last executing test programs: 1m3.460261566s ago: executing program 3 (id=2546): prctl$PR_MCE_KILL(0x23, 0x3, 0x7ffffffff000) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3fd, 0x0) io_pgetevents(0x0, 0x1, 0x1, &(0x7f0000000100)=[{}], 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r4, 0x0, 0x0, 0x400000000000000}]) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r5, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000003008"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x240480c0}, 0x4004844) r6 = socket$nl_route(0x10, 0x3, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5400000010000304000000000000000000000420", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c000280080005000100"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8044) 1m1.179384125s ago: executing program 3 (id=2549): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) bpf$MAP_CREATE(0x0, 0x0, 0x50) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x20042000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x8800) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 1m0.177013544s ago: executing program 3 (id=2550): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='uid_map\x00') read$FUSE(r0, &(0x7f00000046c0)={0x2020}, 0x2021) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000040)=0x8) openat(r0, &(0x7f0000000540)='./file0\x00', 0x40001, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) getrandom(&(0x7f0000000080)=""/253, 0xfd, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) stat(0x0, 0x0) r1 = socket(0xa, 0x5, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) getsockopt$sock_buf(r2, 0x1, 0x13, 0x0, &(0x7f00000003c0)) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0x8, 0x4) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r3, &(0x7f0000000580)={&(0x7f0000000000)=@in={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000200)="a6bbe8994339cda81a0e4bc9bd75b74d431e83329d346063a81d59cd57dc5c509a1e0962ffa0b929ae3fe6dd8b7ecbdb9a82b565143e760eac06eadac994c889a3ff", 0x42}, {&(0x7f0000000140)="e013405ecc26a60cfeeea30a7470a8b0d9b9741750037e045d070596d74908548295937ac18ba6411837b857fa820b0000000000000032829c664335da483d813f930e", 0x43}], 0x2, 0x0, 0x0, 0x4855}, 0x24000052) syz_usb_connect(0x6, 0x44, &(0x7f0000000080)=ANY=[@ANYRES32=r1, @ANYRES8=r1], 0x0) syz_usb_connect$uac2(0x6, 0xe5, &(0x7f0000000280)=ANY=[@ANYBLOB="12010003000000081e0400304000010203010902d30003010d500b080b0202010720300904000000010120000924011c00044600070c2403040603030335fbff0807240b02026b4f1024020205001000000800000002098107240605040a0013240d06010004020001000100020002000100090401000001022000090401010101022000122402020000066e033d4f27d27196e14a2410240102000100000000f802000000050b240201060407040df303090501098f01040500082501833a05f9ff09040200000102200009040201010102200009058209ff030803b30825010203b51000"], &(0x7f0000000500)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x300, 0x7, 0x0, 0x7f, 0x10}, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="130f0529b6eaf5005f57536cc0e44def8484900040"], 0x3, [{0x6b, &(0x7f0000000400)=ANY=[@ANYBLOB="020078f967e5e1ff44bd5ad08d72048b7eda66b2b2be2520f726877a80e612ae8a924656a33315ab8739409823e9cf7d3d173ef9e4fef4bf6f9874df03e94e34633e5a6f7a0deb4473914a321517481cd9c40dd26a7828ed37e429e2aaf131877e0e27fc07f2d16cc7c5c0"]}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x81d}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x42b}}]}) 53.014246158s ago: executing program 3 (id=2565): prctl$PR_MCE_KILL(0x23, 0x3, 0x7ffffffff000) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3fd, &(0x7f0000000500)=0x0) io_pgetevents(r5, 0x1, 0x1, &(0x7f0000000100)=[{}], 0x0, 0x0) io_submit(r5, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r4, 0x0, 0x0, 0x400000000000000}]) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x0) sendmsg$can_bcm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x240480c0}, 0x4004844) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000040)=0xffffffffffffffff) ioctl$vim2m_VIDIOC_DQBUF(r8, 0xc0585611, &(0x7f0000000080)=@fd={0x6, 0x3, 0x4, 0x2, 0x5, {}, {0x3, 0x0, 0x3, 0x8, 0xff, 0x7, "ac610d0f"}, 0x7, 0x4, {}, 0x40, 0x0, r9}) sendmsg$nl_route(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5400000010000304000000000000000000000420", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c000280080005000100"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8044) 51.87529934s ago: executing program 3 (id=2569): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, &(0x7f00000000c0)={{&(0x7f0000f79000/0x3000)=nil, 0x3000}}) 45.30025351s ago: executing program 3 (id=2578): openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x8985, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r6 = dup(r0) syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r1}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x0, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x200, 0x2, 0xbe, 0x0, r1}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) 19.401560368s ago: executing program 2 (id=2619): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x2, 0x2}]}]}, {0x0, [0x5f]}}, 0x0, 0x33, 0x0, 0xa}, 0x28) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5d090936f70e0dd038e7ff7fc6e5539b324c078b089b3934076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1061}}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000814000780080012400000000505001500090000000500010006000000050005000a00000005000400000000000900020073797a300000000010000300686173683a69702c6d616300"], 0x5c}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000000406050000000000000000000a000000050001000700ff01000000000000ac75d749b3a47836a7edce6f7a3f6ed82c38a14736ab557b6011da34bffab0482edfd435fa0f3d02a2e10627e2df4c6aec11dab62c274723d0ad4d48177461beda2cb0ef77257a9512fbb3e8e020"], 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 18.904564333s ago: executing program 2 (id=2621): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x1010, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) listns(&(0x7f0000000200)={0x20, 0x0, 0x3, 0x14020000, 0x0, 0x1}, &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0xe00, 0x0) ioctl$RTC_WKALM_SET(r6, 0x4028700f, &(0x7f0000000080)={0x1, 0x1, {0x39, 0x38, 0x9, 0xd, 0x6, 0x4eac, 0x5, 0xce}}) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2800) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r7, 0x40505412, &(0x7f00000000c0)={0x3, 0x9dc5, 0x0, 0x0, 0xef7826c8d995ba17}) 17.152607463s ago: executing program 2 (id=2622): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18020000fafffffb00000000030000008500000036000000670000000700000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x0, 0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f6276000905000000000000000705e37e1b82e60905f2020000060000090501"], 0x0) pipe2$9p(&(0x7f0000000000), 0x80400) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) setns(0xc9, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r0, r2, 0x25, 0x2, @val=@kprobe_multi=@syms={0x1, 0x0, 0x0, 0x0, 0x8000000000000000}}, 0x30) 16.578104877s ago: executing program 0 (id=2623): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4e23, 0x25, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x32}, @in6=@mcast1, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffb}, {0xffffffffffffffff, 0xfffffffffffffffe, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffdfc}, 0x70bd26, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x200000, 0x6, 0x4, {0xb, @pix={0x6, 0x4019f, 0x0, 0x5, 0x0, 0x0, 0x6, 0x2, 0x1, 0x1, 0x1, 0x1}}, 0x2}) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0xa8382, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc8a1, 0xdb00, 0x8, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000ffff26bd7004fddbdf2700000000", @ANYRES32=0x0, @ANYBLOB="18090400230000001c0012800b000100627269640000000000000000080003000a040000"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100003020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x18000000000002a0, 0x22, 0x0, &(0x7f00000002c0)="b9e203076008008cb89e08f00800511d0833df549e46f70faa89b25966658644d8c7", 0x0, 0xfffffdff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(&(0x7f0000000080)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='zonefs\x00', 0x6066, &(0x7f0000000300)='().\xf1\'\x00') bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x6) ioctl$KVM_GET_CPUID2(r7, 0xc008ae91, &(0x7f0000000400)={0x2, 0x0, [{}, {}]}) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/net/eth0/queues/tx-0/byte_queue_limits/stall_thrs\x00', 0x0, 0x0) 16.018287809s ago: executing program 4 (id=2624): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl(r1, 0x40186f40, &(0x7f0000000100)) (fail_nth: 1) 15.665660537s ago: executing program 4 (id=2626): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x422482, 0xce) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getitimer(0x1, &(0x7f0000000040)) r2 = fsopen(&(0x7f0000000040)='cramfs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f0000000100)='1\x00', 0x2) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x8, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r4, &(0x7f0000006400)={0x2020}, 0x2020) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r5, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b3243078b089b3430076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pnp/devices/00:02/driver\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0)='00:02\x00', 0x6) write(r0, &(0x7f0000000100)="52000000230001010002060000000000000000000000000000000000000000003f0000000000000000", 0x29) r6 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_disconnect(r6) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) 14.617535737s ago: executing program 0 (id=2627): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) setsockopt$inet_opts(r5, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, 0x0, 0x0, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 11.987077048s ago: executing program 0 (id=2629): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) setsockopt$inet_opts(r5, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, 0x0, 0x0, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 10.91529342s ago: executing program 1 (id=2630): mkdir(&(0x7f00000001c0)='./my_configfs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x4e, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa42238e910adb86dd60fca33f00186700fe800000000000000000000000000000ff0f00000000000000000000000008aa2100"/78], 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x48, 0x2, 0x48, 0x5}]}, 0x10) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYRES32=0x0, @ANYRESHEX=r5, @ANYRES8=r2, @ANYRESDEC, @ANYRES16, @ANYBLOB="1a88c2f66ca6dee095a43da36a1a43fcc520db6a91df6b4f8d7a574a4fdf87da9e7860972b099fbc406f"], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000140)="09000000e7001400000000803500008100000088a80000000000504e7c6a59e468", 0x21, 0x4044804, 0x0, 0x0) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r6, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1000000014000300ce5d6201ffdbdf25", @ANYRES32], 0x10}, 0x1, 0x0, 0x0, 0x10000080}, 0x40000) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB="00020000b30000000000000000000000850800002700000085000000070000009500000000000000"], &(0x7f0000000680)='GPL\x00'}, 0x5d) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0xe, &(0x7f0000000fc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cd0aa7b73340cc2160a1fe3c184b751c51160fbce841f8a97be6148ba532e6ea09c346dfebd31a08b32808b80200000000009dd27080e71113610e10d859e8327ef03fb6c86adac12233f9a1fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000067d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c972780870014605c83d7d11c3c975d5aec84222fff0d7216fdb0d3a0ec4bfae563112f4b391aafe234870072858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5dc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8e12baf5c768a40538be5f76e9c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5be5f6eb2eea0d0df414b315f65112412392191fa83ee830548ef8e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb030621204d3ded6f260af62d91faae95196d5e3ff010000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a30280bc586e79a5dd8076c248e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5ffff000000000000c24411d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589ac5d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d54aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5a45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5f7d895de17a10b0a0ea15ccc0d7a830b6eb33b6b21675511d693ef5e3c44bbf71cabc5175d879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2e5a00d2f953a86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c56d0886eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366a9660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e959212181d4bf32ed89c96d421c8171698c49403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef310e10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d618cdaaf7e038879c5d177b3876fda4121e15a00adb976064a93e8d000000000000903350932d3eef7fdada20c19807066e2c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a2c5986aa9200a1306ffa5a71ca69e89a6980612b35fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeadc5cf218a6eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041814f60fbbcafa487ee96b368e8769da90b44190e569fe8b1d155d0765baaca5c5548b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751beed5f79de29a67a579150bfb31232d296b9d2977ed027ca90af7088d6466f1501d96a32bfa3cf9ab0dcd626ac9341833e92685af6917ae05473ae4768341426e244159b3c3e002b6f8ee80cbe6e26c816ab92658d956d849cd3a21ebf4b143d338035cd91f087633aa668e0644b05dc5a7937cd5fb62bd08242a858aeeda8c0cbb4fc2478a8155b859e88493f322702277939832bd4a1d8109f98c5a187564c9eb80acc63ac57459593c81ce8998e38ea231b81ebaa6b242ebdf382d70232f1d8e516a8eaf39d09ea40198cf1b72eb5ce5327d3a3861470be47a9a9dbf569e6f6f474fd1448adfd70c4f4a4487edaf193a00a808389a110a4286905ba81309735f6ac5d2ba7ab2be01fa25c11dbb3170258e9d9fed944fd85c03336a49f7016517a1988bc84ee301e167d3cf88c46c4eba6e2bfd099acd2eec5c624679aa7ebab76061a9ca792bffe3d6df4dbe70b5cab6299a51e63826fd0bda4846d06e322ebd745e73da718ba0c93e7567df9ed7ea8d2fdbde44e65a4cd01748b"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r7}, 0x94) socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8946, &(0x7f0000000040)={'dvmrp1\x00', @random='\x00\x00\x00\x00\x00 '}) 10.681845453s ago: executing program 4 (id=2631): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x2, 0x2}]}]}, {0x0, [0x5f]}}, 0x0, 0x33, 0x0, 0xa}, 0x28) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5d090936f70e0dd038e7ff7fc6e5539b324c078b089b3934076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1061}}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000814000780080012400000000505001500090000000500010006000000050005000a00000005000400000000000900020073797a300000000010000300686173683a69702c6d616300"], 0x5c}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000000406050000000000000000000a000000050001000700ff01000000000000ac75d749b3a47836a7edce6f7a3f6ed82c38a14736ab557b6011da34bffab0482edfd435fa0f3d02a2e10627e2df4c6aec11dab62c274723d0ad4d48177461beda2cb0ef77257a9512fbb3e8e020"], 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 9.488845016s ago: executing program 1 (id=2632): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x214d, 0xc000, 0x2, 0x5e}) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x4041}, 0x0) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 9.436216415s ago: executing program 0 (id=2633): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x718, 0x800, 0x0, 0x232}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe266, 0x0, 0x3, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x986, 0x4, 0x2, 0x8000032a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc227, 0x1000, 0x1, 0x196}}], 0x4, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) link(&(0x7f00000001c0)='./file1\x00', 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x58, &(0x7f00000000c0)=[@in={0x2, 0x1000, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x843}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e24, 0x7, @private2, 0x767c}]}, &(0x7f0000000080)=0x10) io_uring_setup(0x66a, &(0x7f0000000000)={0x0, 0x8dd3, 0x10000, 0x42, 0x235}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f00000000c0)="2000000012005f0214f9f4070000fbe414019ff5526ac553f0ff49a1fc8bf60a", 0x20) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) recvmmsg(r4, &(0x7f00000021c0), 0x5b, 0x40, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xa4}}, 0x4) r5 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r5, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(r5, 0xa) recvmmsg(r5, 0x0, 0x0, 0x2, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) write(r1, &(0x7f00000009c0)='1,', 0x2) 9.055347444s ago: executing program 4 (id=2634): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4e23, 0x25, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x32}, @in6=@mcast1, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffb}, {0xffffffffffffffff, 0xfffffffffffffffe, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffdfc}, 0x70bd26, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x200000, 0x6, 0x4, {0xb, @pix={0x6, 0x4019f, 0x0, 0x5, 0x0, 0x0, 0x6, 0x2, 0x1, 0x1, 0x1, 0x1}}, 0x2}) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0xa8382, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc8a1, 0xdb00, 0x8, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000ffff26bd7004fddbdf2700000000", @ANYRES32=0x0, @ANYBLOB="18090400230000001c0012800b000100627269640000000000000000080003000a040000"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100003020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x18000000000002a0, 0x22, 0x0, &(0x7f00000002c0)="b9e203076008008cb89e08f00800511d0833df549e46f70faa89b25966658644d8c7", 0x0, 0xfffffdff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(&(0x7f0000000080)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='zonefs\x00', 0x6066, &(0x7f0000000300)='().\xf1\'\x00') bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x6) ioctl$KVM_GET_CPUID2(r7, 0xc008ae91, &(0x7f0000000400)={0x2, 0x0, [{}, {}]}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/net/eth0/queues/tx-0/byte_queue_limits/stall_thrs\x00', 0x0, 0x0) read(r8, &(0x7f0000000c00)=""/64, 0x40) getdents64(r8, &(0x7f0000000a00)=""/4096, 0x1000) ioctl$KVM_RUN(r7, 0xae80, 0x0) 6.931363699s ago: executing program 4 (id=2635): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x1, 0x70bd2b, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x240088d0}, 0x40090) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setresuid(0xee01, 0xee01, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x40000000000018e, 0x4000000) 6.858545523s ago: executing program 2 (id=2636): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, &(0x7f00000004c0)=""/222, 0xde, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 4.480923199s ago: executing program 2 (id=2637): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80), 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, &(0x7f00000004c0)=""/222, 0xde, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 3.821587406s ago: executing program 0 (id=2638): r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) shutdown(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) sendto$inet6(r0, &(0x7f00000001c0)="bc", 0x1, 0x40, &(0x7f00000000c0)={0xa, 0x4e20, 0x8, @loopback, 0xfffffffe}, 0x1c) close(r0) (fail_nth: 1) 2.932873889s ago: executing program 2 (id=2639): socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async) r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, &(0x7f0000000240)) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @multicast2, 0x4e21, 0x3, 'lc\x00', 0x5, 0x5, 0x77}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x4e23, 0xdac098b1337ed02a, 0xcd, 0x4}}, 0x44) (async) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) (async) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000400), 0x12) (async) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000000540)={{0x0, 0xfffffffffffffff8, 0x6, 0x5, 0x2, 0xffffffff, 0x6, 0x4d3, 0x4, 0x80000000, 0x4, 0x1000, 0x2, 0xc0d6, 0x8000000000000000}}) ioctl$BTRFS_IOC_INO_LOOKUP(0xffffffffffffffff, 0xd0009412, &(0x7f0000001540)={r2, 0x81}) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) (async) getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x4000, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @multicast2}}}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r6, 0x0, 0x40000) (async) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r7, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r7, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) recvmmsg(r7, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x438, 0x240, 0x240, 0x0, 0x350, 0x370, 0x350, 0x4, 0x0, {[{{@arp={@private, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_to_batadv\x00', 'batadv0\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "bc2e329885ea3654891fbae8c6c66e07212432bde429bcda7deb48d85c6f5e269c2021c8f8dc09af0b3f2e10e8ac79cc67e264613c4be6838ee2daacf7926a6e"}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr, @broadcast}}}, {{@arp={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x488) 2.768560374s ago: executing program 1 (id=2640): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80), 0x0, 0x0) setsockopt$inet_opts(r5, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, &(0x7f00000004c0)=""/222, 0xde, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 2.609558205s ago: executing program 0 (id=2641): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000), 0xfffffecc) syz_emit_ethernet(0x10d, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaaaa0060ec72aea156344a43db9a57641ab538ba375e1b0a261c4d992554cd085082a75324403eb2df231983cbd3bfe010bc3d7f42b012109a537b27f22bb01d2e1dbf9a03603cd17177118dfb88f6b02e7282f28128a306ec00108f24fe23dcba8c7aa85f89cbe042bffaea5c6bf8708aca42f11590d00acda860608f5fc1cc4136b64654e05335d78086fa05cedca71be7c5018d46d506ef53196ef64a0dfa217ffc7a770ad0b095667501726e8c401a491f6e01d028fdd232dd59e8471c69a6cfb7a9d7b9c2ad7ab0e8542e6d39c3106d5f590757c6bbf3f5f297dafdd336e5206c7b940eaf675ecbf0caf4790c91e3145986b7d57ccba6acedc458bc86772f09f126f104b5707ce161d8ee952b669da13b6534723b35567e695d5894303bb31cce91842a2b5d94f0250a59bf1973ed4bf1ae0a31fbf694cf8d021d6dead27a0dd685ceda7cb52a9dc9dd59b9e64dcadc130317392ca5"], &(0x7f0000000280)={0x1, 0x4, [0x2a2, 0x6c3, 0x715, 0x8cc]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000332000/0x4000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000053000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000691000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) r2 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d0001000070060904000504030002000921fcff400122180009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x400, 0x470e00) ioctl$HIDIOCGREPORT(r3, 0x400c4807, &(0x7f0000000200)={0x2, 0x2, 0x3}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000500)={0x2c, &(0x7f0000000100)={0x40, 0x12, 0x39, {0x39, 0xc, "486d85290715e96a922da16471e1c022907fc359f29a6d1f63bae9dc0c356f3f495ac6747bf694b578bf64078981af0d1da90eea87e7e4"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3801}}, &(0x7f0000000180)={0x0, 0xf, 0x41, {0x5, 0xf, 0x41, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x6, 0x7, 0x5, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x4, 0x2, 0x8001}, @ssp_cap={0x1c, 0x10, 0xa, 0x1, 0x4, 0xfff, 0xe100, 0x4, [0xff0030, 0xdf80, 0xff00, 0xff3f30]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0xc, 0x0, 0x9}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0x40, 0x7, 0x2}]}}, &(0x7f0000000480)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x0, 0x3, 0x9, "6f529085", "76808c9c"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x0, 0x5, 0x7, 0x80, 0x8, 0x1}}}, &(0x7f00000009c0)={0x84, &(0x7f0000000540)={0x20, 0x16, 0xb9, "94df73caa594e1ae50a3024e69fd957ec39b896ae7ab8d44ac79f3b626db873e0376cfb47bec02557c41909a1ffbb24ec0bc61a030bff7a4500f44a12c12308636c3c2914c85845a8e125c42464decf79262f6a75d0753f92d965c75e313dec698aeb9129dbe57a497643c1b5e6e1764b6feb810e25cf4d4b1223f58068fa2cc17b56ad4addef1113748e31b3b8f778392dcec18589a1fa4f4508b7ad777c16164be97ee8017158c6ffb846eccfe1fa5c65c2ec24834ee30bd"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x41}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f00000006c0)={0x20, 0x0, 0x8, {0x100, 0x40, [0xf0]}}, &(0x7f0000000700)={0x40, 0x7, 0x2, 0xa}, &(0x7f0000000740)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000780)={0x40, 0xb, 0x2, "4ab4"}, &(0x7f00000007c0)={0x40, 0xf, 0x2, 0xcb2}, &(0x7f0000000800)={0x40, 0x13, 0x6}, &(0x7f0000000840)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000880)={0x40, 0x19, 0x2, "9626"}, &(0x7f00000008c0)={0x40, 0x1a, 0x2, 0x6d7}, &(0x7f0000000900)={0x40, 0x1c, 0x1, 0xc}, &(0x7f0000000940)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000980)={0x40, 0x21, 0x1, 0xaa}}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) 1.509046252s ago: executing program 1 (id=2642): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{0x1}, &(0x7f00000005c0), 0x0}, 0x20) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffffff, 0x0, 0x4c9128d4e1c3bded) openat$tun(0xffffffffffffff9c, 0x0, 0x28003, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x2000009) r1 = socket$inet_sctp(0x2, 0x5, 0x84) close(r1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000340)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200000b, r3}}], 0x20, 0x2400e044}, 0x20001080) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000740)={0x0, 0xf0, "1362cf85f2c7002f0e320199d800e04f6bbf19b74c626646981158fb970d0c92bd138f6e5fdbe001773043a2bfec6e4509d22795336f086f35ccd9b9c5d0295e7a3328ab4bce4d25a06349b2622bd6f6e3597d50a49a3222bd9c6fdfc3790fc3e1bf6ec913afc71d6759ee74e272ab933fa356d1047a86fd935123c82587cf17cd22387c3b4f2d5ff59fa872bf85c1776995397644646b48b50f4d15f33b54e54d1c7b0228b0baf0723a1e20f64fcc790d5ac13ee4396b9d4677d9df810a00f56f90ad60d5f1827b53d517f89a8f0a3b83203e44cadab2abcd5de3d2b37cc78f6e38e073de1904dcc2bb55409eb2b503"}, &(0x7f0000000880)=0xf8) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) 1.221548908s ago: executing program 4 (id=2643): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/swaps\x00', 0x101100, 0x96) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)={0x28, 0x24, 0x1, 0x0, 0x0, "", [@nested={0x18, 0xd3, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x8, 0x1c, 0x0, 0x0, @u32=0xc9}]}]}, 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000006000/0x2000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x1, 0xf3}) r3 = syz_io_uring_setup(0x6d33, 0x0, &(0x7f0000000300)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) write(r7, &(0x7f0000000100)='measure func=FILE_CHECK', 0x17) close(r7) epoll_create1(0x0) landlock_create_ruleset(&(0x7f0000000040)={0x22, 0xb}, 0x30, 0x0) syz_io_uring_submit(r4, r5, r6, 0x0) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@deltfilter={0xe, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x3}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x8010}, 0x0) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0xc, &(0x7f0000000100)=[{0x1, 0x36, 0x5, 0x537}, {0x27, 0x8, 0x9}, {0xe49, 0x2, 0xfa, 0x4}, {0x5b6, 0x8, 0x1, 0x2}, {0x2, 0xe, 0x80, 0x1000003}, {0x1ff, 0x5, 0x10, 0xf}, {0x2, 0x0, 0x1, 0x9}]}) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40400) ioctl$vim2m_VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000100)={0x1, @vbi={0x5, 0x4, 0x3, 0x34324d59, [0x8, 0xfffffdf1], [0x80000001, 0xb], 0x108}}) 469.965689ms ago: executing program 1 (id=2644): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x2, 0x2}]}]}, {0x0, [0x5f]}}, 0x0, 0x33, 0x0, 0xa}, 0x28) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5d090936f70e0dd038e7ff7fc6e5539b324c078b089b3934076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1061}}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000814000780080012400000000505001500090000000500010006000000050005000a00000005000400000000000900020073797a300000000010000300686173683a69702c6d616300"], 0x5c}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000000406050000000000000000000a000000050001000700ff01000000000000ac75d749b3a47836a7edce6f7a3f6ed82c38a14736ab557b6011da34bffab0482edfd435fa0f3d02a2e10627e2df4c6aec11dab62c274723d0ad4d48177461beda2cb0ef77257a9512fbb3e8e020"], 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 0s ago: executing program 1 (id=2645): r0 = epoll_create(0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') r2 = openat(r1, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x0, 0x2000000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) setsockopt$inet_opts(r5, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) pread64(r0, 0x0, 0x0, 0x8001) r6 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) kernel console output (not intermixed with test programs): cuous mode [ 1360.270741][T14202] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1360.293864][T14202] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 1360.337392][ T190] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1360.606566][T14209] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1361.492741][T14215] se_dev->se_dev_ptr already set for storage object [ 1361.635218][ T5809] usb 5-1: USB disconnect, device number 61 [ 1361.866167][T14212] misc userio: The device must be registered before sending interrupts [ 1362.794121][ T190] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 1362.969315][ T190] usb 4-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 1362.970929][ T190] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1362.970943][ T190] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1362.970962][ T190] usb 4-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1362.970980][ T190] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1363.237341][ T190] usb 4-1: USB disconnect, device number 52 [ 1364.460024][T14230] nvme_fabrics: missing parameter 'transport=%s' [ 1364.460042][T14230] nvme_fabrics: missing parameter 'nqn=%s' [ 1364.726670][T14240] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1364.761705][T14239] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2205'. [ 1364.761747][T14239] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2205'. [ 1364.878384][T14239] bridge19: entered promiscuous mode [ 1364.878419][T14239] bridge19: entered allmulticast mode [ 1365.757579][T14245] hub 8-0:1.0: USB hub found [ 1365.758407][T14245] hub 8-0:1.0: 1 port detected [ 1366.576819][T14252] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1369.391597][T14263] se_dev->se_dev_ptr already set for storage object [ 1370.570046][T14268] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2213'. [ 1370.570464][T14268] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2213'. [ 1371.355503][T14257] macvtap1: entered allmulticast mode [ 1371.355521][T14257] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1371.355546][T14257] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1371.356152][T14257] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1371.408711][T14257] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 1371.701471][T14268] bridge23: entered promiscuous mode [ 1371.701487][T14268] bridge23: entered allmulticast mode [ 1371.701916][ T10] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1372.933010][ T5718] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1373.124872][ T5718] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1373.137589][ T5718] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1373.137768][ T5718] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1373.137814][ T5718] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1373.223089][ T5718] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.223120][ T5718] usb 2-1: Product: syz [ 1373.223191][ T5718] usb 2-1: Manufacturer: syz [ 1373.223232][ T5718] usb 2-1: SerialNumber: syz [ 1373.273809][ T5718] usb 2-1: config 0 descriptor?? [ 1373.288799][ T5718] usb 2-1: ucan: probing device on interface #0 [ 1373.288814][ T5718] usb 2-1: ucan: invalid EP count (0) [ 1373.288824][ T5718] usb 2-1: ucan: probe failed; try to update the device firmware [ 1374.530869][T14287] genirq: Flags mismatch irq 32. 00200000 (pcmmio) vs. 00200000 (virtio1-output.0) [ 1375.813695][T14295] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2216'. [ 1375.813992][T14295] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2216'. [ 1375.930253][T14295] bridge21: entered promiscuous mode [ 1375.930269][T14295] bridge21: entered allmulticast mode [ 1376.430370][ T5809] usb 2-1: USB disconnect, device number 36 [ 1376.935337][ T5809] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1377.092823][ T5809] usb 2-1: Using ep0 maxpacket: 32 [ 1377.927333][ T5809] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1377.927365][ T5809] usb 2-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 1377.929506][ T5809] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1377.929526][ T5809] usb 2-1: can't read configurations, error -71 [ 1378.151303][T14304] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1379.432358][T14310] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2226'. [ 1379.432380][T14310] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2226'. [ 1379.436382][T14310] bridge23: entered promiscuous mode [ 1379.436396][T14310] bridge23: entered allmulticast mode [ 1380.202804][ T190] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 1380.891105][T14316] misc userio: The device must be registered before sending interrupts [ 1380.987331][ T190] usb 5-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 1380.990881][ T190] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1380.990905][ T190] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1380.990937][ T190] usb 5-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1380.990967][ T190] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.047697][T14320] FAULT_INJECTION: forcing a failure. [ 1381.047697][T14320] name failslab, interval 1, probability 0, space 0, times 0 [ 1381.047729][T14320] CPU: 1 UID: 0 PID: 14320 Comm: syz.2.2221 Tainted: G L syzkaller #0 PREEMPT(full) [ 1381.047757][T14320] Tainted: [L]=SOFTLOCKUP [ 1381.047764][T14320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1381.047776][T14320] Call Trace: [ 1381.047783][T14320] [ 1381.047791][T14320] dump_stack_lvl+0x100/0x190 [ 1381.047825][T14320] should_fail_ex.cold+0x5/0xa [ 1381.047853][T14320] should_failslab+0xc2/0x120 [ 1381.047880][T14320] __kmalloc_noprof+0xfc/0x840 [ 1381.047902][T14320] ? rcu_is_watching+0x13/0xc0 [ 1381.047930][T14320] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1381.047963][T14320] tomoyo_realpath_from_path+0xb6/0x690 [ 1381.047996][T14320] tomoyo_path_number_perm+0x23c/0x580 [ 1381.048017][T14320] ? tomoyo_path_number_perm+0x22e/0x580 [ 1381.048049][T14320] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1381.048083][T14320] ? __lock_acquire+0x5c0/0x1f40 [ 1381.048120][T14320] ? __fget_files+0x34/0x3d0 [ 1381.048146][T14320] ? find_held_lock+0x2b/0x80 [ 1381.048173][T14320] ? hook_file_ioctl_common+0x140/0x440 [ 1381.048209][T14320] ? __fget_files+0x21f/0x3d0 [ 1381.048239][T14320] security_file_ioctl+0xd3/0x230 [ 1381.048266][T14320] __x64_sys_ioctl+0xb7/0x210 [ 1381.048292][T14320] do_syscall_64+0x123/0x790 [ 1381.048315][T14320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1381.048335][T14320] RIP: 0033:0x7f77d2b9e159 [ 1381.048353][T14320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1381.048370][T14320] RSP: 002b:00007f77d3a65028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1381.048390][T14320] RAX: ffffffffffffffda RBX: 00007f77d2e25fa0 RCX: 00007f77d2b9e159 [ 1381.048404][T14320] RDX: 0000200000000140 RSI: 00000000c040564b RDI: 0000000000000003 [ 1381.048417][T14320] RBP: 00007f77d3a65090 R08: 0000000000000000 R09: 0000000000000000 [ 1381.048430][T14320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1381.048444][T14320] R13: 00007f77d2e26038 R14: 00007f77d2e25fa0 R15: 00007ffe5bf96f78 [ 1381.048475][T14320] [ 1381.048491][T14320] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1381.238002][ T190] usb 5-1: USB disconnect, device number 62 [ 1381.936630][T14325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2230'. [ 1381.936677][T14325] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2230'. [ 1382.052405][T14325] bridge22: entered promiscuous mode [ 1382.052429][T14325] bridge22: entered allmulticast mode [ 1383.542912][T14339] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2234'. [ 1383.555779][T14339] netlink: 'syz.4.2234': attribute type 39 has an invalid length. [ 1385.541657][T14345] nvme_fabrics: missing parameter 'transport=%s' [ 1385.541681][T14345] nvme_fabrics: missing parameter 'nqn=%s' [ 1389.728593][T14350] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input13 [ 1390.775563][T14383] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2242'. [ 1390.775796][T14383] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2242'. [ 1390.896831][T14383] bridge28: entered promiscuous mode [ 1390.897011][T14383] bridge28: entered allmulticast mode [ 1391.221058][T14385] hub 8-0:1.0: USB hub found [ 1391.221288][T14385] hub 8-0:1.0: 1 port detected [ 1391.821661][ T5809] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 1391.984378][ T5809] usb 3-1: Using ep0 maxpacket: 32 [ 1392.016625][ T5809] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1392.016673][ T5809] usb 3-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 1392.017439][ T5809] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1392.017472][ T5809] usb 3-1: can't read configurations, error -71 [ 1392.141191][T14396] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1392.235925][T14398] nvme_fabrics: missing parameter 'transport=%s' [ 1392.235938][T14398] nvme_fabrics: missing parameter 'nqn=%s' [ 1392.449942][T14403] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1393.306178][ T31] audit: type=1400 audit(1790561625.616:1012): avc: denied { setopt } for pid=14402 comm="syz.4.2249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1393.452908][T14413] hub 8-0:1.0: USB hub found [ 1393.453679][T14413] hub 8-0:1.0: 1 port detected [ 1396.257953][T14438] hub 8-0:1.0: USB hub found [ 1396.258841][T14438] hub 8-0:1.0: 1 port detected [ 1397.120268][T14447] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1397.202855][ T5809] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 1398.753452][ T5809] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 1398.775975][ T5809] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1398.776031][ T5809] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.848548][ T5809] usb 2-1: selecting invalid altsetting 1 [ 1398.848672][ T5809] dvb_ttusb_budget: ttusb_init_controller: error [ 1398.848683][ T5809] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1399.048606][ T5809] DVB: Unable to find symbol stv0299_attach() [ 1399.097913][ T5809] DVB: Unable to find symbol tda8083_attach() [ 1399.097928][ T5809] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 1399.100309][ T5809] usb 2-1: USB disconnect, device number 39 [ 1399.217509][T14466] hub 8-0:1.0: USB hub found [ 1399.218249][T14466] hub 8-0:1.0: 1 port detected [ 1399.619095][ T10] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1399.772742][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 1399.774897][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1399.774925][ T10] usb 5-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 1399.776384][ T10] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1399.776418][ T10] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1399.780205][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1399.780220][ T10] usb 5-1: Product: syz [ 1399.780229][ T10] usb 5-1: Manufacturer: syz [ 1399.780237][ T10] usb 5-1: SerialNumber: syz [ 1402.609311][ T10] usb 5-1: USB disconnect, device number 63 [ 1402.765456][T14414] udevd[14414]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1402.992796][ T10] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1403.144154][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 1403.147506][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1403.147535][ T10] usb 3-1: New USB device found, idVendor=0bda, idProduct=4014, bcdDevice= 0.40 [ 1403.150213][ T10] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 252, changing to 7 [ 1403.156698][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.156721][ T10] usb 3-1: Product: syz [ 1403.156736][ T10] usb 3-1: Manufacturer: syz [ 1403.156751][ T10] usb 3-1: SerialNumber: syz [ 1403.428371][ T10] usb 3-1: BAAD HEADPHONE p_chmask mismatch [ 1403.580628][ T10] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1403.624363][ T10] usb 3-1: USB disconnect, device number 54 [ 1403.687561][T14419] udevd[14419]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1404.378702][T14510] se_dev->se_dev_ptr already set for storage object [ 1406.188025][T14521] hub 8-0:1.0: USB hub found [ 1406.188878][T14521] hub 8-0:1.0: 1 port detected [ 1406.843761][T10269] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1406.992849][T10269] usb 4-1: Using ep0 maxpacket: 16 [ 1406.993375][T10269] usb 4-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1406.997046][T10269] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 1406.997077][T10269] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1406.997099][T10269] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 3 [ 1406.997123][T10269] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 224 [ 1407.002426][T10269] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1407.002452][T10269] usb 4-1: Product: syz [ 1407.002468][T10269] usb 4-1: Manufacturer: syz [ 1407.002484][T10269] usb 4-1: SerialNumber: syz [ 1407.070461][T10269] usb 4-1: config 0 descriptor?? [ 1409.375767][T14536] FAULT_INJECTION: forcing a failure. [ 1409.375767][T14536] name failslab, interval 1, probability 0, space 0, times 0 [ 1409.375801][T14536] CPU: 1 UID: 0 PID: 14536 Comm: syz.4.2279 Tainted: G L syzkaller #0 PREEMPT(full) [ 1409.375829][T14536] Tainted: [L]=SOFTLOCKUP [ 1409.375837][T14536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1409.375850][T14536] Call Trace: [ 1409.375859][T14536] [ 1409.375868][T14536] dump_stack_lvl+0x100/0x190 [ 1409.375903][T14536] should_fail_ex.cold+0x5/0xa [ 1409.375934][T14536] should_failslab+0xc2/0x120 [ 1409.375961][T14536] __kmalloc_cache_noprof+0x91/0x6d0 [ 1409.375984][T14536] ? fanout_add+0x19a/0x1550 [ 1409.376013][T14536] fanout_add+0x19a/0x1550 [ 1409.376043][T14536] packet_setsockopt+0x61a/0x2380 [ 1409.376070][T14536] ? sock_has_perm+0x25a/0x2f0 [ 1409.376095][T14536] ? __pfx_packet_setsockopt+0x10/0x10 [ 1409.376125][T14536] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1409.376156][T14536] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1409.376194][T14536] ? find_held_lock+0x2b/0x80 [ 1409.376224][T14536] ? __fget_files+0x215/0x3d0 [ 1409.376256][T14536] ? selinux_socket_setsockopt+0x6a/0x80 [ 1409.376281][T14536] ? __pfx_packet_setsockopt+0x10/0x10 [ 1409.376314][T14536] do_sock_setsockopt+0xf3/0x1d0 [ 1409.376368][T14536] __sys_setsockopt+0x195/0x220 [ 1409.376411][T14536] __x64_sys_setsockopt+0xbd/0x160 [ 1409.376441][T14536] ? do_syscall_64+0xae/0x790 [ 1409.376463][T14536] ? lockdep_hardirqs_on+0x7d/0x110 [ 1409.376484][T14536] do_syscall_64+0x123/0x790 [ 1409.376509][T14536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1409.376533][T14536] RIP: 0033:0x7fde20d9e159 [ 1409.376552][T14536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1409.376572][T14536] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1409.376603][T14536] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1409.376619][T14536] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000004 [ 1409.376633][T14536] RBP: 00007fde20e3506b R08: 0000000000000004 R09: 0000000000000000 [ 1409.376647][T14536] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1409.376661][T14536] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1409.376693][T14536] [ 1409.443998][ T10] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 1409.617076][ T10] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 1409.619719][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1409.619781][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1409.685581][ T10] usb 2-1: selecting invalid altsetting 1 [ 1409.685670][ T10] dvb_ttusb_budget: ttusb_init_controller: error [ 1409.685677][ T10] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1410.557011][ T10] DVB: Unable to find symbol stv0299_attach() [ 1410.743803][T10269] mcba_usb 4-1:0.0: Microchip CAN BUS Analyzer connected [ 1410.743900][ C0] mcba_usb 4-1:0.0 can0: Tx URB aborted (-71) [ 1410.743999][ C0] mcba_usb 4-1:0.0 can0: Tx URB aborted (-71) [ 1410.749269][T10269] usb 4-1: USB disconnect, device number 53 [ 1410.757796][T10269] mcba_usb 4-1:0.0 can0: device disconnected [ 1410.860591][ T10] DVB: Unable to find symbol tda8083_attach() [ 1410.860607][ T10] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 1410.868553][ T10] usb 2-1: USB disconnect, device number 40 [ 1411.103738][T14544] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2285'. [ 1411.103761][T14544] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2285'. [ 1412.036685][T14544] bridge24: entered promiscuous mode [ 1412.036701][T14544] bridge24: entered allmulticast mode [ 1412.809855][T14556] se_dev->se_dev_ptr already set for storage object [ 1414.071497][T14569] hub 8-0:1.0: USB hub found [ 1414.072541][T14569] hub 8-0:1.0: 1 port detected [ 1417.863839][T14596] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2298'. [ 1417.873764][T14596] netlink: 'syz.2.2298': attribute type 39 has an invalid length. [ 1418.395710][ T1254] ieee802154 phy0 wpan0: encryption failed: -22 [ 1418.395788][ T1254] ieee802154 phy1 wpan1: encryption failed: -22 [ 1418.552876][ T9] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1418.703516][ T9] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1418.704426][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1418.704468][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1418.704501][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1418.706307][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1418.706330][ T9] usb 4-1: Product: syz [ 1418.706345][ T9] usb 4-1: Manufacturer: syz [ 1418.706359][ T9] usb 4-1: SerialNumber: syz [ 1418.709024][ T9] usb 4-1: config 0 descriptor?? [ 1418.709673][T14593] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1418.711524][ T9] usb 4-1: ucan: probing device on interface #0 [ 1418.711545][ T9] usb 4-1: ucan: invalid EP count (1) [ 1418.711563][ T9] usb 4-1: ucan: probe failed; try to update the device firmware [ 1419.208924][T14603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2301'. [ 1419.209110][T14603] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2301'. [ 1419.337314][T14603] bridge20: entered promiscuous mode [ 1419.337336][T14603] bridge20: entered allmulticast mode [ 1419.541269][T14606] genirq: Flags mismatch irq 32. 00200000 (pcmmio) vs. 00200000 (virtio1-output.0) [ 1420.080941][T14613] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1421.067064][T14621] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2305'. [ 1421.067088][T14621] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2305'. [ 1421.071026][T14621] bridge21: entered promiscuous mode [ 1421.071040][T14621] bridge21: entered allmulticast mode [ 1421.181862][ T9] usb 4-1: USB disconnect, device number 54 [ 1421.298864][T14629] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1429.215751][T14676] misc userio: The device must be registered before sending interrupts [ 1429.985016][T14681] hub 8-0:1.0: USB hub found [ 1429.985929][T14681] hub 8-0:1.0: 1 port detected [ 1431.202093][T14683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2320'. [ 1431.202116][T14683] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2320'. [ 1431.237767][T14683] bridge23: entered promiscuous mode [ 1431.237782][T14683] bridge23: entered allmulticast mode [ 1431.513727][T14689] hub 8-0:1.0: USB hub found [ 1431.514707][T14689] hub 8-0:1.0: 1 port detected [ 1434.372902][ T5608] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1435.316705][ T5608] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1435.336941][ T5608] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1435.337016][ T5608] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1435.377528][ T5608] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.377766][ T5608] usb 2-1: Product: syz [ 1435.377819][ T5608] usb 2-1: Manufacturer: syz [ 1435.377872][ T5608] usb 2-1: SerialNumber: syz [ 1435.478367][ T5608] usb 2-1: config 0 descriptor?? [ 1435.505876][T14701] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1435.524157][ T5608] usb 2-1: ucan: probing device on interface #0 [ 1435.524180][ T5608] usb 2-1: ucan: invalid EP count (1) [ 1435.524197][ T5608] usb 2-1: ucan: probe failed; try to update the device firmware [ 1436.768894][T14727] genirq: Flags mismatch irq 32. 00200000 (pcmmio) vs. 00200000 (virtio1-output.0) [ 1437.072930][T14729] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1438.998097][ T10] usb 2-1: USB disconnect, device number 41 [ 1439.766174][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2334'. [ 1439.766199][T14736] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2334'. [ 1439.770575][T14736] bridge22: entered promiscuous mode [ 1439.770589][T14736] bridge22: entered allmulticast mode [ 1439.953772][T14744] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1440.051414][T14745] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1446.030155][T14761] ceph: No mds server is up or the cluster is laggy [ 1446.361379][T14778] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1447.308769][T14782] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2348'. [ 1447.309067][T14782] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2348'. [ 1447.403842][T14782] bridge29: entered promiscuous mode [ 1447.403858][T14782] bridge29: entered allmulticast mode [ 1448.273079][ T5608] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1448.428592][ T5608] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1448.434515][ T5608] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1448.434557][ T5608] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1448.434584][ T5608] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1448.434621][ T5608] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1449.332888][ T9] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1449.483207][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1449.489612][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1449.489941][ T9] usb 5-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 1449.531658][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.531748][ T9] usb 5-1: Product: syz [ 1449.531818][ T9] usb 5-1: Manufacturer: syz [ 1449.531834][ T9] usb 5-1: SerialNumber: syz [ 1451.064277][ T5608] cxacru 3-1:1.0: send of cm 0x91 failed (-104) [ 1451.064515][ T5608] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -104 [ 1451.064532][ T5608] ATM dev 0: usbatm_atm_init: atm_start failed: -104! [ 1451.270966][ T5608] cxacru 3-1:1.0: probe with driver cxacru failed with error -104 [ 1451.279269][ T5608] usb 3-1: USB disconnect, device number 55 [ 1451.339656][ T9] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1451.455191][ T9] usb 5-1: USB disconnect, device number 64 [ 1451.561358][T14804] hub 8-0:1.0: USB hub found [ 1451.562190][T14804] hub 8-0:1.0: 1 port detected [ 1452.057738][T14419] udevd[14419]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1452.162000][T14806] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2346'. [ 1452.272121][T14809] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2346'. [ 1452.272151][T14809] netlink: 'syz.3.2346': attribute type 5 has an invalid length. [ 1452.424684][T14812] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1452.479299][T10269] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 1452.640534][T10269] usb 2-1: not running at top speed; connect to a high speed hub [ 1452.640614][T10269] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 1452.649613][T10269] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1452.649655][T10269] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1452.778963][T10269] cyberjack 2-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 1452.937158][T10269] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1452.983159][ T9] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1453.038756][T14808] FAULT_INJECTION: forcing a failure. [ 1453.038756][T14808] name failslab, interval 1, probability 0, space 0, times 0 [ 1453.039057][T14808] CPU: 0 UID: 0 PID: 14808 Comm: syz.1.2350 Tainted: G L syzkaller #0 PREEMPT(full) [ 1453.039086][T14808] Tainted: [L]=SOFTLOCKUP [ 1453.039094][T14808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1453.039107][T14808] Call Trace: [ 1453.039117][T14808] [ 1453.039125][T14808] dump_stack_lvl+0x100/0x190 [ 1453.039160][T14808] should_fail_ex.cold+0x5/0xa [ 1453.039190][T14808] should_failslab+0xc2/0x120 [ 1453.039218][T14808] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1453.039243][T14808] ? do_getname+0x35/0x390 [ 1453.039269][T14808] do_getname+0x35/0x390 [ 1453.039297][T14808] do_sys_openat2+0xc7/0x1e0 [ 1453.039327][T14808] ? __pfx_do_sys_openat2+0x10/0x10 [ 1453.039355][T14808] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1453.039380][T14808] ? __fget_files+0x21f/0x3d0 [ 1453.039411][T14808] __x64_sys_openat+0x12d/0x210 [ 1453.039441][T14808] ? __pfx___x64_sys_openat+0x10/0x10 [ 1453.039468][T14808] ? ksys_write+0x1ac/0x250 [ 1453.039491][T14808] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 1453.039528][T14808] do_syscall_64+0x123/0x790 [ 1453.039552][T14808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1453.039573][T14808] RIP: 0033:0x7f4a8179e159 [ 1453.039591][T14808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1453.039608][T14808] RSP: 002b:00007f4a826b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1453.039629][T14808] RAX: ffffffffffffffda RBX: 00007f4a81a25fa0 RCX: 00007f4a8179e159 [ 1453.039643][T14808] RDX: 0000000000000002 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 1453.039656][T14808] RBP: 00007f4a826b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1453.039668][T14808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1453.039680][T14808] R13: 00007f4a81a26038 R14: 00007f4a81a25fa0 R15: 00007ffe32a52718 [ 1453.039709][T14808] [ 1453.323098][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 1453.429567][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1453.429729][ T9] usb 4-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 1453.430992][T10269] usb 2-1: USB disconnect, device number 42 [ 1453.479312][ T9] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1453.479385][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1453.548827][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1453.548888][ T9] usb 4-1: Product: syz [ 1453.548926][ T9] usb 4-1: Manufacturer: syz [ 1453.548963][ T9] usb 4-1: SerialNumber: syz [ 1453.626792][T10269] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1453.627132][T10269] cyberjack 2-1:1.0: device disconnected [ 1454.563191][T14819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2358'. [ 1454.563226][T14819] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2358'. [ 1454.568425][T14819] bridge23: entered promiscuous mode [ 1454.568445][T14819] bridge23: entered allmulticast mode [ 1458.084734][ T9] usb 4-1: USB disconnect, device number 55 [ 1458.753110][T14850] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2364'. [ 1458.753388][T14850] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2364'. [ 1459.056676][T14850] bridge25: entered promiscuous mode [ 1459.056691][T14850] bridge25: entered allmulticast mode [ 1459.977730][T14424] udevd[14424]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1461.299677][ T31] audit: type=1400 audit(1790561693.606:1013): avc: denied { open } for pid=14859 comm="syz.4.2367" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=44136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1461.335983][T14861] IPVS: length: 26 != 8 [ 1461.767206][T14873] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1462.540256][T14878] se_dev->se_dev_ptr already set for storage object [ 1466.172737][ T5608] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 1466.324714][ T5608] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1466.325204][ T5608] usb 4-1: not running at top speed; connect to a high speed hub [ 1466.325232][ T5608] usb 4-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 1466.326130][ T5608] usb 4-1: config 1 has an invalid interface number: 93 but max is 0 [ 1466.326155][ T5608] usb 4-1: config 1 has no interface number 0 [ 1466.326195][ T5608] usb 4-1: config 1 interface 93 has no altsetting 0 [ 1466.328037][ T5608] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.328061][ T5608] usb 4-1: Product: syz [ 1466.328076][ T5608] usb 4-1: Manufacturer: syz [ 1466.328092][ T5608] usb 4-1: SerialNumber: syz [ 1466.609437][ T5608] peak_usb 4-1:1.93 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 1466.609467][ T5608] peak_usb 4-1:1.93: unable to read PCAN-USB serial number (err -22) [ 1466.696143][ T5608] peak_usb 4-1:1.93: probe with driver peak_usb failed with error -22 [ 1466.711392][ T5608] usb 4-1: USB disconnect, device number 56 [ 1466.813130][T14895] FAULT_INJECTION: forcing a failure. [ 1466.813130][T14895] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1466.813164][T14895] CPU: 1 UID: 0 PID: 14895 Comm: syz.2.2374 Tainted: G L syzkaller #0 PREEMPT(full) [ 1466.813192][T14895] Tainted: [L]=SOFTLOCKUP [ 1466.813199][T14895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1466.813211][T14895] Call Trace: [ 1466.813218][T14895] [ 1466.813227][T14895] dump_stack_lvl+0x100/0x190 [ 1466.813262][T14895] should_fail_ex.cold+0x5/0xa [ 1466.813291][T14895] _copy_from_user+0x2e/0xd0 [ 1466.813316][T14895] io_register_zcrx+0x18d/0x1e20 [ 1466.813347][T14895] ? __pfx_io_register_zcrx+0x10/0x10 [ 1466.813374][T14895] ? lock_acquire+0x1d1/0x380 [ 1466.813396][T14895] ? __do_sys_io_uring_register+0x135/0x1bc0 [ 1466.813432][T14895] ? rcu_is_watching+0x13/0xc0 [ 1466.813459][T14895] ? trace_contention_end+0x126/0x160 [ 1466.813500][T14895] ? __fget_files+0x215/0x3d0 [ 1466.813544][T14895] __do_sys_io_uring_register+0x1193/0x1bc0 [ 1466.813577][T14895] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1466.813606][T14895] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 1466.813634][T14895] ? __fget_files+0x21f/0x3d0 [ 1466.813665][T14895] ? fput+0x7c/0x100 [ 1466.813692][T14895] ? ksys_write+0x1ac/0x250 [ 1466.813714][T14895] ? __pfx_ksys_write+0x10/0x10 [ 1466.813745][T14895] do_syscall_64+0x123/0x790 [ 1466.813769][T14895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.813790][T14895] RIP: 0033:0x7f77d2b9e159 [ 1466.813807][T14895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1466.813825][T14895] RSP: 002b:00007f77d3a23028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 1466.813845][T14895] RAX: ffffffffffffffda RBX: 00007f77d2e26180 RCX: 00007f77d2b9e159 [ 1466.813859][T14895] RDX: 0000200000000100 RSI: 0000000000000020 RDI: 0000000000000005 [ 1466.813872][T14895] RBP: 00007f77d3a23090 R08: 0000000000000000 R09: 0000000000000000 [ 1466.813884][T14895] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1466.813896][T14895] R13: 00007f77d2e26218 R14: 00007f77d2e26180 R15: 00007ffe5bf96f78 [ 1466.813927][T14895] [ 1469.461501][T14918] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2376'. [ 1469.461951][T14918] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2376'. [ 1469.573460][T14918] bridge30: entered promiscuous mode [ 1469.573477][T14918] bridge30: entered allmulticast mode [ 1469.984283][T14920] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1470.107664][T14923] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1471.392868][T14926] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1471.996023][T14931] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1473.718456][T14939] FAULT_INJECTION: forcing a failure. [ 1473.718456][T14939] name failslab, interval 1, probability 0, space 0, times 0 [ 1473.718492][T14939] CPU: 0 UID: 0 PID: 14939 Comm: syz.0.2387 Tainted: G L syzkaller #0 PREEMPT(full) [ 1473.718522][T14939] Tainted: [L]=SOFTLOCKUP [ 1473.718530][T14939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1473.718543][T14939] Call Trace: [ 1473.718550][T14939] [ 1473.718559][T14939] dump_stack_lvl+0x100/0x190 [ 1473.718600][T14939] should_fail_ex.cold+0x5/0xa [ 1473.718630][T14939] should_failslab+0xc2/0x120 [ 1473.718659][T14939] __kmalloc_cache_noprof+0x91/0x6d0 [ 1473.718682][T14939] ? fanout_add+0x19a/0x1550 [ 1473.718713][T14939] fanout_add+0x19a/0x1550 [ 1473.718746][T14939] packet_setsockopt+0x61a/0x2380 [ 1473.718776][T14939] ? sock_has_perm+0x25a/0x2f0 [ 1473.718803][T14939] ? __pfx_packet_setsockopt+0x10/0x10 [ 1473.718832][T14939] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1473.718862][T14939] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1473.718900][T14939] ? find_held_lock+0x2b/0x80 [ 1473.718930][T14939] ? __fget_files+0x215/0x3d0 [ 1473.718962][T14939] ? selinux_socket_setsockopt+0x6a/0x80 [ 1473.718989][T14939] ? __pfx_packet_setsockopt+0x10/0x10 [ 1473.719020][T14939] do_sock_setsockopt+0xf3/0x1d0 [ 1473.719057][T14939] __sys_setsockopt+0x195/0x220 [ 1473.719091][T14939] __x64_sys_setsockopt+0xbd/0x160 [ 1473.719116][T14939] ? do_syscall_64+0xae/0x790 [ 1473.719136][T14939] ? lockdep_hardirqs_on+0x7d/0x110 [ 1473.719157][T14939] do_syscall_64+0x123/0x790 [ 1473.719179][T14939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1473.719200][T14939] RIP: 0033:0x7f0e1419e159 [ 1473.719217][T14939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1473.719237][T14939] RSP: 002b:00007f0e1514f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1473.719261][T14939] RAX: ffffffffffffffda RBX: 00007f0e14425fa0 RCX: 00007f0e1419e159 [ 1473.719277][T14939] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000004 [ 1473.719292][T14939] RBP: 00007f0e1423506b R08: 0000000000000004 R09: 0000000000000000 [ 1473.719303][T14939] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1473.719314][T14939] R13: 00007f0e14426038 R14: 00007f0e14425fa0 R15: 00007ffe6aaa48c8 [ 1473.719352][T14939] [ 1475.093603][T14951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2381'. [ 1475.093674][T14951] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2381'. [ 1475.116597][T14951] bridge31: entered promiscuous mode [ 1475.116633][T14951] bridge31: entered allmulticast mode [ 1475.976293][T14959] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2392'. [ 1475.976701][T14959] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2392'. [ 1475.983334][T14959] bridge24: entered promiscuous mode [ 1475.983348][T14959] bridge24: entered allmulticast mode [ 1476.300489][T14961] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1478.622483][T14974] hub 8-0:1.0: USB hub found [ 1478.623695][T14974] hub 8-0:1.0: 1 port detected [ 1479.085243][ T1254] ieee802154 phy0 wpan0: encryption failed: -22 [ 1479.085297][ T1254] ieee802154 phy1 wpan1: encryption failed: -22 [ 1480.435118][T14983] FAULT_INJECTION: forcing a failure. [ 1480.435118][T14983] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1480.435153][T14983] CPU: 1 UID: 0 PID: 14983 Comm: syz.3.2400 Tainted: G L syzkaller #0 PREEMPT(full) [ 1480.435180][T14983] Tainted: [L]=SOFTLOCKUP [ 1480.435187][T14983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1480.435200][T14983] Call Trace: [ 1480.435207][T14983] [ 1480.435215][T14983] dump_stack_lvl+0x100/0x190 [ 1480.435249][T14983] should_fail_ex.cold+0x5/0xa [ 1480.435279][T14983] _copy_to_user+0x32/0xd0 [ 1480.435306][T14983] simple_read_from_buffer+0xcb/0x170 [ 1480.435335][T14983] proc_fail_nth_read+0x1af/0x230 [ 1480.435363][T14983] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1480.435391][T14983] ? rw_verify_area+0xce/0x6d0 [ 1480.435411][T14983] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1480.435437][T14983] vfs_read+0x1e4/0xb40 [ 1480.435460][T14983] ? lock_acquire+0x1d1/0x380 [ 1480.435482][T14983] ? __fget_files+0x34/0x3d0 [ 1480.435507][T14983] ? __pfx_vfs_read+0x10/0x10 [ 1480.435528][T14983] ? find_held_lock+0x2b/0x80 [ 1480.435557][T14983] ? __fget_files+0x215/0x3d0 [ 1480.435588][T14983] ? __fget_files+0x21f/0x3d0 [ 1480.435622][T14983] ksys_read+0x12a/0x250 [ 1480.435644][T14983] ? __pfx_ksys_read+0x10/0x10 [ 1480.435676][T14983] do_syscall_64+0x123/0x790 [ 1480.435701][T14983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1480.435722][T14983] RIP: 0033:0x7f3e4e95e98e [ 1480.435739][T14983] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1480.435757][T14983] RSP: 002b:00007f3e4f855fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1480.435777][T14983] RAX: ffffffffffffffda RBX: 00007f3e4f8566c0 RCX: 00007f3e4e95e98e [ 1480.435790][T14983] RDX: 000000000000000f RSI: 00007f3e4f8560a0 RDI: 0000000000000005 [ 1480.435802][T14983] RBP: 00007f3e4f856090 R08: 0000000000000000 R09: 0000000000000000 [ 1480.435815][T14983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1480.435827][T14983] R13: 00007f3e4ec26128 R14: 00007f3e4ec26090 R15: 00007ffde30daa18 [ 1480.435857][T14983] [ 1484.681554][T14996] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1485.405375][T15004] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2405'. [ 1485.405668][T15004] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2405'. [ 1485.457401][T15004] bridge24: entered promiscuous mode [ 1485.457417][T15004] bridge24: entered allmulticast mode [ 1486.654331][T15009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2407'. [ 1486.654625][T15009] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2407'. [ 1486.813680][T15009] bridge26: entered promiscuous mode [ 1486.813696][T15009] bridge26: entered allmulticast mode [ 1487.180421][T15012] 9pnet_fd: p9_fd_create_tcp (15012): problem connecting socket to 127.0.0.1 [ 1487.345132][T15015] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1491.110665][T15023] 9p: Could not find request transport: x0000°00000004e24 [ 1491.481568][T15035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2406'. [ 1491.597295][T15039] ip_tables: iptables: counters copy to user failed while replacing table [ 1491.603411][T15037] FAULT_INJECTION: forcing a failure. [ 1491.603411][T15037] name failslab, interval 1, probability 0, space 0, times 0 [ 1491.603442][T15037] CPU: 1 UID: 0 PID: 15037 Comm: syz.1.2401 Tainted: G L syzkaller #0 PREEMPT(full) [ 1491.603471][T15037] Tainted: [L]=SOFTLOCKUP [ 1491.603479][T15037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1491.603492][T15037] Call Trace: [ 1491.603500][T15037] [ 1491.603508][T15037] dump_stack_lvl+0x100/0x190 [ 1491.603543][T15037] should_fail_ex.cold+0x5/0xa [ 1491.603574][T15037] should_failslab+0xc2/0x120 [ 1491.603603][T15037] __kmalloc_cache_noprof+0x91/0x6d0 [ 1491.603625][T15037] ? fanout_add+0x19a/0x1550 [ 1491.603662][T15037] fanout_add+0x19a/0x1550 [ 1491.603695][T15037] packet_setsockopt+0x61a/0x2380 [ 1491.603728][T15037] ? sock_has_perm+0x25a/0x2f0 [ 1491.603752][T15037] ? __pfx_packet_setsockopt+0x10/0x10 [ 1491.603777][T15037] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1491.603802][T15037] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1491.603838][T15037] ? find_held_lock+0x2b/0x80 [ 1491.603866][T15037] ? __fget_files+0x215/0x3d0 [ 1491.603897][T15037] ? selinux_socket_setsockopt+0x6a/0x80 [ 1491.603921][T15037] ? __pfx_packet_setsockopt+0x10/0x10 [ 1491.603950][T15037] do_sock_setsockopt+0xf3/0x1d0 [ 1491.603986][T15037] __sys_setsockopt+0x195/0x220 [ 1491.604018][T15037] __x64_sys_setsockopt+0xbd/0x160 [ 1491.604043][T15037] ? do_syscall_64+0xae/0x790 [ 1491.604064][T15037] ? lockdep_hardirqs_on+0x7d/0x110 [ 1491.604085][T15037] do_syscall_64+0x123/0x790 [ 1491.604109][T15037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1491.604130][T15037] RIP: 0033:0x7f4a8179e159 [ 1491.604148][T15037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1491.604167][T15037] RSP: 002b:00007f4a826b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1491.604188][T15037] RAX: ffffffffffffffda RBX: 00007f4a81a25fa0 RCX: 00007f4a8179e159 [ 1491.604202][T15037] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000004 [ 1491.604214][T15037] RBP: 00007f4a8183506b R08: 0000000000000004 R09: 0000000000000000 [ 1491.604227][T15037] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1491.604241][T15037] R13: 00007f4a81a26038 R14: 00007f4a81a25fa0 R15: 00007ffe32a52718 [ 1491.604274][T15037] [ 1492.018984][T15044] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1493.551413][T15051] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2417'. [ 1493.551672][T15051] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2417'. [ 1493.603276][T15051] bridge25: entered promiscuous mode [ 1493.603292][T15051] bridge25: entered allmulticast mode [ 1493.893335][T15052] FAULT_INJECTION: forcing a failure. [ 1493.893335][T15052] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1493.893371][T15052] CPU: 1 UID: 0 PID: 15052 Comm: syz.3.2408 Tainted: G L syzkaller #0 PREEMPT(full) [ 1493.893401][T15052] Tainted: [L]=SOFTLOCKUP [ 1493.893408][T15052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1493.893421][T15052] Call Trace: [ 1493.893429][T15052] [ 1493.893444][T15052] dump_stack_lvl+0x100/0x190 [ 1493.893480][T15052] should_fail_ex.cold+0x5/0xa [ 1493.893510][T15052] strncpy_from_user+0x3b/0x2d0 [ 1493.893536][T15052] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1493.893565][T15052] keyctl_keyring_search+0xaf/0x450 [ 1493.893589][T15052] ? __x64_sys_futex+0x34f/0x4d0 [ 1493.893621][T15052] ? __pfx_keyctl_keyring_search+0x10/0x10 [ 1493.893645][T15052] ? __pfx___x64_sys_futex+0x10/0x10 [ 1493.893673][T15052] ? ksys_write+0x1ac/0x250 [ 1493.893694][T15052] ? __pfx_ksys_write+0x10/0x10 [ 1493.893720][T15052] __do_sys_keyctl+0x353/0x5a0 [ 1493.893743][T15052] do_syscall_64+0x123/0x790 [ 1493.893768][T15052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1493.893792][T15052] RIP: 0033:0x7f3e4e99e159 [ 1493.893811][T15052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1493.893833][T15052] RSP: 002b:00007f3e4f877028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1493.893854][T15052] RAX: ffffffffffffffda RBX: 00007f3e4ec25fa0 RCX: 00007f3e4e99e159 [ 1493.893869][T15052] RDX: 0000200000000080 RSI: 0000000000000000 RDI: 000000000000000a [ 1493.893882][T15052] RBP: 00007f3e4ea3506b R08: 0000000000000000 R09: 0000000000000000 [ 1493.893896][T15052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1493.893911][T15052] R13: 00007f3e4ec26038 R14: 00007f3e4ec25fa0 R15: 00007ffde30daa18 [ 1493.893939][T15052] [ 1494.729785][T15059] se_dev->se_dev_ptr already set for storage object [ 1496.831709][T15066] misc userio: The device must be registered before sending interrupts [ 1499.206925][T15077] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2424'. [ 1499.207349][T15077] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2424'. [ 1499.308198][T15077] bridge25: entered promiscuous mode [ 1499.308352][T15077] bridge25: entered allmulticast mode [ 1500.788713][T15081] misc userio: The device must be registered before sending interrupts [ 1503.525239][T15102] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2428'. [ 1503.525584][T15102] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2428'. [ 1503.577222][T15102] bridge27: entered promiscuous mode [ 1503.577238][T15102] bridge27: entered allmulticast mode [ 1503.900903][T15104] FAULT_INJECTION: forcing a failure. [ 1503.900903][T15104] name failslab, interval 1, probability 0, space 0, times 0 [ 1503.900939][T15104] CPU: 0 UID: 0 PID: 15104 Comm: syz.4.2426 Tainted: G L syzkaller #0 PREEMPT(full) [ 1503.900968][T15104] Tainted: [L]=SOFTLOCKUP [ 1503.900977][T15104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1503.900989][T15104] Call Trace: [ 1503.901003][T15104] [ 1503.901012][T15104] dump_stack_lvl+0x100/0x190 [ 1503.901049][T15104] should_fail_ex.cold+0x5/0xa [ 1503.901079][T15104] should_failslab+0xc2/0x120 [ 1503.901109][T15104] __kmalloc_cache_noprof+0x91/0x6d0 [ 1503.901132][T15104] ? fanout_add+0x19a/0x1550 [ 1503.901164][T15104] fanout_add+0x19a/0x1550 [ 1503.901196][T15104] packet_setsockopt+0x61a/0x2380 [ 1503.901227][T15104] ? sock_has_perm+0x25a/0x2f0 [ 1503.901252][T15104] ? __pfx_packet_setsockopt+0x10/0x10 [ 1503.901282][T15104] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1503.901312][T15104] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1503.901348][T15104] ? find_held_lock+0x2b/0x80 [ 1503.901379][T15104] ? __fget_files+0x215/0x3d0 [ 1503.901410][T15104] ? selinux_socket_setsockopt+0x6a/0x80 [ 1503.901435][T15104] ? __pfx_packet_setsockopt+0x10/0x10 [ 1503.901465][T15104] do_sock_setsockopt+0xf3/0x1d0 [ 1503.901500][T15104] __sys_setsockopt+0x195/0x220 [ 1503.901534][T15104] __x64_sys_setsockopt+0xbd/0x160 [ 1503.901560][T15104] ? do_syscall_64+0xae/0x790 [ 1503.901581][T15104] ? lockdep_hardirqs_on+0x7d/0x110 [ 1503.901602][T15104] do_syscall_64+0x123/0x790 [ 1503.901627][T15104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.901651][T15104] RIP: 0033:0x7fde20d9e159 [ 1503.901669][T15104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1503.901688][T15104] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1503.901709][T15104] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1503.901725][T15104] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000004 [ 1503.901738][T15104] RBP: 00007fde20e3506b R08: 0000000000000004 R09: 0000000000000000 [ 1503.901750][T15104] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1503.901763][T15104] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1503.901794][T15104] [ 1504.221282][T15108] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1505.740419][T15111] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2432'. [ 1505.740618][T15111] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2432'. [ 1505.812921][T15111] bridge24: entered promiscuous mode [ 1505.812978][T15111] bridge24: entered allmulticast mode [ 1506.405255][T15116] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1507.416328][T15124] hub 8-0:1.0: USB hub found [ 1507.417221][T15124] hub 8-0:1.0: 1 port detected [ 1507.528790][T12507] Bluetooth: hci2: connection err: -111 [ 1507.716465][ T5620] Bluetooth: hci2: unexpected cc 0x080e length: 5 > 3 [ 1507.716623][ T5620] Bluetooth: hci2: unexpected event for opcode 0x080e [ 1507.980907][T15123] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1508.601969][T15131] se_dev->se_dev_ptr already set for storage object [ 1509.149616][T15133] nvme_fabrics: unknown parameter or missing value 'nqn=' in ctrl creation request [ 1509.627301][T15136] misc userio: The device must be registered before sending interrupts [ 1510.332251][T15140] FAULT_INJECTION: forcing a failure. [ 1510.332251][T15140] name failslab, interval 1, probability 0, space 0, times 0 [ 1510.343621][T15140] CPU: 1 UID: 0 PID: 15140 Comm: syz.4.2440 Tainted: G L syzkaller #0 PREEMPT(full) [ 1510.343661][T15140] Tainted: [L]=SOFTLOCKUP [ 1510.343669][T15140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1510.343684][T15140] Call Trace: [ 1510.343692][T15140] [ 1510.343701][T15140] dump_stack_lvl+0x100/0x190 [ 1510.343742][T15140] should_fail_ex.cold+0x5/0xa [ 1510.343774][T15140] should_failslab+0xc2/0x120 [ 1510.343806][T15140] __kmalloc_cache_noprof+0x91/0x6d0 [ 1510.343832][T15140] ? blkcg_css_alloc+0x6b/0x8c0 [ 1510.343865][T15140] blkcg_css_alloc+0x6b/0x8c0 [ 1510.343898][T15140] cgroup_apply_control_enable+0x602/0xdd0 [ 1510.343931][T15140] ? css_populate_dir+0x233/0x590 [ 1510.343968][T15140] cgroup_mkdir+0x57f/0x1330 [ 1510.344001][T15140] ? __pfx_cgroup_mkdir+0x10/0x10 [ 1510.344030][T15140] kernfs_iop_mkdir+0x111/0x190 [ 1510.344054][T15140] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 1510.344097][T15140] vfs_mkdir+0x364/0x850 [ 1510.344129][T15140] filename_mkdirat+0x48b/0x5e0 [ 1510.344165][T15140] ? __pfx_filename_mkdirat+0x10/0x10 [ 1510.344197][T15140] ? strncpy_from_user+0x19d/0x2d0 [ 1510.344231][T15140] ? do_getname+0x191/0x390 [ 1510.344257][T15140] __x64_sys_mkdirat+0x89/0xc0 [ 1510.344290][T15140] do_syscall_64+0x123/0x790 [ 1510.344318][T15140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1510.344342][T15140] RIP: 0033:0x7fde20d9e159 [ 1510.344363][T15140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1510.344383][T15140] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 1510.344406][T15140] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1510.344422][T15140] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 1510.344437][T15140] RBP: 00007fde20e3506b R08: 0000000000000000 R09: 0000000000000000 [ 1510.344451][T15140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1510.344468][T15140] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1510.344503][T15140] [ 1511.142249][T15149] FAULT_INJECTION: forcing a failure. [ 1511.142249][T15149] name failslab, interval 1, probability 0, space 0, times 0 [ 1511.142288][T15149] CPU: 1 UID: 0 PID: 15149 Comm: syz.4.2443 Tainted: G L syzkaller #0 PREEMPT(full) [ 1511.142319][T15149] Tainted: [L]=SOFTLOCKUP [ 1511.142327][T15149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1511.142341][T15149] Call Trace: [ 1511.142350][T15149] [ 1511.142359][T15149] dump_stack_lvl+0x100/0x190 [ 1511.142398][T15149] should_fail_ex.cold+0x5/0xa [ 1511.142432][T15149] should_failslab+0xc2/0x120 [ 1511.142463][T15149] __kmalloc_cache_noprof+0x91/0x6d0 [ 1511.142487][T15149] ? fanout_add+0x19a/0x1550 [ 1511.142519][T15149] fanout_add+0x19a/0x1550 [ 1511.142551][T15149] packet_setsockopt+0x61a/0x2380 [ 1511.142582][T15149] ? sock_has_perm+0x25a/0x2f0 [ 1511.142607][T15149] ? __pfx_packet_setsockopt+0x10/0x10 [ 1511.142635][T15149] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 1511.142667][T15149] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 1511.142704][T15149] ? find_held_lock+0x2b/0x80 [ 1511.142734][T15149] ? __fget_files+0x215/0x3d0 [ 1511.142767][T15149] ? selinux_socket_setsockopt+0x6a/0x80 [ 1511.142792][T15149] ? __pfx_packet_setsockopt+0x10/0x10 [ 1511.142823][T15149] do_sock_setsockopt+0xf3/0x1d0 [ 1511.142861][T15149] __sys_setsockopt+0x195/0x220 [ 1511.142894][T15149] __x64_sys_setsockopt+0xbd/0x160 [ 1511.142921][T15149] ? do_syscall_64+0xae/0x790 [ 1511.142943][T15149] ? lockdep_hardirqs_on+0x7d/0x110 [ 1511.142964][T15149] do_syscall_64+0x123/0x790 [ 1511.142995][T15149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.143020][T15149] RIP: 0033:0x7fde20d9e159 [ 1511.143039][T15149] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1511.143059][T15149] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1511.143081][T15149] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1511.143096][T15149] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000004 [ 1511.143110][T15149] RBP: 00007fde20e3506b R08: 0000000000000004 R09: 0000000000000000 [ 1511.143123][T15149] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1511.143137][T15149] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1511.143168][T15149] [ 1512.138905][T15153] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2434'. [ 1512.157682][T15153] netlink: 'syz.0.2434': attribute type 39 has an invalid length. [ 1516.168208][T15179] misc userio: The device must be registered before sending interrupts [ 1518.142938][ T5809] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1518.494139][ T5809] usb 5-1: Using ep0 maxpacket: 16 [ 1518.500498][ T5809] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1518.500739][ T5809] usb 5-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 1518.506792][ T5809] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1518.506913][ T5809] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1518.519113][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1518.519172][ T5809] usb 5-1: Product: syz [ 1518.519286][ T5809] usb 5-1: Manufacturer: syz [ 1518.519334][ T5809] usb 5-1: SerialNumber: syz [ 1520.032569][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2448'. [ 1520.032602][T15203] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2448'. [ 1520.036527][T15203] bridge32: entered promiscuous mode [ 1520.036541][T15203] bridge32: entered allmulticast mode [ 1521.116810][ T5809] usb 5-1: USB disconnect, device number 65 [ 1521.575793][T14431] udevd[14431]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1523.357857][T15225] nvme_fabrics: unknown parameter or missing value 'nqn=' in ctrl creation request [ 1523.385967][T15226] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1524.268322][T15231] misc userio: The device must be registered before sending interrupts [ 1525.486259][T15243] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1526.967214][T15246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2464'. [ 1526.967465][T15246] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2464'. [ 1527.058871][T15246] bridge25: entered promiscuous mode [ 1527.058934][T15246] bridge25: entered allmulticast mode [ 1528.796281][T15258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2465'. [ 1528.796602][T15258] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2465'. [ 1528.917552][T15258] bridge28: entered promiscuous mode [ 1528.917790][T15258] bridge28: entered allmulticast mode [ 1532.051034][T15272] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2470'. [ 1532.137889][T15274] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1536.040908][T15305] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2478'. [ 1536.041096][T15305] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2478'. [ 1536.157323][T15305] bridge26: entered promiscuous mode [ 1536.157387][T15305] bridge26: entered allmulticast mode [ 1536.785104][ T31] audit: type=1400 audit(1790561769.096:1014): avc: denied { map } for pid=15308 comm="syz.3.2476" path="socket:[46096]" dev="sockfs" ino=46096 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1536.785156][ T31] audit: type=1400 audit(1790561769.096:1015): avc: denied { read } for pid=15308 comm="syz.3.2476" path="socket:[46096]" dev="sockfs" ino=46096 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1536.846287][T10269] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1536.992763][T10269] usb 3-1: device descriptor read/64, error -71 [ 1537.077285][T15312] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1537.242737][T10269] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1537.382800][T10269] usb 3-1: device descriptor read/64, error -71 [ 1537.494370][T10269] usb usb3-port1: attempt power cycle [ 1539.118510][T15318] netlink: 'syz.0.2481': attribute type 39 has an invalid length. [ 1539.646887][T15321] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2482'. [ 1539.692776][T10269] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1539.948469][T15327] vivid-000: disconnect [ 1539.953098][T15327] vivid-000: reconnect [ 1539.964219][ T31] audit: type=1400 audit(1790561772.256:1016): avc: denied { getopt } for pid=15320 comm="syz.3.2482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1540.285423][T10269] usb 3-1: device not accepting address 58, error -71 [ 1540.461465][ T31] audit: type=1400 audit(1790561772.756:1017): avc: denied { read } for pid=15322 comm="syz.2.2485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1540.553399][ T1254] ieee802154 phy0 wpan0: encryption failed: -22 [ 1540.553494][ T1254] ieee802154 phy1 wpan1: encryption failed: -22 [ 1541.203248][T15337] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2486'. [ 1541.203660][T15337] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2486'. [ 1541.319950][T15337] bridge29: entered promiscuous mode [ 1541.320132][T15337] bridge29: entered allmulticast mode [ 1541.674823][T15330] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1542.655736][T15347] FAULT_INJECTION: forcing a failure. [ 1542.655736][T15347] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1542.655809][T15347] CPU: 1 UID: 0 PID: 15347 Comm: syz.4.2489 Tainted: G L syzkaller #0 PREEMPT(full) [ 1542.655837][T15347] Tainted: [L]=SOFTLOCKUP [ 1542.655845][T15347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1542.655858][T15347] Call Trace: [ 1542.655865][T15347] [ 1542.655873][T15347] dump_stack_lvl+0x100/0x190 [ 1542.655908][T15347] should_fail_ex.cold+0x5/0xa [ 1542.655937][T15347] _copy_from_user+0x2e/0xd0 [ 1542.655963][T15347] copy_msghdr_from_user+0x9f/0x4c0 [ 1542.655987][T15347] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1542.656017][T15347] ? find_held_lock+0x2b/0x80 [ 1542.656045][T15347] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 1542.656074][T15347] ___sys_sendmsg+0x106/0x1e0 [ 1542.656099][T15347] ? __pfx____sys_sendmsg+0x10/0x10 [ 1542.656122][T15347] ? rcu_is_watching+0x13/0xc0 [ 1542.656161][T15347] ? find_held_lock+0x2b/0x80 [ 1542.656211][T15347] __sys_sendmsg+0x160/0x210 [ 1542.656239][T15347] ? __pfx___sys_sendmsg+0x10/0x10 [ 1542.656282][T15347] do_syscall_64+0x123/0x790 [ 1542.656307][T15347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1542.656328][T15347] RIP: 0033:0x7fde20d9e159 [ 1542.656346][T15347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1542.656365][T15347] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1542.656391][T15347] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1542.656404][T15347] RDX: 0000000020004804 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1542.656418][T15347] RBP: 00007fde21bbd090 R08: 0000000000000000 R09: 0000000000000000 [ 1542.656430][T15347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1542.656443][T15347] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1542.656472][T15347] [ 1543.288084][T15352] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1545.992766][ T5809] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1546.143097][ T5809] usb 5-1: Using ep0 maxpacket: 16 [ 1546.186222][ T5809] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1546.186361][ T5809] usb 5-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 1546.233668][ T5809] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1546.233770][ T5809] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1546.294346][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.294362][ T5809] usb 5-1: Product: syz [ 1546.294371][ T5809] usb 5-1: Manufacturer: syz [ 1546.294380][ T5809] usb 5-1: SerialNumber: syz [ 1546.990342][T15366] misc userio: The device must be registered before sending interrupts [ 1548.131347][T15378] [U]  [ 1548.131374][T15378] [U] K{‘ [ 1548.139782][T15378] [U] ÄT Ž1ÊÀŠªFÌÇÄFËŠÎ`GÊJǘÜGÖƯ¹¬¡—ÞÈOÕÑ/ÜMCÇ [ 1548.140431][T15378] [U] TžØ–/,~ˆÄœ­‹JÕßÊ}8ÎÊÞ'O1Ü"™7-΂JQœK—¤WºÏQÉ5C%"¬H12–¦Y“„‰ž€ÊXÍ`ˆ‚Íȼ`+³Û(·Â¿!(ÉÛÉZ'ÀTXLN»I®GÅJ– °ÜÝ­·PÅ~÷7Í!‘ÕÒ"بÎ ¾ª(È5ˆOBܤ‡ÍƒJÖ [ 1548.140676][T15378] [U] ±K\&—}6£6œXÎHX ¥Ôµ„ÌÞ.`¸A“$Û40|϶¿9°ØÞ¨„¯À ÏU‚Ò4ÔÄ®VBZÃÐ}ÌWÔM”TºŽÍQŸÝΦR’ 4”ß [ 1548.178225][T15378] [U] ".H6ØÞ"ÖKÇ[›‰¤ŒJÁ4ÇØIN¨™[Z(•„C|TË]Z{Â3ŸC=»¨XÎԞ˅Î4¿W‰)\T‘XJØSH{Q;̹¢…ÖTÔÇ+‹¦÷GÍÈß®D„.Ë‚³>Yž÷ÉWUH„FN—ŽÇHL]SÔ2ŠÇÙ\G%ŠO¼&Z)µК'¨PUL‚_<à ¢Ø°‰Ò®ÔÅ`Ò±TÔÁÞœÐËÞ;_Ô"(‘U{7Jœ¿2X ‘/€'ÝÙCÑÌÕIº©ÀÏH¿CÕ³žV¦=‘AIÇ%W¼ESž RšŸJŠÎœƒÚ”GÂ÷RÁ¹Í¡HI˜¢œAÏÌ6-ÚDÚV¨Á I"ØÅNƨ ÞÚASC~4Áª¹8CØ*­OO5/ßœJš~º§¡W—VK+¬®‰Œ3ÈÇY)Ž¹M°¸ÆV¶ÌYQƽ€DTR¯OTPEM%F×ÊEJÍA5ÆÔT_-X~ ^AAÛ‚Ò˜½QÖÅ [ 1548.220610][T15378] [U] +W‰G?]£Ó'A: »Ú)ÕÏÓ™“' B>T¢ ¡F/™÷<'ÈUÓ'–¼H§IÉ.+]EŸ.½-É¿ß¿Ò%÷È>2`¶^Uß8F.Š6¤Å3ÓØ+ËA¾Â««„°G3ÓPÂÓ6:^0ÀTÉÈV÷'EÕT¼€ÛÂYC‰N¾ÞRÏ©ÞNÈPJ× ;ÆZ†ÊÔÑÛ‘8!¯È\Ù…¸AØÊ–2Á£$е™Â­WI.ÍÇ#ŠÈ/BAI¼Ä`ÐÁ4J’ÔDÎY@ÓZ„ÜGW÷5Ë¿BÄ µÙœ NÓY"VI2ÛÌ [ 1548.220900][T15378] [U] ܾ˜4B`Ë—HÔT¦_K5¸T¬YJÐÞÎ9ÐÕCÊ$BRŸLÚNUL ¶Ü9WÈÝÍ|žGÅ"ʃÆ%ÇÚ¶ÊCªØ°¶ºQÎÙ ŸÇ3‹ÆQ¯ÔN^HP*½Ü$ µ.Î7YÓ±œ2³ [ 1548.221164][T15378] [U] ½?©ß HÜÄ*ÙÁ”Î3Í7Üɾ^#Q"0~‡ ‚Ð(ÉOÏX LŒB£,'VÎÓ=‹ÝËCÌS«…’G‚S¶Þ0•Ö‚‹Ù`˜›žÙ‡Ÿ†=1(÷ξ™÷P#Ò2DO*Ƀ [ 1548.226095][T15378] [U] ©S¹“Gžµ²¶“˜GUÐÔD-{¸™Â|&“®ŸŸÑ2µ›LÞC_©œ!`¨ÍOZÖ¥¢B¶³%>ÊRѶÖWχݎSSÂH"£YA4£O.šYÙÛÄ„RTÔ¶ŒBÚ[+/<>—¡{Q¢Ú×_²ÕLX8ÊU„ÇØÎ{ÐZ³ÍØ)ßÒ7?ËRR;ßC¿R HײڣÁ»¨È1Å>)©Mă‰ÏT§²Ú(ÌÇAÏ„}9·Ú¥ÃJ*MÑœ¥Ä¡«'L¹£Q ÌDWŸÒظ=ؽ|Q¬ ÏÆ™W;5ÆÙŽª!ÑDB¸X`ɧÖ/÷ÂE`Ʀ\ [ 1548.246499][T15378] [U] M¢XÎÂ"Ä{;Ž Õ¥ÂÙ˜_ˆO2«Ñ)ÎO®›.2ÐW2ʲ¨ÐYÙÃÃX_ HPϱœSªD­¦Ø:]‚{Ë©ÔÝÆȽ [ 1548.246863][T15378] [U] I,Ç>ÇÓ¤ ÎÙ51Ñ÷^1ÒN4¯OǶÞ'0Ý?Ö’IÙ9W.Ï_.¶WŠA¼ŠVˆ±`)ÑZ¬ÏÆC6GIÓ¹²A»¬XL[¢›½¡FÜ*ÀÑO‰W)+‡Ç'\NÆ[K@ÑËÄÜ2ÇǬ–®¡P"^`Á‰Í Ø¿ [ 1548.246939][T15378] [U] 22½“Æ©ÐÛ©X?0;3U± [ 1548.257454][T15378] [U] ÞœÕÆÓSOBX 8”Wˆ4Á‘(Ð~/§¿ÍKÇUžÃÔ–OQËE+·G®-YµGY_•>V¢ÜÈË—3.HÁÓ™]Í„²2‘”)™DË, ‘Ä ÞD~×D©£¡+ÃW; A\˜FPÉÞȘ|$ºØ)KØI³ÉÐÉ¿KÑYT^RÍÜÙÇ™µ“ËA=±#–Üœ ÝÍ¿ËAE©TÅ1·Îݯ4K¯.E"RÚS|ПÀSÖ’Á:•Ù>P ™…RÐ"Z‰Ú­ÛÚÉ#P!˜KY"›}ÃÆF¿N84ܳƒÅHÞ±£O•ÈS¿™Ì«%DLWÙMÆ²Ç [ 1548.257703][T15378] [U] [ª['XN€'²÷ Á¿Ü,MR¦«/žšœÂ1D=!DŽX91BÙWÇ»R—LF…ƒÆK̤ZÕÊ# `Ì‘ LØ›§Ëœ»×B~ÅMÒÔÖ [ 1548.257915][T15378] [U] ™LÖ>ÑD+ˆD¯§—®Ì"5ŽÊH3<ª¨ÅIR=F^”FNÕÓÜÀ‰¿Û­VÛ÷œDÁOIOÚ:UÖ>ÖY [ 1548.258022][T15378] [U] 'B—6VÝ20³Ä·Çž¥·×ŒÏ"T8Ñ{9ÆFW]ÔÊÄÌ© [ 1548.258353][T15378] [U] Ù72Þ‰ÏÂÃUÞC6™ÎÜÔÏ„I]8Cª£TÛ¨QSKYÞÎIÒÀ¹ ¿|V'ÛTV/ÙÅG•$[ 9KH`Ú"Ü‘ÚÕ}€Ñ[^=ˆÚ0Á]½Ã%ÆÌ‚T“Šž¹ØFÌ_VÖ4C¸ÒÅ [ 1548.258379][T15378] [U] ¹ EC [ 1548.262197][T15378] [U] —”|‚ÊÌ<ÄÎ:^Ü3$7NK~Ø-™@÷¦?Ÿ–/MTL·Û¾©IˆWȬ@G~TØ{ÊÜP¿+Æ$ªJP|µ ŽÇIÛRIÓPMÐ Õ·YÓ Ú”8ÌTÉÐÞVžÙßÆË,ÎLÂ,Õ [ 1548.493934][T15377] [U] ˆKÌÚÛÕ‰)0ÄÄÝ~ܳʪÁIP'ÍFÓÒœZÚÞR¬™ß @BÓ]Â5ÝÊ{­©Ê¼Ô'À8ÅÆ¥F‡¹UTQUDÇ©¤K;7ͪ0C[„ÃY–¼ÈYC¦¶»Ø°Mª™LÒ8’T…ÍšÎ5³ÝÝRX™¶ÐWÍ X¤²ÓOQHVI'8œ¥Î…Lµ [ 1549.549258][T15406] netlink: 'syz.1.2494': attribute type 39 has an invalid length. [ 1550.268162][ T31] audit: type=1400 audit(1790561782.576:1018): avc: denied { write } for pid=15389 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1550.289927][T15404] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=15404 comm=syz.3.2499 [ 1550.554572][T15415] hub 8-0:1.0: USB hub found [ 1550.555505][T15415] hub 8-0:1.0: 1 port detected [ 1551.030056][ T31] audit: type=1400 audit(1790561783.336:1019): avc: denied { write } for pid=15413 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1551.232936][ T5608] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1551.415722][ T5608] usb 4-1: Using ep0 maxpacket: 32 [ 1551.417850][ T5608] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1551.418881][ T5608] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 1551.418906][ T5608] usb 4-1: config 0 has no interface number 0 [ 1551.418941][ T5608] usb 4-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1551.418962][ T5608] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1551.418988][ T5608] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1551.419014][ T5608] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1551.419034][ T5608] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1551.419055][ T5608] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1551.419074][ T5608] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1551.419094][ T5608] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1551.419114][ T5608] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1551.419136][ T5608] usb 4-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1551.420965][ T5608] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1551.420989][ T5608] usb 4-1: Product: syz [ 1551.421006][ T5608] usb 4-1: Manufacturer: syz [ 1551.421022][ T5608] usb 4-1: SerialNumber: syz [ 1551.564611][ T5608] usb 4-1: config 0 descriptor?? [ 1551.573345][T15417] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1551.603749][ T5608] usb 4-1: will this work? Response EP is not usually 3 [ 1551.603772][ T5608] usb 4-1: will this work? Image data EP is not usually 2 [ 1551.611801][ T5608] scsi host1: microtekX6 [ 1551.649676][ T1119] usb 4-1: error -90 submitting URB [ 1551.672911][T14114] usb 4-1: error -90 submitting URB [ 1551.732820][ T4938] usb 4-1: error -90 submitting URB [ 1551.772831][ T4938] usb 4-1: error -90 submitting URB [ 1551.789668][T15429] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1552.764729][ T31] audit: type=1400 audit(1790561785.076:1020): avc: denied { write } for pid=15430 comm="syz.2.2504" name="rtc0" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1552.778695][T10269] usb 4-1: USB disconnect, device number 57 [ 1552.865190][ T10] usb 5-1: USB disconnect, device number 66 [ 1553.101551][T15438] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2504'. [ 1554.510413][ T31] audit: type=1400 audit(1790561786.806:1021): avc: denied { write } for pid=15419 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1555.240882][ T31] audit: type=1400 audit(1790561787.546:1022): avc: denied { write } for pid=15461 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1557.120152][T15475] FAULT_INJECTION: forcing a failure. [ 1557.120152][T15475] name failslab, interval 1, probability 0, space 0, times 0 [ 1557.120185][T15475] CPU: 1 UID: 0 PID: 15475 Comm: syz.0.2514 Tainted: G L syzkaller #0 PREEMPT(full) [ 1557.120212][T15475] Tainted: [L]=SOFTLOCKUP [ 1557.120219][T15475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1557.120231][T15475] Call Trace: [ 1557.120239][T15475] [ 1557.120248][T15475] dump_stack_lvl+0x100/0x190 [ 1557.120288][T15475] should_fail_ex.cold+0x5/0xa [ 1557.120315][T15475] should_failslab+0xc2/0x120 [ 1557.120345][T15475] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1557.120371][T15475] ? create_new_namespaces+0x30/0xac0 [ 1557.120403][T15475] create_new_namespaces+0x30/0xac0 [ 1557.120426][T15475] ? bpf_lsm_capable+0x9/0x10 [ 1557.120446][T15475] ? security_capable+0x80/0x260 [ 1557.120471][T15475] unshare_nsproxy_namespaces+0xf2/0x220 [ 1557.120497][T15475] ksys_unshare+0x4a2/0xa70 [ 1557.120531][T15475] ? __pfx_ksys_unshare+0x10/0x10 [ 1557.120569][T15475] __x64_sys_unshare+0x31/0x40 [ 1557.120596][T15475] do_syscall_64+0x123/0x790 [ 1557.120622][T15475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1557.120646][T15475] RIP: 0033:0x7f0e1419e159 [ 1557.120664][T15475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1557.120683][T15475] RSP: 002b:00007f0e1514f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1557.120705][T15475] RAX: ffffffffffffffda RBX: 00007f0e14425fa0 RCX: 00007f0e1419e159 [ 1557.120723][T15475] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000028000600 [ 1557.120736][T15475] RBP: 00007f0e1423506b R08: 0000000000000000 R09: 0000000000000000 [ 1557.120750][T15475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1557.120762][T15475] R13: 00007f0e14426038 R14: 00007f0e14425fa0 R15: 00007ffe6aaa48c8 [ 1557.120789][T15475] [ 1557.929611][T15484] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2516'. [ 1557.929881][T15484] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2516'. [ 1558.037738][T15484] bridge27: entered promiscuous mode [ 1558.037902][T15484] bridge27: entered allmulticast mode [ 1563.760952][T15516] hub 8-0:1.0: USB hub found [ 1563.761465][T15516] hub 8-0:1.0: 1 port detected [ 1564.557794][T15521] netlink: 'syz.1.2527': attribute type 39 has an invalid length. [ 1566.600757][T15534] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1567.232928][T15545] netlink: 'syz.2.2534': attribute type 2 has an invalid length. [ 1567.236790][ T31] audit: type=1400 audit(1790561799.546:1023): avc: denied { connect } for pid=15543 comm="syz.2.2534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1567.284871][ T31] audit: type=1400 audit(1790561799.596:1024): avc: denied { setopt } for pid=15543 comm="syz.2.2534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1567.452577][T15545] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2534'. [ 1567.465237][T15545] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2534'. [ 1567.565475][T10269] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1567.596989][T15550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2534'. [ 1567.712916][T10269] usb 4-1: Using ep0 maxpacket: 32 [ 1567.796732][T10269] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1567.797701][T10269] usb 4-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 1567.932326][T10269] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.932397][T10269] usb 4-1: Product: syz [ 1567.932437][T10269] usb 4-1: Manufacturer: syz [ 1567.932505][T10269] usb 4-1: SerialNumber: syz [ 1569.308690][T10269] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1569.758258][T15562] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1570.435727][T10269] usb 4-1: USB disconnect, device number 58 [ 1570.485512][T15564] FAULT_INJECTION: forcing a failure. [ 1570.485512][T15564] name failslab, interval 1, probability 0, space 0, times 0 [ 1570.485551][T15564] CPU: 1 UID: 0 PID: 15564 Comm: syz.1.2528 Tainted: G L syzkaller #0 PREEMPT(full) [ 1570.485585][T15564] Tainted: [L]=SOFTLOCKUP [ 1570.485594][T15564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1570.485609][T15564] Call Trace: [ 1570.485617][T15564] [ 1570.485627][T15564] dump_stack_lvl+0x100/0x190 [ 1570.485668][T15564] should_fail_ex.cold+0x5/0xa [ 1570.485702][T15564] should_failslab+0xc2/0x120 [ 1570.485735][T15564] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 1570.485767][T15564] ? kasan_save_track+0x14/0x30 [ 1570.485793][T15564] ? kstrdup_const+0x63/0x80 [ 1570.485824][T15564] kstrdup+0x51/0xe0 [ 1570.485849][T15564] kstrdup_const+0x63/0x80 [ 1570.485873][T15564] eventfs_create_dir+0x8e/0x5c0 [ 1570.485906][T15564] event_create_dir+0x67b/0xd50 [ 1570.485948][T15564] __trace_add_new_event+0x97/0xf0 [ 1570.485983][T15564] trace_add_event_call+0xd7/0x180 [ 1570.486018][T15564] trace_probe_register_event_call+0x32a/0x510 [ 1570.486056][T15564] __trace_uprobe_create+0x1891/0x2310 [ 1570.486104][T15564] ? __pfx___trace_uprobe_create+0x10/0x10 [ 1570.486137][T15564] ? trace_kmalloc+0xeb/0x110 [ 1570.486166][T15564] ? __kasan_kmalloc+0xaa/0xb0 [ 1570.486195][T15564] ? __kmalloc_noprof+0x350/0x840 [ 1570.486223][T15564] ? argv_split+0x173/0x420 [ 1570.486253][T15564] ? argv_split+0x359/0x420 [ 1570.486284][T15564] ? __pfx___trace_uprobe_create+0x10/0x10 [ 1570.486318][T15564] trace_probe_create+0xef/0x100 [ 1570.486348][T15564] ? __pfx_trace_probe_create+0x10/0x10 [ 1570.486386][T15564] dyn_event_create+0x50/0x90 [ 1570.486410][T15564] create_or_delete_trace_uprobe+0x5a/0xb0 [ 1570.486441][T15564] trace_parse_run_command+0x1ab/0x3b0 [ 1570.486469][T15564] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 1570.486506][T15564] vfs_write+0x2aa/0x1050 [ 1570.486533][T15564] ? __pfx_probes_write+0x10/0x10 [ 1570.486561][T15564] ? lock_acquire+0x1d1/0x380 [ 1570.486587][T15564] ? __fget_files+0x34/0x3d0 [ 1570.486617][T15564] ? __pfx_vfs_write+0x10/0x10 [ 1570.486640][T15564] ? find_held_lock+0x2b/0x80 [ 1570.486674][T15564] ? __fget_files+0x215/0x3d0 [ 1570.486710][T15564] ? __fget_files+0x21f/0x3d0 [ 1570.486749][T15564] ksys_write+0x12a/0x250 [ 1570.486774][T15564] ? __pfx_ksys_write+0x10/0x10 [ 1570.486799][T15564] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 1570.486839][T15564] do_syscall_64+0x123/0x790 [ 1570.486867][T15564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1570.486890][T15564] RIP: 0033:0x7f4a8179e159 [ 1570.486909][T15564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1570.486929][T15564] RSP: 002b:00007f4a826b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1570.486951][T15564] RAX: ffffffffffffffda RBX: 00007f4a81a25fa0 RCX: 00007f4a8179e159 [ 1570.486966][T15564] RDX: 000000000000000f RSI: 0000200000000500 RDI: 0000000000000004 [ 1570.486981][T15564] RBP: 00007f4a8183506b R08: 0000000000000000 R09: 0000000000000000 [ 1570.486994][T15564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1570.487008][T15564] R13: 00007f4a81a26038 R14: 00007f4a81a25fa0 R15: 00007ffe32a52718 [ 1570.487042][T15564] [ 1570.831182][T15564] Failed to create system directory s [ 1572.082873][T15579] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1572.405819][T10269] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1573.643647][T14419] udevd[14419]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1573.692318][T10269] usb 4-1: device descriptor read/all, error -71 [ 1575.414219][T15589] misc userio: The device must be registered before sending interrupts [ 1576.556690][T15596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2546'. [ 1576.556990][T15596] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2546'. [ 1576.671829][T15596] bridge30: entered promiscuous mode [ 1576.672008][T15596] bridge30: entered allmulticast mode [ 1577.242962][ T10] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1577.405022][ T10] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1577.407277][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1577.407306][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1577.407331][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1577.409145][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.409169][ T10] usb 3-1: Product: syz [ 1577.409185][ T10] usb 3-1: Manufacturer: syz [ 1577.409200][ T10] usb 3-1: SerialNumber: syz [ 1577.476639][ T10] usb 3-1: config 0 descriptor?? [ 1577.477327][T15593] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1577.477450][T15593] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1577.481386][ T10] usb 3-1: ucan: probing device on interface #0 [ 1577.698964][ T10] usb 3-1: ucan: could not read protocol version, ret=-32 [ 1577.698991][ T10] usb 3-1: ucan: probe failed; try to update the device firmware [ 1577.862886][T15600] genirq: Flags mismatch irq 32. 00200000 (pcmmio) vs. 00200000 (virtio1-output.0) [ 1578.826413][T15612] ip6gretap1: entered allmulticast mode [ 1578.831306][T15612] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1578.831331][T15612] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1578.831360][T15612] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1579.395884][T15618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2551'. [ 1579.396161][T15618] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2551'. [ 1579.529781][T15618] bridge28: entered promiscuous mode [ 1579.531935][T15618] bridge28: entered allmulticast mode [ 1579.928304][ T5809] usb 3-1: USB disconnect, device number 60 [ 1580.192806][ T31] audit: type=1400 audit(1790561812.476:1025): avc: denied { shutdown } for pid=15622 comm="syz.1.2552" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1581.045207][T15637] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2558'. [ 1581.397451][T15647] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1582.828912][T15658] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1583.160186][ T31] audit: type=1400 audit(1790561815.466:1026): avc: denied { getopt } for pid=15633 comm="syz.1.2557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1583.191198][T15634] kAFS: unparsable volume name [ 1584.818702][T15665] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2563'. [ 1584.819155][T15665] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2563'. [ 1585.149587][T15665] bridge29: entered promiscuous mode [ 1585.149623][T15665] bridge29: entered allmulticast mode [ 1585.991138][T15670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2565'. [ 1585.991160][T15670] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2565'. [ 1585.995896][T15670] bridge31: entered promiscuous mode [ 1585.995911][T15670] bridge31: entered allmulticast mode [ 1586.483133][T15674] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1587.311120][T15678] FAULT_INJECTION: forcing a failure. [ 1587.311120][T15678] name failslab, interval 1, probability 0, space 0, times 0 [ 1587.311154][T15678] CPU: 1 UID: 0 PID: 15678 Comm: syz.0.2570 Tainted: G L syzkaller #0 PREEMPT(full) [ 1587.311182][T15678] Tainted: [L]=SOFTLOCKUP [ 1587.311189][T15678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1587.311201][T15678] Call Trace: [ 1587.311209][T15678] [ 1587.311217][T15678] dump_stack_lvl+0x100/0x190 [ 1587.311252][T15678] should_fail_ex.cold+0x5/0xa [ 1587.311281][T15678] should_failslab+0xc2/0x120 [ 1587.311308][T15678] __kmalloc_noprof+0xfc/0x840 [ 1587.311330][T15678] ? rcu_is_watching+0x13/0xc0 [ 1587.311357][T15678] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1587.311392][T15678] tomoyo_realpath_from_path+0xb6/0x690 [ 1587.311425][T15678] tomoyo_path_number_perm+0x23c/0x580 [ 1587.311447][T15678] ? tomoyo_path_number_perm+0x22e/0x580 [ 1587.311473][T15678] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1587.311508][T15678] ? __lock_acquire+0x5c0/0x1f40 [ 1587.311545][T15678] ? __fget_files+0x34/0x3d0 [ 1587.311572][T15678] ? find_held_lock+0x2b/0x80 [ 1587.311600][T15678] ? hook_file_ioctl_common+0x140/0x440 [ 1587.311636][T15678] ? __fget_files+0x21f/0x3d0 [ 1587.311667][T15678] security_file_ioctl+0xd3/0x230 [ 1587.311694][T15678] __x64_sys_ioctl+0xb7/0x210 [ 1587.311726][T15678] do_syscall_64+0x123/0x790 [ 1587.311751][T15678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1587.311772][T15678] RIP: 0033:0x7f0e1419e159 [ 1587.311790][T15678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1587.311809][T15678] RSP: 002b:00007f0e1514f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1587.311829][T15678] RAX: ffffffffffffffda RBX: 00007f0e14425fa0 RCX: 00007f0e1419e159 [ 1587.311843][T15678] RDX: 00002000000000c0 RSI: 00000000c020aa07 RDI: 0000000000000003 [ 1587.311856][T15678] RBP: 00007f0e1514f090 R08: 0000000000000000 R09: 0000000000000000 [ 1587.311868][T15678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1587.311881][T15678] R13: 00007f0e14426038 R14: 00007f0e14425fa0 R15: 00007ffe6aaa48c8 [ 1587.311911][T15678] [ 1587.311919][T15678] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1587.403200][T15676] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2568'. [ 1588.242603][T15688] FAULT_INJECTION: forcing a failure. [ 1588.242603][T15688] name failslab, interval 1, probability 0, space 0, times 0 [ 1588.242639][T15688] CPU: 1 UID: 0 PID: 15688 Comm: syz.0.2572 Tainted: G L syzkaller #0 PREEMPT(full) [ 1588.242668][T15688] Tainted: [L]=SOFTLOCKUP [ 1588.242674][T15688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1588.242686][T15688] Call Trace: [ 1588.242693][T15688] [ 1588.242701][T15688] dump_stack_lvl+0x100/0x190 [ 1588.242737][T15688] should_fail_ex.cold+0x5/0xa [ 1588.242761][T15688] ? lock_acquire+0x1d1/0x380 [ 1588.242786][T15688] should_failslab+0xc2/0x120 [ 1588.242819][T15688] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 1588.242844][T15688] ? zswap_store+0xc6d/0x2e70 [ 1588.242869][T15688] zswap_store+0xc6d/0x2e70 [ 1588.242902][T15688] ? __pfx_zswap_store+0x10/0x10 [ 1588.242923][T15688] ? lock_acquire+0x1d1/0x380 [ 1588.242946][T15688] ? do_raw_spin_lock+0x128/0x260 [ 1588.242972][T15688] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1588.242998][T15688] ? find_held_lock+0x2b/0x80 [ 1588.243025][T15688] ? swap_writeout+0xdd8/0x1b20 [ 1588.243044][T15688] ? swap_writeout+0xdd8/0x1b20 [ 1588.243071][T15688] swap_writeout+0xde0/0x1b20 [ 1588.243100][T15688] shrink_folio_list+0x4ffb/0x5e40 [ 1588.243143][T15688] ? __pfx_shrink_folio_list+0x10/0x10 [ 1588.243175][T15688] ? unwind_next_frame+0xbd/0x2090 [ 1588.243206][T15688] ? lock_acquire+0x1d1/0x380 [ 1588.243228][T15688] ? unwind_next_frame+0xbd/0x2090 [ 1588.243256][T15688] ? find_held_lock+0x2b/0x80 [ 1588.243283][T15688] ? unwind_next_frame+0x3be/0x2090 [ 1588.243309][T15688] ? unwind_next_frame+0x3be/0x2090 [ 1588.243361][T15688] ? __lock_acquire+0x5c0/0x1f40 [ 1588.243383][T15688] ? __css_rstat_updated+0x1ce/0x590 [ 1588.243412][T15688] ? __pfx___css_rstat_updated+0x10/0x10 [ 1588.243441][T15688] reclaim_folio_list+0xe9/0x5e0 [ 1588.243472][T15688] ? __pfx_reclaim_folio_list+0x10/0x10 [ 1588.243498][T15688] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 1588.243535][T15688] ? lru_gen_update_size+0x431/0xe20 [ 1588.243568][T15688] ? lru_gen_del_folio+0x382/0x5f0 [ 1588.243596][T15688] reclaim_pages+0x428/0x5e0 [ 1588.243626][T15688] ? __pfx_reclaim_pages+0x10/0x10 [ 1588.243652][T15688] ? find_held_lock+0x2b/0x80 [ 1588.243680][T15688] ? madvise_cold_or_pageout_pte_range+0xb8e/0x27b0 [ 1588.243715][T15688] madvise_cold_or_pageout_pte_range+0x15b5/0x27b0 [ 1588.243755][T15688] ? rcu_read_unlock+0x17/0x60 [ 1588.243775][T15688] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 1588.243811][T15688] ? __mod_zone_page_state+0xdb/0x190 [ 1588.243849][T15688] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 1588.243880][T15688] walk_pgd_range+0xbef/0x1e00 [ 1588.243911][T15688] ? find_held_lock+0x2b/0x80 [ 1588.243951][T15688] ? __pfx_walk_pgd_range+0x10/0x10 [ 1588.243976][T15688] ? __pfx_folio_batch_move_lru+0x10/0x10 [ 1588.244010][T15688] __walk_page_range+0x171/0x850 [ 1588.244047][T15688] walk_page_range_vma_unsafe+0x209/0x8f0 [ 1588.244075][T15688] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 1588.244104][T15688] ? find_held_lock+0x2b/0x80 [ 1588.244131][T15688] ? mlock_drain_local+0x254/0x4e0 [ 1588.244150][T15688] ? mlock_drain_local+0x254/0x4e0 [ 1588.244176][T15688] walk_page_range_vma+0x63/0x90 [ 1588.244201][T15688] madvise_pageout+0x29e/0x5b0 [ 1588.244230][T15688] ? __pfx_madvise_pageout+0x10/0x10 [ 1588.244280][T15688] madvise_vma_behavior+0x48b/0x2350 [ 1588.244310][T15688] ? mas_prev+0xa4/0x100 [ 1588.244334][T15688] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 1588.244364][T15688] ? mas_walk+0x260/0x310 [ 1588.244384][T15688] ? find_vma_prev+0xd8/0x150 [ 1588.244410][T15688] ? __pfx_find_vma_prev+0x10/0x10 [ 1588.244442][T15688] ? __pfx__kstrtoull+0x10/0x10 [ 1588.244472][T15688] ? lock_acquire+0x1d1/0x380 [ 1588.244498][T15688] madvise_walk_vmas+0x30e/0xc50 [ 1588.244532][T15688] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 1588.244570][T15688] ? lock_acquire+0x1d1/0x380 [ 1588.244591][T15688] madvise_do_behavior+0x1ea/0x510 [ 1588.244620][T15688] ? __pfx_madvise_do_behavior+0x10/0x10 [ 1588.244649][T15688] ? down_read+0x13b/0x4c0 [ 1588.244685][T15688] do_madvise+0x238/0x290 [ 1588.244712][T15688] ? __pfx_do_madvise+0x10/0x10 [ 1588.244747][T15688] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1588.244781][T15688] ? ksys_write+0x1ac/0x250 [ 1588.244810][T15688] ? __pfx_ksys_write+0x10/0x10 [ 1588.244838][T15688] __x64_sys_madvise+0xa9/0x110 [ 1588.244865][T15688] ? lockdep_hardirqs_on+0x7d/0x110 [ 1588.244886][T15688] do_syscall_64+0x123/0x790 [ 1588.244910][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.244931][T15688] RIP: 0033:0x7f0e1419e159 [ 1588.244948][T15688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1588.244966][T15688] RSP: 002b:00007f0e1514f028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 1588.244986][T15688] RAX: ffffffffffffffda RBX: 00007f0e14425fa0 RCX: 00007f0e1419e159 [ 1588.245000][T15688] RDX: 0000000000000015 RSI: 000000000040001e RDI: 0000200000000000 [ 1588.245013][T15688] RBP: 00007f0e1514f090 R08: 0000000000000000 R09: 0000000000000000 [ 1588.245024][T15688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1588.245037][T15688] R13: 00007f0e14426038 R14: 00007f0e14425fa0 R15: 00007ffe6aaa48c8 [ 1588.245067][T15688] [ 1588.669606][T15691] capability: warning: `syz.2.2573' uses 32-bit capabilities (legacy support in use) [ 1588.958192][T15696] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1590.962036][T15712] hub 8-0:1.0: USB hub found [ 1590.962594][T15712] hub 8-0:1.0: 1 port detected [ 1593.815374][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2579'. [ 1593.815409][T15719] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2579'. [ 1594.336540][ T1278] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1594.364403][T15719] bridge30: entered promiscuous mode [ 1594.364418][T15719] bridge30: entered allmulticast mode [ 1594.576176][ T1278] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1594.764019][ T1278] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1594.959528][ T1278] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.348203][T15731] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1596.605345][T12507] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1596.610264][T12507] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1596.612450][T12507] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1596.638907][T12507] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1596.640114][T12507] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1596.756849][ T1278] bridge_slave_1: left allmulticast mode [ 1596.756891][ T1278] bridge_slave_1: left promiscuous mode [ 1596.758026][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1596.791537][ T1278] bridge_slave_0: left allmulticast mode [ 1596.791563][ T1278] bridge_slave_0: left promiscuous mode [ 1596.791815][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1597.214512][T15741] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1598.765272][T12507] Bluetooth: hci1: command tx timeout [ 1599.082851][T15751] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1599.756925][T15757] FAULT_INJECTION: forcing a failure. [ 1599.756925][T15757] name failslab, interval 1, probability 0, space 0, times 0 [ 1599.756947][T15757] CPU: 0 UID: 0 PID: 15757 Comm: syz.0.2590 Tainted: G L syzkaller #0 PREEMPT(full) [ 1599.756964][T15757] Tainted: [L]=SOFTLOCKUP [ 1599.756969][T15757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1599.756976][T15757] Call Trace: [ 1599.756980][T15757] [ 1599.756986][T15757] dump_stack_lvl+0x100/0x190 [ 1599.757007][T15757] should_fail_ex.cold+0x5/0xa [ 1599.757026][T15757] should_failslab+0xc2/0x120 [ 1599.757044][T15757] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1599.757059][T15757] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1599.757072][T15757] ? __ksm_enter+0x3c/0x630 [ 1599.757089][T15757] __ksm_enter+0x3c/0x630 [ 1599.757105][T15757] ksm_enable_merge_any+0xbf/0x120 [ 1599.757120][T15757] __do_sys_prctl+0x1086/0x2270 [ 1599.757139][T15757] ? __pfx___do_sys_prctl+0x10/0x10 [ 1599.757162][T15757] do_syscall_64+0x123/0x790 [ 1599.757176][T15757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.757188][T15757] RIP: 0033:0x7f0e1419e159 [ 1599.757199][T15757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1599.757213][T15757] RSP: 002b:00007f0e1514f028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 1599.757225][T15757] RAX: ffffffffffffffda RBX: 00007f0e14425fa0 RCX: 00007f0e1419e159 [ 1599.757233][T15757] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000043 [ 1599.757240][T15757] RBP: 00007f0e1514f090 R08: 0000000000000000 R09: 0000000000000000 [ 1599.757247][T15757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1599.757254][T15757] R13: 00007f0e14426038 R14: 00007f0e14425fa0 R15: 00007ffe6aaa48c8 [ 1599.757270][T15757] [ 1599.926412][T15762] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1600.849759][T12507] Bluetooth: hci1: command tx timeout [ 1602.171677][ T1254] ieee802154 phy0 wpan0: encryption failed: -22 [ 1602.171714][ T1254] ieee802154 phy1 wpan1: encryption failed: -22 [ 1603.341217][T15779] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2594'. [ 1603.341498][T15779] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2594'. [ 1603.647676][T12507] Bluetooth: hci1: command tx timeout [ 1603.923049][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1603.928474][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1603.929544][ T1278] bond0 (unregistering): Released all slaves [ 1603.985263][T15779] bridge26: entered promiscuous mode [ 1603.985279][T15779] bridge26: entered allmulticast mode [ 1604.226655][ T1278] IPVS: stopping backup sync thread 6578 ... [ 1604.738664][T15786] misc userio: The device must be registered before sending interrupts [ 1605.732836][T12507] Bluetooth: hci1: command tx timeout [ 1606.937692][T15809] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1607.025362][ T31] audit: type=1400 audit(1790561839.336:1027): avc: denied { write } for pid=15782 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1607.907278][ T31] audit: type=1400 audit(1790561840.216:1028): avc: denied { write } for pid=15814 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1607.954711][T15817] FAULT_INJECTION: forcing a failure. [ 1607.954711][T15817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1607.954752][T15817] CPU: 0 UID: 0 PID: 15817 Comm: syz.4.2595 Tainted: G L syzkaller #0 PREEMPT(full) [ 1607.954781][T15817] Tainted: [L]=SOFTLOCKUP [ 1607.954789][T15817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1607.954801][T15817] Call Trace: [ 1607.954809][T15817] [ 1607.954818][T15817] dump_stack_lvl+0x100/0x190 [ 1607.954856][T15817] should_fail_ex.cold+0x5/0xa [ 1607.954886][T15817] _copy_to_user+0x32/0xd0 [ 1607.954914][T15817] simple_read_from_buffer+0xcb/0x170 [ 1607.954951][T15817] proc_fail_nth_read+0x1af/0x230 [ 1607.954981][T15817] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1607.955010][T15817] ? rw_verify_area+0xce/0x6d0 [ 1607.955031][T15817] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1607.955057][T15817] vfs_read+0x1e4/0xb40 [ 1607.955080][T15817] ? lock_acquire+0x1d1/0x380 [ 1607.955103][T15817] ? __fget_files+0x34/0x3d0 [ 1607.955129][T15817] ? __pfx_vfs_read+0x10/0x10 [ 1607.955149][T15817] ? find_held_lock+0x2b/0x80 [ 1607.955178][T15817] ? __fget_files+0x215/0x3d0 [ 1607.955209][T15817] ? __fget_files+0x21f/0x3d0 [ 1607.955244][T15817] ksys_read+0x12a/0x250 [ 1607.955266][T15817] ? __pfx_ksys_read+0x10/0x10 [ 1607.955297][T15817] do_syscall_64+0x123/0x790 [ 1607.955322][T15817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1607.955343][T15817] RIP: 0033:0x7fde20d5e98e [ 1607.955361][T15817] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1607.955380][T15817] RSP: 002b:00007fde21b9bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1607.955401][T15817] RAX: ffffffffffffffda RBX: 00007fde21b9c6c0 RCX: 00007fde20d5e98e [ 1607.955414][T15817] RDX: 000000000000000f RSI: 00007fde21b9c0a0 RDI: 0000000000000007 [ 1607.955427][T15817] RBP: 00007fde21b9c090 R08: 0000000000000000 R09: 0000000000000000 [ 1607.955438][T15817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1607.955450][T15817] R13: 00007fde21026128 R14: 00007fde21026090 R15: 00007ffefb71a148 [ 1607.955480][T15817] [ 1608.627334][T15819] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2601'. [ 1608.627659][T15819] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2601'. [ 1609.185085][T15819] bridge33: entered promiscuous mode [ 1609.185100][T15819] bridge33: entered allmulticast mode [ 1609.188047][ T5269] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1609.213883][ T31] audit: type=1400 audit(1790561841.516:1029): avc: denied { unmount } for pid=5604 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 1609.386367][ T1278] hsr_slave_0: left promiscuous mode [ 1609.405914][ T1278] hsr_slave_1: left promiscuous mode [ 1609.406753][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1609.406790][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1609.425538][T15824] FAULT_INJECTION: forcing a failure. [ 1609.425538][T15824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1609.425569][T15824] CPU: 1 UID: 0 PID: 15824 Comm: syz.4.2602 Tainted: G L syzkaller #0 PREEMPT(full) [ 1609.425598][T15824] Tainted: [L]=SOFTLOCKUP [ 1609.425605][T15824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1609.425617][T15824] Call Trace: [ 1609.425624][T15824] [ 1609.425631][T15824] dump_stack_lvl+0x100/0x190 [ 1609.425664][T15824] should_fail_ex.cold+0x5/0xa [ 1609.425691][T15824] copy_fpstate_to_sigframe+0x82d/0xae0 [ 1609.425720][T15824] ? do_raw_spin_lock+0x128/0x260 [ 1609.425750][T15824] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1609.425784][T15824] ? posixtimer_deliver_signal+0x1a0/0x6e0 [ 1609.425813][T15824] ? x86_task_fpu+0x5f/0x90 [ 1609.425841][T15824] get_sigframe+0x3fb/0x940 [ 1609.425874][T15824] ? __pfx_get_sigframe+0x10/0x10 [ 1609.425899][T15824] ? rcu_is_watching+0x13/0xc0 [ 1609.425927][T15824] ? siginfo_layout+0x156/0x290 [ 1609.425952][T15824] x64_setup_rt_frame+0x12f/0xce0 [ 1609.425985][T15824] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1609.426020][T15824] arch_do_signal_or_restart+0x5ee/0x7e0 [ 1609.426048][T15824] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1609.426081][T15824] ? fput+0x7c/0x100 [ 1609.426111][T15824] exit_to_user_mode_loop+0x139/0x700 [ 1609.426141][T15824] ? rcu_is_watching+0x13/0xc0 [ 1609.426169][T15824] do_syscall_64+0x661/0x790 [ 1609.426193][T15824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1609.426212][T15824] RIP: 0033:0x7fde20d5e98e [ 1609.426227][T15824] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1609.426245][T15824] RSP: 002b:00007fde21bbcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1609.426263][T15824] RAX: 0000000000000001 RBX: 00007fde21bbd6c0 RCX: 00007fde20d5e98e [ 1609.426275][T15824] RDX: 0000000000000001 RSI: 00007fde21bbd090 RDI: 0000000000000004 [ 1609.426287][T15824] RBP: 00007fde21bbd090 R08: 0000000000000000 R09: 0000000000000000 [ 1609.426297][T15824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1609.426308][T15824] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1609.426335][T15824] [ 1609.625658][ T1278] veth1_macvtap: left promiscuous mode [ 1609.625719][ T1278] veth0_macvtap: left promiscuous mode [ 1609.625862][ T1278] veth1_vlan: left promiscuous mode [ 1609.625938][ T1278] veth0_vlan: left promiscuous mode [ 1610.138543][ T9] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1610.154339][ T31] audit: type=1400 audit(1790561842.466:1030): avc: denied { write } for pid=15825 comm="syz.4.2604" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 1610.292922][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1610.339272][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1610.339303][ T9] usb 3-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 1610.360358][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1610.360385][ T9] usb 3-1: Product: syz [ 1610.360400][ T9] usb 3-1: Manufacturer: syz [ 1610.360413][ T9] usb 3-1: SerialNumber: syz [ 1610.703597][ T9] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1610.792477][T15834] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2605'. [ 1610.980605][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1611.085501][T15836] vivid-000: disconnect [ 1611.088721][T15836] vivid-000: reconnect [ 1611.456211][ T9] usb 3-1: USB disconnect, device number 61 [ 1611.545074][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1611.721942][T15843] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2606'. [ 1611.789405][T14419] udevd[14419]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1614.590559][ T31] audit: type=1400 audit(1790561846.296:1031): avc: denied { append } for pid=15868 comm="syz.0.2609" name="rtc0" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1615.302872][ T5718] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1615.550540][ T5718] usb 3-1: Using ep0 maxpacket: 32 [ 1615.560930][ T5718] usb 3-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1615.572823][ T5718] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 1615.572849][ T5718] usb 3-1: config 0 has no interface number 0 [ 1615.572886][ T5718] usb 3-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1615.572904][ T5718] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1615.572918][ T5718] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1615.572935][ T5718] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1615.572956][ T5718] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1615.572970][ T5718] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1615.572982][ T5718] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1615.572994][ T5718] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1615.573006][ T5718] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1615.573018][ T5718] usb 3-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1615.591218][ T5718] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.591234][ T5718] usb 3-1: Product: syz [ 1615.591243][ T5718] usb 3-1: Manufacturer: syz [ 1615.591251][ T5718] usb 3-1: SerialNumber: syz [ 1615.735552][ T5718] usb 3-1: config 0 descriptor?? [ 1615.737278][T15886] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1615.740746][ T5718] usb 3-1: will this work? Response EP is not usually 3 [ 1615.740767][ T5718] usb 3-1: will this work? Image data EP is not usually 2 [ 1615.778148][ T1278] IPVS: stop unused estimator thread 0... [ 1615.780847][ T5718] scsi host1: microtekX6 [ 1615.806145][ T1411] usb 3-1: error -90 submitting URB [ 1615.853089][T14448] usb 3-1: error -90 submitting URB [ 1615.912845][T14448] usb 3-1: error -90 submitting URB [ 1615.963449][T14448] usb 3-1: error -90 submitting URB [ 1616.956579][ T31] audit: type=1400 audit(1790561848.766:1032): avc: denied { create } for pid=15899 comm="syz.1.2614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1617.177227][ T31] audit: type=1400 audit(1790561849.486:1033): avc: denied { write } for pid=15877 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1617.342277][T15730] bridge0: port 1(bridge_slave_0) entered blocking state [ 1617.342367][T15730] bridge0: port 1(bridge_slave_0) entered disabled state [ 1617.342508][T15730] bridge_slave_0: entered allmulticast mode [ 1617.349096][T15730] bridge_slave_0: entered promiscuous mode [ 1617.441646][ T9] usb 3-1: USB disconnect, device number 62 [ 1617.446364][T15730] bridge0: port 2(bridge_slave_1) entered blocking state [ 1617.446455][T15730] bridge0: port 2(bridge_slave_1) entered disabled state [ 1617.446591][T15730] bridge_slave_1: entered allmulticast mode [ 1617.453152][T15730] bridge_slave_1: entered promiscuous mode [ 1617.614374][ T31] audit: type=1400 audit(1790561849.916:1034): avc: denied { write } for pid=15912 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1617.666730][T15730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1617.687184][T15730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1618.062563][ T31] audit: type=1400 audit(1790561850.366:1035): avc: denied { ioctl } for pid=15915 comm="syz.0.2610" path="socket:[48491]" dev="sockfs" ino=48491 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1618.405764][T15730] team0: Port device team_slave_0 added [ 1618.430216][T15730] team0: Port device team_slave_1 added [ 1618.479922][ T5269] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1618.546565][T15730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1618.546583][T15730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1618.546607][T15730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1618.549484][T15730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1618.549497][T15730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1618.549520][T15730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1618.921140][T15730] hsr_slave_0: entered promiscuous mode [ 1618.921991][T15730] hsr_slave_1: entered promiscuous mode [ 1618.950161][T15730] debugfs: 'hsr0' already exists in 'hsr' [ 1618.950194][T15730] Cannot create hsr debugfs directory [ 1620.508703][T15946] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 1621.089505][ T31] audit: type=1400 audit(1790561852.816:1036): avc: denied { ioctl } for pid=15943 comm="syz.2.2621" path="/dev/rtc0" dev="devtmpfs" ino=915 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1621.275668][T15939] FAULT_INJECTION: forcing a failure. [ 1621.275668][T15939] name failslab, interval 1, probability 0, space 0, times 0 [ 1621.275762][T15939] CPU: 1 UID: 0 PID: 15939 Comm: syz.1.2616 Tainted: G L syzkaller #0 PREEMPT(full) [ 1621.275793][T15939] Tainted: [L]=SOFTLOCKUP [ 1621.275800][T15939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1621.275813][T15939] Call Trace: [ 1621.275820][T15939] [ 1621.275829][T15939] dump_stack_lvl+0x100/0x190 [ 1621.275863][T15939] should_fail_ex.cold+0x5/0xa [ 1621.275892][T15939] should_failslab+0xc2/0x120 [ 1621.275920][T15939] __kmalloc_noprof+0xfc/0x840 [ 1621.275942][T15939] ? rcu_is_watching+0x13/0xc0 [ 1621.275971][T15939] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1621.276004][T15939] tomoyo_realpath_from_path+0xb6/0x690 [ 1621.276039][T15939] tomoyo_path_number_perm+0x23c/0x580 [ 1621.276062][T15939] ? tomoyo_path_number_perm+0x22e/0x580 [ 1621.276087][T15939] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1621.276129][T15939] ? __lock_acquire+0x5c0/0x1f40 [ 1621.276167][T15939] ? __fget_files+0x34/0x3d0 [ 1621.276198][T15939] ? find_held_lock+0x2b/0x80 [ 1621.276226][T15939] ? hook_file_ioctl_common+0x140/0x440 [ 1621.276261][T15939] ? __fget_files+0x21f/0x3d0 [ 1621.276293][T15939] security_file_ioctl+0xd3/0x230 [ 1621.276320][T15939] __x64_sys_ioctl+0xb7/0x210 [ 1621.276345][T15939] do_syscall_64+0x123/0x790 [ 1621.276369][T15939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1621.276389][T15939] RIP: 0033:0x7f4a8179e159 [ 1621.276406][T15939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1621.276424][T15939] RSP: 002b:00007f4a82697028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1621.276444][T15939] RAX: ffffffffffffffda RBX: 00007f4a81a26090 RCX: 00007f4a8179e159 [ 1621.276458][T15939] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000088 [ 1621.276471][T15939] RBP: 00007f4a82697090 R08: 0000000000000000 R09: 0000000000000000 [ 1621.276483][T15939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1621.276496][T15939] R13: 00007f4a81a26128 R14: 00007f4a81a26090 R15: 00007ffe32a52718 [ 1621.276526][T15939] [ 1621.449449][T15939] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1622.430349][T15957] FAULT_INJECTION: forcing a failure. [ 1622.430349][T15957] name failslab, interval 1, probability 0, space 0, times 0 [ 1622.430382][T15957] CPU: 0 UID: 0 PID: 15957 Comm: syz.4.2624 Tainted: G L syzkaller #0 PREEMPT(full) [ 1622.430410][T15957] Tainted: [L]=SOFTLOCKUP [ 1622.430417][T15957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1622.430429][T15957] Call Trace: [ 1622.430436][T15957] [ 1622.430445][T15957] dump_stack_lvl+0x100/0x190 [ 1622.430478][T15957] should_fail_ex.cold+0x5/0xa [ 1622.430507][T15957] should_failslab+0xc2/0x120 [ 1622.430535][T15957] __kmalloc_noprof+0xfc/0x840 [ 1622.430557][T15957] ? rcu_is_watching+0x13/0xc0 [ 1622.430584][T15957] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1622.430618][T15957] tomoyo_realpath_from_path+0xb6/0x690 [ 1622.430650][T15957] tomoyo_path_number_perm+0x23c/0x580 [ 1622.430672][T15957] ? tomoyo_path_number_perm+0x22e/0x580 [ 1622.430695][T15957] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1622.430730][T15957] ? __lock_acquire+0x5c0/0x1f40 [ 1622.430765][T15957] ? __fget_files+0x34/0x3d0 [ 1622.430790][T15957] ? find_held_lock+0x2b/0x80 [ 1622.430817][T15957] ? hook_file_ioctl_common+0x140/0x440 [ 1622.430851][T15957] ? __fget_files+0x21f/0x3d0 [ 1622.430878][T15957] security_file_ioctl+0xd3/0x230 [ 1622.430903][T15957] __x64_sys_ioctl+0xb7/0x210 [ 1622.430934][T15957] do_syscall_64+0x123/0x790 [ 1622.430956][T15957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1622.430976][T15957] RIP: 0033:0x7fde20d9e159 [ 1622.430993][T15957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1622.431011][T15957] RSP: 002b:00007fde21bbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1622.431031][T15957] RAX: ffffffffffffffda RBX: 00007fde21025fa0 RCX: 00007fde20d9e159 [ 1622.431044][T15957] RDX: 0000200000000100 RSI: 0000000040186f40 RDI: 0000000000000003 [ 1622.431056][T15957] RBP: 00007fde21bbd090 R08: 0000000000000000 R09: 0000000000000000 [ 1622.431068][T15957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1622.431080][T15957] R13: 00007fde21026038 R14: 00007fde21025fa0 R15: 00007ffefb71a148 [ 1622.431110][T15957] [ 1622.432392][T15957] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1622.483676][T15957] ubi0: attaching mtd0 [ 1622.483703][T15957] ubi0 error: ubi_attach_mtd_dev: bad VID header (16) or data offsets (80) [ 1622.563339][T15958] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2623'. [ 1623.144393][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1623.329866][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1623.332059][ T10] usb 2-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1623.351431][ T10] usb 2-1: config 0 has an invalid interface number: 146 but max is 0 [ 1623.351459][ T10] usb 2-1: config 0 has no interface number 0 [ 1623.351493][ T10] usb 2-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1623.351514][ T10] usb 2-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1623.351537][ T10] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1623.351563][ T10] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1623.351593][ T10] usb 2-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1623.351616][ T10] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1623.351637][ T10] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1623.351683][ T10] usb 2-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1623.351705][ T10] usb 2-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1623.351728][ T10] usb 2-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1623.376916][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1623.376952][ T10] usb 2-1: Product: syz [ 1623.376995][ T10] usb 2-1: Manufacturer: syz [ 1623.377039][ T10] usb 2-1: SerialNumber: syz [ 1623.422466][ T10] usb 2-1: config 0 descriptor?? [ 1623.428494][T15963] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1623.445171][ T10] usb 2-1: will this work? Response EP is not usually 3 [ 1623.445194][ T10] usb 2-1: will this work? Image data EP is not usually 2 [ 1623.908124][ T10] scsi host1: microtekX6 [ 1624.162946][ T9] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1624.314183][ T1278] usb 2-1: error -90 submitting URB [ 1624.315476][ T9] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 1624.320574][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1624.320943][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.347652][T14448] usb 2-1: error -90 submitting URB [ 1624.383008][T14448] usb 2-1: error -90 submitting URB [ 1624.422923][T14448] usb 2-1: error -90 submitting URB [ 1625.333367][ T31] audit: type=1400 audit(1790561857.646:1037): avc: denied { write } for pid=15931 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1625.333920][ T9] as10x_usb: device has been detected [ 1625.374744][ T9] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 1625.475749][ T31] audit: type=1400 audit(1790561857.786:1038): avc: denied { write } for pid=15978 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1625.513627][T15975] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1625.603791][ T5718] usb 2-1: USB disconnect, device number 43 [ 1625.980271][ T9] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 1626.517840][ T5269] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1626.538056][T15982] loop0: detected capacity change from 0 to 3904 [ 1626.692651][T15986] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1627.683385][ T9] as10x_usb: error during firmware upload part1 [ 1627.683867][ T9] Registered device Abilis Systems DVB-Titan [ 1627.712842][ T9] usb 5-1: USB disconnect, device number 67 [ 1629.320264][ T9] Unregistered device Abilis Systems DVB-Titan [ 1629.329612][ T9] as10x_usb: device has been disconnected [ 1629.473410][T10269] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1629.623027][T10269] usb 3-1: Using ep0 maxpacket: 32 [ 1629.624964][T10269] usb 3-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1629.629348][T10269] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 1629.629467][T10269] usb 3-1: config 0 has no interface number 0 [ 1629.629647][T10269] usb 3-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1629.629681][T10269] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1629.629712][T10269] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1629.629796][T10269] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1629.629849][T10269] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1629.629880][T10269] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1629.629911][T10269] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1629.629994][T10269] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1629.630072][T10269] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1629.630105][T10269] usb 3-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1629.916361][T10269] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1629.916398][T10269] usb 3-1: Product: syz [ 1629.916440][T10269] usb 3-1: Manufacturer: syz [ 1629.916482][T10269] usb 3-1: SerialNumber: syz [ 1630.038269][T10269] usb 3-1: config 0 descriptor?? [ 1630.078563][T16001] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1630.163205][T10269] usb 3-1: will this work? Response EP is not usually 3 [ 1630.163232][T10269] usb 3-1: will this work? Image data EP is not usually 2 [ 1630.253834][T10269] scsi host1: microtekX6 [ 1630.286406][ T1411] usb 3-1: error -90 submitting URB [ 1630.306467][T16009] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2634'. [ 1630.323524][T14448] usb 3-1: error -90 submitting URB [ 1630.372840][T14448] usb 3-1: error -90 submitting URB [ 1630.412809][T14448] usb 3-1: error -90 submitting URB [ 1630.521960][ T31] audit: type=1400 audit(1790561862.826:1039): avc: denied { write } for pid=15988 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1630.746671][T10520] usb 3-1: USB disconnect, device number 63 [ 1630.917349][ T31] audit: type=1400 audit(1790561863.226:1040): avc: denied { write } for pid=16026 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1631.407834][T15730] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1631.430186][T15730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1631.440887][T15730] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1631.451058][T15730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1631.452299][T15730] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1631.485365][T15730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1631.488012][T15730] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1631.537189][T15730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1631.896651][T16042] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1632.442123][T15730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1633.540963][T15730] 8021q: adding VLAN 0 to HW filter on device team0 [ 1633.680987][T10259] bridge0: port 1(bridge_slave_0) entered blocking state [ 1633.681044][T10259] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1633.749201][T10259] bridge0: port 2(bridge_slave_1) entered blocking state [ 1633.749257][T10259] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1634.034144][T16056] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1635.404205][ T31] audit: type=1400 audit(1790561867.716:1041): avc: denied { write } for pid=16028 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1635.873417][T16077] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1636.624034][ T31] audit: type=1400 audit(1790561868.896:1042): avc: denied { write } for pid=16069 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1637.936079][T16094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2643'. [ 1637.984176][T16094] ima: policy update completed [ 1637.993013][ T31] audit: type=1804 audit(1790561870.296:1043): pid=16094 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_policy cause=store_entry comm="syz.4.2643" name="ima_policy_written" res=0 errno=-17 [ 1637.993153][ T31] audit: type=1807 audit(1790561870.296:1044): action=measure func=FILE_CHECK res=1 [ 1637.993231][ T31] audit: type=1802 audit(1790561870.296:1045): pid=16094 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=completed comm="syz.4.2643" res=1 errno=0 [ 1638.288610][ T4974] [ 1638.290968][ T4974] ====================================================== [ 1638.297981][ T4974] WARNING: possible circular locking dependency detected [ 1638.304996][ T4974] syzkaller #0 Tainted: G L [ 1638.310971][ T4974] ------------------------------------------------------ [ 1638.317980][ T4974] udevd/4974 is trying to acquire lock: [ 1638.323518][ T4974] ffff8880349c0f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 1638.331968][ T4974] [ 1638.331968][ T4974] but task is already holding lock: [ 1638.339325][ T4974] ffff888071867798 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 1638.349951][ T4974] [ 1638.349951][ T4974] which lock already depends on the new lock. [ 1638.349951][ T4974] [ 1638.360353][ T4974] [ 1638.360353][ T4974] the existing dependency chain (in reverse order) is: [ 1638.369369][ T4974] [ 1638.369369][ T4974] -> #4 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 1638.377987][ T4974] lock_acquire+0x1d1/0x380 [ 1638.383021][ T4974] __mutex_lock+0x1a4/0x1bd0 [ 1638.388140][ T4974] process_measurement+0x5ab/0x2350 [ 1638.393874][ T4974] ima_file_check+0xc3/0x110 [ 1638.397792][T15730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1638.405724][ T4974] security_file_post_open+0xc4/0x210 [ 1638.411627][ T4974] path_openat+0x5cd/0x2440 [ 1638.416657][ T4974] do_file_open+0x20e/0x430 [ 1638.421684][ T4974] file_open_name+0x1c3/0x3e0 [ 1638.426892][ T4974] filp_open+0x2e/0x50 [ 1638.431491][ T4974] kernel_read_file_from_path_initns+0xec/0x240 [ 1638.438252][ T4974] _request_firmware+0x733/0x13c0 [ 1638.440428][T15730] veth0_vlan: entered promiscuous mode [ 1638.449237][ T4974] request_firmware+0x35/0x50 [ 1638.453779][T15730] veth1_vlan: entered promiscuous mode [ 1638.459865][ T4974] reg_reload_regdb+0x85/0x460 [ 1638.465156][ T4974] genl_family_rcv_msg_doit+0x214/0x300 [ 1638.471233][ T4974] genl_rcv_msg+0x560/0x800 [ 1638.476264][ T4974] netlink_rcv_skb+0x159/0x420 [ 1638.479648][T15730] veth0_macvtap: entered promiscuous mode [ 1638.483514][T15730] veth1_macvtap: entered promiscuous mode [ 1638.492938][ T4974] genl_rcv+0x28/0x40 [ 1638.497444][ T4974] netlink_unicast+0x585/0x850 [ 1638.502729][ T4974] netlink_sendmsg+0x8b0/0xda0 [ 1638.508003][ T4974] ____sys_sendmsg+0xa4d/0xbe0 [ 1638.513269][ T4974] ___sys_sendmsg+0x190/0x1e0 [ 1638.518445][ T4974] __sys_sendmsg+0x160/0x210 [ 1638.523540][ T4974] do_syscall_64+0x123/0x790 [ 1638.528632][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1638.535031][ T4974] [ 1638.535031][ T4974] -> #3 (cb_lock){++++}-{4:4}: [ 1638.541962][ T4974] lock_acquire+0x1d1/0x380 [ 1638.546971][ T4974] down_read+0x99/0x4c0 [ 1638.551632][ T4974] genl_release+0x7e/0x1d0 [ 1638.556553][ T4974] netlink_release+0x105e/0x2000 [ 1638.561994][ T4974] __sock_release+0xb3/0x260 [ 1638.567092][ T4974] sock_close+0x1c/0x30 [ 1638.571751][ T4974] __fput+0x3ff/0xb50 [ 1638.576241][ T4974] fput_close_sync+0x118/0x250 [ 1638.581513][ T4974] __x64_sys_close+0x8b/0x120 [ 1638.586688][ T4974] do_syscall_64+0x123/0x790 [ 1638.591780][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1638.598172][ T4974] [ 1638.598172][ T4974] -> #2 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}: [ 1638.606843][ T4974] lock_acquire+0x1d1/0x380 [ 1638.611849][ T4974] down_write+0x8b/0x1f0 [ 1638.616596][ T4974] __sock_release+0x86/0x260 [ 1638.621696][ T4974] sock_close+0x1c/0x30 [ 1638.626355][ T4974] __fput+0x3ff/0xb50 [ 1638.630845][ T4974] __fput_sync+0xd7/0x100 [ 1638.635684][ T4974] nvme_tcp_alloc_queue.isra.0+0xd6d/0x1770 [ 1638.642090][ T4974] nvme_tcp_configure_admin_queue+0x26/0x530 [ 1638.648576][ T4974] nvme_tcp_setup_ctrl+0xa4/0xa20 [ 1638.654110][ T4974] nvme_tcp_create_ctrl+0x970/0xd90 [ 1638.659818][ T4974] nvmf_dev_write+0x4ee/0xb60 [ 1638.665004][ T4974] vfs_write+0x2aa/0x1050 [ 1638.669836][ T4974] ksys_write+0x12a/0x250 [ 1638.674666][ T4974] do_syscall_64+0x123/0x790 [ 1638.679760][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1638.686154][ T4974] [ 1638.686154][ T4974] -> #1 (nvmf_dev_mutex){+.+.}-{4:4}: [ 1638.693688][ T4974] lock_acquire+0x1d1/0x380 [ 1638.698703][ T4974] __mutex_lock+0x1a4/0x1bd0 [ 1638.703815][ T4974] nvmf_dev_show+0x26/0x210 [ 1638.708836][ T4974] seq_read_iter+0x32f/0x1270 [ 1638.714025][ T4974] seq_read+0x344/0x4d0 [ 1638.718691][ T4974] vfs_read+0x1e4/0xb40 [ 1638.723350][ T4974] ksys_read+0x12a/0x250 [ 1638.728096][ T4974] do_syscall_64+0x123/0x790 [ 1638.733190][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1638.739592][ T4974] [ 1638.739592][ T4974] -> #0 (&p->lock){+.+.}-{4:4}: [ 1638.746608][ T4974] check_prev_add+0xeb/0xe60 [ 1638.751702][ T4974] __lock_acquire+0x1528/0x1f40 [ 1638.757081][ T4974] lock_acquire+0x1d1/0x380 [ 1638.762088][ T4974] __mutex_lock+0x1a4/0x1bd0 [ 1638.767180][ T4974] seq_read_iter+0xe1/0x1270 [ 1638.772276][ T4974] kernfs_fop_read_iter+0x46c/0x610 [ 1638.777976][ T4974] __kernel_read+0x397/0xad0 [ 1638.783069][ T4974] integrity_kernel_read+0x7e/0xb0 [ 1638.788693][ T4974] ima_calc_file_hash_tfm+0x25e/0x350 [ 1638.794570][ T4974] ima_calc_file_hash+0x1e3/0x380 [ 1638.800099][ T4974] ima_collect_measurement+0x94f/0xb30 [ 1638.806063][ T4974] process_measurement+0xdfe/0x2350 [ 1638.811765][ T4974] ima_file_check+0xc3/0x110 [ 1638.816858][ T4974] security_file_post_open+0xc4/0x210 [ 1638.822742][ T4974] path_openat+0x5cd/0x2440 [ 1638.827760][ T4974] do_file_open+0x20e/0x430 [ 1638.832791][ T4974] do_sys_openat2+0x10f/0x1e0 [ 1638.837991][ T4974] __x64_sys_openat+0x12d/0x210 [ 1638.843356][ T4974] do_syscall_64+0x123/0x790 [ 1638.848459][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1638.854857][ T4974] [ 1638.854857][ T4974] other info that might help us debug this: [ 1638.854857][ T4974] [ 1638.865064][ T4974] Chain exists of: [ 1638.865064][ T4974] &p->lock --> cb_lock --> &ima_iint_mutex_key[depth] [ 1638.865064][ T4974] [ 1638.877732][ T4974] Possible unsafe locking scenario: [ 1638.877732][ T4974] [ 1638.885158][ T4974] CPU0 CPU1 [ 1638.890500][ T4974] ---- ---- [ 1638.895841][ T4974] lock(&ima_iint_mutex_key[depth]); [ 1638.901219][ T4974] lock(cb_lock); [ 1638.907436][ T4974] lock(&ima_iint_mutex_key[depth]); [ 1638.915306][ T4974] lock(&p->lock); [ 1638.919095][ T4974] [ 1638.919095][ T4974] *** DEADLOCK *** [ 1638.919095][ T4974] [ 1638.927215][ T4974] locks held by udevd/4974: 1, last CPU#1: [ 1638.932997][ T4974] #0: ffff888071867798 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 1638.944029][ T4974] [ 1638.944029][ T4974] stack backtrace: [ 1638.949902][ T4974] CPU: 1 UID: 0 PID: 4974 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) [ 1638.960300][ T4974] Tainted: [L]=SOFTLOCKUP [ 1638.964603][ T4974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1638.974638][ T4974] Call Trace: [ 1638.977899][ T4974] [ 1638.980811][ T4974] dump_stack_lvl+0x100/0x190 [ 1638.985479][ T4974] print_circular_bug.cold+0x178/0x1be [ 1638.990929][ T4974] check_noncircular+0x146/0x160 [ 1638.995852][ T4974] check_prev_add+0xeb/0xe60 [ 1639.000429][ T4974] __lock_acquire+0x1528/0x1f40 [ 1639.005267][ T4974] ? unwind_next_frame+0xbd/0x2090 [ 1639.010375][ T4974] lock_acquire+0x1d1/0x380 [ 1639.014862][ T4974] ? seq_read_iter+0xe1/0x1270 [ 1639.019613][ T4974] ? __pfx___might_resched+0x10/0x10 [ 1639.024880][ T4974] ? is_bpf_text_address+0x8a/0x1a0 [ 1639.030071][ T4974] ? is_bpf_text_address+0x8a/0x1a0 [ 1639.035256][ T4974] __mutex_lock+0x1a4/0x1bd0 [ 1639.039832][ T4974] ? seq_read_iter+0xe1/0x1270 [ 1639.044584][ T4974] ? seq_read_iter+0xe1/0x1270 [ 1639.049337][ T4974] ? kernel_text_address+0x8d/0x100 [ 1639.054531][ T4974] ? __kernel_text_address+0xd/0x30 [ 1639.059710][ T4974] ? unwind_get_return_address+0x59/0xa0 [ 1639.065330][ T4974] ? __pfx___mutex_lock+0x10/0x10 [ 1639.070344][ T4974] ? stack_trace_save+0x8e/0xc0 [ 1639.075183][ T4974] ? __pfx_stack_trace_save+0x10/0x10 [ 1639.080537][ T4974] ? seq_read_iter+0xe1/0x1270 [ 1639.085283][ T4974] seq_read_iter+0xe1/0x1270 [ 1639.089857][ T4974] ? kasan_save_stack+0x30/0x50 [ 1639.094693][ T4974] ? kasan_save_track+0x14/0x30 [ 1639.099529][ T4974] ? __kasan_kmalloc+0xaa/0xb0 [ 1639.104276][ T4974] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1639.109827][ T4974] ? ima_calc_file_hash_tfm+0x236/0x350 [ 1639.115363][ T4974] ? ima_collect_measurement+0x94f/0xb30 [ 1639.120984][ T4974] ? ima_file_check+0xc3/0x110 [ 1639.125731][ T4974] ? security_file_post_open+0xc4/0x210 [ 1639.131261][ T4974] ? do_file_open+0x20e/0x430 [ 1639.135923][ T4974] ? do_sys_openat2+0x10f/0x1e0 [ 1639.140764][ T4974] kernfs_fop_read_iter+0x46c/0x610 [ 1639.145957][ T4974] __kernel_read+0x397/0xad0 [ 1639.150533][ T4974] ? __pfx___kernel_read+0x10/0x10 [ 1639.155632][ T4974] integrity_kernel_read+0x7e/0xb0 [ 1639.160733][ T4974] ? __pfx_integrity_kernel_read+0x10/0x10 [ 1639.166527][ T4974] ? ima_calc_file_hash_tfm+0x236/0x350 [ 1639.172062][ T4974] ima_calc_file_hash_tfm+0x25e/0x350 [ 1639.177421][ T4974] ? __pfx_ima_calc_file_hash_tfm+0x10/0x10 [ 1639.183312][ T4974] ? ima_alloc_tfm+0x21a/0x2e0 [ 1639.188062][ T4974] ? kernfs_iop_getattr+0xc4/0xf0 [ 1639.193076][ T4974] ima_calc_file_hash+0x1e3/0x380 [ 1639.198090][ T4974] ima_collect_measurement+0x94f/0xb30 [ 1639.203537][ T4974] ? __pfx_ima_collect_measurement+0x10/0x10 [ 1639.209513][ T4974] ? vfs_getxattr_alloc+0xec/0x350 [ 1639.214616][ T4974] ? ima_get_hash_algo+0x241/0x400 [ 1639.219710][ T4974] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 1639.225151][ T4974] ? process_measurement+0xdfe/0x2350 [ 1639.230505][ T4974] process_measurement+0xdfe/0x2350 [ 1639.235690][ T4974] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 1639.241392][ T4974] ? __pfx_process_measurement+0x10/0x10 [ 1639.247013][ T4974] ? irqentry_exit+0x24d/0xa10 [ 1639.251764][ T4974] ? lockdep_hardirqs_on+0x7d/0x110 [ 1639.256950][ T4974] ? kernfs_put_active+0x93/0xe0 [ 1639.261870][ T4974] ? kernfs_fop_open+0x3da/0xd50 [ 1639.266793][ T4974] ima_file_check+0xc3/0x110 [ 1639.271373][ T4974] ? __pfx_ima_file_check+0x10/0x10 [ 1639.276556][ T4974] security_file_post_open+0xc4/0x210 [ 1639.281914][ T4974] path_openat+0x5cd/0x2440 [ 1639.286408][ T4974] ? __pfx_path_openat+0x10/0x10 [ 1639.291337][ T4974] do_file_open+0x20e/0x430 [ 1639.295827][ T4974] ? __pfx_do_file_open+0x10/0x10 [ 1639.300847][ T4974] ? _raw_spin_unlock+0x28/0x50 [ 1639.305687][ T4974] ? alloc_fd+0x471/0x7a0 [ 1639.310005][ T4974] do_sys_openat2+0x10f/0x1e0 [ 1639.314669][ T4974] ? __pfx_do_sys_openat2+0x10/0x10 [ 1639.319858][ T4974] __x64_sys_openat+0x12d/0x210 [ 1639.324698][ T4974] ? __pfx___x64_sys_openat+0x10/0x10 [ 1639.330072][ T4974] do_syscall_64+0x123/0x790 [ 1639.334661][ T4974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1639.340549][ T4974] RIP: 0033:0x7f74ad6a7407 [ 1639.344957][ T4974] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1639.364554][ T4974] RSP: 002b:00007fff22564e10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1639.372953][ T4974] RAX: ffffffffffffffda RBX: 00007f74add9b880 RCX: 00007f74ad6a7407 [ 1639.380904][ T4974] RDX: 0000000000080000 RSI: 00007fff22564f90 RDI: ffffffffffffff9c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1639.388856][ T4974] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 1639.396809][ T4974] R10: 0000000000000000 R11: 0000000000000202 R12: 000055584e9997f5 [ 1639.404761][ T4974] R13: 000055584e9997f5 R14: 0000000000000001 R15: 00007fff225695e0 [ 1639.412726][ T4974] [ 1639.452763][ T31] audit: type=1800 audit(1790561871.756:1046): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15008 res=0 errno=0 [ 1639.488250][ T31] audit: type=1800 audit(1790561871.796:1047): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15008 res=0 errno=0 [ 1639.489778][T15730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1639.546100][ T31] audit: type=1400 audit(1790561871.856:1048): avc: denied { write } for pid=16084 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1639.665720][ T31] audit: type=1800 audit(1790561871.976:1049): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31146 res=0 errno=0 [ 1639.669397][ T31] audit: type=1800 audit(1790561871.976:1050): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=31169 res=0 errno=0 [ 1639.745353][ T31] audit: type=1400 audit(1790561872.056:1051): avc: denied { write } for pid=16108 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1640.593094][ T1278] bridge_slave_1: left allmulticast mode [ 1640.593116][ T1278] bridge_slave_1: left promiscuous mode [ 1640.593236][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1640.594223][ T1278] bridge_slave_0: left allmulticast mode [ 1640.594241][ T1278] bridge_slave_0: left promiscuous mode [ 1640.594351][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1640.849418][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1640.850178][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1640.850627][ T1278] bond0 (unregistering): Released all slaves [ 1640.896709][ T5269] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1641.071391][ T1278] hsr_slave_0: left promiscuous mode [ 1641.071742][ T1278] hsr_slave_1: left promiscuous mode [ 1641.072145][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1641.072501][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1641.166270][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1641.168547][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1641.224280][ T5269] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1641.328548][ T1278] IPVS: stop unused estimator thread 0... [ 1641.381016][ T1278] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.405624][ T1278] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.438161][ T1278] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.472580][ T5269] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1641.496640][ T1278] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.634940][ T31] kauditd_printk_skb: 46 callbacks suppressed [ 1641.634958][ T31] audit: type=1800 audit(1790561873.946:1098): pid=14280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="iflink" dev="sysfs" ino=191943 res=0 errno=0 [ 1641.648980][ T31] audit: type=1800 audit(1790561873.956:1099): pid=14280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="addr_assign_type" dev="sysfs" ino=191946 res=0 errno=0 [ 1641.702693][ T31] audit: type=1400 audit(1790561874.006:1100): avc: denied { write } for pid=16167 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1641.767924][ T31] audit: type=1400 audit(1790561874.076:1101): avc: denied { write } for pid=16178 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1641.816317][ T5269] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1641.870093][ T31] audit: type=1800 audit(1790561874.176:1102): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=192022 res=0 errno=0 [ 1641.870618][ T31] audit: type=1800 audit(1790561874.176:1103): pid=14419 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="type" dev="sysfs" ino=192027 res=0 errno=0 [ 1641.883440][ T31] audit: type=1800 audit(1790561874.186:1104): pid=14419 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="ifindex" dev="sysfs" ino=192031 res=0 errno=0 [ 1641.883478][ T31] audit: type=1800 audit(1790561874.186:1105): pid=14419 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="iflink" dev="sysfs" ino=192030 res=0 errno=0 [ 1641.883508][ T31] audit: type=1800 audit(1790561874.186:1106): pid=14419 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="addr_assign_type" dev="sysfs" ino=192033 res=0 errno=0 [ 1641.883538][ T31] audit: type=1800 audit(1790561874.186:1107): pid=4974 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=192108 res=0 errno=0 [ 1642.018031][ T1278] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1642.060594][ T1278] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1642.130235][ T1278] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1642.132233][ T5269] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1642.174266][ T1278] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1642.395403][ T1278] bridge_slave_1: left allmulticast mode [ 1642.395427][ T1278] bridge_slave_1: left promiscuous mode [ 1642.395544][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1642.398828][ T1278] bridge_slave_0: left allmulticast mode [ 1642.398849][ T1278] bridge_slave_0: left promiscuous mode [ 1642.398956][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.442224][ T1278] bridge_slave_1: left allmulticast mode [ 1642.442247][ T1278] bridge_slave_1: left promiscuous mode [ 1642.442366][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1642.462235][ T1278] bridge_slave_0: left allmulticast mode [ 1642.462256][ T1278] bridge_slave_0: left promiscuous mode [ 1642.462370][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.518255][ T1278] pim6reg: left allmulticast mode [ 1642.519622][ T1278] bridge_slave_1: left allmulticast mode [ 1642.519636][ T1278] bridge_slave_1: left promiscuous mode [ 1642.519710][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1642.520486][ T1278] bridge_slave_0: left allmulticast mode [ 1642.520497][ T1278] bridge_slave_0: left promiscuous mode [ 1642.520561][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.528757][ T1278] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1642.660275][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1642.661596][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.664718][ T1278] bond0 (unregistering): Released all slaves [ 1642.761365][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1642.762028][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.762379][ T1278] bond0 (unregistering): Released all slaves [ 1642.798376][ T1278] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1642.881188][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1642.882378][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.883496][ T1278] bond0 (unregistering): Released all slaves [ 1642.920999][ T1278] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1642.921869][ T1278] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.922414][ T1278] bond0 (unregistering): Released all slaves [ 1642.945087][ T5269] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1643.034123][ T1278] tipc: Disabling bearer [ 1643.034198][ T1278] tipc: Left network mode [ 1643.202278][ T5269] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1643.303230][ T1278] hsr_slave_0: left promiscuous mode [ 1643.303555][ T1278] hsr_slave_1: left promiscuous mode [ 1643.303978][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1643.303995][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1643.304375][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1643.304388][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1643.306658][ T1278] hsr_slave_0: left promiscuous mode [ 1643.307064][ T1278] hsr_slave_1: left promiscuous mode [ 1643.307955][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1643.309190][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1643.311385][ T1278] hsr_slave_0: left promiscuous mode [ 1643.311730][ T1278] hsr_slave_1: left promiscuous mode [ 1643.312120][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1643.312135][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1643.312489][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1643.312502][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1643.425115][ T1278] hsr_slave_0: left promiscuous mode [ 1643.425587][ T1278] hsr_slave_1: left promiscuous mode [ 1643.426009][ T1278] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1643.426025][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1643.426360][ T1278] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1643.437697][ T1278] veth1_macvtap: left promiscuous mode [ 1643.439139][ T1278] veth0_macvtap: left promiscuous mode [ 1643.439195][ T1278] veth1_vlan: left promiscuous mode [ 1643.439233][ T1278] veth0_vlan: left promiscuous mode [ 1643.458298][ T1278] veth1_macvtap: left promiscuous mode [ 1643.458324][ T1278] veth0_macvtap: left promiscuous mode [ 1643.458389][ T1278] veth1_vlan: left promiscuous mode [ 1643.458426][ T1278] veth0_vlan: left promiscuous mode [ 1643.466364][ T1278] veth1_macvtap: left promiscuous mode [ 1643.466400][ T1278] veth0_macvtap: left promiscuous mode [ 1643.466461][ T1278] veth1_vlan: left promiscuous mode [ 1643.466500][ T1278] veth0_vlan: left promiscuous mode [ 1643.632043][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1643.640276][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1643.721680][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1643.730031][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1643.807229][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1643.809498][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1643.886766][ T1278] team0 (unregistering): Port device team_slave_1 removed [ 1643.889024][ T1278] team0 (unregistering): Port device team_slave_0 removed [ 1643.922432][ T5269] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1644.215807][ T5269] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1644.437009][ T5269] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1644.592454][ T1278] IPVS: stop unused estimator thread 0... [ 1644.599424][ T1278] IPVS: stop unused estimator thread 0... [ 1644.599717][ T1278] IPVS: stop unused estimator thread 0... [ 1644.640431][ T5269] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1644.824279][ T5269] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1644.992533][ T5269] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1645.157565][ T5269] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1645.327603][ T5269] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1645.496337][ T5269] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1645.682057][ T5269] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1645.860495][ T5269] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1646.027317][ T5269] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1646.201044][ T5269] 8021q: adding VLAN 0 to HW filter on device eth20