last executing test programs: 3m57.262666194s ago: executing program 4 (id=769): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000040)=""/23, 0x0, 0x100000}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000340)) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = dup(r2) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x1, r3}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close_range(r0, 0xffffffffffffffff, 0x0) 3m57.100841266s ago: executing program 4 (id=770): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x4e20, 0x6, @mcast2, 0xd}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000480)={0x9, {{0xa, 0x0, 0x3a, @mcast2}}, 0x1}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r6, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, &(0x7f0000000480)=[{0x0}], 0x1}, 0x0) 3m55.621866167s ago: executing program 4 (id=772): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) r2 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004001) bpf$PROG_LOAD(0x2, 0x0, 0x0) r5 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)=@get={0xe0, 0x13, 0x1, 0x70bd27, 0x25dfdbfc, {{'essiv(rfc4106(gcm_base(ecb-blowfish-asm,cbcmac-aes-neon)),blake2'}, '\x00', '\x00', 0x2400, 0x2000}}, 0xe0}, 0x1, 0x0, 0x0, 0x4c8d0}, 0xc880) sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@xattr}]}) 3m51.361034461s ago: executing program 4 (id=787): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000680)={0x0, 0xd, 0xd4, {0xd4, 0xca2e63937107b828, "4c8f283b8a728a00a144d2d9e77f79f8c26b95c409a05e52ceb7638f2b7bc201c5dc00cca32a3746f97c7d693b91900ed31f4b3fe1a2cacefdd727d7a0ed8fa19c9b4e82104406fcb99472a9ffdced34f76fa0b8743c15b1776164ac7f7a1b019f049c1cec726c902708531f847d2fd24246069dd0a4c585dc245808b5450476b902d1ebeccd9e404e6ba21d9263426ace34ad8fd9529a51861d18dad12a8dce0c05092e7e41fa15ee5ae4748f5138e42bad6de7d5efc772d66145d18e8a126e374fa1b124efabd86ccd4645846449ff0ac7"}}, 0x0, &(0x7f0000000780)={0x0, 0xf, 0x80, {0x5, 0xf, 0x80, 0x1, [@generic={0x7b, 0x10, 0x0, "f874a7e7b88d037bcbedab641475d2d96b06dbe8a30794a1f72a31345a2cb9d8e3c4656d78d60c93b9aa7e236f9c76016f8af5cbdd50c414748602e031891827bde411fc3b6c56b88cb02c4d250accc9789b5262558bc4ab40814a5fd6adf03dd019962e67b3c1c864b146c5d9be1493eda1a67757661455"}]}}, &(0x7f0000000040)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x3, 0x7, 0x7, "25947d69"}}, &(0x7f0000000100)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9b, 0x0, 0x0, 0x0, 0x7, 0x6, 0x8}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x83109e, 0x0) mount$bind(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x3125899, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="1800000069000b0000000000000000000000000000000000bbec2998f8f6df628bbe5ee217ca73fbadee935b6843751fde70aa16927ed793d70cea36f703510a25b3f010d511209dd4b4f1ecc735c418f752f427e03f672c51c2a2fed0936a54080d4e78b9e3d43f95"], 0x18}, 0x1, 0x0, 0x0, 0x4008001}, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000002700)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x98, 0x8, 0xfa04, 0x98, 0x6c02, 0x1e0, 0x194, 0x194, 0x1e0, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@empty, @rand_addr, 0x0, 0x0, 'veth1_to_bond\x00', 'pimreg\x00'}, 0x0, 0xe0, 0x148, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xc, 0x8, 0x2, 0x8, 'syz1\x00', 'syz1\x00', {0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x141000) umount2(&(0x7f0000000600)='./file0/file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCPKT(r4, 0x5420, &(0x7f0000000100)=0xcf5) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000dc0)={0x0, 0xffffffff, 0x2, 0x800, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) syz_open_pts(r4, 0x121500) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) 3m48.270838361s ago: executing program 4 (id=792): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = fcntl$getown(r1, 0x9) ptrace$getsig(0x4202, r6, 0x7, &(0x7f00000002c0)) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r7, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) socket$packet(0x11, 0x3, 0x300) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x410) 3m47.919529432s ago: executing program 4 (id=795): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) delete_module(0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000213c0000001e0a05010000000000000000070000070900020073797a31000000000900010073797a3000000000100003800c00008008000340004e"], 0xc0}}, 0x40000) 3m47.144084403s ago: executing program 32 (id=795): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) delete_module(0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000213c0000001e0a05010000000000000000070000070900020073797a31000000000900010073797a3000000000100003800c00008008000340004e"], 0xc0}}, 0x40000) 1m46.305222872s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 1m25.058911332s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 1m9.412424615s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 46.239024242s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 34.480979034s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 17.80080417s ago: executing program 5 (id=1409): ioctl$BTRFS_IOC_ADD_DEV(0xffffffffffffffff, 0x5000940a, &(0x7f0000000280)={{}, "69fda8729613f3c340c5a036d328da48d859e0d598ee7379bdb01e1131717ef13d4249865619aaf0561bf1ba03f7223f3d5c2c92de58258dd440a3aa1eb069425b0232c09a558f1334030651961aa1d0b7316b498b4614333fd0fb82e1c7a544305134d20ee786ae66bf9a5e46bd6d5b130d80bf72c4a8ca53c1416a5ec4d7d13c2230722647313af33d4e6d3d4d02fe076db7407a1ba596c4cb47951328efa7789cbe4bf025a638748e31b466b799956c89ee3de74d7add6fe13f0787a7768a0951cd7f137b57862206fb48c7429791ec70a38c0639911e3b303647208a4dbeb3460f6fa57ff9e47d2eb0e4b2a2c25407c0b82be23cebc51e367e9a2e35abeda6656070cffbb5353e84882afca092e4acef01f660cf10a8fa34b2e829e45cd8474f094ece98b222a0daedc930532958acdf22348a32f897b5c9ab3c3d0f7f344a17340fbee5989487c81575ba97cdf1297f1cb40a2c04fb6001cbb2636d72e65d38afa9996d41cb7e1a0a46300ac39903e6db295dadda7ec643088039f3e96dcf1140dbe95e50f2f86d2e0062e6e1b8d50a46723ee2bd25b23baf8b44344e598eb2ab4ae1fa06b5837957d7586d3f1292287b0353fb6427f4b541a14da90562d61a6c88d37122c14843b7545c15a1f1bac47bbdd893fb8fbe188fbd479f5dd78e5b18b62eb4bcee7dd868726f0338fd643521b29978b7a6b323c66e2ca21143e3b2f4f2d03d117dbcf8b1f026ef8ee016430921805b97bf1944417347cccc74ebf81672598b3db17cfae5dfdac2254b8856291c76fc194f1fa7d0c8dbf52ed610a0ff0497a965fb5b403f198c7cd6b027df1a0b5127cedd44cb08781ab45637eed1f2b2c7feef44c100379edb3db54a3f3e0e47970de6fe7c9c2c3bb7aefb00db4c6c3142089d3199b7fd0b775b3327c9fba41f340eec25339b184db0cc283dbb08cae1c8cdf6f229b88d46a5e605058bfafc3691f62e45857efb389ffeb27064c6fa8aebdaa9cae78f13875fba04196f56d9de4c7c3b768389ad161933e7de14ea37a20409cdefcd0d85cc0a499d6444459c93d2d34b80b9c46d7c9a5eabb099228112d73fb02b34e4d82c25c6377dcdd1f0db3f4b1a805ffc0039989c7a9731e3c21c9dd7e1bac5148c09b6de5eb8e48e841cabeaaa78e1b34105692880d89198c5cf9c70e0967dd08b826b9e4a3696c9cce241836f8431d9da6d4e376a7d15884fe906075c0c61cdf60419ad990327f0c75382d8a6ea7973e961833715fc9a488cdddf4a2f87d869655d8ee106a8e0fe81f7633aa053fa44f33a1bf7907d3efe0a6205cca274ee4810d3e47ebd51bdd7bcd50dccc857f3f56bf0b318cc623e3aa395a4d2c1ac608fc42c426297b5563fef5837c6586f0eef0f4d7b4927d32ab032c23d9d6e33e4b28910fcfbebbde85a5c7585c22f7f2b7d98ca0158a32c17f0907e8dd988cef9119cc6e9da703ed81526d40d3c67a5e0758626d62b280e983959c34c620c62c416515c4e398e345cada09aaf9966a0d254d1d3a913b5ec13fd45b2d168d928514a26b009a225e50db34a5e47531693ba443eb8257ce12ee88bbb9d1f52002c7de3ca015ddd1780c11eaacf459dc67550a3403dd1e52184fb3d6220dfbf8a22e45e53c423a9829e53c46502d9f8994f2ea9324052bdb71649e00218a1c936fb93395d7fb7f2a7b85c580a5c89d3a9e73ff6c12b873bb6ac22b08a84d3fd118a582a94462e69630ba14d823ba28bd13d488ccb7cda3e637301c3713261d5f7f2270bfb87a9ae70f1ceced066d129c3a2cffcff3add2538a6c5b23c24427bb45838b8c43eb0065e2f2713272274bb1e0e4cf54a3bc49c4ad504d39f12aeb7074e34f4fde6e1da4498647118a63f88d990ec722c6a903617a21f944fa4a47d8834ae5821dc1d4778fa32af9118861ce992ecbec7c00eb453be088fc5229ef77f4a789371647e5cfaaeffd867fbe83ad35f297d1c629ed7754963833b48a727578c8addacf61c2f9e061380590d0b8a386bd52564bdeca481143618930172ba8f171fba2c9dde9df44ee016c2449b104e68d56da7acb72170bc41ac421063e6df0bb435fbdbd8203fdd9cea030d5d79e78afd418b177d4365fe542d2a6285d212aaa7aee9595de1e7437182bad46c0128f1361a46177f3a2bafefd930d533739db1ebe0cfe4b99a77f67e82884af10bd2a74da3a977577c699c69cba9cbf535687e9e11218c9e5c51a114f42bd7d80727153e4342782f09ad6f4897345543aebcbd42758229657cf300fd7b09d466d3fcb4b147222334c1738febc32d1ef10febe3a48985b19b7ff22cd32e63d25f059c5fc0feb94790a76a92e8599cb45df59d98767ada6b9c2d0cd1f6041eeae10dc82ae15bb1550ad21cb10459332b76e4b289b6fbd66d5f11898fc78177db55884e495b5e72511ac0cbddd99bb3e2969b3dcb4b9f6f0489cfa131dbec7c88ae2a5c30aff573ccc1faa43a1bff0be3cde79ccce95106afc100e2b8c2b930045b1f214053d9ef3c1714f83023749a5b9ea2fdbb2b949afe0926f28807f935baa8dd5adda8ac0b57206f479aa609075c4702952ad2e1ead7e1ba880ae9ec064c56c672b00b698dfccb01cf526485268cacd0f94e213acbec269ffa7c3d19fe057e06518bba42af5f4f9e22b9b33aa04c4f1a2b356c7585d32992f09ba312e5a1da101e38d8eec5494de554f7ff7341128a6654d054bde49a21d53fcf0400ffdc3c3786890aa3e56aa1b4cf2b6546a8c2676a4276820337cf9d82cd4e619571b9485f779f487dbce522b2d0911e8ca415d2d4d3c6dcccc2f0ad146fcbb540969c1c6afb664968010ddcfe1804b5163423af06b7e60e5beb90fc5f01b7ba750d176d055372f14d0ef253421518d156bba3beea3640fa7f77ced90b62d847e6b9366cec0ad229d241521f7ae334354a0a99a188e90f12a387e4775f4de485aa1664d52f8d936c5df9671b46b8dc38144e8c1e69701a5ff4c3ebdeb24541d41e5a938ed5c12f6968514a26524eea566eee31791cb83c6b8a2768fac694a13b3b84915822c279d915eddd4f932f5a664cdedad7428ebc49fa7b63a69e8669eb2a4b1a19b17c9314973514a3cf4488663956438bf8f4c8fe8ccc4be695b4cda76f1b0f95641ef3bea5266c901012b8128fb363c933421c28cd2e576515dea3c0825f031b6f3493c59614539818a6582452f4f492b90271e123d39d3ae9d00f08d401153177319842bfb1f66318110510eea083fc208f0a6ec8bb6d04dcd2dc9a4831112c0c34919e6cd0918ea5e83c73fbc850d2a9b8567198d6ca21c0acbe20b1d2b9c3fdb89804867049df1c9968e3918de44c72fb76e4720dba68fdff7b966918a9ab3fa9c4f34e30da00d6e369b66f7af9368b90edc404665b7119db56e48b29960ed4f960e877e147d842603baa4297cc93ee4c945ac3edce98d79e19466c9835a04af39926d7f7466576f0eaef12b7f8ea12009dcde0835cb39e4c82a1643fd54adc84af0baeec1ce9094e670847bb6a2ac19a8a69447850ff81abb5cbf7318e74e76b1b0aed177c3db90cdd170195e96a703f8851a9303528d7e8ab59242f312b18420c14c78d75510a143656b196697f73eeb39c7a8f4f793067739a82a7e8e374bfd8882baddd20d46ef1683e5e03e5ffd2115e615d7ea5fe709e7c0a97e5bacd1001be73a6b2c93ac561d554d582c07ae4c7f4f0176ca8e0d454ddf1a8fbea9fe5edc4f36560fd7d16d1d1510cd794e180a4446b1c0ae562ae2a4f6fa5e7e6415db9bf055685d6544d10a1ee25ca1ef7e30c04705c59a62627e6e5c1a76dfc2081b9f2542b081550b3d72e94f9b79e1164528eeac2d5f9abb8c5094aa545cdac4269061f2aa9af0288a2f18f95b8f10318f0393217e7e27eaa8aa28cd9148dec3a73a05621c8e42fdb1201a9d108d103a3b5168551bd1ac323f808631baf9be603542086bed4056d604ee4af68ba2a20e14199e112730a06d8bca671c12ccd9e67ac59c2e61f5f8be879024ee6701b2590e8a5b78212f2ff782e74c8427a72199398a872b5f5974c5694f071fe2a9fbd3ff2259211e09c9a49ce35d66a06faf1132786a6e67a85bae6e5427e74a51b79a953b67f60693cd05ab01a036238e4c9731f1114fcabafce9f222518c077919f97cf5195d0774682126dc273a8e8c8d790e89374ba3b75408f0b7773a5f3dff897662bff0f940515cc4940473ea5f648d558a0bfc4c2abdc146e348443dbd15e99076e6c7b9bc28a586c2e1b26a48dea6301681a79ef2a43b955cd39586c02d98195378e25b9a08248227e9ade7253c59dca8c0dccb6330aae130ac05b05c19c84d134a3e3717251f001b32384b296aecfecef86fefc7d596de00361dbebee6829d0f0d113e6a10b41b37034dd5a5887419bd5bd33c0ccffdd8f2f09b2aceab2a2e441d8a8decd7ff7afb91fa22a42e1ca54b9b20763ebb0d19f7fcc40ea7ae8a4b0a116f55fabec2d8067ea665719db51317e645c813daac1c3ef78064838b7dad2816e93a2a9206c1b2cbdfd7a45a2a05642f7489ab10be3e8c297f66863ad9e84d8aae1631c4a956dfc1f6f8f92c4e65c59915f0c111be69d9b4c1ed38777ec19c3bdcaaa255a0664deda6b291c2e17580dc4f251f0109afa5b53e5459c71f66872c4731f1651299f1774a7558d849373ea62963b0a545976b678517d83b7172bb44fe2c561ebcfb85db00529b204068af05f4c9274fbf3e19149dc75b5af9f091e066de07b27e30f6ddc7669d829dbca27129af7157d1d435d423dae5efb3c5721267a4d84f0f7e5f34bb84e93ee07c26b00adad4c2dcedc5f21dacc4a23236436cc261269c36c771040f90d88e195fe72883655eb946630ce4e5b827daac3f7e801764f80b5d8358b31f37961cb4f824436642befffb45d8d2be79d388494c5e854d8e435fbd919bf2c9df05977d4252bbe25671d022fd7eb71c58a093c189cdbbafa9cdc6ccc00a0fe85039cfa96fd2ec0687978c47c2b7c9e52fdc8b4fe69eede3b38d3037d5c6d033cae1c2c5989dc2cffe960a55ca012bd68864d25eabf72f9f69c51d69e99bdf51d48c55910b8eb79128da2765a043ca08bd6874b0b74f66cfb0f1ccd6722fcb8ed6a6019b0072498f69824347db049c549784259bf13584dcb3a795e9f9cdd3cb49074fbc6c964edddae57320302a54e517aea17bf3b654f7220ff3c2f8100e3d4707b1a0f12ea34c9a36bd6a470d9ec2ce875b1b186d0866ed7612c48d764aca9b30abf4599b51bc1434e5d45083f3eddde2c04b0915bec1531aae7af6e7d2f56297f02d94e78efb7c395069a59e6ff1617d9fe27763b201ed0544a8297c252c9de665b6e9600383b37469e2fbb79a746bdba77cd176cc2621199e5e0a9e97a19979f690a41613779ec43b7eb3ff3646c9f5cbbb13134be8f1b33f51258c0814dfa4b33814450d20508b7387439e6dcc8a4bfb273d375b52337e8a8da39dea8caa8059ea41938e8bdeb1fb7c7c275e2fd8adb568122cb97b80ce94ed39524f01ad7fcd6cca975ee88d58ed3d555152fb938478c267a1947b33f9927eb60b2ab78037ff0a1b09bb2e1e61bf31ec1cadd59891f1a242e19581444cb4ee6114d4f550411517bd9986a7d84547f6fa519a15b07af471666bf2f69453346433954f88c70cc33c71c91099a615e78c30e8f57fba04ca2660f1a9e012087027dab9ae00d9ef86efc9afe72750965ba7b51e51ed44688295357987787bced1fd4baec6c21a88809fa11"}) r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001280)={0x24, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00030400000004"], 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 16.526284192s ago: executing program 2 (id=1111): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r1, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0) 15.344691778s ago: executing program 5 (id=1417): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x48) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2, 0xffffffffffffffff}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000680)="76389e6a65585578f830e9000000", 0x0, 0x10001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c00000006000000000000000800000d0000000000000000b70f00000d0000000400000006000000050000000d0000000500000009000000040000000500000004e500000d000000050000000b00000003000000004e71612e00"], &(0x7f0000000640)=""/150, 0x6a, 0x96, 0x1, 0x0, 0x10000, @value}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000280)=[0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc3, &(0x7f0000000400)=[{}, {}], 0x10, 0x10, &(0x7f0000000440), &(0x7f0000000580), 0x8, 0xd, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x14, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYRES16=r6], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r7, @fallback, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r9}, 0x10) syz_open_procfs(0xffffffffffffffff, 0x0) r10 = socket(0x2, 0x2, 0x1) bind$unix(r10, &(0x7f0000000000)=@abs, 0x6e) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') preadv(r11, &(0x7f0000000300)=[{&(0x7f0000000340)=""/190, 0xbe}], 0x1, 0x2, 0x2081) syz_usb_connect(0x2, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000043242108d81301006230010203010902120001000000000904"], 0x0) 14.091703018s ago: executing program 5 (id=1422): r0 = open(&(0x7f0000000280)='.\x00', 0x800, 0x104) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r4, 0x50009405, &(0x7f0000000480)) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000780)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fcntl$notify(r0, 0x402, 0x8000003d) 13.037778083s ago: executing program 5 (id=1424): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="120100005ae4c4aa139e278e7d1096050100f5050102030109021b0001000000000904d60001b5e14500090583"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000027c0)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="400012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0xffffffffffffff91) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000080)=0x3) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000003b00)=[{{&(0x7f0000000180)=@rc={0x1f, @none}, 0x80, &(0x7f0000000280), 0x0, &(0x7f0000000300)=""/50, 0x32}, 0x9}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000400)=""/233, 0xe9}], 0x1, &(0x7f0000000500)=""/114, 0x72}, 0x74}, {{&(0x7f0000000580)=@isdn, 0x80, &(0x7f0000001000)=[{&(0x7f0000000600)=""/109, 0x6d}, {&(0x7f0000000380)=""/18, 0x12}, {&(0x7f0000000680)=""/50, 0x32}, {&(0x7f00000006c0)=""/168, 0xa8}, {&(0x7f0000000780)=""/240, 0xf0}, {&(0x7f0000000e40)=""/190, 0xbe}, {&(0x7f0000000f00)=""/108, 0x6c}, {&(0x7f0000000f80)=""/65, 0x41}], 0x8}, 0x1000}, {{&(0x7f0000001080)=@nfc_llcp, 0x80, &(0x7f0000000880)=[{&(0x7f0000001100)=""/210, 0xd2}], 0x1}, 0x80}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001200)=""/26, 0x1a}, {&(0x7f0000001240)=""/41, 0x29}, {&(0x7f0000001280)=""/27, 0x1b}], 0x3}, 0x6}, {{&(0x7f0000001300)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001380)=""/49, 0x31}, {&(0x7f00000013c0)=""/147, 0x93}], 0x2, &(0x7f00000014c0)=""/176, 0xb0}, 0x23d7}, {{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000001580)=""/12, 0xc}, {&(0x7f00000015c0)=""/223, 0xdf}, {&(0x7f00000016c0)=""/165, 0xa5}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f0000002780)=""/61, 0x3d}, {&(0x7f0000003cc0)=""/108, 0x6c}, {&(0x7f0000002840)=""/4090, 0xffa}, {&(0x7f0000003840)=""/143, 0x8f}, {&(0x7f0000003900)=""/17, 0x11}], 0x9, &(0x7f0000003a00)=""/236, 0xec}, 0x8000}], 0x7, 0x2, 0x0) mprotect(&(0x7f00000ff000/0x14000)=nil, 0x14000, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, 0x0) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="02"], 0x10) socket$l2tp(0x2, 0x2, 0x73) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x1, './file1\x00'}, 0x6e) 9.431522331s ago: executing program 5 (id=1430): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24040084) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0x0, 0x5}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000d00)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) setpriority(0x2, 0x0, 0x7) 9.121442853s ago: executing program 5 (id=1432): syz_usb_connect$cdc_ncm(0x2, 0x6e, 0x0, 0x0) (async) syz_usb_connect$cdc_ncm(0x2, 0x6e, 0x0, 0x0) syz_usb_connect(0x1, 0x798, &(0x7f0000001d40)=ANY=[@ANYBLOB="12011003e13cd40065050500e1a8010203010902860703085000080904410a0a5214f92109210600000122f5020905010100040a05290725018104f0ff0725018007010009050b0000020569080725018200090009050b004000020501072501820101010725010306060009050908000408010907250183032503090503102000fc04010725ed0106020009050f020002ff09fa09050610ff0309040309050a0c0800400687d71163f1a0bf6cc74918c29471d4038bed9a5c118cfe0f08a922882d5b0b7d60bf955e352b38868e5b34c0c54c71c647c5751929bf5c437093b38da99b745ebc8d39aedd791fc163083b95dc53ed70313469c95bad5eaaba2fca78182de3b0a41cc666f6e197e0473d3afa7a1f4d12d38504dd47b4ac4a5e3738f1b42be52b3c91a786fa340ee4f7d5619646939814ef53428f0b77b3aedfda4cd0ad1ea53c88faea6eed3a6f55670f5a536b4fad72162dac026ac4522dfa9aa2f435b091a48f1adb5c0c50657ddfafb3565c38a8d2e8618265cc2c2e6809050b004000900f00320c54eb47935b642d72783a7a2566fbe4d325f5937496c0d4b77dc5a66b91fc57d3ef3ac48332708acb075a2005e126481a09050000ff03022309f30036f3778441cd018f8e2befd429babf59cd1dafce8963caf5d3cf56c2ffd1593a0eabe8d628c919ecdce7e670b9ffaaa4444027c285b77c880d438f635c231a0013007c06d00e74d22a7df87582c312914c87ab2d797dfc14d095e2aa1424d4232aa0a54d1f76ea4ba1fa3e863896b6a7ea2ed680b68f283353c584f70c84738174ad7a90b9dab604826bddc71b918050bc3e2312162b74de6102bc9197841126580e78b111713d95f3a7971d8349fe1d85de8562042aaa6f4b29d131bbf1e704b463c4c847c3f8ec6fea88a2620bcda15965516c87bdb66bb4ba2a1f71aaf7b844366393461013b418e7d116785712736909047f600b460200c50a2401d300fa0201020c24020201010602000804020b240701020009d8bbdfa70c2408060100038b24372cde09050c0008000359c209050301000404011090010d0b11c6fbb32067d94df04713e6cbf5602cca874849b4122544113f5e82c25f8101e0106f142ec5a2a89fc547c14a34f32e24be327e9bf0ec648b292a940e9ea528b904ae069f03e3321a7372404ea3d1b7631b4496d03f1ff5fa37950d238c3888fcd184aea84ab7a46db01a873aa0fd8c46c06e9c95085300dba4a89350e3f0c8e064b4fa4327b972553da5170905051000040400bc072501800121042001ec9b0f6c0b2e5c7ef0ae7cd28afb42a988fba3fca9d6d4f837d406a5027709050a0010007604f809050b0040000907fe072501010701006d044e6648bac11920c5fd3731b5c078dd99d7dab190f6894dc15696e97d49c17aae6a1ecc6950ff0b90ececc099cc71a137268ff6527c93084157f2982cf65a4b7407bb06c3193d489b35fe44f8fa0a57dbd25a27541d6e390f318e483e24545a50e98d3418d723013ffa6c9a09050e021000d88009072501030a01f85c080a0ce7baa9c46ab8c49790278192b39f7297e49b29092e907ebd63a9f0272ababce33d9703e84fefb823931c6a8ac9fce1c8433cf81be8333915bc8ba298e7be4712d02c34ffc63ed2be834715a1c73b09f1570940c8c1702f3e09050b10200004c409733eaa7d4e2cb0800c71fd5cd5c8911449d7ecd7b89db0873665152416c8e646af0030e59ad2b8e3715439ad4a97feee8af546cd67a3c13ff0734dd2df0e6474504b2123413b635c893bcbf14977f4ec24a65202ee872dc73b4de31e1c5f9220584d6cf9fab0219f13b0a5a28d2ad8bf9b206f07250100800500090508000800ef4f0909050a0c0002a6010c09050804400034fe060725018008000209058000100009011009049c030a6a74154009210500030122310409050401000208f48109050b102000030c0f5d2482b492f547c3297f4783254d4a33b06435343f1ddf6f4513adcb3724e778511539135505d14708b96ee1d879bbee67d0b7c3f2819fda8f95fae2b4dbb24f78b07d2434c0e6d6076c0e525ce6189ba472336a16bb00440f9a8b0f93090504000800040708680c36ef78634a49a0b3d723c666edf76d261cc9cf69f61615e12e448ed1fd9cd047a55919ded14eb31e4c9df7891c9e9b6813d6de4e861d8a78234367cce0054f335a8f7e7c7437ae152d6cdb3cd91e54a5db6ac596149f22e3514033afdb6a0e74678eff04071fb924b7200004030630090505001000040080072501030905000725010207da0809050c0020000308030725010101050007250181000800090500100004000606590e3186449718441e66c71f83fea6a7d48ad864047cb5720990d7c837f7e17c2979a772df10dacf8b561138103f3c5945990d79e711296bd3bb1ab6381031e45897daaa09bf5779c560aa654069821cbfbcb0b052714f44a107250100ff01040905070110007f1079072501010205000725018203cd0009050f0310000b02097330b14a15ebc8c691c0f699641b64e9862e6b4d74a9bef9928930883459ff12b4b8beed36fac02b03a38db3eba179709388b1aeec07967bbb92153dc074500040b3e22f0934951f37d42104b753d8396f7dcf365e13ab4c926fbd5c53ad0957e49673246b5b2d065dc7625cd7b809050a00100006ab070f08c31749562ec291e3367bc17cc9a93ca279e3e54e9691e6a57a4183ea0f119076e3fc7a3ba87e8b6802470d6770f34be9d10053108b24"], &(0x7f0000001000)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x300, 0x9, 0x6, 0x8, 0x8, 0x4}, 0x8d, &(0x7f00000002c0)=ANY=[]}) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_io_uring_setup(0x831, &(0x7f00000001c0)={0x0, 0x469c, 0x20, 0x1, 0x361}, &(0x7f0000000300), &(0x7f0000000580)) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000280), 0x26) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) readv(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r2, 0x0, 0x0) (async) read$FUSE(r2, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) eventfd(0xffffffff) (async) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000005c0)=""/87, &(0x7f0000000480)=""/74}) (async) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000005c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) unshare(0x64000600) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc1"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc1"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000006c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 8.656782011s ago: executing program 3 (id=1435): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) userfaultfd(0x80001) socket$xdp(0x2c, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x7ff, 0x100) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f00000000c0), 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x1a0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000180)='usrquota') chdir(&(0x7f0000000280)='./file1\x00') r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r4, 0x0, 0x58) unlink(&(0x7f0000000080)='./file0\x00') ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000380)={0x1, @pix={0x1, 0x2, 0x584e4f53, 0x0, 0xfffffffe, 0x0, 0x1, 0xfeedcafe, 0x3, 0x7, 0x2, 0x7}}) close(r4) ioctl$VIDIOC_LOG_STATUS(r2, 0x5646, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) timer_create(0x7, &(0x7f0000000040)={0x0, 0x39, 0x2, @tid=r0}, &(0x7f0000000100)=0x0) timer_gettime(r6, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{}, {r7, r8+60000000}}, &(0x7f0000000400)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000340)={'pim6reg\x00', 0x2}) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x3, 0x0, 0x2, 0x8}, 0x0, &(0x7f0000000280)={0x3fd, 0x0, 0x0, 0xc, 0x0, 0x9, 0x466, 0xffffffffffffffff}, 0x0, 0x0) 6.451373325s ago: executing program 0 (id=1439): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x6, 0x0, 0x7fff0006}]}) mkdir(0x0, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000009c0)={@in={{0x2, 0x4e24, @multicast2}}, 0x0, 0x0, 0x2c, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) sendto$inet6(r3, 0x0, 0x0, 0x20000841, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000000340)={'sit0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x0, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff, 0x0, 0x45}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff0000600054000"], 0x6c}}, 0xc0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) sendmsg$inet(r5, &(0x7f0000000980)={&(0x7f0000000180)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000900)=[{&(0x7f00000005c0)="b49586d24365232b71bda2fcdb767f9b6547cdbe7d9a0783b5a4dd860bd2d63ca7392854bbdc41b331fe9cd106563d26422934e023a0f1a86777349aaa34333854f8c225ea7b75d3324d9aada824", 0x4e}, {&(0x7f0000000640)="6428f8f86ba6939ab216c315e38d52ac9499c473cb0d4d9437ec3efc1a5251b5d862ce989e37018601eb4b09c65afe30069d2cc500c49781076d41584ab9d490b8815405b7a168934d6f59890c53c3098e61214e5e6f3bf336014ae0d386ab7a97dd6172d2a71275d2340e65650f83eb32842720a52bb223621f04b36b21f591c1a7b6054fdff625d881db73fa0d04b9c587dcf87f673b0d069e238671550821afd0791f1c6f04bbeaaaecfd8e984e861025149f0bb0f292687f09e33254d41baed58510aeaeb125e15bd85cfd1834426f31f06fd6bf669df6cffafc221673ac8000d962a739039d7792507fb0bb26", 0xef}, {&(0x7f0000000340)="9dc6b2ef784279aff09976c44b4f68502717c9ed042f0a4c9a0d65137006ed8e6523ac0fd0d7b71d5b37", 0x2a}, {&(0x7f00000003c0)="2b35fb9d1a738ae595389f44bfb0f15bc4b710", 0x13}, {&(0x7f0000000740)="929731bf37d72bd46c8a01c0b3542642cb68c8c2bd061887b7a4b4769bd9692c196a734081a4817eee4e10c1ff7e180f6f60c294de7589e96203ed356fe486e6", 0x40}, {&(0x7f0000000780)="3e2ba5ba598c0f0bf2a5b310646328f8313504ada32159fb410625897fec7579b7ca8d2f17aaa8d0f366ea191bc876582be91ed97989604f66699b35ae20bed38c8ef7384ac68f63ead7a13e94f3bc8770e1cafa53e2072c2b5bf2d4d02e46ea3c21e130bc8bc6f1148b8bea943afa0398437b80ef29cd1e575363ffa450b4c0c80a84c89376c4af3c755ae1c4673116fa1ae404e7c579e0d63b938d3af45fc1d10728118d", 0xa5}, {&(0x7f0000000840)="d3ac0b002b2fc475b53e282e0decf14c548ab7795b27bce4310aa69afdd63385f89834d329e8f90f6559e20c5e0dc082c4e59dcf9c16feb5636f662bd587a709dd6f93450fbfb41d890397870fd19ae2a9867249255c0397aed2da90db3b18dc50030883bee84489918a356b1457bc16a81f6bb3d4fbe42f66728d4f6778b1117d950bdc2be77fc3e910549983dab4363214b5488857bcac5a76caf2602504f82cc8dc6dddc09690079bf45d47ceb1c2e812f846694617", 0xb7}, {&(0x7f00000011c0)="94361b4973c9d4e26141b3c7541f6c1895db3ec1448c78f1830a52d04800a1bccaedd5f74b7defd172806ea80b9f6bb5071361e2fcd5d451156591b7f99a9504fe1658bce028b65b4c413cec1a401da964262ac143e8e9c41be2bf91ccbb44af3b4b448199714d2eec5fb35fc534778289575623bb0daf965ee6c3a12b72be56f359d0a95c29d2ecfc66bda0460902fe7dcc3e458e959742923f55e0976c3ae53b47d122fdd0de46a0e6d40bf23c37f3928a813700cfed833b4915561903c169b50ad79f597cc9fc46ae7f3cc4a7ed6c8b14070c2d28ac56fe38f6955bc0458d92d388d1ea7536b02cc5b8e81a518bd0ffb45563133968104ec22b6566d4bcad554de957daa4679c225ca9923e4853ac2338577545b4cff96ce02e29410ceafa47ad86e79238f3620a9fd3c92873eac09544763647b2e68a0620a12c7c982e63ee52daf046e7ad758fa9594e3e6a7b60ff52f860e90b83a82f1c6f83d65762feda21b1f1b2587374afb01cb99565ffc02f2b74119ff0c4b12d90af68208e3efc4a1dcd1bd2f7820977224df5b8258da35bdb1e498a32646579375b1d6218102a100bcdb7fd6241a342be6f19554daa63134834c36f515a96c0fc0e91ef2447dd8d8f61b5bdf967215765320e657f5ca375141797221e6167cce2c57ef227175497619cae150a97409c0ef8aab2e4c3dc15a1a522b494fba8fa5222bc80c9246560dbf06d40633c70940daa6feef85ef21869a5a56e82c3d350f7578ec1a4bbe0fb8ab00986c249dbd597c8aeed2a1d3f94ca873a1ec44da8ab93f7907583e9b5b2f5697b2e737ac2f8e4e138bc833322c036208cb32ffaa5bbf9ef716de6df0f971b9c6b29bdede4eae3e4c4a3436ff7d919e2f67d2a4af77f018064ba3721c9ae0523c08f8fc137319b39bb078b43450fabffcaf0a649976f08da478f4e2a8cb9b397fe71418eb0a7b523755e7fc174503acc11a0e6275d85024f3bd59afde6ae58cacd34bc8047f5735bd3c566a6d034e3b31cc26c8fc6081b065d8124d54ffd45bd74c0f40a5ece8a820b87f4269420d6a62b43ad4d2a80f1ee9017edc9ff24e7c4a2f392db9b8ecf5d14f9b7bcb7f0e212f03d2de778b9a963c373af6114fcef09ff22387f0981d0331c35af1046f50396de3233194813cc2d236e32b7af131c9c72af54747a6d637c11e10053e96a07597db49784c9852449480c79308870aa8dfa301bcb1c02658b2db9c0920247ef90e120f8b659c5180c25d08d3db7a45f00742e708d549652caa9d8a5f7b70e243b6a727519c758d3c8b55336ef3197ea9c45b29e1cd941c95718b10bae29dfb213800af5e9bdcd1639faccc07d9c95022b7f69145bd60da2bce5a1d45b2d11236a6abdf96dadd8a5db7b610462f0ed02fe8614457606e95611be830ec7302a1b8f48a6255a839529a7e423971f36a0ed8da48d855090e8ef0b44ddc150dd4858aa33f44d299c979d604c38409449475297d0e9a54e3eddebb7c942cf53d62814872b1d84a04ceb464e26434c03a8a792b1abe9ca74b5560b77e008320fcd51b83f5107aafd6ecc8f1ffcda0566b3c45a7599e0f10718d72f9438406b6b49f21550fc7df3ee1b135af44dd275a18e8df8f816a46ad38cf08ec6f94fedcdd1812c991f387c1938e88ee3402cc15baaad78a06adeed3812ac3a0b85398659b067b8764f74ac44d8d2303ac4ff911b45447b1e3d3df7dad3a1b1dadc3d3cb856b677f9a9aab30bdad88e06771cc29d093334e3f9f97e309f491160e307a54a729cedccef2c5edde60fc39da00cad9b81e4c21a018935d50139b99f0563e50b70716dfe2e8ab4e3d693382be0dedba8ff351226dfef74951e10f27026b3de10c92dfa6e5a3c796b5759e44938ee181f501ce688482027e26ed66e51d51a69e1237e4ebdf55836f5f4a7449c8ecdd23133b5165b32e4e2468c3d29a418b497bc5795d74bb2c6c86ac1c23bf307e7a1806838fb147234fdfd6feb477629fce3bc979123d72b4abdb2e7581eb2352c079de0ee1e9e4974acf6879b659fc44180abc5b206f5540162b7bd37f58218fe6a0fc95af5b3a66a40c9463e5e5ef48591946234d45c3e35f4519fecadd7ab6a7bf35cb6b7eb271a3708a22da338de1d1479ac2e6e9f566f1346897212c6b41af6d7e25c38337e8e49371eaf66dc4facbbd77a33f84324f773f2a21872b36cc6e081a0729cec6842e68bf0784f1dccb43a09b9229f7de3d85c226dc4ec6ed22a16cffecc2b80839fb37f54ad6ba3cc47b5494a6cac2f2f6d7aab78987e52756c3aa081110cf24b7ba9c6dde4b28879501eaf798c5f4950800d7fde299e76dc5849e004a92da73557150647ad790435d73b78a87cbf2732f7d549e9b53a6db976008b642a43cfc0f5be7308f3cffeba673bd5ef992d6fa6f4711bc217bb627acaa8336f2027a0d646097b8eeccb2dc2846ab302dfaaf2319a585bdda032ab3169271f215b2deb00a90980422eb3a72698374d758950d624a4346ff13110e464a078be2624ced97d44a725f2c37e97003b73a63f9bd388a82bd2210a4fe92bdbe1c7011bf55235801cd1469454f34ff1a87e3738186c46971c4ec1637f7fc73a8f52443cee0698766208fb6c7e25d0757775886beb981bade17d998e184b0bb07ae3362d0d86adb864427ce5323784b65a78aa11ee103b7d005e7f59160f936755f81de58cb23e39c5152c8fd19ac42abb69130dfe1887e4aec36d602cf6b2f24ef78b958f04074759da432057070f882358240ab2e83827f6eab31a4d8f5dcb8c996f8a05f55f53883afd59ecbcd3161187ffc9476cda679eb0cb3dc9dfd2156404d2ecfef41d272e97c84724175ca81425bfb145325936be5bf0d860e0e8d32e36183b9328994ad09abb0b56d1d525e44b3e702d1923dbe0fb645ce84597966a4b3c01344e79f3e8f4195f68aeddb16c762a36f052906b756d7033412b9eb96c9bdaedef049360ce25f1ee07b75de44e08fe72aa8d5d0789a8926e7e45d9ea6b4f57e5a41f17a9f6189b48f5f49bb86b515d6a2650aaa42b57e59458e6a34a97dc191daedb797d648c4ff8a934dc48a15eb23f8409961695e882f07c3f6cef408b68df397f9b27972d181acbcfc3faa89742f741be3375c20452db9faa7c7cc2c4da3617a533b3d1bdc897cdd609aee93c12fcea4e45e060081826f763992c5ff28ba8f6efa1327da5f878b7cd15aa50dcad4fac252614fc78817d8192d1d3a9a089e9f414f34ff43164e3a85e9a500f0325b16803ce8dbbec5dd3c6b84b9fce18bb5f98cdef69e55b89512816071c001e4d1cab2680144c44d1ba9114df46d98c988564dc533a74f5af9ee6e95237f0ba10643dc52837943e1723ffeb1cfe5d0c2f2340840aa1afaf9b55ed1645155d128ef2b82dc7427c1722eb3120cf7c7f6d6d53bc5bd1c67572eb3a88a7d74bc8ce143189f47296cc25f0ce77706e6c9be59aa0461d7ff81f915401164cb4e464c8f65477552c7ca531bc3066d77f3edddfc44f7dee7797b83eea85132360d6f56dd5c946522334125017dfa7613d5ea606219fae28870af58c97e9c1bc8d549672008ac07ed450f5ea05246f69c063a1dc713d53b36c80ee3f99d885911af52bcdaa3cd12c3cea3aa84cb173052a27e97e8e2aa7c85757c7b9454a8f9acf5d26cde203cb73358d1ab0995231fb2b6b20d30a4b10c94eaeac148cf5d1edbcf46c983dddb8be12129564cd107ecfbd806d09f5a48cd710f9d250496df4d41101499b7d5d3c6460ea9c140b839b85acb0609a14c3413120b03695778b990fd23cf3a9a35ea64dc64634e6a62c65266044e7a3bc03351d5541bbbe14f785d555bc749958452da32509a0b200d246f0362033bcad9b738ffe23954179b125018fea903b49eb9f2893a2ee9ed3426bb66ef7b30e8b83a5c0d088c06148c11384a9dfbd5846a6a8453f1df2787d13282dabcedffe523a095ca66c7d0e05d1f4336369fae3d3b2fb87292f84411b3982010eddb90503c1e205e00da7033f19877cb31364fc7b7878eca8b85fe0e03dad29c72e4fb276d9f26ca5b2321329502047a57c48ce22b67137dd4a272d920e88a2c06694f58232f2ac0d0743fa48756e191fcc8492bb5ea85a64cbe52f2410263f73df1905fb162a2ccd454626663399a2a1adceadb6c0eac1466df4084f089f7956abc98b2f083bf9873b3be4858d16b75e50fef707fac95e55e980d2e113e2a1d3b2c9a4bc99ca3845d5b83c07eee98c059333c2ae66c83bd17a3bb82cabd2f47e0f58fd8e064671ef0915d9d85be9420236c6c740147817569cadb12fc03181f044c557f98dc4283d5faf47799360dd121096d652c98f36d94b9d393e6ba973714148bf3351a1721ee16d6fc62e5ce3d8034a8ecf4a13053af35dbfe2e77ac5db5a1a869b2aa100f79e45f7caa1fa3b7d5da1503c3657c6bd9b9c383899b9e1ab4758ba0b766adeb7cc89c10517a0a297ec333e32535e2e9647af8fabbb7b9841094b12bc6227ffb22c852b79b4aaf59d9aacfb08c6895fb9e8f6df79972fc50ec281d8f9c6893870f28181fe21f65c6dc2430769e7c64d0b1da009f4045cd338cb5af49c94d1d957283ac940d5e8f3a21d4e4701f9fd2a23e2e9c4bfa273953c652d4785ef98e9eb0810b243c6baa43171b8fc5c34540db723f0bb063e824987e9da83cb7632cd59125bc1a8b595873e65de1d9d2731e931de11af1abf8396fd46cc4472c6598e5a6e8c16eb636c395e017c92aad27a35150d7f41b131e5cbdb8c12d512740ae48dfb54a680f56b24a498b3612c446fe01dea16c20bf3cfa5095d5cf38a4592fe323aa9a10a2ccc1d4aa62a2c6c07fd930d3c0da5fa8819ae7f51f2370014593f3b3d4befa933382faca505c68b354fd0b7110d656927dd7124ec4c22d4fa332e12ecfb20309adfd4415790a38e6afe6682971f138f86c4b7c201b8c5395c94d3554f17e87f631e7c9fbd5e155344ef36a43c575eda66155cd3bc22495d2c25cb7069084ff8594515430a13e4076fb1de56e01060bae340104ffafde704972edc48f20776481cf5e09a85e1e27d94d488b7d9e43dd58b57693907099bb7675f76beea1a199e034b892a30087bab3a012a089527b9c1bd58eb48b6ff0a98f143693e2be7579d9a74e701a15353ea8b8c61813bac8367b2775b686af0aceef06cac40cc318f566bd0e1b6a034afbd197c6b4ad074e80db39f3d5e92665d7e0e7a1c747babd4d3576bf1b2cae0c181141a933299fd2dd623f8138ac72ba1f02c35466efc09d70663635acfc63d88592cc1f0c9af2533b9ea7b8a1b9a119c19f848b5320c59252b2f285ba3f640ea19988a2a1b04dec3a4fafb5f86ebd01a777a44a1622a68d112855cb2f67fb82a10e68cdfb3674981e7271f54d7c4e20cab90a721d0d8610e81b13fadd2930267cfcbe539fae8fcfc7aa5f02eacf47a7d764e6d2bb0f2a32512bd7ff986884e0b95b4928358a8aedabc129987ee58788d6b4324ec3319476b7f7c618a5c00b25b3eedfefb8d2fe6ed951fe3fbd0dc241eca1d58e673dcfc5538fd39b5c047878dd420da9e8b527c4c4fd901ce2883e5a67516a8d6dad6e6604c7aecfe3edb241030f8439029f3bc5c05b822467dc59ff2368cf8a88f87407d2341489dab3d2858e55f0d533184bf14cad5096db82bbac7ceec2bf42b72512f608507c63046c77ea4178c55f140b153ad44dea8ad952d41fe73d8c66867f388f7dc2aa8048bb15b50c64afcb2708fd1f9eff6819f43a28d2543", 0x1000}], 0x8, &(0x7f0000000940)=[@ip_ttl={{0x10, 0x0, 0x2, 0x7e8}}], 0x10}, 0x28845) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mount(&(0x7f0000000540)=@filename='./cgroup/../file0\x00', &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='afs\x00', 0x8800, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0xfffffe00, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @desc3}, &(0x7f0000000480)={0x0, "6035ae1e0fe721441705322225930e6c1e3e2a51a92fd796bc34d7cf6e0236805b4377f7ab1a9b01c103a4c6a7ef54e6763fd7264c39ea00c508ba6062696138"}, 0x48, 0xfffffffffffffffe) write$cgroup_int(r6, &(0x7f0000000580)=0xca8, 0x7) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') 5.796280173s ago: executing program 3 (id=1441): syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000005c0)={r1, 0x0, 0x0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) socket$unix(0x1, 0x1, 0x0) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0xffff, 0x20, 0xfc, 0x2, 0x0, @rand_addr=0x1c, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x5, 0x4, 0x1, @rand_addr=0x64010102, @local}}}}}}, 0x0) 5.502050336s ago: executing program 0 (id=1442): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000049500"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) lseek(r1, 0x851, 0x400000000000000) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$802154_raw(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)="29145c7eda98af7f521d1026022954c46f12a7ec5376066983da152da022cd5ed3f384d09a8461f92d60a1a1d135fa07fb34972882f7a444786243e744bc709f34feb668e08b8b2b119603a6a5d1cb125e9bac26a0c9f539973053401144f108d962db1e6ba6f31504254f29cebaab6d58207533b15e885296e8a05599793f8323ee62a75e9bfe3d3ea8be066c60deaba09e02ce9a9d958af17cf4fa5e5564860f64f445d166aad5bc1f4a80c333d44b2970eb3ed685219b689660625b7a59527dd7610956", 0xc5}, 0x1, 0x0, 0x0, 0x8000}, 0x1000) sendmsg$key(r2, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000b00)=ANY=[@ANYBLOB="020300000b0000000000000000000000030006000000000002000000e000000100000000000000000200010000001c000000fb1800000000030018"], 0x58}, 0x1, 0x7}, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x2801, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xb3, 0x20, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x0, 0x3a, {0x9, 0x21, 0x8c91, 0x6, 0x1, {0x22, 0x983}}, {{{0x9, 0x5, 0x81, 0x3, 0x1bf, 0xa, 0x4, 0x3}}}}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x310, 0x7, 0x6b, 0x53, 0x8, 0x6}, 0xd1, &(0x7f0000000180)={0x5, 0xf, 0xd1, 0x1, [@generic={0xcc, 0x10, 0x1, "75d57f8fe8e2704a99d5a23cbd4c9f6b8e5fc27e12ad2e81470f192a8c1632d97c6f09e907037151e5eab24dceeda56ad82023105b3312c7755d24aec5ee8da1b53fb81d0690807fe18a0af2e8b4e4249fdeab98ceb778a6e8d4f243ef41ac6ff6aca9d3bff57f5cdab584427b0532ec4f092a5ce0c751c9cb9880219ffa8d7a74924928b53fd8f5166d104abf9b78027933f1ef38e4130ed0ab37f3a5c2e6b71446dadc768d73bc8e798a8e0663e1e6316c0134b8f1e348d6b7c9412c5b13790873e6ccefed9bba94"}]}, 0x4, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x140a}}, {0x48, &(0x7f0000000400)=@string={0x48, 0x3, "9e21c3c811b875fd3d7873ea359b365ad4e2e7becaaf36ac7b6c53106ea52bfd57256f75770d610496e3911bd4e763a7205863be9a15ee3de2cd84b3e0890ab5d50383e7d372"}}, {0x33, &(0x7f0000000300)=@string={0x33, 0x3, "ee41e6c2f43b93a6c6350d6af3c799dc318715ba6700ac39f29f92507573a1b843adcc0f6a6310f1ef5b0a5b607b781251"}}, {0xbe, &(0x7f0000000480)=@string={0xbe, 0x3, "08bb16a37bb65cae21225188e6987c7201857fd1cd2962c12856983bd4bbde43ecc942aed63824cdf77e2ec957f548cf673e37c287197bf350518ff4b3d0d37e5fae33bc30f99b94ea5537e90175c70bf94e66129676b335d8e0a88271bfe710477676c10d0e4b392a2e9ca27c05cd29b41c25bc064ea08a2374311348bf171150a9fbe860e146686345f24efa869c3de40300f4741ff6909c2f024cd8cabf21423c5af28b4760fd2150ca3c3de2e97f3d899e7363d25a0447066933"}}]}) 5.434289732s ago: executing program 3 (id=1443): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x7e00, 0x0) write$snapshot(r0, &(0x7f0000000300)="5c09aab66d4ab47448988fea841a08698c9944b9812972156e78b40855d416ebc74e7cec00cc55459449da0ac565b4124ed5e15bc14c2bab0cbd2e39016f6a42a2e117c49c8659c2991eca8608225c46f02b66b4f3b8118c5355cafc57a2976de38355f0eb9cb8438a0ec0616f2bbffb616f61814ad2a3b477e98c9f0ede308b49f1737a15c8612de9f41cf649a205aae6e06a094e1c183b53bb8168cc34035982b50405af9f3318c8df3598ed475b97cb77bc13e4d9ef7ec38460be97d664c3d4f388cf1eaaceb06924282d36e93b07684299624bda6dfd177228188359bde38e122cf77410038f4a3499ea97ddeca3d435348f670e1df2945197c7b387500d0eba51a04eeda0c78693848bbf758e1ca42baea149cff1d8a91bc49a563f363167ceb66b55cb9d65d7f8110dbcf7b2d726f5859e571e9122ee6337905cd1ebe0de5223c70b38ec6cc9d7fc3c9e8a4010f8dbf1153935914215a54a12cc227aaa96c22c075634e024ccce8652bfb25755b732263e5855bf48eb0bb1f16e90f2368d49ab94701176d667bf2c618bd09bc78870f1ffac671739f1ca6f5b3aaf6d2fc80da31e84f24b2682af4b5848a187c221108263f89e382cafb175fff5d1ce5ca123b7a8a56fbcb0e46173a2061aef5d86cff632de35ad10955bed7377eadc68df3566854a318aadb866a020857b7fe0c0218176d28ad009e64584c2691ea57975be895467d4f954b74e676ba5ad8b1179d058c26ed827a35f20f3aacb4fd2afb6a54801fb2344622b5d7388984e9395eb814ace55d22487a75f8df898aa3710f7ee7a228da67e6d6ab8e3c45649cc8f811fc43828e02fe3fac46c6ed89dcf9c19a3925f60eeaad9daa58fce2dd48c0743db7bad31c84a4f9c80d6dc26d59d1ea3341e270bad9b5391c615765623a2410b6fa56ce19bbc839395f92ed1f6123da89f358e85062ab157bb51787e97f65d5a2fc197d7957f9e7c4caca3fadf0e6a4676016d00b1e2c23a6f12e42ab4cc2fcb02a4017a492334997101818037a6394ef94a0cfb40639604b15136157d95c348493fb5a2636dde6839cf6d5589d50296c426311505a398e81bdd710ac5b571f132d16d2d5752bdd8180cff4209705f04019f776d3c8991c8874d2a9407573af2500894dc68215bd55475f7e1553221a71879bede58626ebb414924d6844d0c462b7de230aa9812bf0180974ca756db49d2c01326c9a8b5767f502be366ba74c7c844dc2e52c653f59f3fe60e6406f4d5fa46d179ce2d2147ae8e92d3d9acc41428d276469ccf8ab7c9567247410381942f36b0a5cd08865a8fd198b812060b199ab56fc416483f56a2ce1d9af9428d1f863718cbb8ba4b6d029f6b555135c69c6db559c3bff9ceceeb6081751dea5a7977971513f11f8af4c6d38c521cfe2eaa40f9f774137a5461740c8ce682ac5ed0ec68c4a7ed8aef8db392180edc4cf61218281fd04e3153495d1bd342d8215694a8da77dcea07371e4cbb13193267f62ffb347eac1a4c1eecb5fbc5147070367058d652c56715d9c27674fb726136f242298f4b49af6149b34004b3437bfec3cacf80e4b62afe5060276d2545d7b8d0aba2952eeb4d6c07d56a291b7bb516711a10ca3fff72b4f1b06927d735a1f9f2761fc89ca49d56d580d4a6263d0beaa4b28f4b601cc50a3a429a8eadbb14d185a158685f90d4b0024ac6fdaa3588ae20afabf9165d6ef022e4e671fcf2270086689b3468e0160757cb43dfc641f270d8fabb95c0075e138a94e362b7a4175ef6c91ee378b1d074b220edf5a582655aa7cedfce7ffd9ec4d210b2ec8b23dce0068d91844059268b063c39578df81d46926d148529d0b2106cc35c4245870f08ec5939aa55c1001fa1a81fce3c4ac06bb6f079072fbf10b151cf3eeb1042a933b880b00d78b632467e1391e3ca854864ccb7695aa450ec48496591b20e78f8edf0f59c3cae3c08e7d7696c26af2fb536bdd14b19026b75de358f2394be23d2f008c122a4a7a821ce8a462660092d67c2a10befdea7f4070b1217caf97cab8a1730d02f717c0ab5d7c93bc232da5412f01a58616b8e29398927819af2e111f0fd76e8f387286824c1e5c224cc7f60f91cd680af6dad370e374f05", 0x5e9) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001240)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$netlink(0x10, 0x3, 0x12) syz_usb_connect(0x5, 0x36, 0x0, 0x0) r2 = getpid() prlimit64(r2, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f00000001c0)='freezer.parent_freezing\x00', 0x0, 0x0) preadv2(r4, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000706010800000000000010000a0000040500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000980)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x14}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0x1, 0x1, 0x81, 0x3, @vifc_lcl_addr=@broadcast, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) 4.247010827s ago: executing program 3 (id=1446): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0xfffffe83, &(0x7f0000000100)=ANY=[@ANYBLOB="000002"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_usb_connect$cdc_ncm(0x6, 0x74, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x5, 0x0, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x6fc}, {0xd, 0x24, 0xf, 0x1, 0x2667c83, 0xbe, 0x200, 0x9}, {0x6, 0x24, 0x1a, 0x5, 0x8}, [@country_functional={0x6, 0x24, 0x7, 0x3, 0xe5}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x57, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x5bf, 0x1, 0xdc, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0xc3, 0x9, 0xf2}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0x9, 0x5, 0x8, 0x8, 0xdb}, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="050f08e80003100b"], 0x6, [{0xae, &(0x7f0000000180)=@string={0xae, 0x3, "8c6df75bc865259cba8cbf2dae797dda5596bb8afc010517799d5ea6ade6660be822f3f7581f8fd7270fd47b96fa544cf87964f56e62f9524c868812f1f1090fe503e54013b1474d474c5b2ab87390b31689105b09e190b0d4ea96f5e23bf95e1af2f63360df5b49c7903bf3df11f4156c98b6bfd60053dc29de80331050fb87c37f8933ed9f21efa31670ce0eee9637e7aac66bbd169a692e1b43d76d4012e83dc28d510f9d40cd44920cf5"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x480a}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x43e}}, {0x74, &(0x7f0000000400)=@string={0x74, 0x3, "67557528576bc7c7f0b8bf164215f44c936c92691b28220dc1c4f9768d125521ad95f696d11866b8fd196a1e6bcaa29e6be113cab17050540730ff5cc8dcd9042ef9164b2902ccf67401826f846488490daa4d095418f4aa125e9fea5bb2ed2640b2caade336d7155879e1f497ae2e04207c"}}, {0xf9, &(0x7f0000000480)=ANY=[]}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x459}}]}) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000006c0)={0x14, &(0x7f0000000980)=ANY=[@ANYRES64=r0], &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000900)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="201620000000bbb7edc418caa7e033afe500b7ade76e4b10d40dddcd2877bb51a8900f47a12e"], &(0x7f0000000740)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000780)={0x0, 0x8, 0x1, 0x40}, &(0x7f00000007c0)={0x20, 0x80, 0x1c, {0x81, 0xd14, 0x0, 0x9, 0x7, 0x2, 0x1, 0xfffffffb, 0x4, 0x0, 0x5, 0xba}}, &(0x7f0000000800)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000840)={0x20, 0x83, 0x2}, &(0x7f0000000880)={0x20, 0x87, 0x2, 0xfff8}, &(0x7f00000008c0)={0x20, 0x89, 0x2, 0x1}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000000706070600000000000000000300000a080006400000009c050001000700"], 0x24}}, 0x400c800) r3 = socket$alg(0x26, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') write$vhost_msg(r4, &(0x7f0000000840)={0x796e6564, {0x0, 0x0, 0x0}}, 0x7) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) userfaultfd(0x801) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x6, r5}, 0x38) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000032680)=""/102400, 0x19000) sendmsg$IPVS_CMD_GET_INFO(r4, 0x0, 0x4) memfd_create(0x0, 0x0) pipe(&(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r7, &(0x7f00000000c0), &(0x7f0000000040)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) accept4(r3, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) 3.863385156s ago: executing program 0 (id=1447): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0xffffffffffffffc2, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) pread64(r1, 0x0, 0x0, 0x35) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000004d49ba6669b204d4721cdf5336bc2e6998ab10c7dad7b92570e1cf9dae8b09c653d8b20945a26f41298aec3947e03a80e73273e22c5546d2130c20f4e5a3914de53d814274568ccc5de6a3043c28cfd13f4382876ab223c5c51b728fba222f7331b2b288f3a2771e497fd54f9b161553c4397a0688eb1bd57b5331a13b4f5b475afc359a03078cba14ae4d9ed1dc46464671aaf35b8389079807a83c2bceff1c539b616bb705cdd2dbf843c7ddbeaff38a3f721c78581c6a3516d4bbcbe3133b170954e0b0fcbecb520ba8840bb5c2157999cb66963df71066d58e8d21580dfee3dca298439c8f50038bf70000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000181200"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x28af, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x8096) sendmsg$NLBL_UNLABEL_C_STATICADD(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_open_dev$vim2m(0x0, 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_STREAMON(r7, 0x40045612, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @remote}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @random="0106002010ff"}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) 2.988364483s ago: executing program 0 (id=1448): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@delsa={0x3c, 0x12, 0x1, 0x0, 0xfffffffe, {@in=@dev, 0x4d5}, [@srcaddr={0x14, 0xd, @in=@private=0xa010101}]}, 0x3c}}, 0x20040000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) connect$unix(r5, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$KDSKBSENT(r4, 0x4b49, 0x0) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000000c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r3, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x103442, 0x0) ioctl$TUNSETIFF(r6, 0x400454da, &(0x7f0000000140)={'batadv0\x00'}) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x140f, 0x1, 0x3, 0x0, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x11, 0x45, 'ib_multicast\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000f80}, 0x24000800) 2.920609635s ago: executing program 0 (id=1449): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) r1 = syz_io_uring_setup(0x1104, &(0x7f0000000300)={0x0, 0x0, 0x80, 0x0, 0x21e}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r1, 0x47fa, 0x0, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x0, {0x412}, 0x0, {0x0, r4}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {0xffff, 0xffff}}}, 0x24}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000061124400000000009500"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x4, 0x80010, 0xffffffffffffffff, 0xdef3e000) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)=0x8cef}}) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sed\x00', 0x1, 0x4, 0x72}, 0x2c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) getdents64(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r7, 0x4058534c, &(0x7f0000000000)={0x80, 0x4, 0x4, 0xe05, 0xe3, 0x80}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x8407f, 0x0) chmod(0x0, 0x23f) getsockname(r5, &(0x7f0000000280)=@pppoe={0x18, 0x0, {0x0, @local}}, &(0x7f0000000200)=0x80) 2.729011511s ago: executing program 1 (id=1450): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000540)='bfs\x00', 0x8000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r6 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r6, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @empty}, 0x290, 0x0, 0x0, 0x0, 0x8000}) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc6465075508d7e01, 0x0, &(0x7f0000000100), &(0x7f0000000080)='GPL\x00', 0x2, 0xde, &(0x7f00000005c0)=""/222, 0x41100, 0x5, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x4, 0xc, 0xc7, 0x7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x9, &(0x7f0000000340)=[r5, r7, 0xffffffffffffffff, 0x1, 0x1, r6, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000400)=[{0x4, 0x1, 0x1, 0xc}, {0x5, 0x4, 0x0, 0xb}, {0x1, 0x5, 0x5, 0x2}, {0x4, 0x5, 0x6, 0x6}, {0x5, 0x2, 0xc, 0x7}, {0x5, 0x5, 0xb, 0x6}, {0x2, 0x5, 0x8, 0x3}, {0x0, 0x2, 0xb, 0x1}, {0x5, 0x4, 0x2}], 0x10, 0x7, @void, @value}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000580)={r7, r8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 1.449273538s ago: executing program 1 (id=1451): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xe0000000, 0x5e490420, 0x2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000000740)=[{{&(0x7f00000000c0)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_ttl={{0x14, 0x0, 0x34, 0x4}}], 0x18}}], 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r4, 0x1, &(0x7f0000000700)=[&(0x7f0000000440)={0x18, 0x700fbff, 0x4, 0x1, 0x0, r3, 0x0}]) dup3(r0, r3, 0x6700000000000000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0xffffffffffffffff) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = openat$audio1(0xffffffffffffff9c, 0x0, 0x2241, 0x0) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='%6b\xaa\xe3\x8fa\x8e\xdc\xcc\xb5\x05\x83?3\xf1\x9c\'\x84J\xd8\x04\x12\x9f\x05\x00\x00\x00\x83\xd8\xaa\xb4\xaa\x871Ojc\\Ox\xcc\xa0e\xb3\x86\v\x83\x84\x9c\v\xb9\x92\f\xb9\x82\xeb\x1bXA7y\xb4\x18g\xec\xe7\xd9h\xf2U\x83e\xba\xfe\x80\xbe\x92\xb5\xe2 !@\v\xe8\xc0\x9f\xaf\xcc\xc6\\\xa3^#\xccZ\x19\'OPH&\x00\x00\x00\x00\xf6\xd6\xa3$\x02\xf8^f\f`', 0x0) 1.312072773s ago: executing program 0 (id=1452): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x75, 0x1c, 0x1, 0x10, 0xfe6, 0x9800, 0xd19a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x29, 0x2, 0x2, 0xb4, 0x8c, 0xbb, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}]}}]}}]}}, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000280)={0x24, &(0x7f0000000000)={0x40, 0x21, 0x1c, {0x1c, 0x21, "647ff8ef93b4e29a1599b3afcdf35a95e3c0d403da643d172b77"}}, &(0x7f0000000140)={0x0, 0x3, 0xbd, @string={0xbd, 0x3, "94182c4deda6000db6c402f21a437f0359dd3bfdb69c9f0cfffa4fa2291b0eacc649b2116e76d85d18dded5beb2c2ea957fd9e88f4f01ba5e4f787b864a5933f8cc4dc1e41b6562638e0e2ffa2f7ecc875be2f2f4224c738e48abbf6790cfe4128ee38eee9884ecd54eb90cc022a554eb1790a22648d9dde3bd84b4ae8476098ccafb17a3ff9e3ddf63756013744b41d386a66ea54098d5e2fc71aad145438f63af8af92c0697bf1d351e7a065e9e8c72ef0838cf921ab098d7c19"}}, &(0x7f0000000080)={0x0, 0x22, 0x6, {[@global=@item_012={0x2, 0x1, 0x4, "8e35"}, @main=@item_012={0x2, 0x0, 0xc, "028b"}]}}, &(0x7f0000000240)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0x5, 0x1, {0x22, 0x908}}}}, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0xc, 0xaa, "054226f56382363365ac548d5920712d32c5440a36ae9c2de0b0caea3540090832d48e2e29f08c12d42aff7b6800586c158a4ce2dd555fca78c5ffd9df5545e447f67c8c33195378339f869957310b5c62d0d39e4c14854128033dbebcb104f1bc8f2877dc9216bf506e4e7aade71fcf10813dcb77f588ccedfc74c9066c7862ff0dd7c80246aac784ad486ede52d22c1d126594a387b5afbf7164525c7d0459f27740cc1f48df54dad0"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000500)={0x20, 0x1, 0xe9, "4240af0469be555a5b54bcda6b63f2842832e1c99f07d33b2256e1c73a9a0c6e7e5a6e5b8795d9d2f92500e5ed96ca27fcd4f75760ef904b23641c732d3ac9956eb6d213d5697910844a0c94c8e9391667bfff3e5149104c5890887e52089a405f2c62c277a438c2bce3a061dbfd9d7d2e17643fead77614f166fbf3f64a86f588c92c0ac6a8b14f66f4d5945b73921511a191ef62e420aa643fe60f4115b46911e64e548db2c6ee1c36d3ad038a2bb1b85d963d996c461d1d097dce77ea49dac2428892fab041fd0b0d38d96b84f4831b8f258fd8b232c214107c4da1605f88b4e098749c88aacfcb"}, &(0x7f0000000400)={0x20, 0x3, 0x1, 0x9}}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000740)={0x44, &(0x7f00000004c0)={0x0, 0x30, 0x6, "b5a7bede8711"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000008c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x0, 0x268, 0x311, 0x0, 0x268, 0x3f0, 0x460, 0x460, 0x3f0, 0x460, 0x9, 0x0, {[{{@uncond, 0x160, 0x288, 0x2b0, 0x0, {0x9401}, [@common=@inet=@hashlimit2={{0x150}, {'hsr0\x00', {0x0, 0x9, 0x0, 0x0, 0x0, 0x5, 0x9}}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @private2, @remote, [], [], [], 0x0, 0x7863}}]}, @common=@unspec=@NFQUEUE2={0x28}}, {{@ipv6={@private2, @remote, [], [], 'ip6gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xd8, 0x140, 0xe4030000, {}, [@common=@unspec=@realm={{0x30}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) fallocate(0xffffffffffffffff, 0x4, 0x1000, 0xf09) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x50}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r5, r4, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000340)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89f7, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000040)={&(0x7f00006c6000/0x400000)=nil, &(0x7f0000685000/0x4000)=nil, 0x400000, 0x0, 0x18100}) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000b40)={0x34, &(0x7f0000000940)={0x0, 0x5, 0x1d, "de2cbaafdab5e0b7fef0fe24b2749f0777809d5b6db856f7574d400b57"}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000016c0)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080000000", @ANYRES32=0x0, @ANYRES16=r0], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) 1.114007679s ago: executing program 1 (id=1453): syz_usb_connect$printer(0x55d21f7560eb3a30, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x5, &(0x7f00000000c0)={0x5, 0xf, 0x5}}) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000300)=0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c03000017"], 0x34c}, 0x19}, 0x44) 391.555649ms ago: executing program 1 (id=1454): mkdir(0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[]) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={0xffffffffffffffff, 0x53, 0xd, 0x9}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) 327.542643ms ago: executing program 3 (id=1455): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000500)='tlb_flush\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='tlb_flush\x00', r2, 0x0, 0x10000000000000}, 0x18) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x74, r3, {0xf}, {0x0, 0x1}, {0x3, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x40) 229.824058ms ago: executing program 1 (id=1456): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x70, 0x2, 0x6, 0x5, 0xfffffff5, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x8002}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8}}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x70}}, 0x0) 168.764287ms ago: executing program 1 (id=1457): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000180)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000400)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRESDEC=r0, @ANYRESHEX, @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000f8ff00b7080000000000007b8af8ff0000000700000000000000007b8af0ff00000000bfa10000000000fcffffff1ef8ffffffbfa40000000000000704a7b21744"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd, @void, @value}, 0x94) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000004c0)={{0x12, 0x1, 0x141, 0x30, 0xf5, 0x69, 0x20, 0x5ac, 0x219, 0xf072, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x55, 0x7, 0x1, 0x3, 0x49, 0x2, 0x0, [], [{{0x9, 0x5, 0x82, 0x3, 0x400, 0x0, 0x33, 0x81}}]}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="20a911bb11e39d2e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_open_dev$evdev(0x0, 0x72, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x40, &(0x7f0000000080)=ANY=[]) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) write$cgroup_pid(r3, &(0x7f00000001c0), 0x12) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYRES64=r4], 0x48) 0s ago: executing program 3 (id=1458): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000540)='bfs\x00', 0x8000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000080), 0x4) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000540)=""/119}, 0x20) r5 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r5, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @empty}, 0x290, 0x0, 0x0, 0x0, 0x8000}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r7, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc6465075508d7e01, 0x0, &(0x7f0000000100), &(0x7f0000000080)='GPL\x00', 0x2, 0xde, &(0x7f00000005c0)=""/222, 0x41100, 0x5, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x4, 0xc, 0xc7, 0x7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x9, &(0x7f0000000340)=[0xffffffffffffffff, r8, 0xffffffffffffffff, 0x1, 0x1, r5, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000400)=[{0x4, 0x1, 0x1, 0xc}, {0x5, 0x4, 0x0, 0xb}, {0x1, 0x5, 0x5, 0x2}, {0x4, 0x5, 0x6, 0x6}, {0x5, 0x2, 0xc, 0x7}, {0x5, 0x5, 0xb, 0x6}, {0x2, 0x5, 0x8, 0x3}, {0x0, 0x2, 0xb, 0x1}, {0x5, 0x4, 0x2}], 0x10, 0x7, @void, @value}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000580)={r8, r9}) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) kernel console output (not intermixed with test programs): newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 474.173470][T10377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 474.190111][T10377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 474.200818][T10377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 474.210847][T10377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 474.221526][T10377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 474.232621][T10377] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 474.243567][T10377] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.244393][T10552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.254254][T10377] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.270192][T10552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.280415][T10377] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.289111][T10377] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.415160][ T9528] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 474.428593][ T9528] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 474.451793][ T9534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 474.463923][ T9534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 474.985133][T10563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.995902][T10563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.011504][ T30] audit: type=1400 audit(2000000073.270:676): avc: denied { ioctl } for pid=10561 comm="syz.5.1211" path="socket:[28248]" dev="sockfs" ino=28248 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 475.018630][ T1211] usb 2-1: USB disconnect, device number 68 [ 475.320289][T10558] Bluetooth: hci2: command 0x0c1a tx timeout [ 475.671087][ T1211] usb 1-1: USB disconnect, device number 60 [ 476.210099][ T910] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 476.370429][ T910] usb 4-1: Using ep0 maxpacket: 32 [ 476.381292][ T910] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 476.389744][ T910] usb 4-1: config 0 has no interface number 0 [ 476.398580][ T910] usb 4-1: config 0 interface 184 has no altsetting 0 [ 476.407993][ T910] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 476.424151][ T910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.432999][ T910] usb 4-1: Product: syz [ 476.437236][ T910] usb 4-1: Manufacturer: syz [ 476.444279][ T910] usb 4-1: SerialNumber: syz [ 476.461084][ T910] usb 4-1: config 0 descriptor?? [ 476.475318][ T910] smsc75xx v1.0.0 [ 476.479831][ T910] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 476.493151][ T910] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -22 [ 477.740950][T10591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10591 comm=syz.0.1217 [ 478.399118][ T9528] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.473101][T10600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.489453][T10600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.265589][ T9] usb 4-1: USB disconnect, device number 65 [ 479.307585][ T9528] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.326962][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 479.339540][ T5822] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 479.348479][ T5822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 479.359633][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 479.368315][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 479.456939][ T9528] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.469627][ T9] hid-generic 0003:FFFFFFFF:0004.0018: item fetching failed at offset 0/1 [ 479.480535][ T9] hid-generic 0003:FFFFFFFF:0004.0018: probe with driver hid-generic failed with error -22 [ 480.142735][ T9528] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.352698][T10605] lo speed is unknown, defaulting to 1000 [ 480.579026][T10616] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 480.584619][ T9528] bridge_slave_1: left allmulticast mode [ 480.594565][ T9528] bridge_slave_1: left promiscuous mode [ 480.603285][ T9528] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.628497][ T9528] bridge_slave_0: left allmulticast mode [ 480.634433][ T9528] bridge_slave_0: left promiscuous mode [ 480.641458][ T9528] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.224476][ T30] audit: type=1400 audit(2000000079.490:677): avc: denied { mount } for pid=10632 comm="syz.1.1229" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 481.254772][ T30] audit: type=1400 audit(2000000079.510:678): avc: denied { map } for pid=10635 comm="syz.0.1230" path="/proc/882/ns" dev="proc" ino=29272 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 481.411598][T10558] Bluetooth: hci2: command tx timeout [ 481.531182][T10648] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1231'. [ 481.580244][ T9528] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 481.595818][ T9528] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 481.606991][ T9528] bond0 (unregistering): Released all slaves [ 481.707161][ T30] audit: type=1400 audit(2000000079.970:679): avc: denied { unmount } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 481.963570][T10656] Lens B: ================= START STATUS ================= [ 481.971050][T10656] Lens B: Focus, Absolute: 0 [ 481.975747][T10656] Lens B: ================== END STATUS ================== [ 483.499996][T10558] Bluetooth: hci2: command tx timeout [ 484.323784][T10605] chnl_net:caif_netlink_parms(): no params data found [ 484.377831][T10651] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 484.378227][T10651] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 484.389029][T10651] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 484.459696][T10666] syz_tun: entered allmulticast mode [ 484.496577][T10605] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.497704][T10666] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1235'. [ 484.507511][T10605] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.521598][T10605] bridge_slave_0: entered allmulticast mode [ 484.528698][T10605] bridge_slave_0: entered promiscuous mode [ 484.531778][T10671] SELinux: failed to load policy [ 484.537066][T10605] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.546982][T10605] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.547018][ T30] audit: type=1400 audit(2000000082.790:680): avc: denied { load_policy } for pid=10669 comm="syz.1.1236" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 484.554576][T10605] bridge_slave_1: entered allmulticast mode [ 484.582816][T10605] bridge_slave_1: entered promiscuous mode [ 484.594398][T10671] SELinux: failed to load policy [ 484.605854][T10671] SELinux: failed to load policy [ 484.627047][T10666] syz_tun (unregistering): left allmulticast mode [ 484.661772][ T5865] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 484.885787][T10605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 484.897934][T10605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 484.917470][ T9528] hsr_slave_0: left promiscuous mode [ 484.926186][ T9528] hsr_slave_1: left promiscuous mode [ 485.068787][ T5865] usb 4-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.00 [ 485.070533][ T9528] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 485.103110][ T9528] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 485.106264][ T5865] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.123631][ T9528] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 485.133696][ T9528] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 485.150704][ T5865] usb 4-1: config 0 descriptor?? [ 485.169384][ T9528] veth1_macvtap: left promiscuous mode [ 485.183191][ T5865] go7007 4-1:0.0: probe with driver go7007 failed with error -12 [ 485.186336][ T9528] veth0_macvtap: left promiscuous mode [ 485.201411][T10683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.214412][ T9528] veth1_vlan: left promiscuous mode [ 485.214718][T10683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.219791][ T9528] veth0_vlan: left promiscuous mode [ 486.040576][ T5865] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 486.130923][ T9] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 486.189080][T10697] Lens B: ================= START STATUS ================= [ 486.197074][T10697] Lens B: Focus, Absolute: 0 [ 486.202009][T10697] Lens B: ================== END STATUS ================== [ 486.460019][T10558] Bluetooth: hci2: command 0x0419 tx timeout [ 487.132780][ T5865] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.143928][ T5865] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 487.157392][ T5865] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 487.166484][ T5865] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.176548][ T5865] usb 2-1: config 0 descriptor?? [ 487.185505][ T5865] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 487.202165][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.213415][ T9528] team0 (unregistering): Port device team_slave_1 removed [ 487.217097][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 487.239771][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 487.251212][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 487.261040][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 487.274242][ T9528] team0 (unregistering): Port device team_slave_0 removed [ 487.275755][ T9] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 487.290876][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 487.298963][ T9] usb 1-1: Product: syz [ 487.303191][ T9] usb 1-1: Manufacturer: syz [ 487.310899][ T9] usb 1-1: SerialNumber: syz [ 487.323063][ T9] usb 1-1: config 0 descriptor?? [ 487.548480][ T9] radio-si470x 1-1:0.0: DeviceID=0x3f6e ChipID=0x7100 [ 487.613024][ T5865] usb 4-1: USB disconnect, device number 66 [ 487.709231][T10605] team0: Port device team_slave_0 added [ 487.739356][T10605] team0: Port device team_slave_1 added [ 487.762002][ T9] radio-si470x 1-1:0.0: software version 63, hardware version 110 [ 487.830307][T10605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 487.843813][T10703] set match dimension is over the limit! [ 487.849578][T10605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 487.878332][T10605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 487.905080][T10705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.915115][T10605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 487.927688][T10705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.935956][T10605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 488.073968][T10605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 488.370603][ T9] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 488.389754][ T9] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 488.397299][ T9] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -32 [ 488.412357][ T9] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 488.540465][T10558] Bluetooth: hci2: command 0x0419 tx timeout [ 488.567485][T10605] hsr_slave_0: entered promiscuous mode [ 488.575199][T10605] hsr_slave_1: entered promiscuous mode [ 488.583902][T10605] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 488.592108][T10605] Cannot create hsr debugfs directory [ 489.301839][T10605] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 489.365742][T10605] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 489.401236][T10605] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 489.415573][T10713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.431697][T10605] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 489.438549][T10713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.637084][T10605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 489.651225][ T8323] usb 2-1: USB disconnect, device number 69 [ 489.678744][T10605] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.699609][ T9535] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.706744][ T9535] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.717489][ T1211] usb 4-1: new full-speed USB device number 67 using dummy_hcd [ 489.733512][ T9535] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.740638][ T9535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.825964][T10605] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 489.837130][T10605] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 489.871314][ T1211] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.008801][ T1211] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 490.223032][ T1211] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 490.241723][ T910] usb 1-1: USB disconnect, device number 61 [ 490.278765][ T1211] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 490.309021][ T1211] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 490.358346][ T1211] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 490.391507][ T1211] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 490.413070][ T1211] usb 4-1: Product: syz [ 490.428717][ T1211] usb 4-1: Manufacturer: syz [ 490.458719][ T1211] usb 4-1: SerialNumber: syz [ 490.487550][ T1211] usb 4-1: config 0 descriptor?? [ 490.611148][T10558] Bluetooth: hci2: command 0x0419 tx timeout [ 490.680121][ T5914] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 490.884926][T10605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.901649][ T5914] usb 2-1: config 150 has an invalid interface number: 204 but max is 0 [ 490.918938][ T5914] usb 2-1: config 150 has no interface number 0 [ 490.931748][ T5914] usb 2-1: config 150 interface 204 has no altsetting 0 [ 490.952753][ T5914] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 490.963602][ T1211] radio-si470x 4-1:0.0: DeviceID=0x3f6e ChipID=0x7100 [ 490.973971][T10605] veth0_vlan: entered promiscuous mode [ 490.990657][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.004593][ T5914] usb 2-1: Product: syz [ 491.011940][T10605] veth1_vlan: entered promiscuous mode [ 491.017452][ T5914] usb 2-1: Manufacturer: syz [ 491.024367][ T5914] usb 2-1: SerialNumber: syz [ 491.056759][T10605] veth0_macvtap: entered promiscuous mode [ 491.066274][T10605] veth1_macvtap: entered promiscuous mode [ 491.103921][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 491.123468][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.133738][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 491.144322][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.154233][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 491.165236][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.165292][ T1211] radio-si470x 4-1:0.0: software version 63, hardware version 110 [ 491.175378][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 491.231677][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.253584][ T5914] usb 2-1: USB disconnect, device number 70 [ 491.271532][T10605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 491.339800][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 491.359972][ T910] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 491.360513][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.379541][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 491.391364][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.402101][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 491.459899][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.469760][T10605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 491.502567][T10605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 491.514588][T10605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 491.530431][T10605] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.539198][T10605] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.540166][ T910] usb 1-1: Using ep0 maxpacket: 16 [ 491.554973][T10605] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.564398][T10605] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.565567][ T910] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 491.598571][ T910] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 491.630018][ T910] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 491.650091][ T910] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 491.660156][ T9528] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.667949][ T9528] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.675504][ T910] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 491.677733][ T910] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 491.700864][ T1211] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 491.709456][ T1211] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 491.710276][ T910] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 491.718807][ T1211] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -32 [ 491.724805][ T910] usb 1-1: Manufacturer: syz [ 491.745395][ T910] usb 1-1: config 0 descriptor?? [ 491.753206][ T1211] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22 [ 491.772659][ T9529] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.790131][ T9529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 492.687324][T10745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.696273][T10745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.123844][ T24] usb 4-1: USB disconnect, device number 67 [ 493.753771][ T9534] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.919967][ T910] rc_core: IR keymap rc-hauppauge not found [ 494.925939][ T910] Registered IR keymap rc-empty [ 494.931170][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.955369][ T9534] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.970046][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.990989][ T910] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 495.004565][ T910] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input54 [ 495.023254][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.036426][ T9534] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.050021][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.070028][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.089999][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.111804][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.120840][ T9534] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.140931][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.160040][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.180084][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.200022][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.221503][ T910] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 495.233116][ T9534] bridge_slave_1: left allmulticast mode [ 495.239449][ T9534] bridge_slave_1: left promiscuous mode [ 495.245440][ T9534] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.247402][ T910] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 495.262625][ T9534] bridge_slave_0: left allmulticast mode [ 495.263374][ T910] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 495.268256][ T9534] bridge_slave_0: left promiscuous mode [ 495.288130][ T9534] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.298584][ T910] usb 1-1: USB disconnect, device number 62 [ 495.517072][T10775] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1262'. [ 496.567644][T10782] loop6: detected capacity change from 0 to 524287999 [ 496.633090][T10779] IPVS: set_ctl: invalid protocol: 12 10.1.1.0:20000 [ 497.813216][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 497.825810][T10791] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 497.835188][T10791] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 497.853401][T10791] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 497.870547][T10791] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 498.358261][T10795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.368412][T10795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.781661][ T9534] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 498.827452][ T9534] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 498.919360][ T9534] bond0 (unregistering): Released all slaves [ 499.981135][T10791] Bluetooth: hci2: command tx timeout [ 500.148910][ T5860] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 500.312857][ T30] audit: type=1400 audit(2000000098.400:681): avc: denied { listen } for pid=10803 comm="syz.0.1271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 500.619752][ T5860] usb 4-1: Using ep0 maxpacket: 16 [ 500.710015][ T5860] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.729972][ T5860] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 500.785385][ T5860] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 500.825511][ T5860] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 500.880866][T10789] lo speed is unknown, defaulting to 1000 [ 500.897293][ T5860] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 501.013122][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.025475][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.379154][ T5860] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 501.388292][ T5860] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 501.405053][ T5860] usb 4-1: Manufacturer: syz [ 501.440876][ T5860] usb 4-1: config 0 descriptor?? [ 501.610011][ T9534] hsr_slave_0: left promiscuous mode [ 501.623772][ T9534] hsr_slave_1: left promiscuous mode [ 501.632959][ T9534] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 501.657040][ T9534] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 501.668991][ T9534] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 501.682643][ T9534] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 501.707506][ T9534] veth1_macvtap: left promiscuous mode [ 501.753709][ T9534] veth0_macvtap: left promiscuous mode [ 501.788711][T10823] Lens B: ================= START STATUS ================= [ 501.796267][T10823] Lens B: Focus, Absolute: 0 [ 501.801326][T10823] Lens B: ================== END STATUS ================== [ 501.824927][ T9534] veth1_vlan: left promiscuous mode [ 501.861817][ T9534] veth0_vlan: left promiscuous mode [ 502.050013][T10791] Bluetooth: hci2: command tx timeout [ 503.569931][ T5860] rc_core: IR keymap rc-hauppauge not found [ 503.575894][ T5860] Registered IR keymap rc-empty [ 503.581665][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 503.605267][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 503.605920][T10837] FAULT_INJECTION: forcing a failure. [ 503.605920][T10837] name failslab, interval 1, probability 0, space 0, times 0 [ 503.641074][ T5860] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 503.657776][T10837] CPU: 0 UID: 0 PID: 10837 Comm: syz.3.1278 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 503.657799][T10837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 503.657809][T10837] Call Trace: [ 503.657815][T10837] [ 503.657821][T10837] dump_stack_lvl+0x16c/0x1f0 [ 503.657849][T10837] should_fail_ex+0x512/0x640 [ 503.657869][T10837] ? fs_reclaim_acquire+0xae/0x150 [ 503.657892][T10837] ? tomoyo_encode2+0x100/0x3e0 [ 503.657914][T10837] should_failslab+0xc2/0x120 [ 503.657931][T10837] __kmalloc_noprof+0xd2/0x510 [ 503.657956][T10837] ? d_absolute_path+0x136/0x1a0 [ 503.657981][T10837] tomoyo_encode2+0x100/0x3e0 [ 503.658007][T10837] tomoyo_encode+0x29/0x50 [ 503.658027][T10837] tomoyo_realpath_from_path+0x18f/0x6e0 [ 503.658057][T10837] tomoyo_path_number_perm+0x245/0x580 [ 503.658077][T10837] ? tomoyo_path_number_perm+0x237/0x580 [ 503.658099][T10837] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 503.658129][T10837] ? __lock_acquire+0xaa4/0x1ba0 [ 503.658171][T10837] ? __pfx___might_resched+0x10/0x10 [ 503.658197][T10837] ? down_write+0x14d/0x200 [ 503.658220][T10837] ? __pfx_down_write+0x10/0x10 [ 503.658241][T10837] ? mnt_get_write_access+0x20c/0x300 [ 503.658264][T10837] security_path_chmod+0x121/0x2c0 [ 503.658286][T10837] chmod_common+0x16c/0x460 [ 503.658306][T10837] ? __pfx_chmod_common+0x10/0x10 [ 503.658320][T10837] ? find_held_lock+0x2b/0x80 [ 503.658340][T10837] ? __fget_files+0x204/0x3c0 [ 503.658378][T10837] __x64_sys_fchmod+0x110/0x1a0 [ 503.658395][T10837] do_syscall_64+0xcd/0x260 [ 503.658420][T10837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.658442][T10837] RIP: 0033:0x7f0dc3b8e969 [ 503.658456][T10837] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 503.658471][T10837] RSP: 002b:00007f0dc19f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000005b [ 503.658487][T10837] RAX: ffffffffffffffda RBX: 00007f0dc3db5fa0 RCX: 00007f0dc3b8e969 [ 503.658498][T10837] RDX: 0000000000000000 RSI: 0000000000000140 RDI: 0000000000000003 [ 503.658508][T10837] RBP: 00007f0dc19f6090 R08: 0000000000000000 R09: 0000000000000000 [ 503.658518][T10837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.658527][T10837] R13: 0000000000000000 R14: 00007f0dc3db5fa0 R15: 00007fffaa897ef8 [ 503.658551][T10837] [ 503.658695][T10837] ERROR: Out of memory at tomoyo_realpath_from_path. [ 503.663200][ T5860] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input55 [ 503.776970][T10841] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 503.779567][ T30] audit: type=1400 audit(2000000102.030:682): avc: denied { map } for pid=10840 comm="syz.0.1280" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 503.797274][T10841] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 503.842942][ T30] audit: type=1400 audit(2000000102.090:683): avc: denied { ioctl } for pid=10844 comm="syz.3.1281" path="socket:[31098]" dev="sockfs" ino=31098 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 503.993222][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.022281][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.040358][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.062892][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.092655][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.131922][T10791] Bluetooth: hci2: command tx timeout [ 504.148467][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.182302][T10850] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1282'. [ 504.221312][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.270896][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.330019][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.370870][ T5860] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.456995][ T5860] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 504.514839][ T5860] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 504.641943][ T5860] usb 4-1: USB disconnect, device number 68 [ 505.441405][ T9534] team0 (unregistering): Port device team_slave_1 removed [ 505.594670][ T9534] team0 (unregistering): Port device team_slave_0 removed [ 506.224049][T10791] Bluetooth: hci2: command tx timeout [ 506.391154][T10867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.400724][T10867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.894590][T10789] chnl_net:caif_netlink_parms(): no params data found [ 507.010050][ T5860] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 507.115854][T10789] bridge0: port 1(bridge_slave_0) entered blocking state [ 507.130410][T10789] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.146431][T10789] bridge_slave_0: entered allmulticast mode [ 507.170493][T10789] bridge_slave_0: entered promiscuous mode [ 507.178575][T10789] bridge0: port 2(bridge_slave_1) entered blocking state [ 507.190243][T10789] bridge0: port 2(bridge_slave_1) entered disabled state [ 507.197380][T10789] bridge_slave_1: entered allmulticast mode [ 507.229966][ T5860] usb 4-1: Using ep0 maxpacket: 8 [ 507.239293][ T5860] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 507.323861][ T5860] usb 4-1: config 0 has no interface number 0 [ 507.383248][ T5860] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 507.484643][ T30] audit: type=1400 audit(2000000105.730:684): avc: denied { audit_write } for pid=10882 comm="syz.5.1293" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 507.532985][ T5860] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 507.567519][ T5865] IPVS: starting estimator thread 0... [ 507.571673][T10789] bridge_slave_1: entered promiscuous mode [ 507.638302][ T5860] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 507.638336][ T5860] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 507.638375][ T5860] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 507.638396][ T5860] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.642821][ T5860] usb 4-1: config 0 descriptor?? [ 507.721519][ T5860] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 507.762521][T10884] IPVS: using max 44 ests per chain, 105600 per kthread [ 507.789241][T10789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 507.807060][T10890] syz.5.1295: attempt to access beyond end of device [ 507.807060][T10890] nbd5: rw=0, sector=0, nr_sectors = 1 limit=0 [ 507.822864][T10789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 507.849673][T10866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.940550][T10866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.969427][T10789] team0: Port device team_slave_0 added [ 507.988484][T10789] team0: Port device team_slave_1 added [ 508.011867][ T30] audit: type=1400 audit(2000000106.280:685): avc: denied { setopt } for pid=10894 comm="syz.1.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 508.270050][T10897] Cannot find add_set index 0 as target [ 508.290114][ T30] audit: type=1400 audit(2000000106.550:686): avc: denied { connect } for pid=10894 comm="syz.1.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 508.309732][ C1] vkms_vblank_simulate: vblank timer overrun [ 508.504570][T10789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 508.512252][T10789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 508.538208][T10789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 508.551450][T10789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 508.558398][T10789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 508.587076][T10789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 508.639438][T10789] hsr_slave_0: entered promiscuous mode [ 508.655922][T10789] hsr_slave_1: entered promiscuous mode [ 508.669573][T10789] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 508.696265][T10789] Cannot create hsr debugfs directory [ 509.224143][ T5865] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 509.390077][ T5865] usb 2-1: Using ep0 maxpacket: 16 [ 509.397360][ T5865] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.412528][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 509.437087][ T5865] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 509.509961][ T5865] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 509.530873][ T5865] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 509.563058][ T5865] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 509.583589][ T5865] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 509.593672][ T5865] usb 2-1: Manufacturer: syz [ 509.633992][ T5865] usb 2-1: config 0 descriptor?? [ 509.773375][T10789] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 509.816186][T10789] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 509.845898][T10789] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 509.873031][T10789] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 509.953106][T10789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.984578][T10789] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.000940][ T9525] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.008076][ T9525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 510.046063][ T9525] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.053212][ T9525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 510.076322][ T1211] usb 4-1: USB disconnect, device number 69 [ 510.089310][ T1211] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 510.868406][T10920] overlayfs: failed to resolve './file2': -2 [ 513.104365][ T5865] rc_core: IR keymap rc-hauppauge not found [ 513.115123][ T5865] Registered IR keymap rc-empty [ 513.126937][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.170086][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.179666][T10789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 513.294115][ T5865] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 513.302272][T10789] veth0_vlan: entered promiscuous mode [ 513.313195][ T5865] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input56 [ 513.326315][T10789] veth1_vlan: entered promiscuous mode [ 513.331175][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.498319][ T8323] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 513.770338][ T24] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 513.789960][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.810003][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.819266][T10789] veth0_macvtap: entered promiscuous mode [ 513.827304][T10789] veth1_macvtap: entered promiscuous mode [ 513.834743][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.849351][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 513.860761][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.862547][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 513.878608][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 513.889345][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 513.899481][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 513.899973][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.911098][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 513.927340][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 513.937939][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 513.947969][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 513.950014][ T8323] usb 1-1: Using ep0 maxpacket: 8 [ 513.956999][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 513.959477][ T8323] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 513.966297][T10789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 513.976127][ T8323] usb 1-1: config 179 has no interface number 0 [ 513.982596][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 513.999973][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 514.009785][ T24] usb 4-1: config 255 has an invalid interface number: 81 but max is 0 [ 514.029160][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 514.039327][ T24] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 514.075335][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 514.086513][ T5865] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 514.101108][ T24] usb 4-1: config 255 has no interface number 0 [ 514.104988][ T8323] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 514.122640][ T8323] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 514.134228][ T24] usb 4-1: config 255 interface 81 altsetting 3 has an endpoint descriptor with address 0x93, changing to 0x83 [ 514.134256][ T24] usb 4-1: config 255 interface 81 altsetting 3 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 514.134280][ T24] usb 4-1: config 255 interface 81 has no altsetting 0 [ 514.135424][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 514.149792][ T8323] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 514.159365][ T5865] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 514.196061][ T8323] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 514.197484][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 514.223561][ T5865] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 514.229645][ T8323] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 514.232133][ T24] usb 4-1: string descriptor 0 read error: -22 [ 514.251419][ T24] usb 4-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice=24.ac [ 514.257633][ T8323] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 514.266786][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 514.279780][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.302352][ T5865] usb 2-1: USB disconnect, device number 71 [ 514.325082][ T24] input: USB Touchscreen 0dfc:0001 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:255.81/input/input57 [ 514.330649][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 514.347653][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 514.358424][T10789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 514.369672][T10945] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 514.378569][T10789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 514.408250][T10789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 514.445702][T10789] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.499915][T10789] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.534424][T10789] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.543666][T10789] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.606418][ C1] usbtouchscreen 4-1:255.81: usbtouch_irq - usb_submit_urb failed with result: -1 [ 515.284297][T10942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.293048][T10942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.306205][ T9522] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 515.316088][ T9522] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 515.366436][ T9522] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 515.375501][ T9522] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 515.397715][ T30] audit: type=1400 audit(2000000113.660:687): avc: denied { ioctl } for pid=10976 comm="syz.1.1315" path="socket:[32019]" dev="sockfs" ino=32019 ioctlcmd=0x9410 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 515.831325][T10992] FAULT_INJECTION: forcing a failure. [ 515.831325][T10992] name failslab, interval 1, probability 0, space 0, times 0 [ 515.844195][T10992] CPU: 1 UID: 0 PID: 10992 Comm: syz.1.1318 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 515.844223][T10992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 515.844234][T10992] Call Trace: [ 515.844240][T10992] [ 515.844246][T10992] dump_stack_lvl+0x16c/0x1f0 [ 515.844272][T10992] should_fail_ex+0x512/0x640 [ 515.844292][T10992] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 515.844318][T10992] should_failslab+0xc2/0x120 [ 515.844336][T10992] __kmalloc_cache_noprof+0x6a/0x3e0 [ 515.844358][T10992] ? __pfx_avc_has_perm+0x10/0x10 [ 515.844374][T10992] ? packet_setsockopt+0x17f1/0x3360 [ 515.844398][T10992] packet_setsockopt+0x17f1/0x3360 [ 515.844420][T10992] ? __pfx_packet_setsockopt+0x10/0x10 [ 515.844438][T10992] ? selinux_netlbl_socket_setsockopt+0x183/0x470 [ 515.844457][T10992] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 515.844475][T10992] ? proc_fail_nth_write+0x9f/0x250 [ 515.844497][T10992] ? __lock_acquire+0x5ca/0x1ba0 [ 515.844522][T10992] ? selinux_socket_setsockopt+0x6a/0x80 [ 515.844539][T10992] ? __pfx_packet_setsockopt+0x10/0x10 [ 515.844557][T10992] do_sock_setsockopt+0x221/0x470 [ 515.844574][T10992] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 515.844602][T10992] __sys_setsockopt+0x1a0/0x230 [ 515.844617][T10992] __x64_sys_setsockopt+0xbd/0x160 [ 515.844628][T10992] ? do_syscall_64+0x91/0x260 [ 515.844645][T10992] ? lockdep_hardirqs_on+0x7c/0x110 [ 515.844661][T10992] do_syscall_64+0xcd/0x260 [ 515.844680][T10992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.844693][T10992] RIP: 0033:0x7fcdf1f8e969 [ 515.844704][T10992] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 515.844717][T10992] RSP: 002b:00007fcdf2dc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 515.844729][T10992] RAX: ffffffffffffffda RBX: 00007fcdf21b6160 RCX: 00007fcdf1f8e969 [ 515.844738][T10992] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 000000000000000a [ 515.844745][T10992] RBP: 00007fcdf2dc4090 R08: 0000000000000004 R09: 0000000000000000 [ 515.844753][T10992] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 515.844760][T10992] R13: 0000000000000000 R14: 00007fcdf21b6160 R15: 00007ffe98236f38 [ 515.844779][T10992] [ 515.846497][T10992] netlink: 'syz.1.1318': attribute type 1 has an invalid length. [ 516.079802][T10992] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.1318'. [ 516.312760][T10961] usb 1-1: USB disconnect, device number 63 [ 516.365931][T10995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.382006][T10995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.546276][T11005] syz.1.1324: attempt to access beyond end of device [ 516.546276][T11005] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 516.645678][ T9533] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.012711][ T9533] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.074060][ T9533] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.134180][T11009] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1323'. [ 517.198876][ T9533] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.336517][ T9533] bridge_slave_1: left allmulticast mode [ 517.347565][ T9533] bridge_slave_1: left promiscuous mode [ 517.354820][ T9533] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.392223][ T9533] bridge_slave_0: left allmulticast mode [ 517.408052][ T9533] bridge_slave_0: left promiscuous mode [ 517.424704][ T9533] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.629976][ T30] audit: type=1400 audit(2000000115.880:688): avc: denied { create } for pid=11014 comm="syz.5.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 517.649357][ C1] vkms_vblank_simulate: vblank timer overrun [ 517.675228][ T5865] usb 4-1: USB disconnect, device number 70 [ 517.755977][T11017] Lens B: ================= START STATUS ================= [ 517.764109][T11017] Lens B: Focus, Absolute: 0 [ 517.768794][T11017] Lens B: ================== END STATUS ================== [ 518.848497][ T24] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 519.040888][T10558] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 519.057703][T10558] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 519.068536][T10558] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 519.077445][ T24] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 519.079023][T11031] loop6: detected capacity change from 0 to 7 [ 519.086882][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.101093][T10558] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 519.108663][T10558] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 519.134573][ T24] usb 2-1: config 0 descriptor?? [ 519.142668][ T24] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 519.301545][ T910] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 519.327912][ T9533] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 519.339522][ T9533] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 519.374218][T11024] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1329'. [ 519.386240][ T30] audit: type=1400 audit(2000000117.650:689): avc: denied { lock } for pid=11022 comm="syz.0.1329" path="socket:[31439]" dev="sockfs" ino=31439 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 519.412752][ T9533] bond0 (unregistering): Released all slaves [ 519.469964][ T910] usb 4-1: device descriptor read/64, error -71 [ 519.739989][ T910] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 519.835679][ T24] gp8psk: usb in 128 operation failed. [ 519.848239][ T24] gp8psk: usb in 137 operation failed. [ 519.862083][ T24] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 519.888381][ T24] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 519.912187][ T24] usb 2-1: USB disconnect, device number 72 [ 519.960630][ T910] usb 4-1: device descriptor read/64, error -71 [ 520.081008][ T910] usb usb4-port1: attempt power cycle [ 520.118938][T11026] lo speed is unknown, defaulting to 1000 [ 520.339019][T11051] FAULT_INJECTION: forcing a failure. [ 520.339019][T11051] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 520.370919][T11051] CPU: 1 UID: 0 PID: 11051 Comm: syz.0.1337 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 520.370943][T11051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 520.370953][T11051] Call Trace: [ 520.370959][T11051] [ 520.370965][T11051] dump_stack_lvl+0x16c/0x1f0 [ 520.370993][T11051] should_fail_ex+0x512/0x640 [ 520.371018][T11051] _copy_from_user+0x2e/0xd0 [ 520.371041][T11051] memdup_user+0x6b/0xe0 [ 520.371060][T11051] ucma_set_option+0x11f/0x530 [ 520.371081][T11051] ? __might_fault+0xe3/0x190 [ 520.371095][T11051] ? __pfx_ucma_set_option+0x10/0x10 [ 520.371122][T11051] ? __pfx_ucma_set_option+0x10/0x10 [ 520.371144][T11051] ucma_write+0x1f8/0x330 [ 520.371163][T11051] ? __pfx_ucma_write+0x10/0x10 [ 520.371180][T11051] ? bpf_lsm_file_permission+0x9/0x10 [ 520.371201][T11051] ? security_file_permission+0x71/0x210 [ 520.371226][T11051] ? rw_verify_area+0xcf/0x680 [ 520.371250][T11051] vfs_write+0x25c/0x1180 [ 520.371271][T11051] ? __pfx_ucma_write+0x10/0x10 [ 520.371294][T11051] ? __pfx_vfs_write+0x10/0x10 [ 520.371315][T11051] ? find_held_lock+0x2b/0x80 [ 520.371335][T11051] ? __fget_files+0x204/0x3c0 [ 520.371369][T11051] ? __fget_files+0x20e/0x3c0 [ 520.371399][T11051] ksys_write+0x205/0x240 [ 520.371421][T11051] ? __pfx_ksys_write+0x10/0x10 [ 520.371442][T11051] ? rcu_is_watching+0x12/0xc0 [ 520.371468][T11051] do_syscall_64+0xcd/0x260 [ 520.371492][T11051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.371509][T11051] RIP: 0033:0x7f275758e969 [ 520.371522][T11051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 520.371538][T11051] RSP: 002b:00007f2758359038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 520.371554][T11051] RAX: ffffffffffffffda RBX: 00007f27577b5fa0 RCX: 00007f275758e969 [ 520.371565][T11051] RDX: 0000000000000020 RSI: 0000200000000340 RDI: 0000000000000003 [ 520.371574][T11051] RBP: 00007f2758359090 R08: 0000000000000000 R09: 0000000000000000 [ 520.371583][T11051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.371592][T11051] R13: 0000000000000000 R14: 00007f27577b5fa0 R15: 00007ffc7ded6328 [ 520.371615][T11051] [ 520.597888][ C1] vkms_vblank_simulate: vblank timer overrun [ 520.840494][ T9533] hsr_slave_0: left promiscuous mode [ 520.860611][ T9533] hsr_slave_1: left promiscuous mode [ 520.870572][ T910] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 520.873165][ T30] audit: type=1400 audit(2000000119.140:690): avc: denied { create } for pid=11056 comm="syz.1.1339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 520.878886][ T9533] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 520.901945][ T30] audit: type=1400 audit(2000000119.170:691): avc: denied { getopt } for pid=11056 comm="syz.1.1339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 520.911065][ T910] usb 4-1: device descriptor read/8, error -71 [ 520.927491][ T30] audit: type=1400 audit(2000000119.170:692): avc: denied { connect } for pid=11056 comm="syz.1.1339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 520.931159][ T9533] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 520.950343][ C1] vkms_vblank_simulate: vblank timer overrun [ 520.952040][ T30] audit: type=1400 audit(2000000119.170:693): avc: denied { name_connect } for pid=11056 comm="syz.1.1339" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 520.986593][ T30] audit: type=1400 audit(2000000119.230:694): avc: denied { setopt } for pid=11056 comm="syz.1.1339" lport=47488 faddr=2001::2 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 520.987765][T11058] binder: BINDER_SET_CONTEXT_MGR already set [ 521.018153][T11058] binder: 11056:11058 ioctl 4018620d 200000000040 returned -16 [ 521.018422][ T9533] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 521.030353][T11058] binder: 11056:11058 ioctl c0306201 200000001a80 returned -11 [ 521.033403][ T9533] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 521.055376][ T9533] veth1_macvtap: left promiscuous mode [ 521.061040][ T9533] veth0_macvtap: left promiscuous mode [ 521.066552][ T9533] veth1_vlan: left promiscuous mode [ 521.072233][ T9533] veth0_vlan: left promiscuous mode [ 521.110057][T10972] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 521.180009][ T910] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 521.187626][T10558] Bluetooth: hci2: command tx timeout [ 521.220537][ T910] usb 4-1: device descriptor read/8, error -71 [ 521.261343][T10972] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.282236][T10972] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 521.291941][T10972] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 521.324269][T10972] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 521.333375][T10972] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.343232][ T910] usb usb4-port1: unable to enumerate USB device [ 521.373152][T10972] usb 1-1: Product: syz [ 521.377492][T10972] usb 1-1: Manufacturer: syz [ 521.384492][T10972] usb 1-1: SerialNumber: syz [ 521.420432][ T30] audit: type=1400 audit(2000000119.690:695): avc: denied { ioctl } for pid=11059 comm="syz.5.1340" path="socket:[31523]" dev="sockfs" ino=31523 ioctlcmd=0x6615 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 521.530809][ T9533] team0 (unregistering): Port device team_slave_1 removed [ 521.563043][ T9533] team0 (unregistering): Port device team_slave_0 removed [ 521.603785][T10972] usb 1-1: USB disconnect, device number 64 [ 521.757157][ T30] audit: type=1400 audit(2000000120.020:696): avc: denied { shutdown } for pid=11062 comm="syz.1.1341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 521.854865][T11064] IPVS: set_ctl: invalid protocol: 137 127.0.0.1:20000 [ 521.937133][T11026] chnl_net:caif_netlink_parms(): no params data found [ 522.145478][T11026] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.158142][T11026] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.166280][T11026] bridge_slave_0: entered allmulticast mode [ 522.183738][T11026] bridge_slave_0: entered promiscuous mode [ 522.217062][T11026] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.237328][T11026] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.257880][T11026] bridge_slave_1: entered allmulticast mode [ 522.296356][T11026] bridge_slave_1: entered promiscuous mode [ 522.658794][T11072] binder: 11070:11072 ioctl c0306201 2000000003c0 returned -14 [ 522.671296][T11060] lo speed is unknown, defaulting to 1000 [ 522.718115][T11026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 522.869970][T11078] set match dimension is over the limit! [ 522.988585][T11026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 523.271421][T10558] Bluetooth: hci2: command tx timeout [ 523.638405][T11026] team0: Port device team_slave_0 added [ 523.657721][T11026] team0: Port device team_slave_1 added [ 523.750083][T11026] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 523.754381][T11091] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 523.761923][T11026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.803930][T11026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 523.817827][T11026] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 523.825327][T11026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.857110][T11026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 523.901538][T11026] hsr_slave_0: entered promiscuous mode [ 523.907839][T11026] hsr_slave_1: entered promiscuous mode [ 523.927632][T11026] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 523.945768][T11026] Cannot create hsr debugfs directory [ 524.028022][ T30] audit: type=1400 audit(2000000122.290:697): avc: denied { bind } for pid=11101 comm="syz.3.1351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 524.057672][ T30] audit: type=1400 audit(2000000122.290:698): avc: denied { name_bind } for pid=11101 comm="syz.3.1351" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 524.116914][ T30] audit: type=1400 audit(2000000122.290:699): avc: denied { write } for pid=11101 comm="syz.3.1351" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 524.220262][ T5865] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 524.221616][T11106] trusted_key: encrypted_key: insufficient parameters specified [ 524.297698][T11109] netlink: 'syz.1.1353': attribute type 1 has an invalid length. [ 524.309069][T11109] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1353'. [ 524.421794][ T5865] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 524.442278][ T5865] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 524.464687][ T5865] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 524.486523][ T5865] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 524.499942][T10971] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 524.508489][ T5865] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 524.554686][ T5865] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 524.563845][ T5865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 524.578445][ T5865] usb 1-1: Product: syz [ 524.583072][ T5865] usb 1-1: Manufacturer: syz [ 524.587675][ T5865] usb 1-1: SerialNumber: syz [ 524.610538][ T5865] usb 1-1: config 0 descriptor?? [ 524.902312][T10971] usb 4-1: Using ep0 maxpacket: 8 [ 524.932783][T10971] usb 4-1: config 0 has an invalid interface number: 189 but max is 0 [ 524.946393][ T5865] radio-si470x 1-1:0.0: DeviceID=0x3f6e ChipID=0x7100 [ 524.970300][T10971] usb 4-1: config 0 has no interface number 0 [ 524.970619][T11026] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 524.976387][T10971] usb 4-1: too many endpoints for config 0 interface 189 altsetting 140: 51, using maximum allowed: 30 [ 524.994903][T10971] usb 4-1: config 0 interface 189 altsetting 140 has 0 endpoint descriptors, different from the interface descriptor's value: 51 [ 525.049726][T11026] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 525.100408][T11026] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 525.117979][T10971] usb 4-1: config 0 interface 189 has no altsetting 0 [ 525.148077][T11026] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 525.164734][T10971] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 525.198997][T10971] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.228244][ T5865] radio-si470x 1-1:0.0: software version 63, hardware version 110 [ 525.242524][T10971] usb 4-1: Product: syz [ 525.256005][T10971] usb 4-1: Manufacturer: syz [ 525.275450][T10971] usb 4-1: SerialNumber: syz [ 525.301933][T10971] usb 4-1: config 0 descriptor?? [ 525.330164][T10558] Bluetooth: hci2: command tx timeout [ 525.416349][T11026] 8021q: adding VLAN 0 to HW filter on device bond0 [ 525.481264][T11026] 8021q: adding VLAN 0 to HW filter on device team0 [ 525.512929][ T9522] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.520074][ T9522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 525.573881][ T9534] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.581029][ T9534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 525.598606][ T910] usb 4-1: USB disconnect, device number 75 [ 525.670231][T10972] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 525.749290][ T5865] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 525.762752][ T5865] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 525.788190][ T5865] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -32 [ 525.808521][T11026] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 525.839619][T10972] usb 2-1: device descriptor read/64, error -71 [ 525.936123][ T5865] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 526.680392][T10972] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 526.814839][T11026] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 526.822313][T10972] usb 2-1: device descriptor read/64, error -71 [ 526.863177][T11026] veth0_vlan: entered promiscuous mode [ 526.878719][T11026] veth1_vlan: entered promiscuous mode [ 526.901440][ T24] usb 4-1: new full-speed USB device number 76 using dummy_hcd [ 526.933576][T11026] veth0_macvtap: entered promiscuous mode [ 526.946301][T11026] veth1_macvtap: entered promiscuous mode [ 526.964891][T10972] usb usb2-port1: attempt power cycle [ 526.966862][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 526.984525][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 526.995436][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.008928][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.020443][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.038112][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.048244][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.058898][ T24] usb 4-1: device descriptor read/64, error -71 [ 527.068593][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.083635][T11026] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 527.100596][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 527.111188][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.121426][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 527.132437][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.143981][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 527.154534][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.164433][T11026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 527.175419][T11026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.186150][T11026] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 527.197775][T11026] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.206578][T11026] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.215456][T11026] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.224618][T11026] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.294723][ T9530] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.303154][ T24] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 527.304889][ T9530] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.329991][T10972] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 527.332908][ T9530] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.347791][ T9530] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.352507][T10972] usb 2-1: device descriptor read/8, error -71 [ 527.440850][ T24] usb 4-1: device descriptor read/64, error -71 [ 527.550887][ T24] usb usb4-port1: attempt power cycle [ 527.600024][T10972] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 527.621971][T10972] usb 2-1: device descriptor read/8, error -71 [ 527.650036][ T5865] usb 1-1: USB disconnect, device number 65 [ 527.730446][T10972] usb usb2-port1: unable to enumerate USB device [ 527.900035][ T24] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 527.931073][ T24] usb 4-1: device descriptor read/8, error -71 [ 528.069982][ T5865] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 528.199973][ T24] usb 4-1: new full-speed USB device number 79 using dummy_hcd [ 528.220771][ T24] usb 4-1: device descriptor read/8, error -71 [ 528.239932][ T5865] usb 1-1: Using ep0 maxpacket: 32 [ 528.246203][ T5865] usb 1-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 528.259223][ T5865] usb 1-1: config 1 interface 0 has no altsetting 0 [ 528.268767][ T5865] usb 1-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 528.278044][ T5865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.286107][ T5865] usb 1-1: Product: 㐁 [ 528.292631][ T5865] usb 1-1: Manufacturer: 렌ꙫ홦鴠굫﴿匍懩㖔鋁휧榛것唳るﳭ댏皒歸綯猪筵谩쑡⯡㥏骯䶠㞀ᗘ䡽疬㥨Ⰾ瞂촆貯뗚᐀魮咻躇쁹츴塎萆괅轹漨땵䈭ꀺ뇥΃㷦艌↓ꄣ憌缾౦店ꘇꓪへ⧳鍦돴䗿ﱱ禫௙ેิ云黒 [ 528.318614][ T5865] usb 1-1: SerialNumber: 䓯驅ᘼ諮⬅잰롭蠤ꔌ㔇⑂淬ᵱⓗ饊ᙳ뿬Ү媡⿘灝傍䮐鸟쁺쥅〮Ꮇ竳猴볕皾牚겒吁뢯螮慸ం⒠Ⲙ彯ᮻ쏨睈鵠㋏㓶衿ꭼ糣댘䕑廧挍栢杷匕㭜竖ﲵ罬謈⢯䧈ࠃˎ⦴̻껑ΰ噮Dz긳෤ⱘਪ蕭꿠租⤚㦖먙폗䵈枫圶䘵픃矙薌䳆 [ 528.356981][ T24] usb usb4-port1: unable to enumerate USB device [ 528.418843][ T9535] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.453856][T11134] sg_write: data in/out 209152/1 bytes for SCSI command 0xf2-- guessing data in; [ 528.453856][T11134] program syz.1.1360 not setting count and/or reply_len properly [ 528.576026][ T5865] usbhid 1-1:1.0: can't add hid device: -71 [ 528.582211][ T5865] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 528.593132][ T5865] usb 1-1: USB disconnect, device number 66 [ 528.944262][ T9535] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.192858][T11139] FAULT_INJECTION: forcing a failure. [ 529.192858][T11139] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 529.195321][T11141] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1362'. [ 529.208065][T11139] CPU: 0 UID: 0 PID: 11139 Comm: syz.0.1361 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 529.208087][T11139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 529.208095][T11139] Call Trace: [ 529.208100][T11139] [ 529.208105][T11139] dump_stack_lvl+0x16c/0x1f0 [ 529.208130][T11139] should_fail_ex+0x512/0x640 [ 529.208152][T11139] _copy_from_user+0x2e/0xd0 [ 529.208172][T11139] sg_write+0x2cc/0xe10 [ 529.208193][T11139] ? __pfx_sg_write+0x10/0x10 [ 529.208210][T11139] ? __pfx__kstrtoull+0x10/0x10 [ 529.208247][T11139] ? bpf_lsm_file_permission+0x9/0x10 [ 529.208266][T11139] ? security_file_permission+0x71/0x210 [ 529.208287][T11139] ? rw_verify_area+0xcf/0x680 [ 529.208312][T11139] ? __pfx_sg_write+0x10/0x10 [ 529.208329][T11139] vfs_writev+0x6c4/0xdc0 [ 529.208353][T11139] ? __pfx_vfs_writev+0x10/0x10 [ 529.208387][T11139] ? __fget_files+0x20e/0x3c0 [ 529.208407][T11139] ? __fget_files+0x1b0/0x3c0 [ 529.208432][T11139] ? do_writev+0x132/0x330 [ 529.208449][T11139] do_writev+0x132/0x330 [ 529.208468][T11139] ? __pfx_do_writev+0x10/0x10 [ 529.208485][T11139] ? rcu_is_watching+0x12/0xc0 [ 529.208508][T11139] do_syscall_64+0xcd/0x260 [ 529.208528][T11139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.208543][T11139] RIP: 0033:0x7f275758e969 [ 529.208554][T11139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 529.208568][T11139] RSP: 002b:00007f2758359038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 529.208582][T11139] RAX: ffffffffffffffda RBX: 00007f27577b5fa0 RCX: 00007f275758e969 [ 529.208591][T11139] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000003 [ 529.208599][T11139] RBP: 00007f2758359090 R08: 0000000000000000 R09: 0000000000000000 [ 529.208608][T11139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.208616][T11139] R13: 0000000000000000 R14: 00007f27577b5fa0 R15: 00007ffc7ded6328 [ 529.208635][T11139] [ 529.537771][T10791] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 529.553792][T10791] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 529.562605][T10791] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 529.573294][ T9535] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.584655][T10791] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 529.593464][T10791] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 529.684691][ T30] audit: type=1400 audit(2000000127.950:700): avc: denied { accept } for pid=11151 comm="syz.3.1366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 529.707861][ T9535] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.759796][T11155] input: syz1 as /devices/virtual/input/input58 [ 529.780227][ T5948] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 529.975854][ T30] audit: type=1400 audit(2000000128.190:701): avc: denied { setopt } for pid=11154 comm="syz.3.1367" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 530.149169][ T5948] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 530.175838][ T5948] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 530.237107][ T5948] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 530.271674][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.301086][T11161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.457137][T11162] 9pnet_fd: Insufficient options for proto=fd [ 530.470467][T11161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.493032][ T5948] usb 2-1: config 0 descriptor?? [ 530.499995][ T9535] bridge_slave_1: left allmulticast mode [ 530.500802][ T5948] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 530.505630][ T9535] bridge_slave_1: left promiscuous mode [ 530.522554][ T30] audit: type=1400 audit(2000000128.790:702): avc: denied { bind } for pid=11159 comm="syz.3.1368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 530.546715][ T9535] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.556196][ T9535] bridge_slave_0: left allmulticast mode [ 530.562440][ T9535] bridge_slave_0: left promiscuous mode [ 530.578551][ T9535] bridge0: port 1(bridge_slave_0) entered disabled state [ 530.979691][ T9535] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 531.022331][ T9535] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 531.038407][ T9535] bond0 (unregistering): Released all slaves [ 531.203937][T11147] lo speed is unknown, defaulting to 1000 [ 531.488568][T11147] chnl_net:caif_netlink_parms(): no params data found [ 531.652502][T10791] Bluetooth: hci2: command tx timeout [ 531.845981][T10972] usb 1-1: new low-speed USB device number 67 using dummy_hcd [ 532.022665][T11147] bridge0: port 1(bridge_slave_0) entered blocking state [ 532.030355][T11147] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.037611][T11147] bridge_slave_0: entered allmulticast mode [ 532.045563][T11147] bridge_slave_0: entered promiscuous mode [ 532.053752][T10972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 532.066635][T10972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 532.076677][T10972] usb 1-1: New USB device found, idVendor=046d, idProduct=c090, bcdDevice= 0.00 [ 532.086028][T10972] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.094246][ T9535] hsr_slave_0: left promiscuous mode [ 532.103277][T10972] usb 1-1: config 0 descriptor?? [ 532.111050][ T9535] hsr_slave_1: left promiscuous mode [ 532.118207][ T9535] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 532.139247][ T9535] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 532.154549][ T9535] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 532.178080][ T9535] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 532.322898][ T9535] veth1_macvtap: left promiscuous mode [ 532.334485][ T9535] veth0_macvtap: left promiscuous mode [ 532.344235][ T9535] veth1_vlan: left promiscuous mode [ 532.356143][ T9535] veth0_vlan: left promiscuous mode [ 532.846413][T10972] logitech-hidpp-device 0003:046D:C090.0019: unbalanced delimiter at end of report description [ 532.867349][T10972] logitech-hidpp-device 0003:046D:C090.0019: hidpp_probe:parse failed [ 532.876574][T10972] logitech-hidpp-device 0003:046D:C090.0019: probe with driver logitech-hidpp-device failed with error -22 [ 532.894184][T10972] usb 1-1: USB disconnect, device number 67 [ 532.976691][ T5948] usb 2-1: USB disconnect, device number 77 [ 533.993543][T10791] Bluetooth: hci2: command tx timeout [ 535.621310][T11211] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1378'. [ 535.748980][T11220] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1379'. [ 536.050039][T10791] Bluetooth: hci2: command tx timeout [ 536.062161][ T5914] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 536.258896][ T5914] usb 2-1: Using ep0 maxpacket: 16 [ 536.293900][ T5914] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 536.365983][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 536.422558][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 536.485210][ T5914] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 536.551636][ T5914] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 536.613650][ T5914] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 536.660467][ T5914] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 536.706189][ T5914] usb 2-1: Manufacturer: syz [ 536.729145][ T5914] usb 2-1: config 0 descriptor?? [ 536.872988][ T9535] team0 (unregistering): Port device team_slave_1 removed [ 536.909754][ T9535] team0 (unregistering): Port device team_slave_0 removed [ 537.214479][T11147] bridge0: port 2(bridge_slave_1) entered blocking state [ 537.222104][T11147] bridge0: port 2(bridge_slave_1) entered disabled state [ 537.229234][T11147] bridge_slave_1: entered allmulticast mode [ 537.236716][T11147] bridge_slave_1: entered promiscuous mode [ 537.274941][T11211] 8021q: adding VLAN 0 to HW filter on device team2 [ 537.531532][ T30] audit: type=1326 audit(2000000135.800:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11221 comm="syz.3.1381" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x0 [ 537.561404][T11220] 8021q: adding VLAN 0 to HW filter on device team1 [ 537.961414][ T30] audit: type=1326 audit(2000000136.220:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11221 comm="syz.3.1381" exe="/root/syz-executor" sig=31 arch=c000003e syscall=230 compat=0 ip=0x7f0dc3bc1225 code=0x0 [ 538.006901][T11147] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 538.018616][T11147] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 538.073972][T11147] team0: Port device team_slave_0 added [ 538.104208][T11147] team0: Port device team_slave_1 added [ 538.130767][T10791] Bluetooth: hci2: command tx timeout [ 538.153050][T11147] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 538.207327][T11147] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 538.288683][T11147] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 538.338553][T11147] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 538.377049][T11147] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 538.448579][T11147] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 538.519458][T11147] hsr_slave_0: entered promiscuous mode [ 538.529628][T11237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.545094][T11237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.554282][T11147] hsr_slave_1: entered promiscuous mode [ 538.564508][T11147] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 538.573419][T11147] Cannot create hsr debugfs directory [ 539.448691][ T5914] rc_core: IR keymap rc-hauppauge not found [ 539.454724][ T5914] Registered IR keymap rc-empty [ 539.462742][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 539.490031][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 539.513191][ T5914] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 540.440793][ T5914] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input59 [ 540.463299][T11248] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 540.472899][T11248] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 540.550474][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 540.676673][T11248] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 540.773803][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 540.850676][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 540.857141][T11260] set match dimension is over the limit! [ 540.885527][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.127540][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.161607][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.177105][T11264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.192351][T11264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 541.192437][T11265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.208819][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.221440][T11265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 541.230418][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.250178][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.255989][T11147] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 541.276045][T11147] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 541.286073][T11147] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 541.298533][T11147] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 541.361212][ T5914] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 541.380191][T10972] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 541.402633][ T5914] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 541.411865][ T5914] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 541.514934][ T30] audit: type=1400 audit(2000000139.770:705): avc: denied { mounton } for pid=11266 comm="syz.1.1393" path="/295/file0" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=dir permissive=1 [ 541.650384][T10791] Bluetooth: hci2: command 0x0c1a tx timeout [ 541.828947][T11147] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.838251][ T5914] usb 2-1: USB disconnect, device number 78 [ 541.855128][T11147] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.867359][ T9534] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.874471][ T9534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 541.895217][ T9530] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.902342][ T9530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 541.904570][T10972] usb 4-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 541.938844][T10972] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=16 [ 541.954744][T10972] usb 4-1: SerialNumber: syz [ 541.964914][T10972] usb 4-1: config 0 descriptor?? [ 542.098936][T11147] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.137122][T11147] veth0_vlan: entered promiscuous mode [ 542.149447][T11147] veth1_vlan: entered promiscuous mode [ 542.161930][T11276] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1394'. [ 542.261450][T11276] vxcan1 (unregistering): left allmulticast mode [ 542.291994][T11147] veth0_macvtap: entered promiscuous mode [ 542.304951][T11284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.317447][T11284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.342108][T11147] veth1_macvtap: entered promiscuous mode [ 542.371988][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 542.383426][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 542.393538][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 542.404541][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 542.404703][T10972] hackrf 4-1:0.0: Board ID: 00 [ 542.422651][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 542.433492][T10972] hackrf 4-1:0.0: Firmware version: { [ 542.441718][T10972] videodev: could not get a free minor [ 542.447314][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 542.457243][T10972] hackrf 4-1:0.0: Failed to register as video device (-23) [ 542.464633][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 542.476055][T10972] hackrf 4-1:0.0: probe with driver hackrf failed with error -23 [ 542.488325][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 542.521292][T11147] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.993531][T10971] usb 4-1: USB disconnect, device number 80 [ 543.327054][T11297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.338192][T11297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.730100][T10791] Bluetooth: hci2: command 0x0c1a tx timeout [ 544.283128][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 544.295936][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 544.306238][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 544.379146][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 544.404100][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 544.435505][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 544.448759][T11147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 544.459565][T11147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 544.473512][T11147] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 544.481530][T11309] syz_tun: entered allmulticast mode [ 544.488872][T11307] tipc: Started in network mode [ 544.494934][T11307] tipc: Node identity ac1414aa, cluster identity 4711 [ 544.507271][ T30] audit: type=1400 audit(2000000142.770:706): avc: denied { listen } for pid=11316 comm="syz.1.1405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 544.521347][T11307] tipc: Enabled bearer , priority 10 [ 544.546339][T11147] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.560409][T11147] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.569214][T11147] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.578358][T11147] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.594008][T11307] syz_tun: left allmulticast mode [ 544.671402][ T9530] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.685651][ T9530] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.713981][ T9530] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.723399][ T9530] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.741821][T11324] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.1406' sets config #0 [ 545.040677][T10971] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 545.058367][T11330] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1410'. [ 545.178068][T11334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1411'. [ 545.199591][T10971] usb 1-1: device descriptor read/64, error -71 [ 545.302278][T11334] 8021q: adding VLAN 0 to HW filter on device team1 [ 545.500695][ T5860] tipc: Node number set to 2886997162 [ 546.094404][T11335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.128570][T11335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.249962][T10971] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 546.613903][ T9522] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.652132][T10971] usb 1-1: device descriptor read/64, error -71 [ 546.680581][T11343] vlan2: entered allmulticast mode [ 546.686024][T11346] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1414'. [ 546.760322][T10971] usb usb1-port1: attempt power cycle [ 547.100345][T10971] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 547.120629][T10971] usb 1-1: device descriptor read/8, error -71 [ 547.144166][ T30] audit: type=1326 audit(2000000145.410:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.168072][ T30] audit: type=1326 audit(2000000145.410:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.196337][ T30] audit: type=1326 audit(2000000145.410:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.233171][ T30] audit: type=1326 audit(2000000145.410:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.257245][ T30] audit: type=1326 audit(2000000145.410:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.281224][ T30] audit: type=1326 audit(2000000145.410:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.305300][ T30] audit: type=1326 audit(2000000145.410:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.328659][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.334958][ T30] audit: type=1326 audit(2000000145.410:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.358860][ T30] audit: type=1326 audit(2000000145.410:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11341 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dc3b8e969 code=0x7fc00000 [ 547.359935][T10971] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 547.382228][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.410704][T10971] usb 1-1: device descriptor read/8, error -71 [ 547.526747][T10971] usb usb1-port1: unable to enumerate USB device [ 547.588392][T11356] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1015 sclass=netlink_route_socket pid=11356 comm=syz.1.1418 [ 547.653235][T11354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.694730][T11354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.814148][T11362] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1419'. [ 547.914184][T11362] 8021q: adding VLAN 0 to HW filter on device team1 [ 548.354859][ T9522] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.913771][ T9522] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.925919][T10558] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 548.936471][T10558] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 549.728695][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 549.728709][ T30] audit: type=1400 audit(2000000147.390:722): avc: denied { ioctl } for pid=11367 comm="syz.5.1422" path="/dev/btrfs-control" dev="devtmpfs" ino=1309 ioctlcmd=0x9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 549.728829][ T5948] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 549.741084][ T30] audit: type=1400 audit(2000000147.990:723): avc: denied { ioctl } for pid=11370 comm="syz.0.1423" path="mnt:[4026532969]" dev="nsfs" ino=4026532969 ioctlcmd=0x940a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 549.770681][T10558] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 549.807128][T10558] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 549.820767][T11382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.903392][T10558] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 549.934983][T11382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.991819][ T9522] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.220270][ T5948] usb 2-1: Using ep0 maxpacket: 16 [ 550.239511][ T5948] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 550.262235][T11389] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1426'. [ 550.345772][T11389] 8021q: adding VLAN 0 to HW filter on device team2 [ 551.019389][ T5948] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 551.145880][ T5948] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.168867][ T5948] usb 2-1: Product: syz [ 551.196178][ T5948] usb 2-1: Manufacturer: syz [ 551.220278][ T5948] usb 2-1: SerialNumber: syz [ 551.253865][ T5948] usb 2-1: config 0 descriptor?? [ 551.303705][ T9522] bridge_slave_1: left allmulticast mode [ 551.309344][ T9522] bridge_slave_1: left promiscuous mode [ 551.317559][ T5948] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 551.773314][ T5948] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 551.790201][ T9522] bridge0: port 2(bridge_slave_1) entered disabled state [ 551.834680][ T9522] bridge_slave_0: left allmulticast mode [ 551.868399][ T9522] bridge_slave_0: left promiscuous mode [ 551.908980][ T9522] bridge0: port 1(bridge_slave_0) entered disabled state [ 552.078944][T10791] Bluetooth: hci2: command tx timeout [ 552.298729][ T5948] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 552.440529][T10970] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 552.585683][ T9522] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 552.598622][ T9522] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 552.599942][T10970] usb 4-1: Using ep0 maxpacket: 16 [ 552.764302][ T9522] bond0 (unregistering): Released all slaves [ 552.920994][T10970] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 552.931255][T10970] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 552.944127][T10970] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 552.956469][T10970] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 552.966352][T10970] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 552.983791][T11369] lo speed is unknown, defaulting to 1000 [ 552.993664][T10970] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 553.004286][T10970] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 553.013834][T10970] usb 4-1: Manufacturer: syz [ 553.013966][T11366] ptrace attach of "./syz-executor exec"[5808] was attempted by "./syz-executor exec"[11366] [ 553.036499][T10970] usb 4-1: config 0 descriptor?? [ 553.155493][ T5948] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 553.184666][ T5948] em28xx 2-1:0.0: board has no eeprom [ 553.272270][ T5948] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 553.280538][T11401] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 553.286628][T11401] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 553.292759][ T5948] em28xx 2-1:0.0: dvb set to bulk mode. [ 553.292837][T10972] em28xx 2-1:0.0: Binding DVB extension [ 553.317323][ T5948] usb 2-1: USB disconnect, device number 79 [ 553.372093][ T5948] em28xx 2-1:0.0: Disconnecting em28xx [ 553.387338][T11401] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 553.467029][T10972] em28xx 2-1:0.0: Registering input extension [ 553.475265][ T5948] em28xx 2-1:0.0: Closing input extension [ 553.483179][T10970] rc_core: IR keymap rc-hauppauge not found [ 553.489133][T10970] Registered IR keymap rc-empty [ 553.495648][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.523654][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.532535][ T5948] em28xx 2-1:0.0: Freeing device [ 553.555807][T10970] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 553.601138][T10970] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input60 [ 553.647728][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.690041][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.707633][T10961] usb 6-1: USB disconnect, device number 17 [ 553.727678][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.793619][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.864922][T11369] chnl_net:caif_netlink_parms(): no params data found [ 553.875478][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.920035][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.950007][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.970709][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.000218][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.029542][T10970] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.065943][T10970] mceusb 4-1:0.0: Registered ﵩ with mce emulator interface version 1 [ 554.114557][T10970] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 554.217622][T10970] usb 4-1: USB disconnect, device number 81 [ 555.021786][T11425] Lens B: ================= START STATUS ================= [ 555.029205][T11425] Lens B: Focus, Absolute: 0 [ 555.033970][T11425] Lens B: ================== END STATUS ================== [ 555.204405][ T9522] hsr_slave_0: left promiscuous mode [ 555.330397][T10791] Bluetooth: hci2: command 0x040f tx timeout [ 555.336769][ T9522] hsr_slave_1: left promiscuous mode [ 555.343272][ T9522] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 555.359918][ T9522] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 555.360051][T11432] FAULT_INJECTION: forcing a failure. [ 555.360051][T11432] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.381410][T11432] CPU: 1 UID: 0 PID: 11432 Comm: syz.0.1437 Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 555.381434][T11432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 555.381445][T11432] Call Trace: [ 555.381451][T11432] [ 555.381458][T11432] dump_stack_lvl+0x16c/0x1f0 [ 555.381486][T11432] should_fail_ex+0x512/0x640 [ 555.381512][T11432] _copy_to_user+0x32/0xd0 [ 555.381537][T11432] simple_read_from_buffer+0xcb/0x170 [ 555.381563][T11432] proc_fail_nth_read+0x197/0x270 [ 555.381589][T11432] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 555.381614][T11432] ? rw_verify_area+0xcf/0x680 [ 555.381634][T11432] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 555.381659][T11432] vfs_read+0x1de/0xc70 [ 555.381686][T11432] ? __pfx___mutex_lock+0x10/0x10 [ 555.381713][T11432] ? __pfx_vfs_read+0x10/0x10 [ 555.381743][T11432] ? __fget_files+0x20e/0x3c0 [ 555.381775][T11432] ksys_read+0x12a/0x240 [ 555.381810][T11432] ? __pfx_ksys_read+0x10/0x10 [ 555.381832][T11432] ? rcu_is_watching+0x12/0xc0 [ 555.381859][T11432] do_syscall_64+0xcd/0x260 [ 555.381883][T11432] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.381900][T11432] RIP: 0033:0x7f275758d37c [ 555.381915][T11432] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 555.381936][T11432] RSP: 002b:00007f2758359030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 555.381952][T11432] RAX: ffffffffffffffda RBX: 00007f27577b5fa0 RCX: 00007f275758d37c [ 555.381962][T11432] RDX: 000000000000000f RSI: 00007f27583590a0 RDI: 0000000000000004 [ 555.381972][T11432] RBP: 00007f2758359090 R08: 0000000000000000 R09: 0000000000000000 [ 555.381982][T11432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.381992][T11432] R13: 0000000000000000 R14: 00007f27577b5fa0 R15: 00007ffc7ded6328 [ 555.382016][T11432] [ 555.393011][ T9522] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 555.549591][T10558] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 555.552262][ T9522] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 555.564819][T10558] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 555.613997][T10558] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 555.621736][T10558] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 555.629169][T10558] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 555.661392][ T9522] veth1_macvtap: left promiscuous mode [ 555.667142][ T9522] veth0_macvtap: left promiscuous mode [ 555.673286][ T9522] veth1_vlan: left promiscuous mode [ 555.678823][ T9522] veth0_vlan: left promiscuous mode [ 555.839990][T10970] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 556.001045][T10970] usb 1-1: Using ep0 maxpacket: 16 [ 556.014911][T10970] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 556.015300][ T9522] team0 (unregistering): Port device team_slave_1 removed [ 556.026418][T10970] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 556.041622][T10970] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.049626][T10970] usb 1-1: Product: syz [ 556.054061][T10970] usb 1-1: Manufacturer: syz [ 556.058698][T10970] usb 1-1: SerialNumber: syz [ 556.069668][T10970] usb 1-1: config 0 descriptor?? [ 556.077991][T10970] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 556.089969][T10970] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 556.090259][ T9522] team0 (unregistering): Port device team_slave_0 removed [ 556.286086][T11437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.303099][T11437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.392920][T10970] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 556.474944][T10970] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 556.495887][T10970] em28xx 1-1:0.0: board has no eeprom [ 556.576491][T10970] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 556.731328][T11446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1439'. [ 556.759311][T11446] kAFS: unparsable volume name [ 556.789629][ T30] audit: type=1400 audit(2000000155.020:724): avc: denied { mounton } for pid=11440 comm="syz.0.1439" path="/syzcgroup/unified/syz0" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 556.949767][T10970] em28xx 1-1:0.0: dvb set to bulk mode. [ 556.955454][T10961] em28xx 1-1:0.0: Binding DVB extension [ 556.971848][T10970] usb 1-1: USB disconnect, device number 72 [ 556.978663][T10970] em28xx 1-1:0.0: Disconnecting em28xx [ 557.007914][T11369] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.022545][T11369] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.044265][T11369] bridge_slave_0: entered allmulticast mode [ 557.079702][T11369] bridge_slave_0: entered promiscuous mode [ 557.086447][T10961] em28xx 1-1:0.0: Registering input extension [ 557.105544][T10970] em28xx 1-1:0.0: Closing input extension [ 557.129122][T11369] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.147773][T11369] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.165386][T10970] em28xx 1-1:0.0: Freeing device [ 557.182010][T11369] bridge_slave_1: entered allmulticast mode [ 557.201866][T11369] bridge_slave_1: entered promiscuous mode [ 557.275529][T11452] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (34359738360 ns) > initial count (3800 ns). Using initial count to start timer. [ 557.301343][ T30] audit: type=1400 audit(2000000155.540:725): avc: denied { watch watch_reads } for pid=11451 comm="syz.1.1440" path="pipe:[35854]" dev="pipefs" ino=35854 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 557.325344][ C1] vkms_vblank_simulate: vblank timer overrun [ 557.404070][T11369] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 557.413999][T10558] Bluetooth: hci2: command 0x040f tx timeout [ 557.441443][T11369] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 557.509753][T11369] team0: Port device team_slave_0 added [ 557.519755][T11369] team0: Port device team_slave_1 added [ 557.652345][T10558] Bluetooth: hci4: command tx timeout [ 557.710299][T10970] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 557.883641][T11460] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 557.893816][T11460] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 557.911535][T11369] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 557.913525][T11460] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 557.918514][T11369] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 557.970669][T10970] usb 1-1: Using ep0 maxpacket: 8 [ 557.978119][T10970] usb 1-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 557.994015][T10970] usb 1-1: config 1 interface 0 has no altsetting 0 [ 558.000848][T11369] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 558.003663][T11460] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 558.023289][T10970] usb 1-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.40 [ 558.032366][T10970] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.050539][T10970] usb 1-1: Product: 䇮싦㯴ꚓ㗆樍쟳蜱먕g㦬鿲傒獵뢡굃࿌捪寯嬊筠ቸ [ 558.060341][T10970] usb 1-1: Manufacturer: ↞죃렑ﵵ砽鬵娶뻧꿊갶汻ၓꕮﴫ╗畯൷ѡᮑꝣ堠빣ᖚ㷮췢뎄觠딊ϕ狓 [ 558.074306][T10970] usb 1-1: SerialNumber: 묈ꌖ뙻깜∡衑飦牼蔁텿⧍셢嘨㮘믔䏞짬깂㣖촤绷줮콈㹧숷ᦇ児킳结깟밳擄钛嗪甁ே仹ቦ皖㖳芨뽱ყ癇셶ญ㥋⸪ꊜռ⧍Ჴ밥丆誠琣ጱ뽈ᄗꥐ框䕣仲蛺㶜Ϥὴ郶⾜䰂쫘↿㱂䞋ﵠ倡㳊翩褽玞퉣њه㍩ [ 558.074367][T11433] lo speed is unknown, defaulting to 1000 [ 558.122837][T11369] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 558.130218][T11369] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 558.156245][T11369] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 558.240309][T11369] hsr_slave_0: entered promiscuous mode [ 558.246642][T11369] hsr_slave_1: entered promiscuous mode [ 558.253330][T11369] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 558.262712][T11369] Cannot create hsr debugfs directory [ 558.334608][T10970] usbhid 1-1:1.0: can't add hid device: -71 [ 558.342822][T10970] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 558.363403][T10970] usb 1-1: USB disconnect, device number 73 [ 558.451215][T11433] chnl_net:caif_netlink_parms(): no params data found [ 558.532539][T11433] bridge0: port 1(bridge_slave_0) entered blocking state [ 558.539741][T11433] bridge0: port 1(bridge_slave_0) entered disabled state [ 558.540181][T10972] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 558.546964][T11433] bridge_slave_0: entered allmulticast mode [ 558.563527][T11433] bridge_slave_0: entered promiscuous mode [ 558.570978][T11433] bridge0: port 2(bridge_slave_1) entered blocking state [ 558.605293][T11433] bridge0: port 2(bridge_slave_1) entered disabled state [ 558.617108][T11433] bridge_slave_1: entered allmulticast mode [ 558.624419][T11433] bridge_slave_1: entered promiscuous mode [ 558.657896][T11433] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 558.668965][T11433] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 558.707693][T11433] team0: Port device team_slave_0 added [ 558.710009][T10972] usb 2-1: Using ep0 maxpacket: 16 [ 558.720825][T10972] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.721143][T11433] team0: Port device team_slave_1 added [ 558.731372][T10972] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 558.748016][T10972] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 558.763602][T10972] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 558.773535][T10972] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 558.789301][T11433] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 558.793211][T10972] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 558.796502][T11433] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 558.808957][T10972] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 558.840826][T11433] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 558.842482][T10972] usb 2-1: Manufacturer: syz [ 558.853112][T11433] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 558.863246][T11433] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 558.863341][T10970] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 558.889560][T11433] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 558.939527][T10972] usb 2-1: config 0 descriptor?? [ 558.986168][T11433] hsr_slave_0: entered promiscuous mode [ 558.994336][T11433] hsr_slave_1: entered promiscuous mode [ 559.001091][T11433] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 559.008722][T11433] Cannot create hsr debugfs directory [ 559.107971][T11480] veth0_vlan: entered allmulticast mode [ 559.171142][T11480] veth0_vlan: left promiscuous mode [ 559.180176][T11480] veth0_vlan: entered promiscuous mode [ 559.445867][T11369] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 559.550006][T11369] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 559.584915][T11369] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 559.585888][T10970] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.602199][T10970] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 559.615642][T10970] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 559.624837][T10970] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.634143][T11369] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 559.635248][T10970] usb 4-1: config 0 descriptor?? [ 559.649087][T10970] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 559.656475][T10972] rc_core: IR keymap rc-hauppauge not found [ 559.660044][T10558] Bluetooth: hci2: command 0x040f tx timeout [ 559.662573][T10972] Registered IR keymap rc-empty [ 559.682264][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.701788][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.724406][T10972] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 559.739435][T10972] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input63 [ 559.759471][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.781423][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.808488][T11433] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.824486][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.850300][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.880512][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.910248][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.931821][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.941482][T11433] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.950540][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.970183][T10558] Bluetooth: hci4: command 0x040f tx timeout [ 559.976301][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 559.977382][T11369] 8021q: adding VLAN 0 to HW filter on device bond0 [ 560.001815][T11369] 8021q: adding VLAN 0 to HW filter on device team0 [ 560.010882][T10972] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 560.024659][ T9533] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.031814][ T9533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 560.065514][T10972] mceusb 2-1:0.0: Registered ﵩ with mce emulator interface version 1 [ 560.075318][ T9533] bridge0: port 2(bridge_slave_1) entered blocking state [ 560.082445][ T9533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 560.099518][T10972] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 560.129648][T10972] usb 2-1: USB disconnect, device number 80 [ 560.327611][T11433] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.389454][ T30] audit: type=1400 audit(2000000158.650:726): avc: denied { write } for pid=11485 comm="syz.0.1449" name="sequencer2" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:apt_lock_t:s0" [ 560.870576][ T30] audit: type=1400 audit(2000000159.120:727): avc: denied { ioctl } for pid=11485 comm="syz.0.1449" path="/dev/sequencer2" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:apt_lock_t:s0" [ 561.052930][T11433] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.509401][T11433] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 561.527371][T11433] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 561.545912][T11433] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 561.564887][T11433] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 561.732483][T10558] Bluetooth: hci2: command 0x040f tx timeout [ 561.759444][T11369] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 561.794299][T11507] netlink: 'syz.1.1453': attribute type 29 has an invalid length. [ 561.818093][T11507] netlink: 'syz.1.1453': attribute type 29 has an invalid length. [ 561.834151][T11507] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1453'. [ 561.851556][T11433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 561.869964][ T5914] usb 1-1: new full-speed USB device number 74 using dummy_hcd [ 561.906161][T11433] 8021q: adding VLAN 0 to HW filter on device team0 [ 561.948992][ T9533] bridge0: port 1(bridge_slave_0) entered blocking state [ 561.956152][ T9533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 561.978311][ T9533] bridge0: port 2(bridge_slave_1) entered blocking state [ 561.985457][ T9533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.013063][T11369] veth0_vlan: entered promiscuous mode [ 562.037581][T11369] veth1_vlan: entered promiscuous mode [ 562.051932][T10558] Bluetooth: hci4: command 0x040f tx timeout [ 562.060774][ T5914] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 562.069373][ T5914] usb 1-1: config 0 has no interface number 0 [ 562.076025][ T5914] usb 1-1: config 0 interface 41 has no altsetting 0 [ 562.085773][ T5914] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 562.095125][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.103563][ T5914] usb 1-1: Product: syz [ 562.107811][ T5914] usb 1-1: Manufacturer: syz [ 562.112528][ T5914] usb 1-1: SerialNumber: syz [ 562.123690][ T5914] usb 1-1: config 0 descriptor?? [ 562.137135][T11369] veth0_macvtap: entered promiscuous mode [ 562.159310][T11369] veth1_macvtap: entered promiscuous mode [ 562.176720][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 562.188656][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.199171][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 562.213941][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.224144][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 562.237869][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.248368][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 562.261666][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.272878][T11369] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 562.293932][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.315675][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.329712][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.340836][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.351667][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.362516][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.372676][T11369] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 562.384320][T11369] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 562.435790][ T5948] usb 4-1: USB disconnect, device number 82 [ 562.452583][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.478833][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.489543][T11369] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 562.499072][T11513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1454'. [ 562.529698][T11513] 8021q: adding VLAN 0 to HW filter on device team2 [ 562.544221][T11369] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.555609][T11369] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.570011][T11369] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.580631][T11369] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.593482][T11515] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1455'. [ 562.723509][T11515] team0 (unregistering): Port device team_slave_0 removed [ 562.735217][T11515] team0 (unregistering): Port device team_slave_1 removed [ 562.776820][T11433] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 562.909441][ T9534] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.067352][ T5860] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 563.080037][ T9534] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 563.119892][ T9534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.127769][ T9534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 563.658071][T11503] ip6t_srh: unknown srh invflags 7863 [ 563.663614][ T5860] usb 2-1: Using ep0 maxpacket: 8 [ 563.742046][ T5860] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 563.837872][T10558] Bluetooth: hci2: command 0x040f tx timeout [ 563.859923][ T5860] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.873544][T11369] ================================================================== [ 563.881605][T11369] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0 [ 563.889333][T11369] Write of size 8 at addr ffff888033400408 by task syz-executor/11369 [ 563.897483][T11369] [ 563.899805][T11369] CPU: 1 UID: 0 PID: 11369 Comm: syz-executor Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 563.899828][T11369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 563.899838][T11369] Call Trace: [ 563.899844][T11369] [ 563.899850][T11369] dump_stack_lvl+0x116/0x1f0 [ 563.899881][T11369] print_report+0xc3/0x670 [ 563.899899][T11369] ? __virt_addr_valid+0x5e/0x590 [ 563.899920][T11369] ? __phys_addr+0xc6/0x150 [ 563.899942][T11369] ? binder_add_device+0xa4/0xb0 [ 563.899963][T11369] kasan_report+0xe0/0x110 [ 563.899979][T11369] ? binder_add_device+0xa4/0xb0 [ 563.900000][T11369] binder_add_device+0xa4/0xb0 [ 563.900020][T11369] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 563.900048][T11369] binderfs_fill_super+0x8d4/0x1360 [ 563.900075][T11369] ? __pfx_binderfs_fill_super+0x10/0x10 [ 563.900108][T11369] ? shrinker_register+0x1a8/0x260 [ 563.900126][T11369] ? sget_fc+0x808/0xc20 [ 563.900148][T11369] ? __pfx_set_anon_super_fc+0x10/0x10 [ 563.900170][T11369] ? __pfx_binderfs_fill_super+0x10/0x10 [ 563.900194][T11369] get_tree_nodev+0xda/0x190 [ 563.900223][T11369] vfs_get_tree+0x8b/0x340 [ 563.900244][T11369] path_mount+0x14d4/0x1f20 [ 563.900261][T11369] ? kmem_cache_free+0x2d4/0x4d0 [ 563.900285][T11369] ? __pfx_path_mount+0x10/0x10 [ 563.900303][T11369] ? putname+0x154/0x1a0 [ 563.900321][T11369] __x64_sys_mount+0x28d/0x310 [ 563.900343][T11369] ? __pfx___x64_sys_mount+0x10/0x10 [ 563.900359][T11369] ? rcu_is_watching+0x12/0xc0 [ 563.900382][T11369] do_syscall_64+0xcd/0x260 [ 563.900404][T11369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.900422][T11369] RIP: 0033:0x7f427759010a [ 563.900437][T11369] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 563.900454][T11369] RSP: 002b:00007ffde1dc7b18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 563.900471][T11369] RAX: ffffffffffffffda RBX: 00007f4277610e74 RCX: 00007f427759010a [ 563.900482][T11369] RDX: 00007f42776208cb RSI: 00007f4277610e74 RDI: 00007f42776208cb [ 563.900493][T11369] RBP: 00007f42776110bd R08: 0000000000000000 R09: 00007f42777b6738 [ 563.900503][T11369] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f42775ec1a8 [ 563.900513][T11369] R13: 00007f42775ec180 R14: 0000000000000009 R15: 0000000000000000 [ 563.900530][T11369] [ 563.900535][T11369] [ 563.917594][T11433] veth0_vlan: entered promiscuous mode [ 563.922775][T11369] Allocated by task 8954: [ 563.922786][T11369] kasan_save_stack+0x33/0x60 [ 563.922813][T11369] kasan_save_track+0x14/0x30 [ 563.922835][T11369] __kasan_kmalloc+0xaa/0xb0 [ 564.157379][T11369] binderfs_binder_device_create.isra.0+0x17a/0xb70 [ 564.163961][T11369] binderfs_fill_super+0x8d4/0x1360 [ 564.169144][T11369] get_tree_nodev+0xda/0x190 [ 564.173719][T11369] vfs_get_tree+0x8b/0x340 [ 564.178116][T11369] path_mount+0x14d4/0x1f20 [ 564.182599][T11369] __x64_sys_mount+0x28d/0x310 [ 564.187341][T11369] do_syscall_64+0xcd/0x260 [ 564.191826][T11369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.197695][T11369] [ 564.200000][T11369] Freed by task 10972: [ 564.204040][T11369] kasan_save_stack+0x33/0x60 [ 564.208703][T11369] kasan_save_track+0x14/0x30 [ 564.213364][T11369] kasan_save_free_info+0x3b/0x60 [ 564.218367][T11369] __kasan_slab_free+0x51/0x70 [ 564.223109][T11369] kfree+0x2b6/0x4d0 [ 564.226988][T11369] binder_proc_dec_tmpref+0x4c3/0x590 [ 564.232340][T11369] binder_deferred_func+0xe87/0x12c0 [ 564.237604][T11369] process_one_work+0x9cc/0x1b70 [ 564.242519][T11369] worker_thread+0x6c8/0xf10 [ 564.247088][T11369] kthread+0x3c2/0x780 [ 564.251136][T11369] ret_from_fork+0x45/0x80 [ 564.255531][T11369] ret_from_fork_asm+0x1a/0x30 [ 564.260279][T11369] [ 564.262581][T11369] The buggy address belongs to the object at ffff888033400400 [ 564.262581][T11369] which belongs to the cache kmalloc-512 of size 512 [ 564.276609][T11369] The buggy address is located 8 bytes inside of [ 564.276609][T11369] freed 512-byte region [ffff888033400400, ffff888033400600) [ 564.290205][T11369] [ 564.292508][T11369] The buggy address belongs to the physical page: [ 564.298892][T11369] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33400 [ 564.307628][T11369] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 564.316102][T11369] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 564.323624][T11369] page_type: f5(slab) [ 564.327584][T11369] raw: 00fff00000000040 ffff88801b441c80 dead000000000100 dead000000000122 [ 564.336145][T11369] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 564.344710][T11369] head: 00fff00000000040 ffff88801b441c80 dead000000000100 dead000000000122 [ 564.353357][T11369] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 564.362005][T11369] head: 00fff00000000002 ffffea0000cd0001 00000000ffffffff 00000000ffffffff [ 564.370652][T11369] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 564.379295][T11369] page dumped because: kasan: bad access detected [ 564.385679][T11369] page_owner tracks the page as allocated [ 564.391370][T11369] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5818, tgid 5818 (syz-executor), ts 69294009110, free_ts 69256569450 [ 564.410622][T11369] post_alloc_hook+0x181/0x1b0 [ 564.415372][T11369] get_page_from_freelist+0x135c/0x3920 [ 564.420902][T11369] __alloc_frozen_pages_noprof+0x263/0x23a0 [ 564.426782][T11369] alloc_pages_mpol+0x1fb/0x550 [ 564.431610][T11369] new_slab+0x244/0x340 [ 564.435749][T11369] ___slab_alloc+0xd9c/0x1940 [ 564.440407][T11369] __slab_alloc.constprop.0+0x56/0xb0 [ 564.445761][T11369] __kmalloc_noprof+0x2f2/0x510 [ 564.450595][T11369] fib6_info_alloc+0x40/0x160 [ 564.455250][T11369] ip6_route_info_create+0x33f/0x18e0 [ 564.460604][T11369] addrconf_f6i_alloc+0x391/0x670 [ 564.465611][T11369] addrconf_notify+0x10a1/0x19e0 [ 564.470529][T11369] notifier_call_chain+0xb9/0x410 [ 564.475550][T11369] call_netdevice_notifiers_info+0xbe/0x140 [ 564.481428][T11369] __dev_notify_flags+0x12c/0x2e0 [ 564.486428][T11369] netif_change_flags+0x108/0x160 [ 564.491429][T11369] page last free pid 5815 tgid 5815 stack trace: [ 564.497729][T11369] __free_frozen_pages+0x69d/0xff0 [ 564.502825][T11369] __put_partials+0x16d/0x1c0 [ 564.507482][T11369] qlist_free_all+0x4e/0x120 [ 564.512057][T11369] kasan_quarantine_reduce+0x195/0x1e0 [ 564.517499][T11369] __kasan_slab_alloc+0x69/0x90 [ 564.522329][T11369] kmem_cache_alloc_node_noprof+0x1d5/0x3b0 [ 564.528205][T11369] __alloc_skb+0x2b2/0x380 [ 564.532599][T11369] netlink_alloc_large_skb+0x69/0x130 [ 564.537949][T11369] netlink_sendmsg+0x6a1/0xdd0 [ 564.542695][T11369] __sys_sendto+0x495/0x510 [ 564.547184][T11369] __x64_sys_sendto+0xe0/0x1c0 [ 564.551933][T11369] do_syscall_64+0xcd/0x260 [ 564.556417][T11369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.562288][T11369] [ 564.564590][T11369] Memory state around the buggy address: [ 564.570195][T11369] ffff888033400300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 564.578233][T11369] ffff888033400380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 564.586271][T11369] >ffff888033400400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 564.594306][T11369] ^ [ 564.598607][T11369] ffff888033400480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 564.606643][T11369] ffff888033400500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 564.614678][T11369] ================================================================== [ 564.624672][ T5860] usb 2-1: Product: syz [ 564.629682][ T5860] usb 2-1: Manufacturer: syz [ 564.635359][ T5860] usb 2-1: SerialNumber: syz [ 564.644601][T11433] veth1_vlan: entered promiscuous mode [ 564.660618][ T5860] usb 2-1: config 0 descriptor?? [ 564.669293][ T30] audit: type=1400 audit(2000000162.930:728): avc: denied { read } for pid=5167 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 564.681972][T10558] Bluetooth: hci4: command 0x040f tx timeout [ 564.691730][ T30] audit: type=1400 audit(2000000162.930:729): avc: denied { search } for pid=5167 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 564.720445][ T30] audit: type=1400 audit(2000000162.930:730): avc: denied { write } for pid=5167 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 564.742181][ T30] audit: type=1400 audit(2000000162.930:731): avc: denied { add_name } for pid=5167 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 564.763737][ T30] audit: type=1400 audit(2000000162.930:732): avc: denied { create } for pid=5167 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 564.788155][ T30] audit: type=1400 audit(2000000162.930:733): avc: denied { append open } for pid=5167 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 564.858698][T11433] veth0_macvtap: entered promiscuous mode [ 564.868188][T11433] veth1_macvtap: entered promiscuous mode [ 564.890368][ T30] audit: type=1400 audit(2000000162.930:734): avc: denied { getattr } for pid=5167 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 564.938822][ T5914] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 564.950473][ T5914] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 564.961035][ T5914] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 564.971460][T11369] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 564.978660][T11369] CPU: 1 UID: 0 PID: 11369 Comm: syz-executor Not tainted 6.15.0-rc5-syzkaller-00136-g9c69f8884904 #0 PREEMPT(full) [ 564.990888][T11369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 565.000922][T11369] Call Trace: [ 565.004255][T11369] [ 565.007172][T11369] dump_stack_lvl+0x3d/0x1f0 [ 565.011760][T11369] panic+0x71c/0x800 [ 565.015650][T11369] ? __pfx_panic+0x10/0x10 [ 565.020061][T11369] ? mark_held_locks+0x49/0x80 [ 565.024827][T11369] ? preempt_schedule_thunk+0x16/0x30 [ 565.030180][T11369] ? binder_add_device+0xa4/0xb0 [ 565.035102][T11369] ? preempt_schedule_common+0x44/0xc0 [ 565.040548][T11369] ? check_panic_on_warn+0x1f/0xb0 [ 565.045650][T11369] ? binder_add_device+0xa4/0xb0 [ 565.050572][T11369] check_panic_on_warn+0xab/0xb0 [ 565.055500][T11369] end_report+0x107/0x170 [ 565.059814][T11369] kasan_report+0xee/0x110 [ 565.064215][T11369] ? binder_add_device+0xa4/0xb0 [ 565.069159][T11369] binder_add_device+0xa4/0xb0 [ 565.073916][T11369] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 565.080497][T11369] binderfs_fill_super+0x8d4/0x1360 [ 565.085685][T11369] ? __pfx_binderfs_fill_super+0x10/0x10 [ 565.091311][T11369] ? shrinker_register+0x1a8/0x260 [ 565.096406][T11369] ? sget_fc+0x808/0xc20 [ 565.100643][T11369] ? __pfx_set_anon_super_fc+0x10/0x10 [ 565.106089][T11369] ? __pfx_binderfs_fill_super+0x10/0x10 [ 565.111711][T11369] get_tree_nodev+0xda/0x190 [ 565.116290][T11369] vfs_get_tree+0x8b/0x340 [ 565.120692][T11369] path_mount+0x14d4/0x1f20 [ 565.125178][T11369] ? kmem_cache_free+0x2d4/0x4d0 [ 565.130107][T11369] ? __pfx_path_mount+0x10/0x10 [ 565.134948][T11369] ? putname+0x154/0x1a0 [ 565.139176][T11369] __x64_sys_mount+0x28d/0x310 [ 565.143925][T11369] ? __pfx___x64_sys_mount+0x10/0x10 [ 565.149190][T11369] ? rcu_is_watching+0x12/0xc0 [ 565.153939][T11369] do_syscall_64+0xcd/0x260 [ 565.158431][T11369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.164307][T11369] RIP: 0033:0x7f427759010a [ 565.168707][T11369] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 565.188297][T11369] RSP: 002b:00007ffde1dc7b18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 565.196693][T11369] RAX: ffffffffffffffda RBX: 00007f4277610e74 RCX: 00007f427759010a [ 565.204645][T11369] RDX: 00007f42776208cb RSI: 00007f4277610e74 RDI: 00007f42776208cb [ 565.212603][T11369] RBP: 00007f42776110bd R08: 0000000000000000 R09: 00007f42777b6738 [ 565.220555][T11369] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f42775ec1a8 [ 565.228507][T11369] R13: 00007f42775ec180 R14: 0000000000000009 R15: 0000000000000000 [ 565.236462][T11369] [ 565.239649][T11369] Kernel Offset: disabled [ 565.243948][T11369] Rebooting in 86400 seconds..