last executing test programs: 8m4.852833726s ago: executing program 1 (id=470): socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0xd0f, 0x0, 0x1, {0x60, 0x0, 0x0, 0x0, {0x0, 0xe}, {0xffff, 0x2}, {0x5}}}, 0x24}}, 0x44004) write$sndseq(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000300)) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x6) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.current\x00', 0xf000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001c0001010a00cd1e00f2ff0007000000", @ANYRES32=r3, @ANYBLOB="c300a6000a00020001"], 0x28}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f00000007c0)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) 8m4.503543927s ago: executing program 1 (id=472): r0 = io_uring_setup(0x218a, &(0x7f0000000240)={0x0, 0xad5e, 0x2, 0x4, 0x221}) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) connect$can_j1939(r2, &(0x7f00000004c0)={0x1d, r3, 0x3, {0x0, 0x0, 0x3}, 0xfe}, 0x18) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) r6 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f0000000080)={0x1d, r5, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r6, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f0000000280)}, 0x1, 0x0, 0x0, 0x400c000}, 0xee) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r5, {0x6, 0xfff2}, {0x5, 0xfff3}, {0xd, 0xffe0}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) close_range(r0, 0xffffffffffffffff, 0x0) 8m3.825289658s ago: executing program 1 (id=475): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x1fffffffffe, &(0x7f0000000280)="f387f3d0d636834c015f24e62c2e7c82d107a6808737c85e69706da9c8440000009c0ebf8e740a7efe0ed91d923af04bf049364e1b69237c6258215d8f1e91bd3bd03e7f3876d52ef012264768d6b703075024a5164aebe8ba1203b8512b2258bb6dfa2f55f49638af78cd0b6cc0956fd12d29590c6eee14a6c7bc9d5d9c26915315ab4f01f3b278e7") ptrace$cont(0x21, r0, 0x80000001, 0x4) syz_usb_connect(0x0, 0x34, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000a6ff0540cdabeecdb9050000000109022200010000000009049c0001010351000905fd12000000000007"], 0x0) 8m1.251168803s ago: executing program 1 (id=484): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x40400) ioctl$VIDIOC_S_FBUF(r1, 0x4030560b, &(0x7f0000000040)={0x2, 0x0, 0x0, {0xffffff81, 0x2, 0x30314247, 0x2, 0xcf40, 0xf, 0xc, 0x3ff}}) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r2 = openat$ppp(0xffffffffffffff9c, 0x0, 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000002c0)=0xfffffffe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r5, 0x6) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452509005ad94a461cdbfee9bdb942352359a351d1ec0cffb4792cd8000080", 0x4c, 0x10000000000, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x15) syz_usb_connect(0x3, 0x24, 0x0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0}) writev(r8, &(0x7f0000000100)=[{&(0x7f0000000380)="5800000014000300000000000000679abeff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff5a6052", 0x5b}], 0x1) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x424900, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x440200, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) 8m0.02098232s ago: executing program 1 (id=488): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYRES64=0x0], &(0x7f0000000080)='syzkaller\x00'}, 0x94) r1 = socket$inet6(0xa, 0x80002, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x161) mount$fuse(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) syz_open_dev$sndpcmc(0x0, 0x8, 0x14100) shutdown(0xffffffffffffffff, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x51) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = accept4(r3, 0x0, 0x0, 0x0) recvmmsg$unix(r5, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @remote}, 0x1c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 7m59.356496039s ago: executing program 1 (id=494): openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r3, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452509005ad94a461cdbfee9bdb942352359a351d1ec0cffb4792cd8000080", 0x4c, 0x100000000000000, 0x0, 0x0) 7m43.891033795s ago: executing program 32 (id=494): openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r3, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452509005ad94a461cdbfee9bdb942352359a351d1ec0cffb4792cd8000080", 0x4c, 0x100000000000000, 0x0, 0x0) 5m39.86044366s ago: executing program 3 (id=1060): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r1 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000040)=""/207, &(0x7f0000000140)=0xcf) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto$l2tp6(r1, &(0x7f0000000180)="611e7da43f1fb36126deed02f5534a991ded43613a46917a5d41bf18e61ed6fb2f0c12198350556262466826e8f7e1b5ffe4f6fa46f756d8ca64daaabb945d7da45694ab739ccd87ad16cc03afe244f04e5c4061ca8868ebc69c0869940054d44eeb0d3ea8de08d6332181f01841a2ef10cf9845c433826123a887cfaac10a53968edac3cbb266a87cd03fcb2e5b0e14a914f975cb499d82bf4bb31fcdccd511cdebd670146684a1b600b535128d526408de3e48e830c8b255d2e3a41b8e31c539e4c3c0a1862148719c1dd015e76df857bcc4d72ad0174317fc7d", 0xdb, 0x20004090, &(0x7f0000000280)={0xa, 0x0, 0x7, @loopback, 0x0, 0x3}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000002c0)={0x0, 0x0}) ioprio_set$pid(0x0, r3, 0x2000) rmdir(&(0x7f0000000340)='./file0\x00') getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f0000000380)=""/20, &(0x7f00000003c0)=0x14) prctl$PR_SCHED_CORE(0x3e, 0x4, r3, 0x2, &(0x7f0000000400)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000440)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r5 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002780)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@empty}}, &(0x7f0000002880)=0xe8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000028c0)={{0x1, 0x1, 0x18, r2, {0x0, 0xee01}}, './file0\x00'}) getgroups(0x5, &(0x7f0000002980)=[0xee01, 0x0, 0xee01, 0xffffffffffffffff, 0xee01]) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002b80)={{{@in6, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, &(0x7f0000002c80)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000002cc0)={{{@in6=@mcast1, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@private0}}, &(0x7f0000002dc0)=0xe8) lstat(&(0x7f0000002e00)='./file0\x00', &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002ec0)={0x0, 0x0}, &(0x7f0000002f00)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002f40)={0x0, 0x0, 0x0}, &(0x7f0000002f80)=0xc) read$FUSE(r2, &(0x7f0000002fc0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000005000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) r17 = getgid() fstat(r2, &(0x7f0000005040)={0x0, 0x0, 0x0, 0x0, 0x0}) r19 = getuid() statx(0xffffffffffffff9c, &(0x7f00000050c0)='./file0\x00', 0x1000, 0x10, &(0x7f0000005100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000005680)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={""/10, ""/2, @private}}}, &(0x7f0000005780)=0xe8) syz_fuse_handle_req(r4, &(0x7f0000000480)="8579bd6c4f3669c0a04d3c09bc2a99b50484f21f3b4564318ef1e1725d750de3dce609df8b3ac68a7ba533eb141bf0955b8077aa798f7638852d486482fa55409b2ca9dcfbca3122387028ff4d5439027af1d4702b7a48a26f0845fb791743627fa8ded2b52871a2821df555ce0d9204452b558d86b4e5b44b1159eb3ebb55c8d1a91a87a91d92bfaafdcc920e710cff6576371a075af0a45568c253f13846fc718b14d7006ad5d1670fcf2e19add71ce62c9979dd15beeb9257301a47e6dcbc90ff4e89af736c4b05055828ce5e9e57af44cabe378fb8b3afb3a0ff5a1845dbff164a68ccd7f78bb6e1e5bdca3b11b5d5534d69ad9804bb34ff5b02cb59245876b5bcf9203779e67e0c539d67efc8709fd5ce20ce959f8fa8972ef209a12094fcfbdbcaeaa0200eec234f5e17b40ab85779b4918da207c93a5ee92439705b515fe4e963711697dfcd85821db26d0793e97935800f1c4c223b7912170f1ded7fc7ad733594d302174c3113989107f1062e320f864f85683cd0de2b09fee20607d08fc8d84dd167048117e66bb82a91c6dc382ebb3eaad3c7d13850309becaf55e8953fe970da3d94bfe49a878cd6fb079df8ad5d489c88a5e64f7dc786d571af46b743dd90da93e608c992eeb842e68bb26d53ef6d8433375b5169270127d9f1e25230ed2c6d49119efefe60d0c5650bd9313ec917e31c334a5fdb7480da294af7e6e484bd9e51a547c4ea1dd6932446c855758cff0c74e24de31499a96a656381b4fa8bd8e43324a09a5777a00cfe7c64f9d941eba9f34ae9ce8c6cf228493e535e006fa945e1b3daa30c560530adca7ddea7e01e3faf855d6fbe66d3098a8d0da6e684b778ddec6f7783cf42a9d2f104b9cdaf7bf80590092da3700e9febceed38119bc01510e3e203c94024ee786188483a4267c30aed32ca7c68650e6b2cf28614298670cc0b37f9379d84d4ef2947bc066b64b87cac9c04df139fd0387aaf7bcb6285ba3f0bc2dba44bd418dab7da9c45c991768edef761b4d1aa0e0ab835ccf5fc0d0043de3527e478990e263f68196c38471c119f7a6152f09817c2d796ee083e33ecb483431a8ef42158f610769160c1997b8ae4fc77de3204b34fb44616df25006b5779e7a50ce3f747c114a74b72311a9198e2d7409ab190e5e7fd92af62a519e235a92ccf8b57a804dd1e92a0c7ad07ae0015b336a6d8b02989237f39d8c71798252d92b00c25559c7a2962dbc7b51a560785849e6a8c71633ecfecdf84b7509b06f1b3588cba2518574247a2c99e3dc7df4a42cb2802b08040d84671abab58ffa3d773b5e72fd66da254a628072346d29307854a1147bb7254b6d7baf29a3e66d0c8deaf9d711b90d667acbf021ae7eef610e9eee5a32edb20ab47a374929bf97b10f6ddcc6dfb3bd4e6f0638734a7e0c7151685577f6549630fd4a803dd1384b0d18314e8dec6931f5fcf444b51dbbc929bd3c0e114ca93073dc7ba6ef19b2d6292ad8f669774ea3f012299054da934a3b3ca51cd0d0ad139a466d8399e9f64a236e1d6a06a77f6f0c12fd07879893516800907430c31d24fd5057624854c585348da9d537c6bd5705179f5c6d7d48b7a7311a749b58fbafffcdd5c67a09a4d7aa820dc160a996fdfa3c8c6206f6143e6f0c040c57fe36e57aaa1471173e41f7abaee4e222d335d4abdb6ed51caeb07850046311bbb3860faaffb8dacbe9c23bf027f091953f08e63586fa46a6d9243f7d9f68120ac10065fc49fbe5ac230f7d2d814b22e0991a73da8f381e6dc56a5e6addb7346327b6768c66d058d0da573ecfe0e4e23dc545473aacbdb1367958f314dd6632787aeff0ecedb9aa6d10b1bc75477770cb62da54be2d90c83ff672a0c59f4626010a57ea274ce1796124ded12d8daafc9671b3110a1bed31180bab1041c9833c6398239cd87af370fac663eb9599a97fc656428e3c6666638be01d63c50bfb9cf5830bb8ab668581bc7422b0561191e8a41fd51cfa748508e8231323052e8ba8ea6ef806d72522b6c395296ec13bf4c976e83c18de94b69f51921e5342df09427d256bd81caf78fb56962103518b153567157b3895d8bc242c714a4a943a1e9958bb62e5d5038f45cba099935ab32833c45c56849a767695d978a0f4214a43cb5df89d27f83199f2d3edcf97d5a63c2a21da01dbb0fef7429d4e0387b72481f95de4ea80a4a65be7552ce65580ffc73d443188566bb8edeb58dbf022bb0435c1a3a914e5092854e9f1ef9e23b0337c1cf5b4c7a6593d8554c3df31402295e312e2eb07f40e549c1b124056b82873180128ccda1999dcbfa89eb68f8d98c197bacc6f86b65aa80d457d4ec6369eadf265043426fbdac506ea5c5fbe6dfcfb2e62b951236f5368081ee2ee6d46911288925059ce0429c43cba5f56f6816f61a0258c941d396936070ef4172742d0fcb441193a7c70ffbc0be6689f5dc8347bffb09e62c57b067baf262dc148f4cca1fb7f42efb96d126165864bdfeef89f6ebf8021fb41d12ebef78dc41b705c93063c769e83dd49036706b69184661fac48b7f7edb7d9acdb79c9b32c5f79f3bfb7b6273866cb1017aefcf2b0795c63f4f911d20e549784a057ae8a1e58592db40637165ace2cef643146b2bf5c4e09016767ef34bc2b541d2986563f1b1e0121177810e8382232a0cc05d2946b437b858eb5808c18bdb70753872cb9506304d50042531d96b444d3fb703d4befef9bd5d4c3f36f6c2e5e38bc4e781f2b20dbeb97f7c4d47c623d7b30a9101a9dfeaf00145eec3a83e6a68f1d452780b3328c1b08d1767bcf22499fcf9982ff018afc5edc89a9c414f327e7754db85a9b5fa3e9c65493c0638fbfff8b74974940f45e23584ad5ee4af690824518292b654ea024842836686e042065e54e492fd27eb33bac58a99c0a5bf9e88c525d4cb297c79ab17e2f0d58e07f85879df624769a1e3dce510ed29b4ca02396f4b8a34a0cb7172d2ce62e64d931fb16fd7802bf4c7a6807c1851ef7f615110e241aa07ef413af4d8189b93697ec43047c23944292d525a300d605c2c8d6e8fca35aff8ac0c47b5ccc09c2147f296fe53ed008b9732e190ad1f60c327bbd6d38d5622cda139fcf41e1c9b83702778bce110257407b5371debaeaafec707082175bbb6071561722182577b9049d80734ec5e3de1030db5db2c39dd602857ce19d1506c1b538199a41319dedfb00cdecee6faa0808f94caf08391de4f3c2e327f79a6775b6878570abeaab3fbc4f1054bf0f678021f6be01d4a9b4da75977d567ce4326047255fafefed61e4188b5ba5f472bafc9a8acc339a720c81d2d3f6eb24bdcbc77d7b66b0393d93fe9bf86f01892d30988242ac15d6ad5ee1703607e0e2a4b193731bef80a47e6018ec31097c27b4c5af168ea05c57356f3182e363561cb798731e36428cebda393cd0e2d085d5ff63d45beec5cd8d2eca5e59991f811e6f4d3851d7372440212cc42911effeb3fb94ce6ad324f737312685d38b1f911224502d75519c6af9ef9312d21f114c87f9e026a3ecdba5d7a8a18076bba4d3fa6b8f34411505eb9005e1349a47697851ca60f6b1511dfe6e34a0fa0c49498a3b667ec538e4e4d496dd1d9a57214e23c107b50564659799cf98153f2652de2da9e6802ac2be11b6e34b1583fcbf374cffffd343fb33742c3999b186d73062c0e3bccd564c4e6492982e32700192c3725fbc070cbbcb9ebf0b1f2bdee52c8ab419b25895e73277204e1d05bcf590abed3f3bc4840236478bd95e1a7a74e62995ce75018836de2961da7632c8220268faf412ec1f1d2c7410ddfabcd4897106677a9e92bde10305e2ea735d2f379b84367e8671fc84dc4f3ef5d53014ba3e32fe22ce9c03c27e826288c0ea6d1dcfce240d35b892c04a774f7bcff555dbb9080defe2f96ae778683861e16ac60fa02b9a02da6438a76f2e10bd860213b057b4925dc3f73b1a51106fe037fcd80c83d517ab4dcdcf308c56b39f818cfa0ad7a3657f8c78265b8b87bfbf475129dca6d61cf38dc4905b9e0bc48a8121280979a0c46206c1988c14ddb56dc787bc97a52d51208dc4d64f88ed7cdba6132632f4babb0cc721cd94313c4aa9b64ed82e058149b381327a9c95444bc9f2f78b5462f718c171ac1bb961e637794b3232f5c08c1e088971ac030311b3d3e708159c18ed9da8bfda699a73ecbd5e71e948dce8729f94ab3725008d28ec803954cd553f7c76db2019e508645ce3ad55ee2c55c3ba5ab2e87da28262dad997f8027d507115eadba5b8d6d912d76319b4fcc648ac4ede0d53b74559ad35e5573c3fc45f1f213a095002c61fde937e31ea4a2b35a046689de282521e3f58579106bdd0532c14e73bfb6b3310dcf750a322946f191c142b5f6fa31c1337216f6860d7d7d5718ac07872b205b56189abca6bc5cb6f72f2029ec2fd82e99a034bfa0ec193f5e12f58c7af52fdcb346d8459e9307a4771188bc2b1cc96232bdb0be2cee5753afc332b2043ac0528ae5c3796ef76e43a8bbff718a4b5974f2d8e1fc13ad2096368817fcad5dfbdea7795a9e2065719a85f8b4d59bfcc96253932e7cc7a40de7557ac9c41ed411e5777ad66f995f64a6e011caba2afb42c1b5fe03631c7d053027f5978dfb460a480bbd4b55fdac0247fb96c19fdc7c4d6034d23b55dc68976474f13b97c9001a8585f902068b45b675fe3559fc07b5c87925f1d8943720f0469689e793729e654d090a1d1187b73cb902140222cf48e2b8d981c631098887028112a041e48ca8a947b6f8340d326d778011b9d9aecab6974e3724731cc8f861324154fc6860e17d409f9f373f6d6ce17daf8ca96856e938a21f7fd05d6e34b41fad688083ae82811aaeb8a4343e8b22c010926a8e4e407a33462d6b8c807806deb5011fdea3d31ac2ce2ebd758e769ae90b9b20d8fac2f36d7f47140053c9a0e531a98047b7d60c76173dc9e1b426ed3f6a1501d8457dda3abc37759e1115abd6519ee1d4ebb6d9df187698173fad6139e9d5202416073a7a27fa89c67e06c4d5d5714c9c8215f49e00a7227371f666eb9dea864a3c50235713c1069bd81b0a6dc5a30cfea5064fbff42badf31ae54c813b34151a4dc78b7ab7a39d91ae8c44cb60c2bd7d5cb573e64fb36181d6ed12c66ff2757c59e2437ca60c6bf809785f6994b14edadb2cb480851b4318bf7b526699ca32258d81c472c518b0a21c739fa3cc224b601c87f7071729b2f9a360c67662635e7bb470b5f431a43fb1b1bbe23a6d181995afa99692cd02d427e8376f35ffdeed4fb6d16cbbf68ecfa98eced4addf97161608d7763a45c4e5a807f841b26eedd59d111909c927d669b73908d6b1711c1a3c989807bffd36a56d0d55be66d5c2282d2d60a9b1c015894638d6e3ea51e6827e1ff4afb4d4c51bef38188bbd8aaa0c4966e56888cd7d6ec781584ce0b561085b5b21c89d2e835a66007efb1b3780cd074167bb4ec358472bf84b0d4119c9305c2596d348c60da14994f688da8c009f3acbbdea4621a490ca193a61030206bc7597de673c7fac98b1af7f7794c390b803a25452a558195264090611dc4d2c3dd08adb8bce90d7a067ded575b4a5eef19442d46079cd48333b81a5e1d916a347eb235eb86cec66b2711e283cf3f346c7e44c46f7ceb7411f9c1f4a6ab089fc464d3033110c5a2dcd3c166f4b833a89006c00407995b9152154dcbc18ef1aee70841f9234b782cb0aa7435bc8e643dcab687c12cc4ded68c226e514337367f4a0cb00482278e07e8a17bcd3bfee8672bf7d4013612ffbe9c66fb9d9febd670bf1c31f735c80c5975e23ee6f97b6f6b63a4ed8355c84d4a3226b7bab544dba1954b8be1a46d3c45c6f87d85a84f61739ed46646010fa4350d31f4f59cb5d4cd99d214fbf5bebed441801c07f26feee8851f9c6ba367bfe854870cdb9ec3c37cf8e5e09f11446d1060d6d4a55874d1163478a98165643722d694ff323a1d676636c4e4ab6bab02c2fca0a28936c51cc8b20a0cd67da5e79585ebcea7d92d0a54221a21000c77ce9fa59df1872b0037bbc21d4cff5a6d6240ad0e9afb61217a585e91cf3f74890bf6c0fc5b4a2327a52796925f4d586655cc17dbb63269535ff5d715b1212a49a50c190aa5e554932515543579c6d031906af2818e591809e869c89c754b64ea7f3e192ce67fa8b6caa3ca803dc283c83562f4f982cc42009d310f2d2e7e0f559ba7a102fc03a122a10e246821868cb07e84da2a85dbb44d6dc99b80d3b1314e5c05e400c38db17560758220307b84829685c0b995a0c60dc60f7e4ac1b8e5864ff58eb48efc9d524bc05d6cfc5c43fd79e193105b85797a11641c06c216b5f1c501376fd457cfe2dd6159d370b34fcdc55bcfae3458a976e588801b77f35a45a0b120a0e3b611255605e45c4f763a51f963c5f62e52a4efe30b88dacaf5ac436aec571afbf256ab806971a2cf1547015d9f2a8916b957b491d9a648d83ac4273cc0e339be4a01a897cc642bda209e15cdb6f5eb0f4c806d32e98a2748bad795d46d4ec3e873015ba2786088908cd4c07bd15356e8b7fe9a55b1bc0c89510e0bf4f61d792f3f4ab64e57f796fe4b32ee2c27ca1f644f4ad7a1eb0ae47ca3be0ac8672655f7b1caaca489c16f8219c4210ce86cdf9e536987e61f91b417663390ec0c77ffa08f2c356929a46bce277132d0821c467f444168f3e11bd95e90c9804340ea0095f3c4eafdb048824cd3165a26c2433c65711d94a067437edf76720ea206dbeba636b8885f7a981c772b5b1a2df5382d7c7289e4a24efbc4fb60ba97626a3aaa9b86c775f62774325c3059d3763171465d260fce11c73e564e2ab059d45a3fdd024d7e747d43e3b32f55e0bbccc2bca1e197670bfcb9e6853be6986cb57344f7722a5cb8190506d716931849e6816be9cf49a48bb4010a2fc81505e0b74ccdae911befa3b1fc540b59e1c763c80cc1c3bb8882aaac157da8b81894d7fa45227ff4b8d27ffcf62084bb4cd54e65cae8a4af0fbbb3067d1636baf6f4436f2605435f370a343bb0afcf86ab3e6903d0f5fabbe29fb9667856d2d9dd7d0cea7185185a1066e26728493d6fdb5148151d6b6fdc5a4132b489311c338e2162501ac306ba16e67e1a229773ea6409088462c0718c7c347e97ddb569c56ca1ab0fbcb9b72a19c4d5b4ffbbf8214f6e3488f57a96200500d8ea122e464902322ee4ada155ae1d08ed3f7b9aaf099df885a5a3f87425abb453fd0d6f5ba6899b816ced63906802cccd11d116260b663891d07b69734a170a4fc391dfd1ccc2e673263d9c57dc25f524e525a3d9351f26637fe1c5e467f8d0718d68353c461e190424bb46701dbd212a77103157c9463e528ef03021cc75161569872d693f82d2b9bbb48ed127b05b6e2b7705b6c38fc77014b27cfdfb5dc15ff5e7bd292094a7236f114a152a0698de115e0f451e1ccba924b480f957a4f818cd720cc5d12dd629af3b735311a706f5bc75f8c32607bf2e5accfa515a23aedc9dabe6beea1df4e514fc626100b8b1ada84c39838146af722d2c0328fb6b82b8b6c0d90a98facfa17572f61099f4fffe8922946b196f6c68e127da06c6bbb1a95472ea7a257b9c9a8c718faeaaee3413de9529d6770193c986951ae002e1e76f0c1da60186b5fd9b0c1b25f50a019d006737c42c1226a65cb4a783f98debe406ec137bf203f568fabdbfbed821d66d5db5611b648226c9d5c6e15d281784b91dd45da57d3e61b2e3d5d3e7a25c193d2f1a705e440c47dcc93b279e5e2acc4c0f6f35a6cdcbc9607ebce2611e19daf1834c49f3070af7f87f3020e4f59dbcb144f38f06c76db2e4b5fe572485a23a14e50efdf6b802b66c4be497e02262dd5a0d62d2bca3ba2a4b1e54600049985467da8d3d7b7d5a1886f8b60ae72e43906218260f1f13510e4389f3b2346d49625df9d1000e48e5fa32d4cee0d2d27adb27a487ba3ed7e94ad1cc73b42e942dbd39cbdbebf6d4de2e8410fd4ce31c2aef6cdbf183feff4328aca386304c3509c7c7ac5ec805c740e4ea869086a1460a0aea7712858e1d3e44458afa65fd221686c9138286c2858ffc7b0e9eb623e483e63a6a6b24bcb1ee2db826c32a71c52ad441dafeea73a0d36703836f3f5721c96658f0c0ea522b06e2cb02f6d77f6a741ff12135131eebece23ce06082c6d906fa5c7eeb8176392513fc2d2a86a0f2b2ced7285534d6c01d9c1573a62e88e10ac84f8e6c3c57264ae5701800636907d2be3b758468898033819a6fd0d16e0b9769b45dc23a569c02014be60a00201124ec7e737635543d301cb7784e74ab9c02317b2b7bedc5ef66cc13e2103233f47971c0e42a707d64dfa8793c896e1588b7dc89d777c29ad0f2c303991d6fbde3c4dc8d15283b178035f29ac9cf896947a08c807e7d27d29eb210866ff996a74b3b09f97399b6f0a77caaad36a2d47cb3edc8301d866cf0f8011c9707801e54dec2b7fa18ff94fb33c371e73ecbde1a84b712435de894fbfa56d1020fae853451235666b03895166441ad3f7faa8ad10d565826ed44a10512d145ecea901f5ae8af744801dff6f6086ffef9b30e87aeb8776bdcbb85faa21531c08feb578dd0d50a47f769feca70537e27aebb4f9eb183d41ecd9abb2b36554993f0474241ef77e698ed0097c5416193fa707c16ef05cddde62162027cfcc1f014d2a5df630a4dc627268a196295d895c317f889f05496c1c38f23b6d724378f2ab6cd9c99b7aded1fa70704e33ff4e979cbc9a4048e018426e4b314374e788e898c8e8bf3e6b2b9fe76618e7b60b888f4e54540cc79121652ae712dd88ed9e25e6720fad1689a7127841bf97d31cf16853d9454733a7fbe2f93fb9cee944e5c60157d7f1813144c7ece9215fe6c3cef4157a2865fcb4e6c1dcd8945c6a254a8972839d5a7bce7842f7ba9640736951f5c547ba0c403decee9eeb3269cb8d4262825bced804cd99cb946dba5f99b858c3553ef2aaeaf9a3b5348b85440e57746392aa592cf0935a3c54ff2bdca071347767460da091af6623307d8921e0e76858027ab02b7e1b88cb50e76a6d94d0a6e059878d45854051615a592b66098e0be15eb186bf30837550d49039c405757b9198a979efaa55f07a17d79416b8f41f6256fc5d9c415b2fdf2aa6ae878747e954601cb03278ff8e42529e24f445ad784ace6f58784c0e293e746d8f1ab4d6e825b8af09f006a2066fafefbde945e34922a1e4af40266ff4c4b34bc26b46eca40f739e4f6e86fb390dced3bc9f88d2e4d65b141492d9af64855816730366e1eff55cddb1e525baaafb44d020664ff37a1a663e499f592c696c8f2de4821d08c561d66e19b0804f3fbd0172f6091f3e2569e34f2645f0fd2f0a213714d7aa5272475b8d52063cc5f8dcab284a3b2dce8692461148024f1ca7aba44e7df88266e658f433622a16069246960846158fe7edaede0fff6b53d5e4d0d8f945d26c407086cd12aa72d86ec5612a8043ec2a5a0fbb960dcd98e628be7f4a2053e82dd133c76a176b4ef81f3991f64ace7e54a649367ebd13e0d7556100abf3354e51cf0aa9c9560f5dc2b92b6131afdb025e2cc993919179a46be47401df203ef1e8937be5df3b25f8213eb2630fe58e3752cfd53cd75c5d8ed9b19b2174e6ba73ab1161332baf21db24fa158f6d6bf3fbf10506d6676b8bc76ecdcc233c0468f482415bcef4ab867c47540e62ac49fccdc703cec7b9ae5f9ae1c5162ba722d1ddcded333ae30bb423f9d6be0be2b5947efcf5dbe4cbf9e7ced4b407ef964169bda47fc44cda011d88403c0a4597d7b84886c4c868b3c30b66f8b0d126b35168dfcde7aa42edd0baea65f78b195b5d3e532ae0a40230263f9a0532ab1961555ce45d5fd27701a4ad5e474d4ceffcd44233cf952a36411a43ea6981ea8a7961b8624efa87a3bd0c02982128b6bb59d65a3fdd5db1695a501540e13709fff26a74e178dabe613d0b8023f95c5e8bd97336f6e507f6d1e13cd86653501edd0abe6d167f3b233558888ed68e68f4edc099db0020235c30a384276de94d3889fcfd86a8d1d92abe86705c916a753c7c12faedadd8cb64fdb3a3ecacec3c19c2ad6eb442ba6b124265081ce5961bd3e5fe64c25aafb2c48e4ef79e8dd35d5c172255b9fa60eceb38c27cde0d887fb04bbfb7a7b9b01f992a8a23a076b4a9a99a727b5ad5504c269fd7cd738cb5376ed399aa5b871ef2508e911316aae79401ad507034e8a69c28ff90832c7b60fe0f5642ab918ab2e3f1198849a7fc7beff9f13e7acdc49ab6ee1e6aa3455af0fcc78193c07648493ba965b2bc77556e06f88eb59fa9c6804de37e7c05c2edaea699348036569f3b8796556f0aa3674cb8dca9ac2c5c64c819cf61e94d8bd1868de21527d83cc1bdc971a2f36b68652bef689fe1f5e72dd02bcc2586b2e2ea2715af6a39d7ffe5d59a6dbc50ff15c876de771c9d51ecd54153b04439d89c0deb9e9f29a73ca5071290a7ea9fc397f697323d47ccb9d86d6c10e6f03e6fd3c288e8ecca821651aaff67c352a44d444cda55a2ed4f27ac2afb0cee8dd510a0e8cbc30c55e46e4922d81f13df4d37675551cc6216f66b872975522c349a46370f81a6a0e463e5ef31de8180f3f87751012f68eda698ac6936097630cc1aa5d1e739863490c8f6c35489631fa2e2750a3e0ac2237bd2fb9f432ff47e96366da7dd4cfa1f54ecf3f2d3a7245014a4bba0c82059bffb89dc1ab4fe0eff98f91c69ebb599a7d97eef602cfaf250107c2c37f55270175b76e03a8bbc446c2faff5038a8ee2abc2763b35c58a819427769cf3c3213114a2d4aeb877c093fcaac8d1230e24d56a5090d447d1dd37259281113fef5e0a7ba9e71452244235c600722d9a255e8b1ffde0a7b9f990c841897466ddbd0fc172e9c708be22832a2649c300dfafc216d1b5e83dd585f66009a131c2bd8c24e585b9c399b1048eeb6279e8691dfe7024b1617ab8c536db39e17a2c38d30a6dddbdc2391cdf501dc9ba4370d684d980e0b4ad5e3f661a55a3a0baefbb1c8691e220a70c23cc13a0b002f66f5502c0757995bc252d83be35808210aa4c178e714ea770c420dc986fcf24e097d13600c62faf02a71b67cd98f02887e2a019e4dbae8ae5534bb3fae2e811bab4c28727f11af1ab1bec2884c665aa1fec264b7290867060621f02b5126eff102c398aa169bb6594d82b4df4ff56e96bb56c396fc7007e177dec3810ebad990fe00ce2c57d401fa38124d610eeb4d8b96bdb93c515c72b00f3c8d489245deec73c565004d2bf2bacc0c7ee93bdf1e77748d8c9558d39336f06d41316d8a7a4437aced0a82bc30e2df569a0c49436d5013c8060b430ad6b7d1a53253247c1291feafffa5cf25aa83fd88ac6dfb7e11c5e90b4235f2f23ce04d50b6a6126443176cb90a3e7499d3704165545a433b4904f2dd7aa538cd88f8b27ad56f81162b41c56e15c993412320b55b352ba1af0c31c58e9d26668b4d547af10517143c8bc432db488526a0f3e53dc169f3d5d01", 0x2000, &(0x7f0000005a00)={&(0x7f0000002480)={0x50, 0xffffffffffffffda, 0x5, {0x7, 0x2b, 0x3, 0xffffffff88115216, 0x1, 0x400, 0x8, 0x3, 0x0, 0x0, 0x80, 0x1ff}}, &(0x7f0000002500)={0x18, 0xfffffffffffffffe, 0x2, {0x4}}, &(0x7f0000002540)={0x18, 0x0, 0x8, {0x2}}, &(0x7f0000002580)={0x18, 0x0, 0x0, {0xfff}}, &(0x7f00000025c0)={0x18, 0xfffffffffffffff5, 0xffffffffffffffff, {0xed7}}, &(0x7f0000002600)={0x28, 0x0, 0x8, {{0x8000000000000000, 0x686, 0x2, r5}}}, &(0x7f0000002640)={0x60, 0x0, 0x0, {{0x200000000000000, 0xffffffffffffffff, 0x2, 0x8, 0x8, 0x80000000, 0x8000, 0x9}}}, &(0x7f00000026c0)={0x18, 0x0, 0x6, {0x37d}}, &(0x7f0000002700)={0x11, 0xfffffffffffffffe, 0xe, {'\x00'}}, &(0x7f0000002740)={0x20, 0x0, 0x100000000, {0x0, 0x2}}, &(0x7f0000002900)={0x78, 0xfffffffffffffffe, 0x0, {0xfffffffffffff001, 0x3, 0x0, {0x3, 0x1, 0x4, 0xd6fd, 0x8000, 0x3, 0x6, 0x7ff, 0x8000, 0xb000, 0x3, r6, r8, 0x1000000, 0x1}}}, &(0x7f00000029c0)={0x90, 0x0, 0x8, {0x0, 0x3, 0x8, 0x10000, 0x3, 0x3, {0x0, 0x1, 0x6fc, 0x3, 0x6, 0x7fffffff, 0x7, 0x4, 0x2, 0x6000, 0x40, 0x0, r9, 0x4}}}, &(0x7f0000002a80)={0xe0, 0x0, 0xf, [{0x1, 0xcb69, 0x0, 0x2}, {0x1, 0x9, 0x3, 0x2, '\xb6h)'}, {0x3, 0x8bd, 0x6, 0x9, '!^,w[\x9e'}, {0x5, 0x7, 0x5, 0x7fffffff, '-#,&.'}, {0x5, 0x4b9, 0x0, 0x3}, {0x4, 0x3, 0x6, 0xa28, '/-R(#@'}, {0x1, 0x5, 0x3, 0x0, '*+&'}]}, &(0x7f0000005200)={0x458, 0xffffffffffffffda, 0x0, [{{0x2, 0x2, 0x1, 0xe, 0x4, 0x4, {0x1, 0xa42, 0x1, 0x8, 0x4, 0x6, 0x3, 0x7fff, 0x6, 0x6000, 0x401, r10, 0xee01, 0x3, 0x7}}, {0x1, 0x3, 0x2, 0x4, '\xdd*'}}, {{0x3, 0x2, 0x1, 0x1ff, 0x4, 0x1, {0x0, 0x7, 0x3, 0x1, 0x800, 0x0, 0x5, 0xd, 0x7fffffff, 0x8000, 0x3, r11, r12, 0x4}}, {0x4, 0x0, 0x0, 0x81}}, {{0x2, 0x0, 0x2, 0x8, 0xccbf, 0x9, {0x6, 0x7fffffff, 0xffffffff00000000, 0x2, 0x1, 0x3, 0x800, 0x10000, 0x3, 0x2000, 0x2, r13, r14, 0x3}}, {0x3, 0x200, 0x2, 0x0, '!+'}}, {{0x3, 0x1, 0x52, 0x4, 0x6, 0x4, {0x1, 0x2, 0x7, 0x6, 0x8, 0x101, 0x6, 0x2, 0x1ff, 0x6000, 0x8d, 0xee01, r15, 0x0, 0x6}}, {0x1, 0x80, 0x5, 0xa, '+!,\\]'}}, {{0x6, 0x1, 0x3, 0xfff, 0x8, 0xc5f, {0x4, 0x1ff, 0x1, 0x7, 0xf, 0x1, 0x3, 0x8, 0x3, 0x4000, 0xfffffff9, r16, r17, 0xa97, 0xffff0000}}, {0x2, 0x10001, 0x1, 0x3, '*'}}, {{0x2, 0x1, 0x7, 0x4, 0x6, 0xb9, {0x6, 0xb3c, 0x0, 0x3, 0x4, 0xffffffffffffffff, 0x10000, 0x10000, 0xffff7fff, 0x0, 0x2, r18, 0x0, 0x8, 0x9}}, {0x5, 0xf9, 0x0, 0xfffffffc}}, {{0x1, 0x1, 0x77c48dfa, 0x5, 0x8, 0x0, {0x6, 0x9, 0xd, 0xc, 0x3, 0x0, 0x5, 0x3ff, 0x9, 0xc000, 0x7ff, r19, r20, 0x297}}, {0x6, 0xfb}}]}, &(0x7f00000057c0)={0xa0, 0x0, 0xff1f, {{0x4, 0x0, 0x0, 0x401, 0x4, 0x1, {0x4, 0xffffffffffffffff, 0x9, 0x5, 0xffffffffffffff7f, 0x4, 0x70, 0x7, 0x0, 0xa000, 0x6, r22, 0x0, 0xd1, 0x5}}}}, &(0x7f0000005880)={0x20, 0x0, 0x4, {0x9, 0x0, 0x7, 0x50000000}}, &(0x7f00000058c0)={0x130, 0x0, 0xff, {0x10000, 0xa0, 0x0, '\x00', {0x1, 0x1, 0x8, 0x5, 0xee01, 0xffffffffffffffff, 0x4000, '\x00', 0xf, 0x4e, 0xbd, 0x0, {0x0, 0xfffffffc}, {0x10, 0x8}, {0x8, 0x4}, {0xd42c, 0x797}, 0x93f, 0xf15, 0x0, 0x8000}}}}) pwrite64(r7, &(0x7f0000005ac0)="79c6744373eee30145498b0d304b6b089b161d62a7fd9fcd95201da1dd24526a4666fb22a0c5c8ade673ef60f611ddad8bbda887ca68fc7ef18b941466a9657fcd3dfb8123caf09d5e0c2d61bdf066f6bab5eae1276437e1bc282a1a61004e7d580b33c99efb33eac5b7ec4fa4bd46a697", 0x71, 0x3c8) sendmsg$DCCPDIAG_GETSOCK(r4, &(0x7f0000005c80)={&(0x7f0000005b40)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000005c40)={&(0x7f0000005b80)={0x90, 0x13, 0x200, 0x70bd29, 0x25dfdbfc, {0x18, 0x80, 0x5d, 0xa, {0x4e23, 0x4e24, [0x10000, 0x2, 0x200, 0x5], [0x1, 0x0, 0x3ff, 0x6], r21, [0x101, 0x3]}, 0x7, 0xf}, [@INET_DIAG_REQ_BYTECODE={0x43, 0x1, "148424680eae6e75cd03182e01114e5403843f4974cb275e32388f8ceaf7d8b9f2d70bf71abfff1fbad374a590daec234e3fd6749e5289317b37b5f92de884"}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000880}, 0x24000c00) 5m38.792792442s ago: executing program 3 (id=1065): accept4$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @local}, 0x0, 0x800) r0 = socket$kcm(0x10, 0x2, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r2, 0x0, 0x90) ioctl$KVM_GET_CLOCK(0xffffffffffffffff, 0x8030ae7c, 0x0) sendmsg$FOU_CMD_ADD(r2, 0x0, 0x4000000) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000371930404516080036cf200000010902120001400200000904"], 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sndseq(0xffffffffffffff9c, 0x0, 0x446102) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x40000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(0xffffffffffffffff, 0x40045402, &(0x7f0000000140)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/anycast6\x00') r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000001440), 0x0, 0x0) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000380)=0x14) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f00000000c0)=0x32) 5m36.683233711s ago: executing program 3 (id=1076): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r2, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) write$selinux_load(r1, &(0x7f0000000000)=ANY=[], 0xffbd) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xfffffdd5}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r3, 0x4020744f, &(0x7f00000003c0)=0xc446806) write$binfmt_aout(r3, 0x0, 0xfce1) 5m35.354841452s ago: executing program 4 (id=1078): read$FUSE(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="400fcb0000008a"], &(0x7f0000000200)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x2f}}) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x20000000, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) 5m35.132777603s ago: executing program 3 (id=1079): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x8, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x42}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x5c}}, 0x0) sysinfo(&(0x7f0000000000)=""/196) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r0, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000040000000040100"}) syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0xc0}, &(0x7f00000002c0), &(0x7f0000000640)) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x151) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4000) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) accept$inet(0xffffffffffffffff, &(0x7f0000001500)={0x2, 0x0, @initdev}, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x1ff, 0x0, 0x8009}, 0x10) write(r2, &(0x7f0000000000)="240000001a005f0214f9f407000904001f0000000002003f000200000800040001000000", 0x24) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2f, 0x8, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2000004) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) semop(0x0, &(0x7f00000003c0)=[{0x0, 0x7fff, 0x1000}], 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r4, 0x4188aec6, &(0x7f0000000040)={0x7}) syz_open_procfs(0x0, &(0x7f0000000100)='net/nf_conntrack\x00') 5m32.570401948s ago: executing program 4 (id=1087): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_pressure(r1, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xff}, 0x2f) r3 = openat$cgroup_pressure(r1, &(0x7f0000000300)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x9, 0x20, 0xffffa}, 0x2f) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='load ecryptfs usvr:GPL\x00 00000000000000000002 6f'], 0x30, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000900)=@newlink={0x40, 0x10, 0x437, 0x2, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x4}]}}}]}, 0x40}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000000)={0x4, 0x4}, &(0x7f0000000040)) getsockopt$inet6_tcp_int(r7, 0x6, 0x24, 0x0, &(0x7f0000002000)) socket$inet_icmp(0x2, 0x2, 0x1) 5m32.507313792s ago: executing program 3 (id=1088): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ppoll(&(0x7f0000000040)=[{r2, 0x100}], 0x1, 0x0, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r3, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f0000000240)={0x2008}) mount(&(0x7f00000000c0)=@sr0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x400, &(0x7f0000000280)='-#\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9, 0x15031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)=""/1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendfile(r3, r3, 0x0, 0x40008) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x28) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x8) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000000000000590200000000000001000000000000c5"]) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r6, 0xc0a85320, &(0x7f0000000840)={{0x80}, 'port1\x00', 0x88, 0x0, 0x2b, 0x7, 0x6, 0x5, 0x1}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r7, 0x40505330, &(0x7f0000000bc0)={0x800100, 0xfffffffc, 0x0, 0x724f, 0x1, 0x67645513}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) 5m31.83998828s ago: executing program 4 (id=1090): ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect={0x50}) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/kexec_crash_size', 0x222200, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000080)=0x8a) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000500, r1, &(0x7f0000000140)) (async) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000500, r1, &(0x7f0000000140)) openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x40400) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x40400) r2 = syz_open_dev$mouse(&(0x7f00000001c0), 0x3, 0x440a00) read$msr(r2, &(0x7f0000000200), 0x0) (async) read$msr(r2, &(0x7f0000000200), 0x0) r3 = creat(&(0x7f0000000240)='./file0\x00', 0x30) write$uinput_user_dev(r3, &(0x7f0000000280)={'syz0\x00', {0x38, 0x1, 0x4, 0x4}, 0x13, [0x3, 0x8, 0x6, 0xfffffffc, 0x5, 0xfffffffb, 0x7f, 0x4, 0x4, 0xfffffffd, 0x7ff, 0x80000, 0x800, 0x101, 0x2, 0x5, 0x3, 0x3, 0x6478, 0x3, 0x40000000, 0x1, 0x2, 0x0, 0x2, 0x3, 0x9, 0x311, 0x200, 0x9190, 0x3, 0x5, 0x4, 0x0, 0xfffffffd, 0x7, 0x5, 0x1, 0x3ff, 0xffff, 0x3, 0x9, 0x3, 0x9d, 0x9, 0x71, 0x1, 0xe, 0x0, 0x0, 0x9, 0xffffe370, 0x1, 0x4, 0x9, 0x5, 0x1, 0x75bb, 0x2, 0x5, 0x4, 0x9, 0x498, 0x7], [0x1, 0xffffffff, 0x3, 0x2, 0xe, 0x7f4, 0x7f, 0xfffffa32, 0xffff, 0x5ef, 0xfffffff8, 0x400, 0x2, 0xa, 0xa, 0x0, 0x0, 0x4, 0xffffffff, 0xd2e, 0x9, 0x5, 0x401, 0x3ff, 0x87, 0x69e, 0x7, 0x3f3c, 0xffff, 0x4, 0x1640, 0x9, 0x6, 0x800, 0x9, 0x5, 0x81, 0x401, 0x6, 0x0, 0x7, 0x101, 0xfffff800, 0xa, 0x5, 0x8, 0x6, 0x3ad9, 0x9, 0x7, 0x2, 0x127, 0x80000000, 0x9, 0x5, 0x9, 0x6, 0xc, 0x4ff2, 0x4, 0x10000, 0x81, 0x200, 0x2], [0x2, 0x3, 0x582f, 0x200, 0x1, 0x9, 0x3, 0x7be, 0x2f, 0x10001, 0xb7e, 0x4, 0x0, 0x9, 0x10, 0x10000, 0x530, 0x4, 0x3, 0xff, 0x1, 0xfff, 0x1, 0x4, 0x6, 0x0, 0x100, 0x0, 0x1, 0x4, 0x7, 0x10000, 0x1, 0x2, 0x5, 0xd, 0x20000000, 0xe, 0x9, 0x800, 0x8de, 0xfffffffb, 0x80, 0x63f6e2e9, 0x0, 0x4, 0x10, 0x1, 0xd2, 0x3, 0x101, 0xffff7352, 0x10, 0x9, 0x3, 0x10, 0x8, 0x5, 0x29ba, 0x2, 0xfffffff8, 0x0, 0x100, 0x6], [0x40, 0xf997, 0x3, 0x9, 0xf08, 0xd, 0xa24, 0x7, 0x6, 0x7, 0x1, 0x80000001, 0xb2d, 0x40, 0xfffffffe, 0x5, 0x4, 0x5, 0x7, 0x3, 0xac5b, 0x10, 0xbe7a, 0x0, 0x1, 0x5, 0xffffffff, 0x2, 0xfffffff8, 0x200, 0x0, 0x8000, 0x8001, 0xec65, 0x1, 0x6, 0x2000000, 0x1ee, 0x0, 0xaa11, 0x400, 0x6, 0x7326, 0x8e79, 0x3, 0xb, 0x550, 0x4, 0x9, 0x7ff, 0x9, 0x10, 0x6, 0xfffffffb, 0x4, 0x3, 0x1ff, 0xfffffffa, 0x6, 0xda7b, 0x2, 0x200, 0x9, 0x3ff]}, 0x45c) syz_open_dev$sndmidi(&(0x7f0000000700), 0x1000, 0x480340) r4 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$KDDELIO(r4, 0x4b35, 0x400) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000740), 0x4000, 0x0) ioctl$UI_SET_RELBIT(r5, 0x40045566, 0x2) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000780), &(0x7f00000007c0)={'U+', 0x3}, 0x16, 0x3) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000980)=@urb_type_iso={0x0, {0x3}, 0xa6000000, 0x40, &(0x7f0000000800)="d1ab754ef9a8c0d7c1ef6617b61fc950a371a0b76a2f69373804b0a2a0365ecc19d28af50aa06448dc88ef82ccc27383732626e21363ec52af3399ad6cb81811c965889147fadba425d1aa3ff37d62d5a5333872565b8c2fe7043c54205d62ea035ecef0c517d5b877303c14d8c0c1778c66f44940d3c81a3ce5022a60dc568dbcd494680d95f90f7aaa950bc0f8cf84d35a06f3e85cdfd83edb3f4205fc1a84fec52b4156dba5b0d4a362bf5869d815ec78f461002dfeeb6339b91202a6d1b94e5d1dfbe059145e1e1a7f2fc899ae527960ef3f24ac55c2f4a268f5", 0xdc, 0x6, 0x7ff, 0x6a, 0x3, 0x0, &(0x7f0000000900)="300a6ece67f43d6ad6a3be5e0af0c0e35f08c8470dca7b69c3c9d49d28d241193c2ba18d9d12861b40a678c3cb27d5dfa9d9c9dff3abe6cef142d86d7725583588f5f3ee2a7579fd1383b4150ad8e72a5f", [{0x9, 0x200, 0x6}, {0x0, 0x3, 0x6}, {0xc, 0x7ff, 0xc2}, {0x0, 0x2, 0x2bf}, {0x9, 0x1, 0x9}, {0x10001, 0x0, 0x5}, {0x8, 0x0, 0xfffffffe}, {0x7, 0x7, 0x10001}, {0xf39, 0x8, 0xae50}, {0x8, 0x3, 0xb}, {0xffffffff, 0x9, 0xcad3}, {0x200, 0x80, 0xd}, {0x0, 0xffffd02b, 0x9}, {0x5, 0x0, 0x5}, {0x7, 0x93, 0x6e}, {0x2b3c, 0x7, 0x7}, {0xc63d94a4, 0x2, 0x80000000}, {0x4, 0x4, 0xd}, {0x8, 0x3, 0x8806}, {0x7fffffff, 0x3, 0x1e7}, {0x4, 0x4, 0x7}, {0x5, 0x3, 0x7}, {0xf, 0x3}, {0x2, 0x4, 0x6}, {0xfff, 0x2b, 0x1}, {0x7f, 0x7, 0x1}, {0x4, 0x0, 0x6}, {0x6, 0x54d8a0e4, 0x45}, {0x101, 0x6, 0x3}, {0x100, 0x100020, 0x7}, {0x7, 0xfffffff9, 0x8}, {0x7, 0x10001, 0x2}, {0x5, 0xd, 0x10}, {0x9, 0x3, 0x6}, {0x5, 0x8, 0x5cf7}, {0x4, 0x9, 0x800}, {0x0, 0xdc, 0x1}, {0x6, 0x9ed8}, {0x8, 0x10, 0xfffffffe}, {0x101, 0x0, 0xaba}, {0x5, 0x0, 0x5}, {0x2, 0x2, 0x9}, {0x9, 0x0, 0x7}, {0x4, 0x9, 0x3}, {0x7, 0x9, 0x94}, {0x64e, 0x7f, 0x3}, {0x3ff, 0x7, 0x1}, {0x0, 0x9}, {0x101, 0x3, 0x1}, {0x8, 0x1, 0x4}, {0x208, 0xb}, {0x1924, 0x40, 0x1000}, {0x9, 0x0, 0x40}, {0x2, 0x6, 0x14e}, {0x3, 0x10, 0xb}, {0x4, 0x9, 0x7}, {0x3, 0x8, 0xb265}, {0x1, 0x89ce, 0x80000000}, {0x76e, 0xd4c, 0x5}, {0x7, 0x543, 0x8}, {0x2, 0x1, 0x8}, {0x0, 0x9c5, 0x5bef3808}, {0x5, 0x7fff, 0xb}, {0x7fff, 0x7, 0x1}, {0x5, 0x8, 0x5}, {0x6, 0x7fffffff, 0x66f}, {0x9, 0x0, 0x1}, {0x8001, 0x8, 0x4860}, {0xff, 0x7, 0x8001}, {0x9, 0x8, 0x86}, {0x0, 0x4, 0x2}, {0x2, 0xffffffff, 0x7f}, {0xd, 0x2, 0x4}, {0x8, 0x5, 0xfffffffb}, {0x80, 0x6, 0x1}, {0x3, 0x4, 0x4}, {0x6e, 0x8000, 0x10}, {0x3, 0x2, 0x5}, {0x0, 0xe47d, 0xfff}, {0x3, 0x3}, {0x7, 0x200000, 0x425}, {0x4, 0x9, 0x10000}, {0xfffffffd, 0x40, 0x5}, {0x2, 0x1000, 0x400}, {0x6, 0x0, 0x6}, {0x16966b07, 0x6, 0x3}, {0x6, 0x5, 0x6}, {0x4, 0x5, 0x2}, {0x3, 0x7, 0xf}, {0x3, 0x4, 0x7}, {0x9, 0x6c, 0x9}, {0x4, 0x6, 0x400}, {0x4, 0x7f, 0x3}, {0x80000001, 0x7, 0x81}, {0x9, 0x80000000, 0x4}, {0x5, 0x2, 0xb}, {0x80000000, 0x10}, {0x5, 0xb, 0x5}, {0x6, 0x6, 0xffffffff}, {0x200, 0x4}, {0xfffffffd, 0xfffffff9, 0x1ff}, {0x1, 0xfffffff7}, {0x2, 0x0, 0x6}, {0x8000, 0xb, 0x5b}, {0x8, 0x7, 0x110a0}, {0x7e3, 0xfffffff9, 0xc3}]}) (async) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000980)=@urb_type_iso={0x0, {0x3}, 0xa6000000, 0x40, &(0x7f0000000800)="d1ab754ef9a8c0d7c1ef6617b61fc950a371a0b76a2f69373804b0a2a0365ecc19d28af50aa06448dc88ef82ccc27383732626e21363ec52af3399ad6cb81811c965889147fadba425d1aa3ff37d62d5a5333872565b8c2fe7043c54205d62ea035ecef0c517d5b877303c14d8c0c1778c66f44940d3c81a3ce5022a60dc568dbcd494680d95f90f7aaa950bc0f8cf84d35a06f3e85cdfd83edb3f4205fc1a84fec52b4156dba5b0d4a362bf5869d815ec78f461002dfeeb6339b91202a6d1b94e5d1dfbe059145e1e1a7f2fc899ae527960ef3f24ac55c2f4a268f5", 0xdc, 0x6, 0x7ff, 0x6a, 0x3, 0x0, &(0x7f0000000900)="300a6ece67f43d6ad6a3be5e0af0c0e35f08c8470dca7b69c3c9d49d28d241193c2ba18d9d12861b40a678c3cb27d5dfa9d9c9dff3abe6cef142d86d7725583588f5f3ee2a7579fd1383b4150ad8e72a5f", [{0x9, 0x200, 0x6}, {0x0, 0x3, 0x6}, {0xc, 0x7ff, 0xc2}, {0x0, 0x2, 0x2bf}, {0x9, 0x1, 0x9}, {0x10001, 0x0, 0x5}, {0x8, 0x0, 0xfffffffe}, {0x7, 0x7, 0x10001}, {0xf39, 0x8, 0xae50}, {0x8, 0x3, 0xb}, {0xffffffff, 0x9, 0xcad3}, {0x200, 0x80, 0xd}, {0x0, 0xffffd02b, 0x9}, {0x5, 0x0, 0x5}, {0x7, 0x93, 0x6e}, {0x2b3c, 0x7, 0x7}, {0xc63d94a4, 0x2, 0x80000000}, {0x4, 0x4, 0xd}, {0x8, 0x3, 0x8806}, {0x7fffffff, 0x3, 0x1e7}, {0x4, 0x4, 0x7}, {0x5, 0x3, 0x7}, {0xf, 0x3}, {0x2, 0x4, 0x6}, {0xfff, 0x2b, 0x1}, {0x7f, 0x7, 0x1}, {0x4, 0x0, 0x6}, {0x6, 0x54d8a0e4, 0x45}, {0x101, 0x6, 0x3}, {0x100, 0x100020, 0x7}, {0x7, 0xfffffff9, 0x8}, {0x7, 0x10001, 0x2}, {0x5, 0xd, 0x10}, {0x9, 0x3, 0x6}, {0x5, 0x8, 0x5cf7}, {0x4, 0x9, 0x800}, {0x0, 0xdc, 0x1}, {0x6, 0x9ed8}, {0x8, 0x10, 0xfffffffe}, {0x101, 0x0, 0xaba}, {0x5, 0x0, 0x5}, {0x2, 0x2, 0x9}, {0x9, 0x0, 0x7}, {0x4, 0x9, 0x3}, {0x7, 0x9, 0x94}, {0x64e, 0x7f, 0x3}, {0x3ff, 0x7, 0x1}, {0x0, 0x9}, {0x101, 0x3, 0x1}, {0x8, 0x1, 0x4}, {0x208, 0xb}, {0x1924, 0x40, 0x1000}, {0x9, 0x0, 0x40}, {0x2, 0x6, 0x14e}, {0x3, 0x10, 0xb}, {0x4, 0x9, 0x7}, {0x3, 0x8, 0xb265}, {0x1, 0x89ce, 0x80000000}, {0x76e, 0xd4c, 0x5}, {0x7, 0x543, 0x8}, {0x2, 0x1, 0x8}, {0x0, 0x9c5, 0x5bef3808}, {0x5, 0x7fff, 0xb}, {0x7fff, 0x7, 0x1}, {0x5, 0x8, 0x5}, {0x6, 0x7fffffff, 0x66f}, {0x9, 0x0, 0x1}, {0x8001, 0x8, 0x4860}, {0xff, 0x7, 0x8001}, {0x9, 0x8, 0x86}, {0x0, 0x4, 0x2}, {0x2, 0xffffffff, 0x7f}, {0xd, 0x2, 0x4}, {0x8, 0x5, 0xfffffffb}, {0x80, 0x6, 0x1}, {0x3, 0x4, 0x4}, {0x6e, 0x8000, 0x10}, {0x3, 0x2, 0x5}, {0x0, 0xe47d, 0xfff}, {0x3, 0x3}, {0x7, 0x200000, 0x425}, {0x4, 0x9, 0x10000}, {0xfffffffd, 0x40, 0x5}, {0x2, 0x1000, 0x400}, {0x6, 0x0, 0x6}, {0x16966b07, 0x6, 0x3}, {0x6, 0x5, 0x6}, {0x4, 0x5, 0x2}, {0x3, 0x7, 0xf}, {0x3, 0x4, 0x7}, {0x9, 0x6c, 0x9}, {0x4, 0x6, 0x400}, {0x4, 0x7f, 0x3}, {0x80000001, 0x7, 0x81}, {0x9, 0x80000000, 0x4}, {0x5, 0x2, 0xb}, {0x80000000, 0x10}, {0x5, 0xb, 0x5}, {0x6, 0x6, 0xffffffff}, {0x200, 0x4}, {0xfffffffd, 0xfffffff9, 0x1ff}, {0x1, 0xfffffff7}, {0x2, 0x0, 0x6}, {0x8000, 0xb, 0x5b}, {0x8, 0x7, 0x110a0}, {0x7e3, 0xfffffff9, 0xc3}]}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000ec0), 0xa0100, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000f00)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x7, 0x10f337, 0x350c52}) write$cgroup_subtree(r4, &(0x7f0000000f80)={[{0x2d, 'cpuacct'}]}, 0x9) (async) write$cgroup_subtree(r4, &(0x7f0000000f80)={[{0x2d, 'cpuacct'}]}, 0x9) migrate_pages(0xffffffffffffffff, 0xffffffff, &(0x7f0000000fc0)=0x6, &(0x7f0000001000)=0x5a) (async) migrate_pages(0xffffffffffffffff, 0xffffffff, &(0x7f0000000fc0)=0x6, &(0x7f0000001000)=0x5a) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000001140)=@multiplanar_userptr={0x81, 0x6, 0x4, 0x2, 0x8, {0x0, 0x2710}, {0x3, 0xc, 0x9, 0x2, 0x0, 0x6, "02be4ef8"}, 0x3, 0x2, {&(0x7f00000010c0)=[{0x5, 0x0, {&(0x7f0000001040)}, 0x3}, {0x9, 0x2, {&(0x7f0000001080)}, 0x401}]}, 0x0, 0x0, r5}) (async) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000001140)=@multiplanar_userptr={0x81, 0x6, 0x4, 0x2, 0x8, {0x0, 0x2710}, {0x3, 0xc, 0x9, 0x2, 0x0, 0x6, "02be4ef8"}, 0x3, 0x2, {&(0x7f00000010c0)=[{0x5, 0x0, {&(0x7f0000001040)}, 0x3}, {0x9, 0x2, {&(0x7f0000001080)}, 0x401}]}, 0x0, 0x0, r5}) sendto$inet(r6, &(0x7f00000011c0)="76fbb6be454974cc9e3f9bb7545fe37bc4b4af84f324517fec8deff526b13856b23238f5fb0fc34d8e634d73604ca0c5bf111421564a97e4575acc4dd78ff83acee3c9d985c4048fe8e76d4d96ce2a5c450800e283e90462789c7e3654f1cffa4783d470b5ac11", 0x67, 0x20000008, &(0x7f0000001240)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2a}}, 0x10) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r0, 0x4020aed2, &(0x7f0000001280)={0x1, 0x12000}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000015c0)={&(0x7f00000012c0)="bea452ff6d6a0b6423c3cd32a44bf4c68fb65306bea80fe5fad9586e8a9691d035d2ce8bf4c5ed89ed010077f6654983e86790342096039c334abc18e1fdb11f46a384d0e359b0319f640f9b223e07435632af28c68e37c72d6b238bbc51bfd2d8120c70f035fb650b740c51f571dae4799e37e9b358e3bcfa963e68b29b02f32dd15d40cc7c45626dfa43d09477df87109aadb8482b018863c0052ebf3ab42a548ac3b41998c28c834200859fa2e036b8a3532089c9642bbc", &(0x7f0000001380)=""/206, &(0x7f0000001480)="e58a1f79a12e0b9a7596e21eba23c8ebdd0a8df5466745919420a05f69254ba18788a61af617df", &(0x7f00000014c0)="d754cd1287fd142ab8d0a1c5e6b80f23e33340a006a8e9c98d92374d0441dfb12673742557e3a633b730152e7c4f780a452f69ea438b1940ce269908b0a01d9793a4209a6a66ba9ef56602b640983e91060d436d3bd7d12a86446c8363bfd41400027b63121605602d5d81010d14c1626e5c47b9cb62f040a244672fc0316d9120b1f859f22febd5976104402ee7c0bb5862d7cd8b7685a2541a8fb7158ca280eef49af3433440e0664586d25a4a950ac996ad150f72fde96179991d155c48a9966e8a683005d178aac8fb54b2cd29027ff8bfcbe917acd5f73e", 0x1, r2, 0x4}, 0x38) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000015c0)={&(0x7f00000012c0)="bea452ff6d6a0b6423c3cd32a44bf4c68fb65306bea80fe5fad9586e8a9691d035d2ce8bf4c5ed89ed010077f6654983e86790342096039c334abc18e1fdb11f46a384d0e359b0319f640f9b223e07435632af28c68e37c72d6b238bbc51bfd2d8120c70f035fb650b740c51f571dae4799e37e9b358e3bcfa963e68b29b02f32dd15d40cc7c45626dfa43d09477df87109aadb8482b018863c0052ebf3ab42a548ac3b41998c28c834200859fa2e036b8a3532089c9642bbc", &(0x7f0000001380)=""/206, &(0x7f0000001480)="e58a1f79a12e0b9a7596e21eba23c8ebdd0a8df5466745919420a05f69254ba18788a61af617df", &(0x7f00000014c0)="d754cd1287fd142ab8d0a1c5e6b80f23e33340a006a8e9c98d92374d0441dfb12673742557e3a633b730152e7c4f780a452f69ea438b1940ce269908b0a01d9793a4209a6a66ba9ef56602b640983e91060d436d3bd7d12a86446c8363bfd41400027b63121605602d5d81010d14c1626e5c47b9cb62f040a244672fc0316d9120b1f859f22febd5976104402ee7c0bb5862d7cd8b7685a2541a8fb7158ca280eef49af3433440e0664586d25a4a950ac996ad150f72fde96179991d155c48a9966e8a683005d178aac8fb54b2cd29027ff8bfcbe917acd5f73e", 0x1, r2, 0x4}, 0x38) fallocate(r8, 0x0, 0x2, 0x7) ioctl$TIOCNOTTY(r4, 0x5422) (async) ioctl$TIOCNOTTY(r4, 0x5422) syz_genetlink_get_family_id$ethtool(&(0x7f0000001600), r3) 5m31.299723087s ago: executing program 4 (id=1093): ioctl$KVM_GET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000180)) socket(0x25, 0x4, 0xff) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x100, 0x3, 0x1d}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000040)={&(0x7f0000001000), 0x0, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r0, 0x0, 0x0, 0x0, 0x40002202, 0x1, {0x1}}) io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreq(r4, 0x0, 0x7, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) unlink(&(0x7f0000000300)='./file0\x00') sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000cc0)}], 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x42280, 0x0) close(0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0xd, 0x0, 0xfe50) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f00000002c0)={0x4000}, 0x0) 5m31.22743026s ago: executing program 3 (id=1094): prlimit64(0x0, 0x6, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) set_mempolicy(0x2, &(0x7f0000000040)=0xd, 0x6) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x59032, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ac76d6af373a738c704d911567bc74e847a84d47d7bbb954e5722a1c305a037701aaf2637c4e26760312aa0afb365cbba978df5585ab4dc1a12eb86e607b282caec43f46136d30bc8c44750f41da4204847013d157fb48fea4485fd31773a96427dec1d944d0200c2e880533e3edc60017a51081611314f39c37d03e73ceaed290e98a6ce895f40635a9e8175752599e4546cb44043a6484198a8cffdb1dd1eba26ac6b8f7acb9ff7e9d221657a5c4ac2822c35839f97f7b8faa36869ac322ef34e90ebdaddb1d6040093e65b0cce7c38d35bdedcdf71f00"/254], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d2f, 0x0, 0x0, 0x1}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="5de91336eb7fda92137dc9949f0821db6c0cd2b7931ff268230e697244a1e0068164a422a9cfead4dbc94e6753970289b8af6a835253e93d271de197519598085a5220b93f7d950dd895f3836f84ccd248dce8426e5de1d450dc69f939fc8f5e0836aa6535bc9ca30d68d0d81bb883dfee05b2fca6c8b3fb38c196444b6cc2cbafdb4fbde02c777cf562f10f627d1f56bac9eed5d274a067d0984a1b106c459a29263a31", @ANYRESDEC=r3, @ANYRES16=r3, @ANYRES8=r6, @ANYRES16=r2, @ANYRES64, @ANYRESHEX=r4, @ANYRESHEX], 0x66) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="380000002b000b00000000000000000007000000040003000c0001800600040088480000130002006661756a656374696f6e00"], 0x38}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) read$msr(0xffffffffffffffff, &(0x7f0000002000)=""/102400, 0x19000) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_DROP(r1, 0x4143, 0x0) 5m29.396893806s ago: executing program 4 (id=1099): r0 = openat$binfmt_format(0xffffff9c, &(0x7f0000000500)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='lp\x00', 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b000000000000000000000000800000000000009b0e6f267e3e41c6830b9699f00876512bfa14708ba1a455d82fd4a43fe1583dd13be6ed76fb793830b472e7138dc8c5e000151fe9d822f0e4c6319426f52b3c817e08e0d79b592785d2bc3490d5891b0efa2eb8ecc5f4c813c693e2fd23c5f7df1ccb1623783894e8c5f174bc982875ffd29908c9e74c2775741576279dd1c48d6f96f9fc534da39047ed6d4001a4867406f49e6ea611cf478e00659ba2eecd21d2417884ea73", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES32], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0e00000004000000080000000800000000000000", @ANYRES32=0x0], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sched_switch\x00', r6}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r7, &(0x7f00000062c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000004200)={0x50, 0x0, r8, {0x7, 0x29, 0x0, 0x80000}}, 0x50) syz_fuse_handle_req(r7, &(0x7f00000042c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000970700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eeffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x20, 0x0, 0x400000000000, {0x0, 0x6}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) 5m25.984670199s ago: executing program 4 (id=1103): socket(0x2a, 0x0, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) gettid() syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0x118}, 0x1, 0x0, 0x0, 0x40000}, 0x24040040) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00') r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000280)=@gcm_128={{0x304}, "dc00", "acc1e9f9399482e5f29e9c10ca86c172", "84902b01", "1109361dd889ced6"}, 0x28) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000500)=ANY=[@ANYBLOB="00000000100000fb08"]) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x70, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x200000001300, 0x200000001330], 0x0, 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000000000000000000000000000000000000000000000000000000000006bad87fa6c7472c5ec9140cd0064e3a700000000000000ffffffff00"/144]}, 0x108) fsmount(0xffffffffffffffff, 0x1, 0x7f) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f00000000c0)={0x80, 0x13, 0x300, 0x0, 0x0, 0xfffe, 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="752f7bd9024523cb72141fbcc37b7899df3225ddb1c232f590df5f96070387decbc52d76a505cd472abdf41ba8b4fc6c9a73092a15ddd135bafb74cd9c31e4af6c8534e345d7a001d125f8dd324f7da1fcd17acbf2"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r5, 0x0, 0xd}, 0x18) 5m14.088043294s ago: executing program 33 (id=1094): prlimit64(0x0, 0x6, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) set_mempolicy(0x2, &(0x7f0000000040)=0xd, 0x6) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x59032, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ac76d6af373a738c704d911567bc74e847a84d47d7bbb954e5722a1c305a037701aaf2637c4e26760312aa0afb365cbba978df5585ab4dc1a12eb86e607b282caec43f46136d30bc8c44750f41da4204847013d157fb48fea4485fd31773a96427dec1d944d0200c2e880533e3edc60017a51081611314f39c37d03e73ceaed290e98a6ce895f40635a9e8175752599e4546cb44043a6484198a8cffdb1dd1eba26ac6b8f7acb9ff7e9d221657a5c4ac2822c35839f97f7b8faa36869ac322ef34e90ebdaddb1d6040093e65b0cce7c38d35bdedcdf71f00"/254], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d2f, 0x0, 0x0, 0x1}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="5de91336eb7fda92137dc9949f0821db6c0cd2b7931ff268230e697244a1e0068164a422a9cfead4dbc94e6753970289b8af6a835253e93d271de197519598085a5220b93f7d950dd895f3836f84ccd248dce8426e5de1d450dc69f939fc8f5e0836aa6535bc9ca30d68d0d81bb883dfee05b2fca6c8b3fb38c196444b6cc2cbafdb4fbde02c777cf562f10f627d1f56bac9eed5d274a067d0984a1b106c459a29263a31", @ANYRESDEC=r3, @ANYRES16=r3, @ANYRES8=r6, @ANYRES16=r2, @ANYRES64, @ANYRESHEX=r4, @ANYRESHEX], 0x66) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="380000002b000b00000000000000000007000000040003000c0001800600040088480000130002006661756a656374696f6e00"], 0x38}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) read$msr(0xffffffffffffffff, &(0x7f0000002000)=""/102400, 0x19000) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_DROP(r1, 0x4143, 0x0) 5m10.701232046s ago: executing program 34 (id=1103): socket(0x2a, 0x0, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) gettid() syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0x118}, 0x1, 0x0, 0x0, 0x40000}, 0x24040040) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00') r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000280)=@gcm_128={{0x304}, "dc00", "acc1e9f9399482e5f29e9c10ca86c172", "84902b01", "1109361dd889ced6"}, 0x28) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000500)=ANY=[@ANYBLOB="00000000100000fb08"]) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x70, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x200000001300, 0x200000001330], 0x0, 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000000000000000000000000000000000000000000000000000000000006bad87fa6c7472c5ec9140cd0064e3a700000000000000ffffffff00"/144]}, 0x108) fsmount(0xffffffffffffffff, 0x1, 0x7f) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f00000000c0)={0x80, 0x13, 0x300, 0x0, 0x0, 0xfffe, 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="752f7bd9024523cb72141fbcc37b7899df3225ddb1c232f590df5f96070387decbc52d76a505cd472abdf41ba8b4fc6c9a73092a15ddd135bafb74cd9c31e4af6c8534e345d7a001d125f8dd324f7da1fcd17acbf2"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r5, 0x0, 0xd}, 0x18) 1m23.679631094s ago: executing program 6 (id=2349): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xe}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x4040100}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x60240) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x8417f, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x4004000}, 0x2000001) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xfc}}, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) fadvise64(r6, 0x0, 0x7ffc, 0x4) syz_usb_control_io(r5, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000140)=ANY=[@ANYRES32=r6, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xc0145b0e, &(0x7f0000000040)) 1m19.955173303s ago: executing program 6 (id=2383): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x18, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m19.784907079s ago: executing program 6 (id=2385): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 1m19.609071681s ago: executing program 6 (id=2387): r0 = epoll_create1(0x80000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/power/wakeup_count', 0x80800, 0x8) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0xe000001a}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000000200)) 1m19.240739845s ago: executing program 6 (id=2389): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb0}}, 0x0) 1m19.088875018s ago: executing program 6 (id=2395): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) lseek(r0, 0x2, 0x3) 1m3.794629695s ago: executing program 35 (id=2395): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) lseek(r0, 0x2, 0x3) 6.852817757s ago: executing program 0 (id=2909): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000a80)={0xffffffffffffffff}) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xae, 0x9a, 0x15, 0x20, 0xa07, 0x64, 0xeae3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x4, 0x40, 0x20, 0x0, [{{0x9, 0x4, 0x81, 0x8, 0x1, 0xe2, 0xbb, 0xa0, 0x1, [], [{{0x9, 0x5, 0xe, 0x10, 0x3ff, 0xed, 0x7, 0xe}}]}}]}}]}}, 0x0) sendmmsg(r0, &(0x7f0000008dc0), 0x0, 0x4009811) recvmmsg(r0, &(0x7f00000046c0), 0x0, 0x40010043, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) io_setup(0x9073, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r1 = accept$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, '\x00', 0xd}, 0xdcf}, 0x1c) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_test', 0x40042, 0x101) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x100, 0x4, 0x1d}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000040)={0x0, 0x0, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r2, 0x0, 0x0, 0x0, 0x40002202, 0x1, {0x3}}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 5.324829655s ago: executing program 0 (id=2919): r0 = syz_open_dev$mouse(&(0x7f0000000040), 0x3, 0x2042) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) syz_usb_connect(0x6, 0x2d, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='coredump_filter\x00') epoll_create1(0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x1000000a, 0x8002, 0x2, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, 0x0, 0x0) 3.888774586s ago: executing program 8 (id=2934): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x64, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_ACT={0x30, 0x1, [@m_ct={0x2c, 0x11, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200000038000480340001800b00010074617267657400002400028010000100434f4e4e5345434d41524b0005000300ef00000008000240000000000900010073797a30000000000900020073797a3200000000140005"], 0xa0}}, 0x14b6deac033214c2) 3.547463419s ago: executing program 8 (id=2935): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xbe, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x24, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x76, 0x0, [{0x0, 0xc, "e256b28c590300000052"}, {0x0, 0x9, "020007651442eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a05a0dc91e5c6"}, {0x0, 0x9, "00000000008000"}, {0x0, 0x12, "73bc23f9ffffffa30900a301c8460000"}, {0x0, 0x12, "c8f46976e79ea788f03d9d3205927e3d"}]}, @cipso={0x86, 0x6, 0x20}]}}, "a3d50542"}}}}}, 0x0) 3.357417762s ago: executing program 8 (id=2938): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x4, 0x4, 0x4, 0xbf25}, 0x48) close_range(0xffffffffffffffff, r0, 0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 3.246795321s ago: executing program 7 (id=2939): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) dup2(r1, r0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f00000014c0)={0x0, &(0x7f0000001400)}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/address_bits', 0x0, 0x0) fcntl$notify(r5, 0x402, 0x8) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x3, 0xfa, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513", &(0x7f00000001c0)=""/4103, 0x0, 0x0, 0x0, 0x0}) 3.224793999s ago: executing program 5 (id=2940): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 3.132783746s ago: executing program 8 (id=2941): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x30004081) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r1}, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000a80)=""/20, 0x14}], 0x1}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000480)={r3, &(0x7f0000000440)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 3.056821088s ago: executing program 5 (id=2942): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x8, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xc}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_QUANTUM={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 2.967778693s ago: executing program 5 (id=2943): syz_open_dev$usbmon(&(0x7f00000000c0), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(0x0, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) r1 = socket(0x1d, 0x2, 0x6) r2 = syz_io_uring_setup(0x239, &(0x7f0000000300)={0x0, 0x200000, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r0, 0x4018aee1, &(0x7f0000000200)=@attr_pmu_filter={0x0, 0x1, 0x1, &(0x7f0000000140)={0xf83a, 0x1, 0x1}}) io_uring_enter(r2, 0x2def, 0x4000, 0x0, 0x0, 0x0) sendmsg$inet(r1, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x14, 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000180)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x9, 0x81, 0x0, 0x0, 0xfffffff7, 0x5, 0x3, 0x37f2, 0x8, 0x0}) 2.839383554s ago: executing program 5 (id=2944): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000300)={{0x0, 0x4, 0x2, 0x2009}, 'syz1\x00', 0xc}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) unshare(0x28020480) r4 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r4, 0x5451, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x4, 0x0, 0x3}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/unix\x00') mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFCONF(r5, 0x8912, 0x0) io_uring_enter(0xffffffffffffffff, 0x14, 0xb9c, 0x3, 0x0, 0xffffffd5) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0x9, 0xd, {0x2, 0xdac}, {0x9, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x6}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]}) 2.808953714s ago: executing program 7 (id=2945): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) close(r0) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x100000e, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000180)="5e73663bf4082f7c6c9ecbf09d6dd7be5a06dfd645630500c1a303434a36bfc45a7badc8faed24bb77c848723a43602d1fe0d236c062e105ec77ffdc0fb243c3111dda42112650cc", 0x0, 0x48) read(r0, &(0x7f0000000100)=""/71, 0x47) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) gettid() 2.708298673s ago: executing program 7 (id=2946): socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x2100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7, 0x2f, 0x0, @empty, @multicast1}}}}) gettid() setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x250, 0x0, 0xffffffff, 0xffffffff, 0x100, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'batadv0\x00', 'batadv_slave_0\x00', {}, {}, 0x21}, 0x6, 0xa0, 0x100, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[], [], 0x0, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [], 0x5}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x3], 0x5}}}}, {{@ip={@empty, @remote, 0x0, 0x0, 'veth0_virt_wifi\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0x98, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0) sched_setscheduler(0x0, 0x0, &(0x7f0000000200)=0xfffffffe) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000004fe) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 2.084426s ago: executing program 8 (id=2949): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone3(&(0x7f0000000180)={0x80000000, 0x0, 0x0, 0x0, {0x1b}, 0x0, 0x0, 0x0, 0x0}, 0x58) bind$alg(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r4, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x14) getsockopt(r3, 0x40, 0x8000, &(0x7f0000000200)=""/83, &(0x7f00000002c0)=0x53) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000003200)=@newtfilter={0x34, 0x28, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r7, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1.913342192s ago: executing program 0 (id=2950): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) mmap$fb(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0xd8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad724a1"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000780)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000006c0)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x3d}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x36}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 1.708993045s ago: executing program 5 (id=2952): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb60000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x10, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x39, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x5, 0x9, 0x1}, 0x48) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x6}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r0}, 0x10) 1.412875731s ago: executing program 5 (id=2953): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x53, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0x80015b18, 0x0) 1.357771348s ago: executing program 0 (id=2954): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x1000}, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000340)="1400", 0x2}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) 1.236148484s ago: executing program 7 (id=2955): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='nv\x00', 0x3) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003bc0)=[{{0x0, 0x0, &(0x7f0000003700)=[{&(0x7f00000024c0)="c354cd46de81", 0x6}, {0x0}], 0x2}}], 0x1, 0x48800) shutdown(r0, 0x2) 1.104807202s ago: executing program 7 (id=2956): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000400)={0x2020}, 0x2020) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r4, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000500)={0x28, 0x6, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x80000001}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r4}) 635.811563ms ago: executing program 8 (id=2957): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f010400000009058303"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000300)={0x50, 0xffff, 0x0, {0x0, 0x68bd}, {}, @cond=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) 445.643585ms ago: executing program 2 (id=2958): bind$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4, 0x0, @loopback={0x2d21}}}, {0x12, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x6c}}, 0x0) 332.953772ms ago: executing program 2 (id=2959): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x30004081) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r1}, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000a80)=""/20, 0x14}], 0x1}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000480)={r3, &(0x7f0000000440)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 317.268736ms ago: executing program 2 (id=2960): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000010000000458000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006", 0x4d}], 0x1) 309.158535ms ago: executing program 0 (id=2961): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xb2, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xa4, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x21, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x67, 0x0, [{0x0, 0xc, "e256b28c590300000052"}, {0x0, 0x9, "020007651442eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0xa, "0000000000800000"}, {0x0, 0x12, "73bc23f9ffffffa30900a301c8460000"}, {0x0, 0x12, "c8f46976e79ea788f03d9d3205927e3d"}]}, @cipso={0x86, 0x6, 0x20}]}}, "a3d50542"}}}}}, 0x0) 241.200726ms ago: executing program 7 (id=2962): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000300)={{0x0, 0x4, 0x2, 0x2009}, 'syz1\x00', 0xc}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) unshare(0x28020480) r4 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r4, 0x5451, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x4, 0x0, 0x3}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/unix\x00') mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFCONF(r5, 0x8912, 0x0) io_uring_enter(0xffffffffffffffff, 0x14, 0xb9c, 0x3, 0x0, 0xffffffd5) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0x9, 0xd, {0x2, 0xdac}, {0x9, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x6}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]}) 210.290679ms ago: executing program 0 (id=2963): r0 = syz_io_uring_setup(0x131, &(0x7f0000000340)={0x0, 0x5cb1, 0x2, 0x3, 0xfffffffd}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x16, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x5031, 0xffffffffffffffff, 0xc2dcc000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x7, 0x0, &(0x7f0000000080)="f4b84de4115d64", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r0, 0x1e76, 0xf728, 0x5, 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000b00)=0x6) read(r4, &(0x7f0000000a40)=""/141, 0x8d) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc4c85513, &(0x7f0000000540)={{0x1, 0x0, 0x800, 0x0, 'syz0\x00', 0xa7d}, 0x0, [0xfffffffffffffe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x20000000000000, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffff6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd0f, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3e56, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000740)='wlan0\x00', 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r5 = io_uring_setup(0x4a5e, &(0x7f0000000140)={0x0, 0x0, 0x400, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e22, @broadcast}, 0x10) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000300)="18", 0x1) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000100), 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000000000006110b000000000001c010000000d000095000085eb000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) execve(&(0x7f0000000480)='./file0\x00', &(0x7f0000000c80)={[&(0x7f00000004c0)='\x00', 0x0, &(0x7f0000000b40)='@\'^\x00', &(0x7f0000000b80)='\'+:[\x00', &(0x7f0000000bc0)='/dev/snd/controlC#\x00', &(0x7f0000000c00)='/dev/snd/controlC#\x00', &(0x7f0000000c40)='&+,\xd6\x00']}, &(0x7f0000000e40)={[&(0x7f0000000cc0)='\x00', &(0x7f0000000d00)='\'\x00', &(0x7f0000000d40)='\x00', &(0x7f0000000d80)='\x00', &(0x7f0000000dc0)='syz0\x00', &(0x7f0000000e00)='})\xcd\\\x00']}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r6, 0xc400941d, &(0x7f0000000080)={0x0, 0x2, 0x400}) 169.766392ms ago: executing program 2 (id=2964): r0 = syz_open_dev$sndctrl(&(0x7f00000001c0), 0x2, 0x141002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='rdma.current\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000300)=ANY=[@ANYRESOCT, @ANYBLOB="d48e4a850285756bbff715d976d353e4bf489f4a3344da3210a6d6335b52d45b2e9698f256e434fb990e8d29eff11141b9eda6ef6180d99a6fea3bfc6e561913e13ca07528bef1c24b74ff39fd674ee87ee27b284018328c16e69808cc25e85a038ad16cd0a2f57686e51be79a9d262f"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0xc0045543, &(0x7f0000000080)) 75.883877ms ago: executing program 2 (id=2965): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x3, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0900000002000000020000000400000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/18], 0x50) 0s ago: executing program 2 (id=2966): socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x2100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7, 0x2f, 0x0, @empty, @multicast1}}}}) gettid() setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x250, 0x0, 0xffffffff, 0xffffffff, 0x100, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'batadv0\x00', 'batadv_slave_0\x00', {}, {}, 0x21}, 0x6, 0xa0, 0x100, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[], [], 0x0, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [], 0x5}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x3], 0x5}}}}, {{@ip={@empty, @remote, 0x0, 0x0, 'veth0_virt_wifi\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0x98, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0) sched_setscheduler(0x0, 0x0, &(0x7f0000000200)=0xfffffffe) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000004fe) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): h. [ 483.596885][T12139] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1439'. [ 483.636029][T12134] netlink: 'syz.6.1440': attribute type 1 has an invalid length. [ 484.073948][T12155] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1442'. [ 484.176522][T12149] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1441'. [ 484.827265][T12168] input: syz1 as /devices/virtual/input/input20 [ 485.801651][T12179] binder: BINDER_SET_CONTEXT_MGR already set [ 485.927254][T12179] binder: 12177:12179 ioctl 4018620d 200000000040 returned -16 [ 485.959244][T12179] binder: 12177:12179 ioctl c0306201 200000000240 returned -11 [ 487.294253][T10634] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 487.618084][T10634] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 487.659518][T10634] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 487.685948][T10634] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 487.705269][T10634] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 487.712960][T12227] SELinux: syz.6.1455 (12227) set checkreqprot to 1. This is no longer supported. [ 487.715141][ T30] audit: type=1400 audit(1753005737.016:575): avc: denied { setcheckreqprot } for pid=12225 comm="syz.6.1455" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 487.750299][T10634] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.780785][T10634] usb 3-1: Product: syz [ 487.793688][T10634] usb 3-1: Manufacturer: syz [ 487.812067][T10634] usb 3-1: SerialNumber: syz [ 487.823710][T12232] syz_tun: Device is already in use. [ 488.345768][T10634] cdc_ncm 3-1:1.0: bind() failure [ 488.389126][T10634] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 488.405480][T10634] cdc_ncm 3-1:1.1: bind() failure [ 488.429755][T10634] usb 3-1: USB disconnect, device number 44 [ 489.191289][T12254] binder: 12253:12254 ioctl 4018620d 0 returned -22 [ 489.217108][T12254] binder: 12253:12254 ioctl c0306201 200000000240 returned -11 [ 489.874268][T12271] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1465'. [ 490.468706][T12287] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 490.854822][ T2338] pvrusb2: request_firmware fatal error with code=-110 [ 490.861737][ T2338] pvrusb2: Failure uploading firmware1 [ 490.906425][ T2338] pvrusb2: Device initialization was not successful. [ 490.917372][ T2338] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 490.953666][ T2338] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 490.988670][ T10] pvrusb2: Device being rendered inoperable [ 491.632226][T12308] xt_cgroup: invalid path, errno=-2 [ 492.252788][T12322] binder: 12321:12322 ioctl 4018620d 0 returned -22 [ 492.650729][T12322] binder: 12321:12322 ioctl c0306201 200000000240 returned -11 [ 493.172648][T12341] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1479'. [ 493.415213][T12346] block nbd0: shutting down sockets [ 493.719808][ T30] audit: type=1326 audit(1753005743.026:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 493.724563][ T5866] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 493.743272][ C0] vkms_vblank_simulate: vblank timer overrun [ 493.854191][ T30] audit: type=1326 audit(1753005743.026:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 493.877696][ C0] vkms_vblank_simulate: vblank timer overrun [ 494.006233][ T30] audit: type=1326 audit(1753005743.026:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.029616][ C0] vkms_vblank_simulate: vblank timer overrun [ 494.067176][ T5866] usb 6-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 494.086436][ T5866] usb 6-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 494.094576][ T30] audit: type=1326 audit(1753005743.026:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094617][ T30] audit: type=1326 audit(1753005743.026:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094656][ T30] audit: type=1326 audit(1753005743.026:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094692][ T30] audit: type=1326 audit(1753005743.026:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=249 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094730][ T30] audit: type=1326 audit(1753005743.026:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094767][ T30] audit: type=1326 audit(1753005743.026:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.094805][ T30] audit: type=1326 audit(1753005743.026:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12352 comm="syz.0.1484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d58f8e9a9 code=0x7ffc0000 [ 494.133083][T12367] binder: 12366:12367 ioctl 4018620d 0 returned -22 [ 494.143416][ T5866] usb 6-1: Product: syz [ 494.216620][T12369] No such timeout policy "syz0" [ 494.244972][ T5866] usb 6-1: Manufacturer: syz [ 494.260827][ C0] vkms_vblank_simulate: vblank timer overrun [ 494.302410][T12367] binder: 12366:12367 ioctl c0306201 200000000240 returned -11 [ 494.382354][ T5866] usb 6-1: SerialNumber: syz [ 494.755507][ T5866] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 494.955391][ T5866] vp7045: USB control message 'out' went wrong. [ 494.974263][ T5866] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 495.034526][ T5866] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 495.117315][ T5866] usb 6-1: USB disconnect, device number 30 [ 495.423249][T12387] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12387 comm=syz.2.1495 [ 496.650767][T12408] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 497.094466][T12417] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12417 comm=syz.0.1501 [ 497.551110][T12421] ntfs3(nullb0): Primary boot signature is not NTFS. [ 497.558563][T12421] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 498.280603][T12424] wg1 speed is unknown, defaulting to 1000 [ 500.210069][T12447] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1508'. [ 500.357930][T12449] xt_CT: You must specify a L4 protocol and not use inversions on it [ 500.680433][T12447] bridge_slave_1: left allmulticast mode [ 500.691032][T12447] bridge_slave_1: left promiscuous mode [ 500.703731][T12447] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.719315][T12447] bridge_slave_0: left allmulticast mode [ 500.727040][T12447] bridge_slave_0: left promiscuous mode [ 500.733385][T12447] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.783990][T12458] zonefs (nbd0) ERROR: Not a zoned block device [ 500.983126][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.989552][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.007113][T12460] xt_CT: No such helper "pptp" [ 502.746941][T12468] wg1 speed is unknown, defaulting to 1000 [ 503.054386][T12462] Bluetooth: hci5: command 0x0406 tx timeout [ 503.600351][T12472] wg1 speed is unknown, defaulting to 1000 [ 506.870629][T12498] wg1 speed is unknown, defaulting to 1000 [ 508.236451][T12517] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1526'. [ 508.261353][T12517] bridge_slave_1: left allmulticast mode [ 508.281081][T12517] bridge_slave_1: left promiscuous mode [ 508.337732][T12517] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.362486][T12517] bridge_slave_0: left allmulticast mode [ 508.369619][T12517] bridge_slave_0: left promiscuous mode [ 508.382282][T12517] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.383525][T12519] binder: 12518:12519 ioctl c0306201 200000000240 returned -11 [ 508.484268][T10786] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 508.736823][T10786] usb 1-1: Using ep0 maxpacket: 8 [ 508.885935][T10786] usb 1-1: unable to get BOS descriptor or descriptor too short [ 508.896625][T10786] usb 1-1: config 1 has an invalid interface number: 65 but max is 0 [ 508.929418][T10786] usb 1-1: config 1 has no interface number 0 [ 508.944998][T10786] usb 1-1: config 1 interface 65 has no altsetting 0 [ 508.977702][T10786] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice=2b.cd [ 508.986958][T10786] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.014181][T10786] usb 1-1: Product: syz [ 509.019433][T10786] usb 1-1: Manufacturer: syz [ 509.026422][T10786] usb 1-1: SerialNumber: syz [ 509.176597][T12529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1531'. [ 509.184360][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 509.184372][ T30] audit: type=1400 audit(1753005758.496:595): avc: denied { ioctl } for pid=12527 comm="syz.2.1531" path="socket:[34621]" dev="sockfs" ino=34621 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 509.218674][T12529] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1531'. [ 509.232965][T12529] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.242187][T12529] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.251759][T12529] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.261398][T12529] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.270910][T12515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.281445][T12531] binder: 12525:12531 unknown command 0 [ 509.287096][T12531] binder: 12525:12531 ioctl c0306201 200000000300 returned -22 [ 509.289187][T12515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.304298][T12529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1531'. [ 509.328249][T10786] kalmia 1-1:1.65 (unnamed net_device) (uninitialized): Error sending init packet. Status -22 [ 509.344816][T10786] kalmia 1-1:1.65: probe with driver kalmia failed with error -22 [ 509.359104][T10786] usb 1-1: USB disconnect, device number 29 [ 509.393106][T12529] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1531'. [ 509.600905][T12544] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1535'. [ 509.791727][T12550] binder: 12547:12550 ioctl c0306201 200000000240 returned -11 [ 509.826400][T12552] binder: 12551:12552 ioctl c0306201 200000000240 returned -11 [ 509.892470][T12553] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1538'. [ 511.558553][T12578] Trying to write to read-only block-device nullb0 [ 511.716863][T12579] trusted_key: encrypted_key: insufficient parameters specified [ 511.899813][T12585] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 511.910733][T12588] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1547'. [ 512.072080][T12592] binder: BINDER_SET_CONTEXT_MGR already set [ 512.084644][T12592] binder: 12591:12592 ioctl 4018620d 200000000040 returned -16 [ 512.092328][ T30] audit: type=1400 audit(1753005761.396:596): avc: denied { ioctl } for pid=12583 comm="syz.0.1549" path="socket:[35870]" dev="sockfs" ino=35870 ioctlcmd=0x891c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 512.120366][T12592] binder: 12591:12592 ioctl c0306201 200000000240 returned -11 [ 512.843547][T12611] netlink: 'syz.6.1557': attribute type 10 has an invalid length. [ 512.934920][T12611] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 513.830778][T12624] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 513.857085][T12624] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 514.174754][T12631] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12631 comm=syz.5.1562 [ 514.501626][ T30] audit: type=1400 audit(1753005763.806:597): avc: denied { link } for pid=12633 comm="syz.0.1565" name="file1" dev="tmpfs" ino=1757 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 515.141236][T12639] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1564'. [ 515.152194][ T30] audit: type=1400 audit(1753005764.026:598): avc: denied { connect } for pid=12633 comm="syz.0.1565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 515.323398][T12641] wg1 speed is unknown, defaulting to 1000 [ 515.510184][ T30] audit: type=1400 audit(1753005764.816:599): avc: denied { map } for pid=12645 comm="syz.0.1568" path="/dev/video0" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 515.555262][T12642] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 515.555367][ T30] audit: type=1400 audit(1753005764.816:600): avc: denied { execute } for pid=12645 comm="syz.0.1568" path="/dev/video0" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 515.596969][ C0] vkms_vblank_simulate: vblank timer overrun [ 515.920385][T12654] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12654 comm=syz.0.1570 [ 516.244390][T12659] ptrace attach of "./syz-executor exec"[10461] was attempted by "./syz-executor exec"[12659] [ 517.364301][ T10] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 517.662713][T12677] binder_alloc: 12676: binder_alloc_buf, no vma [ 517.696393][ T30] audit: type=1400 audit(1753005767.006:601): avc: denied { bind } for pid=12676 comm="syz.7.1577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 517.754882][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 517.796015][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 517.817792][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 517.867440][ T10] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 517.938156][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 517.969029][T12680] netlink: 165 bytes leftover after parsing attributes in process `syz.0.1578'. [ 517.971792][ T10] usb 7-1: config 0 descriptor?? [ 519.409472][T10634] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 519.538944][T12700] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1056 sclass=netlink_route_socket pid=12700 comm=syz.7.1584 [ 519.684262][T10634] usb 3-1: Using ep0 maxpacket: 16 [ 519.696112][T10634] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 519.739242][T10634] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 519.749961][T10634] usb 3-1: config 0 interface 0 has no altsetting 0 [ 519.758715][T10634] usb 3-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 519.777131][T10634] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.807681][T10634] usb 3-1: config 0 descriptor?? [ 519.815457][T12706] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=640 (1280 ns) > initial count (34 ns). Using initial count to start timer. [ 519.984422][T10786] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 520.215402][ T10] usbhid 7-1:0.0: can't add hid device: -71 [ 520.221432][ T10] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 520.306950][ T10] usb 7-1: USB disconnect, device number 12 [ 520.365987][T10786] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 520.517715][T10786] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 520.528297][T10786] usb 6-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 520.538004][T10786] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.555972][T10786] usb 6-1: config 0 descriptor?? [ 520.562848][T10634] cougar 0003:060B:500A.000B: usage count exceeds max: fixing up report descriptor [ 520.573470][T10634] cougar 0003:060B:500A.000B: unexpected long global item [ 520.581332][T10634] cougar 0003:060B:500A.000B: parse failed [ 520.587503][T10634] cougar 0003:060B:500A.000B: probe with driver cougar failed with error -22 [ 520.608464][T12716] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1 sclass=netlink_route_socket pid=12716 comm=syz.6.1588 [ 520.640745][T12718] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 520.778722][ T30] audit: type=1400 audit(1753005770.086:602): avc: denied { lock } for pid=12682 comm="syz.2.1581" path="socket:[36224]" dev="sockfs" ino=36224 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 520.799690][T12684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.827766][T12684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.856390][ T92] usb 3-1: USB disconnect, device number 45 [ 520.968210][T10786] wacom 0003:056A:033B.000C: unknown main item tag 0x0 [ 520.980662][T10786] wacom 0003:056A:033B.000C: unbalanced delimiter at end of report description [ 520.990191][T10786] wacom 0003:056A:033B.000C: parse failed [ 520.996328][T10786] wacom 0003:056A:033B.000C: probe with driver wacom failed with error -22 [ 522.150219][T12728] wg1 speed is unknown, defaulting to 1000 [ 523.228724][T10786] usb 6-1: USB disconnect, device number 31 [ 523.699986][T12740] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1595'. [ 524.103010][T12750] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 525.089675][T12774] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 525.204280][ T880] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 525.365815][ T880] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 525.529054][ T880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 525.771175][ T880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 525.807003][ T880] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 525.848820][ T880] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 525.860102][ T880] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.116587][ T880] usb 1-1: config 0 descriptor?? [ 526.561088][ T880] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 526.629030][T12800] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1609'. [ 526.674259][T12800] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1609'. [ 526.706562][T12800] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1609'. [ 526.884261][ T880] usb 1-1: USB disconnect, device number 30 [ 527.101241][T12816] misc userio: Begin command sent, but we're already running [ 527.494216][ T880] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 527.682333][ T880] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 527.701792][ T880] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 527.717577][ T880] usb 7-1: config 0 interface 0 has no altsetting 0 [ 527.726068][ T880] usb 7-1: New USB device found, idVendor=054c, idProduct=03d5, bcdDevice= 0.00 [ 527.737995][ T880] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.778761][ T880] usb 7-1: config 0 descriptor?? [ 528.236794][ T880] usbhid 7-1:0.0: can't add hid device: -71 [ 528.250723][ T880] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 528.331673][T12836] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (comedi_parport) [ 528.342489][ T880] usb 7-1: USB disconnect, device number 13 [ 528.414238][ T92] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 528.614835][ T92] usb 3-1: Using ep0 maxpacket: 16 [ 528.653379][T12842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1619'. [ 529.049500][ T92] usb 3-1: config 0 has no interfaces? [ 529.057721][ T92] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 529.084575][ T92] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.102953][ T92] usb 3-1: Product: syz [ 529.132754][ T92] usb 3-1: Manufacturer: syz [ 529.149394][ T92] usb 3-1: SerialNumber: syz [ 529.170306][ T92] usb 3-1: config 0 descriptor?? [ 529.192724][T12848] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1620'. [ 529.384181][ T880] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 529.384295][ T92] usb 3-1: USB disconnect, device number 46 [ 529.503800][T12862] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1623'. [ 529.544691][ T880] usb 6-1: Using ep0 maxpacket: 32 [ 529.572807][ T880] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 529.583014][ T880] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 529.635970][ T880] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 529.645346][ T880] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 529.653594][ T880] usb 6-1: Product: syz [ 529.658732][ T880] usb 6-1: Manufacturer: syz [ 529.663615][ T880] usb 6-1: SerialNumber: syz [ 529.671841][ T880] usb 6-1: config 0 descriptor?? [ 529.699911][ T880] hub 6-1:0.0: bad descriptor, ignoring hub [ 529.746392][ T880] hub 6-1:0.0: probe with driver hub failed with error -5 [ 530.466559][T10634] usb 6-1: USB disconnect, device number 32 [ 530.474171][ T880] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 530.680990][T12902] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 530.693976][T12902] trusted_key: encrypted_key: master key parameter '00N004093' is invalid [ 531.222241][T12910] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 531.448920][T12920] Unknown options in mask 5 [ 531.570863][T12920] SELinux: failure in selinux_parse_skb(), unable to parse packet [ 531.962517][ T5978] Bluetooth: hci4: Frame reassembly failed (-84) [ 531.992102][T12927] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1635'. [ 532.184398][ T880] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 532.354158][ T880] usb 3-1: device descriptor read/64, error -71 [ 532.648621][ T880] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 532.902043][ T880] usb 3-1: device descriptor read/64, error -71 [ 533.087856][ T880] usb usb3-port1: attempt power cycle [ 533.414649][T12954] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12954 comm=syz.0.1644 [ 533.604416][ T880] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 533.724616][ T880] usb 3-1: device descriptor read/8, error -71 [ 533.984258][ T51] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 533.996231][ T880] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 534.186776][ T880] usb 3-1: device descriptor read/8, error -71 [ 534.305531][ T880] usb usb3-port1: unable to enumerate USB device [ 534.779444][ T30] audit: type=1400 audit(1753005784.086:603): avc: denied { setattr } for pid=12970 comm="syz.7.1650" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 534.889066][ T880] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 535.046164][ T880] usb 1-1: device descriptor read/64, error -71 [ 535.295164][ T880] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 535.444386][ T880] usb 1-1: device descriptor read/64, error -71 [ 535.540010][T12993] binder: 12991:12993 ioctl c0306201 0 returned -14 [ 535.548089][T12993] binder: 12991:12993 ioctl c0306201 200000000240 returned -11 [ 535.571081][ T880] usb usb1-port1: attempt power cycle [ 535.745207][T12998] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=12998 comm=syz.6.1658 [ 536.092450][T13003] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60432 sclass=netlink_route_socket pid=13003 comm=syz.2.1659 [ 536.175074][ T880] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 536.330581][ T880] usb 1-1: device descriptor read/8, error -71 [ 536.584294][ T880] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 536.618680][ T30] audit: type=1400 audit(1753005785.926:604): avc: denied { unmount } for pid=10487 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 536.654713][ T880] usb 1-1: device descriptor read/8, error -71 [ 536.764585][ T880] usb usb1-port1: unable to enumerate USB device [ 536.928164][ T30] audit: type=1400 audit(1753005786.236:605): avc: denied { name_connect } for pid=13026 comm="syz.6.1673" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 537.339019][T13054] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1683'. [ 537.368128][T13051] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1683'. [ 537.386994][T13051] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1683'. [ 537.408692][T13057] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1685'. [ 538.418303][ T30] audit: type=1400 audit(1753005787.726:606): avc: denied { name_connect } for pid=13102 comm="syz.6.1706" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 538.565709][T13113] netlink: 'syz.5.1709': attribute type 13 has an invalid length. [ 538.594157][T13113] netlink: 164 bytes leftover after parsing attributes in process `syz.5.1709'. [ 540.294308][T13152] netlink: 'syz.6.1726': attribute type 10 has an invalid length. [ 540.302165][T13152] netlink: 2 bytes leftover after parsing attributes in process `syz.6.1726'. [ 540.316036][T13152] bond0: entered promiscuous mode [ 540.333458][T13152] bond_slave_0: entered promiscuous mode [ 540.366394][T13152] bond_slave_1: entered promiscuous mode [ 540.391515][T13152] mac80211_hwsim hwsim22 wlan1: entered promiscuous mode [ 540.436268][T13152] bridge0: port 3(bond0) entered blocking state [ 540.442669][T13152] bridge0: port 3(bond0) entered disabled state [ 540.457589][T13152] bond0: entered allmulticast mode [ 540.462739][T13152] bond_slave_0: entered allmulticast mode [ 540.488259][T13152] bond_slave_1: entered allmulticast mode [ 540.511889][T13152] mac80211_hwsim hwsim22 wlan1: entered allmulticast mode [ 540.537365][T13152] bridge0: port 3(bond0) entered blocking state [ 540.543758][T13152] bridge0: port 3(bond0) entered forwarding state [ 540.750514][ T30] audit: type=1400 audit(1753005790.056:607): avc: denied { write } for pid=13179 comm="syz.6.1739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 540.894389][T13186] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 541.793929][T13232] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1765'. [ 541.830120][T13233] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1764'. [ 541.867795][T13230] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1764'. [ 541.913337][T13234] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1764'. [ 542.598194][ T30] audit: type=1400 audit(1753005791.906:608): avc: denied { relabelfrom } for pid=13275 comm="syz.6.1786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 542.622473][ T30] audit: type=1400 audit(1753005791.926:609): avc: denied { relabelto } for pid=13275 comm="syz.6.1786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 543.168383][T13301] netlink: 'syz.2.1793': attribute type 2 has an invalid length. [ 543.181731][T13301] netlink: 'syz.2.1793': attribute type 1 has an invalid length. [ 543.194608][T13301] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.1793'. [ 543.205149][T13301] nbd: illegal input index -404748436 [ 544.771787][ T30] audit: type=1400 audit(1753005794.076:610): avc: denied { watch } for pid=13341 comm="syz.7.1815" path="/file0" dev="rpc_pipefs" ino=38185 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=dir permissive=1 [ 544.799711][ T30] audit: type=1400 audit(1753005794.086:611): avc: denied { unmount } for pid=13341 comm="syz.7.1815" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 545.614219][ T43] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 545.642204][T13372] input: syz0 as /devices/virtual/input/input23 [ 545.649474][T13372] input: failed to attach handler leds to device input23, error: -6 [ 545.775679][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 545.782131][ T43] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 545.793838][ T43] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 545.824053][ T43] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 545.836968][ T43] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 545.847566][ T43] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 545.869948][ T43] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 545.879313][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.106980][ T43] usb 3-1: usb_control_msg returned -32 [ 546.117868][ T43] usbtmc 3-1:16.0: can't read capabilities [ 547.539815][ T30] audit: type=1400 audit(1753005796.826:612): avc: denied { name_bind } for pid=13410 comm="syz.0.1846" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 547.591068][T13416] netlink: 4632 bytes leftover after parsing attributes in process `syz.5.1848'. [ 547.748959][ T5866] usb 3-1: USB disconnect, device number 52 [ 547.800623][ T30] audit: type=1400 audit(1753005797.106:613): avc: denied { append } for pid=13424 comm="syz.6.1852" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 547.838874][T13425] loop6: detected capacity change from 0 to 1 [ 547.857605][T13425] Dev loop6: unable to read RDB block 1 [ 547.869868][T13425] loop6: unable to read partition table [ 547.885922][T13425] loop6: partition table beyond EOD, truncated [ 547.900580][T13425] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 548.378435][ T30] audit: type=1400 audit(1753005797.686:614): avc: denied { name_bind } for pid=13442 comm="syz.5.1859" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 548.940944][T13457] netlink: 'syz.5.1865': attribute type 2 has an invalid length. [ 548.950597][T13457] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.1865'. [ 548.990728][T13457] nbd: must specify at least one socket [ 549.117845][ T30] audit: type=1326 audit(1753005798.316:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.190011][ T30] audit: type=1326 audit(1753005798.316:616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.307839][T13467] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1867'. [ 549.317529][T13467] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1867'. [ 549.337327][T13467] dummy0: entered promiscuous mode [ 549.354491][T13467] dummy0: left promiscuous mode [ 549.423459][ T5866] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 549.520540][ T30] audit: type=1326 audit(1753005798.316:617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.557532][ T30] audit: type=1326 audit(1753005798.316:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.599674][ T30] audit: type=1326 audit(1753005798.316:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.623039][ C1] vkms_vblank_simulate: vblank timer overrun [ 549.674423][ T30] audit: type=1326 audit(1753005798.316:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 549.698004][ T30] audit: type=1326 audit(1753005798.316:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13446 comm="syz.7.1847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00e138e9a9 code=0x7ffc0000 [ 550.278106][T13479] batadv_slave_1: entered promiscuous mode [ 550.287072][T13477] batadv_slave_1: left promiscuous mode [ 550.410364][ T880] hid-generic 0003:0004:0000.000E: unknown main item tag 0x0 [ 550.435674][ T880] hid-generic 0003:0004:0000.000E: unknown main item tag 0x0 [ 550.462967][ T880] hid-generic 0003:0004:0000.000E: unknown main item tag 0x0 [ 550.499354][ T880] hid-generic 0003:0004:0000.000E: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 550.698836][T13492] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (comedi_parport) [ 550.708509][T13488] fido_id[13488]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 551.085849][T10634] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 551.317443][T10634] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 551.328127][T10634] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 551.404092][T10634] usb 7-1: config 220 has no interface number 2 [ 551.422668][T10634] usb 7-1: config 220 interface 1 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 551.479226][T10634] usb 7-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 551.565381][T10634] usb 7-1: config 220 interface 0 has no altsetting 0 [ 551.587117][T10634] usb 7-1: config 220 interface 76 has no altsetting 0 [ 551.632489][T10634] usb 7-1: config 220 interface 1 has no altsetting 0 [ 551.664091][T10634] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 551.679208][T10634] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.688652][T10634] usb 7-1: Product: syz [ 551.692973][T10634] usb 7-1: Manufacturer: syz [ 551.722938][T10634] usb 7-1: SerialNumber: syz [ 551.980961][T10634] usb 7-1: selecting invalid altsetting 0 [ 552.001659][T10634] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 552.076011][T10634] usb 7-1: No valid video chain found. [ 552.123593][T10634] usb 7-1: selecting invalid altsetting 0 [ 552.141323][T10634] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 552.189095][T10634] usb 7-1: USB disconnect, device number 14 [ 552.804522][ T5866] usb 1-1: unable to get BOS descriptor or descriptor too short [ 552.842270][ T5866] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 552.860781][ T5866] usb 1-1: can't read configurations, error -71 [ 552.903764][T13510] batadv0: entered promiscuous mode [ 552.909658][T13510] vlan2: entered promiscuous mode [ 552.924207][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 552.924222][ T30] audit: type=1400 audit(1753005802.206:681): avc: denied { setattr } for pid=13509 comm="syz.6.1885" path="/dev/mixer" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 552.954182][ C1] vkms_vblank_simulate: vblank timer overrun [ 553.727298][ T30] audit: type=1326 audit(1753005802.866:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 553.897433][ T30] audit: type=1326 audit(1753005802.866:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 553.920729][ C1] vkms_vblank_simulate: vblank timer overrun [ 554.012864][ T30] audit: type=1326 audit(1753005802.866:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 554.130410][ T30] audit: type=1326 audit(1753005802.866:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 554.153641][ C1] vkms_vblank_simulate: vblank timer overrun [ 554.214310][ T30] audit: type=1326 audit(1753005802.866:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 554.237710][ C1] vkms_vblank_simulate: vblank timer overrun [ 554.290337][T13549] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1898'. [ 554.443938][ T30] audit: type=1326 audit(1753005802.866:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 554.598614][ T30] audit: type=1326 audit(1753005802.866:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 554.622000][ C1] vkms_vblank_simulate: vblank timer overrun [ 555.135478][ T30] audit: type=1326 audit(1753005802.866:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 555.220231][ T30] audit: type=1326 audit(1753005802.866:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13521 comm="syz.6.1891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 556.826203][T13585] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1913'. [ 556.854483][T13585] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1913'. [ 556.906875][T13585] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1913'. [ 556.923211][T13585] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1913'. [ 557.118787][T13603] netlink: 'syz.7.1918': attribute type 2 has an invalid length. [ 557.140773][T13603] netlink: 'syz.7.1918': attribute type 1 has an invalid length. [ 557.149138][T13603] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.1918'. [ 557.184502][T13603] nbd: illegal input index -404748436 [ 557.295645][ T5866] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 557.369517][T13617] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13617 comm=syz.5.1924 [ 557.504309][ T5866] usb 7-1: Using ep0 maxpacket: 32 [ 557.522285][ T5866] usb 7-1: config index 0 descriptor too short (expected 35577, got 27) [ 557.544162][ T5866] usb 7-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 557.578835][ T5866] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 557.604313][ T5866] usb 7-1: config 1 has no interface number 0 [ 557.614924][ T5866] usb 7-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 557.678177][ T5866] usb 7-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 557.714229][ T5866] usb 7-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 557.769707][ T5866] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.790416][ T5866] snd_usb_pod 7-1:1.1: Line 6 Pocket POD found [ 557.993218][ T5866] snd_usb_pod 7-1:1.1: invalid control EP [ 558.108468][ T5866] snd_usb_pod 7-1:1.1: cannot start listening: -22 [ 558.150032][ T5866] snd_usb_pod 7-1:1.1: Line 6 Pocket POD now disconnected [ 558.163955][ T5866] snd_usb_pod 7-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 558.201396][T13605] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.229016][T13605] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.318145][T13605] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.332630][T13605] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.452365][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 558.452376][ T30] audit: type=1400 audit(1753005807.756:727): avc: denied { connect } for pid=13604 comm="syz.6.1920" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 558.483607][T13652] netlink: 'syz.7.1937': attribute type 2 has an invalid length. [ 558.517711][T13652] netlink: 'syz.7.1937': attribute type 1 has an invalid length. [ 558.606497][T13652] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.1937'. [ 558.616945][T13652] nbd: illegal input index -404748436 [ 558.835529][T13665] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13665 comm=syz.7.1941 [ 558.883357][ T43] usb 7-1: USB disconnect, device number 15 [ 559.167946][T13684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1948'. [ 559.391428][T13682] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1945'. [ 559.401906][T13682] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1945'. [ 560.074700][T10786] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 560.513092][T10786] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 1040, setting to 64 [ 560.562970][T10786] usb 1-1: config 0 interface 0 has no altsetting 0 [ 560.620477][T10786] usb 1-1: New USB device found, idVendor=0458, idProduct=5014, bcdDevice= 0.00 [ 560.652233][T10786] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.696790][T10786] usb 1-1: config 0 descriptor?? [ 560.707970][T13711] vivid-000: disconnect [ 560.753782][T13698] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 560.950359][T13717] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 560.996710][T13717] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1956'. [ 561.007841][T13717] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 561.075958][T13722] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 561.111949][T13722] netdevsim netdevsim5 netdevsim0: left promiscuous mode [ 561.427445][ T30] audit: type=1400 audit(1753005810.736:728): avc: denied { write } for pid=13732 comm="syz.6.1964" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 561.784442][ T5866] usb 6-1: new low-speed USB device number 33 using dummy_hcd [ 561.985598][ T5866] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 561.999768][ T5866] usb 6-1: config 0 has no interface number 0 [ 562.012738][ T5866] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 562.023935][ T5866] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 562.036421][ T5866] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 562.054571][T13751] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1971'. [ 562.148291][ T5866] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.315636][ T5866] usb 6-1: config 0 descriptor?? [ 562.321905][T13738] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 562.332724][ T5866] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 562.416290][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.422611][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.675007][T13738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.678105][T10786] usbhid 1-1:0.0: can't add hid device: -71 [ 562.696320][T13738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.719783][T10786] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 562.804075][T10786] usb 1-1: USB disconnect, device number 37 [ 562.884883][T13738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 563.059039][T13738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 563.382656][T13777] netlink: 'syz.6.1979': attribute type 2 has an invalid length. [ 563.391773][T13777] netlink: 'syz.6.1979': attribute type 1 has an invalid length. [ 563.405567][T13777] netlink: 193500 bytes leftover after parsing attributes in process `syz.6.1979'. [ 563.433395][T13777] nbd: illegal input index -404748436 [ 563.694507][ T880] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 563.751613][T10786] usb 6-1: USB disconnect, device number 33 [ 564.409879][T13779] batadv0: entered promiscuous mode [ 564.415444][T13779] vlan4: entered promiscuous mode [ 564.518449][T13717] vivid-000: reconnect [ 564.599475][ T880] usb 1-1: unable to get BOS descriptor or descriptor too short [ 564.629123][ T880] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 564.644878][ T880] usb 1-1: can't read configurations, error -71 [ 564.663528][ T30] audit: type=1400 audit(1753005813.966:729): avc: denied { read } for pid=5188 comm="acpid" name="mouse3" dev="devtmpfs" ino=3583 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 564.697468][ T30] audit: type=1400 audit(1753005813.966:730): avc: denied { open } for pid=5188 comm="acpid" path="/dev/input/mouse3" dev="devtmpfs" ino=3583 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 564.722606][ T30] audit: type=1400 audit(1753005813.966:731): avc: denied { ioctl } for pid=5188 comm="acpid" path="/dev/input/mouse3" dev="devtmpfs" ino=3583 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 564.859301][T13797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13797 comm=syz.5.1987 [ 565.007737][T13804] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 565.250584][T13814] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1993'. [ 565.328793][T13814] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1993'. [ 565.507959][T13814] hsr_slave_1 (unregistering): left promiscuous mode [ 565.631338][T13822] syzkaller1: entered promiscuous mode [ 565.668625][T13822] syzkaller1: entered allmulticast mode [ 565.750175][T13827] trusted_key: encrypted_key: master key parameter 'ecryp' is invalid [ 565.760539][T13824] netlink: 'syz.0.1998': attribute type 29 has an invalid length. [ 565.773442][T13828] netlink: 'syz.0.1998': attribute type 29 has an invalid length. [ 565.845885][T13826] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (comedi_parport) [ 565.992090][T13833] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13833 comm=syz.5.2001 [ 566.024585][T13838] syzkaller0: entered promiscuous mode [ 566.030207][T13838] syzkaller0: entered allmulticast mode [ 567.902852][T13865] input: syz0 as /devices/virtual/input/input24 [ 568.364370][T10634] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 568.538102][T10634] usb 6-1: no configurations [ 568.543750][T10634] usb 6-1: can't read configurations, error -22 [ 568.674278][T10634] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 568.846706][T10634] usb 6-1: no configurations [ 568.851385][T10634] usb 6-1: can't read configurations, error -22 [ 568.858611][T10634] usb usb6-port1: attempt power cycle [ 569.160363][T13864] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.206610][T10634] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 569.239483][T10634] usb 6-1: no configurations [ 569.250730][T10634] usb 6-1: can't read configurations, error -22 [ 569.273557][T13864] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 569.288268][T13864] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 569.299886][T13895] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2021'. [ 569.394756][T10634] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 569.419342][T13864] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.429418][T13864] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.440372][T13864] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.451548][T10634] usb 6-1: no configurations [ 569.456797][T10634] usb 6-1: can't read configurations, error -22 [ 569.463554][T10634] usb usb6-port1: unable to enumerate USB device [ 569.470721][T13864] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.513328][T13864] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 569.522525][T13864] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 569.531401][T13864] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 569.540467][T13864] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 569.582209][T13883] netlink: 'syz.6.2019': attribute type 29 has an invalid length. [ 570.325225][T13927] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13927 comm=syz.7.2032 [ 570.586075][T10634] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 570.774261][T10634] usb 7-1: Using ep0 maxpacket: 8 [ 570.853478][T10634] usb 7-1: config 0 has an invalid descriptor of length 162, skipping remainder of the config [ 570.869661][T10634] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 570.885500][T10634] usb 7-1: New USB device found, idVendor=0a5c, idProduct=2033, bcdDevice=72.01 [ 570.904406][T10634] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.921396][T10634] usb 7-1: Product: syz [ 570.940891][T10634] usb 7-1: Manufacturer: syz [ 570.960306][T10634] usb 7-1: SerialNumber: syz [ 571.126475][T10634] usb 7-1: config 0 descriptor?? [ 572.112073][ T30] audit: type=1400 audit(1753005821.416:732): avc: denied { write } for pid=13962 comm="syz.2.2045" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 572.331430][T13974] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2051'. [ 572.433233][T13977] netlink: 'syz.7.2053': attribute type 10 has an invalid length. [ 572.449497][T13977] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2053'. [ 572.463246][T13977] batadv0: entered promiscuous mode [ 572.474157][T13977] batadv0: entered allmulticast mode [ 572.483766][T13977] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 572.678896][T13986] tipc: Started in network mode [ 572.684552][T13986] tipc: Node identity 7f000001, cluster identity 4711 [ 572.706211][T13986] tipc: Enabled bearer , priority 10 [ 573.094223][T10634] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 573.111768][ T5940] usb 7-1: USB disconnect, device number 16 [ 573.334325][T10634] usb 3-1: Using ep0 maxpacket: 16 [ 573.834785][ T5940] tipc: Node number set to 2130706433 [ 574.134202][ T10] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 574.449491][T14035] openvswitch: netlink: Flow key attr not present in new flow. [ 574.573456][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.653947][ T10] usb 6-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 574.686886][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.702592][T14041] netlink: 128 bytes leftover after parsing attributes in process `syz.6.2080'. [ 574.724782][ T10] usb 6-1: config 0 descriptor?? [ 574.786619][ T10] usb 6-1: bad CDC descriptors [ 576.047652][T10634] usb 3-1: unable to get BOS descriptor or descriptor too short [ 576.110988][T10634] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 576.231549][T14068] vivid-000: disconnect [ 576.476025][ T30] audit: type=1800 audit(1753005825.586:733): pid=14067 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2089" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 576.497895][T10634] usb 3-1: can't read configurations, error -71 [ 576.593667][ T10] usb 6-1: USB disconnect, device number 38 [ 576.768669][T14054] vivid-000: reconnect [ 577.135008][T14064] cgroup: fork rejected by pids controller in /syz2 [ 577.754305][T10634] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 577.918647][T10634] usb 3-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=de.ad [ 577.932126][T10634] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 577.949774][T10634] usb 3-1: config 0 descriptor?? [ 578.196857][T10634] snd-usb-hiface 3-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 578.395399][T14110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 578.424639][T14110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.433918][ T43] usb 3-1: USB disconnect, device number 55 [ 578.465889][T14133] input: syz1 as /devices/virtual/input/input25 [ 578.699094][ T30] audit: type=1326 audit(1753005828.006:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 578.917391][ T30] audit: type=1326 audit(1753005828.006:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 578.955530][ T30] audit: type=1326 audit(1753005828.006:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 578.980518][ T30] audit: type=1326 audit(1753005828.006:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.005489][ T30] audit: type=1326 audit(1753005828.006:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.029670][ T30] audit: type=1326 audit(1753005828.006:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.061171][ T30] audit: type=1326 audit(1753005828.006:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.087628][ T30] audit: type=1326 audit(1753005828.006:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=17 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.123571][ T30] audit: type=1326 audit(1753005828.006:742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76b9b8e9a9 code=0x7ffc0000 [ 579.268370][ T30] audit: type=1326 audit(1753005828.006:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14134 comm="syz.6.2106" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f76b9b8d310 code=0x7ffc0000 [ 579.568352][T14166] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2118'. [ 580.029906][T14178] netlink: 'syz.6.2121': attribute type 2 has an invalid length. [ 580.037818][T14178] netlink: 'syz.6.2121': attribute type 1 has an invalid length. [ 580.060792][T14178] netlink: 193500 bytes leftover after parsing attributes in process `syz.6.2121'. [ 580.104626][T14178] nbd: illegal input index -404748436 [ 581.250643][T14211] netlink: 'syz.7.2135': attribute type 2 has an invalid length. [ 581.274282][T14211] netlink: 'syz.7.2135': attribute type 1 has an invalid length. [ 581.286298][ T5866] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 581.297679][T14211] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.2135'. [ 581.321134][T14211] nbd: illegal input index -404748436 [ 581.475988][ T5866] usb 6-1: Using ep0 maxpacket: 8 [ 581.506486][ T5866] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 581.514906][ T5866] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 581.528561][ T5866] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 581.548232][ T5866] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 581.568182][ T5866] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 581.586401][ T5866] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 581.595856][ T5866] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.842169][ T5866] usb 6-1: GET_CAPABILITIES returned 0 [ 581.847805][ T5866] usbtmc 6-1:16.0: can't read capabilities [ 582.054281][T10634] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 582.069224][T14205] usb 6-1: usbtmc_ioctl_clear_out_halt returned -32 [ 582.077685][ T5866] usb 6-1: USB disconnect, device number 39 [ 582.225968][T10634] usb 3-1: Using ep0 maxpacket: 8 [ 582.232455][T10634] usb 3-1: config 5 has an invalid interface number: 35 but max is 1 [ 582.240738][T10634] usb 3-1: config 5 has an invalid interface number: 4 but max is 1 [ 582.249087][T10634] usb 3-1: config 5 has an invalid interface number: 4 but max is 1 [ 582.257277][T10634] usb 3-1: config 5 has no interface number 0 [ 582.263625][T10634] usb 3-1: config 5 has no interface number 1 [ 582.269873][T10634] usb 3-1: config 5 interface 35 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 582.282942][T10634] usb 3-1: config 5 interface 4 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 582.298209][T10634] usb 3-1: config 5 interface 35 has no altsetting 0 [ 582.305017][T10634] usb 3-1: config 5 interface 4 has no altsetting 0 [ 582.311742][T10634] usb 3-1: config 5 interface 4 has no altsetting 1 [ 582.321842][T10634] usb 3-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=d4.1b [ 582.340722][T10634] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.351027][T10634] usb 3-1: Product: syz [ 582.355310][T10634] usb 3-1: Manufacturer: syz [ 582.359951][T10634] usb 3-1: SerialNumber: syz [ 582.440226][T14231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2142'. [ 582.556772][T14235] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 582.577337][T10634] ttusbir 3-1:5.35: cannot find expected altsetting [ 582.609652][T10634] ttusbir 3-1:5.4: cannot find expected altsetting [ 582.626805][T10634] usb 3-1: USB disconnect, device number 56 [ 582.875864][T14246] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2146'. [ 583.002293][T14249] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2146'. [ 583.334196][ T10] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 583.496293][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 583.544007][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 583.593594][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.690624][ T10] usb 1-1: config 0 descriptor?? [ 584.139681][T14274] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2157'. [ 584.290538][T10634] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 584.298670][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 584.315024][ T10] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 584.323991][ T10] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 584.677313][T10634] usb 7-1: Using ep0 maxpacket: 16 [ 584.687677][T10634] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 584.697349][T10634] usb 7-1: can't read configurations, error -61 [ 584.904180][T10634] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 584.922838][T14282] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2159'. [ 584.958654][T14282] block device autoloading is deprecated and will be removed. [ 584.967508][T14282] syz.5.2159: attempt to access beyond end of device [ 584.967508][T14282] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 585.221775][T10634] usb 7-1: Using ep0 maxpacket: 16 [ 585.243149][T10634] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 585.271103][T10634] usb 7-1: can't read configurations, error -61 [ 585.283113][T10634] usb usb7-port1: attempt power cycle [ 585.654171][T10634] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 585.708776][T10634] usb 7-1: Using ep0 maxpacket: 16 [ 585.755521][T10634] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 585.776558][T10634] usb 7-1: can't read configurations, error -61 [ 585.934330][T10634] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 585.969448][T10634] usb 7-1: Using ep0 maxpacket: 16 [ 586.009898][T10634] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 586.032697][T10634] usb 7-1: can't read configurations, error -61 [ 586.064384][T10634] usb usb7-port1: unable to enumerate USB device [ 587.870753][T14332] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2174'. [ 591.942162][T14412] vivid-003: disconnect [ 591.962579][T14411] vivid-003: reconnect [ 592.124433][T10634] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 592.314156][T10634] usb 6-1: device descriptor read/64, error -71 [ 592.566533][T10634] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 592.744469][T10634] usb 6-1: device descriptor read/64, error -71 [ 592.763253][T14443] vivid-000: disconnect [ 592.769855][T14442] vivid-000: reconnect [ 592.854510][T10634] usb usb6-port1: attempt power cycle [ 592.929905][T14452] netlink: 'syz.6.2219': attribute type 2 has an invalid length. [ 592.946507][T14452] netlink: 'syz.6.2219': attribute type 1 has an invalid length. [ 592.956843][T14452] netlink: 193500 bytes leftover after parsing attributes in process `syz.6.2219'. [ 592.990673][T14452] nbd: illegal input index -404748436 [ 593.241502][T10634] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 593.278232][T10634] usb 6-1: device descriptor read/8, error -71 [ 593.404189][ T880] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 593.457308][T14467] netlink: 'syz.0.2225': attribute type 29 has an invalid length. [ 593.492117][T14467] syzkaller0: entered promiscuous mode [ 593.499550][T14467] syzkaller0: entered allmulticast mode [ 593.524237][T10634] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 593.554203][ T880] usb 7-1: Using ep0 maxpacket: 8 [ 593.562325][T10634] usb 6-1: device descriptor read/8, error -71 [ 593.573261][ T880] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 593.581692][ T880] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 593.602070][ T880] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 593.618294][ T880] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 593.635879][ T880] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 593.662463][ T880] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 593.677909][ T880] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 593.708296][T10634] usb usb6-port1: unable to enumerate USB device [ 593.923218][ T880] usb 7-1: GET_CAPABILITIES returned 0 [ 593.928906][ T880] usbtmc 7-1:16.0: can't read capabilities [ 594.118128][T14474] vivid-000: disconnect [ 594.122616][T14473] vivid-000: reconnect [ 594.129945][T10634] usb 7-1: USB disconnect, device number 21 [ 597.574181][ T5866] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 597.774420][ T5866] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.823921][ T5866] usb 3-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 598.048333][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.205851][ T5866] usb 3-1: config 0 descriptor?? [ 598.267297][ T5866] usb 3-1: bad CDC descriptors [ 598.552972][T14568] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2259'. [ 598.599481][T14565] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2259'. [ 599.020274][T14572] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.836795][T14572] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.886558][T14572] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 600.254321][T14572] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.282017][T14572] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.314664][T14572] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.343735][T14572] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.663143][T10634] usb 3-1: USB disconnect, device number 57 [ 601.143531][ T5866] wg1 speed is unknown, defaulting to 1000 [ 601.154338][ T5866] syz0: Port: 1 Link DOWN [ 601.266797][T14599] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2268'. [ 601.292266][T14603] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2268'. [ 601.325749][ T5866] wg1 speed is unknown, defaulting to 1000 [ 601.331960][T14601] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2268'. [ 602.680580][T14631] netlink: 'syz.5.2278': attribute type 2 has an invalid length. [ 602.718701][T14631] netlink: 143072 bytes leftover after parsing attributes in process `syz.5.2278'. [ 602.738702][T14631] nbd: must specify at least one socket [ 603.696777][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 603.696792][ T30] audit: type=1400 audit(1753005853.006:765): avc: denied { write } for pid=14667 comm="syz.5.2291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 603.792487][T14674] netlink: 'syz.0.2293': attribute type 2 has an invalid length. [ 603.844186][T14674] netlink: 143072 bytes leftover after parsing attributes in process `syz.0.2293'. [ 603.880675][T14674] nbd: must specify at least one socket [ 604.335917][T14708] wg1 speed is unknown, defaulting to 1000 [ 604.864299][ T5866] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 605.104148][ T5866] usb 7-1: Using ep0 maxpacket: 8 [ 605.112793][ T5866] usb 7-1: config 5 has an invalid interface number: 35 but max is 1 [ 605.123812][ T5866] usb 7-1: config 5 has an invalid interface number: 4 but max is 1 [ 605.132184][ T5866] usb 7-1: config 5 has an invalid interface number: 4 but max is 1 [ 605.145802][ T5866] usb 7-1: config 5 has no interface number 0 [ 605.169972][ T5866] usb 7-1: config 5 has no interface number 1 [ 605.185806][ T5866] usb 7-1: config 5 interface 35 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 605.223629][T14740] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 605.302761][ T5866] usb 7-1: config 5 interface 4 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 605.327470][ T5866] usb 7-1: config 5 interface 35 has no altsetting 0 [ 605.353256][ T5866] usb 7-1: config 5 interface 4 has no altsetting 0 [ 605.363385][ T5866] usb 7-1: config 5 interface 4 has no altsetting 1 [ 605.372997][ T5866] usb 7-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=d4.1b [ 605.382577][ T5866] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.398384][ T5866] usb 7-1: Product: syz [ 605.474501][ T5866] usb 7-1: Manufacturer: syz [ 605.509095][ T5866] usb 7-1: SerialNumber: syz [ 607.374264][ T976] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 607.527479][ T976] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 607.550897][ T976] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 607.620881][ T5866] ttusbir 7-1:5.35: cannot find expected altsetting [ 607.623147][ T976] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 607.665828][ T976] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 607.876365][T14794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2340'. [ 607.893808][ T976] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.899216][ T5866] ttusbir 7-1:5.4: cannot find expected altsetting [ 607.930327][ T976] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 607.941562][ T976] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 607.950984][ T976] usb 6-1: Product: syz [ 607.955243][ T976] usb 6-1: Manufacturer: syz [ 607.987027][ T976] cdc_wdm 6-1:1.0: skipping garbage [ 607.995933][ T976] cdc_wdm 6-1:1.0: skipping garbage [ 608.011940][ T976] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 608.018258][ T5866] usb 7-1: USB disconnect, device number 22 [ 608.018321][ T976] cdc_wdm 6-1:1.0: Unknown control protocol [ 608.202620][ T30] audit: type=1400 audit(1753005857.506:766): avc: denied { read write } for pid=14783 comm="syz.5.2338" name="cdc-wdm0" dev="devtmpfs" ino=3613 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 608.216386][T14784] cdc_wdm 6-1:1.0: Error submitting int urb - -90 [ 608.413413][ T30] audit: type=1400 audit(1753005857.526:767): avc: denied { open } for pid=14783 comm="syz.5.2338" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3613 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 608.438204][ C0] vkms_vblank_simulate: vblank timer overrun [ 608.744037][ T30] audit: type=1400 audit(1753005858.046:768): avc: denied { rename } for pid=14810 comm="syz.7.2346" name="file0" dev="tmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 608.990559][ T976] usb 6-1: USB disconnect, device number 44 [ 609.564356][ T976] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 609.596696][T10634] usb 3-1: new low-speed USB device number 58 using dummy_hcd [ 609.612387][T14835] netlink: 'syz.5.2355': attribute type 2 has an invalid length. [ 609.627852][T14835] netlink: 'syz.5.2355': attribute type 1 has an invalid length. [ 609.635965][T14835] netlink: 193500 bytes leftover after parsing attributes in process `syz.5.2355'. [ 609.676069][T14835] nbd: must specify at least one socket [ 609.763662][T10634] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 609.771905][T10634] usb 3-1: config 0 has no interface number 0 [ 609.780209][ T976] usb 7-1: Using ep0 maxpacket: 8 [ 609.833887][T10634] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 609.903117][T10634] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 609.919644][ T976] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 609.943059][ T976] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 609.959337][T10634] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 610.000817][ T976] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 610.011616][T10634] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.056484][ T976] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 610.070351][T10634] usb 3-1: config 0 descriptor?? [ 610.111255][T14827] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 610.155150][T10634] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 610.169238][ T976] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 610.193488][ T976] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.388954][T14827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.470976][T14827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.489362][T14827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.503244][T14827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.513153][T10634] usb 3-1: USB disconnect, device number 58 [ 610.562714][ T976] usb 7-1: GET_CAPABILITIES returned 0 [ 610.569170][ T976] usbtmc 7-1:16.0: can't read capabilities [ 610.811481][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 611.251880][T14881] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2374'. [ 611.913723][T14894] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2380'. [ 612.519480][T14900] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2381'. [ 612.702676][ T976] usb 7-1: USB disconnect, device number 23 [ 612.933472][T14911] netlink: 'syz.6.2385': attribute type 2 has an invalid length. [ 612.942419][T14911] netlink: 'syz.6.2385': attribute type 1 has an invalid length. [ 612.953954][T14911] netlink: 193500 bytes leftover after parsing attributes in process `syz.6.2385'. [ 613.044793][T14911] nbd: must specify at least one socket [ 613.932750][T14939] netlink: 128 bytes leftover after parsing attributes in process `syz.5.2398'. [ 614.234753][ T976] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 614.427139][ T976] usb 6-1: Using ep0 maxpacket: 32 [ 614.442429][ T976] usb 6-1: config 0 interface 0 has no altsetting 0 [ 614.455540][ T976] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 614.464916][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.477190][ T976] usb 6-1: Product: syz [ 614.484024][ T976] usb 6-1: Manufacturer: syz [ 614.489384][ T976] usb 6-1: SerialNumber: syz [ 614.717490][ T976] usb 6-1: config 0 descriptor?? [ 614.955103][T14939] tc_dump_action: action bad kind [ 615.025637][ T976] gs_usb 6-1:0.0: Required endpoints not found [ 615.055770][ T976] usb 6-1: USB disconnect, device number 45 [ 615.156880][T14973] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2411'. [ 615.700120][ T30] audit: type=1400 audit(1753005865.006:769): avc: denied { setattr } for pid=14974 comm="syz.2.2412" path="/dev/input/event2" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 615.729277][T14979] netlink: 'syz.5.2414': attribute type 2 has an invalid length. [ 615.754409][T14979] netlink: 'syz.5.2414': attribute type 1 has an invalid length. [ 615.772498][T14979] netlink: 193500 bytes leftover after parsing attributes in process `syz.5.2414'. [ 615.798733][T14979] nbd: must specify at least one socket [ 617.091504][T14998] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2420'. [ 617.215901][T15001] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 617.654826][T14996] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2420'. [ 617.955782][T15014] netlink: 'syz.0.2426': attribute type 2 has an invalid length. [ 617.963578][T15014] netlink: 'syz.0.2426': attribute type 1 has an invalid length. [ 617.973682][T15014] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.2426'. [ 618.035970][T15014] nbd: must specify at least one socket [ 618.110831][ T30] audit: type=1400 audit(1753005867.416:770): avc: denied { name_bind } for pid=15016 comm="syz.0.2427" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 619.706643][T15088] syz.5.2447: attempt to access beyond end of device [ 619.706643][T15088] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 620.937313][T15120] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2461'. [ 621.032830][T15120] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2461'. [ 621.444609][T15127] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2462'. [ 621.503368][T15124] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2462'. [ 621.869944][T15145] netlink: 'syz.0.2471': attribute type 2 has an invalid length. [ 621.878408][T15145] netlink: 'syz.0.2471': attribute type 1 has an invalid length. [ 621.911141][T15145] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.2471'. [ 621.951013][T15145] nbd: must specify at least one socket [ 622.136312][T15153] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2473'. [ 622.365507][T15161] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 622.365894][ T92] IPVS: starting estimator thread 0... [ 622.484177][T15164] IPVS: using max 43 ests per chain, 103200 per kthread [ 623.039036][T15172] loop7: detected capacity change from 0 to 7 [ 623.049186][T15172] Dev loop7: unable to read RDB block 7 [ 623.057734][T15172] loop7: AHDI p1 p2 [ 623.067798][T15172] loop7: partition table partially beyond EOD, truncated [ 623.082859][T15172] loop7: p1 start 1702000233 is beyond EOD, truncated [ 623.862510][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.868955][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.038668][T15192] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2486'. [ 624.325679][ T30] audit: type=1400 audit(1753005873.636:771): avc: denied { append } for pid=15200 comm="syz.5.2490" name="usbmon3" dev="devtmpfs" ino=725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 624.408691][ T30] audit: type=1400 audit(1753005873.656:772): avc: denied { ioctl } for pid=15200 comm="syz.5.2490" path="/dev/usbmon3" dev="devtmpfs" ino=725 ioctlcmd=0x9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 626.842118][ T30] audit: type=1400 audit(1753005876.146:773): avc: denied { read } for pid=15244 comm="syz.7.2503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 627.802173][T15266] netlink: 'syz.2.2512': attribute type 1 has an invalid length. [ 627.810033][T15266] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2512'. [ 629.783959][T12462] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 629.799154][T12462] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 629.808480][T12462] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 629.818481][T12462] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 629.827715][T12462] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 629.857846][T15310] netlink: 'syz.7.2527': attribute type 5 has an invalid length. [ 629.945647][T15312] wg1 speed is unknown, defaulting to 1000 [ 630.484168][ T92] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 630.562131][T15335] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2537'. [ 630.666514][ T92] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 630.678987][ T92] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 630.690186][ T92] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 630.701404][ T92] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 630.725343][ T92] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 630.744441][ T92] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 630.757249][ T92] usb 3-1: Manufacturer: syz [ 630.770732][ T92] usb 3-1: config 0 descriptor?? [ 630.809795][T15312] chnl_net:caif_netlink_parms(): no params data found [ 630.999248][T15312] bridge0: port 1(bridge_slave_0) entered blocking state [ 631.026830][T15312] bridge0: port 1(bridge_slave_0) entered disabled state [ 631.034058][T15312] bridge_slave_0: entered allmulticast mode [ 631.043219][T15312] bridge_slave_0: entered promiscuous mode [ 631.064869][T15312] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.071989][T15312] bridge0: port 2(bridge_slave_1) entered disabled state [ 631.079316][T15312] bridge_slave_1: entered allmulticast mode [ 631.095543][T15312] bridge_slave_1: entered promiscuous mode [ 631.159057][T15312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 631.190970][ T92] appleir 0003:05AC:8243.000F: unknown main item tag 0x0 [ 631.202940][T15312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 631.217414][ T92] appleir 0003:05AC:8243.000F: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 631.282207][T15312] team0: Port device team_slave_0 added [ 631.296971][T15312] team0: Port device team_slave_1 added [ 631.380147][T15312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 631.395639][T15312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 631.418726][T15349] input: syz1 as /devices/virtual/input/input30 [ 631.468738][T15312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 631.487209][T15312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 631.498994][T15312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 631.527232][T15312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 631.583180][T15312] hsr_slave_0: entered promiscuous mode [ 631.593117][T15312] hsr_slave_1: entered promiscuous mode [ 631.600010][T15312] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 631.610674][T15312] Cannot create hsr debugfs directory [ 631.840408][T15312] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 631.852883][T15312] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 631.872387][ T51] Bluetooth: hci4: command tx timeout [ 631.938053][T15312] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 631.951210][T15312] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 631.991044][T15358] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2541'. [ 632.003163][T10634] usb 3-1: USB disconnect, device number 59 [ 632.127979][T15312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 632.153162][T15312] 8021q: adding VLAN 0 to HW filter on device team0 [ 632.169270][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 632.176455][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 632.208336][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.215567][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 632.629105][T15312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 633.074298][T15391] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 633.160584][T15312] veth0_vlan: entered promiscuous mode [ 633.178106][T15312] veth1_vlan: entered promiscuous mode [ 633.241266][T15312] veth0_macvtap: entered promiscuous mode [ 633.267459][T15312] veth1_macvtap: entered promiscuous mode [ 633.310190][T15312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 633.352513][T15312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 633.381518][T15312] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.405903][T15312] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.427105][T15312] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.496318][T15312] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.708107][T15399] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2554'. [ 633.873082][ T6752] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.904532][ T6752] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.913382][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.936635][ T51] Bluetooth: hci4: command tx timeout [ 633.955108][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 634.866714][ T5885] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 635.024335][ T5885] usb 9-1: Using ep0 maxpacket: 8 [ 635.078742][ T5885] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 635.089053][ T5885] usb 9-1: config 179 has no interface number 0 [ 635.107417][ T5885] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 635.136521][T15440] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2568'. [ 635.311570][ T5885] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 635.380838][ T5885] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 635.519209][ T5885] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 635.556821][ T5885] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 635.650145][ T5885] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 635.675516][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.014223][ T51] Bluetooth: hci4: command tx timeout [ 636.030837][T15421] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 636.328954][ T5885] input: Generic X-Box pad as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:179.65/input/input31 [ 636.846729][T15469] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 636.860823][T15469] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 637.129489][T15469] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 637.139037][T15469] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 637.175817][T15469] netdevsim netdevsim5 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 637.202969][T15469] netdevsim netdevsim5 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 637.249277][T15469] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.258499][T15469] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.285090][T15469] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.313177][T15469] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.889749][T10634] usb 9-1: USB disconnect, device number 2 [ 637.889749][ C1] xpad 9-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 637.889789][ C1] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 638.064160][ T5885] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 638.094430][ T51] Bluetooth: hci4: command tx timeout [ 638.264371][ T5885] usb 6-1: Using ep0 maxpacket: 16 [ 638.647024][ T5968] IPVS: starting estimator thread 0... [ 638.754316][T15499] IPVS: using max 72 ests per chain, 172800 per kthread [ 639.963854][T15530] loop6: detected capacity change from 0 to 7 [ 639.979143][T15530] Dev loop6: unable to read RDB block 7 [ 639.988695][T15530] loop6: unable to read partition table [ 639.995693][T15530] loop6: partition table beyond EOD, truncated [ 640.006962][T15530] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 640.549155][ T30] audit: type=1400 audit(1753005889.856:774): avc: denied { getopt } for pid=15535 comm="syz.8.2605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 640.792016][ T5885] usb 6-1: unable to get BOS descriptor or descriptor too short [ 640.814440][ T5885] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 640.841946][ T5885] usb 6-1: can't read configurations, error -71 [ 641.876815][T15564] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2611'. [ 642.732475][T15563] tty tty34: ldisc open failed (-12), clearing slot 33 [ 642.838714][T15564] syz.7.2611 (15564): drop_caches: 2 [ 642.971604][ T30] audit: type=1400 audit(1753005892.276:775): avc: denied { setopt } for pid=15580 comm="syz.7.2620" lport=42371 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 643.632984][T15601] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2627'. [ 644.824505][ T5885] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 644.926155][ T30] audit: type=1400 audit(1753005894.236:776): avc: denied { append } for pid=15634 comm="syz.7.2641" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 644.986856][ T5885] usb 3-1: Using ep0 maxpacket: 8 [ 644.998072][ T5885] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 645.006802][ T5885] usb 3-1: config 179 has no interface number 0 [ 645.017063][ T5885] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 645.041509][ T5885] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 645.063040][ T5885] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 645.075314][ T5885] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 645.127377][ T5885] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 645.137708][ T5885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.163266][T15627] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 645.394159][ T5968] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 645.453819][ T5885] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input32 [ 645.574155][ T5968] usb 6-1: Using ep0 maxpacket: 8 [ 645.584823][ T5968] usb 6-1: config 5 has an invalid interface number: 35 but max is 1 [ 645.595438][ T5968] usb 6-1: config 5 has an invalid interface number: 4 but max is 1 [ 645.607065][ T5968] usb 6-1: config 5 has an invalid interface number: 4 but max is 1 [ 645.629463][ T5968] usb 6-1: config 5 has no interface number 0 [ 645.635886][ T5866] usb 3-1: USB disconnect, device number 60 [ 645.636550][ T5968] usb 6-1: config 5 has no interface number 1 [ 645.644123][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 645.652876][ T5968] usb 6-1: config 5 interface 35 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 645.670653][ T5968] usb 6-1: config 5 interface 4 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 645.684025][ T5968] usb 6-1: config 5 interface 35 has no altsetting 0 [ 645.710977][ T5968] usb 6-1: config 5 interface 4 has no altsetting 0 [ 645.721804][ T5968] usb 6-1: config 5 interface 4 has no altsetting 1 [ 645.738100][ T5968] usb 6-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=d4.1b [ 645.748152][ T5968] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.756429][ T5968] usb 6-1: Product: syz [ 645.760761][ T5968] usb 6-1: Manufacturer: syz [ 645.767606][ T5968] usb 6-1: SerialNumber: syz [ 645.991983][ T5968] ttusbir 6-1:5.35: cannot find expected altsetting [ 646.009302][ T5968] ttusbir 6-1:5.4: cannot find expected altsetting [ 646.029316][ T5968] usb 6-1: USB disconnect, device number 48 [ 646.151384][ T30] audit: type=1400 audit(1753005895.446:777): avc: denied { map } for pid=15657 comm="syz.8.2649" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 646.378555][ T30] audit: type=1400 audit(1753005895.446:778): avc: denied { execute } for pid=15657 comm="syz.8.2649" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 646.471087][T15668] netlink: 'syz.2.2651': attribute type 12 has an invalid length. [ 646.487247][T15668] netlink: 'syz.2.2651': attribute type 29 has an invalid length. [ 646.504466][T15668] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2651'. [ 646.663685][T15675] netlink: 'syz.2.2656': attribute type 29 has an invalid length. [ 646.699852][T15675] netlink: 'syz.2.2656': attribute type 29 has an invalid length. [ 646.836331][T15680] syzkaller0: entered promiscuous mode [ 646.842625][T15680] syzkaller0: entered allmulticast mode [ 647.476630][T15696] netlink: 'syz.2.2663': attribute type 2 has an invalid length. [ 647.490157][T15696] netlink: 'syz.2.2663': attribute type 1 has an invalid length. [ 647.513153][T15696] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2663'. [ 647.549864][T15696] nbd: must specify at least one socket [ 649.553967][ T10] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 649.618952][ T10] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 649.675535][ T10] usb 1-1: USB disconnect, device number 40 [ 649.697386][T15744] netlink: 'syz.0.2682': attribute type 12 has an invalid length. [ 649.712737][T15744] netlink: 'syz.0.2682': attribute type 29 has an invalid length. [ 649.738052][T15744] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2682'. [ 649.964486][ T5866] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 650.123391][T15755] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (comedi_parport) [ 650.142775][T15755] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (comedi_parport) [ 650.186333][ T5866] usb 3-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=de.ad [ 650.197971][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.212598][ T5866] usb 3-1: config 0 descriptor?? [ 650.436754][ T5866] snd-usb-hiface 3-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 650.639578][ T5866] usb 3-1: USB disconnect, device number 61 [ 650.692669][T15768] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 651.053708][ T5885] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 651.273816][T15772] netlink: 'syz.2.2692': attribute type 2 has an invalid length. [ 651.289502][T15772] netlink: 'syz.2.2692': attribute type 1 has an invalid length. [ 651.315319][ T1152] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.336071][T15772] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2692'. [ 651.364474][ T5885] usb 9-1: Using ep0 maxpacket: 8 [ 651.430641][T15772] nbd: must specify at least one socket [ 651.444045][ T5885] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 651.460208][ T5885] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 651.498284][ T5885] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 651.511755][ T5885] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 651.532227][ T5885] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 651.541643][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.786674][ T1152] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.023269][ T1152] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.044230][ T5885] usb 9-1: GET_CAPABILITIES returned 0 [ 652.049739][ T5885] usbtmc 9-1:16.0: can't read capabilities [ 652.058554][ T10] IPVS: starting estimator thread 0... [ 652.354136][T15782] IPVS: using max 72 ests per chain, 172800 per kthread [ 652.525322][ T1152] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.594308][ T10] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 652.772236][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 652.788568][ T10] usb 3-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 652.971972][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.087940][ T10] usb 3-1: config 0 descriptor?? [ 653.104318][ T1152] bond0: left allmulticast mode [ 653.115778][ T1152] bond_slave_0: left allmulticast mode [ 653.168214][ T10] usb 3-1: bad CDC descriptors [ 653.205935][ T1152] bond_slave_1: left allmulticast mode [ 653.229496][ T1152] mac80211_hwsim hwsim22 wlan1: left allmulticast mode [ 653.337353][ T1152] bridge0: port 3(bond0) entered disabled state [ 653.389141][T15805] IPv6: Can't replace route, no match found [ 653.404496][ T1152] bridge_slave_1: left allmulticast mode [ 653.418943][ T1152] bridge_slave_1: left promiscuous mode [ 653.491646][ T10] usb 9-1: USB disconnect, device number 3 [ 653.565935][ T1152] bridge0: port 2(bridge_slave_1) entered disabled state [ 653.672350][ T1152] bridge_slave_0: left allmulticast mode [ 653.690605][ T1152] bridge_slave_0: left promiscuous mode [ 653.762228][ T1152] bridge0: port 1(bridge_slave_0) entered disabled state [ 654.744237][ T5885] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 654.894810][ T5885] usb 1-1: Using ep0 maxpacket: 8 [ 654.946893][ T5885] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 654.961916][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 654.973059][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 654.996091][ T5885] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 655.019026][ T5885] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 655.080037][ T10] usb 3-1: USB disconnect, device number 62 [ 655.099634][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.280015][ T1152] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 655.291222][ T1152] bond_slave_0: left promiscuous mode [ 655.327459][ T1152] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 655.355876][ T1152] bond_slave_1: left promiscuous mode [ 655.368294][ T5885] usb 1-1: GET_CAPABILITIES returned 0 [ 655.382063][ T5885] usbtmc 1-1:16.0: can't read capabilities [ 655.427173][ T1152] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 655.464919][ T1152] mac80211_hwsim hwsim22 wlan1: left promiscuous mode [ 655.508677][ T1152] bond0 (unregistering): Released all slaves [ 655.573919][T15831] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.582959][T15831] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.602317][T15844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.610979][T15844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.627349][T15844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.640856][T15844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.767804][ T10] usb 1-1: USB disconnect, device number 41 [ 655.825221][T15831] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 655.858536][T15831] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 656.231738][T15831] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.240883][T15831] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.250147][T15831] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.259585][T15831] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.318734][ T5866] IPVS: starting estimator thread 0... [ 656.370448][T15859] netlink: 'syz.2.2721': attribute type 29 has an invalid length. [ 656.388340][T15861] netlink: 'syz.2.2721': attribute type 29 has an invalid length. [ 656.420599][T15871] IPVS: using max 47 ests per chain, 112800 per kthread [ 656.984469][ T5866] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 657.001404][T15902] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2732'. [ 657.051130][ T30] audit: type=1400 audit(1753005906.356:779): avc: denied { map } for pid=15903 comm="syz.5.2734" path="/dev/sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 657.074994][ C1] vkms_vblank_simulate: vblank timer overrun [ 657.154273][ T5866] usb 9-1: Using ep0 maxpacket: 32 [ 657.161303][ T1152] hsr_slave_0: left promiscuous mode [ 657.169153][ T5866] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 657.174755][ T1152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 657.203262][ T1152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 657.230201][ T5866] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 657.267376][ T5866] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 657.287602][ T1152] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 657.301921][ T5866] usb 9-1: Product: syz [ 657.310900][ T5866] usb 9-1: Manufacturer: syz [ 657.325097][ T1152] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 657.343795][ T5866] usb 9-1: SerialNumber: syz [ 657.364805][ T5866] usb 9-1: config 0 descriptor?? [ 657.370331][T15891] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 657.407859][ T1152] veth1_macvtap: left promiscuous mode [ 657.413395][ T1152] veth0_macvtap: left promiscuous mode [ 657.438957][ T1152] veth1_vlan: left promiscuous mode [ 657.471619][ T1152] veth0_vlan: left promiscuous mode [ 657.953659][ T1152] pim6reg (unregistering): left allmulticast mode [ 658.444303][ T5866] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 658.547988][T15954] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2748'. [ 658.576562][T15954] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2748'. [ 658.664240][ T5866] usb 3-1: Using ep0 maxpacket: 8 [ 658.888157][ T1152] team0 (unregistering): Port device team_slave_1 removed [ 658.941819][ T1152] team0 (unregistering): Port device team_slave_0 removed [ 659.039182][ T5866] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 659.106498][ T5866] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 659.143901][ T5866] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 659.199527][ T5866] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 659.369252][ T5866] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 659.464407][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.734389][ T5866] usb 3-1: GET_CAPABILITIES returned 0 [ 659.739947][ T5866] usbtmc 3-1:16.0: can't read capabilities [ 659.822939][ T92] usb 9-1: USB disconnect, device number 4 [ 659.931988][T15968] netlink: 'syz.5.2752': attribute type 2 has an invalid length. [ 659.970951][T15968] netlink: 'syz.5.2752': attribute type 1 has an invalid length. [ 660.009871][T15968] netlink: 193500 bytes leftover after parsing attributes in process `syz.5.2752'. [ 660.040300][T15968] nbd: illegal input index 14681964 [ 660.900807][T15998] input: syz1 as /devices/virtual/input/input35 [ 661.902302][ T10] usb 3-1: USB disconnect, device number 63 [ 662.014458][ T880] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 662.087189][T16029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2763'. [ 662.102338][T16029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2763'. [ 662.175491][ T880] usb 1-1: Using ep0 maxpacket: 32 [ 662.193170][ T880] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 662.251421][ T880] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 662.260931][ T880] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 662.368169][ T880] usb 1-1: Product: syz [ 662.388829][ T880] usb 1-1: Manufacturer: syz [ 662.418503][ T880] usb 1-1: SerialNumber: syz [ 662.471637][ T880] usb 1-1: config 0 descriptor?? [ 662.518554][T16021] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 662.604054][T16042] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2768'. [ 663.925663][T16065] input: syz1 as /devices/virtual/input/input36 [ 664.663122][T16083] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2774'. [ 664.883968][ T5866] usb 1-1: USB disconnect, device number 42 [ 666.364155][ T880] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 666.423407][T16141] netlink: 'syz.7.2792': attribute type 2 has an invalid length. [ 666.432805][T16141] netlink: 'syz.7.2792': attribute type 1 has an invalid length. [ 666.442452][T16141] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.2792'. [ 666.477358][T16141] nbd: must specify at least one socket [ 666.510561][T16144] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pid=16144 comm=syz.2.2793 [ 666.586736][ T880] usb 9-1: Using ep0 maxpacket: 32 [ 666.991251][ T880] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 667.036185][ T880] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 667.085764][ T880] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 667.093977][ T880] usb 9-1: Product: syz [ 667.139430][ T880] usb 9-1: Manufacturer: syz [ 667.184288][ T880] usb 9-1: SerialNumber: syz [ 667.216350][ T880] usb 9-1: config 0 descriptor?? [ 667.228807][T16123] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 667.954579][T16192] netlink: 59 bytes leftover after parsing attributes in process `syz.5.2804'. [ 668.607001][T16203] netlink: 'syz.2.2806': attribute type 2 has an invalid length. [ 668.616603][T16203] netlink: 'syz.2.2806': attribute type 1 has an invalid length. [ 668.625218][T16203] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2806'. [ 668.635524][T16203] nbd: must specify at least one socket [ 669.093979][ T880] usb 9-1: USB disconnect, device number 5 [ 669.104885][T16208] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 669.152631][T16208] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 669.385068][T16208] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.428230][T16208] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.437682][T16208] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.449831][T16208] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.574235][ T5885] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 670.746716][ T5885] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 671.032408][ T5885] usb 1-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 671.092246][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.176005][ T5885] usb 1-1: config 0 descriptor?? [ 671.231226][ T5885] usb 1-1: bad CDC descriptors [ 671.961722][T16292] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2828'. [ 672.690051][ T976] usb 1-1: USB disconnect, device number 43 [ 672.714455][T16309] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pid=16309 comm=syz.0.2833 [ 673.565505][T16330] tipc: Started in network mode [ 673.571084][T16330] tipc: Node identity a2819bbb761c, cluster identity 4711 [ 673.588595][T16330] tipc: Enabled bearer , priority 0 [ 673.609314][T16330] syzkaller0: entered promiscuous mode [ 673.619731][T16330] syzkaller0: entered allmulticast mode [ 673.689193][T16330] tipc: Resetting bearer [ 673.700237][T16329] tipc: Resetting bearer [ 673.713392][T16329] tipc: Disabling bearer [ 674.254265][ T5885] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 674.405893][ T5885] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 674.417770][ T5885] usb 9-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 674.428012][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.439734][ T5885] usb 9-1: config 0 descriptor?? [ 674.460554][ T5885] usb 9-1: bad CDC descriptors [ 674.514125][ T976] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 674.714217][ T976] usb 3-1: Using ep0 maxpacket: 8 [ 674.720800][ T976] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 674.729269][ T976] usb 3-1: config 179 has no interface number 0 [ 674.735866][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 674.747086][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 674.758725][ T976] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 674.769987][ T976] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 674.783314][ T976] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 674.792372][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.802371][T16345] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 675.220685][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 675.220692][ T5885] usb 3-1: USB disconnect, device number 64 [ 675.220730][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 675.243499][ C0] vkms_vblank_simulate: vblank timer overrun [ 676.890069][ T5885] usb 9-1: USB disconnect, device number 6 [ 677.514222][ T976] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 677.724481][ T976] usb 6-1: Using ep0 maxpacket: 8 [ 677.740515][ T976] usb 6-1: unable to get BOS descriptor or descriptor too short [ 677.757020][ T976] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 677.766600][ T976] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 677.803963][ T976] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 677.830536][ T976] usb 6-1: New USB device found, idVendor=1d6b, idProduct=1101, bcdDevice= 0.40 [ 677.841819][ T976] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.880128][ T976] usb 6-1: Product: syz [ 677.897715][ T976] usb 6-1: Manufacturer: syz [ 677.913194][ T976] usb 6-1: SerialNumber: syz [ 678.045589][T16441] syz.2.2870: attempt to access beyond end of device [ 678.045589][T16441] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 679.008896][T16452] syzkaller0: entered promiscuous mode [ 679.057075][T16452] syzkaller0: entered allmulticast mode [ 679.484248][ T10] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 679.647664][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 679.860011][ T10] usb 3-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 679.968850][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.110707][ T976] usb 6-1: 0:2 : does not exist [ 680.129492][ T10] usb 3-1: config 0 descriptor?? [ 680.167918][ T10] usb 3-1: bad CDC descriptors [ 680.202343][ T976] usb 6-1: USB disconnect, device number 49 [ 680.252407][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 681.359029][T16485] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2879'. [ 681.662454][T16489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2880'. [ 682.160777][ T5885] usb 3-1: USB disconnect, device number 65 [ 682.630809][T16511] binder: BINDER_SET_CONTEXT_MGR already set [ 682.648705][T16511] binder: 16509:16511 ioctl 4018620d 200000000040 returned -16 [ 684.565717][T16592] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2903'. [ 684.599930][T16591] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2903'. [ 685.296574][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.302897][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.814458][ T30] audit: type=1400 audit(1753005935.126:780): avc: denied { getopt } for pid=16615 comm="syz.5.2908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 686.094332][ T5885] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 686.264703][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 686.271494][ T5885] usb 1-1: config 4 has an invalid interface number: 129 but max is 0 [ 686.287758][ T5885] usb 1-1: config 4 has no interface number 0 [ 686.293925][ T5885] usb 1-1: config 4 interface 129 altsetting 8 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 686.312217][ T5885] usb 1-1: config 4 interface 129 has no altsetting 0 [ 686.321722][ T5885] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=ea.e3 [ 686.331160][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 686.356593][ T5885] usb 1-1: Product: syz [ 686.375323][ T5885] usb 1-1: Manufacturer: syz [ 686.384257][ T5885] usb 1-1: SerialNumber: syz [ 686.739213][ T5885] adutux 1-1:4.129: interrupt endpoints not found [ 686.765657][ T5885] usb 1-1: USB disconnect, device number 44 [ 686.864328][ T880] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 686.964158][ T5866] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 687.026826][ T880] usb 3-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=de.ad [ 687.049754][ T880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.060417][ T880] usb 3-1: config 0 descriptor?? [ 687.134260][ T5866] usb 9-1: Using ep0 maxpacket: 8 [ 687.144976][ T5866] usb 9-1: config 5 has an invalid interface number: 35 but max is 1 [ 687.153093][ T5866] usb 9-1: config 5 has an invalid interface number: 4 but max is 1 [ 687.164143][ T5866] usb 9-1: config 5 has an invalid interface number: 4 but max is 1 [ 687.184116][ T5866] usb 9-1: config 5 has no interface number 0 [ 687.190235][ T5866] usb 9-1: config 5 has no interface number 1 [ 687.204164][ T5866] usb 9-1: config 5 interface 35 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 687.224165][ T5866] usb 9-1: config 5 interface 4 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 687.249234][ T5866] usb 9-1: config 5 interface 35 has no altsetting 0 [ 687.264253][ T5866] usb 9-1: config 5 interface 4 has no altsetting 0 [ 687.270900][ T5866] usb 9-1: config 5 interface 4 has no altsetting 1 [ 687.274848][ T880] snd-usb-hiface 3-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 687.304434][ T5866] usb 9-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=d4.1b [ 687.313544][ T5866] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.492721][ T880] usb 3-1: USB disconnect, device number 66 [ 687.645501][ T5866] usb 9-1: Product: syz [ 687.657388][ T5866] usb 9-1: Manufacturer: syz [ 687.662010][ T5866] usb 9-1: SerialNumber: syz [ 687.767231][T16688] netlink: 'syz.5.2920': attribute type 2 has an invalid length. [ 687.800778][T16688] netlink: 'syz.5.2920': attribute type 1 has an invalid length. [ 687.816552][T16688] netlink: 193500 bytes leftover after parsing attributes in process `syz.5.2920'. [ 687.826218][T16688] nbd: must specify at least one socket [ 687.908790][ T5866] ttusbir 9-1:5.35: cannot find expected altsetting [ 687.932427][ T5866] ttusbir 9-1:5.4: cannot find expected altsetting [ 687.956954][ T5866] usb 9-1: USB disconnect, device number 7 [ 688.071653][T16700] ucma_write: process 1478 (syz.5.2925) changed security contexts after opening file descriptor, this is not allowed. [ 688.515099][ T976] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 689.064207][ T976] usb 3-1: Using ep0 maxpacket: 8 [ 689.070645][ T976] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 689.104212][ T976] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 689.144245][ T976] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 689.171235][ T976] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 689.202721][ T976] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 689.212588][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.366910][T16728] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1373 sclass=netlink_route_socket pid=16728 comm=syz.5.2937 [ 689.485123][ T976] usb 3-1: GET_CAPABILITIES returned 0 [ 689.511420][ T976] usbtmc 3-1:16.0: can't read capabilities [ 689.740669][ T30] audit: type=1400 audit(1753005939.046:781): avc: denied { write } for pid=16743 comm="syz.5.2943" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 689.768247][T16744] usb usb8: usbfs: process 16744 (syz.5.2943) did not claim interface 0 before use [ 689.795885][ T976] usb 3-1: USB disconnect, device number 67 [ 689.827658][T16746] input: syz1 as /devices/virtual/input/input39 [ 690.110010][T16754] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2946'. [ 690.122541][T16754] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2946'. [ 690.865247][T16765] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2949'. [ 691.077242][T16774] binder: BINDER_SET_CONTEXT_MGR already set [ 691.083228][T16774] binder: 16766:16774 ioctl 4018620d 200000000040 returned -16 [ 691.107398][T16774] binder: 16766:16774 ioctl c0306201 200000000240 returned -11 [ 691.991500][T16787] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 692.104225][ T5885] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 692.247260][T16792] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2958'. [ 692.256481][T16792] tipc: Enabling of bearer rejected, failed to enable media [ 692.266922][ T5885] usb 6-1: Using ep0 maxpacket: 8 [ 692.273637][ T5885] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 692.282215][ T5885] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 692.292452][ T5885] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 692.302411][ T5885] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 692.313286][ T5885] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 692.324265][ T976] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 692.334035][ T5885] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 692.347851][ T5885] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.487248][ T976] usb 9-1: Using ep0 maxpacket: 8 [ 692.497583][T16800] input: syz1 as /devices/virtual/input/input40 [ 692.509174][ T976] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 692.523814][ T976] usb 9-1: config 179 has no interface number 0 [ 692.540310][ T976] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 692.559088][ T976] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 692.570914][ T976] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 692.589011][ T976] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 692.594441][ T5885] usb 6-1: GET_CAPABILITIES returned 0 [ 692.599618][ T976] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 692.622449][ T5885] usbtmc 6-1:16.0: can't read capabilities [ 692.628041][ T976] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 692.639009][ T976] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.678182][T16790] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 692.689880][ T976] xpad 9-1:179.65: probe with driver xpad failed with error -5 [ 692.840862][ T976] usb 6-1: USB disconnect, device number 50 [ 692.883837][T16812] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2966'. [ 692.960260][T16790] [ 692.962596][T16790] ====================================================== [ 692.969589][T16790] WARNING: possible circular locking dependency detected [ 692.976602][T16790] 6.16.0-rc6-syzkaller-00279-gbf61759db409 #0 Not tainted [ 692.983691][T16790] ------------------------------------------------------ [ 692.990702][T16790] syz.8.2957/16790 is trying to acquire lock: [ 692.996763][T16790] ffff8880506bc870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_submit.part.0+0x25/0x2e0 [ 693.006966][T16790] [ 693.006966][T16790] but task is already holding lock: [ 693.014330][T16790] ffff88805d55fcb0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1dd/0xc10 [ 693.023137][T16790] [ 693.023137][T16790] which lock already depends on the new lock. [ 693.023137][T16790] [ 693.033538][T16790] [ 693.033538][T16790] the existing dependency chain (in reverse order) is: [ 693.042552][T16790] [ 693.042552][T16790] -> #3 (&ff->mutex){+.+.}-{4:4}: [ 693.049771][T16790] __mutex_lock+0x199/0xb90 [ 693.054803][T16790] input_ff_flush+0x63/0x180 [ 693.059915][T16790] uinput_dev_flush+0x2a/0x40 [ 693.065117][T16790] input_flush_device+0xa4/0x110 [ 693.070584][T16790] evdev_release+0x344/0x420 [ 693.075707][T16790] __fput+0x3ff/0xb70 [ 693.080198][T16790] fput_close_sync+0x118/0x260 [ 693.085468][T16790] __x64_sys_close+0x8b/0x120 [ 693.090654][T16790] do_syscall_64+0xcd/0x4c0 [ 693.095665][T16790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.102063][T16790] [ 693.102063][T16790] -> #2 (&dev->mutex#2){+.+.}-{4:4}: [ 693.109526][T16790] __mutex_lock+0x199/0xb90 [ 693.114532][T16790] input_register_handle+0xdc/0x620 [ 693.120251][T16790] kbd_connect+0xca/0x160 [ 693.125084][T16790] input_attach_handler.isra.0+0x181/0x260 [ 693.131396][T16790] input_register_device+0xa84/0x1130 [ 693.137278][T16790] acpi_button_add+0x582/0xb70 [ 693.142546][T16790] acpi_device_probe+0xc9/0x330 [ 693.147905][T16790] really_probe+0x23e/0xa90 [ 693.152914][T16790] __driver_probe_device+0x1de/0x440 [ 693.158709][T16790] driver_probe_device+0x4c/0x1b0 [ 693.164237][T16790] __driver_attach+0x283/0x580 [ 693.169503][T16790] bus_for_each_dev+0x13e/0x1d0 [ 693.174861][T16790] bus_add_driver+0x2e9/0x690 [ 693.180047][T16790] driver_register+0x15c/0x4b0 [ 693.185315][T16790] __acpi_bus_register_driver+0xdf/0x130 [ 693.191456][T16790] acpi_button_driver_init+0x82/0x110 [ 693.197331][T16790] do_one_initcall+0x120/0x6e0 [ 693.202597][T16790] kernel_init_freeable+0x5c2/0x900 [ 693.208298][T16790] kernel_init+0x1c/0x2b0 [ 693.213130][T16790] ret_from_fork+0x5d4/0x6f0 [ 693.218230][T16790] ret_from_fork_asm+0x1a/0x30 [ 693.223499][T16790] [ 693.223499][T16790] -> #1 (input_mutex){+.+.}-{4:4}: [ 693.230777][T16790] __mutex_lock+0x199/0xb90 [ 693.235784][T16790] input_register_device+0x98a/0x1130 [ 693.241666][T16790] uinput_ioctl_handler.isra.0+0x1357/0x1df0 [ 693.248153][T16790] __x64_sys_ioctl+0x18e/0x210 [ 693.253442][T16790] do_syscall_64+0xcd/0x4c0 [ 693.258447][T16790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.264844][T16790] [ 693.264844][T16790] -> #0 (&newdev->mutex){+.+.}-{4:4}: [ 693.272382][T16790] __lock_acquire+0x126f/0x1c90 [ 693.277737][T16790] lock_acquire+0x179/0x350 [ 693.282742][T16790] __mutex_lock+0x199/0xb90 [ 693.287747][T16790] uinput_request_submit.part.0+0x25/0x2e0 [ 693.294055][T16790] uinput_dev_upload_effect+0x174/0x1f0 [ 693.300110][T16790] input_ff_upload+0x56b/0xc10 [ 693.305377][T16790] evdev_do_ioctl+0xf40/0x1b30 [ 693.310648][T16790] evdev_ioctl+0x16f/0x1a0 [ 693.315574][T16790] __x64_sys_ioctl+0x18e/0x210 [ 693.320842][T16790] do_syscall_64+0xcd/0x4c0 [ 693.325848][T16790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.332242][T16790] [ 693.332242][T16790] other info that might help us debug this: [ 693.332242][T16790] [ 693.342448][T16790] Chain exists of: [ 693.342448][T16790] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex [ 693.342448][T16790] [ 693.354779][T16790] Possible unsafe locking scenario: [ 693.354779][T16790] [ 693.362206][T16790] CPU0 CPU1 [ 693.367551][T16790] ---- ---- [ 693.372894][T16790] lock(&ff->mutex); [ 693.376860][T16790] lock(&dev->mutex#2); [ 693.383609][T16790] lock(&ff->mutex); [ 693.390091][T16790] lock(&newdev->mutex); [ 693.394402][T16790] [ 693.394402][T16790] *** DEADLOCK *** [ 693.394402][T16790] [ 693.402522][T16790] 2 locks held by syz.8.2957/16790: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 693.407697][T16790] #0: ffff88807cf84118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl+0x7f/0x1a0 [ 693.416735][T16790] #1: ffff88805d55fcb0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1dd/0xc10 [ 693.425943][T16790] [ 693.425943][T16790] stack backtrace: [ 693.431810][T16790] CPU: 1 UID: 0 PID: 16790 Comm: syz.8.2957 Not tainted 6.16.0-rc6-syzkaller-00279-gbf61759db409 #0 PREEMPT(full) [ 693.431829][T16790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 693.431838][T16790] Call Trace: [ 693.431844][T16790] [ 693.431849][T16790] dump_stack_lvl+0x116/0x1f0 [ 693.431873][T16790] print_circular_bug+0x275/0x350 [ 693.431896][T16790] check_noncircular+0x14c/0x170 [ 693.431926][T16790] __lock_acquire+0x126f/0x1c90 [ 693.431942][T16790] lock_acquire+0x179/0x350 [ 693.431954][T16790] ? uinput_request_submit.part.0+0x25/0x2e0 [ 693.431971][T16790] ? __pfx___might_resched+0x10/0x10 [ 693.431992][T16790] __mutex_lock+0x199/0xb90 [ 693.432005][T16790] ? uinput_request_submit.part.0+0x25/0x2e0 [ 693.432021][T16790] ? uinput_request_reserve_slot+0x3ca/0x4d0 [ 693.432037][T16790] ? uinput_request_submit.part.0+0x25/0x2e0 [ 693.432053][T16790] ? __pfx___mutex_lock+0x10/0x10 [ 693.432066][T16790] ? _raw_spin_unlock+0x28/0x50 [ 693.432086][T16790] ? __mutex_trylock_common+0xe9/0x250 [ 693.432101][T16790] ? __pfx_uinput_request_reserve_slot+0x10/0x10 [ 693.432118][T16790] ? __pfx___might_resched+0x10/0x10 [ 693.432138][T16790] ? uinput_request_submit.part.0+0x25/0x2e0 [ 693.432153][T16790] uinput_request_submit.part.0+0x25/0x2e0 [ 693.432171][T16790] uinput_dev_upload_effect+0x174/0x1f0 [ 693.432187][T16790] ? __pfx_uinput_dev_upload_effect+0x10/0x10 [ 693.432207][T16790] ? __might_fault+0x13b/0x190 [ 693.432231][T16790] input_ff_upload+0x56b/0xc10 [ 693.432247][T16790] evdev_do_ioctl+0xf40/0x1b30 [ 693.432270][T16790] ? __pfx_evdev_do_ioctl+0x10/0x10 [ 693.432299][T16790] evdev_ioctl+0x16f/0x1a0 [ 693.432320][T16790] ? __pfx_evdev_ioctl+0x10/0x10 [ 693.432342][T16790] __x64_sys_ioctl+0x18e/0x210 [ 693.432361][T16790] do_syscall_64+0xcd/0x4c0 [ 693.432375][T16790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.432389][T16790] RIP: 0033:0x7f6aef18e9a9 [ 693.432401][T16790] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 693.432416][T16790] RSP: 002b:00007f6af003c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 693.432428][T16790] RAX: ffffffffffffffda RBX: 00007f6aef3b5fa0 RCX: 00007f6aef18e9a9 [ 693.432438][T16790] RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000004 [ 693.432447][T16790] RBP: 00007f6aef210d69 R08: 0000000000000000 R09: 0000000000000000 [ 693.432456][T16790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 693.432464][T16790] R13: 0000000000000000 R14: 00007f6aef3b5fa0 R15: 00007fffab0cc8e8 [ 693.432477][T16790] [ 694.212021][T16778] bond0: (slave syz_tun): Releasing backup interface [ 694.349108][ T6887] bridge_slave_1: left allmulticast mode [ 694.356829][ T6887] bridge_slave_1: left promiscuous mode [ 694.362484][ T6887] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.372032][ T6887] bridge_slave_0: left allmulticast mode [ 694.378694][ T6887] bridge_slave_0: left promiscuous mode [ 694.385001][ T6887] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.470625][ T6887] bond2 (unregistering): (slave gretap1): Releasing active interface [ 694.478868][ T6887] gretap1 (unregistering): left promiscuous mode [ 694.485476][ T6887] gretap1 (unregistering): left allmulticast mode [ 694.670061][ T6887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 694.679330][ T6887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 694.688388][ T6887] bond0 (unregistering): Released all slaves [ 694.768261][ T6887] bond1 (unregistering): Released all slaves [ 694.846442][ T6887] bond2 (unregistering): Released all slaves [ 694.854248][ T6887] bond3 (unregistering): Released all slaves [ 695.136411][ T6887] hsr_slave_0: left promiscuous mode [ 695.145919][ T6887] hsr_slave_1: left promiscuous mode [ 695.151428][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 695.160963][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 695.175226][ T6887] pimreg (unregistering): left allmulticast mode [ 695.189457][ T6887] pim6reg (unregistering): left allmulticast mode [ 695.439259][ T6887] team0 (unregistering): Port device team_slave_1 removed [ 695.466347][ T6887] team0 (unregistering): Port device team_slave_0 removed [ 695.568139][ T13] smc: removing ib device syz0 [ 695.993993][ T6887] IPVS: stop unused estimator thread 0... [ 696.729194][ T6887] bridge_slave_1: left allmulticast mode [ 696.736494][ T6887] bridge_slave_1: left promiscuous mode [ 696.742148][ T6887] bridge0: port 2(bridge_slave_1) entered disabled state [ 696.751684][ T6887] bridge_slave_0: left allmulticast mode [ 696.757369][ T6887] bridge_slave_0: left promiscuous mode [ 696.764541][ T6887] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.871944][ T6887] bond1 (unregistering): (slave geneve3): Releasing active interface [ 696.881946][ T6887] geneve3 (unregistering): left promiscuous mode [ 697.005330][ T6887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 697.014737][ T6887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 697.023551][ T6887] bond0 (unregistering): Released all slaves [ 697.097549][ T6887] bond1 (unregistering): Released all slaves [ 697.380189][ T6887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 697.389701][ T6887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 697.398691][ T6887] bond0 (unregistering): Released all slaves [ 697.470714][ T6887] bond1 (unregistering): Released all slaves [ 697.541324][ T6887] bond2 (unregistering): Released all slaves [ 697.719552][ T6887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 697.728745][ T6887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 697.737967][ T6887] bond0 (unregistering): Released all slaves [ 697.851148][ T6887] tipc: Left network mode [ 697.860655][ T6887] tipc: Disabling bearer [ 697.871535][ T6887] tipc: Left network mode [ 698.265780][ T6887] team0: left promiscuous mode [ 698.270571][ T6887] team_slave_0: left promiscuous mode [ 698.284977][ T6887] team_slave_1: left promiscuous mode [ 698.291549][ T6887] batadv_slave_1: left promiscuous mode [ 698.300888][ T6887] hsr_slave_0: left promiscuous mode [ 698.307120][ T6887] hsr_slave_1: left promiscuous mode [ 698.312745][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 698.323552][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 698.335509][ T6887] hsr_slave_0: left promiscuous mode [ 698.341087][ T6887] hsr_slave_1: left promiscuous mode [ 698.347414][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 698.356381][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 698.366248][ T6887] hsr_slave_0: left promiscuous mode [ 698.371830][ T6887] hsr_slave_1: left promiscuous mode [ 698.378772][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 698.386444][ T6887] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 698.607471][ T6887] team0 (unregistering): Port device team_slave_1 removed [ 698.633007][ T6887] team0 (unregistering): Port device team_slave_0 removed [ 698.844912][ T6887] pim6reg (unregistering): left allmulticast mode [ 699.021555][ T6887] team0 (unregistering): Port device team_slave_1 removed [ 699.405982][ T6887] team0 (unregistering): Port device team_slave_1 removed [ 699.431843][ T6887] team0 (unregistering): Port device team_slave_0 removed [ 700.193844][ T6887] IPVS: stop unused estimator thread 0... [ 700.200882][ T6887] IPVS: stop unused estimator thread 0...