last executing test programs: 35.100144247s ago: executing program 3 (id=1473): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000880), 0x400) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0xb, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(r1, &(0x7f0000000740)=[{{&(0x7f00000002c0)=@l2tp={0x2, 0x0, @broadcast, 0x4}, 0x80, &(0x7f0000000340)=[{&(0x7f00000006c0)="cc5c84001214dbd9e5943aa8a315357330c56529d6b619a78687eea13ea02981afbb0fab70e8c3ab037cd82bd48f4947702a177974e7eff5f2ccdec909645f69e3dea5153157374459f6a21ba8609552d9ada54e81b0f19b55b77cf382ad229baa9decce1ea639a300f1fa65b945a0e29d36cb8ed369e91698c0e9", 0x7b}, {&(0x7f0000001400)="9af390e2aadb61017e08249a2485ad46a590a90910858e1ceefc66db2ed8f32bf6be0e2f94e7e4db6454393a128402ed26580c7c5ebc85db639da17c927c23dbde640ab030889e8b61f26d270bc73b21c9ac8ba542e6b4ad2cd147059128ba038e4b9ebb20537f437b23b46ec790720e1fb74cef3c677e9978662a84cf2fcf73c73a5e763358496737af6284226bad34fb9083f87d853ab78c816cf32c90bd5c40ff6446214552d29745d34e0c4bfa623d00e5cbb393972371503122a0f44135db5654ace67cddb85a12df91fcf994fc680afe5d34268b23447589ef3f5383d152bf6dd104984297180f896ec8b1ba50952c5ab76e144f5636692d7cf17922c9b447ed6d59553ec6085e07413034875c1ae0947280e1a6f0d5e7f23b32e56ead8590d3269fdcb624cc870968b2f100bf3bc3d2ab105a5f61456d4969181fbd207b6f4d6d9ca0a1920daabec06d0c5e276d18f2571e88373dd41af9080d72aa88b10f8900b48acb61a61007dd4dd0e9240af5382a26f68bd706a83d8df76a4a5d02b39d07f97c4f86dad9e14eb957cc4be52b027a462262589929e3d035188dd9f0561e3ba2de6bafe743d9ae397e9aa423644fba8b2d6425ac1cd78c76e52e04d3a29e74075625fb5e674bab02843991ce804e0d04961f2978f3749c5ad83f355ae5da936fd6e0178d2bd12aacbe0205aa9a15579fd61d738f8d36412e814ba500edaf28ea68b0e96fb1839acf8416d8f5df7fad3b663f68e2ee5784fd01c7021130a490e629b1348acf3479e0392ecabbeeb18ec421c26e76f6f5c480e7decc85a0583a56180f199d26090b10ee5057ec4c1e04be948a5960acda014d646cf91bfdfb9d327f8ab545f8b41e8dbab94f195b189a8642a6b95e0ceb36b640fbdfe21925cc110bd2ef2c3fe24f12f95771b60e2ffbc47e58b2237b5574cadc32aab0f0db3202e4adc44a0651ef97703957857cfb6022578c97802f486bd7f48129f0c120700d0b70e048618a9f1de9f34dbb1f92dadc86f09e6288eb1bdbd1f700cc2df781654dfd57d9da779607080d3bc6dede5818aa8d6c99fa1ffdbb6a1a43040fe1379cf2a8b4b862db428c29e388a6e6b863bc818c2139a0d4238f10baf22f498b6629181f997ac280547e92fe300d0f8dd8b6724df5aa14be73cd630b808a29bfb52707b8db7d0065bd753b3773f8df58c74ea56f4582caa2fa8532b8049fd9ba775afc5b92b767ed0b35d4c086d9af6f7b7ed96f5f9d3734e703fc683fe0ed82b7763c67734067759e27b60036a3b4c53526716c175d75a9fa6ed019d3e1047bcb9c6510665de23cc2802804a0c3a347faba392282df430e5e6141f9eb660f7cb0eaedb832a7880c953bc0188c1f28eb466799e2768886ef81096847f50159278b572b0cca7744d6a572a81ddd2bcea73da3c8a59680bcaaadaf95e1fe91e41a8036835975b072a9587c560e3da854c96c64011755d08fef5228bb2db62a445bc0b9e17dea88854cd6a7c8a288727d5690fc4941978dee5eda2dbdc85915e7a2fdae978adb217b3f6b31cf69b51b9f805f8b447a4868b442933fc0e03860a7084230ff8fdff70665717f9c0bade31f87f5de99643e800feceb0dfdd6d1b67d4056a52f0efa2ed2b1142132c6242d917b46d939aade6a362bf586058385d7fcef1b4e358a093d6781b9e9bf280520ff083a6026bf701237e38927ed21209dbf407a7944ef687b93619b181b9112477fa902f391a7163f93bec2d6369ffba644f4fd5139890fb66bd6017a61d9fd043154eb0ab0de3046cdb8a182a553cece0701a922518cf09cd1ab421ee8ec677a8d453cd8c21bdaa5f8dd804dfe80fffec8c4d778d5e260b65a2f0d3c1b09e9d6bd1f3746aa7fe07374a028a89fc96eb66affbcddfaa01a72058566e33af88e37f43fbba73c0423d54079fad54c136ec5fcd61d5134f833ab44f6cfbc2348871f190ac4c4bc20c97fcb29f4823a8e3bf76f85b10dfd33df0001646a7e0b2ee3e14455f6c8f225b80eed457e772cb2504ded46a24e911428decff4a130be797b6530c33ec1be7b0dd4df6206ec227e6e9050c1efa1a1c4c8dfda776336bcb876d80043195de773fbcf0d3abe53e9a38da0af7a6598815a71ffc937203f5a04e87eb532e579d66d42b06b791b6ebd50e7855f6645d29434bb0280fdf1511b163b12838f39ca864516711501bbe345d46b34ab2f0d8317d45376f73e302a90f5c362b18e1840668a9f27e90f2b715b4b6ae7a6dc387583110a42fd4977635275f7244a1912d0c67cf53d5da8a384839020d71db234fcc4388a735275763f01b2b4967e99f551e489bcc28f693a1e688ac8c39a971f8ae9d973cc7adac4a642a7a84ecca2d0bd24c300b94dff82fa4f95c1ce5fdb9128466443cb8442048e53cd46334d59774de0e2ceefcd4cd2e6c9da7cdc2162346111f7da236d72f33d509d73133951e1a3f84fa7e767cf56", 0x6dc}], 0x2}}], 0x1, 0x11) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NFQNL_MSG_VERDICT(r2, &(0x7f0000000640)={&(0x7f0000000580), 0xc, &(0x7f0000000600)={&(0x7f0000000780)={0x9c, 0x1, 0x3, 0x201, 0x0, 0x0, {0xc, 0x0, 0x8}, [@NFQA_EXP={0x88, 0xf, 0x0, 0x1, [@CTA_EXPECT_TUPLE={0x84, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8004}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 34.883615774s ago: executing program 3 (id=1474): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x11, @private=0xa010101, 0x2, 0x0, 'ovf\x00', 0x11, 0xfffffff8, 0x15}, 0x2c) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000001c0)={"04dfc86351907bcbc9293982262169af775bedfb0a63cb8031ecdc0051097e022d45a9640a4a4b506dc328f61ac030dacac442d82b9e81e6847961e65610b8f6e25f9eaf1a9f48ac011b67d68f8725991345a1f8ed6450a11246c6424cd7837f6bfc47319662ba0d0f44149fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8a481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16893a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2abe3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521afbcd560c15cd9f33e36417a251af7100392b6cdb000000000000000efb5589f279cfd594911cb11f2a7336af10b28e80056a2eec8287c735f2346449f1629fde95d6c78bed90645bb280e222976d5721ee6dd6068cfd6174d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a450a32cfdfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f20a1847642018840b49c335074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0f8de9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf2556ce92ae6438bb3e3aa258c8c4ba6646f99f5a3d4f14f677353722cc81a8ef1f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c50263b3e0314004ec808df7cec279df5785fa2124d1650563799defc378cb9506ee7142eb108b3f4125ade3d9a73646bfdac795c753895b2ad51d358eff496d1c1a885c30b85b50eca89bf14ee50ae3301805f1691b3a391d7575c9a0a514710ad3e590491c60bdab122222c66cbb155452a01cb9750d14ffdc77ad11d4495c53bf38c8185c769c1409eb0b1c613eac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c50527200"}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x1, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x51, &(0x7f0000000100)=[{&(0x7f00000006c0)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703360000001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 33.551189387s ago: executing program 3 (id=1478): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f000001b700)=""/102392, 0x18ff8) add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = fsmount(r0, 0x1, 0x6) fchdir(r2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f00000000c0)={'#! ', '', [{0x20, 'user\x00'}, {0x20, '#! '}, {0x20, '@c\x13\x98\x89\xc5~\xb3\xfb\xe0\'\xbd\xd0\xb2\xaa\xec\x16\xf9\xbd\x11\xa1\xf1\x1aoL\x80!\x82\xedg\x85\xa6[!U\xa0K\xb8\xe6^\xa8a\xcc\xf7\x10H\xfd~\xb3%\x16$8'}, {0x20, 'user\x00'}, {0x20, '/-'}]}, 0x4d) 29.715679304s ago: executing program 2 (id=1495): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setscheduler(0x0, 0x5, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000200), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000000)=0x2) preadv2(r4, &(0x7f0000000300)=[{&(0x7f00000005c0)=""/272, 0x110}], 0x1, 0x4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r6 = dup2(r5, r5) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000001c0)={0x14000000}) 29.554211212s ago: executing program 0 (id=1496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340), 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x1, 0x805, 0x0, 0x0) 28.558354068s ago: executing program 4 (id=1497): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) 28.557355488s ago: executing program 2 (id=1498): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xe, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000000500000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0, r2, 0x0, 0x4}, 0x18) readahead(r3, 0x401, 0x1000) sendmmsg$inet(r1, &(0x7f0000005f40)=[{{&(0x7f0000000d00)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000003400)=ANY=[@ANYBLOB="20000000000000000000000007000000440cd1700000000700000e0f940401001400000000000000000600000200000002000000000000001100000000000000000000000100000009000000000000001400000000000000eaffffff0100000006000000000000001400000000000000000000000200000006"], 0x80}}, {{&(0x7f00000010c0)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f00000012c0)=ANY=[], 0x28}}], 0x2, 0x4000004) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="79129800000000006113280000000000bf2020000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000002c650000000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e80100008000000000887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000000000000000005f37d83f84e98a523d80bd0d0d703f37ca363f601ae899a56715a0a62a26a0f6a5480a55c22fe394ae0000000000000000000000000000437d57defb79ea000500000000000000000000f014a4a318ba48d35ae9f438000000000000db894b62a614cb1fdd46619c5d2200000000000700000000000000000000006dcd2f421400f69947e4f26e099c9e8369080663c909b7e7c87e3b5e8e5a6df77c8f7338cd5a85f211a41b5d529d4243e47d7ab0d5991756b59d363ba30b18fc2ff189a4e8db38ab97c6a125e2785619e84c6a2b50f0e3ff83ef5149aff43dc899fdebdc2c496e6bdd4dd4d21f06fe133f4444272c5f0839ad663100452a6c6b6421f7e89a33b339401eee2cd466ab2a93a1ee7fb8a9e455ba1c6e17b02a1cd7bf35d36cf5b2a0f063469ae0d0b9fc042b48e98626eb0f9754d8cbbefa3079fe63063047baff09e9aaf7600000fba9a88db9ebef86f7cb522a784bb6d37e5f802757a15c6735138b493db9df53440a63fc565a0b190a710ae1e6807cbeb415ac841e94b706974160a60a14e571274f333d23186143b95514c79b50994cb39cda343bda8f01cf8ec7cdfdace0289e83ce50a57d69bfecfaf69fe7ff5b0375a47d3eb57b41d8a0589b82a1cf1149ba3f21ea2b65433321eb1a6f04ecc713c2b26d27baa49e54c2babec86335b9f418b5a5eb997bc9dd65197124b9aa80fc4aa8defb986bf05c41b919886bb81ecd3d24cf9ecc7004000000000000002c70d32f5d55ef2a2cf7560cb2884f46a92b3c25550f73e407fc5d514b2b7a6b690e290e676266addb7d96e723dec9c418eec8c48dffb6f432b4d5fef16e4f0051ba7efc690022c3f62b37cb5682d8bfdfc637ad3bf089ef0117bcd395322fcfb8e8e0a6e2babceb5f289b1d991770681192bcd0b584c3497e455f30ab918a690514a87a7d8e1d5f169a4e680e9c390071d26f2e0e26fc062f2785f14c0404fe01fb4000000000000000577dcb1698a9021a36d73ed03651c1937b2c84046023a1a0a87b208e33ad2d7c2892b176877264e1d699b7401eb917b289f6f67060fda0fa44b54bd87517a2bf09dba7209e41db4288b61bda5960952c45e5c55f2cd68bf9c6ff33e46109584bf42e8696ef1876564fef6f24cbbed0db8ab7fda1ffcc8c9fd4ab2cbe8f8df8e5535b12a942a948eacdaf308d48932064cfc3329da74f6f3e4409d6764a29680e312bf1a0143180e6493c9201ea916e6c9b2566c558ad88d9f7c0aebf82f5807eecefa97ada9bbd9e478e5d7748ee188bc719ca7a73dce5b6758a767c4c6b7572ab25eb2d73986379d5685cb438fe7091d097cc8f33fc0f83dee76603d6580f1c8fc4c37efd305ccc5a25678180425718bb9344e60dda8dae2677bb602d29aa0810616a2fdbca7020d72291b592b84223e2522ee01f5bdaa0fc4eb8d71d948a2baccf3ea2aa79d4d9069d8c0000000000000000000000321cd67859b4567badee56f158406f08683bdc5ffe2dedc916000c71f922fa2dfead7535999436a4aeb908781893479319b8b55e00d90ae6f09f06be2a0fc0bc17bef53331208112a0132350c0c5dd4607547079acc9471300dea6ae01742dccdae69f932cef80bca1bfcb57b9c852cf8358a580044772a80f20de36f707385380155be8907029d039a1d1447fc06b7020221e0d439f3f47edcf12f913dc8b6389a540340ae37804728ea65352e630c2e90424d58d72fdc1b28403e1dc7aad238b81df3b2d4166d656c6a9c73554bdf4f7312a4c0271e0eb45b4a596b7fa928ac3683f09fdaca46226c1df2c6c866cb4412d17d3d52c38cf0f7bd3b0eea2d4e06d061bb1b7c8c52f37f4036932d00028abd4527f5649bd60df638596fd639d7b16860033754ab13419429e5e39f290751ab6bd9392aef5519cd8c16e1f1cb1f225cc84a1a62497c1e436142fe28048a2b4d133905814a1808bc5b3e45eaa9eaebd946bee806968aeeb5a9eed87eba3d25d0b412a1b4cf2d419a58b09fc275c4395a0bd332eb538321465043e5967dd22459d0f52190a37f93ab823431a81fa6f54de61637fd473e19a6f567fead100e7d8cac149b66ebe9973af846146c62065a64854ed21e8b6f6fbe78474b753915a42efcb7da8ad18bacff8d69e0af1ca1f8174530a21820738412b100b54ee9b4a0dc22d5fe1cadecaea73fbfad087b19ce53177488d230539c5174f572a539d9d7c42698aa82bccf030ad393f25c10baa17e919f647d0e31877b7a6c1d8d86583f884a0c1da07b9b6dced06cdeb0094aa635a82f233b5993926b8970a0840ba116a7d20a40efb3bd03c4bdf380a2510a0a1ea69811ded68943c71218b42783b38959753978f222e1396b9b36dee2ce205122a000577cab29f48bff4f88c417e6bf5fb430d925596f29aca8677ca5a113aeaa5e0252ca17244d6c76e78ff1bbd81a71c4dfc72431d7f1126f8bdbf4056ee0f58a1bf83d53b1de07489541182dc4ee0f573c25b6c15dad930bc7a770b5a4f407d7a879db7185f15f80100000000000000739cc97db66ec6b925955d9a591808947fdd8d484ad27353230a449fdf87fc46c73b852fec931cfb6718acf3315bf5e577d00beb77c5514bc05d576a81345a03ad7aae74c5d2b77d45718348aed4fcbcd1441ff31b8f038824a989a9446a4a69367b228b3d174230b7320fc4d3c03368db573816dd0c04e65d6f8ce48283e76abdddbb965e0b2568e93c9cc5494a55421793f562c50c53f876cbde93c5cc7a3099c99d9775af010ba093f8a13b771782a3cfb24fbde6ef763e20c613164ab014d1906c4e098f1431b6b2886a155c4bac2911d7ee6a646f5913205ebd175e68975b93c330e4f9131788026b3b7cd5b6452c9e17452ac70000000000000000000000c71185f72436640fd4294fc3da230f9065095be47d7a848df12316c3c8b184fe110b061987fd79cf7d83443e69d08e2e839ae4fbe26ef7764f4870ef3bd0ec12eb45f60ca10dbfe329271f0bc93b28798e982e0dd32fc14bd4313c63b2dbb568f33fb45acad2dc7f438ea162c0709c0bbe1ea13e1e47399286e8143f400d7adf5f69e455706626814ee49274667f47769293451fd49885a152b8d2cf18febc7993f4a93893c6c7b7e46a230359ef2443e6bb9f50bb0faa5eaafd3ed6d551600c46b58a29fd7ccbbb0616f0be27302b683eccd742791d97f4a1daa0447f004426fd09b67d926f51525da63987bc73af35b28277879089b89fff6edab2fa1caf660a46a1a9f09e2d095b1c4be95c7c33dc81857f580e36c0a78d94dd879ee18de4a6475858d2ded2e3427ae007cc6f8e5e99aa146667f71ad83f3ddcf5db2dc396d7da499b65cd98125f20c284fc84d6a70be1de44b49c82022225292199c75cc26beab98dce4c331ed722f01d0d6314a72416814a565f4d90a5f8a255810f23541082f4b06f451e4724cd882f4d589600000000005854ca490d7df9cc293547c9a51aecc7a92f417f6a4d327737f1b198252358832dbe43507844a0cc112af4ce457c173fa64174ffd5ab9501eeb85508ebb60e169c0736c5960f2fe08735d6a7aa7c1f4a6433e77d3e547bbe6cf5b5d93a491ab4bba1ea7a1e6f37618b1d74cff3630d85a210092211be1ec12a30891eef590b19cdde055d626818c64e1c56b8918f33441a64b54946571b7bc70fb065d3bb1647f6f989ab8159e6d1cfa6c0ec7329d7d2263ca22144bf17d8692f03b592bd0f610096094da096233984e95b9a8216a6e60a104ae0bb5f77ac70b4390ea2cb6f6c40c928fae489f447240a25fd0a5bd9d5b6cd2a98f8804862922c11229c4e45c765e4d3348af3d3aadd5cc24b39437f1ea2df0000000000000000000000000022b90d93a267f3af4e02606f0ce6c2ffc4cab575a09d6e625f3248689005eb4a9c8df3c67e6b2b759cab3a7bedf1b927cd8ba6d13b3e7d7279515e3d6d20"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) 28.348165862s ago: executing program 4 (id=1499): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0xc4000) 28.216566918s ago: executing program 2 (id=1500): syz_usb_connect(0x0, 0x0, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x391200, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0xf7e) read$dsp(r0, &(0x7f00000002c0)=""/4096, 0x1000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x28}}, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) ioctl$SG_IO(r1, 0x2285, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) (fail_nth: 2) 28.202986489s ago: executing program 0 (id=1501): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000dd0000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1d, 0x8, &(0x7f0000000100)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x385000, 0x0) r1 = open$dir(0x0, 0x195802, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), r2) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0xc004811}, 0x4010) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000040)='{\x00', &(0x7f0000000080)='./file0\x00', r1) r3 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f00000000c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r6, 0x0, 0xf3a, 0x0) read$char_usb(r5, &(0x7f0000000000)=""/111, 0x6f) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$binfmt_misc(r6, &(0x7f0000000980), 0xfdef) 28.012559495s ago: executing program 4 (id=1502): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="b70000000000000007000000000000009500e200000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caa"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f00000000c0)=r0, 0x4) 27.473713101s ago: executing program 4 (id=1503): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket(0xa, 0x1, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000180)={0x3c, r1, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ffb}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008040}, 0x20000000) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r5, 0x40086408, &(0x7f0000000000)={0x4, 0x232}) ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f0000000980)=ANY=[@ANYBLOB="000000004c90020052feffff0300010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000006500000000000000000000000000000000000000000000000000450cdbfcf13f56ed8f8af9ca147a6124c5722e717833ae74976b6c3c312bf33104e23f1bc3eee6b9c7c298971e0b2aba41245674ccfb6b537ffb2792440000000002b28c6ca6c23abf4bc08e1bcf3222903177b54ae6a0d3288678a40020ea6d4a41c81538"]) ioctl$KVM_HAS_DEVICE_ATTR(r5, 0x4018aee3, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x49da}) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) fcntl$setpipe(r6, 0x407, 0x80000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) ioctl$KVM_IRQ_LINE_STATUS(r7, 0xc008ae67, &(0x7f00000001c0)={0x80000001, 0x81}) r8 = dup3(r4, r3, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x4, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x4e, 0x3c5b, 0x1, 0x24, 0xd, 0x2, 0x4, 0xffffffff, 0xe661, 0x0, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x243, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0xffffffff], [0x8, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x2, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x1, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0xfffffffe, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x4b, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x40060a7, 0x5, 0x16, 0xffffffff, 0x80000000, 0x6, 0x4, 0xc8, 0x7ff, 0xfffff000, 0x4, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x3, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x89, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000780)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000001b00)={0x0, "e09329b466f3dffe3e3130cb81877f25"}) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000002b00)={{r10}, 0x0, 0x0, @inherit={0x60, &(0x7f0000000880)={0x1, 0x3, 0x98, 0x2, {0x8, 0x2, 0x8, 0x0, 0x4}, [0xd, 0xfffffffffffffffd, 0xa]}}, @devid=r11}) r12 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) sendmsg$FOU_CMD_ADD(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x30, r12, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r13}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004091}, 0x10) io_uring_setup(0x6503, &(0x7f0000001300)={0x0, 0x8d5f, 0x1046, 0x11, 0x264}) 27.122809111s ago: executing program 0 (id=1505): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x80}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000140)) 27.122270815s ago: executing program 4 (id=1506): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x109040, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @loopback, 0x0, 0x1, [@rand_addr=0x64010100]}, 0x14) ioctl$TCFLSH(r0, 0x400455c8, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) write$rfkill(0xffffffffffffffff, &(0x7f0000000600)={0x2, 0x4, 0x1, 0x0, 0x1}, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0x3, 0xff) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r1}, 0x8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f00000003c0)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000440), &(0x7f0000000480)=r2}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x7, 0x1d, &(0x7f0000000500)=@raw=[@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7fffffff}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3d2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc429}, 0x94) 26.987944121s ago: executing program 1 (id=1507): syz_emit_vhci(&(0x7f0000001340)=ANY=[], 0x21) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000000)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0x5000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000780)={0x1, 0x1, &(0x7f0000000380)=""/240, &(0x7f0000000900)=""/103, &(0x7f0000000800)=""/90}) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, 0x0, 0x310) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="600000bf85f340181c51471a853500", @ANYRES16=0x0, @ANYBLOB="200028bd7000fddbdf2545000000080001007063690011000200303030303a30303a31302e300000000008008e00010000000e0001006e657464657673696d0000000f0002006e657464657673696d"], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x4800) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x1, @mcast1, 0x8000}}, {{0xa, 0x0, 0xb53, @empty, 0x80}}}, 0x108) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000400)=0xa) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0xc) sendmsg$AUDIT_SET(r4, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x3c, 0x3e9, 0x806, 0x70bd26, 0x25dfdbfd, {0x2, 0x0, 0x1, r2, 0xe, 0x9, 0x6, 0xffffffff, 0x0, 0x7fff, 0x9}, ["", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) socket$inet6(0xa, 0x80002, 0x0) 26.544923172s ago: executing program 0 (id=1508): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setscheduler(0x0, 0x5, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000200), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000000)=0x2) preadv2(r4, &(0x7f0000000300)=[{&(0x7f00000005c0)=""/272, 0x110}], 0x1, 0x4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r6 = dup2(r5, r5) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000001c0)={0x14000000}) 26.540722581s ago: executing program 1 (id=1509): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0), 0x0, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) 26.507567652s ago: executing program 1 (id=1510): r0 = syz_open_dev$vim2m(0x0, 0x7fff, 0x2) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000440)=""/243, 0xf3}], 0x1, 0xd5, 0x5) 26.436888284s ago: executing program 1 (id=1511): mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2204c96, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, 0x0, r0, 0x0, 0x46) syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x35, 0x1, 0xe4, 0x10, 0xbda, 0x139, 0x67c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0xff, 0x90, 0x2, [{{0x9, 0x4, 0xec, 0x4, 0x0, 0xb2, 0xa0, 0x9d, 0x7}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) 26.227640635s ago: executing program 0 (id=1512): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) r6 = syz_open_procfs(0x0, &(0x7f0000000cc0)='net/netlink\x00') read$FUSE(r6, &(0x7f00000027c0)={0x2020}, 0x2038) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01008c19", @ANYRES32=r2, @ANYBLOB="1c002f800c0002000000000000000000080001000600000004000380"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) 26.058839515s ago: executing program 3 (id=1513): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1e, 0x12, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x6}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @exit, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f0000000000)='syzkaller\x00', 0xb, 0xb6, &(0x7f0000000340)=""/182, 0x40f00, 0x20, '\x00', 0x0, @sk_lookup, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r2, 0x2, &(0x7f00000004c0)=[r0], &(0x7f0000000500)=[{0x3, 0x1, 0x7}, {0x2, 0x3, 0x9, 0x4}], 0x10, 0x40000}, 0x94) 25.931632544s ago: executing program 3 (id=1514): prctl$PR_MCE_KILL(0x29, 0x1, 0x2) r0 = socket(0x80000000000000a, 0x807, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000300)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x21, 0x0, @private, @broadcast}, @redirect={0x5, 0x0, 0x0, @private=0xa010102, {0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1}, {[@rr={0x7, 0xf, 0x0, [@private, @broadcast, @dev={0xac, 0x14, 0x14, 0xc}]}]}}}}}}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r10, @ANYBLOB], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0xff, 0x3}, 0x90) r11 = memfd_create(&(0x7f0000000b40)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\x00\x00\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x14M\x8b\xd0\xc0\xb8L\xbd\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b1\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\xe7\xf6\t\x9dJ\xa4^m\xf3\xb5Y\f\x8f\r\xd5)>A\xe9\xf59\'G[\xf0`\xf3\'\xe4\xb2\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I?^\xf3,\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW', 0x6) fallocate(r11, 0x0, 0x0, 0x400001) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000840)={r7, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) memfd_create(&(0x7f0000000040)='\x01\xfd\xae.+\xa6\x8c\xf8\xff2\x199\x94S,|\x99x?Ue[\xbd\xe1!\x03[d \xa0\x97\xf5G\x97A\xc2\xd8\xf0Uq\xe6+\xa5l\x94\v\xd3\a\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\xfa\x18\x8dR\xbb\xea5F\x00G\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xccV\xa6w%\x06\x19\x7f\xc3\xb3O\xe5t3\x03\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\xa1\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xe9k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6x\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00p+\x96\x1ei|n\xda\xee\x01\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\x9f\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\xf4\xcd\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xffY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\ti\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x17&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96\xb8\x02\x13pA\x19\tf\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcc\b\x00\x00\x00\x00\x00\x00\x00\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01;\xbfM.\xe3\x84\x82\x9c\x91\a\x9b\x191c\xaeLz\xe0\x04Daz\x8d\xc3\x03\xab\x8dEGC$\x00e,\x94#\xcd4\xf9\x05\x88.\x13\x03\x04\xdb\x00\x00\x00\x00\x00', 0x4) r12 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r12, 0xc0105512, &(0x7f0000000200)=@usbdevfs_disconnect={0x20000000}) 25.264633948s ago: executing program 0 (id=1515): ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) ioctl$MEDIA_REQUEST_IOC_REINIT(r0, 0x7c81, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000031c0)=[{{&(0x7f0000000340)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000440)=""/79, 0xf}, {&(0x7f0000000180)=""/4, 0x4}, {&(0x7f00000006c0)=""/198, 0xc6}, {&(0x7f00000003c0)=""/36, 0x24}, {&(0x7f00000007c0)=""/83, 0x53}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/216, 0xd8}, {&(0x7f0000000540)=""/49, 0x31}], 0x8, &(0x7f0000000b40)=""/32, 0x20}, 0x1}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000b80)=""/178, 0xb2}, {&(0x7f0000000c40)=""/255, 0xff}], 0x2}, 0x7}, {{&(0x7f0000000d80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000e00)=""/74, 0x4a}, {&(0x7f0000000e80)=""/111, 0x6f}, {&(0x7f0000000f00)=""/72, 0x48}], 0x3, &(0x7f0000000fc0)=""/254, 0xfe}, 0x7a27}, {{&(0x7f00000010c0)=@isdn, 0x80, &(0x7f0000003140), 0x2, &(0x7f0000003180)=""/20, 0x14}, 0x10001}], 0x4, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r3 = syz_io_uring_setup(0x3ac6, &(0x7f00000001c0)={0x0, 0xfffffffd, 0x10100, 0x4, 0x37c}, &(0x7f0000000080), 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) io_uring_enter(r3, 0x92, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0, @ANYBLOB], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000000201d200000000000000000a00000f3485befb28f36029b3ab2d1adc43826cd5b8f795316b3cb6fc3073dac969a62f5101dd82d2b91c2ac797510d94faf5ac388a46fbf005574f146eaaf358e9c464cdc0bf4ee3ed17ec04f9cdcaf2460da4e9c7b71d3f1340a579369dd802858f11a2db0dee44660e8a7b1fad9a34d5c6fd3337ed64f76c521175b5d0c8fb485d91d3749b8c8e0a058cc0c1"], 0x14}}, 0x0) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x2400, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$BTRFS_IOC_SCRUB_CANCEL(r7, 0x941c, 0x0) sendmsg$IPSET_CMD_TEST(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2c, 0xb, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x4800) 25.117974284s ago: executing program 2 (id=1516): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000dd0000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1d, 0x8, &(0x7f0000000100)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x385000, 0x0) r1 = open$dir(0x0, 0x195802, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), r2) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0xc004811}, 0x4010) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000040)='{\x00', &(0x7f0000000080)='./file0\x00', r1) r3 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f00000000c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r6, 0x0, 0xf3a, 0x0) read$char_usb(r5, &(0x7f0000000000)=""/111, 0x6f) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$binfmt_misc(r6, &(0x7f0000000980), 0xfdef) 24.935711283s ago: executing program 1 (id=1517): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) gettid() r4 = socket(0x1, 0x2, 0x0) connect$qrtr(0xffffffffffffffff, &(0x7f0000000000)={0x2d, 0x0, 0x8000}, 0xc) bind$xdp(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) shutdown(r5, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={r3, r2, 0x0, 0x0, 0x0}, 0x30) fcntl$setlease(r0, 0x400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000100)={0xf0f016, 0x2}) 24.884667052s ago: executing program 4 (id=1518): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x100000000, 0x1, 0x0, 0x3}, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', 0xffffffffffffffff, 0x0, 0xa}, 0x18) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000001680)='0', 0x1}, {&(0x7f0000000080)='+', 0x1}], 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r2, @ANYRESOCT=r2], 0x3c}}, 0x20024090) signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x3]}, 0x8) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = fanotify_init(0x0, 0x0) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) r6 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc0b02) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000d40)={0x0, 0x1, 0x4, 0x0, 0x0, 0x4063, "57c1169b6664ea61326ac71ae7213059"}) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000140)={0x100000000, 0x800, 0xf, 0x80000001, 0xfe1c, 0x6, "72aba977db089b65fdfdc5bd97abc350", 0x74, 0x3, 0xa7, 0x7, 0x8, 0x7, 0x29}) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_connect$uac1(0x0, 0x93, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000206b1d010140000102030109028100030102c0bf0904000000010100000a240100000002010208240805010000d70b240605030207000900000904010000010200000904010101010200000905010920000b03ac072501023b01000904020000010200000904020101010200000824024e450100800724016a0902000905820920"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$peekuser(0x3, r7, 0xb0) 24.487524041s ago: executing program 1 (id=1519): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={0x0}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x8) r0 = openat$sysfs(0xffffff9c, 0x0, 0x0, 0x10) finit_module(r0, 0x0, 0x7) mount$tmpfs(0x0, 0x0, 0x0, 0x10008, 0x0) syz_io_uring_setup(0x49d, 0x0, 0x0, 0x0) modify_ldt$write2(0x11, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x6, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='fd/3\x00') syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="080000030000edff090000dfff"], 0x5000) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000480)=0x4da, 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) getsockopt$inet_buf(r3, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000080)={&(0x7f00000018c0)=[{0x4, 0x9a01, 0x3b, &(0x7f00000000c0)="748812610bb56165793e9b729ea9b57aad377de78fdf88edb0d99148289a8d4e2433ce62e44fd26ddfa5d67288ff7da527e7b95fa6081d901d2240"}, {0x9, 0x3000, 0x78, &(0x7f00000001c0)="2dbfdc394f753a618e8fe25b0e8fdb1990eaa4ef96a4b6afd92928597b9796b684194087cee613606e18707a36e2fba8761f2eaf9790e671b27b4133ce9836b0ffa78a8918fb720b21eaf39d27d88bd7f4d2baea6931d2ff8d7c2c65a5629b22bf27fcd094f33ccd87a19d6d8779ba82d700b3467ca27b8d"}, {0x5, 0x200, 0xc3, &(0x7f0000000300)="9ca307a9a6b939ae30da9ebe954540e96ce3dd93e5f5e2d90e13c7a95304d52d5fe59f35767aff9f3c81cf340c8a98ebc8c4fb138c50f1dd3549a79131b9b4fd9c21de6c92e3be2904283d4d6fe803241fac2621788fba648018daf71c4a3a491fd8929577956d16482c2efc3cb01acffa1899d539084dfb642c78cfa0bc199ea4c47d8e8a757cda332560a2a3c6ae03526e5f35ba68a60c76421b46f3566343d13e85a8314ab9894cdf92fab35c7231c7c617e15a4d6ba007cff2451dc09d293e97e3"}, {0x0, 0x1, 0x41, &(0x7f0000000240)="ca1d8850f5ba7225c9a9195d431728cd80258d44c97b4fe04e6034d5b44d0194c4d1e320ed044b9ec92a3a22c65f948133ef69889a08bba283d2254c18be61023a"}, {0x0, 0x4201, 0x7c, &(0x7f0000000400)="d41fb88757f69eea0403a2a8fecaffd4b82761cbf2dd3c6807202381312d5896f904961419a09ae4e39ec96169dd75c3bbb3f158006456d0070c8b793944b65f9f23382eca9f25c01fcebd3e0ef671798ec17cf0f7bbb7d26971afe4584d15f76d25b81ef88e27b6258843ebdbf618cf98ff4c59415c3bcf56ef1542"}, {0xccc, 0x800, 0x34, &(0x7f0000000140)="1baf8263906f7fb184edfcb162e67b2bac173251c90100e23a040133adcc842fffb76d22f7e67604e44d163b1be7a7253ffb9167"}, {0x6, 0x0, 0xf6, &(0x7f0000000580)="2568a5a2e4caced753d933d2ccd7a1d65d754602e7a9811048b387547d648057d22490e8ef093b6cde90553cfc1c881c4a326c72a5a00f2f788582acb8dba8489559c94f0bc65988ddbab4b683a7c0d7b544a28e8958020f9ab8138251f832416c473364ed016d5247587e09f2270d5b2a85c5f69548bddd4a7841ae9b4c14dbc07fb2e5f6c1a1c28d96bc889edf6c1b95b00623b76b0215df1e561c08e7507d600962f1cf7ecfa7d66fbfffa78e1acbc45f09351900661b00c65d1f8eca1400fcb2b2575fc6377442b53a17b0fe336d5451c9c3a525fe3ec495df5427b4abb5b455db606780d85d40441b282e5a64767e0b0ad83101"}, {0x4, 0x800, 0xbf, &(0x7f0000000800)="079a49fc0842fd8db8be1bef9f35bc4b7c7041dc3010aa065349df47e3a17bfd97f8a11ba7d9f1cde498948c4ed8f7b1d5b16a591bba3ec42bf0491d1de11b158d5faaecaef9a3bfa47217702a7c85c252ea1382fc0cb0df00ce4209c3129640587272c82abffa63bd183f9984d3c7bb103ab47d6185c42c9dc17a7e04fa1589c9983d4788dd1f306910663ff2182886d30978f3ce1a248fc11eb3f80db67a93a5ec19d5df8aa3da090e61e8b5d331106e7c48b7135d360ee338d659baf184"}, {0x7, 0x8410, 0x1000, &(0x7f00000008c0)="441f8589392260d0cff7c2950a7751069100f557932ddfa180f507f084abca75a9d62f4348cf5f09afffebed1eac74d035bac0db661822f8c8ab238565d47df2132685ca8a0dced28dcb7beb6ad7fafed4d14bb0c22ef450fa412d5fcc2815c9496b1da7bc2cd1e6cb4259d207f76943d4624091bf2311412c6505c4075b101ec7e51a486b451af6e80e95922127a71cb8ebd5d64082acd77019663858992801f38210de464ee12298976ca863afaa1a75205bf1db0029ba4a97c93666872f6aa86dc00d5fcbe945b8aed44ce277929a6200d089ceda1369df8aae5158081dfdef286f989e252b0241a354fd0795fe6fea9bff6bdc3f010a4631833fb67b1420b03459d5cf28ef6bb05b834f6ab312e5a807ac1c46c1c13f3ceb8c729b2e2fbd08a6df13adaf36c7f1fe551053757a494451ac9e034877ee247bc44bf653c5743650bb863985a7ed0dc8a7d638bd34442987693a05a2becd06fa1fcdb52d7d1ffd1296e1901655a8fbb0f6823b2d8f95a2a6ab61c3e45a2c4a42c165dcdf286b6a80a5069abebbbbca9949b3840ef65a1bcf2817d5240436e5874352dd9e98e8f8e9fb80dd94cb8b1e53bae136ef91c91d9b5c02ab2be775aee66f63593961147490db99b606f173d76778e54bf4e7d956576663cd033d01b5e32a590e3461a61c5f0d8069cfa95672a29d4492b07b8fc51ae869fb5b3d6b9cc5761cb818cfb2ed4c21c3977a017c894a2c98c98013526838117805383856aba273abd63ebd8ad87721d1ab07e074384aa10606411a4892e83182eeb7be97afa6d18721c1f2c30058aee2ade6814d47de6c49c9ce461c8393de35da582126afdd8076f25cc47963af10a35c66738dc4c88f2a4406340f20f369290f6fb7d69d02a17a2e06a3396bd2e9f43023ee0a2c362fe01150b05d252a5b0c1ebdb78367ee1fae8801010a80a09ab224a4f691016173ae29d89c6cba4399bdaed1e4c6cd4cb387094cb9da353a42182e7d11b2b808b8775bc37c3577b4229bbcc7481ed8dd2c80415c12afbe70a0d2a9e7fa250f4b754c80b5501a91f2354d0315a6196fd9dbf5debab26f12d6f82eb8dc7ed602086ddacb623245d3483efcc4c1344b1353809220f8eabcbf28457043ee7df0047fee562369d81f8ba901f0abbf71bfffe69bf90f233e0a710180cfa819b9ff3a03a4d81c1f31dd5e00c38b21aef1c77fcb1e23c4deeef651dc68ad5dcac4d182322dea2a05416d800fcb56651ea6af78513b2b5873c43db6ff0617d94536a9d4f313f4f0a94fe88a1870ed3da8121285f0812634d7c5e7aee0b19491c5aac44c0fc4576bbd452a91eadba055e272fc8c212e29dba7f89a7e502529d40479df76c3cfeeb598e25c80e09c06fd89a95bf47a6d9557832ee7b51cbabd59778313b72191b08f37b62d7ee68775f6ad1ddfad539d53ea199e48038c7212e1cea1c56d2abb12e56f84d00a6fd8a4599f522cbd726cc7132c77a7d6afe1f403b5340cb38c38cc8707d14014258c127481f033d42fd8fd8b850ff57f992a6abf5415e4629c2b2daa8ab30424596b7c2be58455c5b01f5cf0ecd21e297fc35b05222a7a11ab64e7a3d830562f62546ee695206f74f5de0429e7901ae5a2e1775e4592defa1957426c73bb5625e782f5ce97dce550a67a35b6e36c504039fa1ed3bef55af0f2394bf47bf3497a8c158cedb2ec5aa2cd85b7b33036a8daa28d3706c87037c51b4b722f0fb7188de87934988bda16e2173efdf459d24e2e6ad5cd2aeb94d592245a7fe607e053121128d97a10fbea01d7d019b2904137ce1999ac1aec3e1f412001c72c8685598c9d4a20e4c6956f1220b1c45e9f49b90b4d8707226b520b3576e9c78a9061ee5bf94a9ebb4cd30de9df0c792999b690b0b4f835fa6fa6ff7e497b59b3dba0a1e7b5e62d80666e85bd3e9209e85cf9c6db1d882358a9bc875e328aebbe2332a667677c871c396e3dce923e84e08d94ef7f74d3985d648625ee624c026d01071bc3e6928c36cf0591c595136766ab7d2d58a6b72a0e879717e9f47f9755e8c0cb5004c41cccc48575250f15fd29e3724525e33a7356b1846e8cd0b8afbcf59db6b8a5f9f256ad78e8880147a4e6f44c6d1894ff5379cf35af0af50c2fa644415c669f5712753cfe19c6134a8e56abee8f34c3a5ba9e25d548fac62e3cd7f7bbd322a9b9ef8f8de9ca406f49dc6e242104aab1c71e255da50c33e10f675d41fbc99aa7538590ccc74785a30b404ab877170b16b6a3163f5f8b2f7b909bb1e0c73577382aeee2184f54531b9d65725224a42d59c8c8fc212cdbaf785078786c2d0435b3c2e2c3abd679f9caf99e1835ca0856495b803c514621ca065ec58cb2cda9150b8648194d975a54c760d7887df786b4ee5152e14cb3682ef1c3bdf21aafa286c322e21093dd5cc7095070842707e94a145fc93ff63f97208af7b8d55939a1a87a5120097721f8646bd4e1974d108359991c5738e88b7202e043b417a24b72559a89cdea56b48655842bc2121395829561bd2bd16a96ef0bff5f3f094af4691c4a4f926d8b7f7715807ee26c0da09575afe1c0b8ffc4afe68ce279ec253dafed23e660aa0074872371de04c0308f2a3470747d7124a1596bdf22f1472b0c8a2833ef31b4122a6162ff95422bf318964f11e544db2137907454e2c9ecf8abb141777aac8e91903efc613daf17c2263851bdbbe44d15b60befe292832e7a242601a0e717cc105e2f01d680885f43427e5d0d4180b7c04d15a4d02013b3291ede3b9b1bd1b950d271a6c0fbab1aebe08abf0fe77a8bcc1b3b8e52f40f93b6ce6e50c79b7c03ad340d295f0fd7456a49b9157b12ae848f9c0f5bb06e42e29e69d469eb2653273d7a51081647aa5f94cfa3180cc59855826d9d7bd41b80aad3dee587597d89ef57e0bbfe21fd88227c8f1a4c56bda644f1f90c48cd303bd809c4593a6fa2376d30e84cb02e30c86e39935643ec765f2fdfaf7e7d2fa18549028cf6c98c82e9ba703e686db66e799d36ba404dceee8e56895a2428913b6c3ae6c73a3f090074d2c4ec7800be3151ee0dfc55630995a00a349ec31f0cc99bf0138cc0dfa5434cb0145c3baffa22dd3ca6912f3cb844fe562b9b8dab917131682779bab787fc24980614a03141359365d8cd4c38036418f3e52b82e9f738741848f0153e81f2aa266246140688f10d455ebf24b7ab47d8cd49cffe1488259c8a13135fc59cc32cfc1ceaf0d7bb88f7bfda251ec2bb3e08a0dba6a842cbd439c40f3656673aeed52c32de35a7cc449fa7b1bc29f9e623bc802eee0146f5d9d3e25c1d37949d77c61d65ea5e771dafc788e88d1df357c6da20f9a3eb2cf4e2476bb9abe8f0cdba61b5e3660503a8f2b498de85215787b75454505f4a67ccf578c4929fd78a9d615b19d50170a4a673a879da7b3ce921c9b8739673d304e2381d772cbce979496940a07fbcc135fe1089cb803dc0305423b471526ec81bd2eb6a084830ba632be9f810818dfe8d40d49d2580bdc8cb9cccd746d09689f5130a228b118a0fc3b3b0f2aa842328e327a650363e8041d3fa663fc0dd6e35f7990c20876985c0c59fc313e92b79d1d4941084dfcc92716d061c7aed49318fc0f8cf3c20deb860b9dd8df758724c4c693d77ee25a49af6664eb57aa2476e6d879cdbd85576200df09562266ab43c186055cd1f3d2b1532b3a74cfc56b975450fe65f9265f1bcf60919aaee189b4aab01739e42dc3a5dc3f4b5660fe42281e1da1e289c8776c30c7bd510a7ab340c5d6b655517f453aceb2d4843a54d13e1493ed5e24cb23e33b6ac8c5837e95ce2240135aba6570a8200d6f0a8981f50fe3af1d6835a8c5876074db33ddd24afbadb7e894b88a0c3887e8951ba40826ba6b58fc9ac0e83ecbafcd2cc109e9c324896482665f92f8866ed185953ba2748474334acc39763c2ff60e6164617541d181d2f1a7648c61999c179099d193f84b9246346c678ab598649f8692ab58101e962d0f68b3514ed2af1641ef680dd84f43643a1b18f3715bad97858f9dbdce85c74f679a92137149ad8b9386d2f703ab350a086f15732518adace76d3481841aa4c0197dd1f6c8a0f7fb247224ac9be438c76d5ad62511391c4fee38b9242c35729ad1ebed04e439fbdf39e9291d69935525344383774118b4188a50e610b37715967ed9c6b353f5b260d726679318c470f18e47c166002f272cd90525e7c855501e3e38a1c38117acd8e0507922d84fa22a874010f1b409b131beaadd41583db4b5c037126e8ff29a41e9c85843510064d798044dc25ec72e0378199f339e3097d4145368f17a18230b409cbb769c2e534ef1b847f90f7d3fced6302ae9bcc83466437e3ebf9692252e5c5417185178bde76db1817479ffceea51411a00400add85eeaf1e7ceb7568dd3de97b9b84a1d540d0299308bbcd560777c4c565be90b87e5b10ad124c4c2f7e1ebf1c0914ad06b44d1d4fdfd25ebc95d3f3f7bbd150aadcaedc4d207ec09f713b35d2ddab030dfc589f714476f50905256c5fc4613b196a72164756389443fe8d5a1651a807d813fc67f025cf1366540b7617e147b374983b7265951bdc6e72834a03680fe672f1f0b801193fc1ef5a29fadb3c73ae26588fd8cf663c72bc85b5f90fbe7f7cd19203e4f23641cb5d53076d36fe11834078225279be7a7ed48d0e019b943371dfb54c5a0c2e78da8d0e4f2e7ef67249e64bd3aa4254319765c4ea7a3841941811210114567d8b366f41ff664dda3ceaed305dcd4489fae8c1548f8cf38e84c44e284218155a9ce173da319f5ecd6d1684d6e844a6049247e4f6915968bdb140e6eceab29b62aab0ebb610ca172c27baca161cf06e9ea271750e753c01d00b14c4e4e7c7dfbe8c1c5814f0c8f3a16372427586eaa2f29e24709c8c0863536f963521c997996c7ee6412b6bb1db9a6c5cc7e191de6ec8d6c71e8ad63022a3d5808ae1f301a786ce381c4cab4c6e2f9d827144ededccf5533b911943430834cfc8c36aac0340007ef08b46e69c09b3359513407bca98463c043c34897ef04fb28274decff3c879eda19bbd9223e963f993900dfdee1d8d4615b37d5eb841474614746d8bf4abf66de2c9147fc7cb908f48cde1581372e6602588490a47a99eda91c28544ab8f935128ec496e2ec091cf2ca8528bbb099f62cfecc476ed15faebc055769f303da581d206bb36cc331585e5b73a5b19722204dfef380a27d278a4d5a237c7ae74d88e716bc65f8f3c51ead89aa3940634cb33f4f985fe7c64885338b3229f29e35ebff42bf851417e11f41814803276a9e5b89e645fea77cae0377301050ed1ae4117836ce28eddebf404805d39ce303216475da957827e1a1922ab8ec9d46f2233ea5c30c6759317696fe9334570e36978a4b2ef1890fcfdb1bb0da91fb87be06769925837ba91603803372aa0512588e4564c142ef7959bf94a7c9580c5ff075d4f356fed7839e4b4f56c7cf4365b5ad8791a787f0d7f763b1d50ead1c65a59b4b1cd789fb64135bb122b19e4d7ce6a0a0225a5fa4b09b30403aed1e4ac87d97269ffde2be2e5e38844c20c3920d1946f3ce796f1357f0dd73d9716b84eb1970d686421deae47f21f639215fff51c286fb15fc5eb53431db1262900ecbba950d1acb7cf2b255d39c1aed81f9b77352e859694eabd41ca0f2f62db04ff42dde9549694547519f1a3e2ab01892e056d6050c28c91d21e90adf718d97544f1adfebe32af62aa10762f8d8b751105a48751b0586af8c"}], 0x9}) 24.163189841s ago: executing program 3 (id=1520): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0), 0x0, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) 24.130095386s ago: executing program 2 (id=1521): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) preadv(r0, 0x0, 0x0, 0xd5, 0x5) 23.864396137s ago: executing program 2 (id=1522): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setscheduler(0x0, 0x5, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000200), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000000)=0x2) preadv2(r4, &(0x7f0000000300)=[{&(0x7f00000005c0)=""/272, 0x110}], 0x1, 0x4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r6 = dup2(r5, r5) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000001c0)={0x14000000}) 8.899345132s ago: executing program 32 (id=1515): ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) ioctl$MEDIA_REQUEST_IOC_REINIT(r0, 0x7c81, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000031c0)=[{{&(0x7f0000000340)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000440)=""/79, 0xf}, {&(0x7f0000000180)=""/4, 0x4}, {&(0x7f00000006c0)=""/198, 0xc6}, {&(0x7f00000003c0)=""/36, 0x24}, {&(0x7f00000007c0)=""/83, 0x53}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/216, 0xd8}, {&(0x7f0000000540)=""/49, 0x31}], 0x8, &(0x7f0000000b40)=""/32, 0x20}, 0x1}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000b80)=""/178, 0xb2}, {&(0x7f0000000c40)=""/255, 0xff}], 0x2}, 0x7}, {{&(0x7f0000000d80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000e00)=""/74, 0x4a}, {&(0x7f0000000e80)=""/111, 0x6f}, {&(0x7f0000000f00)=""/72, 0x48}], 0x3, &(0x7f0000000fc0)=""/254, 0xfe}, 0x7a27}, {{&(0x7f00000010c0)=@isdn, 0x80, &(0x7f0000003140), 0x2, &(0x7f0000003180)=""/20, 0x14}, 0x10001}], 0x4, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r3 = syz_io_uring_setup(0x3ac6, &(0x7f00000001c0)={0x0, 0xfffffffd, 0x10100, 0x4, 0x37c}, &(0x7f0000000080), 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) io_uring_enter(r3, 0x92, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0, @ANYBLOB], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000000201d200000000000000000a00000f3485befb28f36029b3ab2d1adc43826cd5b8f795316b3cb6fc3073dac969a62f5101dd82d2b91c2ac797510d94faf5ac388a46fbf005574f146eaaf358e9c464cdc0bf4ee3ed17ec04f9cdcaf2460da4e9c7b71d3f1340a579369dd802858f11a2db0dee44660e8a7b1fad9a34d5c6fd3337ed64f76c521175b5d0c8fb485d91d3749b8c8e0a058cc0c1"], 0x14}}, 0x0) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x2400, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$BTRFS_IOC_SCRUB_CANCEL(r7, 0x941c, 0x0) sendmsg$IPSET_CMD_TEST(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2c, 0xb, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x4800) 2.83554692s ago: executing program 33 (id=1519): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={0x0}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x8) r0 = openat$sysfs(0xffffff9c, 0x0, 0x0, 0x10) finit_module(r0, 0x0, 0x7) mount$tmpfs(0x0, 0x0, 0x0, 0x10008, 0x0) syz_io_uring_setup(0x49d, 0x0, 0x0, 0x0) modify_ldt$write2(0x11, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x6, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='fd/3\x00') syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="080000030000edff090000dfff"], 0x5000) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000480)=0x4da, 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) getsockopt$inet_buf(r3, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000080)={&(0x7f00000018c0)=[{0x4, 0x9a01, 0x3b, &(0x7f00000000c0)="748812610bb56165793e9b729ea9b57aad377de78fdf88edb0d99148289a8d4e2433ce62e44fd26ddfa5d67288ff7da527e7b95fa6081d901d2240"}, {0x9, 0x3000, 0x78, &(0x7f00000001c0)="2dbfdc394f753a618e8fe25b0e8fdb1990eaa4ef96a4b6afd92928597b9796b684194087cee613606e18707a36e2fba8761f2eaf9790e671b27b4133ce9836b0ffa78a8918fb720b21eaf39d27d88bd7f4d2baea6931d2ff8d7c2c65a5629b22bf27fcd094f33ccd87a19d6d8779ba82d700b3467ca27b8d"}, {0x5, 0x200, 0xc3, &(0x7f0000000300)="9ca307a9a6b939ae30da9ebe954540e96ce3dd93e5f5e2d90e13c7a95304d52d5fe59f35767aff9f3c81cf340c8a98ebc8c4fb138c50f1dd3549a79131b9b4fd9c21de6c92e3be2904283d4d6fe803241fac2621788fba648018daf71c4a3a491fd8929577956d16482c2efc3cb01acffa1899d539084dfb642c78cfa0bc199ea4c47d8e8a757cda332560a2a3c6ae03526e5f35ba68a60c76421b46f3566343d13e85a8314ab9894cdf92fab35c7231c7c617e15a4d6ba007cff2451dc09d293e97e3"}, {0x0, 0x1, 0x41, &(0x7f0000000240)="ca1d8850f5ba7225c9a9195d431728cd80258d44c97b4fe04e6034d5b44d0194c4d1e320ed044b9ec92a3a22c65f948133ef69889a08bba283d2254c18be61023a"}, {0x0, 0x4201, 0x7c, &(0x7f0000000400)="d41fb88757f69eea0403a2a8fecaffd4b82761cbf2dd3c6807202381312d5896f904961419a09ae4e39ec96169dd75c3bbb3f158006456d0070c8b793944b65f9f23382eca9f25c01fcebd3e0ef671798ec17cf0f7bbb7d26971afe4584d15f76d25b81ef88e27b6258843ebdbf618cf98ff4c59415c3bcf56ef1542"}, {0xccc, 0x800, 0x34, &(0x7f0000000140)="1baf8263906f7fb184edfcb162e67b2bac173251c90100e23a040133adcc842fffb76d22f7e67604e44d163b1be7a7253ffb9167"}, {0x6, 0x0, 0xf6, &(0x7f0000000580)="2568a5a2e4caced753d933d2ccd7a1d65d754602e7a9811048b387547d648057d22490e8ef093b6cde90553cfc1c881c4a326c72a5a00f2f788582acb8dba8489559c94f0bc65988ddbab4b683a7c0d7b544a28e8958020f9ab8138251f832416c473364ed016d5247587e09f2270d5b2a85c5f69548bddd4a7841ae9b4c14dbc07fb2e5f6c1a1c28d96bc889edf6c1b95b00623b76b0215df1e561c08e7507d600962f1cf7ecfa7d66fbfffa78e1acbc45f09351900661b00c65d1f8eca1400fcb2b2575fc6377442b53a17b0fe336d5451c9c3a525fe3ec495df5427b4abb5b455db606780d85d40441b282e5a64767e0b0ad83101"}, {0x4, 0x800, 0xbf, &(0x7f0000000800)="079a49fc0842fd8db8be1bef9f35bc4b7c7041dc3010aa065349df47e3a17bfd97f8a11ba7d9f1cde498948c4ed8f7b1d5b16a591bba3ec42bf0491d1de11b158d5faaecaef9a3bfa47217702a7c85c252ea1382fc0cb0df00ce4209c3129640587272c82abffa63bd183f9984d3c7bb103ab47d6185c42c9dc17a7e04fa1589c9983d4788dd1f306910663ff2182886d30978f3ce1a248fc11eb3f80db67a93a5ec19d5df8aa3da090e61e8b5d331106e7c48b7135d360ee338d659baf184"}, {0x7, 0x8410, 0x1000, &(0x7f00000008c0)="441f8589392260d0cff7c2950a7751069100f557932ddfa180f507f084abca75a9d62f4348cf5f09afffebed1eac74d035bac0db661822f8c8ab238565d47df2132685ca8a0dced28dcb7beb6ad7fafed4d14bb0c22ef450fa412d5fcc2815c9496b1da7bc2cd1e6cb4259d207f76943d4624091bf2311412c6505c4075b101ec7e51a486b451af6e80e95922127a71cb8ebd5d64082acd77019663858992801f38210de464ee12298976ca863afaa1a75205bf1db0029ba4a97c93666872f6aa86dc00d5fcbe945b8aed44ce277929a6200d089ceda1369df8aae5158081dfdef286f989e252b0241a354fd0795fe6fea9bff6bdc3f010a4631833fb67b1420b03459d5cf28ef6bb05b834f6ab312e5a807ac1c46c1c13f3ceb8c729b2e2fbd08a6df13adaf36c7f1fe551053757a494451ac9e034877ee247bc44bf653c5743650bb863985a7ed0dc8a7d638bd34442987693a05a2becd06fa1fcdb52d7d1ffd1296e1901655a8fbb0f6823b2d8f95a2a6ab61c3e45a2c4a42c165dcdf286b6a80a5069abebbbbca9949b3840ef65a1bcf2817d5240436e5874352dd9e98e8f8e9fb80dd94cb8b1e53bae136ef91c91d9b5c02ab2be775aee66f63593961147490db99b606f173d76778e54bf4e7d956576663cd033d01b5e32a590e3461a61c5f0d8069cfa95672a29d4492b07b8fc51ae869fb5b3d6b9cc5761cb818cfb2ed4c21c3977a017c894a2c98c98013526838117805383856aba273abd63ebd8ad87721d1ab07e074384aa10606411a4892e83182eeb7be97afa6d18721c1f2c30058aee2ade6814d47de6c49c9ce461c8393de35da582126afdd8076f25cc47963af10a35c66738dc4c88f2a4406340f20f369290f6fb7d69d02a17a2e06a3396bd2e9f43023ee0a2c362fe01150b05d252a5b0c1ebdb78367ee1fae8801010a80a09ab224a4f691016173ae29d89c6cba4399bdaed1e4c6cd4cb387094cb9da353a42182e7d11b2b808b8775bc37c3577b4229bbcc7481ed8dd2c80415c12afbe70a0d2a9e7fa250f4b754c80b5501a91f2354d0315a6196fd9dbf5debab26f12d6f82eb8dc7ed602086ddacb623245d3483efcc4c1344b1353809220f8eabcbf28457043ee7df0047fee562369d81f8ba901f0abbf71bfffe69bf90f233e0a710180cfa819b9ff3a03a4d81c1f31dd5e00c38b21aef1c77fcb1e23c4deeef651dc68ad5dcac4d182322dea2a05416d800fcb56651ea6af78513b2b5873c43db6ff0617d94536a9d4f313f4f0a94fe88a1870ed3da8121285f0812634d7c5e7aee0b19491c5aac44c0fc4576bbd452a91eadba055e272fc8c212e29dba7f89a7e502529d40479df76c3cfeeb598e25c80e09c06fd89a95bf47a6d9557832ee7b51cbabd59778313b72191b08f37b62d7ee68775f6ad1ddfad539d53ea199e48038c7212e1cea1c56d2abb12e56f84d00a6fd8a4599f522cbd726cc7132c77a7d6afe1f403b5340cb38c38cc8707d14014258c127481f033d42fd8fd8b850ff57f992a6abf5415e4629c2b2daa8ab30424596b7c2be58455c5b01f5cf0ecd21e297fc35b05222a7a11ab64e7a3d830562f62546ee695206f74f5de0429e7901ae5a2e1775e4592defa1957426c73bb5625e782f5ce97dce550a67a35b6e36c504039fa1ed3bef55af0f2394bf47bf3497a8c158cedb2ec5aa2cd85b7b33036a8daa28d3706c87037c51b4b722f0fb7188de87934988bda16e2173efdf459d24e2e6ad5cd2aeb94d592245a7fe607e053121128d97a10fbea01d7d019b2904137ce1999ac1aec3e1f412001c72c8685598c9d4a20e4c6956f1220b1c45e9f49b90b4d8707226b520b3576e9c78a9061ee5bf94a9ebb4cd30de9df0c792999b690b0b4f835fa6fa6ff7e497b59b3dba0a1e7b5e62d80666e85bd3e9209e85cf9c6db1d882358a9bc875e328aebbe2332a667677c871c396e3dce923e84e08d94ef7f74d3985d648625ee624c026d01071bc3e6928c36cf0591c595136766ab7d2d58a6b72a0e879717e9f47f9755e8c0cb5004c41cccc48575250f15fd29e3724525e33a7356b1846e8cd0b8afbcf59db6b8a5f9f256ad78e8880147a4e6f44c6d1894ff5379cf35af0af50c2fa644415c669f5712753cfe19c6134a8e56abee8f34c3a5ba9e25d548fac62e3cd7f7bbd322a9b9ef8f8de9ca406f49dc6e242104aab1c71e255da50c33e10f675d41fbc99aa7538590ccc74785a30b404ab877170b16b6a3163f5f8b2f7b909bb1e0c73577382aeee2184f54531b9d65725224a42d59c8c8fc212cdbaf785078786c2d0435b3c2e2c3abd679f9caf99e1835ca0856495b803c514621ca065ec58cb2cda9150b8648194d975a54c760d7887df786b4ee5152e14cb3682ef1c3bdf21aafa286c322e21093dd5cc7095070842707e94a145fc93ff63f97208af7b8d55939a1a87a5120097721f8646bd4e1974d108359991c5738e88b7202e043b417a24b72559a89cdea56b48655842bc2121395829561bd2bd16a96ef0bff5f3f094af4691c4a4f926d8b7f7715807ee26c0da09575afe1c0b8ffc4afe68ce279ec253dafed23e660aa0074872371de04c0308f2a3470747d7124a1596bdf22f1472b0c8a2833ef31b4122a6162ff95422bf318964f11e544db2137907454e2c9ecf8abb141777aac8e91903efc613daf17c2263851bdbbe44d15b60befe292832e7a242601a0e717cc105e2f01d680885f43427e5d0d4180b7c04d15a4d02013b3291ede3b9b1bd1b950d271a6c0fbab1aebe08abf0fe77a8bcc1b3b8e52f40f93b6ce6e50c79b7c03ad340d295f0fd7456a49b9157b12ae848f9c0f5bb06e42e29e69d469eb2653273d7a51081647aa5f94cfa3180cc59855826d9d7bd41b80aad3dee587597d89ef57e0bbfe21fd88227c8f1a4c56bda644f1f90c48cd303bd809c4593a6fa2376d30e84cb02e30c86e39935643ec765f2fdfaf7e7d2fa18549028cf6c98c82e9ba703e686db66e799d36ba404dceee8e56895a2428913b6c3ae6c73a3f090074d2c4ec7800be3151ee0dfc55630995a00a349ec31f0cc99bf0138cc0dfa5434cb0145c3baffa22dd3ca6912f3cb844fe562b9b8dab917131682779bab787fc24980614a03141359365d8cd4c38036418f3e52b82e9f738741848f0153e81f2aa266246140688f10d455ebf24b7ab47d8cd49cffe1488259c8a13135fc59cc32cfc1ceaf0d7bb88f7bfda251ec2bb3e08a0dba6a842cbd439c40f3656673aeed52c32de35a7cc449fa7b1bc29f9e623bc802eee0146f5d9d3e25c1d37949d77c61d65ea5e771dafc788e88d1df357c6da20f9a3eb2cf4e2476bb9abe8f0cdba61b5e3660503a8f2b498de85215787b75454505f4a67ccf578c4929fd78a9d615b19d50170a4a673a879da7b3ce921c9b8739673d304e2381d772cbce979496940a07fbcc135fe1089cb803dc0305423b471526ec81bd2eb6a084830ba632be9f810818dfe8d40d49d2580bdc8cb9cccd746d09689f5130a228b118a0fc3b3b0f2aa842328e327a650363e8041d3fa663fc0dd6e35f7990c20876985c0c59fc313e92b79d1d4941084dfcc92716d061c7aed49318fc0f8cf3c20deb860b9dd8df758724c4c693d77ee25a49af6664eb57aa2476e6d879cdbd85576200df09562266ab43c186055cd1f3d2b1532b3a74cfc56b975450fe65f9265f1bcf60919aaee189b4aab01739e42dc3a5dc3f4b5660fe42281e1da1e289c8776c30c7bd510a7ab340c5d6b655517f453aceb2d4843a54d13e1493ed5e24cb23e33b6ac8c5837e95ce2240135aba6570a8200d6f0a8981f50fe3af1d6835a8c5876074db33ddd24afbadb7e894b88a0c3887e8951ba40826ba6b58fc9ac0e83ecbafcd2cc109e9c324896482665f92f8866ed185953ba2748474334acc39763c2ff60e6164617541d181d2f1a7648c61999c179099d193f84b9246346c678ab598649f8692ab58101e962d0f68b3514ed2af1641ef680dd84f43643a1b18f3715bad97858f9dbdce85c74f679a92137149ad8b9386d2f703ab350a086f15732518adace76d3481841aa4c0197dd1f6c8a0f7fb247224ac9be438c76d5ad62511391c4fee38b9242c35729ad1ebed04e439fbdf39e9291d69935525344383774118b4188a50e610b37715967ed9c6b353f5b260d726679318c470f18e47c166002f272cd90525e7c855501e3e38a1c38117acd8e0507922d84fa22a874010f1b409b131beaadd41583db4b5c037126e8ff29a41e9c85843510064d798044dc25ec72e0378199f339e3097d4145368f17a18230b409cbb769c2e534ef1b847f90f7d3fced6302ae9bcc83466437e3ebf9692252e5c5417185178bde76db1817479ffceea51411a00400add85eeaf1e7ceb7568dd3de97b9b84a1d540d0299308bbcd560777c4c565be90b87e5b10ad124c4c2f7e1ebf1c0914ad06b44d1d4fdfd25ebc95d3f3f7bbd150aadcaedc4d207ec09f713b35d2ddab030dfc589f714476f50905256c5fc4613b196a72164756389443fe8d5a1651a807d813fc67f025cf1366540b7617e147b374983b7265951bdc6e72834a03680fe672f1f0b801193fc1ef5a29fadb3c73ae26588fd8cf663c72bc85b5f90fbe7f7cd19203e4f23641cb5d53076d36fe11834078225279be7a7ed48d0e019b943371dfb54c5a0c2e78da8d0e4f2e7ef67249e64bd3aa4254319765c4ea7a3841941811210114567d8b366f41ff664dda3ceaed305dcd4489fae8c1548f8cf38e84c44e284218155a9ce173da319f5ecd6d1684d6e844a6049247e4f6915968bdb140e6eceab29b62aab0ebb610ca172c27baca161cf06e9ea271750e753c01d00b14c4e4e7c7dfbe8c1c5814f0c8f3a16372427586eaa2f29e24709c8c0863536f963521c997996c7ee6412b6bb1db9a6c5cc7e191de6ec8d6c71e8ad63022a3d5808ae1f301a786ce381c4cab4c6e2f9d827144ededccf5533b911943430834cfc8c36aac0340007ef08b46e69c09b3359513407bca98463c043c34897ef04fb28274decff3c879eda19bbd9223e963f993900dfdee1d8d4615b37d5eb841474614746d8bf4abf66de2c9147fc7cb908f48cde1581372e6602588490a47a99eda91c28544ab8f935128ec496e2ec091cf2ca8528bbb099f62cfecc476ed15faebc055769f303da581d206bb36cc331585e5b73a5b19722204dfef380a27d278a4d5a237c7ae74d88e716bc65f8f3c51ead89aa3940634cb33f4f985fe7c64885338b3229f29e35ebff42bf851417e11f41814803276a9e5b89e645fea77cae0377301050ed1ae4117836ce28eddebf404805d39ce303216475da957827e1a1922ab8ec9d46f2233ea5c30c6759317696fe9334570e36978a4b2ef1890fcfdb1bb0da91fb87be06769925837ba91603803372aa0512588e4564c142ef7959bf94a7c9580c5ff075d4f356fed7839e4b4f56c7cf4365b5ad8791a787f0d7f763b1d50ead1c65a59b4b1cd789fb64135bb122b19e4d7ce6a0a0225a5fa4b09b30403aed1e4ac87d97269ffde2be2e5e38844c20c3920d1946f3ce796f1357f0dd73d9716b84eb1970d686421deae47f21f639215fff51c286fb15fc5eb53431db1262900ecbba950d1acb7cf2b255d39c1aed81f9b77352e859694eabd41ca0f2f62db04ff42dde9549694547519f1a3e2ab01892e056d6050c28c91d21e90adf718d97544f1adfebe32af62aa10762f8d8b751105a48751b0586af8c"}], 0x9}) 1.93632837s ago: executing program 34 (id=1518): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x100000000, 0x1, 0x0, 0x3}, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', 0xffffffffffffffff, 0x0, 0xa}, 0x18) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000001680)='0', 0x1}, {&(0x7f0000000080)='+', 0x1}], 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r2, @ANYRESOCT=r2], 0x3c}}, 0x20024090) signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x3]}, 0x8) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = fanotify_init(0x0, 0x0) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) r6 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc0b02) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000d40)={0x0, 0x1, 0x4, 0x0, 0x0, 0x4063, "57c1169b6664ea61326ac71ae7213059"}) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000140)={0x100000000, 0x800, 0xf, 0x80000001, 0xfe1c, 0x6, "72aba977db089b65fdfdc5bd97abc350", 0x74, 0x3, 0xa7, 0x7, 0x8, 0x7, 0x29}) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_connect$uac1(0x0, 0x93, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000206b1d010140000102030109028100030102c0bf0904000000010100000a240100000002010208240805010000d70b240605030207000900000904010000010200000904010101010200000905010920000b03ac072501023b01000904020000010200000904020101010200000824024e450100800724016a0902000905820920"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$peekuser(0x3, r7, 0xb0) 630.846245ms ago: executing program 35 (id=1522): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setscheduler(0x0, 0x5, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, &(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000200), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000000)=0x2) preadv2(r4, &(0x7f0000000300)=[{&(0x7f00000005c0)=""/272, 0x110}], 0x1, 0x4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r6 = dup2(r5, r5) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000001c0)={0x14000000}) 0s ago: executing program 36 (id=1520): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0), 0x0, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) kernel console output (not intermixed with test programs): 000 RSI: 0000200000000480 RDI: 0000000000000004 [ 387.578949][ T9993] RBP: 00007f68da63c090 R08: 0000000000000000 R09: 0000000000000000 [ 387.578959][ T9993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 387.578968][ T9993] R13: 00007f68d99e6038 R14: 00007f68d99e5fa0 R15: 00007ffea224f008 [ 387.578994][ T9993] [ 387.879276][ C0] vkms_vblank_simulate: vblank timer overrun [ 388.117814][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 388.117830][ T30] audit: type=1400 audit(2000000079.960:740): avc: denied { ioctl } for pid=9989 comm="syz.3.1021" path="socket:[24020]" dev="sockfs" ino=24020 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 388.279069][ T5813] Bluetooth: hci0: unexpected cc 0x1005 length: 9 > 8 [ 388.818509][ T5813] Bluetooth: hci0: unexpected event for opcode 0x1005 [ 389.091779][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 389.201756][T10023] net veth1_virt_wifi : renamed from virt_wifi0 [ 389.463021][T10023] bridge0: port 3(batadv8) entered blocking state [ 389.472518][T10023] bridge0: port 3(batadv8) entered disabled state [ 389.478988][T10023] batadv8: entered allmulticast mode [ 389.488061][T10023] batadv8: entered promiscuous mode [ 389.975565][ T49] batman_adv: batadv8: No IGMP Querier present - multicast optimizations disabled [ 389.985080][ T49] batman_adv: batadv8: No MLD Querier present - multicast optimizations disabled [ 390.170075][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.660991][T10038] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.683169][T10038] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.751247][T10038] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.792573][T10038] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.253012][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.330380][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.656948][ T30] audit: type=1326 audit(2000000084.730:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08b9f8efc9 code=0x7ffc0000 [ 392.729259][ T30] audit: type=1326 audit(2000000084.730:742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08b9f8efc9 code=0x7ffc0000 [ 392.816889][ T5811] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.857653][ T30] audit: type=1326 audit(2000000084.730:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=286 compat=0 ip=0x7f08b9f8efc9 code=0x7ffc0000 [ 393.090160][ T30] audit: type=1326 audit(2000000084.730:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08b9f8efc9 code=0x7ffc0000 [ 393.113883][ T30] audit: type=1326 audit(2000000084.730:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08b9f8efc9 code=0x7ffc0000 [ 393.137721][ T30] audit: type=1326 audit(2000000084.730:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10059 comm="syz.4.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f08b9f8d9dc code=0x7ffc0000 [ 393.482856][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 394.035629][ T30] audit: type=1400 audit(2000000086.110:747): avc: denied { read } for pid=10071 comm="syz.3.1042" path="socket:[24120]" dev="sockfs" ino=24120 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 394.279728][ T30] audit: type=1400 audit(2000000086.140:748): avc: denied { read append } for pid=10071 comm="syz.3.1042" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 394.305478][ T30] audit: type=1400 audit(2000000086.140:749): avc: denied { open } for pid=10071 comm="syz.3.1042" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 394.352173][T10072] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 394.385988][T10072] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 394.492431][ T30] audit: type=1400 audit(2000000086.570:750): avc: denied { setopt } for pid=10093 comm="syz.1.1046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 394.570472][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 394.580809][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 394.590015][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 394.716429][T10100] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1046'. [ 394.919769][T10072] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 394.931264][T10072] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 395.001142][T10072] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 395.031785][T10072] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 395.051969][T10072] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 395.059205][T10072] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 395.071964][T10072] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 395.087895][T10072] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 395.685540][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 395.785494][T10113] netlink: 'syz.0.1049': attribute type 10 has an invalid length. [ 395.793576][T10113] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1049'. [ 395.802963][T10113] bridge0: port 3(veth0_vlan) entered blocking state [ 395.811175][T10113] bridge0: port 3(veth0_vlan) entered disabled state [ 395.821512][T10113] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 396.175254][ T2964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 396.183809][ T5811] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 396.410082][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 396.980137][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 396.993345][ T30] audit: type=1400 audit(2000000089.070:751): avc: denied { append } for pid=10132 comm="syz.3.1054" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 397.060023][ T5813] Bluetooth: hci2: command 0x0406 tx timeout [ 397.130068][ T5813] Bluetooth: hci4: command 0x0406 tx timeout [ 397.136140][ T5136] Bluetooth: hci3: command 0x0406 tx timeout [ 397.192707][ T30] audit: type=1400 audit(2000000089.100:752): avc: denied { write } for pid=10132 comm="syz.3.1054" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 397.978702][ T5933] net_ratelimit: 2 callbacks suppressed [ 397.978717][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 398.030016][ T24] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 398.180990][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 398.189385][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 398.202268][ T24] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 398.220748][ T24] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 398.315350][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.324291][ T24] usb 2-1: Product: syz [ 398.331109][ T24] usb 2-1: Manufacturer: syz [ 398.335734][ T24] usb 2-1: SerialNumber: syz [ 398.342930][ T24] usb 2-1: config 0 descriptor?? [ 398.490001][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 398.564414][ T24] usb 2-1: USB disconnect, device number 17 [ 399.052566][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 399.060672][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 399.130412][ T5813] Bluetooth: hci2: command 0x0406 tx timeout [ 399.211337][ T5136] Bluetooth: hci3: command 0x0406 tx timeout [ 399.224932][ T5813] Bluetooth: hci4: command 0x0406 tx timeout [ 400.277887][T10193] netlink: 'syz.0.1070': attribute type 39 has an invalid length. [ 400.386293][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 400.491009][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 400.501632][ T30] audit: type=1400 audit(2000000092.530:753): avc: denied { listen } for pid=10187 comm="syz.1.1069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 400.703456][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 400.877588][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 400.886120][ T30] audit: type=1400 audit(2000000092.540:754): avc: denied { accept } for pid=10187 comm="syz.1.1069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 401.420644][ T30] audit: type=1400 audit(2000000093.500:755): avc: denied { ioctl } for pid=10205 comm="syz.3.1075" path="socket:[24454]" dev="sockfs" ino=24454 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 401.448374][T10207] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1075'. [ 401.532522][T10208] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1075'. [ 401.618584][T10215] tmpfs: Unknown parameter 'm ol' [ 401.708010][ T30] audit: type=1400 audit(2000000093.690:756): avc: denied { mounton } for pid=10214 comm="syz.0.1077" path="/syzcgroup/unified/syz0" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 402.037908][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 402.046032][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 402.058129][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 402.192695][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 402.413264][T10208] bond0: (slave bond_slave_1): Releasing backup interface [ 402.764427][T10230] bridge0: port 3(veth1_to_bridge) entered blocking state [ 402.781645][T10230] bridge0: port 3(veth1_to_bridge) entered disabled state [ 402.789380][T10230] veth1_to_bridge: entered allmulticast mode [ 402.797694][T10230] veth1_to_bridge: entered promiscuous mode [ 402.808009][T10230] bridge0: adding interface veth1_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 402.821317][T10230] bridge0: port 3(veth1_to_bridge) entered blocking state [ 402.828714][T10230] bridge0: port 3(veth1_to_bridge) entered forwarding state [ 402.845826][T10230] binder_alloc: binder_alloc_mmap_handler: 10228 200000ffe000-200001000000 already mapped failed -16 [ 402.958455][ T30] audit: type=1400 audit(2000000095.030:757): avc: denied { read write } for pid=10238 comm="syz.0.1083" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 402.987387][T10239] [ 402.990032][ T30] audit: type=1400 audit(2000000095.060:758): avc: denied { open } for pid=10238 comm="syz.0.1083" path="/233/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 403.050093][ T5933] net_ratelimit: 3 callbacks suppressed [ 403.050120][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 404.519953][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 405.410638][T10268] vlan3: entered promiscuous mode [ 405.415702][T10268] bridge0: entered promiscuous mode [ 405.523341][T10277] tmpfs: Unknown parameter 'm ol' [ 405.539224][T10259] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 405.547810][T10259] team0: Port device batadv2 added [ 405.568068][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 405.830352][ T5811] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 406.450028][T10281] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1091'. [ 406.459769][T10281] 8021q: VLANs not supported on ip6tnl0 [ 406.472699][ T7195] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.481393][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.493086][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.501150][ T5811] usb 4-1: Using ep0 maxpacket: 8 [ 406.504698][ T5811] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 406.556486][ T5811] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 406.688625][ T5811] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 406.733783][ T5811] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 406.758359][ T5811] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 406.835845][ T5811] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 406.859990][ T5811] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.057403][ T30] audit: type=1400 audit(2000000099.110:759): avc: denied { write } for pid=10292 comm="syz.0.1096" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 407.106056][ T5811] usb 4-1: usb_control_msg returned -71 [ 407.173556][ T5811] usbtmc 4-1:16.0: can't read capabilities [ 407.233910][ T5811] usb 4-1: USB disconnect, device number 19 [ 407.367305][T10302] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 407.530102][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.832504][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.932037][ T30] audit: type=1400 audit(2000000101.010:760): avc: denied { setopt } for pid=10334 comm="syz.0.1104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 408.965897][T10335] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 409.099768][ T30] audit: type=1400 audit(2000000101.170:761): avc: denied { append } for pid=10309 comm="syz.2.1100" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 409.371806][ T5811] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 409.541760][ T5811] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 409.570292][ T5811] usb 2-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 409.589979][ T5811] usb 2-1: config 150 has no interface number 0 [ 409.596297][ T5811] usb 2-1: config 150 interface 204 has no altsetting 0 [ 409.635591][ T5811] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 409.660201][ T5811] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.668228][ T5811] usb 2-1: Product: syz [ 409.700097][ T5811] usb 2-1: Manufacturer: syz [ 409.704739][ T5811] usb 2-1: SerialNumber: syz [ 409.853343][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.945418][ T5811] xr_serial 2-1:150.204: skipping garbage [ 409.954907][T10366] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1112'. [ 409.965375][ T5811] xr_serial 2-1:150.204: xr_serial converter detected [ 409.979405][ T30] audit: type=1400 audit(2000000102.050:762): avc: denied { bind } for pid=10342 comm="syz.3.1106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 410.009785][T10366] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1112'. [ 410.025652][T10343] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=616 sclass=netlink_route_socket pid=10343 comm=syz.3.1106 [ 410.066977][ T30] audit: type=1400 audit(2000000102.110:763): avc: denied { setopt } for pid=10342 comm="syz.3.1106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 410.086654][T10368] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 410.088423][ T30] audit: type=1400 audit(2000000102.110:764): avc: denied { getopt } for pid=10342 comm="syz.3.1106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 410.116791][ T30] audit: type=1400 audit(2000000102.140:765): avc: denied { mount } for pid=10367 comm="syz.2.1113" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 410.159764][ T30] audit: type=1400 audit(2000000102.230:766): avc: denied { listen } for pid=10367 comm="syz.2.1113" laddr=fe80::a lport=35513 faddr=fe80::bb fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 410.200083][ T30] audit: type=1400 audit(2000000102.230:767): avc: denied { accept } for pid=10367 comm="syz.2.1113" laddr=fe80::a lport=35513 faddr=fe80::bb fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 410.693881][T10372] kvm: pic: non byte write [ 410.782888][T10383] No control pipe specified [ 410.890742][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.496889][ T30] audit: type=1400 audit(2000000103.570:768): avc: denied { unmount } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 411.935973][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.329418][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.386087][ T5811] xr_serial ttyUSB0: Failed to set reg 0x0c: -71 [ 412.424204][ T30] audit: type=1400 audit(2000000104.500:769): avc: denied { connect } for pid=10412 comm="syz.1.1124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 412.516677][ T30] audit: type=1400 audit(2000000104.580:770): avc: denied { ioctl } for pid=10412 comm="syz.1.1124" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x2286 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 412.523165][ T5811] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 412.660541][ T5811] usb 2-1: USB disconnect, device number 18 [ 412.781434][ T5811] xr_serial 2-1:150.204: device disconnected [ 413.040177][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.575710][ T30] audit: type=1400 audit(2000000105.630:771): avc: denied { bind } for pid=10410 comm="syz.2.1123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 413.584312][T10420] xt_ecn: cannot match TCP bits for non-tcp packets [ 414.132265][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.175825][ T30] audit: type=1400 audit(2000000105.910:772): avc: denied { unmount } for pid=5820 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 414.816729][T10447] FAULT_INJECTION: forcing a failure. [ 414.816729][T10447] name failslab, interval 1, probability 0, space 0, times 0 [ 414.836394][T10447] CPU: 0 UID: 0 PID: 10447 Comm: syz.4.1131 Not tainted syzkaller #0 PREEMPT(full) [ 414.836421][T10447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 414.836432][T10447] Call Trace: [ 414.836439][T10447] [ 414.836446][T10447] dump_stack_lvl+0x116/0x1f0 [ 414.836476][T10447] should_fail_ex+0x512/0x640 [ 414.836496][T10447] should_failslab+0xc2/0x120 [ 414.836516][T10447] kmem_cache_alloc_noprof+0x75/0x6e0 [ 414.836539][T10447] ? __send_signal_locked+0x159/0x12c0 [ 414.836562][T10447] ? __send_signal_locked+0x159/0x12c0 [ 414.836576][T10447] __send_signal_locked+0x159/0x12c0 [ 414.836598][T10447] send_sig+0xd7/0x170 [ 414.836616][T10447] ? __pfx_send_sig+0x10/0x10 [ 414.836634][T10447] ? __pfx_woken_wake_function+0x10/0x10 [ 414.836660][T10447] sk_stream_error+0xb8/0x120 [ 414.836680][T10447] tcp_sendmsg_locked+0xea7/0x42e0 [ 414.836702][T10447] ? avc_has_perm+0x144/0x1f0 [ 414.836728][T10447] ? __lock_acquire+0xb8a/0x1c90 [ 414.836761][T10447] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 414.836780][T10447] ? do_raw_spin_lock+0x12c/0x2b0 [ 414.836801][T10447] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 414.836826][T10447] ? __local_bh_enable_ip+0xa4/0x120 [ 414.836850][T10447] tcp_sendmsg+0x2e/0x50 [ 414.836866][T10447] ? __pfx_tcp_sendmsg+0x10/0x10 [ 414.836882][T10447] inet6_sendmsg+0xb9/0x140 [ 414.836909][T10447] __sys_sendto+0x376/0x520 [ 414.836931][T10447] ? __pfx___sys_sendto+0x10/0x10 [ 414.836961][T10447] ? find_held_lock+0x2b/0x80 [ 414.837003][T10447] __x64_sys_sendto+0xe0/0x1c0 [ 414.837022][T10447] ? do_syscall_64+0x91/0xfa0 [ 414.837049][T10447] ? lockdep_hardirqs_on+0x7c/0x110 [ 414.837076][T10447] do_syscall_64+0xcd/0xfa0 [ 414.837105][T10447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.837131][T10447] RIP: 0033:0x7f08b9f90e5c [ 414.837147][T10447] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 414.837165][T10447] RSP: 002b:00007f08bae42ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 414.837183][T10447] RAX: ffffffffffffffda RBX: 00007f08bae42fc0 RCX: 00007f08b9f90e5c [ 414.837195][T10447] RDX: 0000000000000020 RSI: 00007f08bae43010 RDI: 0000000000000006 [ 414.837207][T10447] RBP: 0000000000000000 R08: 00007f08bae42f14 R09: 000000000000000c [ 414.837218][T10447] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006 [ 414.837229][T10447] R13: 00007f08bae42f68 R14: 00007f08bae43010 R15: 0000000000000000 [ 414.837257][T10447] [ 415.144193][ C0] vkms_vblank_simulate: vblank timer overrun [ 415.583760][T10457] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1134'. [ 416.853992][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.919660][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.930208][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.466965][ T30] audit: type=1400 audit(2000000110.540:773): avc: denied { mount } for pid=10472 comm="syz.2.1137" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 418.980331][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.010335][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.707349][ T30] audit: type=1400 audit(2000000112.780:774): avc: denied { getopt } for pid=10513 comm="syz.3.1147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 420.743016][T10511] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1145'. [ 421.061334][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.239528][ T30] audit: type=1400 audit(2000000113.300:775): avc: denied { execute } for pid=10518 comm="syz.2.1148" path="/proc/sys/fs/binfmt_misc/register" dev="binfmt_misc" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=file permissive=1 [ 421.627113][ T30] audit: type=1400 audit(2000000113.700:776): avc: denied { mounton } for pid=10520 comm="syz.4.1149" path="/proc/861/task" dev="proc" ino=26658 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 421.628081][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.093696][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.163021][ T5927] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 422.320116][ T5927] usb 3-1: Using ep0 maxpacket: 16 [ 422.359697][ T5927] usb 3-1: config 0 has no interfaces? [ 422.416585][ T5927] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 422.426235][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.438298][ T5927] usb 3-1: Product: syz [ 422.444085][ T5927] usb 3-1: Manufacturer: syz [ 422.448753][ T5927] usb 3-1: SerialNumber: syz [ 422.475070][ T5927] usb 3-1: config 0 descriptor?? [ 422.502425][T10540] tmpfs: Unknown parameter 'm ol' [ 423.130988][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.340064][ T977] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 423.711712][T10555] ======================================================= [ 423.711712][T10555] WARNING: The mand mount option has been deprecated and [ 423.711712][T10555] and is ignored by this kernel. Remove the mand [ 423.711712][T10555] option from the mount to silence this warning. [ 423.711712][T10555] ======================================================= [ 423.711735][ T30] audit: type=1400 audit(2000000115.790:777): avc: denied { remount } for pid=10553 comm="syz.1.1156" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 423.746591][ C1] vkms_vblank_simulate: vblank timer overrun [ 423.781781][ T977] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 423.791313][ T977] usb 4-1: config 1 has an invalid descriptor of length 247, skipping remainder of the config [ 423.808117][ T977] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 423.821508][ T977] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 423.842886][ T977] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 423.852602][ T977] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 423.861714][ T977] usb 4-1: Product: syz [ 423.861730][ T977] usb 4-1: Manufacturer: syz [ 423.868992][ T977] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 424.079175][T10565] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1159'. [ 424.110321][ T977] usb 4-1: USB disconnect, device number 20 [ 424.262865][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.571297][T10569] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1160'. [ 424.580534][T10569] 8021q: VLANs not supported on ip6tnl0 [ 424.721375][ T977] usb 3-1: USB disconnect, device number 23 [ 424.861543][ T30] audit: type=1400 audit(2000000116.920:778): avc: denied { create } for pid=10576 comm="syz.2.1162" name="#11" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 424.896206][ T30] audit: type=1400 audit(2000000116.920:779): avc: denied { link } for pid=10576 comm="syz.2.1162" name="#11" dev="tmpfs" ino=1263 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 424.919136][ T30] audit: type=1400 audit(2000000116.920:780): avc: denied { rename } for pid=10576 comm="syz.2.1162" name="#12" dev="tmpfs" ino=1263 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 425.290185][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.319420][T10588] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1164'. [ 425.334761][T10587] bridge5: entered promiscuous mode [ 426.089989][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 426.134187][T10600] xt_HMARK: proto mask must be zero with L3 mode [ 426.142551][ T30] audit: type=1400 audit(2000000118.200:781): avc: denied { bind } for pid=10599 comm="syz.3.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 426.164810][ T30] audit: type=1400 audit(2000000118.200:782): avc: denied { setopt } for pid=10599 comm="syz.3.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 426.240005][ T977] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 426.247652][ T9] usb 2-1: device descriptor read/64, error -71 [ 426.330263][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.410278][ T977] usb 5-1: Using ep0 maxpacket: 16 [ 426.451817][ T977] usb 5-1: config 0 has no interfaces? [ 426.470452][ T977] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 426.481021][ T977] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.489497][ T977] usb 5-1: Product: syz [ 426.497212][ T977] usb 5-1: Manufacturer: syz [ 426.502016][ T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 426.510248][ T977] usb 5-1: SerialNumber: syz [ 426.520884][ T977] usb 5-1: config 0 descriptor?? [ 426.640084][ T9] usb 2-1: device descriptor read/64, error -71 [ 426.750629][ T9] usb usb2-port1: attempt power cycle [ 426.888917][T10605] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1170'. [ 427.025020][T10607] netlink: 4280 bytes leftover after parsing attributes in process `syz.2.1171'. [ 427.109935][ T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 427.198252][T10610] FAULT_INJECTION: forcing a failure. [ 427.198252][T10610] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 427.213950][T10610] CPU: 0 UID: 0 PID: 10610 Comm: syz.2.1171 Not tainted syzkaller #0 PREEMPT(full) [ 427.213975][T10610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 427.213985][T10610] Call Trace: [ 427.213991][T10610] [ 427.213997][T10610] dump_stack_lvl+0x16c/0x1f0 [ 427.214034][T10610] should_fail_ex+0x512/0x640 [ 427.214058][T10610] should_fail_alloc_page+0xe7/0x130 [ 427.214079][T10610] prepare_alloc_pages+0x3c2/0x610 [ 427.214103][T10610] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 427.214129][T10610] ? lockdep_hardirqs_on+0x7c/0x110 [ 427.214155][T10610] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 427.214173][T10610] ? find_held_lock+0x2b/0x80 [ 427.214186][T10610] ? is_bpf_text_address+0x8a/0x1a0 [ 427.214199][T10610] ? bpf_ksym_find+0x127/0x1c0 [ 427.214214][T10610] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 427.214231][T10610] ? is_bpf_text_address+0x94/0x1a0 [ 427.214244][T10610] ? kernel_text_address+0x8d/0x100 [ 427.214255][T10610] ? widen_string+0xdc/0x2d0 [ 427.214267][T10610] ? __kernel_text_address+0xd/0x40 [ 427.214284][T10610] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 427.214298][T10610] ? policy_nodemask+0xea/0x4e0 [ 427.214312][T10610] alloc_pages_mpol+0x1fb/0x550 [ 427.214325][T10610] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 427.214341][T10610] ___kmalloc_large_node+0xed/0x160 [ 427.214355][T10610] __kmalloc_large_node_noprof+0x1c/0x70 [ 427.214369][T10610] __kmalloc_noprof.cold+0xc/0x62 [ 427.214386][T10610] ? snd_ctl_new+0x56/0x1a0 [ 427.214402][T10610] ? snd_ctl_new+0x56/0x1a0 [ 427.214415][T10610] snd_ctl_new+0x56/0x1a0 [ 427.214430][T10610] snd_ctl_elem_add+0x527/0x14e0 [ 427.214448][T10610] ? find_held_lock+0x2b/0x80 [ 427.214460][T10610] ? __might_fault+0xe3/0x190 [ 427.214475][T10610] ? __might_fault+0xe3/0x190 [ 427.214489][T10610] ? __might_fault+0x13b/0x190 [ 427.214504][T10610] ? __pfx_snd_ctl_elem_add+0x10/0x10 [ 427.214524][T10610] snd_ctl_elem_add_user+0xc3/0x170 [ 427.214539][T10610] ? __pfx_snd_ctl_elem_add_user+0x10/0x10 [ 427.214567][T10610] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 427.214585][T10610] snd_ctl_ioctl+0x799/0xf80 [ 427.214600][T10610] ? __pfx_snd_ctl_ioctl+0x10/0x10 [ 427.214617][T10610] ? selinux_file_ioctl+0x180/0x270 [ 427.214628][T10610] ? selinux_file_ioctl+0xb4/0x270 [ 427.214640][T10610] ? __pfx_snd_ctl_ioctl+0x10/0x10 [ 427.214656][T10610] __x64_sys_ioctl+0x18e/0x210 [ 427.214672][T10610] do_syscall_64+0xcd/0xfa0 [ 427.214689][T10610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.214699][T10610] RIP: 0033:0x7f8ca718efc9 [ 427.214708][T10610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 427.214718][T10610] RSP: 002b:00007f8ca80d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 427.214728][T10610] RAX: ffffffffffffffda RBX: 00007f8ca73e6090 RCX: 00007f8ca718efc9 [ 427.214735][T10610] RDX: 0000200000000080 RSI: 00000000c1105517 RDI: 0000000000000008 [ 427.214741][T10610] RBP: 00007f8ca80d5090 R08: 0000000000000000 R09: 0000000000000000 [ 427.214747][T10610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.214754][T10610] R13: 00007f8ca73e6128 R14: 00007f8ca73e6090 R15: 00007ffe384cd2e8 [ 427.214768][T10610] [ 427.888841][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.890539][ T9] usb 2-1: device descriptor read/8, error -71 [ 428.075251][ T30] audit: type=1400 audit(2000000120.130:783): avc: denied { append } for pid=10612 comm="syz.2.1173" name="sg0" dev="devtmpfs" ino=767 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 428.168570][ T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 428.200890][ T9] usb 2-1: device descriptor read/8, error -71 [ 428.402473][ T9] usb usb2-port1: unable to enumerate USB device [ 428.455237][ T30] audit: type=1400 audit(2000000120.530:784): avc: denied { name_connect } for pid=10612 comm="syz.2.1173" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 428.503467][T10624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.559208][T10624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.612772][T10616] 8021q: adding VLAN 0 to HW filter on device batadv5 [ 428.621572][T10616] team0: Port device batadv5 added [ 428.631054][T10624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.782947][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.063931][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.100885][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.121652][ T977] usb 5-1: USB disconnect, device number 12 [ 429.128617][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.168738][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.188749][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.200900][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.211799][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.222579][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.233291][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.288707][T10616] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 429.366133][T10631] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.374475][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.564788][T10635] tmpfs: Unknown parameter 'm ol' [ 430.090450][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.262862][ T30] audit: type=1400 audit(2000000122.340:785): avc: denied { name_connect } for pid=10638 comm="syz.0.1179" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 430.813672][T10645] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1182'. [ 431.532213][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.543425][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.553545][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.562781][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.581167][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.589770][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.726601][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.864794][ T30] audit: type=1400 audit(2000000124.940:786): avc: denied { bind } for pid=10654 comm="syz.0.1183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 432.940374][T10663] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1183'. [ 433.774596][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.580846][T10688] fuse: Unknown parameter '01777777777777777777777' [ 435.072151][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.301536][ T5882] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 435.771999][ T5882] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 435.785440][ T5882] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 435.799801][ T5882] usb 2-1: config 0 has no interface number 0 [ 435.890882][ T5882] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 435.912816][T10702] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1198'. [ 436.103318][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.218031][ T5882] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 437.026394][ T5882] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 437.059963][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.903152][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.960266][ T5882] usb 2-1: Product: syz [ 437.964676][ T5882] usb 2-1: Manufacturer: syz [ 437.969486][ T5882] usb 2-1: SerialNumber: syz [ 438.104701][ T5882] usb 2-1: config 0 descriptor?? [ 438.118561][ T5882] usb 2-1: can't set config #0, error -71 [ 438.133814][ T5882] usb 2-1: USB disconnect, device number 23 [ 438.410157][T10725] netlink: 4280 bytes leftover after parsing attributes in process `syz.1.1204'. [ 438.970163][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.327752][ T5882] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 439.685312][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.691852][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.763034][ T5882] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 439.787570][ T5882] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 439.812601][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.827176][ T5882] usb 4-1: Product: syz [ 439.835308][ T5882] usb 4-1: Manufacturer: syz [ 439.841322][ T5882] usb 4-1: SerialNumber: syz [ 440.059333][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.082397][ T5882] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 440.097583][ T5882] usb 4-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 440.121769][ T5882] usb 4-1: USB disconnect, device number 21 [ 440.620030][T10749] netlink: 'syz.1.1210': attribute type 10 has an invalid length. [ 440.628913][T10749] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1210'. [ 440.639256][T10749] bridge0: port 3(veth0_vlan) entered blocking state [ 440.646971][T10749] bridge0: port 3(veth0_vlan) entered disabled state [ 440.658720][T10749] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 440.811830][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.131858][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.002092][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 442.162006][ T9] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 442.185838][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 29525, setting to 1024 [ 442.203456][T10771] tmpfs: Unknown parameter 'm ol' [ 442.208924][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.000839][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 443.047294][ T9] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 443.066201][ T9] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 443.080377][ T9] usb 3-1: Manufacturer: syz [ 443.094199][ T9] usb 3-1: config 0 descriptor?? [ 443.106005][T10753] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 443.118051][ T9] igorplugusb 3-1:0.0: endpoint incorrect [ 443.268515][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.815863][ T5933] usb 3-1: USB disconnect, device number 24 [ 443.930151][T10784] 8021q: adding VLAN 0 to HW filter on device batadv6 [ 443.951974][T10784] team0: Port device batadv6 added [ 444.272489][T10774] sctp_transport_update_pmtu: 48 callbacks suppressed [ 444.272501][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 444.703407][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 444.703716][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.821978][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 444.836179][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 444.867062][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.876267][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.885173][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.894287][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.903052][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.925183][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.933605][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.944221][T10795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.072859][T10795] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pid=10795 comm=syz.2.1223 [ 445.279080][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 445.292959][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 445.310423][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 445.331412][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 445.641945][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 446.004508][T10774] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 448.777080][T10834] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1234'. [ 448.907693][ T5882] net_ratelimit: 14 callbacks suppressed [ 448.907714][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.939500][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.920906][T10855] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1237'. [ 450.931851][T10855] 8021q: VLANs not supported on ip6tnl0 [ 451.140932][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.149131][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.280606][T10852] fuse: Unknown parameter '01777777777777777777777' [ 451.889944][ T5882] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 452.052467][ T5882] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 452.090102][ T5882] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 452.120942][ T5882] usb 4-1: config 0 has no interface number 0 [ 452.151012][ T5882] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 452.173442][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.214611][ T5882] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 452.402063][ T5882] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 452.418981][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.427253][ T5882] usb 4-1: Product: syz [ 452.446852][ T5882] usb 4-1: Manufacturer: syz [ 452.461720][ T5882] usb 4-1: SerialNumber: syz [ 452.488501][ T5882] usb 4-1: config 0 descriptor?? [ 453.453308][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.988380][T10876] 8021q: adding VLAN 0 to HW filter on device batadv4 [ 454.716367][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.757503][ T30] audit: type=1400 audit(2000000146.830:787): avc: denied { lock } for pid=10898 comm="syz.0.1247" path="socket:[27688]" dev="sockfs" ino=27688 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 454.807280][T10876] team0: Port device batadv4 added [ 454.838824][T10895] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1246'. [ 455.039457][ T5927] usb 4-1: USB disconnect, device number 22 [ 455.882418][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.136822][ T30] audit: type=1400 audit(2000000148.210:788): avc: denied { accept } for pid=10914 comm="syz.0.1251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 456.963380][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.287618][ T5875] kernel read not supported for file /dsp (pid: 5875 comm: kworker/0:4) [ 458.250166][T10947] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1259'. [ 458.327063][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.075251][T10961] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1262'. [ 459.084483][T10961] 8021q: VLANs not supported on ip6tnl0 [ 459.138602][ T5875] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 459.299905][ T5875] usb 5-1: Using ep0 maxpacket: 16 [ 459.311884][ T5875] usb 5-1: config 11 has an invalid interface number: 32 but max is 0 [ 459.320491][ T5875] usb 5-1: config 11 has no interface number 0 [ 459.327344][ T5875] usb 5-1: config 11 interface 32 has no altsetting 0 [ 459.340912][ T5875] usb 5-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 5.91 [ 459.350231][ T5875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.362622][ T5875] usb 5-1: Product: syz [ 459.384550][ T5875] usb 5-1: Manufacturer: syz [ 459.396671][ T5875] usb 5-1: SerialNumber: syz [ 459.433170][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.738873][ T5875] ttusb_dec_send_command: command bulk message failed: error -22 [ 459.781807][ T5875] ttusb-dec 5-1:11.32: probe with driver ttusb-dec failed with error -22 [ 459.827058][ T5875] usb 5-1: USB disconnect, device number 13 [ 460.010207][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.618221][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.650139][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.430402][ T5875] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 461.590351][ T5875] usb 5-1: Using ep0 maxpacket: 16 [ 461.620975][ T5875] usb 5-1: config 0 has no interfaces? [ 461.645121][ T5875] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 461.683641][ T5875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.708415][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.732060][ T5875] usb 5-1: Product: syz [ 461.804824][ T5875] usb 5-1: Manufacturer: syz [ 461.810532][ T5875] usb 5-1: SerialNumber: syz [ 461.827316][ T5875] usb 5-1: config 0 descriptor?? [ 462.742784][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.888837][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.899938][ T30] audit: type=1326 audit(2000000154.030:789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10969 comm="syz.2.1265" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ca718efc9 code=0x7fc00000 [ 464.566334][ T30] audit: type=1400 audit(2000000156.640:790): avc: denied { getopt } for pid=11006 comm="syz.2.1275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 464.599697][ T30] audit: type=1400 audit(2000000156.670:791): avc: denied { ioctl } for pid=11006 comm="syz.2.1275" path="socket:[29090]" dev="sockfs" ino=29090 ioctlcmd=0x9422 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 464.626138][T11005] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3821099475 (7642198950 ns) > initial count (2842047336 ns). Using initial count to start timer. [ 464.893896][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.418920][ T977] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 465.601725][ T977] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 465.614933][ T977] usb 2-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 465.625978][ T977] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 465.636770][ T977] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 465.657161][ T977] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 465.672603][ T977] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 465.692703][ T977] usb 2-1: Product: syz [ 465.699022][ T977] usb 2-1: Manufacturer: syz [ 465.711262][ T977] cdc_wdm 2-1:1.0: skipping garbage [ 465.722149][ T977] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 465.855502][T11028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.866577][T11028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.876911][T11028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.887069][T11028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.897053][T11028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.913435][T11027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.948676][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.122243][ T977] usb 2-1: USB disconnect, device number 24 [ 466.275353][T11038] 8021q: adding VLAN 0 to HW filter on device batadv7 [ 466.315802][T11038] team0: Port device batadv7 added [ 466.327394][T11037] sctp_transport_update_pmtu: 48 callbacks suppressed [ 466.327410][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.357737][ T30] audit: type=1400 audit(2000000158.420:792): avc: denied { bind } for pid=11039 comm="syz.2.1283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 466.392469][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.447232][ T30] audit: type=1400 audit(2000000158.420:793): avc: denied { node_bind } for pid=11039 comm="syz.2.1283" saddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 466.496769][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.518761][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.533104][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.543868][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 466.555017][ T30] audit: type=1400 audit(2000000158.460:794): avc: denied { bind } for pid=11039 comm="syz.2.1283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 466.590798][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 467.036764][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.057746][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 467.103204][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 467.117909][T11037] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 467.370138][ T5927] usb 5-1: USB disconnect, device number 14 [ 467.818326][T11060] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1289'. [ 468.080585][T11065] cgroup: Unknown subsys name 'cpuset' [ 468.287874][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.290311][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.300134][T11082] FAULT_INJECTION: forcing a failure. [ 469.300134][T11082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.320397][T11082] CPU: 1 UID: 0 PID: 11082 Comm: syz.4.1291 Not tainted syzkaller #0 PREEMPT(full) [ 469.320418][T11082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 469.320427][T11082] Call Trace: [ 469.320432][T11082] [ 469.320438][T11082] dump_stack_lvl+0x16c/0x1f0 [ 469.320463][T11082] should_fail_ex+0x512/0x640 [ 469.320483][T11082] _copy_from_user+0x2e/0xd0 [ 469.320501][T11082] move_addr_to_kernel+0x65/0x170 [ 469.320516][T11082] __sys_sendto+0x1be/0x520 [ 469.320533][T11082] ? __pfx___sys_sendto+0x10/0x10 [ 469.320568][T11082] ? ksys_write+0x1ac/0x250 [ 469.320580][T11082] ? __pfx_ksys_write+0x10/0x10 [ 469.320596][T11082] __x64_sys_sendto+0xe0/0x1c0 [ 469.320611][T11082] ? do_syscall_64+0x91/0xfa0 [ 469.320636][T11082] ? lockdep_hardirqs_on+0x7c/0x110 [ 469.320656][T11082] do_syscall_64+0xcd/0xfa0 [ 469.320677][T11082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.320691][T11082] RIP: 0033:0x7f08b9f8efc9 [ 469.320702][T11082] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 469.320715][T11082] RSP: 002b:00007f08bae23038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 469.320729][T11082] RAX: ffffffffffffffda RBX: 00007f08ba1e6180 RCX: 00007f08b9f8efc9 [ 469.320738][T11082] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 469.320745][T11082] RBP: 00007f08bae23090 R08: 0000200000000080 R09: 0000000000000080 [ 469.320754][T11082] R10: 0000000000028000 R11: 0000000000000246 R12: 0000000000000001 [ 469.320761][T11082] R13: 00007f08ba1e6218 R14: 00007f08ba1e6180 R15: 00007fff3948c458 [ 469.320781][T11082] [ 469.624745][T11074] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pid=11074 comm=syz.2.1287 [ 469.644752][T11074] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1287'. [ 469.663021][T11074] : entered promiscuous mode [ 470.286715][T11094] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1294'. [ 472.523585][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.921995][T11103] netlink: 'syz.1.1297': attribute type 10 has an invalid length. [ 472.930850][T11103] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1297'. [ 473.135413][T11103] bridge0: port 3(veth0_vlan) entered blocking state [ 473.142389][T11103] bridge0: port 3(veth0_vlan) entered disabled state [ 473.150765][T11103] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 473.319350][T11106] 8021q: adding VLAN 0 to HW filter on device batadv8 [ 473.328118][T11111] netlink: 'syz.4.1298': attribute type 1 has an invalid length. [ 473.338374][T11111] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1298'. [ 473.340966][T11106] team0: Port device batadv8 added [ 473.370024][ T5927] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 473.663575][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.830448][ T5927] usb 3-1: Using ep0 maxpacket: 16 [ 473.834256][T11106] sctp_transport_update_pmtu: 48 callbacks suppressed [ 473.834270][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 473.897163][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 473.908524][ T5927] usb 3-1: config 0 has no interfaces? [ 473.937287][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 473.957139][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 473.998824][ T30] audit: type=1400 audit(2000000166.070:795): avc: denied { append } for pid=11115 comm="syz.0.1300" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 474.057448][ T5927] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 474.066703][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.127477][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.152438][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.169549][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.181686][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.310450][ T5927] usb 3-1: Product: syz [ 474.327872][ T5927] usb 3-1: Manufacturer: syz [ 474.346663][T11121] loop6: detected capacity change from 0 to 524288000 [ 474.357053][T11120] fuse: Invalid rootmode [ 474.362438][ T30] audit: type=1400 audit(2000000166.440:796): avc: denied { name_bind } for pid=11118 comm="syz.1.1301" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 474.393871][T11120] lo speed is unknown, defaulting to 1000 [ 474.471453][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.492815][ T5927] usb 3-1: SerialNumber: syz [ 474.500114][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.520904][ T5927] usb 3-1: config 0 descriptor?? [ 474.631599][T11106] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 474.776072][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.842248][T11117] loop6: detected capacity change from 524288000 to 524287951 [ 475.299388][ T30] audit: type=1400 audit(2000000167.370:797): avc: denied { ioctl } for pid=11131 comm="syz.1.1304" path="socket:[28072]" dev="sockfs" ino=28072 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 475.333281][ T977] usb 3-1: USB disconnect, device number 25 [ 475.698057][T11148] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 475.706835][T11148] team0: Port device batadv3 added [ 475.854117][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.634874][T11167] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1310'. [ 479.002895][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.862408][ T5875] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.010339][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.172373][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.494686][ T977] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 481.693733][ T977] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 481.737316][ T977] usb 2-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 481.767527][ T977] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 481.822513][ T977] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 481.873125][ T977] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 481.948134][ T977] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 481.963830][ T977] usb 2-1: Product: syz [ 481.968020][ T977] usb 2-1: Manufacturer: syz [ 481.995375][ T977] cdc_wdm 2-1:1.0: skipping garbage [ 482.007837][ T977] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 482.109217][ T24] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 482.254744][ T80] usb 2-1: USB disconnect, device number 25 [ 482.278788][T11224] netlink: 'syz.3.1328': attribute type 10 has an invalid length. [ 482.302989][T11224] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 482.308254][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.324889][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 482.349175][ T24] usb 3-1: config 0 has no interfaces? [ 482.359601][ T24] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 482.374280][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.384116][ T24] usb 3-1: Product: syz [ 482.393751][ T24] usb 3-1: Manufacturer: syz [ 482.406229][ T24] usb 3-1: SerialNumber: syz [ 482.419548][ T24] usb 3-1: config 0 descriptor?? [ 482.428641][T11224] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 482.580071][ T977] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 482.740107][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 482.766194][ T977] usb 4-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 482.789124][ T977] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 482.815366][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.855161][ T977] usb 4-1: Product: syz [ 482.859325][ T977] usb 4-1: Manufacturer: syz [ 482.887757][ T977] usb 4-1: SerialNumber: syz [ 483.260087][ T977] usb 4-1: config 0 descriptor?? [ 483.293147][ T977] usb 4-1: bad CDC descriptors [ 483.299367][ T977] usb 4-1: unsupported MDLM descriptors [ 483.434277][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.476456][ T5811] usb 3-1: USB disconnect, device number 26 [ 483.670071][T11242] netlink: 'syz.1.1333': attribute type 10 has an invalid length. [ 483.683266][T11242] team0: Device ipvlan1 failed to register rx_handler [ 484.659237][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.671413][T11252] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1335'. [ 484.680741][T11252] 8021q: VLANs not supported on ip6tnl0 [ 485.618985][T11264] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1340'. [ 485.700306][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.790016][ T80] usb 4-1: USB disconnect, device number 23 [ 485.800004][ T977] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 485.981180][ T977] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 486.320289][ T977] usb 2-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 486.333424][ T977] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 486.336380][ T3015] Bluetooth: Invalid byte 5e after esc byte [ 486.351380][ T977] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 486.375324][ T977] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 486.386009][ T977] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 486.394337][ T977] usb 2-1: Product: syz [ 486.398840][ T977] usb 2-1: Manufacturer: syz [ 486.519147][ T977] cdc_wdm 2-1:1.0: skipping garbage [ 486.524781][ T977] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 486.593482][ T7177] Bluetooth: Error in BCSP hdr checksum [ 486.668714][ T80] usb 2-1: USB disconnect, device number 26 [ 486.732603][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.783527][ T30] audit: type=1400 audit(2000000178.860:798): avc: denied { module_load } for pid=11282 comm="syz.4.1345" path="/sys/power/wakeup_count" dev="sysfs" ino=1413 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 487.065289][T11290] /dev/nullb0: Can't open blockdev [ 487.178339][T11293] syz.3.1346 (11293): drop_caches: 0 [ 487.286326][T11292] fuse: Unknown parameter '01777777777777777777777' [ 487.724273][T11299] fuse: Unknown parameter '01777777777777777777777' [ 487.733057][ T80] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 487.807075][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.940090][ T5813] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 488.013010][ T80] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 488.097401][ T24] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 488.134151][ T80] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.165052][ T80] usb 5-1: config 0 has no interface number 0 [ 488.171459][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.195773][ T80] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 488.206208][ T80] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 488.295475][T11309] JFS: charset not found [ 488.305545][T11309] SELinux: Context system_u:object_r:xconsole_device_t:s0 is not valid (left unmapped). [ 488.331446][T11309] pim6reg: entered allmulticast mode [ 488.332536][ T24] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 488.429379][ T80] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 488.539968][ T80] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.591708][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.618497][ T80] usb 5-1: Product: syz [ 488.628126][ T24] usb 2-1: config 0 has no interface number 0 [ 488.633969][ T30] audit: type=1400 audit(2000000180.390:799): avc: denied { relabelto } for pid=11305 comm="syz.2.1351" name="file1" dev="tmpfs" ino=1453 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:xconsole_device_t:s0" [ 488.639908][ T80] usb 5-1: Manufacturer: syz [ 488.639925][ T80] usb 5-1: SerialNumber: syz [ 488.684378][ T24] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 488.719395][ T24] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 488.727953][ T30] audit: type=1400 audit(2000000180.390:800): avc: denied { associate } for pid=11305 comm="syz.2.1351" name="file1" dev="tmpfs" ino=1453 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:xconsole_device_t:s0" [ 488.796189][ T24] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 488.825588][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.837216][ T80] usb 5-1: config 0 descriptor?? [ 488.842606][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.910005][ T24] usb 2-1: Product: syz [ 488.914226][ T24] usb 2-1: Manufacturer: syz [ 488.974899][ T24] usb 2-1: SerialNumber: syz [ 489.005052][ T24] usb 2-1: config 0 descriptor?? [ 489.683573][T11316] fuse: Bad value for 'fd' [ 489.989088][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.934711][ T24] usb 5-1: USB disconnect, device number 15 [ 491.114951][T11329] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1358'. [ 493.708628][ T80] usb 2-1: USB disconnect, device number 27 [ 493.714284][T11334] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1360'. [ 493.732966][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.835311][T11338] JFS: charset not found [ 493.933807][T11338] vxcan0: entered allmulticast mode [ 494.210839][ T80] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 494.371495][ T80] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 494.403022][ T80] usb 2-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 494.418570][ T80] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 494.730002][ T80] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 494.837588][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 494.864561][ T80] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 494.878792][ T80] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 494.889047][ T80] usb 2-1: Product: syz [ 494.894384][ T80] usb 2-1: Manufacturer: syz [ 494.961635][ T80] cdc_wdm 2-1:1.0: skipping garbage [ 494.968896][ T80] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 495.235112][ T9] usb 2-1: USB disconnect, device number 28 [ 495.464964][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.488902][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.513260][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.524296][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.576404][T11364] 8021q: adding VLAN 0 to HW filter on device batadv9 [ 495.584416][T11364] team0: Port device batadv9 added [ 495.611445][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.620221][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.628681][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.637217][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.645632][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.655172][T11364] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.966016][ T5136] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 495.989436][ T5136] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 496.208959][ T30] audit: type=1400 audit(2000000188.040:801): avc: denied { accept } for pid=11362 comm="syz.0.1366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 496.829830][T11372] fuse: Unknown parameter '01777777777777777777777' [ 496.838629][ T80] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 497.010659][ T80] usb 2-1: Using ep0 maxpacket: 32 [ 497.018297][ T80] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 497.037090][ T80] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.060779][ T80] usb 2-1: config 0 descriptor?? [ 497.071030][ T80] as10x_usb: device has been detected [ 497.079895][ T5933] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 497.101006][ T80] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 497.128032][ T80] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 497.147385][ T80] as10x_usb: error during firmware upload part1 [ 497.154296][ T80] Registered device nBox DVB-T Dongle [ 497.291619][ T5933] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 497.340426][ T5933] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 497.355029][T11370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.371422][T11370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.407865][ T5933] usb 4-1: config 0 has no interface number 0 [ 497.430154][ T5933] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 497.506967][ T5933] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 497.526222][T11382] lo speed is unknown, defaulting to 1000 [ 497.526635][T11383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.553180][T11383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.572528][ T5933] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 497.597357][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.614413][ T5933] usb 4-1: Product: syz [ 497.660131][ T5933] usb 4-1: Manufacturer: syz [ 497.729179][ T5933] usb 4-1: SerialNumber: syz [ 497.835994][ T5933] usb 4-1: config 0 descriptor?? [ 498.229964][T11390] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1372'. [ 498.500006][ T9] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 498.703354][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 498.734664][ T9] usb 5-1: config 0 has no interfaces? [ 498.746916][ T9] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 498.766056][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.775766][ T9] usb 5-1: Product: syz [ 498.780285][ T9] usb 5-1: Manufacturer: syz [ 498.785130][ T9] usb 5-1: SerialNumber: syz [ 498.795755][ T9] usb 5-1: config 0 descriptor?? [ 499.470519][ T9] usb 2-1: USB disconnect, device number 29 [ 499.518984][ T9] Unregistered device nBox DVB-T Dongle [ 499.526214][ T9] as10x_usb: device has been disconnected [ 499.684063][ T30] audit: type=1400 audit(2000000191.760:802): avc: denied { create } for pid=11403 comm="syz.2.1376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 499.870111][ T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 499.922576][ T80] usb 4-1: USB disconnect, device number 24 [ 499.991921][ T30] audit: type=1400 audit(2000000192.070:803): avc: denied { ioctl } for pid=11407 comm="syz.3.1378" path="socket:[28495]" dev="sockfs" ino=28495 ioctlcmd=0x581f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 500.016729][ T5933] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 500.018072][ T30] audit: type=1400 audit(2000000192.070:804): avc: denied { connect } for pid=11407 comm="syz.3.1378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 500.046255][ T30] audit: type=1400 audit(2000000192.120:805): avc: denied { write } for pid=11407 comm="syz.3.1378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 500.093194][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 500.164507][ T9] usb 2-1: config 0 has no interfaces? [ 500.382232][T11411] netlink: 360 bytes leftover after parsing attributes in process `syz.3.1378'. [ 500.466943][ T9] usb 2-1: New USB device found, idVendor=33f8, idProduct=01a3, bcdDevice=a9.16 [ 500.515145][ T5933] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 500.525140][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.529912][ T5933] usb 3-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 500.545361][ T9] usb 2-1: Product: syz [ 500.549677][ T9] usb 2-1: Manufacturer: syz [ 500.552786][ T5933] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 500.555334][ T9] usb 2-1: SerialNumber: syz [ 500.588239][ T9] usb 2-1: config 0 descriptor?? [ 501.206862][T11410] syz.3.1378 (11410): drop_caches: 2 [ 501.231476][ T5933] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 501.246530][ T5933] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 501.253758][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.274449][ T5933] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 501.283451][ T5811] usb 5-1: USB disconnect, device number 16 [ 501.299089][ T24] net_ratelimit: 157 callbacks suppressed [ 501.299101][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.350394][ T5933] usb 3-1: Product: syz [ 501.354752][ T5933] usb 3-1: Manufacturer: syz [ 501.438618][ T5933] cdc_wdm 3-1:1.0: skipping garbage [ 501.457094][ T5933] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 501.564858][ T5811] usb 2-1: USB disconnect, device number 30 [ 501.572957][ T30] audit: type=1400 audit(2000000193.640:806): avc: denied { ioctl } for pid=11415 comm="syz.3.1379" path="uts:[4026532804]" dev="nsfs" ino=4026532804 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 501.640948][ T9] usb 3-1: USB disconnect, device number 27 [ 501.809975][ T5933] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 501.981185][ T5933] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 501.989246][ T5933] usb 4-1: config 1 has no interface number 0 [ 501.995416][ T5933] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 32 [ 502.006124][ T5933] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 502.017698][ T5933] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 502.026744][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.034743][ T5933] usb 4-1: Product: syz [ 502.038898][ T5933] usb 4-1: Manufacturer: syz [ 502.049414][ T5933] usb 4-1: SerialNumber: syz [ 502.056188][T11416] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 502.063677][T11416] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 502.072503][ T5933] usb 4-1: Error in usbnet_get_endpoints (-22) [ 502.250359][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 502.528738][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 502.537268][T11425] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1381'. [ 502.691216][ T9] usb 4-1: USB disconnect, device number 25 [ 503.674795][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.703335][ T80] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 503.748903][ T30] audit: type=1326 audit(2000000195.820:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11451 comm="syz.0.1387" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f68d978efc9 code=0x0 [ 503.803529][ T30] audit: type=1400 audit(2000000195.880:808): avc: denied { ioctl } for pid=11453 comm="syz.3.1389" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 503.872665][ T80] usb 2-1: Using ep0 maxpacket: 16 [ 503.896113][ T80] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 503.923892][ T80] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.953167][ T80] usb 2-1: Product: syz [ 503.974355][ T80] usb 2-1: Manufacturer: syz [ 503.979647][ T80] usb 2-1: SerialNumber: syz [ 504.158691][ T80] usb 2-1: config 0 descriptor?? [ 504.181031][ T80] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 504.216806][T11465] binder: BINDER_SET_CONTEXT_MGR already set [ 504.223261][T11465] binder: 11463:11465 ioctl 4018620d 2000000002c0 returned -16 [ 504.260381][ T30] audit: type=1326 audit(2000000196.280:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.330067][ T30] audit: type=1326 audit(2000000196.280:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.383674][ T30] audit: type=1326 audit(2000000196.280:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.419169][ T30] audit: type=1326 audit(2000000196.280:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.468603][ T30] audit: type=1326 audit(2000000196.280:813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.493409][ T30] audit: type=1326 audit(2000000196.290:814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.539919][ T5811] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 504.702884][ T30] audit: type=1326 audit(2000000196.290:815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11463 comm="syz.2.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8ca718efc9 code=0x7ffc0000 [ 504.703831][ T5811] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 504.740145][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 504.771643][T11472] netlink: 'syz.0.1387': attribute type 1 has an invalid length. [ 504.790772][ T80] usb 2-1: clie_3_5_startup: get config number failed: -71 [ 504.801806][ T80] visor 2-1:0.0: probe with driver visor failed with error -71 [ 504.802192][ T5811] usb 5-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 504.843833][ T5811] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 504.855270][ T5811] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 504.899074][ T5811] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 504.901117][ T80] usb 2-1: USB disconnect, device number 31 [ 504.912916][ T5811] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 504.923163][ T5811] usb 5-1: Product: syz [ 504.927460][ T5811] usb 5-1: Manufacturer: syz [ 504.947492][ T5811] cdc_wdm 5-1:1.0: skipping garbage [ 504.954888][ T5811] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 505.159208][ T5811] usb 5-1: USB disconnect, device number 17 [ 505.619976][ T80] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 505.773909][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 505.789995][ T80] usb 2-1: Using ep0 maxpacket: 8 [ 505.796944][ T80] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 505.820860][ T80] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 505.831395][ T80] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 505.854926][ T80] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 505.881300][ T80] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 505.913229][ T80] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.439526][T11480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1396'. [ 506.810516][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.072160][ T80] usb 2-1: usb_control_msg returned -32 [ 507.089669][ T80] usbtmc 2-1:16.0: can't read capabilities [ 507.862945][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.195008][T11526] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1408'. [ 508.333240][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 508.333256][ T30] audit: type=1400 audit(2000000200.410:846): avc: denied { execute } for pid=11531 comm="syz.4.1411" path="/dev/comedi4" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 508.673711][ T977] usb 2-1: USB disconnect, device number 32 [ 508.890363][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.215803][T11556] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1416'. [ 510.224966][T11556] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1416'. [ 510.239823][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.300190][ T80] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 510.343870][T11559] delete_channel: no stack [ 510.562883][ T80] usb 5-1: Using ep0 maxpacket: 16 [ 511.366467][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.400345][ T80] usb 5-1: config 11 has an invalid interface number: 32 but max is 0 [ 512.408612][ T80] usb 5-1: config 11 has no interface number 0 [ 512.421815][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.450044][ T80] usb 5-1: config 11 interface 32 has no altsetting 0 [ 512.730001][T11575] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1422'. [ 513.049999][ T80] usb 5-1: string descriptor 0 read error: -71 [ 513.057116][ T80] usb 5-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 5.91 [ 513.075195][ T80] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.169904][ T5927] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 513.178069][ T80] usb 5-1: can't set config #11, error -71 [ 513.461347][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.506873][ T5927] usb 3-1: device descriptor read/64, error -71 [ 513.540003][ T80] usb 5-1: USB disconnect, device number 18 [ 513.647855][T11591] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 513.693152][ T30] audit: type=1400 audit(2000000205.770:847): avc: denied { remount } for pid=11590 comm="syz.4.1427" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 513.810076][ T5927] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 514.106774][T11580] /dev/nullb0: Can't open blockdev [ 514.164309][ T5927] usb 3-1: device descriptor read/64, error -71 [ 514.313005][ T5927] usb usb3-port1: attempt power cycle [ 514.456096][ T30] audit: type=1400 audit(2000000206.240:848): avc: denied { connect } for pid=11593 comm="syz.4.1428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 514.491653][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.719964][ T5927] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 515.177980][ T5927] usb 3-1: device not accepting address 30, error -71 [ 515.216828][ T30] audit: type=1400 audit(2000000207.290:849): avc: denied { create } for pid=11611 comm="syz.2.1432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 515.267126][ T30] audit: type=1400 audit(2000000207.340:850): avc: denied { name_bind } for pid=11611 comm="syz.2.1432" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 515.397872][ T30] audit: type=1400 audit(2000000207.470:851): avc: denied { ioctl } for pid=11610 comm="syz.4.1433" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 515.537923][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.656210][T11622] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 515.682957][T11622] team0: Port device batadv3 added [ 516.389694][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.728390][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.955856][ T30] audit: type=1400 audit(2000000209.030:852): avc: denied { setopt } for pid=11638 comm="syz.3.1439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 516.980063][ T977] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 517.186366][ T977] usb 5-1: Using ep0 maxpacket: 8 [ 517.198485][ T977] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 517.206755][ T30] audit: type=1400 audit(2000000209.220:853): avc: denied { lock } for pid=11645 comm="syz.3.1441" path="socket:[31267]" dev="sockfs" ino=31267 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 517.207211][ T977] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 517.271843][ T977] usb 5-1: config 0 has no interface number 0 [ 517.278106][ T977] usb 5-1: config 0 interface 52 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 517.291806][ T977] usb 5-1: config 0 interface 52 has no altsetting 0 [ 517.299490][ T30] audit: type=1400 audit(2000000209.340:854): avc: denied { getopt } for pid=11645 comm="syz.3.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 517.432559][ T977] usb 5-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 517.466156][ T977] usb 5-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 517.761073][ T977] usb 5-1: Manufacturer: syz [ 517.770143][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.788838][ T977] usb 5-1: config 0 descriptor?? [ 517.807817][ T977] hub 5-1:0.52: bad descriptor, ignoring hub [ 517.815399][ T977] hub 5-1:0.52: probe with driver hub failed with error -5 [ 517.964440][T11661] netlink: 'syz.1.1444': attribute type 10 has an invalid length. [ 517.972821][T11661] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1444'. [ 517.982352][T11661] bridge0: port 3(veth0_vlan) entered blocking state [ 517.989216][T11661] bridge0: port 3(veth0_vlan) entered disabled state [ 518.001683][T11661] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 518.375588][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 518.468989][ T977] usb 5-1: Can not set alternate setting to 1, error: -71 [ 518.606540][ T977] synaptics_usb 5-1:0.52: probe with driver synaptics_usb failed with error -71 [ 518.924677][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 518.931625][ T977] usb 5-1: USB disconnect, device number 19 [ 519.364022][T11671] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1447'. [ 519.373662][T11671] 8021q: VLANs not supported on ip6tnl0 [ 519.415688][ T30] audit: type=1400 audit(2000000211.490:855): avc: denied { setopt } for pid=11672 comm="syz.1.1448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 519.451029][T11676] erspan1: entered allmulticast mode [ 520.001168][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.361281][ T30] audit: type=1400 audit(2000000212.440:856): avc: denied { name_bind } for pid=11685 comm="syz.1.1451" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 520.865387][T11700] fuse: Unknown parameter '01777777777777777777777' [ 520.957643][T11709] netlink: 'syz.2.1456': attribute type 1 has an invalid length. [ 520.980777][T11709] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1456'. [ 521.010544][T11709] NCSI netlink: No device for ifindex 0 [ 521.051096][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.187317][ T5927] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 521.245662][T11723] 8021q: adding VLAN 0 to HW filter on device batadv9 [ 521.521308][T11723] team0: Port device batadv9 added [ 521.602923][ T5927] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 521.612661][ T5927] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 521.623831][ T5927] usb 5-1: config 0 has no interface number 0 [ 521.639065][ T5927] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 521.659511][ T5927] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 521.803161][T11731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.852318][ T5927] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 521.863006][ T5927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.871323][ T5927] usb 5-1: Product: syz [ 521.875507][ T5927] usb 5-1: Manufacturer: syz [ 521.881554][ T5927] usb 5-1: SerialNumber: syz [ 521.960629][ T5927] usb 5-1: config 0 descriptor?? [ 521.975401][T11731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.018482][T11703] sctp_transport_update_pmtu: 48 callbacks suppressed [ 522.018618][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.052396][T11728] 8021q: adding VLAN 0 to HW filter on device batadv10 [ 522.080226][T11728] team0: Port device batadv10 added [ 522.089504][T11731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.101158][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.147743][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.176616][T11735] netlink: 332 bytes leftover after parsing attributes in process `syz.1.1462'. [ 522.218001][T11735] netlink: 332 bytes leftover after parsing attributes in process `syz.1.1462'. [ 522.333626][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.373376][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.399590][ T30] audit: type=1400 audit(2000000214.470:857): avc: denied { bind } for pid=11734 comm="syz.1.1462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 522.421150][ T30] audit: type=1400 audit(2000000214.470:858): avc: denied { write } for pid=11734 comm="syz.1.1462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 522.447817][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.458969][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.470311][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.481450][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.491950][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.504821][T11703] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 522.517108][ T30] audit: type=1400 audit(2000000214.470:859): avc: denied { getopt } for pid=11734 comm="syz.1.1462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 522.736527][ T9] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 522.802279][T11728] net_ratelimit: 125 callbacks suppressed [ 522.802295][T11728] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.816548][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.910413][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 522.917169][ T9] usb 2-1: too many configurations: 155, using maximum allowed: 8 [ 522.929943][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 522.946042][ T9] usb 2-1: can't read configurations, error -61 [ 523.059312][T11720] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.071437][T11720] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.169309][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.172810][ T9] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 523.495882][T11720] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.581902][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 523.606152][ T9] usb 2-1: too many configurations: 155, using maximum allowed: 8 [ 523.624607][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 523.634337][ T9] usb 2-1: can't read configurations, error -61 [ 523.648738][ T9] usb usb2-port1: attempt power cycle [ 523.805381][ T5927] usb 5-1: USB disconnect, device number 20 [ 524.036799][ T9] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 524.073713][T11758] fuse: Unknown parameter 'f' [ 524.090659][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 524.097512][ T9] usb 2-1: too many configurations: 155, using maximum allowed: 8 [ 524.116403][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 524.134622][ T9] usb 2-1: can't read configurations, error -61 [ 524.187888][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.779938][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 524.811228][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 524.821679][ T9] usb 2-1: too many configurations: 155, using maximum allowed: 8 [ 524.843913][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 524.866552][ T9] usb 2-1: can't read configurations, error -61 [ 524.873626][ T9] usb usb2-port1: unable to enumerate USB device [ 525.214097][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.725994][T11769] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1471'. [ 525.735071][T11769] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1471'. [ 526.428887][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.431831][T11779] netlink: 'syz.3.1474': attribute type 10 has an invalid length. [ 526.444922][T11779] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1474'. [ 526.454434][T11779] bridge0: port 3(veth0_vlan) entered blocking state [ 526.461335][T11779] bridge0: port 3(veth0_vlan) entered disabled state [ 526.473347][T11779] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 527.080737][T11785] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 527.087387][T11785] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 527.396050][T11785] vhci_hcd vhci_hcd.0: Device attached [ 527.421058][T11790] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(7) [ 527.427583][T11790] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 527.437771][T11790] vhci_hcd vhci_hcd.0: Device attached [ 527.627516][T11790] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 527.685424][T11785] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(6) [ 527.691959][T11785] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 527.711367][T11785] vhci_hcd vhci_hcd.0: Device attached [ 527.898156][ T5927] usb 41-1: new high-speed USB device number 2 using vhci_hcd [ 528.126096][T11796] vhci_hcd: connection closed [ 528.130516][T11787] vhci_hcd: connection closed [ 528.135476][ T36] vhci_hcd: stop threads [ 528.153452][ T36] vhci_hcd: release socket [ 528.163166][ T36] vhci_hcd: disconnect device [ 528.168184][ T36] vhci_hcd: stop threads [ 528.172869][T11791] vhci_hcd: connection closed [ 528.173628][ T36] vhci_hcd: release socket [ 528.191441][ T36] vhci_hcd: disconnect device [ 528.196400][ T36] vhci_hcd: stop threads [ 528.205188][ T36] vhci_hcd: release socket [ 528.224649][ T36] vhci_hcd: disconnect device [ 528.232834][ T5927] usb 41-1: enqueue for inactive port 0 [ 528.340103][ T5927] vhci_hcd: vhci_device speed not set [ 528.490227][ T5882] net_ratelimit: 3 callbacks suppressed [ 528.490241][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.468381][T11826] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1016 sclass=netlink_route_socket pid=11826 comm=syz.1.1487 [ 529.609549][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.628711][ T30] audit: type=1400 audit(2000000221.700:860): avc: denied { map } for pid=11824 comm="syz.4.1488" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 529.751366][ T30] audit: type=1400 audit(2000000221.730:861): avc: denied { execute } for pid=11824 comm="syz.4.1488" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 529.775268][ C0] vkms_vblank_simulate: vblank timer overrun [ 530.410349][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.650632][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.736823][ T2964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.745696][ T977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.770098][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.920352][ T5882] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 531.655875][T11857] input: syz1 as /devices/virtual/input/input21 [ 531.756045][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 531.767026][ T5882] usb 2-1: config 234 has an invalid interface number: 137 but max is 0 [ 531.957434][ T5882] usb 2-1: config 234 has no interface number 0 [ 531.978869][ T5882] usb 2-1: config 234 interface 137 altsetting 234 has an invalid descriptor for endpoint zero, skipping [ 532.360138][ T5882] usb 2-1: config 234 interface 137 altsetting 234 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 532.404150][ T5882] usb 2-1: config 234 interface 137 altsetting 234 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 532.468066][ T5882] usb 2-1: config 234 interface 137 altsetting 234 has an invalid descriptor for endpoint zero, skipping [ 532.497562][ T5882] usb 2-1: config 234 interface 137 has no altsetting 0 [ 532.528203][T11880] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.539030][ T5882] usb 2-1: New USB device found, idVendor=0c26, idProduct=000b, bcdDevice=27.98 [ 532.557663][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.597440][ T5882] usb 2-1: Product: ⽙︷琒熴᪀奃ⳳ苕﯏퇇탃芁範鯕팺맰ꍭ蓤赉輘Ὄ廃푷檗굞滆碼⎔㶱ꀪ咤凞釘湂짱垒t쵁ᰦᖒ〺灺橐ཛ뮔竈ȝ䐃ヶ쯬應ꐌ괈赸넑냜ﳐ軰듵툶㞦頚虸它ꯓ噎뺽뛤圸쮑챙昷늂᎝⽡ᇓ呖饕쭐贱菝ᜅ殭㧭ꀓ鷣㻝츩㡒휛⡋ [ 532.729904][ T5882] usb 2-1: Manufacturer:  [ 532.739082][ T5882] usb 2-1: SerialNumber: 윻숆嵲ዠ熳覆潂䅝罇Ҳ褈샛㦘ⵦ䣵쀢ᨤﮘ륰货ᆼ⽵䱓珦ᚮ㉯菿檠褚괉댙﨨ᓀ瓴틾倻 [ 532.895295][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.185613][T11888] FAULT_INJECTION: forcing a failure. [ 533.185613][T11888] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.198748][T11888] CPU: 0 UID: 0 PID: 11888 Comm: syz.2.1500 Not tainted syzkaller #0 PREEMPT(full) [ 533.198763][T11888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 533.198769][T11888] Call Trace: [ 533.198773][T11888] [ 533.198778][T11888] dump_stack_lvl+0x16c/0x1f0 [ 533.198798][T11888] should_fail_ex+0x512/0x640 [ 533.198813][T11888] _copy_from_user+0x2e/0xd0 [ 533.198827][T11888] sg_write+0x76d/0xe10 [ 533.198844][T11888] ? __pfx_sg_write+0x10/0x10 [ 533.198858][T11888] ? __pfx__kstrtoull+0x10/0x10 [ 533.198887][T11888] ? bpf_lsm_file_permission+0x9/0x10 [ 533.198898][T11888] ? security_file_permission+0x71/0x210 [ 533.198911][T11888] ? rw_verify_area+0xcf/0x6c0 [ 533.198928][T11888] ? __pfx_sg_write+0x10/0x10 [ 533.198941][T11888] vfs_writev+0x5df/0xde0 [ 533.198960][T11888] ? __pfx_vfs_writev+0x10/0x10 [ 533.198985][T11888] ? __fget_files+0x20e/0x3c0 [ 533.198995][T11888] ? __fget_files+0x110/0x3c0 [ 533.199007][T11888] ? do_writev+0x132/0x340 [ 533.199022][T11888] do_writev+0x132/0x340 [ 533.199037][T11888] ? __pfx_do_writev+0x10/0x10 [ 533.199053][T11888] ? fput+0x9b/0xd0 [ 533.199067][T11888] do_syscall_64+0xcd/0xfa0 [ 533.199084][T11888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.199095][T11888] RIP: 0033:0x7f8ca718efc9 [ 533.199109][T11888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 533.199120][T11888] RSP: 002b:00007f8ca80d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 533.199130][T11888] RAX: ffffffffffffffda RBX: 00007f8ca73e6090 RCX: 00007f8ca718efc9 [ 533.199137][T11888] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000004 [ 533.199142][T11888] RBP: 00007f8ca80d5090 R08: 0000000000000000 R09: 0000000000000000 [ 533.199148][T11888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.199154][T11888] R13: 00007f8ca73e6128 R14: 00007f8ca73e6090 R15: 00007ffe384cd2e8 [ 533.199167][T11888] [ 533.393831][ C0] vkms_vblank_simulate: vblank timer overrun [ 533.454291][ T5882] usb 2-1: can't set config #234, error -71 [ 533.465919][ T5882] usb 2-1: USB disconnect, device number 37 [ 533.684594][ T30] audit: type=1400 audit(2000000225.760:862): avc: denied { write } for pid=11897 comm="syz.4.1503" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 533.709670][T11902] block nbd0: server does not support multiple connections per device. [ 533.734767][T11902] block nbd0: shutting down sockets [ 533.813775][T11913] Bluetooth: hci5: Frame reassembly failed (-84) [ 533.959618][ T2964] Bluetooth: hci5: Frame reassembly failed (-84) [ 534.330366][ T5882] net_ratelimit: 1 callbacks suppressed [ 534.330380][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.730387][ T9] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 534.900780][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 534.914782][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 534.926171][ T9] usb 2-1: config 4 has an invalid interface number: 236 but max is 0 [ 534.943205][ T9] usb 2-1: config 4 has no interface number 0 [ 534.949494][ T9] usb 2-1: config 4 interface 236 has no altsetting 0 [ 534.962164][ T9] usb 2-1: New USB device found, idVendor=0bda, idProduct=0139, bcdDevice= 6.7c [ 534.994761][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.015149][ T9] usb 2-1: Product: syz [ 535.019314][ T9] usb 2-1: Manufacturer: syz [ 535.026931][ T9] usb 2-1: SerialNumber: syz [ 535.238184][ T9] rtsx_usb 2-1:4.236: probe with driver rtsx_usb failed with error -22 [ 535.274373][T11949] 8021q: adding VLAN 0 to HW filter on device batadv10 [ 535.283860][T11949] team0: Port device batadv10 added [ 535.306525][T11949] sctp_transport_update_pmtu: 48 callbacks suppressed [ 535.306540][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.324016][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.334565][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.345131][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.367021][ T9] usb 2-1: USB disconnect, device number 38 [ 535.375610][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.387660][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.398479][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.409238][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.420032][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.430916][T11949] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 535.443001][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.832278][T11955] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1515'. [ 535.929917][ T5136] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 536.177600][ T2964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.188521][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.250779][ T5882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.326241][ T30] audit: type=1326 audit(2000000228.400:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 536.421283][T11969] bridge0: port 1(bridge_slave_0) entered disabled state [ 536.456437][T11970] netlink: 'syz.4.1518': attribute type 16 has an invalid length. [ 536.464715][T11970] netlink: 'syz.4.1518': attribute type 17 has an invalid length. [ 536.476913][T11969] bridge0: port 2(bridge_slave_1) entered disabled state [ 536.510442][ T80] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.520146][ T30] audit: type=1326 audit(2000000228.430:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 536.543809][ T30] audit: type=1326 audit(2000000228.430:865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 536.568703][ T30] audit: type=1326 audit(2000000228.430:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 536.799936][ T5882] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 536.833091][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 536.833475][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 536.833997][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 536.834341][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 536.956284][ T30] audit: type=1326 audit(2000000228.430:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 536.979645][ C0] vkms_vblank_simulate: vblank timer overrun [ 537.037550][ T30] audit: type=1326 audit(2000000228.430:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 537.060878][ C0] vkms_vblank_simulate: vblank timer overrun [ 539.339838][ C1] net_ratelimit: 16039 callbacks suppressed [ 539.339855][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.357890][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.370031][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.382165][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.394193][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.406329][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.418352][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.430460][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.442504][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 539.454633][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.349781][ C1] net_ratelimit: 33884 callbacks suppressed [ 544.349798][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.367831][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 544.379924][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.391963][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.404083][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 544.416102][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.428118][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.440246][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 544.452266][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 544.464279][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.360133][ C1] net_ratelimit: 25118 callbacks suppressed [ 549.360146][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.378200][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 549.390344][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.402941][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.415216][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 549.427497][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.440089][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.452474][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 549.465218][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 549.477805][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 550.247089][ T5933] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 551.595684][ T30] audit: type=1326 audit(2000000228.430:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 551.910036][ T30] audit: type=1326 audit(2000000228.430:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 552.200022][ T30] audit: type=1326 audit(2000000228.430:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 554.369942][ C1] net_ratelimit: 15011 callbacks suppressed [ 554.369955][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.390983][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 554.404589][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.418878][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.432240][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 554.445678][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.462337][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.478715][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 554.491704][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 554.504573][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 557.942576][ T30] audit: type=1326 audit(2000000228.430:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 558.280983][ T30] audit: type=1326 audit(2000000228.430:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=313 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 558.875932][ T5933] usb 5-1: device descriptor read/64, error -110 [ 558.982187][ T30] audit: type=1326 audit(2000000228.430:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 559.380058][ C1] net_ratelimit: 13784 callbacks suppressed [ 559.380077][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.400677][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.413787][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 559.427530][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.451137][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.470664][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 559.486338][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.502080][ C1] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.502949][ T30] audit: type=1326 audit(2000000228.430:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 559.523235][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 559.560544][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 559.804008][ T5933] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 560.010164][ T30] audit: type=1326 audit(2000000228.430:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 560.184674][ T5933] usb 5-1: device descriptor read/64, error -32 [ 560.230412][ T30] audit: type=1326 audit(2000000228.430:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 560.327011][ T5933] usb usb5-port1: attempt power cycle [ 560.486065][ T30] audit: type=1326 audit(2000000228.430:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=154 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 561.214589][ T30] audit: type=1326 audit(2000000228.430:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e48d8efc9 code=0x7ffc0000 [ 561.528020][ T30] audit: type=1326 audit(2000000228.430:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4e48d8d810 code=0x7ffc0000 [ 561.727251][ T5813] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 561.737621][ T5813] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 561.747374][ T5813] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 561.758198][ T5813] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 561.770578][ T5813] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 561.811962][ T30] audit: type=1326 audit(2000000228.430:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11967 comm="syz.1.1519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4e48d8ebcb code=0x7ffc0000 [ 561.906191][ T5136] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 561.927071][ T5136] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 561.940440][ T5136] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 561.952045][ T5136] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 561.980039][ T5136] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 562.136765][ T5813] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 562.147037][ T5813] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 562.162656][ T5813] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 562.195808][ T5813] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 562.209978][ T5813] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 562.426243][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.440042][ T1295] ================================================================== [ 562.453771][ T1295] BUG: KASAN: slab-use-after-free in tty_write_room+0x7d/0x90 [ 562.463861][ T1295] Read of size 8 at addr ffff88807a10e020 by task aoe_tx0/1295 [ 562.472632][ T1295] [ 562.475054][ T1295] CPU: 0 UID: 0 PID: 1295 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT(full) [ 562.475078][ T1295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 562.475088][ T1295] Call Trace: [ 562.475095][ T1295] [ 562.475102][ T1295] dump_stack_lvl+0x116/0x1f0 [ 562.475133][ T1295] print_report+0xcd/0x630 [ 562.475153][ T1295] ? __virt_addr_valid+0x81/0x610 [ 562.475176][ T1295] ? __phys_addr+0xe8/0x180 [ 562.475199][ T1295] ? tty_write_room+0x7d/0x90 [ 562.475217][ T1295] kasan_report+0xe0/0x110 [ 562.475237][ T1295] ? tty_write_room+0x7d/0x90 [ 562.475258][ T1295] tty_write_room+0x7d/0x90 [ 562.475276][ T1295] handle_tx+0x14f/0x630 [ 562.475299][ T1295] ? _raw_spin_unlock_irqrestore+0x31/0x80 [ 562.475327][ T1295] dev_hard_start_xmit+0x97/0x740 [ 562.475349][ T1295] __dev_queue_xmit+0xa46/0x4490 [ 562.475370][ T1295] ? lockdep_hardirqs_on+0x7c/0x110 [ 562.475396][ T1295] ? finish_task_switch.isra.0+0x221/0xc10 [ 562.475419][ T1295] ? rcu_is_watching+0x12/0xc0 [ 562.475442][ T1295] ? __pfx___dev_queue_xmit+0x10/0x10 [ 562.475460][ T1295] ? __schedule+0x11a3/0x5de0 [ 562.475484][ T1295] ? __lock_acquire+0xb8a/0x1c90 [ 562.475518][ T1295] ? __lock_acquire+0xb8a/0x1c90 [ 562.475547][ T1295] ? do_raw_spin_lock+0x12c/0x2b0 [ 562.475571][ T1295] ? rcu_is_watching+0x12/0xc0 [ 562.475594][ T1295] tx+0xcc/0x190 [ 562.475612][ T1295] ? __pfx_tx+0x10/0x10 [ 562.475628][ T1295] kthread+0x1e4/0x3e0 [ 562.475654][ T1295] ? find_held_lock+0x2b/0x80 [ 562.475674][ T1295] ? __pfx_kthread+0x10/0x10 [ 562.475699][ T1295] ? __pfx_default_wake_function+0x10/0x10 [ 562.475721][ T1295] ? lockdep_hardirqs_on+0x7c/0x110 [ 562.475746][ T1295] ? __kthread_parkme+0x19e/0x250 [ 562.475770][ T1295] ? __pfx_kthread+0x10/0x10 [ 562.475795][ T1295] kthread+0x3c5/0x780 [ 562.475811][ T1295] ? __pfx_kthread+0x10/0x10 [ 562.475828][ T1295] ? rcu_is_watching+0x12/0xc0 [ 562.475846][ T1295] ? __pfx_kthread+0x10/0x10 [ 562.475862][ T1295] ret_from_fork+0x675/0x7d0 [ 562.475877][ T1295] ? __pfx_kthread+0x10/0x10 [ 562.475893][ T1295] ret_from_fork_asm+0x1a/0x30 [ 562.475923][ T1295] [ 562.475929][ T1295] [ 562.710257][ T1295] Allocated by task 11819: [ 562.714702][ T1295] kasan_save_stack+0x33/0x60 [ 562.719771][ T1295] kasan_save_track+0x14/0x30 [ 562.724558][ T1295] __kasan_kmalloc+0xaa/0xb0 [ 562.729962][ T1295] alloc_tty_struct+0x96/0x8c0 [ 562.734754][ T1295] tty_init_dev.part.0+0x1e/0x500 [ 562.740050][ T1295] tty_open+0xa4f/0xf90 [ 562.746395][ T1295] chrdev_open+0x234/0x6a0 [ 562.750812][ T1295] do_dentry_open+0x982/0x1530 [ 562.755679][ T1295] vfs_open+0x82/0x3f0 [ 562.759865][ T1295] path_openat+0x1de4/0x2cb0 [ 562.766471][ T1295] do_filp_open+0x20b/0x470 [ 562.771206][ T1295] do_sys_openat2+0x11b/0x1d0 [ 562.776157][ T1295] __x64_sys_openat+0x174/0x210 [ 562.781823][ T1295] do_syscall_64+0xcd/0xfa0 [ 562.786535][ T1295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.792784][ T1295] [ 562.795100][ T1295] Freed by task 5811: [ 562.800425][ T1295] kasan_save_stack+0x33/0x60 [ 562.805719][ T1295] kasan_save_track+0x14/0x30 [ 562.810817][ T1295] __kasan_save_free_info+0x3b/0x60 [ 562.817982][ T1295] __kasan_slab_free+0x5f/0x80 [ 562.824692][ T1295] kfree+0x2b8/0x6d0 [ 562.829543][ T1295] process_one_work+0x9cf/0x1b70 [ 562.834761][ T1295] worker_thread+0x6c8/0xf10 [ 562.840239][ T1295] kthread+0x3c5/0x780 [ 562.844408][ T1295] ret_from_fork+0x675/0x7d0 [ 562.850664][ T1295] ret_from_fork_asm+0x1a/0x30 [ 562.856310][ T1295] [ 562.860545][ T1295] Last potentially related work creation: [ 562.867692][ T1295] kasan_save_stack+0x33/0x60 [ 562.874578][ T1295] kasan_record_aux_stack+0xa7/0xc0 [ 562.880241][ T1295] insert_work+0x36/0x230 [ 562.885016][ T1295] __queue_work+0x97e/0x1160 [ 562.890428][ T1295] queue_work_on+0x1a4/0x1f0 [ 562.895117][ T1295] release_tty+0x4de/0x5d0 [ 562.902048][ T1295] tty_release_struct+0xb7/0xe0 [ 562.909552][ T1295] tty_release+0xe2d/0x1430 [ 562.914422][ T1295] __fput+0x402/0xb70 [ 562.918596][ T1295] task_work_run+0x150/0x240 [ 562.923205][ T1295] do_exit+0x86f/0x2bf0 [ 562.929020][ T1295] do_group_exit+0xd3/0x2a0 [ 562.933646][ T1295] get_signal+0x2671/0x26d0 [ 562.938254][ T1295] arch_do_signal_or_restart+0x8f/0x7c0 [ 562.943834][ T1295] exit_to_user_mode_loop+0x85/0x130 [ 562.950012][ T1295] do_syscall_64+0x426/0xfa0 [ 562.955252][ T1295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.961775][ T1295] [ 562.964705][ T1295] The buggy address belongs to the object at ffff88807a10e000 [ 562.964705][ T1295] which belongs to the cache kmalloc-cg-2k of size 2048 [ 562.981109][ T1295] The buggy address is located 32 bytes inside of [ 562.981109][ T1295] freed 2048-byte region [ffff88807a10e000, ffff88807a10e800) [ 562.997017][ T1295] [ 563.000156][ T1295] The buggy address belongs to the physical page: [ 563.007173][ T1295] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807a10d000 pfn:0x7a108 [ 563.018029][ T1295] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 563.026800][ T1295] memcg:ffff88807b5c0a01 [ 563.031086][ T1295] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 563.040810][ T1295] page_type: f5(slab) [ 563.044899][ T1295] raw: 00fff00000000240 ffff88813ffb03c0 ffffea0000a27010 ffffea0001bee610 [ 563.053757][ T1295] raw: ffff88807a10d000 0000000000080002 00000000f5000000 ffff88807b5c0a01 [ 563.065676][ T1295] head: 00fff00000000240 ffff88813ffb03c0 ffffea0000a27010 ffffea0001bee610 [ 563.074983][ T1295] head: ffff88807a10d000 0000000000080002 00000000f5000000 ffff88807b5c0a01 [ 563.087696][ T1295] head: 00fff00000000003 ffffea0001e84201 00000000ffffffff 00000000ffffffff [ 563.101265][ T1295] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 563.113627][ T1295] page dumped because: kasan: bad access detected [ 563.121407][ T1295] page_owner tracks the page as allocated [ 563.128019][ T1295] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5810, tgid 5810 (syz-executor), ts 207936955532, free_ts 207928139259 [ 563.155211][ T1295] post_alloc_hook+0x1c0/0x230 [ 563.160453][ T1295] get_page_from_freelist+0x10a3/0x3a30 [ 563.167518][ T1295] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 563.173457][ T1295] alloc_pages_mpol+0x1fb/0x550 [ 563.180444][ T1295] new_slab+0x24a/0x360 [ 563.185103][ T1295] ___slab_alloc+0xdae/0x1a60 [ 563.191813][ T1295] __slab_alloc.constprop.0+0x63/0x110 [ 563.197631][ T1295] __kvmalloc_node_noprof+0x5aa/0x9c0 [ 563.203185][ T1295] alloc_fdtable+0x110/0x2d0 [ 563.207874][ T1295] dup_fd+0x83b/0xb90 [ 563.212038][ T1295] copy_process+0x2312/0x76a0 [ 563.216825][ T1295] kernel_clone+0xfc/0x930 [ 563.221265][ T1295] __do_sys_clone+0xce/0x120 [ 563.226075][ T1295] do_syscall_64+0xcd/0xfa0 [ 563.230812][ T1295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.236939][ T1295] page last free pid 5810 tgid 5810 stack trace: [ 563.243378][ T1295] __free_frozen_pages+0x7df/0x1160 [ 563.249288][ T1295] __folio_put+0x329/0x450 [ 563.254229][ T1295] page_to_skb+0xa88/0xcc0 [ 563.258683][ T1295] receive_buf+0x789/0x4510 [ 563.263453][ T1295] virtnet_poll+0x153c/0x3e10 [ 563.268138][ T1295] __napi_poll.constprop.0+0xba/0x550 [ 563.273560][ T1295] net_rx_action+0x97f/0xef0 [ 563.278164][ T1295] handle_softirqs+0x219/0x8e0 [ 563.283201][ T1295] __irq_exit_rcu+0x109/0x170 [ 563.287978][ T1295] irq_exit_rcu+0x9/0x30 [ 563.293397][ T1295] common_interrupt+0xbf/0xe0 [ 563.298618][ T1295] asm_common_interrupt+0x26/0x40 [ 563.304086][ T1295] [ 563.306825][ T1295] Memory state around the buggy address: [ 563.312891][ T1295] ffff88807a10df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 563.322091][ T1295] ffff88807a10df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 563.331736][ T1295] >ffff88807a10e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 563.340585][ T1295] ^ [ 563.346900][ T1295] ffff88807a10e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 563.355670][ T1295] ffff88807a10e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 563.368340][ T1295] ================================================================== [ 563.379825][ T1295] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 563.387751][ T1295] CPU: 0 UID: 0 PID: 1295 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT(full) [ 563.397700][ T1295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 563.408555][ T1295] Call Trace: [ 563.411930][ T1295] [ 563.414949][ T1295] dump_stack_lvl+0x3d/0x1f0 [ 563.420344][ T1295] vpanic+0x640/0x6f0 [ 563.424645][ T1295] panic+0xca/0xd0 [ 563.429463][ T1295] ? __pfx_panic+0x10/0x10 [ 563.435192][ T1295] ? check_panic_on_warn+0x1f/0xb0 [ 563.441306][ T1295] check_panic_on_warn+0xab/0xb0 [ 563.446519][ T1295] end_report+0x107/0x170 [ 563.451303][ T1295] kasan_report+0xee/0x110 [ 563.455763][ T1295] ? tty_write_room+0x7d/0x90 [ 563.462097][ T1295] tty_write_room+0x7d/0x90 [ 563.466727][ T1295] handle_tx+0x14f/0x630 [ 563.471433][ T1295] ? _raw_spin_unlock_irqrestore+0x31/0x80 [ 563.478519][ T1295] dev_hard_start_xmit+0x97/0x740 [ 563.484454][ T1295] __dev_queue_xmit+0xa46/0x4490 [ 563.490543][ T1295] ? lockdep_hardirqs_on+0x7c/0x110 [ 563.496283][ T1295] ? finish_task_switch.isra.0+0x221/0xc10 [ 563.502784][ T1295] ? rcu_is_watching+0x12/0xc0 [ 563.507685][ T1295] ? __pfx___dev_queue_xmit+0x10/0x10 [ 563.513075][ T1295] ? __schedule+0x11a3/0x5de0 [ 563.518029][ T1295] ? __lock_acquire+0xb8a/0x1c90 [ 563.525252][ T1295] ? __lock_acquire+0xb8a/0x1c90 [ 563.530744][ T1295] ? do_raw_spin_lock+0x12c/0x2b0 [ 563.535989][ T1295] ? rcu_is_watching+0x12/0xc0 [ 563.540887][ T1295] tx+0xcc/0x190 [ 563.544531][ T1295] ? __pfx_tx+0x10/0x10 [ 563.552459][ T1295] kthread+0x1e4/0x3e0 [ 563.558218][ T1295] ? find_held_lock+0x2b/0x80 [ 563.563009][ T1295] ? __pfx_kthread+0x10/0x10 [ 563.568138][ T1295] ? __pfx_default_wake_function+0x10/0x10 [ 563.574320][ T1295] ? lockdep_hardirqs_on+0x7c/0x110 [ 563.579805][ T1295] ? __kthread_parkme+0x19e/0x250 [ 563.585212][ T1295] ? __pfx_kthread+0x10/0x10 [ 563.590075][ T1295] kthread+0x3c5/0x780 [ 563.594350][ T1295] ? __pfx_kthread+0x10/0x10 [ 563.599153][ T1295] ? rcu_is_watching+0x12/0xc0 [ 563.603939][ T1295] ? __pfx_kthread+0x10/0x10 [ 563.608637][ T1295] ret_from_fork+0x675/0x7d0 [ 563.613247][ T1295] ? __pfx_kthread+0x10/0x10 [ 563.617851][ T1295] ret_from_fork_asm+0x1a/0x30 [ 563.622633][ T1295] [ 563.625964][ T1295] Kernel Offset: disabled [ 563.630450][ T1295] Rebooting in 86400 seconds..