last executing test programs: 8m40.627226756s ago: executing program 0 (id=461): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000080)="1c0000006d0081044e81f782db1f4cb9041c1d08", 0x14}], 0x1}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000760091"], 0xfe33) (fail_nth: 1) 8m40.594344619s ago: executing program 0 (id=462): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfffffffffffffffb}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x3) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getpgid(0x0) mount$9p_unix(&(0x7f0000002600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000003600)='.\x00', &(0x7f0000003640), 0x2000000, &(0x7f0000000d00)=ANY=[@ANYBLOB="7472616e733d756e69782c00af0b08c0e8bf5d5ec64a50fc43fd9b18a407300e850b"]) 8m37.657939972s ago: executing program 0 (id=469): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, &(0x7f0000000100)=0x6) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x8b, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r2, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a100000"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r2, 0x1000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000240)={'wg2\x00'}) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) io_setup(0x7, &(0x7f0000000280)=0x0) r5 = openat$sysfs(0xffffff9c, 0x0, 0x42, 0x0) io_submit(r4, 0x1, &(0x7f0000000140)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x3, 0x4, r3, &(0x7f0000000880)="58ec41974751846de534260b896b0427327f3826e4d1f260f13c4e29f3f44a8b093bb03672bab315e6b50c9a5d818286cfc40f723c0a30bbe31f2ec8065819afad9b6293e96a96e4678f5900f8987c6288b89cbd5653acdaa10c6f41398e20675b9c37b1b47258ecc6a599c8331e155d2cabeecfb859f50df44fa0461def4be42ce0ebef8fda07465bb530b33f188b4ce4ba6116041383b18b6edd4ed9279d22202e6df02e2f2bd591f8ede88a823aa7646b7aabca9471c45bdac610f8b5871cd398ed567a493c30feadb36c601c3fb844fe5d8ca2b6b50e4679ab7c66875f1790075bbeee", 0xe5, 0x8, 0x0, 0x2, r5}]) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r5}, 0x4) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r1, 0x0, 0x0) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x3, 0x4) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000500)="48000000140081fb7059ae08060c040002ff0f03900000000000000400006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a02000000461eb886a5e54f8f", 0x48}], 0x1}, 0x0) keyctl$restrict_keyring(0xa, r6, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='ed:cb2e') setuid(0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r8, r8, 0x0, 0x200000) 8m34.97162881s ago: executing program 0 (id=477): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2, 0x2}, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x23f) setuid(0xee01) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r1, &(0x7f0000000100), 0x0, 0x4c040) close(r1) r2 = syz_open_dev$MSR(&(0x7f0000000340), 0x1, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x10) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020300090a0000000000000000000200030006000000000002000000ac1414bb00000000000000000200010000000000fd000504feffff4b030005000000000002"], 0x50}}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) getgroups(0xfffffffffffffdb2, 0xfffffffffffffffe) memfd_create(&(0x7f0000000b00)='\xa3\x9fnt\xb4dR\x04`5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17m\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf1\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xa8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \xdd\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x18v\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9el\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a\xddj\xf8\x03\xedkG\x166:\t\x8cv!\xddf\xb3-\x02#2.v\x8b\x8c3\xb1ja\xde\x1dg\xe6\xccnxR\xe1L^\xc4\xd6m\x00\xb9s\xccJ1\xbf\\=\xdf\xc4\xf9 *\xdb\xc7\n\f\x80\x0fS0\xc1R)\xa4\x04\x8ez\x87\xf81N\x9b\x9a\xd2\n\xc2:e7\x9aM\xb7\"\x9fx|\x94U\x97\x84\r\xd9\x1eM\xfa\xff]wDw\n-\xc2_63k\x93\xed\xd0[\x9a\tPej\x05\xbeA\x1b3\xdf\x14\xdf\'&\x93\x90\xacq\xcc\xda_\xa7\xff\x17#E+*\x8b\\\xce\x91\xffzh\xdaK?\xd4c\xb9\xc5,\xd6\xee\x9c\x9a\xed\x03d\xbb\xf0<*\x88yF\x05\xc6MmJ%C\xdd\x06\xb3h\xae\x9a\xb0\xfa\xd7\xb0HwN\xc3\x9f\x8c\xd1\xa9\\\x187\xc3T\xd1\x11n\xb3Sr\xb9\xc1L\xe3e(\x8b\x19Wj\xf2\x0f\xb0\xb3\xdd\xfcc\xf8\xd0\xe3\xbf\b\xd7l\x87\x90%\xf1\xa4=>]\xa8\xec{\xa8\x92\x9d\x01x\x19\x1d\xcej*\xc2ww\x8d0<\x91%\xc2\x06p\x00\xd13g\xd7\x83\xc2W\xfc+\\\xba\xd9\x83\xdbG\xe1\xca\xa4\xd5P\x02\xe3\x00\x00\x00\x00\x00\x00!\x86\xacD\xe34L>\x16\xfc\x9f\xf3\xc2\xbb*#m\x03u>E\xf1\xae\xcc\x86/\xf6dj\xde\xbb\xe0\xd0\xdb-\xb5,\'c\xc1=\xcf\x9e4T^\x94~\a\xd3\xfeym\f\xc4c\x87d(\xf2l\xea\xa4\xc1\x06z~\xef\xd8\x1b\x80\xccS\x16\xc5\xf7y\x8bg-d}\xe3_bg\xb1\xbb\xe3\x1d\x14\xf3\xa4\xc7xS\xf0\n\xd1l\x1f\x8e\xbf\xee]\xc4I+-z\"q\xd5\xc5\xb4;\xcd\x93LtM\xb5\xb0\x12\n6\xbf`\x81\x0e\xf4HdJp\xfe\xe6\v\xf2\x1d\x9e\'\xca\x1fK6\x97&\xa5t\xb0\xd6y\xdb\x15\x95\x8c\x98\xf7\x8cD\xfd^?\x961b\x89x\x11\\e\xb4\xad\x8cO@\x8bU\x8aV\x86Y\x9f\xeaD\r\xaa\x1d2\xf9\x04\xd1\xdd~\xeb\xfc\xf9\x8775\xb7\x18\xbd$\xd4\x04\xa8\xc0\x8e=\xfe\xbday\x80c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\xf3\x00\xe8\x89[\x91B\xc2/u\xd9;\xbf\xc6\x88\x96\xbe\xa3wU\xb1\xdeN\xe6', 0x4) syz_emit_ethernet(0x4a, &(0x7f00000009c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6002000000140600fe8000000000000000000000000000bbfe8000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50d40b000078fffc829c95b7d04908db9dd2dbb179294352f1f0f76b4e0a46f76185b5ed4edad0a6c798e38906bc246dae6000e22d9eb488011f976d29083733b6ca6692052760efaf2dbca1a6edd4b51962130b2af3c25446346bc268ece168423fe59bf66d53561a08df8e3762173a9c376f49fc1e32258275aa5cd97aa6233c9b7e9d2a773f01ab1dbc613fd8bea443b105f437c07c98da83bc720273f6b3b7ceff5515d910336458bf3e7202061206500ab1fbd3158bdf2797282af6ab9ced1e4405c029c5553eef5ec921c7bf7d9cb468a2f9d9c79b919397029d0424a9645bea28"], 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x3000)=nil, 0x0, 0x8, 0x120052, 0xffffffffffffffff, 0x0) 8m34.039545089s ago: executing program 0 (id=480): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r1}, 0x70) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0xf0, 0x32, 0x205, 0x70bd2d, 0x25dfdbfc, {}, [{0xc9}]}, 0xf0}, 0x1, 0x0, 0x0, 0x85}, 0x8000) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40086602, &(0x7f0000000000)) fstat(r2, &(0x7f0000000340)) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_usb_disconnect(r3) 8m30.490981297s ago: executing program 0 (id=492): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000230000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fcffffff850000007b00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) prctl$PR_SET_PDEATHSIG(0x1, 0x31) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) r5 = getpgid(r1) capget(&(0x7f0000000040)={0x19980330, r5}, &(0x7f0000000280)={0x7f, 0x10001, 0x4, 0x64, 0xffff, 0xfff}) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000100)={{0x7000, 0xdddd1000, 0x0, 0x0, 0x8, 0x8, 0x0, 0x2, 0x80, 0x6, 0x9, 0x10}, {0x8080000, 0x0, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x100000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0xeeee8000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0xd, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80}, {0x8080000, 0x0, 0xa, 0x6, 0x5, 0x0, 0x3}, {0x80a0000, 0xdddd0000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xa, 0x26}, {0x80a0000}, {0xeeef0000}, 0xfdfcffdb, 0x0, 0x0, 0x28, 0xb, 0xf801, 0x0, [0x0, 0x0, 0x1]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x4000}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000030601020000000000000000010000000500010007e7ffff3ad37f840a7a9759a3578a1d8299db4a82f2bed3817d08230a21f5ac43c301cbc0d34b5da736747a38ed1aecf7eb174fe230d57e66e61806c41311cc60652128ae7e201d1a3762aa3f3b6c4209c0fe2f7509626e38113704d28f642a141987fc8e0d54a26231f392fb7602ac7904552d7769a7d335c65da99e4a561241f9c78525f5ff9a4944a053fc46622e66eaface1d0587a05ac75aee18002546954d4cfbc38b8a"], 0x1c}, 0x1, 0x0, 0x0, 0x8840}, 0x4000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)={0x1c, 0x0, 0x1, 0x70bd2a, 0x259fdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x20000084) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xd4, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x3, 0x1e}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x13a}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8c}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x36e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x35}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x15f4}], @key_params=[@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_SEQ={0x8, 0x4, "00e7bf29"}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}]}, @NL80211_ATTR_KEY={0x24, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x18, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_TYPE={0x8, 0x7, 0x1}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f1e41d4f557948f23b0f19104e"}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24010005}, 0x80) 8m15.242270205s ago: executing program 32 (id=492): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000230000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fcffffff850000007b00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) prctl$PR_SET_PDEATHSIG(0x1, 0x31) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) r5 = getpgid(r1) capget(&(0x7f0000000040)={0x19980330, r5}, &(0x7f0000000280)={0x7f, 0x10001, 0x4, 0x64, 0xffff, 0xfff}) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000100)={{0x7000, 0xdddd1000, 0x0, 0x0, 0x8, 0x8, 0x0, 0x2, 0x80, 0x6, 0x9, 0x10}, {0x8080000, 0x0, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x100000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0xeeee8000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0xd, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80}, {0x8080000, 0x0, 0xa, 0x6, 0x5, 0x0, 0x3}, {0x80a0000, 0xdddd0000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xa, 0x26}, {0x80a0000}, {0xeeef0000}, 0xfdfcffdb, 0x0, 0x0, 0x28, 0xb, 0xf801, 0x0, [0x0, 0x0, 0x1]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x4000}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000030601020000000000000000010000000500010007e7ffff3ad37f840a7a9759a3578a1d8299db4a82f2bed3817d08230a21f5ac43c301cbc0d34b5da736747a38ed1aecf7eb174fe230d57e66e61806c41311cc60652128ae7e201d1a3762aa3f3b6c4209c0fe2f7509626e38113704d28f642a141987fc8e0d54a26231f392fb7602ac7904552d7769a7d335c65da99e4a561241f9c78525f5ff9a4944a053fc46622e66eaface1d0587a05ac75aee18002546954d4cfbc38b8a"], 0x1c}, 0x1, 0x0, 0x0, 0x8840}, 0x4000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)={0x1c, 0x0, 0x1, 0x70bd2a, 0x259fdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x20000084) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xd4, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x3, 0x1e}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x13a}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8c}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x36e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x35}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x15f4}], @key_params=[@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_SEQ={0x8, 0x4, "00e7bf29"}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}]}, @NL80211_ATTR_KEY={0x24, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x18, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_TYPE={0x8, 0x7, 0x1}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "f1e41d4f557948f23b0f19104e"}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24010005}, 0x80) 5m38.320343078s ago: executing program 1 (id=1034): socket$nl_generic(0x10, 0x3, 0x10) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) rt_sigqueueinfo(r2, 0x40, &(0x7f0000000180)={0x3f, 0x3, 0x5}) r5 = socket$inet6(0xa, 0x2, 0x3a) openat$binfmt_register(0xffffff9c, &(0x7f0000000200), 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@ipv4_delroute={0x3c, 0x19, 0x901, 0x70bd29, 0x80, {0x2, 0x18, 0x10, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @SEG6_LOCAL_BPF={0xc, 0x8, 0x0, 0x1, @SEG6_LOCAL_BPF_PROG={0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) recvfrom$inet6(r5, 0x0, 0xfffffffffffffcaa, 0x123, 0x0, 0xffb6) r7 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x4, r0}) ioctl$DMA_BUF_SET_NAME_A(r8, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000140)=0x2) 5m37.384164324s ago: executing program 1 (id=1037): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 5m36.24530698s ago: executing program 1 (id=1041): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) write$cgroup_pid(r1, 0x0, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r2, 0x110, 0x2, 0x0, 0x5392f5b1) read$FUSE(r1, &(0x7f0000002540)={0x2020}, 0xfdef) 5m35.213097054s ago: executing program 1 (id=1044): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x7cce8c743ee810df}) read(r2, &(0x7f0000000840)=""/40, 0x28) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) 5m33.479066663s ago: executing program 1 (id=1049): syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x101000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) syz_open_dev$video(&(0x7f0000000040), 0x9, 0x0) syz_open_procfs$namespace(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000500), 0x8, 0x0) syz_io_uring_setup(0x2, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0x0, 0x304}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0xc8c9, 0x4002, 0x5e51, 0xfffffffffffffffe, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x2, 0x0, 0x5, 0x5}, 0x0, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565b, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0xf1ffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x8}]}}]}, 0x38}}, 0x0) 5m30.318988766s ago: executing program 1 (id=1058): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r3, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x2080401, 0x7, 0xf}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r4, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000280)={r3, 0x0, 0x0, 0x0, 0x0, [], [], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r6, &(0x7f00000001c0)={0x1d, r7}, 0x10) setsockopt$CAN_RAW_ERR_FILTER(r6, 0x65, 0x2, &(0x7f0000000180)=0x6, 0x4) r8 = socket(0x10, 0x3, 0x0) write(r8, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) r9 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r10 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xfff, 0x7}, 0x50) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r12}, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r10, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r10, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r13, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r10, 0xc06864ce, &(0x7f0000000200)={r14, 0x1, 0x800, 0x7, 0x0, [0x0], [0x0, 0x6], [0xa, 0x8, 0x10000, 0x3], [0x1019cd22, 0x0, 0xe4, 0x21d]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r9, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x81, 0x20203843, 0x3, [0x2, 0x0, r15], [0x800, 0x0, 0x9], [0x0, 0x0, 0x4]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000380)={r15}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r5}) r16 = syz_usb_connect(0x1, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="12012000f1048108cd060202d492002e618c81c44835d61c2600000109021b1901000000d40904150001da40df0009058202a89eba075de70400f56c37ff490bd5e33db94aca5950b1b6a7c41730c0076b72f2f04cdbc1d458e4"], 0x0) syz_usb_control_io$uac1(r16, 0x0, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) 5m14.958345063s ago: executing program 33 (id=1058): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r3, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x2080401, 0x7, 0xf}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r4, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000280)={r3, 0x0, 0x0, 0x0, 0x0, [], [], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r6, &(0x7f00000001c0)={0x1d, r7}, 0x10) setsockopt$CAN_RAW_ERR_FILTER(r6, 0x65, 0x2, &(0x7f0000000180)=0x6, 0x4) r8 = socket(0x10, 0x3, 0x0) write(r8, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) r9 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r10 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xfff, 0x7}, 0x50) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r12}, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r10, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r10, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r13, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r10, 0xc06864ce, &(0x7f0000000200)={r14, 0x1, 0x800, 0x7, 0x0, [0x0], [0x0, 0x6], [0xa, 0x8, 0x10000, 0x3], [0x1019cd22, 0x0, 0xe4, 0x21d]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r9, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x81, 0x20203843, 0x3, [0x2, 0x0, r15], [0x800, 0x0, 0x9], [0x0, 0x0, 0x4]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000380)={r15}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r5}) r16 = syz_usb_connect(0x1, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="12012000f1048108cd060202d492002e618c81c44835d61c2600000109021b1901000000d40904150001da40df0009058202a89eba075de70400f56c37ff490bd5e33db94aca5950b1b6a7c41730c0076b72f2f04cdbc1d458e4"], 0x0) syz_usb_control_io$uac1(r16, 0x0, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) 2m34.647253976s ago: executing program 3 (id=1604): r0 = socket(0x10, 0x3, 0x0) poll(0x0, 0x0, 0x3) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xc, 0x2031, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = socket(0x400000000010, 0x3, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0xa0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000300)=0x5f, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r4}, 0x8) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xf, 0xc, &(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYRES32, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x2a, &(0x7f0000001700)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}, @void, {@ipv4={0x800, @generic={{0x7, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @dev, {[@cipso={0x86, 0x6}]}}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='sched_switch\x00', r5}, 0x18) r6 = syz_open_dev$evdev(&(0x7f0000002f00), 0x5c, 0x82) ioctl$EVIOCGREP(r6, 0x80084503, &(0x7f0000002f40)=""/244) 2m33.593963163s ago: executing program 3 (id=1608): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f00000000c0)=0x1, 0xfffffffffffffd92) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) rt_sigaction(0x15, &(0x7f00000000c0)={0x0, 0xc0000002, 0x0}, 0x0, 0x8, &(0x7f0000000200)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x306) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = syz_clone(0x1022000, 0x0, 0xabb58d6d2e69f9ba, 0x0, 0x0, 0x0) r7 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000340)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r9, &(0x7f0000000080)=r6, 0x12) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[], 0x18) 2m32.959780898s ago: executing program 3 (id=1610): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x2f00, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="e3ff0000000000002400128009000100626f6e64000000001400028005001b00000000000500010006"], 0x44}}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000feffffff0000000000040000851000000200000085000000230000009500000000000000"], 0x0, 0xfffffffe, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r2 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) write$binfmt_elf64(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4602010103fcffffffffffffff03003e005666d37500010000000000004000000000000000df012000040000000000000003003800010007000200010003000000000000000300000000010100ff"], 0x509) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0), 0xea843, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000180)=0x4000000) ioctl$PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000280)=0x1005000) close(r2) r4 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c46"], 0x78) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req={0x78a7, 0x81, 0x3, 0x3}, 0x10) recvmmsg$unix(r5, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000003100)=""/4096, 0x1000}], 0x1}}], 0x1, 0x400122a2, 0x0) sendmmsg(r5, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) close(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0x40400, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0), 0x18001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2m29.839320141s ago: executing program 3 (id=1622): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x73, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 2m28.877776672s ago: executing program 3 (id=1623): syz_open_dev$vim2m(0x0, 0x800, 0x2) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) (async) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000340), 0x15) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x0, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x80c0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0xa, 0x3, 0x87) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20401, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000240)) (async) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) (async, rerun: 64) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io(r4, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000440)={0x20, 0xf}, 0x0, &(0x7f0000000540)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000580)={0x20, 0x0, 0x4, {0x0, 0x1}}, 0x0, &(0x7f0000000600)={0x40, 0x7, 0x2, 0x40}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000680)={0x40, 0xb, 0x2, "cd43"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000000700)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "069c"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000800)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0x8}}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) (async) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) (async) fstat(0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0xa39, 0x0, 0x0, &(0x7f0000000340)) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002"], 0x122}}, 0x0) 2m28.718102854s ago: executing program 3 (id=1624): openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',cache=mmap']) chmod(&(0x7f0000000140)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) pwritev2(r3, &(0x7f0000000900)=[{&(0x7f0000000500)="27bae4e328f3cefd78d60375855e4601aa9f68dd96953ab5370c6a3d2cc1ffcd47d2bc6cf814f6924eaf9bc30db121b3893913129639e7ee2bdd7f73c915927ef5619e4984", 0x45}], 0x1, 0x7, 0x5, 0x16) write$FUSE_POLL(r3, &(0x7f0000000380)={0x18, 0xfffffffffffffff5, 0x0, {0x1}}, 0xfdef) 2m13.640980311s ago: executing program 34 (id=1624): openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',cache=mmap']) chmod(&(0x7f0000000140)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) pwritev2(r3, &(0x7f0000000900)=[{&(0x7f0000000500)="27bae4e328f3cefd78d60375855e4601aa9f68dd96953ab5370c6a3d2cc1ffcd47d2bc6cf814f6924eaf9bc30db121b3893913129639e7ee2bdd7f73c915927ef5619e4984", 0x45}], 0x1, 0x7, 0x5, 0x16) write$FUSE_POLL(r3, &(0x7f0000000380)={0x18, 0xfffffffffffffff5, 0x0, {0x1}}, 0xfdef) 1m3.982888888s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 53.109181781s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 40.499143662s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 29.464979454s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 18.006953559s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 7.331220345s ago: executing program 2 (id=2075): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000780)={0x3, {{0xa, 0x4e23, 0x9, @mcast1, 0x8}}}, 0x90) syz_open_dev$dri(0x0, 0x1ff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x9, 0x0, 0x31}, 0x10) 7.133200112s ago: executing program 6 (id=2076): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(r0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) epoll_create1(0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) sched_setaffinity(0x0, 0xff02, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee3c0cb001829a8681ed391da1a71d8d", 0x63}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f1a0f9fff9e440b4", "881aae83544dfa6412f91b9057e3f415", "9dca4bb6", "9ecb592c6ee49fbd"}, 0x28) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x80000001}) socket$netlink(0x10, 0x3, 0x10) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000240)=""/50, 0x32}, {&(0x7f0000000280)=""/203, 0xcb}, {0x0}, {&(0x7f00000003c0)=""/235, 0xeb}, {&(0x7f00000004c0)=""/226, 0xe2}], 0x5) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x400000}, 0xc) r4 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r4, 0x40305652, &(0x7f0000000040)={0x1, 0x1, 0x6e, 0x0, 0xd, 0x80000000, 0x4001}) 6.989369533s ago: executing program 7 (id=1684): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="000000000e0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7ff}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x2, 0x8, 0x5, 0x7f, 0xb2c, 0x4, 0xffff, 0x710}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000004c0)={&(0x7f00007a3000/0x4000)=nil, &(0x7f0000514000/0x1000)=nil, &(0x7f00009af000/0x3000)=nil, &(0x7f0000651000/0x1000)=nil, &(0x7f00002e5000/0x3000)=nil, &(0x7f0000854000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000061e000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000001b000/0x3000)=nil, &(0x7f0000060000/0x1000)=nil, &(0x7f00000003c0)="0d4a66a18cb59d9da605b0162864a34035b8cc079d3a03ea7abce0d5b3d3611485146a1a21044a9b21a386f213c3657b0809d669e1d52cee547e78aee1ac5e7090d9d3de015971edfa53409430dba481b626934ffc805faae2f9c2deeb8fdf859f2eee8693dd8d197255559173cd6216dddc08557c4dfc30d2365a8520226e575cf8e920fde8a7bc858182cee470c842747543aaf11455d0baf142790cdd2bfda595e4113ecd03aef983019bb95f34721699e350c05f29f59777a9107809ecdecc7f73c589b713e504ad89ccb2ef2ed4befe508c862f113910b804d4a109e2e733bc5a976c241c1ba1b6eb80d6070f8653c456", 0xf3, r4}, 0x68) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x480, @loopback}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e21, @empty}}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400"], 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 5.167639405s ago: executing program 6 (id=2078): syz_usb_connect(0x6, 0xfffffffffffffc8e, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_emit_ethernet(0x32d, &(0x7f00000006c0)={@broadcast, @random="6487a2bed3d6", @void, {@ipv6={0x86dd, @tipc_packet={0xa, 0x6, "a4c205", 0x2f7, 0x6, 0xfe, @mcast1, @ipv4={'\x00', '\xff\xff', @broadcast}, {[@dstopts={0x2, 0xa, '\x00', [@hao={0xc9, 0x10, @rand_addr=' \x01\x00'}, @ra={0x5, 0x2, 0x7}, @hao={0xc9, 0x10, @mcast1}, @jumbo={0xc2, 0x4, 0x8000}, @jumbo={0xc2, 0x4, 0x9}, @calipso={0x7, 0x18, {0x1, 0x4, 0x4, 0x3, [0x3, 0x3052]}}, @padn={0x1, 0x1, [0x0]}, @generic={0x0, 0x2, "4c92"}]}, @hopopts={0xc, 0x3e, '\x00', [@enc_lim={0x4, 0x1, 0x5}, @generic={0x5, 0xe4, "d9000f16728605d91381d305112fb3994d789f45df227f81ade001dce70ae8f556a44af26abe6b1d8ff3edba2d218b938976feb388a150d7c03166f1913077ad5b340239ecebc657c6371b60d844d6e4f5b1898d3e115601979c4e52dd909db04c8196860e9800b05aa775ace4d2e5a243dc61429f5d1203c175e13ea301a3fc5711df04be4dafb0e72df72c9014fbd8b647cfb8b937214fc7dc8f45bac388eb1f2a9a2184f091c7a9fcd463912193356eb981a581a012ae0d1fb191c972be25dd0a500aa81f2e34317e4368b0ce209b329866e116154e3c916530da027e166cecb47d52"}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @generic={0x6, 0xa8, "ff78dfc57334952ea980ae9f6bb4ec8731c705595b813a8a268ff4f9c4a98ef965384e8a59ab6162c1b16ed76689780f01c68ecd52d4614df1489e738c61c89c8265bed90df389c2bcc75ee15fcc73781e1d0c2c7738a2589b11ec40c8a378479431921b8127fb21450059f9a43b75ae4627304fe970030dab4ad68568fbd53217b33a72ec97c6a565fff97cd937b4c9a12478d59f44ebf3f4fbe7191323b23f0a6d39e4000522fc"}, @generic={0x7, 0x41, "9df53412844cfd321b4df9ca2831b8a03e95e36063d66f61fd3a4bd4fdd9541eb4f454ef9eb24d0d8ac23a36b146ab3d35ee3876a9d65f2111c57375c87d59afa1"}]}, @hopopts={0x5e, 0x0, '\x00', [@jumbo]}, @fragment={0x3a, 0x0, 0x3, 0x1, 0x0, 0x1e, 0x64}, @dstopts={0x2, 0x3, '\x00', [@generic={0x3, 0x9, "e1d6f0f43e4a7ddeb3"}, @pad1, @jumbo={0xc2, 0x4, 0x3}, @padn={0x1, 0x1, [0x0]}, @jumbo={0xc2, 0x4, 0x5}]}, @dstopts={0x2e, 0x3, '\x00', [@ra={0x5, 0x2, 0x4d}, @ra={0x5, 0x2, 0x5}, @hao={0xc9, 0x10, @loopback}]}], @payload_mcast={{{{{{0x2f, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x3, 0x0, 0x3, 0x9, 0x2, 0x1, 0x4, 0x7, 0x0, 0x4e24, 0x4e23}, 0x3, 0x3}, 0x3, 0x4}}}, [0x0, 0x0, 0x0]}}}}}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000096971c4e031cb766020bcfdc00020001007063690011000200303030303a30303a31302e3000000000080003000000000000ffff00"], 0x38}}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000200)) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="1700000015006b05c84e21000ab16d6e230675f8020000", 0x17}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, 0xffffffffffffffff, 0x2000) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="280000004e000010cc000000000000000180e127d6fb000000822d0cfc0000000000000000000000ff7fffffffffd70e8cb3974479ee000000000636b6428b85551445fd5b3dc47e68ade701be286e7aa4613038a31f386ac23e87fadc61"], 0x10000) 5.167343283s ago: executing program 2 (id=2079): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB(r0, 0xc01c64ad, &(0x7f0000000140)={r2}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000440)={r2}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000001000000) 5.058887049s ago: executing program 2 (id=2081): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r1) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800001f", @ANYRES16=r2, @ANYBLOB="0900000000000000000002000000140001"], 0x28}}, 0x0) 4.939216529s ago: executing program 4 (id=2083): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x7, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) ptrace$ARCH_GET_GS(0x1e, r0, &(0x7f0000000200), 0x1004) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000080), 0x80) keyctl$invalidate(0x15, 0x0) r3 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, 0x0, &(0x7f0000000000)='encrypted\x00', 0x0, r3) io_uring_setup(0x330b, &(0x7f0000000640)={0x0, 0xffffffee, 0x1, 0x103fc, 0x14e}) socket$rds(0x15, 0x5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000380)='xprt_reserve\x00', 0xffffffffffffffff, 0x0, 0xfb2}, 0x18) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) iopl(0x3) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r4, 0x4004ae8b, &(0x7f0000000040)=ANY=[@ANYBLOB='\b']) r5 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x6, 0x4, 0x2, 0x47, @mcast1, @loopback, 0x1, 0x8, 0x3, 0x66}}) 4.938983958s ago: executing program 2 (id=2084): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000640)=0xd1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x3c, 0x0, 0x8, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x79ba}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x1}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x8090) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 3.909317475s ago: executing program 4 (id=2085): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001214010027bd7000fddbdf25080001000000000008004f000000000008004b001300000008000100ffffd7fd"], 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x810) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x1) r4 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000000)={0x3, 0xb, 0x0, "fbda6b21f1d7479797795318a9b4b19471c838f51ef5dfaee256e99c476c937d", 0x30323953}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r5}, 0x10) setrlimit(0x9, &(0x7f0000000000)={0x0, 0xfffffffffffffffe}) io_setup(0x2004, &(0x7f0000000680)) syz_emit_ethernet(0x46, &(0x7f0000000480)=ANY=[@ANYRES64=r0], 0x0) r6 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)=@deltclass={0x0, 0x29, 0x20, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xb, 0x2}, {0x6, 0xb}, {0xf, 0x5}}, [@tclass_kind_options=@c_qfq, @TCA_RATE={0x0, 0x5, {0xcb, 0x16}}, @tclass_kind_options=@c_prio, @tclass_kind_options=@c_tbf, @TCA_RATE={0x0, 0x5, {0xf8}}, @TCA_RATE={0x0, 0x5, {0xa0, 0xf6}}, @tclass_kind_options=@c_cake, @tclass_kind_options=@c_red, @tclass_kind_options=@c_skbprio, @TCA_RATE={0x0, 0x5, {0x40, 0x1}}]}, 0x74}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) 3.241036106s ago: executing program 4 (id=2086): r0 = socket(0x1a, 0x4, 0x6) syz_emit_ethernet(0x2a, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080600060500060400000180c2000000ac1414280180c2000000e0000002b0a30a7750a7f2327904"], 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) (async) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x88) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r2, &(0x7f0000000780), 0x0, 0x2, 0x0) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$inet6(0xa, 0x2, 0x0) (async) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, 0x0, &(0x7f00000001c0)=0xffffffffffffffb1) (async) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000940)) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000800)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000004c0)="b9ff030768441a8cb89e14f088a8", 0x0, 0x4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) (async) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) (async) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES16=r4, @ANYBLOB="31542cb47c0121642ab173295812c1354113e766f9f52048227f601f993e4a8ed29c849fab5beea4c991a8ae9af3d96e65e6782fcfa95d28fb85c74a868d07d775863db0dc7e688aa257ef3efdbc88f4d8b11166c770abc03dd8ab9a3ad27d2392125b83c6d411285a64c425fd5a3d53eaaf60c2eb8ecacde61c00b1f4414ca1785119590b2fc41f97", @ANYRES32=r9, @ANYRES32=r7], 0x3c}}, 0x40801) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0xff, 0x3}, 0x90) ioctl$SNDCTL_DSP_SETFMT(r6, 0xc0045005, &(0x7f0000000640)=0x8000) (async) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000200)={0x0, {{0xa, 0x4e23, 0xfffffffd, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}, 0xfffffe00}}}, 0x108) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newqdisc={0x44, 0x10, 0x1, 0x3, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x5, 0x2}, {0x0, 0xffea}, {0x6}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_RATE={0x6, 0x5, {0x4, 0x72}}, @TCA_RATE={0x6, 0x5, {0x7, 0xf}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x4000044) r10 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r10, 0xc0105512, &(0x7f0000000200)) (async) openat$audio1(0xffffffffffffff9c, &(0x7f0000000340), 0x400000, 0x0) 3.134747727s ago: executing program 2 (id=2087): r0 = socket$inet(0x2, 0x2, 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x7f, 0x9, @vifc_lcl_addr=@broadcast, @loopback}, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r2, 0x541b, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r5 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r5, 0x8, 0x0, 0xff9e, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffedb, 0x0, 0x0, 0x10, 0x4}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x5, 0x0) r6 = syz_open_procfs(0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x3f, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r9], 0x20}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000004380)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYBLOB="2004000000000000ff7f1b000000"], 0x28}}, 0x0) recvmmsg$unix(r7, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1}}], 0x4000000000003b9, 0x26022, 0x0) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @remote}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000004c0)="1ed8b7f9d457", 0x6}], 0x2, &(0x7f0000000100)=ANY=[], 0x40}, 0x20000000) 2.954165522s ago: executing program 4 (id=2089): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="09000000050000000002000040"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000003c0), 0x7fff, r1}, 0x38) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f00000001c0)={r1, &(0x7f0000000080), &(0x7f0000000180)=""/29}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x25, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x3, 0xfff2}, {0xffff, 0xffff}, {0xa}}}, 0x24}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000000000)="3a3f5d2129ffc724bcebbf31c6bdac74", 0x10) close_range(r4, r4, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$SIOCAX25ADDFWD(r6, 0x89ea, &(0x7f0000000100)={@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f000009de40)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="050029bd7000000000002e00000008000300", @ANYRES32=r7, @ANYBLOB="0a00340002020202020200000800350005"], 0x30}}, 0x0) 2.465758787s ago: executing program 5 (id=2090): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000780)={0x3, {{0xa, 0x4e23, 0x9, @mcast1, 0x8}}}, 0x90) syz_open_dev$dri(0x0, 0x1ff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x9, 0x0, 0x31}, 0x10) 1.590590922s ago: executing program 5 (id=2091): close(0xffffffffffffffff) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0xffe4, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 1.540460263s ago: executing program 6 (id=2092): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r1, &(0x7f0000000b00)={'syz0\x00', {0xfff, 0x7, 0x3, 0x7}, 0x3e, [0x2, 0x9, 0x0, 0x1, 0xc, 0xea45, 0xd, 0x1, 0x0, 0x0, 0x800008, 0xc, 0x9, 0x0, 0x1, 0xb, 0x93f, 0x7fffffff, 0x51, 0x5, 0x803, 0xfffffffa, 0x3ff, 0x2, 0x7, 0xffffffff, 0x3, 0x1, 0x4f, 0x100006, 0x9, 0x7, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x9, 0x4, 0xa, 0x8, 0x0, 0x8, 0x0, 0x2, 0xffff, 0x6, 0x939, 0x5, 0x9, 0x2, 0x4f, 0x40004, 0xfffffff7, 0x7fff, 0x4, 0x5, 0x2, 0x56f00ca9, 0x5, 0x2a, 0x1, 0x21], [0x1, 0x9, 0x9, 0x1, 0x5, 0x6, 0x800, 0xc, 0xfffffffa, 0x2329, 0xfd8, 0x1, 0xe9, 0x5, 0x0, 0x24e, 0x1, 0xfffffff7, 0x2, 0x3, 0x5, 0x9, 0x82, 0xb6fe, 0x1, 0x40, 0xa3, 0x8, 0xffffffff, 0x5, 0x10000, 0x1, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xa9, 0x101, 0x10, 0x2, 0x7, 0x7, 0x8, 0x7, 0x8000, 0x0, 0x5, 0xc5, 0x6, 0x1, 0x9, 0x8, 0x3, 0xfffffff7, 0x3, 0x24b, 0x1fd, 0x2a0, 0x5, 0x6, 0x8, 0x7, 0x80000007], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x6, 0x5, 0x8001, 0x10, 0x1, 0x2, 0x7fffffff, 0x8000, 0x4, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x97f82544, 0x8, 0x0, 0x1a2e, 0x5, 0x5, 0x4, 0x9, 0xc93, 0xffffff3c, 0x9b2, 0x7, 0x0, 0xff, 0x0, 0x2, 0x4, 0xb, 0x9, 0x6, 0x7, 0x7c13, 0x1, 0x1, 0x7, 0xff, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0xdd, 0xfe83, 0x9, 0xc3, 0x7751c64, 0x800007a3], [0xb, 0x3d3, 0xffff9a7f, 0x200, 0x3, 0x2, 0x2000003, 0x1, 0x5, 0x4, 0x3, 0x1f, 0x3, 0x6, 0x6, 0x2, 0x9, 0x7, 0x2, 0x66608000, 0x9, 0x7ff, 0x6, 0x5, 0xa476, 0x5, 0x9, 0x1, 0xd, 0x0, 0xfff7ff81, 0x5, 0x10001, 0x61, 0x10, 0x1000, 0x8, 0x100, 0xffffffff, 0x20000000, 0x8, 0x1d, 0x4000b329, 0xec000000, 0x6, 0x1904, 0x4, 0x9, 0x8, 0x7ff, 0x80, 0x5, 0xfffffffb, 0x7, 0x6e79, 0x8, 0x10000, 0x9371, 0x4f89, 0x7, 0x580, 0x10001, 0x80, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000000)={0x0, 0x0}) 1.363112992s ago: executing program 5 (id=2093): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r1, &(0x7f0000000b00)={'syz0\x00', {0xfff, 0x7, 0x3, 0x7}, 0x3e, [0x2, 0x9, 0x0, 0x1, 0xc, 0xea45, 0xd, 0x1, 0x0, 0x0, 0x800008, 0xc, 0x9, 0x0, 0x1, 0xb, 0x93f, 0x7fffffff, 0x51, 0x5, 0x803, 0xfffffffa, 0x3ff, 0x2, 0x7, 0xffffffff, 0x3, 0x1, 0x4f, 0x100006, 0x9, 0x7, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x9, 0x4, 0xa, 0x8, 0x0, 0x8, 0x0, 0x2, 0xffff, 0x6, 0x939, 0x5, 0x9, 0x2, 0x4f, 0x40004, 0xfffffff7, 0x7fff, 0x4, 0x5, 0x2, 0x56f00ca9, 0x5, 0x2a, 0x1, 0x21], [0x1, 0x9, 0x9, 0x1, 0x5, 0x6, 0x800, 0xc, 0xfffffffa, 0x2329, 0xfd8, 0x1, 0xe9, 0x5, 0x0, 0x24e, 0x1, 0xfffffff7, 0x2, 0x3, 0x5, 0x9, 0x82, 0xb6fe, 0x1, 0x40, 0xa3, 0x8, 0xffffffff, 0x5, 0x10000, 0x1, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xa9, 0x101, 0x10, 0x2, 0x7, 0x7, 0x8, 0x7, 0x8000, 0x0, 0x5, 0xc5, 0x6, 0x1, 0x9, 0x8, 0x3, 0xfffffff7, 0x3, 0x24b, 0x1fd, 0x2a0, 0x5, 0x6, 0x8, 0x7, 0x80000007], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x6, 0x5, 0x8001, 0x10, 0x1, 0x2, 0x7fffffff, 0x8000, 0x4, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x97f82544, 0x8, 0x0, 0x1a2e, 0x5, 0x5, 0x4, 0x9, 0xc93, 0xffffff3c, 0x9b2, 0x7, 0x0, 0xff, 0x0, 0x2, 0x4, 0xb, 0x9, 0x6, 0x7, 0x7c13, 0x1, 0x1, 0x7, 0xff, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0xdd, 0xfe83, 0x9, 0xc3, 0x7751c64, 0x800007a3], [0xb, 0x3d3, 0xffff9a7f, 0x200, 0x3, 0x2, 0x2000003, 0x1, 0x5, 0x4, 0x3, 0x1f, 0x3, 0x6, 0x6, 0x2, 0x9, 0x7, 0x2, 0x66608000, 0x9, 0x7ff, 0x6, 0x5, 0xa476, 0x5, 0x9, 0x1, 0xd, 0x0, 0xfff7ff81, 0x5, 0x10001, 0x61, 0x10, 0x1000, 0x8, 0x100, 0xffffffff, 0x20000000, 0x8, 0x1d, 0x4000b329, 0xec000000, 0x6, 0x1904, 0x4, 0x9, 0x8, 0x7ff, 0x80, 0x5, 0xfffffffb, 0x7, 0x6e79, 0x8, 0x10000, 0x9371, 0x4f89, 0x7, 0x580, 0x10001, 0x80, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000000)={0x0, 0x0}) (fail_nth: 1) 1.361761552s ago: executing program 6 (id=2094): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c4000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a0000008700", @ANYRES32=0x0, @ANYRES32=0x0], 0xc4}}, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}}, 0xb8}}, 0x0) write(r0, 0x0, 0x0) (async) write(r0, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) dup(r3) (async) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8012, r4, 0x2000) 941.32287ms ago: executing program 2 (id=2095): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) syz_emit_ethernet(0x0, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_dev$usbmon(0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x180, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8001, &(0x7f0000008e00)=0x1, 0x6a6f, 0x2) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) lsm_set_self_attr(0x64, &(0x7f0000000000)={0x6d, 0x800, 0x27, 0x7, "c8f35676897551"}, 0x27, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000500)=@newsa={0x140, 0x10, 0x1, 0x7fffffc, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast2, 0x4, 0x6c}, @in6=@remote, {0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x5, 0x4, 0xd, 0xa}, {0x0, 0x400}, 0xfffffffc, 0x0, 0xa, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @etimer_thresh={0x8, 0xc, 0x6}]}, 0x140}}, 0x20000000) 883.03152ms ago: executing program 6 (id=2096): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$GETPID(0x0, 0x3, 0xb, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000004c00), 0x1, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002580000000e0a01020000000000000000010000000900020073797a32000000001800038014000080100001800600028006000180000000000900010073797a30"], 0xc8}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x58}, [@jmp={0x5, 0x0, 0xc, 0x2, 0x6, 0x50, 0x10}, @alu={0x4, 0x0, 0x7, 0x4, 0x1, 0xffffffffffffffe0, 0x10}]}, &(0x7f00000001c0)='syzkaller\x00', 0x7, 0x65, &(0x7f0000000340)=""/101, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x0, 0xa3c}, 0x8, 0x10, &(0x7f00000003c0)={0x2, 0x6, 0x40, 0x7fff}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xda9}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x2, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r4}, 0x94) close(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r8, @ANYRES32=r7, @ANYBLOB='&'], 0x10) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r8}, &(0x7f0000000000), &(0x7f00000002c0)=r5}, 0x20) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r9, 0x9, 0x0) sendmsg$inet(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) 834.500145ms ago: executing program 4 (id=2097): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f0000000700)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xd5c, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0xe, 0xffffffffffffffff, 0x8, 0x0, 0x16, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe57}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=@RTM_DELMDB={0x58, 0x54, 0x93d, 0x0, 0x0, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x2, {0x0, 0x0, 0x0, 0x0, {@in6_addr=@empty}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x0, 0x3, 0x0, {@ip4=@broadcast, 0x86dd}}}]}, 0x58}}, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000080)) (async) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28008040}, 0x40000) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r4) r5 = socket(0x10, 0x2, 0x0) recvmmsg(r5, 0x0, 0x0, 0x2, &(0x7f00000001c0)) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x4}}}, 0x108) r7 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffe, 0x9, @empty, 0x4}}}, 0x108) (async, rerun: 32) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) (async, rerun: 32) r8 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f0000000080)=0x74000000) (async, rerun: 32) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xffffffd9) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) connect$802154_dgram(r6, &(0x7f0000000100)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x14) (async, rerun: 64) semctl$SETALL(0x0, 0x0, 0x11, 0x0) (rerun: 64) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) write$dsp(r8, &(0x7f0000002000)='`', 0x88020) 732.459314ms ago: executing program 5 (id=2098): r0 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)={0x0, 0x3938700}}) io_uring_enter(r0, 0x47ba, 0x3e80, 0x225c17d03, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) 195.284539ms ago: executing program 5 (id=2099): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a"], 0x68}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="5400001f10000100"/20, @ANYRES32, @ANYBLOB="7240146c00000000340012800c0001006d6163766c616e0024"], 0x54}}, 0x0) 152.383217ms ago: executing program 4 (id=2100): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(r0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) epoll_create1(0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) sched_setaffinity(0x0, 0xff02, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee3c0cb001829a8681ed391da1a71d8d", 0x63}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f1a0f9fff9e440b4", "881aae83544dfa6412f91b9057e3f415", "9dca4bb6", "9ecb592c6ee49fbd"}, 0x28) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x80000001}) socket$netlink(0x10, 0x3, 0x10) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000240)=""/50, 0x32}, {&(0x7f0000000380)=""/11, 0xb}, {&(0x7f00000003c0)=""/235, 0xeb}, {&(0x7f00000004c0)=""/226, 0xe2}], 0x4) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x400000}, 0xc) r4 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r4, 0x40305652, &(0x7f0000000040)={0x1, 0x1, 0x6e, 0x0, 0xd, 0x80000000, 0x4001}) 121.021977ms ago: executing program 5 (id=2101): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000780)={0x3, {{0xa, 0x4e23, 0x9, @mcast1, 0x8}}}, 0x90) syz_open_dev$dri(0x0, 0x1ff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x9, 0x0, 0x31}, 0x10) 0s ago: executing program 6 (id=2102): recvmmsg(0xffffffffffffffff, &(0x7f0000006b40), 0x0, 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x80002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) madvise(&(0x7f00007ed000/0x4000)=nil, 0x4000, 0x64) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) fchdir(0xffffffffffffffff) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(r2, 0x50009401, &(0x7f0000000380)={{r0}, "759e94942a11c40b52adf9b00679a537e888b5ef3005dd05a4b8ad51ab22ff59368ffc566c637edf7e3a69ced265d358a6c5f051381b40e4e8d143111ad81ec8e47f25349d1d1145109e5d5718b98df51b2e42c16c851232e5603794f1ece00b1f29f315e91ebd35bec6e71407a9566691b8efb7afc72dc556b1bdd8ae4a439f91182fcf9b769c4bfafc660a93e864adf9f3b2eb60692f4183f6eaba9eda636c741215bef5dd971a7fe063071c626e9cc7b00faafc0859e596a815f394668903cce2ec4b9099ac11ec4077554060e130e08f695b1bf7b48c5c15f5b478c384e41b4c236bf779275c942a94064d96823ebbe371191612c02b7396d9c147fab94660b567bd2c7504dc39ed55eb784dac033852f942698c6dafbe8429f5a8ae2822abca2df2df2d4e9d8156552f5e444c7c887bcb6964d8cad83bf6982d7598c83f4a0a3d07148addc47c4e7c24e9a04c87f78d720f4db0811c936ebaefa3ca66f48c163ff075c9e2dd2db618280405923afde2b3dabe9e3e3193f320b3becbe11c3bb36463ee36ac7e530c9d839baba157d35916919ed756faef5420621befeaa12bb98fdbe7a3d213f3490f86f982726edd7a315e4b69c8c076f0989f6ca5d905e2f45c65cff940084f2558c840cfef56f77eb0d3dd2804f2e59aa265d0e676fb7013f1f69746ce9081c771e35e2c53c2820070f79a0f1bba582bc41f2f40ca88e48f11b47ac70062e59837687f55418a7a188ac13ca5eefc5969a6632b71f97129556350b6bf4e17665fc82b16b2ae0cede4c3318f0ea13d05c748349ee0155384128c43e7b635f8772ab4cb382e846d0c89eb0eba21fb2d2c192ad692b64ec2268b219d2012bbd4c98c1fc06849024f7c41056ff653cf8696da08c44a045fc8c9f9381f3e3d7ebd6bfdc2f318912387e12c059c7e2f1b9450971db75cb97485d6f88eb4afb01d67994cac391ba9e506cf6e7afc60fad6b7742add0073da8d9198d1901b7d099e86865d05a048c20b6abed1ab0c2dfdbf96ba0dfd0612836e816e274e4b497a74feee4ca5364e35946fee23fe5160c78851866c8210bdc298c7d497be65d5322a9b9bbb33e1829edd9138f33a0ebcd4ad960afb8bccce09590e6c66641a5ae9b7db3cd0bfe6c40ca2d90192b07e476b4caa2d5c1441ee9b96c9581050baaab66b35679acd95ca211ed036f62ca356a7e1a98e51ebfcc5f274e42373471783befd341a8205a3233fb9861520cd8a298ec17a58f381c76f916bae1aa933e59d44f051ddeb0966089681e74395629df70815bab3042a378be0d06e911f341a275bf397e3ccbb0757a9416b134908dc6430ccb0d6543c5003829d711c0f5ff0c542d7036e8d53e20506148b744bab4fb9bc3a327aa710c36b2ade471e22359942d97b13a3579199b2b3db41db85b8ec23a07463530eaec12538d7c0297dfee6f532db7c9b95f37b922f30764106f60ace9df2a18c335a9f865ca4bf8595590a07fdddfcbc63c3cb9bbd5f508c1c3a42435fdb9c75de3690cd3a0713edf28847c516fbce729e3f736d415d18cac908ebcac671c4612cbafdd594a9026048aba66b5609c741c6b96b51077ceffdad3483bd72bb569ec1e530151cb0e2dc7870844977a628d9211e987a1d9d5992dddbc3f33e82f6182520a8461ee905f9d0d849532d018de468cf63660f4edcf87d2dee3b22881fb00da34ebea66b67f634e629ee2005963df514a59906d21ab2227e554495c96ede76519de765cede84ad6ae98c3879a62f3c9a29548fb2c07323bfb3c95e6ecbabc10eed532639b13a6939689c40070eafff47ca6a0a3ea62fa4795ee0cce94fa6789667551fc1c847d12173146d2479fe92d3a36291c6629131a18607c793970ab96ad64f093fce77da6884bcb75dcae81b1484c562aaf636ec44e90f4d68823bf4aefd35060831b0882fdd1df5620c80940d3c9cb226e1f69b56677b18ed14c3cd938774ab15e95562c88f6d744df7275da8a93db7f6b1748cf6b8ef9522d384ee620c3311e7f669e298857a5f74e990e6bbeac964ee20fc25732ff134d690dfd0649555dbf371503f95b1ad3957a3a1b6b1c68d772d8187c3be0fb7b09a5e89bfbd833604b5ecc4e6071b9a35e6a659e7dc5a34684c1273e74a61f2a2f22daa5974250924fe44dfa73ee60ebcf5519867c8669794914cfb42469e9969f1dd62ec4f4b4c087b5bb68e953fa1b8cf58ddfa5b9c6d6aab3513f321db304f9f9f210f553fcd41d8e585c6cbe45f83da36ee9b531c8a2a4b1a5330c78b24311ab0d996dc3abd9d22d37334d23a1beac903182e70412d667c4a38a793fe7b0f96ef3fdb3493984072ac764fa55e645815a97787982e45d3fba1068fa40bee4811c3d65eee75e445cae3a4fdd4bbceeb649472c462cf4e9029b1c072cd624ceb23d5154ae4917f72674f68a7ccde86fafc1857983bb69cd2caf01e85c35223688ff66487e6c6e33e5a09f9f84807875ed8747fa85737a1d45d47c99fa9fb5a1c2bffcc7a9022781e6e46e24c319d8ef430d7957abcda345801f6c10d96790997dca65f3bb5870c02fc8780e16b34bf9eff2ed37791e8521f232e7d34e3d9d46a27adce2f9742013b492fe27eddad14a9f5cfdbbb38a9ce80014c0944799442cd4f86f7fd89a643c3dc86848c9863cc2c40cab020604745fc445178ed93b3060539707cae96c661ee2ec31c591ba76b9f899481137e97245fa303dd18d5ad25f8ef2062e25de83885a2737c6e1361c34c13f9dfebe2b4d78e3b01cfe9e6e309366d9f8921c298d657c2da3aef4fea58aff7a36a23878043a6545deabf0f48f7730fbfe5ea20af61b1bb1f53e61531c7715fb7530c31247edaefcf96efb0379daa315d63e2b48b4888cbc7296225245ace06bce587655987663e6b6c567c22d265850fa7f91012b628ca513656be43b2613a7e5c100243fe3984844b3ff123e45afc89ee90fac8ed070be71484507e0fbb118095ab89ccab4e4ebc172ce0d05006d6a02950e142ceccc4e1f4472b8750381fe7edc063203bd510d7c8ca2b32cdbd0aa3b6ff6cad50c157fae00d2c346cd65d176ad74a04300c2442b63d344bf60b3eaaa4d7524cd8fd4428c9a8fc3531002fdebbb6ffe713839ff5a443fa3893defdec90bc25a051fa62af35a22402cdd33a85cef962effe52a1fa81cdedcafaee9e377e9fb61fc1b652cbac8f1d74a10c1c87467e1966835c53c1aff8f2047ad83536154282166949bd94cd6aab7f23013ea422c6b1021b723a8c39f7c5710f7ea41c07c918e4cceeb5a7123934021dce7ddca8e2afade48019e8d7faa9e2ab42579f0543d6e68159437d7d93467981bdce7c3145c79c9d4b4fd586be80ab9a3abaddfb25cd01eb1a94300948ca6fc480de6b1be52b169acfc385ee8ac1351f2cdf7e23a2477023385d91b934feead0cdecdd1a47e7bfcc73efd52ec3e7009f93842c46021a4b3f793c07c194eb48f4ecda1a66dc8021ccd9494e6d423c3f03808626db455c42abf00a23823ca7c664d3a8ad0df0036a9c954cda9cc9552a080743b63464bfc3de2d16be549c74586a8383204bfd36db7e64b92fe3823d436d902c7f69a36651eb25d0cf30c359b5508dd11421f8f65aa4a54a8d7eb44eb5b691a1c8c5e45e885ade4d747b89e21d2107220e3f8e4a5c8a204ca06722812c752c8e63c6c892115ea0a06ccfec2b70540bf9abac376855c07029d96d2dcbe423b31a325ee6d0102468127938ace3db79a1f7a065607f556829850086866b9cd4499085652bf8e13e6421fadcadce739759aa3c8e25e546aaa7bca9d0ab58e344cd56da6e1510d5c7d85b045a7f42f6bcb0141ad7cfcfc69a8d365334a1643b4fcb8c036a471e4fee91ba3d9599ca8d78226873e73f659718bbc8d3edad6f74836e775fac799e542bf48f2ce8c8fec201661fae8d7e68f0d00270cdfc89e76b64a82e27f79d4a0ed8c38d82d8e0b86e439c6fe835688b7ad58a1a74122afbed934d7961d0479847540754802fa2b61c88f0176fc128d35ddafbd9ce426854dc0cc03fa1aef5ae0b13ddecf9308496223892b3d4e1df2e156db1625064c2f0a64889410fed2f4dd19e7d05f64418acefe661573cf810e9ec825ff44c70fd1ef3591ebdfe6a7e454b441ed19839bb88886b5226386814d8dd62584df9f5859079b6eef9b080650b66a0ee25393d1724d9a11349882036b1ad2016aee2c3da2add31768e0f40a5d1bae02ebe409cfe1028bc2d37a8e9965eb91fb216a9c857cfe9ba57a08b162eb089cf754d8107ec973f41704c91a794396ac81bc9bef0d0c99d56869265b1a8caa86a0c093161e7d1dc573ec3950478bf17e82212fbc51520bbefcac24a2e92ab366adfae9cb1baf160c13cfa8652d4b235dca1e2f14985cdbf23cca74bd481ecb28af1ba2e6bb6c1be6090e08a9fe4d12d70cc0dd07b6dc703b365111d784830193a3e819213be7841331a9d6307e489f277e80b83aa92ce6280872a1d21569843cbcfd370d6521a3ffa7c2dfc8db4dbd06c90be38babbe7feb5f9b5ec00fa26377d03c41de620f5e585b09aa5e8e8baccd7c9c7926708fb478cbb45a86ef146d615338fe68ea6b5a47e2917f370bffa39e4652f44c6079be4724cb39cd4e2779d1d41acf35796ca664364942fb0fc755b308c1e1d2d60d0db0d984abaa7b76900432320243e32c6854e6aa06a35806e6536a15f3ed2c52321a8e4422edd22c7ada8a360a89490a298dd573ea98a9429c3f132b29b4a202f75cf389ba700f028de2a6ccdcbba4847ce25427b35ca3d71bcb4fbbeb6b7532225668fb8d828e9f3a9f1fe4ee5b133dc0b9f224e478503c206a455b294bd0fac0c8eac7c6daba02bdefacc693a2561ae565397f7eb45f4b4733fa59e15d82a2f26ff3a1ddbf23bc0eead5989eebd51dd209069ce96cc2f0f94e9e05329dfd6c63e6ec7bf88d436ba5949ddbf0bab14f8e2a9e4f83eb857dec9350a80ffe3ac990fc23b278172b50b3e58b6fd69ff4f8f063698841bb1adbfdaf56b3aa178e81080553c151495bc63154955c65b34513971ef57206bf059648916f205e3fe680ff8fcdd7ae10f063b4e93f4e1fb3ce3eedf4fdf8c2bc43bdce65fbf4c28ff64795cef7ee255d83a1df9383eb4ba88e16070e51bca433b395bf0f9f42bbd9b83e69d55b8a82cdd95e6dcc8be2c1f9d893079642924bc51e701dbcb03f914fad1efcbd5626d7dd931392de552f1644eae6f6d488933cf415dd5087fddbdb3bff220d222fae3cc6d31a63e64f9d30acc9ae88fb7e0c4bcbfc36830baba29055c85559186a28647defd4949d26a7367e85817fa580c2bc66c5e2931425560699e7977786ad3011995519ba999097a5652feec948bef38b5364d8578cf16eeb825e74e4500eb858515d7e43dddba8920c26dcd9530efe2fefc50883bde10e82d643099c62c34ff8f5c372f7abca5d8948ab40c8d2113d1eaa10a401fb4c339a802d7c8612b027b600e3cd8fa270cb2a4bfc9cabdc184ae93514d954e86575ce11a58bd6d0930d671faa53a9f141a1869ef62093408f622ddad4bfa1c7d27fcffe5c0aad85da75701df1895a97e2bab8ea49d69cd22140cf71103f42b6097ee3c847d233fa6e43033c06a3bff754ca877fb07c146159e2fad09dfee5b3a22af8a5deec04f1f6fb9eca6b36d592e09a0da393890f4b3d5e90c4ba103ed9e85ff30769464a6a6d47ad666973d23feab8f86cb4ccfca1061bf470e49c4da4f371f53808125eccea8ca2a"}) syz_io_uring_setup(0x49b, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x7, 0x288}, &(0x7f0000000340), &(0x7f0000000280)) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$SEG6(&(0x7f00000011c0), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(r7, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="210f2dbd02000000df2502"], 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x10) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000100)=0x80000) kernel console output (not intermixed with test programs): nfig 168 descriptor has 1 excess byte, ignoring [ 566.081437][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 566.092347][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 566.092511][ T5942] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 566.094683][ T5891] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 566.104409][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 566.131966][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 566.145563][ T10] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 566.153676][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 566.164392][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 566.176077][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 566.187220][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 566.198911][ T5936] pwc: recv_control_msg error -71 req 04 val 1200 [ 566.199385][ T10] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 566.207101][ T5936] pwc: Registered as video103. [ 566.212781][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 566.212808][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 566.219351][ T5936] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input41 [ 566.228258][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 566.228285][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 566.231109][ T10] usb 3-1: string descriptor 0 read error: -22 [ 566.240017][ T5942] usb 6-1: device descriptor read/64, error -71 [ 566.249511][ T10] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 566.295401][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.297851][ T5936] usb 7-1: USB disconnect, device number 14 [ 566.390358][ T10] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 566.522780][ T5942] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 566.613305][ T10] usb 3-1: USB disconnect, device number 55 [ 566.662945][ T5942] usb 6-1: device descriptor read/64, error -71 [ 566.772907][ T5942] usb usb6-port1: attempt power cycle [ 566.791495][T12710] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 566.797791][T12710] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 566.803768][T12710] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 566.815127][T12710] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 566.821092][T12710] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 566.843956][T12711] delete_channel: no stack [ 566.848490][T12711] delete_channel: no stack [ 566.854291][ T10] usb 4-1: USB disconnect, device number 49 [ 567.021404][T12719] netlink: 'syz.6.1556': attribute type 7 has an invalid length. [ 567.228671][T12722] Failed to initialize the IGMP autojoin socket (err -2) [ 567.508256][ T5891] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 567.526371][ T5891] ath9k_htc: Failed to initialize the device [ 567.571973][ T10] usb 4-1: ath9k_htc: USB layer deinitialized [ 567.572390][ T5942] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 567.612996][ T5942] usb 6-1: device descriptor read/8, error -71 [ 567.942403][ T5942] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 567.973267][ T5942] usb 6-1: device descriptor read/8, error -71 [ 568.034003][ T5837] Bluetooth: hci0: command 0x0406 tx timeout [ 568.041748][T12710] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 568.072087][T12721] block device autoloading is deprecated and will be removed. [ 568.152805][ T5942] usb usb6-port1: unable to enumerate USB device [ 568.184040][T12736] FAULT_INJECTION: forcing a failure. [ 568.184040][T12736] name failslab, interval 1, probability 0, space 0, times 0 [ 568.217452][T12736] CPU: 1 UID: 0 PID: 12736 Comm: syz.3.1563 Not tainted syzkaller #0 PREEMPT(full) [ 568.217475][T12736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 568.217484][T12736] Call Trace: [ 568.217489][T12736] [ 568.217495][T12736] dump_stack_lvl+0x16c/0x1f0 [ 568.217522][T12736] should_fail_ex+0x512/0x640 [ 568.217552][T12736] ? fs_reclaim_acquire+0xae/0x150 [ 568.217573][T12736] should_failslab+0xc2/0x120 [ 568.217592][T12736] __kmalloc_noprof+0xdd/0x880 [ 568.217615][T12736] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 568.217644][T12736] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 568.217669][T12736] tomoyo_realpath_from_path+0xc2/0x6e0 [ 568.217696][T12736] ? tomoyo_profile+0x47/0x60 [ 568.217716][T12736] tomoyo_path_number_perm+0x245/0x580 [ 568.217738][T12736] ? tomoyo_path_number_perm+0x237/0x580 [ 568.217763][T12736] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 568.217787][T12736] ? find_held_lock+0x2b/0x80 [ 568.217836][T12736] ? find_held_lock+0x2b/0x80 [ 568.217860][T12736] ? hook_file_ioctl_common+0x145/0x410 [ 568.217884][T12736] ? __fget_files+0x20e/0x3c0 [ 568.217907][T12736] security_file_ioctl+0x9b/0x240 [ 568.217934][T12736] __x64_sys_ioctl+0xb7/0x210 [ 568.217963][T12736] do_syscall_64+0xcd/0x4e0 [ 568.217989][T12736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.218005][T12736] RIP: 0033:0x7f636498eec9 [ 568.218019][T12736] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 568.218035][T12736] RSP: 002b:00007f63657dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 568.218052][T12736] RAX: ffffffffffffffda RBX: 00007f6364be5fa0 RCX: 00007f636498eec9 [ 568.218063][T12736] RDX: 0000200000000000 RSI: 0000000000002275 RDI: 0000000000000003 [ 568.218073][T12736] RBP: 00007f63657dd090 R08: 0000000000000000 R09: 0000000000000000 [ 568.218083][T12736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 568.218093][T12736] R13: 00007f6364be6038 R14: 00007f6364be5fa0 R15: 00007fff0b8d3c18 [ 568.218117][T12736] [ 568.431768][T12737] Mount JFS Failure: -22 [ 568.436275][T12737] jfs_mount failed w/return code = -22 [ 568.454294][T12736] ERROR: Out of memory at tomoyo_realpath_from_path. [ 568.459728][ T30] audit: type=1400 audit(1759494973.909:957): avc: denied { setopt } for pid=12738 comm="syz.4.1564" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 568.885543][ T5145] Bluetooth: hci2: command 0x040f tx timeout [ 568.892094][ T5837] Bluetooth: hci1: command 0x0405 tx timeout [ 570.568478][ T5837] Bluetooth: hci0: command 0x0406 tx timeout [ 570.741418][ T30] audit: type=1400 audit(1759494975.429:958): avc: denied { getopt } for pid=12748 comm="syz.5.1567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 570.912244][ T5145] Bluetooth: hci2: command 0x040f tx timeout [ 570.918410][ T5837] Bluetooth: hci1: command 0x0405 tx timeout [ 571.447114][T12762] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1566'. [ 572.494810][T12792] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 572.625035][T12791] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1573'. [ 572.637239][ T9750] Bluetooth: (null): Invalid header checksum [ 572.645613][ T9750] Bluetooth: (null): Invalid header checksum [ 572.653978][ T9750] Bluetooth: (null): Invalid header checksum [ 572.807906][ T36] Bluetooth: (null): Too short H5 packet [ 572.833002][ T36] Bluetooth: (null): Invalid header checksum [ 574.195644][ T5942] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 574.362109][ T5942] usb 3-1: Using ep0 maxpacket: 32 [ 574.482515][ T5942] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 574.508615][ T5942] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 574.987689][ T5942] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 575.016842][ T5942] usb 3-1: Product: syz [ 575.039050][ T5942] usb 3-1: Manufacturer: syz [ 575.056398][ T5942] usb 3-1: SerialNumber: syz [ 575.077332][ T5942] usb 3-1: config 0 descriptor?? [ 575.095219][T12816] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 575.248326][T12832] 9pnet_fd: Insufficient options for proto=fd [ 575.254698][ T30] audit: type=1400 audit(1759494980.699:959): avc: denied { mounton } for pid=12831 comm="syz.4.1585" path="/331/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 575.322787][ T5942] usb 3-1: USB disconnect, device number 56 [ 577.228896][T12863] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1592'. [ 578.727158][ T30] audit: type=1400 audit(1759494984.179:960): avc: denied { read } for pid=12891 comm="syz.3.1600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 579.340125][T12895] 9pnet_fd: Insufficient options for proto=fd [ 579.377063][T12898] ALSA: mixer_oss: invalid OSS volume '' [ 579.921707][ T10] usb 7-1: new full-speed USB device number 15 using dummy_hcd [ 580.072752][ T10] usb 7-1: not running at top speed; connect to a high speed hub [ 580.082483][ T10] usb 7-1: config index 0 descriptor too short (expected 32786, got 18) [ 580.091077][ T10] usb 7-1: config 95 has an invalid interface number: 1 but max is 0 [ 580.101070][ T30] audit: type=1400 audit(1759494985.559:961): avc: denied { write } for pid=12908 comm="syz.2.1606" path="socket:[40262]" dev="sockfs" ino=40262 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 580.132256][ T10] usb 7-1: config 95 has no interface number 0 [ 580.141578][ T10] usb 7-1: config 95 interface 1 has no altsetting 0 [ 580.161982][ T10] usb 7-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 580.194146][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.223311][ T10] usb 7-1: Product: ã [ 580.245162][ T10] usb 7-1: Manufacturer: Й [ 580.249691][ T10] usb 7-1: SerialNumber: 㖉áéµæ­§ì†ƒà¼ìª¹â„쭞硚㣣ꃈഋ⡿체딫㦾牲쾦í¨äŠŒê—½è²§æž»ï¾ºâ…ƒêŽ“à®å­é™‚㯯ㄚ䃽攛뉡霵Ằ⿴㯤⟦犺嘦旳츯욚圛儊隵æର뜮䵠Ꭴ∟ꆈãªåª¨ãŒ§ç·Ÿç¸ê³¾×‰ç«Šâœ€æ²´î ¿á¨¤ï¯„燵㌧쌙욘隦絳頂瀳å îŸ‡ç¡¸ë•¤è­˜ì¾¨ã…›à¯©ËŠì‹¦â™éƒ‹Þšáœ¡é±§é¡ë«¡æ¸™ [ 581.130299][T12924] bond1: entered promiscuous mode [ 581.142179][T12924] bond1: entered allmulticast mode [ 581.174518][T12924] 8021q: adding VLAN 0 to HW filter on device bond1 [ 581.691842][ T10] usb 7-1: USB disconnect, device number 15 [ 581.951570][ T5904] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 582.124785][ T5904] usb 6-1: Using ep0 maxpacket: 32 [ 582.141775][ T5904] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 582.163699][ T5904] usb 6-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 582.211514][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.233608][ T5904] usb 6-1: config 0 descriptor?? [ 582.254928][ T5904] gspca_main: spca501-2.14.0 probing 0000:0000 [ 583.097589][T12964] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1617'. [ 583.201856][ T5904] gspca_spca501: reg write: error -110 [ 583.827011][ T5904] spca501 6-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 583.838447][ T5904] spca501 6-1:0.0: probe with driver spca501 failed with error -22 [ 584.061481][ T10] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 584.322380][ T10] usb 7-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 584.346095][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.796245][ T10] usb 7-1: config 0 descriptor?? [ 584.818822][ T10] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 585.364443][ T30] audit: type=1400 audit(1759494990.820:962): avc: denied { setattr } for pid=12996 comm="syz.3.1624" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 585.833057][T13013] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 585.867656][T13013] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1629'. [ 586.212972][ T5904] usb 6-1: USB disconnect, device number 34 [ 586.631599][ T10] usb 7-1: USB disconnect, device number 16 [ 586.898838][ T30] audit: type=1400 audit(1759494992.350:963): avc: denied { associate } for pid=13044 comm="syz.5.1634" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 588.936752][ T5942] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 589.111329][ T5942] usb 3-1: Using ep0 maxpacket: 32 [ 589.147997][ T5942] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 589.187254][ T5942] usb 3-1: config 0 has no interface number 0 [ 589.197512][ T5942] usb 3-1: config 0 interface 184 has no altsetting 0 [ 589.206802][ T5942] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 589.417596][ T5942] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.522958][ T5942] usb 3-1: Product: syz [ 589.527147][ T5942] usb 3-1: Manufacturer: syz [ 589.531969][ T5942] usb 3-1: SerialNumber: syz [ 589.538594][ T5942] usb 3-1: config 0 descriptor?? [ 589.545608][ T5942] smsc75xx v1.0.0 [ 589.549311][ T5942] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 589.581027][ T5942] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -22 [ 589.752121][T13064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.774118][T13064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.793086][ T5942] usb 3-1: USB disconnect, device number 57 [ 589.800985][T13072] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 589.855719][T13077] fuse: Unknown parameter 'user_id00000000000000000000' [ 589.878632][T13072] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1643'. [ 589.989339][T13083] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1644'. [ 590.481320][T13096] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1648'. [ 590.601281][ T5891] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 590.802999][ T5891] usb 3-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 590.812115][ T5891] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.854687][ T5891] usb 3-1: config 0 descriptor?? [ 590.897310][ T5891] gspca_main: spca508-2.14.0 probing 8086:0110 [ 591.183377][ T5891] gspca_spca508: reg_read err -32 [ 591.198840][ T5891] gspca_spca508: reg_read err -32 [ 591.216400][ T5891] gspca_spca508: reg_read err -32 [ 591.697899][ T5891] gspca_spca508: reg_read err -32 [ 591.708474][ T5891] gspca_spca508: reg_read err -32 [ 591.959585][ T5891] gspca_spca508: reg write: error -71 [ 591.971831][ T5891] spca508 3-1:0.0: probe with driver spca508 failed with error -71 [ 592.007856][ T5891] usb 3-1: USB disconnect, device number 58 [ 592.380520][ T30] audit: type=1400 audit(1759494997.829:964): avc: denied { bind } for pid=13110 comm="syz.5.1653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 592.515235][T13121] fuse: Bad value for 'fd' [ 596.619206][T13170] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1667'. [ 596.746277][T13172] fuse: Bad value for 'fd' [ 596.898109][ T30] audit: type=1400 audit(1759495002.349:965): avc: denied { append } for pid=13175 comm="syz.4.1670" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 596.924895][T13177] IPVS: Error during creation of socket; terminating [ 599.454450][T13210] fuse: Bad value for 'fd' [ 599.562339][T13214] tmpfs: Unknown parameter 'grpquotaÿÿÿÿ' [ 600.119638][T13226] loop5: detected capacity change from 0 to 7 [ 600.131848][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.141146][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.163156][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.172366][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.181437][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.190676][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.211032][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.220207][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.231463][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.240600][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.256272][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.265474][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.275033][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.284212][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.292168][T13226] ldm_validate_partition_table(): Disk read failed. [ 600.312421][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.321593][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.337205][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 600.346382][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 601.503387][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 601.512564][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 601.520761][T13226] Dev loop5: unable to read RDB block 0 [ 601.530146][T13226] loop5: unable to read partition table [ 601.541484][T13226] loop5: partition table beyond EOD, truncated [ 601.561481][T13226] loop_reread_partitions: partition scan of loop5 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐìœëÜ%õ«`Éæ߀ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 601.829240][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 601.846280][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 601.860042][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 601.868513][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 601.876085][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 602.827199][T13241] Failed to initialize the IGMP autojoin socket (err -2) [ 603.951540][ T5145] Bluetooth: hci5: command tx timeout [ 603.985976][T13241] chnl_net:caif_netlink_parms(): no params data found [ 604.312999][ T30] audit: type=1400 audit(1759495009.769:966): avc: denied { bind } for pid=13261 comm="syz.2.1692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 604.482675][T13241] bridge0: port 1(bridge_slave_0) entered blocking state [ 604.489887][T13241] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.503699][T13241] bridge_slave_0: entered allmulticast mode [ 604.512084][T13241] bridge_slave_0: entered promiscuous mode [ 604.533678][T13241] bridge0: port 2(bridge_slave_1) entered blocking state [ 604.540804][T13241] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.551097][T13241] bridge_slave_1: entered allmulticast mode [ 604.557731][ T5891] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 604.570854][T13241] bridge_slave_1: entered promiscuous mode [ 604.654432][T13241] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 604.681468][T13241] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 604.735960][ T5891] usb 3-1: Using ep0 maxpacket: 32 [ 604.743640][ T5891] usb 3-1: config 0 has an invalid interface number: 129 but max is 0 [ 604.761925][ T5936] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 604.771900][T13241] team0: Port device team_slave_0 added [ 604.790893][T13241] team0: Port device team_slave_1 added [ 604.823830][T13241] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.830983][T13241] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.857167][T13241] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.870218][T13241] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.877458][T13241] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.903354][ T5891] usb 3-1: config 0 has no interface number 0 [ 604.910693][T13241] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.923173][ T5891] usb 3-1: New USB device found, idVendor=2040, idProduct=7610, bcdDevice=5b.0c [ 604.932316][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.940307][ T5891] usb 3-1: Product: syz [ 604.944525][ T5891] usb 3-1: Manufacturer: syz [ 604.949125][ T5891] usb 3-1: SerialNumber: syz [ 604.955985][ T5891] usb 3-1: config 0 descriptor?? [ 604.961399][ T10] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 605.073458][ T5936] usb 6-1: too many configurations: 67, using maximum allowed: 8 [ 605.111475][ T30] audit: type=1400 audit(1759495010.519:967): avc: denied { listen } for pid=13280 comm="syz.4.1698" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 605.243500][ T5936] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 605.276296][ T5891] usb 3-1: USB disconnect, device number 59 [ 605.321428][T13241] hsr_slave_0: entered promiscuous mode [ 605.328862][ T5936] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.338574][T13241] hsr_slave_1: entered promiscuous mode [ 605.346087][T13241] debugfs: 'hsr0' already exists in 'hsr' [ 605.348075][ T5936] usb 6-1: Product: syz [ 605.351938][T13241] Cannot create hsr debugfs directory [ 605.361805][ T5936] usb 6-1: Manufacturer: syz [ 605.366464][ T5936] usb 6-1: SerialNumber: syz [ 605.375805][ T5936] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 605.392863][ T5942] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 605.411439][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 605.422339][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 605.434670][ T10] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 605.446012][ T10] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 605.458336][ T10] usb 7-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 605.471433][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 605.478112][ T10] usb 7-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 605.487313][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.500850][ T10] usb 7-1: config 0 descriptor?? [ 605.582741][T13241] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 605.594886][T13241] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 605.616916][T13241] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 605.630700][T13241] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 605.816130][T13290] usb 6-1: USB disconnect, device number 35 [ 605.928577][T13241] 8021q: adding VLAN 0 to HW filter on device team0 [ 605.954106][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 605.961274][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.059314][ T5837] Bluetooth: hci5: command tx timeout [ 606.278192][ T5145] Bluetooth: hci1: unexpected event for opcode 0x040d [ 606.371342][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.378495][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.388463][ T10] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 606.500928][ T5942] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 606.508248][ T5942] ath9k_htc: Failed to initialize the device [ 606.518466][T13290] usb 6-1: ath9k_htc: USB layer deinitialized [ 606.526967][ T10] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 606.541117][ T10] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 606.550012][ T10] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 607.150414][ T10] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 607.186647][ T10] hid-thrustmaster 0003:044F:B65D.000B: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.6-1/input0 [ 607.192360][T13303] Failed to initialize the IGMP autojoin socket (err -2) [ 607.222176][ T10] hid-thrustmaster 0003:044F:B65D.000B: Wrong number of endpoints? [ 607.256337][T13302] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 607.288616][ C0] hid-thrustmaster 0003:044F:B65D.000B: URB to get model id failed with error -71 [ 607.297626][T13306] Failed to initialize the IGMP autojoin socket (err -2) [ 607.305839][ T10] usb 7-1: USB disconnect, device number 17 [ 607.405252][ T30] audit: type=1400 audit(1759495012.849:968): avc: denied { ioctl } for pid=13305 comm="syz.4.1701" path="socket:[42209]" dev="sockfs" ino=42209 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 607.453655][T13313] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1703'. [ 608.120788][ T5837] Bluetooth: hci5: command tx timeout [ 608.805648][T13338] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13338 comm=syz.2.1707 [ 609.038514][T13332] netlink: 168 bytes leftover after parsing attributes in process `syz.6.1705'. [ 609.365952][T13241] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 610.223737][ T5145] Bluetooth: hci5: command tx timeout [ 610.642636][T13367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1710'. [ 610.822561][T13241] veth0_vlan: entered promiscuous mode [ 610.834195][T13241] veth1_vlan: entered promiscuous mode [ 611.253114][T13377] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1712'. [ 612.077416][T13389] SELinux: policydb version -1109844251 does not match my version range 15-35 [ 612.086528][ T30] audit: type=1400 audit(1759495017.529:969): avc: denied { load_policy } for pid=13384 comm="syz.4.1714" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 612.192673][T13389] SELinux: failed to load policy [ 612.283648][ T5145] Bluetooth: hci5: command 0x0405 tx timeout [ 612.336253][T13241] veth0_macvtap: entered promiscuous mode [ 612.538066][T13241] veth1_macvtap: entered promiscuous mode [ 613.452615][T13241] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 613.518753][T13241] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 613.688986][T13241] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 613.723194][T13241] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 613.762690][T13241] wireguard: wg0: Could not create IPv4 socket [ 613.789806][T13241] wireguard: wg1: Could not create IPv4 socket [ 613.815935][T13241] wireguard: wg2: Could not create IPv4 socket [ 614.172629][ T30] audit: type=1400 audit(1759495019.619:970): avc: denied { recv } for pid=13441 comm="dhcpcd" src=68 daddr=255.255.255.255 dest=67 netif=veth0_to_bond scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 615.511277][ T30] audit: type=1400 audit(1759495020.959:971): avc: denied { read } for pid=13466 comm="syz.2.1723" path="socket:[41591]" dev="sockfs" ino=41591 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 615.646321][T13471] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 615.672582][T13471] CIFS mount error: No usable UNC path provided in device string! [ 615.672582][T13471] [ 615.682833][T13471] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 616.284507][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 616.299409][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 616.366394][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 616.400913][ T30] audit: type=1400 audit(1759495021.789:972): avc: denied { create } for pid=13453 comm="syz.4.1721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 616.423550][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 616.475785][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 616.611931][T13475] Failed to initialize the IGMP autojoin socket (err -2) [ 617.621248][ T5942] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 617.775717][ T30] audit: type=1326 audit(1759495023.229:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13488 comm="syz.4.1727" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x0 [ 617.815965][ T5942] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 617.836369][ T5942] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.844644][ T5942] usb 7-1: Product: syz [ 617.851332][ T5942] usb 7-1: Manufacturer: syz [ 617.856010][ T5942] usb 7-1: SerialNumber: syz [ 617.865432][ T5942] usb 7-1: config 0 descriptor?? [ 617.874739][ T5942] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 018 [ 618.722513][ T5837] Bluetooth: hci5: command tx timeout [ 619.178189][T13475] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 619.188477][T13475] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 619.210070][T13475] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 619.228242][T13475] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 619.301291][ T5936] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 619.341351][ T1203] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 619.451386][ T5936] usb 6-1: Using ep0 maxpacket: 32 [ 619.466109][ T5936] usb 6-1: New USB device found, idVendor=1e71, idProduct=200e, bcdDevice= 0.00 [ 619.479167][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.492924][ T1203] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 619.505142][ T5936] usb 6-1: config 0 descriptor?? [ 619.520786][ T1203] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 619.548738][ T1203] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 619.573747][ T1203] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 619.587347][ T1203] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.599592][ T1203] usb 3-1: Product: syz [ 619.618553][ T1203] usb 3-1: Manufacturer: syz [ 619.632370][ T1203] usb 3-1: SerialNumber: syz [ 619.657347][ T1203] usb 3-1: config 0 descriptor?? [ 619.677705][T13507] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 619.693913][T13507] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 619.715511][ T1203] usb 3-1: ucan: probing device on interface #0 [ 619.884791][T13475] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 619.905083][T13475] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 619.924142][T13475] wireguard: wg0: Could not create IPv4 socket [ 619.937141][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 619.949650][T13475] wireguard: wg1: Could not create IPv4 socket [ 619.956436][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 619.964543][ T5942] (null): failure setting delay to 10us [ 619.970381][ T5942] i2c-tiny-usb 7-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 619.982338][T13475] wireguard: wg2: Could not create IPv4 socket [ 619.988618][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 620.006764][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 620.022958][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 620.040015][ T5936] nzxt-smart2 0003:1E71:200E.000C: unknown main item tag 0x0 [ 620.060057][ T5936] nzxt-smart2 0003:1E71:200E.000C: hidraw0: USB HID vb4.34 Device [HID 1e71:200e] on usb-dummy_hcd.5-1/input0 [ 620.189513][ T5936] usb 6-1: USB disconnect, device number 36 [ 620.225083][ T5942] usb 7-1: USB disconnect, device number 18 [ 620.348602][ T1203] ucan 3-1:0.0: probe with driver ucan failed with error -71 [ 620.361268][ T1203] usb 3-1: USB disconnect, device number 60 [ 621.005946][T13552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1738'. [ 621.035521][ T30] audit: type=1400 audit(1759495026.489:974): avc: denied { ioctl } for pid=13542 comm="syz.5.1736" path="socket:[43030]" dev="sockfs" ino=43030 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 621.060202][ C1] vkms_vblank_simulate: vblank timer overrun [ 621.353549][T13555] XFS (nullb0): Invalid superblock magic number [ 622.220970][T13572] usb usb8: usbfs: process 13572 (syz.6.1741) did not claim interface 0 before use [ 622.474331][ T30] audit: type=1400 audit(1759495027.929:975): avc: denied { connect } for pid=13573 comm="syz.2.1742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 622.551359][ T5905] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 622.792301][ T5905] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 622.843289][ T5905] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 622.931467][ T5905] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 623.033964][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.179351][ T5905] usb 6-1: config 0 descriptor?? [ 623.257758][ T5905] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 623.279274][ T5905] dvb-usb: bulk message failed: -22 (3/0) [ 623.313711][ T5905] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 623.343893][ T5905] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 623.364332][ T5905] usb 6-1: media controller created [ 623.372897][ T5905] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 623.393535][ T5905] dvb-usb: bulk message failed: -22 (6/0) [ 623.399378][ T5905] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 623.413751][ T5905] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input44 [ 623.466241][ T5905] dvb-usb: schedule remote query interval to 150 msecs. [ 623.480118][ T5905] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 623.573181][T13571] dvb-usb: bulk message failed: -22 (2/0) [ 623.593036][ T5936] usb 6-1: USB disconnect, device number 37 [ 623.637811][ T5936] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 623.781611][T13594] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 623.788905][T13594] IPv6: NLM_F_CREATE should be set when creating new route [ 623.796383][T13594] IPv6: NLM_F_CREATE should be set when creating new route [ 623.803675][T13594] IPv6: NLM_F_CREATE should be set when creating new route [ 623.831316][ T30] audit: type=1400 audit(1759495029.219:976): avc: denied { ioctl } for pid=13592 comm="syz.2.1746" path="socket:[43268]" dev="sockfs" ino=43268 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 624.031760][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.090912][T13597] loop9: detected capacity change from 0 to 7 [ 624.128711][T13597] Dev loop9: unable to read RDB block 7 [ 624.134444][T13597] loop9: unable to read partition table [ 624.140152][T13597] loop9: partition table beyond EOD, truncated [ 624.224877][T13597] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 624.359051][T13615] No source specified [ 624.375362][T13615] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1748'. [ 624.407257][T13614] netlink: 88 bytes leftover after parsing attributes in process `syz.6.1751'. [ 625.691451][ T5891] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 625.902466][ T5891] usb 7-1: Using ep0 maxpacket: 32 [ 625.916769][ T5891] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 626.001267][ T5891] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 626.069106][ T5891] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 626.121438][ T5891] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 626.227595][ T5891] usb 7-1: config 0 interface 0 has no altsetting 0 [ 626.294181][ T5891] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 626.371250][ T5891] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 626.407973][ T5891] usb 7-1: Product: syz [ 626.424778][ T5891] usb 7-1: Manufacturer: syz [ 626.429391][ T5891] usb 7-1: SerialNumber: syz [ 626.466624][ T30] audit: type=1326 audit(1759495031.909:977): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 626.490780][ T5891] usb 7-1: config 0 descriptor?? [ 626.522970][ T5891] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 626.533705][ T5891] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 626.551711][ T30] audit: type=1326 audit(1759495031.919:978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=218 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 626.620977][ T30] audit: type=1326 audit(1759495031.919:979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 626.774446][ T30] audit: type=1326 audit(1759495031.919:980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 627.097358][T13663] FAULT_INJECTION: forcing a failure. [ 627.097358][T13663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 627.135131][ T30] audit: type=1326 audit(1759495031.919:981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 627.563902][T13663] CPU: 1 UID: 0 PID: 13663 Comm: syz.6.1753 Not tainted syzkaller #0 PREEMPT(full) [ 627.563920][T13663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 627.563927][T13663] Call Trace: [ 627.563934][T13663] [ 627.563939][T13663] dump_stack_lvl+0x16c/0x1f0 [ 627.563959][T13663] should_fail_ex+0x512/0x640 [ 627.563979][T13663] _copy_from_user+0x2e/0xd0 [ 627.563997][T13663] kstrtouint_from_user+0xd6/0x1d0 [ 627.564011][T13663] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 627.564025][T13663] ? mark_held_locks+0x49/0x80 [ 627.564037][T13663] ? cfusbl_device_notify+0x90/0x900 [ 627.564059][T13663] proc_fail_nth_write+0x83/0x220 [ 627.564074][T13663] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 627.564088][T13663] ? preempt_schedule_thunk+0x16/0x30 [ 627.564108][T13663] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 627.564121][T13663] vfs_write+0x29d/0x11d0 [ 627.564135][T13663] ? __pfx___mutex_lock+0x10/0x10 [ 627.564152][T13663] ? __pfx_vfs_write+0x10/0x10 [ 627.564167][T13663] ? __fget_files+0x20e/0x3c0 [ 627.564184][T13663] ksys_write+0x12a/0x250 [ 627.564196][T13663] ? __pfx_ksys_write+0x10/0x10 [ 627.564211][T13663] do_syscall_64+0xcd/0x4e0 [ 627.564229][T13663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.564240][T13663] RIP: 0033:0x7fd52978d97f [ 627.564249][T13663] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 627.564260][T13663] RSP: 002b:00007fd52a688030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 627.564271][T13663] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd52978d97f [ 627.564279][T13663] RDX: 0000000000000001 RSI: 00007fd52a6880a0 RDI: 0000000000000006 [ 627.564285][T13663] RBP: 00007fd52a688090 R08: 0000000000000000 R09: 0000000000000000 [ 627.564292][T13663] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 627.564298][T13663] R13: 00007fd5299e6128 R14: 00007fd5299e6090 R15: 00007ffc167877b8 [ 627.564312][T13663] [ 627.774374][ T5934] usb 7-1: USB disconnect, device number 19 [ 627.783409][ T30] audit: type=1326 audit(1759495031.919:982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 627.913134][ T5934] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 627.931241][ T30] audit: type=1326 audit(1759495031.919:983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 627.986341][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 628.007088][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 628.018688][T13677] fuse: Unknown parameter 'fd0x0000000000000004' [ 628.031513][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 628.042679][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 628.052769][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 628.061436][ T30] audit: type=1326 audit(1759495031.919:984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 628.071603][T13666] Failed to initialize the IGMP autojoin socket (err -2) [ 628.102387][ T30] audit: type=1326 audit(1759495031.919:985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13648 comm="syz.5.1755" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 628.261252][ T5904] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 628.432742][ T5904] usb 5-1: Using ep0 maxpacket: 32 [ 628.448370][ T5904] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 628.708257][ T5904] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.815399][ T5904] usb 5-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 628.824762][ T5904] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.833269][ T10] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 628.845851][ T5904] usb 5-1: config 0 descriptor?? [ 629.001411][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 629.017729][ T10] usb 6-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 629.083533][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.109965][ T10] usb 6-1: config 0 descriptor?? [ 629.123273][ T10] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 629.205754][T13699] input: syz0 as /devices/virtual/input/input45 [ 629.296367][ T5904] smartjoyplus 0003:0925:8866.000D: hidraw0: USB HID v0.00 Device [HID 0925:8866] on usb-dummy_hcd.4-1/input0 [ 629.324860][ T5904] smartjoyplus 0003:0925:8866.000D: no output reports found [ 629.453154][T13684] usb usb8: usbfs: process 13684 (syz.5.1766) did not claim interface 0 before use [ 629.491267][ T10] gspca_vc032x: reg_r err -71 [ 629.503060][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.512721][T13290] usb 5-1: USB disconnect, device number 60 [ 629.516411][T13666] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 629.520745][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.542253][T13666] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 629.549415][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.565364][T13666] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 629.565373][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.565387][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.583810][ T5934] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 629.586140][T13666] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 629.592033][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.604149][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.613117][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.634015][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.640490][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.647056][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.653533][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.661472][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.666826][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.672617][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.677945][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.683451][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.688782][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 629.694118][ T10] gspca_vc032x: Unknown sensor... [ 629.699238][ T10] vc032x 6-1:0.0: probe with driver vc032x failed with error -22 [ 629.709704][ T10] usb 6-1: USB disconnect, device number 38 [ 629.751827][ T5934] usb 7-1: Using ep0 maxpacket: 8 [ 629.758592][ T5934] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 629.767311][ T5934] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 629.777465][ T5934] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 629.788115][ T5934] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 629.798453][ T5934] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 629.812307][ T5934] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 629.821496][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.993200][T13666] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 630.014723][T13666] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 630.034112][T13666] wireguard: wg0: Could not create IPv4 socket [ 630.041796][ T5934] usb 7-1: usb_control_msg returned -32 [ 630.048951][T13666] wireguard: wg1: Could not create IPv4 socket [ 630.057489][ T5934] usbtmc 7-1:16.0: can't read capabilities [ 630.066547][T13666] wireguard: wg2: Could not create IPv4 socket [ 630.113504][ T5837] Bluetooth: hci5: command tx timeout [ 630.393752][T13698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.468595][ T5934] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 630.667718][T13726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.678573][T13698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.689842][T13726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.234081][ T5934] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 631.245109][ T5934] usb 5-1: config 0 has no interface number 0 [ 631.254201][ T5934] usb 5-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 631.263314][ T5934] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.283162][ T5934] usb 5-1: config 0 descriptor?? [ 631.306458][ T5934] usb 5-1: selecting invalid altsetting 1 [ 631.320750][ T5934] dvb_ttusb_budget: ttusb_init_controller: error [ 631.330991][ T5934] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 631.376860][ T5934] DVB: Unable to find symbol cx22700_attach() [ 631.420987][ T5934] DVB: Unable to find symbol tda10046_attach() [ 631.427356][ T5934] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 631.492733][ T5934] usb 5-1: USB disconnect, device number 61 [ 631.561261][ T5936] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 631.712462][ T5936] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 631.722409][ T5936] usb 6-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 631.731509][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.740917][ T5936] usb 6-1: config 0 descriptor?? [ 631.956827][ T5936] usb 6-1: USB disconnect, device number 39 [ 632.171276][T13766] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1780'. [ 632.190038][ T5934] usb 7-1: USB disconnect, device number 20 [ 632.203553][T13766] vivid-000: ================= START STATUS ================= [ 632.217792][T13766] vivid-000: Generate PTS: true [ 632.225987][T13766] vivid-000: Generate SCR: true [ 632.233513][T13766] tpg source WxH: 720x576 (Y'CbCr) [ 632.239865][T13766] tpg field: 4 [ 632.244323][T13766] tpg crop: (0,0)/720x576 [ 632.249721][T13766] tpg compose: (0,0)/720x576 [ 632.255406][T13766] tpg colorspace: 1 [ 632.260233][T13766] tpg transfer function: 0/1 [ 632.266124][T13766] tpg Y'CbCr encoding: 0/1 [ 632.271627][T13766] tpg quantization: 0/2 [ 632.275797][T13766] tpg RGB range: 0/2 [ 632.280293][T13766] vivid-000: ================== END STATUS ================== [ 632.626493][T13784] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1784'. [ 634.866758][T13808] netlink: 'syz.6.1789': attribute type 1 has an invalid length. [ 637.438735][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 637.446730][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 637.454485][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 637.464125][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 637.472211][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 637.492353][T13850] Failed to initialize the IGMP autojoin socket (err -2) [ 637.936270][T13850] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 637.948376][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 637.948391][ T30] audit: type=1400 audit(1759495043.409:1022): avc: denied { setopt } for pid=13857 comm="syz.4.1802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 637.949905][T13850] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 638.010703][ T30] audit: type=1400 audit(1759495043.459:1023): avc: denied { bind } for pid=13857 comm="syz.4.1802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 638.040162][T13850] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 638.052719][T13859] vivid-000: ================= START STATUS ================= [ 638.053187][T13850] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 638.070789][T13859] vivid-000: Generate PTS: true [ 638.093414][T13859] vivid-000: Generate SCR: true [ 638.115312][T13859] tpg source WxH: 720x576 (Y'CbCr) [ 638.133076][T13859] tpg field: 4 [ 638.143469][T13859] tpg crop: (0,0)/720x576 [ 638.156776][T13859] tpg compose: (0,0)/720x576 [ 638.173315][T13859] tpg colorspace: 1 [ 638.181227][T13859] tpg transfer function: 0/1 [ 638.190290][T13859] tpg Y'CbCr encoding: 0/1 [ 638.199331][T13859] tpg quantization: 0/2 [ 638.205851][T13859] tpg RGB range: 0/2 [ 638.210392][T13859] vivid-000: ================== END STATUS ================== [ 638.827112][T13891] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1808'. [ 639.619164][ T5145] Bluetooth: hci5: command tx timeout [ 639.888577][T13290] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 640.259320][T13850] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 640.348851][T13896] 9pnet_fd: Insufficient options for proto=fd [ 640.358244][T13850] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 640.572027][T13850] wireguard: wg0: Could not create IPv4 socket [ 640.607167][T13850] wireguard: wg1: Could not create IPv4 socket [ 640.631527][ T30] audit: type=1400 audit(1759495046.079:1024): avc: denied { mount } for pid=13885 comm="syz.2.1809" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 640.694760][T13850] wireguard: wg2: Could not create IPv4 socket [ 641.461282][ T5934] usb 6-1: new full-speed USB device number 40 using dummy_hcd [ 641.611264][ T5934] usb 6-1: device descriptor read/64, error -71 [ 642.160342][ T30] audit: type=1400 audit(1759495047.349:1025): avc: denied { execute_no_trans } for pid=13923 comm="syz.4.1817" path=2F6D656D66643A202864656C6574656429 dev="hugetlbfs" ino=46110 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 642.251389][ T5934] usb 6-1: new full-speed USB device number 41 using dummy_hcd [ 642.280094][T13290] usb 3-1: unable to get BOS descriptor or descriptor too short [ 642.299734][T13290] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 642.328897][T13290] usb 3-1: can't read configurations, error -71 [ 642.416265][ T5934] usb 6-1: device descriptor read/64, error -71 [ 642.722913][T13938] FAULT_INJECTION: forcing a failure. [ 642.722913][T13938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 642.736037][T13938] CPU: 0 UID: 0 PID: 13938 Comm: syz.2.1820 Not tainted syzkaller #0 PREEMPT(full) [ 642.736061][T13938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 642.736071][T13938] Call Trace: [ 642.736079][T13938] [ 642.736086][T13938] dump_stack_lvl+0x16c/0x1f0 [ 642.736116][T13938] should_fail_ex+0x512/0x640 [ 642.736144][T13938] _copy_to_user+0x32/0xd0 [ 642.736173][T13938] simple_read_from_buffer+0xcb/0x170 [ 642.736194][T13938] proc_fail_nth_read+0x197/0x240 [ 642.736216][T13938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 642.736241][T13938] ? rw_verify_area+0xcf/0x6c0 [ 642.736268][T13938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 642.736290][T13938] vfs_read+0x1e4/0xcf0 [ 642.736311][T13938] ? __pfx___mutex_lock+0x10/0x10 [ 642.736342][T13938] ? __pfx_vfs_read+0x10/0x10 [ 642.736367][T13938] ? __fget_files+0x20e/0x3c0 [ 642.736394][T13938] ksys_read+0x12a/0x250 [ 642.736412][T13938] ? __pfx_ksys_read+0x10/0x10 [ 642.736437][T13938] do_syscall_64+0xcd/0x4e0 [ 642.736464][T13938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 642.736483][T13938] RIP: 0033:0x7f416238d8dc [ 642.736496][T13938] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 642.736512][T13938] RSP: 002b:00007f4163281030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 642.736529][T13938] RAX: ffffffffffffffda RBX: 00007f41625e6090 RCX: 00007f416238d8dc [ 642.736582][T13938] RDX: 000000000000000f RSI: 00007f41632810a0 RDI: 0000000000000008 [ 642.736595][T13938] RBP: 00007f4163281090 R08: 0000000000000000 R09: 0000000000000000 [ 642.736605][T13938] R10: 0000000020008000 R11: 0000000000000246 R12: 0000000000000001 [ 642.736615][T13938] R13: 00007f41625e6128 R14: 00007f41625e6090 R15: 00007fffeeec1638 [ 642.736638][T13938] [ 643.118529][ T5934] usb usb6-port1: attempt power cycle [ 643.471441][ T5934] usb 6-1: new full-speed USB device number 42 using dummy_hcd [ 643.515819][ T5934] usb 6-1: device descriptor read/8, error -71 [ 644.171271][ T5934] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 644.424075][ T5934] usb 6-1: device descriptor read/8, error -71 [ 644.735294][ T5934] usb usb6-port1: unable to enumerate USB device [ 645.178345][ T30] audit: type=1400 audit(1759495050.629:1026): avc: denied { map } for pid=13966 comm="syz.5.1828" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 645.371296][ T1203] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 645.511603][ T1203] usb 5-1: device descriptor read/64, error -71 [ 645.761423][ T1203] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 645.901271][ T1203] usb 5-1: device descriptor read/64, error -71 [ 646.022450][ T1203] usb usb5-port1: attempt power cycle [ 646.371342][ T1203] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 646.423623][ T1203] usb 5-1: device descriptor read/8, error -71 [ 646.711589][ T1203] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 646.778368][ T1203] usb 5-1: device descriptor read/8, error -71 [ 646.887524][ T5837] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 646.897720][ T5837] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 646.983022][ T1203] usb usb5-port1: unable to enumerate USB device [ 646.990486][ T5837] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 647.004579][ T5837] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 647.012187][ T5837] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 647.035627][T13982] Failed to initialize the IGMP autojoin socket (err -2) [ 647.267932][T13992] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1829'. [ 648.644782][T13982] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 649.152451][ T5837] Bluetooth: hci5: command tx timeout [ 649.171391][T13982] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 649.273502][T13982] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 649.293967][T13982] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 650.445650][ T30] audit: type=1400 audit(1759495055.899:1027): avc: denied { ioctl } for pid=14027 comm="syz.6.1843" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x641f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 650.747153][T13290] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 650.819935][T14041] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1845'. [ 650.911970][T13290] usb 5-1: Using ep0 maxpacket: 8 [ 650.949699][T13290] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 650.970670][T13290] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 48602, setting to 1024 [ 650.982060][T13290] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 650.993724][T13290] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 651.383486][ T5837] Bluetooth: hci5: command tx timeout [ 651.396668][T13290] usb 5-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 651.461393][T13290] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 651.479480][T13290] usb 5-1: SerialNumber: syz [ 651.514817][T13290] usb 5-1: config 0 descriptor?? [ 651.520469][T14026] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 651.530284][T13290] hso 5-1:0.0: Can't find BULK OUT endpoint [ 651.587454][T13982] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 651.607386][T13982] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 651.628684][T13982] wireguard: wg0: Could not create IPv4 socket [ 651.636222][T13982] wireguard: wg1: Could not create IPv4 socket [ 651.643907][T13982] wireguard: wg2: Could not create IPv4 socket [ 651.955469][ T5891] usb 5-1: USB disconnect, device number 66 [ 652.237563][T14058] wg1: entered promiscuous mode [ 652.242610][T14058] wg1: entered allmulticast mode [ 652.978264][ T5891] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 653.161260][ T5891] usb 5-1: device descriptor read/64, error -71 [ 653.411480][ T5891] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 653.551333][ T5891] usb 5-1: device descriptor read/64, error -71 [ 653.664283][ T5891] usb usb5-port1: attempt power cycle [ 654.013639][ T5891] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 654.061691][ T5891] usb 5-1: device descriptor read/8, error -71 [ 654.300478][ T5905] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 654.321613][ T5891] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 654.381671][ T5891] usb 5-1: device descriptor read/8, error -71 [ 654.495943][ T5891] usb usb5-port1: unable to enumerate USB device [ 654.531260][ T5905] usb 6-1: Using ep0 maxpacket: 32 [ 654.546124][ T5905] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 31, changing to 8 [ 654.575682][ T5905] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 654.603711][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.636261][ T5905] usb 6-1: config 0 descriptor?? [ 654.649090][ T5905] hub 6-1:0.0: USB hub found [ 655.052055][T14082] syz.5.1851 uses old SIOCAX25GETINFO [ 655.139260][ T30] audit: type=1400 audit(1759495060.589:1028): avc: denied { read } for pid=14074 comm="syz.5.1851" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 655.216514][ T30] audit: type=1400 audit(1759495060.589:1029): avc: denied { open } for pid=14074 comm="syz.5.1851" path="/228/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 655.244375][ T30] audit: type=1400 audit(1759495060.629:1030): avc: denied { ioctl } for pid=14074 comm="syz.5.1851" path="/228/file0/file0" dev="fuse" ino=0 ioctlcmd=0x5437 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 656.210268][T14105] netlink: 'syz.6.1856': attribute type 6 has an invalid length. [ 656.305598][ T30] audit: type=1400 audit(1759495061.759:1031): avc: denied { search } for pid=14104 comm="getty" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 656.358876][ T30] audit: type=1400 audit(1759495061.759:1032): avc: denied { read write } for pid=14104 comm="getty" name="utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 656.510062][ T30] audit: type=1400 audit(1759495061.759:1033): avc: denied { open } for pid=14104 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 656.532985][ T30] audit: type=1400 audit(1759495061.759:1034): avc: denied { lock } for pid=14104 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 656.934551][ T30] audit: type=1400 audit(1759495061.759:1035): avc: denied { read } for pid=14104 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 656.976833][ T5905] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 656.995230][ T5905] usbhid 6-1:0.0: can't add hid device: -71 [ 657.001555][ T5905] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 657.046536][ T5905] usb 6-1: USB disconnect, device number 44 [ 657.120821][T14113] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1858'. [ 659.358947][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 659.368302][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 659.376078][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 659.383771][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 659.391633][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 659.408632][T14139] Failed to initialize the IGMP autojoin socket (err -2) [ 659.450522][T14142] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 659.451257][ T5934] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 659.513888][T14145] team0: Mode changed to "loadbalance" [ 659.803470][ T5934] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 659.882985][ T5934] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 659.915971][ T5934] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 659.926056][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.180605][T14136] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 661.189928][ T5934] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 661.439799][T14165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1872'. [ 661.471263][ T5837] Bluetooth: hci5: command tx timeout [ 662.215151][T14139] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 662.242690][T14166] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1871'. [ 662.396162][T14179] fuse: Unknown parameter 'èEÜAŽ3ɪ¡' [ 662.487390][ T30] audit: type=1400 audit(1759495068.848:1036): avc: denied { create } for pid=14178 comm="syz.4.1876" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 662.509060][ T30] audit: type=1400 audit(1759495068.848:1037): avc: denied { mounton } for pid=14178 comm="syz.4.1876" path="/406/file0" dev="tmpfs" ino=2155 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 662.532224][ T30] audit: type=1400 audit(1759495068.858:1038): avc: denied { write } for pid=14178 comm="syz.4.1876" name="file0" dev="tmpfs" ino=2155 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 662.555046][ T30] audit: type=1400 audit(1759495068.858:1039): avc: denied { open } for pid=14178 comm="syz.4.1876" path="/406/file0" dev="tmpfs" ino=2155 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 663.418626][T14139] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 663.557987][ T5837] Bluetooth: hci5: command tx timeout [ 663.623329][T14139] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 663.640565][T14139] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 663.764325][ T30] audit: type=1400 audit(1759495070.218:1040): avc: denied { setopt } for pid=14192 comm="syz.4.1879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 664.355898][T14208] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 664.396098][T14208] kernel read not supported for file /file2 (pid: 14208 comm: syz.2.1880) [ 664.407154][ T30] audit: type=1800 audit(1759495070.858:1041): pid=14208 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1880" name="file2" dev="mqueue" ino=46896 res=0 errno=0 [ 664.657413][ T5905] usb 7-1: USB disconnect, device number 21 [ 665.406243][T14139] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 665.424794][T14139] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 665.457799][T14139] wireguard: wg0: Could not create IPv4 socket [ 665.631243][ T5837] Bluetooth: hci5: command tx timeout [ 665.639998][T14225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1885'. [ 665.776262][T14139] wireguard: wg1: Could not create IPv4 socket [ 666.258625][T14139] wireguard: wg2: Could not create IPv4 socket [ 666.593198][T14232] tmpfs: Unknown parameter ' ' [ 668.735028][T14246] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 668.923775][T14253] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1892'. [ 669.201322][ T1203] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 669.460444][ T1203] usb 7-1: device descriptor read/64, error -71 [ 669.801221][ T1203] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 669.816614][T14268] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1897'. [ 669.958561][ T1203] usb 7-1: device descriptor read/64, error -71 [ 670.092729][ T1203] usb usb7-port1: attempt power cycle [ 670.991251][ T1203] usb 7-1: new full-speed USB device number 24 using dummy_hcd [ 671.065452][ T1203] usb 7-1: device descriptor read/8, error -71 [ 671.331239][ T1203] usb 7-1: new full-speed USB device number 25 using dummy_hcd [ 671.371713][ T1203] usb 7-1: device descriptor read/8, error -71 [ 671.481526][ T1203] usb usb7-port1: unable to enumerate USB device [ 672.353708][T14289] wg1: entered promiscuous mode [ 672.358596][T14289] wg1: entered allmulticast mode [ 672.873880][T14294] mkiss: ax0: crc mode is auto. [ 673.049827][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 673.060692][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 673.071914][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 673.089174][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 673.099539][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 673.121227][ T5934] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 673.272981][ T5934] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 673.283852][ T5934] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 673.303677][T14300] Failed to initialize the IGMP autojoin socket (err -2) [ 673.304905][ T5934] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 673.385664][ T5934] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 673.414150][ T5934] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 673.431329][ T1203] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 673.442806][ T5934] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 673.456388][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 673.511202][ T5934] usb 3-1: Product: syz [ 673.515396][ T5934] usb 3-1: Manufacturer: syz [ 673.557184][ T5934] cdc_wdm 3-1:1.0: skipping garbage [ 673.564480][ T5934] cdc_wdm 3-1:1.0: skipping garbage [ 673.577923][ T5934] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 673.592782][ T1203] usb 6-1: config 0 has no interfaces? [ 673.596963][ T5934] cdc_wdm 3-1:1.0: Unknown control protocol [ 673.608945][ T1203] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 673.651554][ T1203] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.685725][ T1203] usb 6-1: config 0 descriptor?? [ 673.992387][ T5934] usb 3-1: USB disconnect, device number 63 [ 674.146852][T14300] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 674.165601][T14300] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 674.177152][T14300] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 674.188401][T14300] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 674.302662][ T30] audit: type=1400 audit(1759495080.748:1042): avc: denied { add_name } for pid=14308 comm="syz.4.1908" name="file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 674.302885][ T30] audit: type=1400 audit(1759495080.758:1043): avc: denied { create } for pid=14308 comm="syz.4.1908" name="file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 674.831265][ T5934] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 675.091211][ T5934] usb 5-1: Using ep0 maxpacket: 16 [ 675.153635][ T5837] Bluetooth: hci5: command tx timeout [ 675.155787][ T5934] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 675.225259][ T5934] usb 5-1: config 0 interface 0 has no altsetting 0 [ 675.232878][ T5934] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 675.271399][ T5934] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.290244][ T5934] usb 5-1: config 0 descriptor?? [ 675.705478][ T5934] nzxt-smart2 0003:1E71:2009.000E: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 675.946982][T14300] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 675.989400][T14300] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 676.023478][T14300] wireguard: wg0: Could not create IPv4 socket [ 676.058585][T14300] wireguard: wg1: Could not create IPv4 socket [ 676.111208][ T5934] usb 5-1: USB disconnect, device number 71 [ 676.125543][T14300] wireguard: wg2: Could not create IPv4 socket [ 676.171892][ T5936] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 676.361232][ T5936] usb 7-1: Using ep0 maxpacket: 16 [ 676.379225][ T5936] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 676.399924][ T5891] usb 6-1: USB disconnect, device number 45 [ 676.407882][ T5936] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 676.578002][ T5936] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 676.591678][ T5936] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.825950][ T5936] usb 7-1: config 0 descriptor?? [ 677.172888][T14358] virtio-fs: tag not found [ 677.227508][T14358] fuse: Unknown parameter 'group_¥Ë¿›mN³ 芧\£id' [ 678.638321][ T5936] usbhid 7-1:0.0: can't add hid device: -71 [ 678.669574][ T5936] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 679.115729][ T5936] usb 7-1: USB disconnect, device number 26 [ 679.536291][ T30] audit: type=1326 audit(1759495085.968:1044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.573958][ T30] audit: type=1326 audit(1759495085.968:1045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.600664][ T30] audit: type=1326 audit(1759495085.968:1046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.673901][ T30] audit: type=1326 audit(1759495085.968:1047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.746436][ T30] audit: type=1326 audit(1759495085.968:1048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.795390][ T30] audit: type=1326 audit(1759495085.968:1049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.849569][ T30] audit: type=1326 audit(1759495085.968:1050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.881507][ T30] audit: type=1326 audit(1759495085.968:1051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 679.926763][T14383] Falling back ldisc for ttyprintk. [ 680.002572][ T30] audit: type=1326 audit(1759495085.968:1052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14384 comm="syz.6.1925" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fd52978eec9 code=0x7ffc0000 [ 680.035901][ T30] audit: type=1400 audit(1759495086.338:1053): avc: denied { call } for pid=14384 comm="syz.6.1925" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 680.982332][T13290] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 681.271191][T13290] usb 5-1: Using ep0 maxpacket: 32 [ 681.305306][T13290] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.315673][T13290] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 681.334087][T13290] usb 5-1: New USB device found, idVendor=2040, idProduct=7210, bcdDevice=a4.0c [ 681.748988][T13290] usb 5-1: New USB device strings: Mfr=74, Product=84, SerialNumber=160 [ 681.757431][T13290] usb 5-1: Product: syz [ 681.761628][T13290] usb 5-1: Manufacturer: syz [ 681.766248][T13290] usb 5-1: SerialNumber: syz [ 681.778578][T13290] usb 5-1: config 0 descriptor?? [ 683.172169][T14439] Failed to initialize the IGMP autojoin socket (err -2) [ 683.638743][ T13] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 683.649807][ T13] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 683.678112][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 683.783618][T10852] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 683.793630][T10852] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 683.804164][T10852] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 683.822730][T10852] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 683.830120][T10852] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 683.849701][T14452] Failed to initialize the IGMP autojoin socket (err -2) [ 684.025040][ T5934] usb 5-1: USB disconnect, device number 72 [ 684.544022][ T30] kauditd_printk_skb: 594 callbacks suppressed [ 684.544033][ T30] audit: type=1326 audit(1759495090.998:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.573343][ C1] vkms_vblank_simulate: vblank timer overrun [ 684.596701][ T30] audit: type=1326 audit(1759495091.028:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.620325][ T30] audit: type=1326 audit(1759495091.028:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.643539][ C1] vkms_vblank_simulate: vblank timer overrun [ 684.650568][ T30] audit: type=1326 audit(1759495091.028:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.673766][ C1] vkms_vblank_simulate: vblank timer overrun [ 684.683427][ T30] audit: type=1326 audit(1759495091.028:1652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.706615][ C1] vkms_vblank_simulate: vblank timer overrun [ 684.821616][ T30] audit: type=1326 audit(1759495091.028:1653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.844848][ C1] vkms_vblank_simulate: vblank timer overrun [ 684.855071][ T30] audit: type=1326 audit(1759495091.028:1654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 684.878304][ C1] vkms_vblank_simulate: vblank timer overrun [ 685.318078][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.337742][T14463] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1940'. [ 685.393601][ T30] audit: type=1326 audit(1759495091.028:1655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 685.525656][ T30] audit: type=1326 audit(1759495091.028:1656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 685.708801][ T30] audit: type=1326 audit(1759495091.028:1657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14457 comm="syz.4.1938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x50000 [ 685.711489][ T5837] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 685.871280][ T5837] Bluetooth: hci6: command tx timeout [ 686.071226][ T5936] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 686.287325][T14485] FAULT_INJECTION: forcing a failure. [ 686.287325][T14485] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 686.300635][T14485] CPU: 0 UID: 0 PID: 14485 Comm: syz.6.1944 Not tainted syzkaller #0 PREEMPT(full) [ 686.300658][T14485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 686.300666][T14485] Call Trace: [ 686.300670][T14485] [ 686.300674][T14485] dump_stack_lvl+0x16c/0x1f0 [ 686.300694][T14485] should_fail_ex+0x512/0x640 [ 686.300713][T14485] strncpy_from_user+0x3b/0x2e0 [ 686.300730][T14485] getname_flags.part.0+0x8f/0x550 [ 686.300749][T14485] __x64_sys_rmdir+0xb0/0x110 [ 686.300762][T14485] do_syscall_64+0xcd/0x4e0 [ 686.300779][T14485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 686.300790][T14485] RIP: 0033:0x7fd52978eec9 [ 686.300800][T14485] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 686.300810][T14485] RSP: 002b:00007fd52a688038 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 686.300821][T14485] RAX: ffffffffffffffda RBX: 00007fd5299e6090 RCX: 00007fd52978eec9 [ 686.300829][T14485] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 686.300836][T14485] RBP: 00007fd52a688090 R08: 0000000000000000 R09: 0000000000000000 [ 686.300842][T14485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 686.300849][T14485] R13: 00007fd5299e6128 R14: 00007fd5299e6090 R15: 00007ffc167877b8 [ 686.300862][T14485] [ 686.461377][ T5936] usb 6-1: Using ep0 maxpacket: 32 [ 686.628835][ T1158] Bluetooth: hci5: Frame reassembly failed (-84) [ 686.667585][T14452] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 686.675038][ T1158] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 686.695420][T14452] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 686.726790][ T3590] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 686.742843][T14452] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 686.750487][T14489] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1945'. [ 686.762680][ T5936] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 686.774012][ T5936] usb 6-1: can't read configurations, error -61 [ 686.775767][T14452] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 686.790559][T14489] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1945'. [ 686.981490][ T5936] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 687.582549][ T5936] usb 6-1: Using ep0 maxpacket: 32 [ 687.620767][ T5936] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 687.708160][T14505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1949'. [ 687.816435][ T5936] usb 6-1: can't read configurations, error -61 [ 687.992929][ T5145] Bluetooth: hci6: command tx timeout [ 688.183006][ T5936] usb usb6-port1: attempt power cycle [ 688.521257][ T5936] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 688.611244][ T5837] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 688.630807][ T5936] usb 6-1: Using ep0 maxpacket: 32 [ 688.643009][ T5936] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 688.680360][ T5936] usb 6-1: can't read configurations, error -61 [ 688.821356][ T5936] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 688.862798][ T5936] usb 6-1: device descriptor read/8, error -71 [ 688.982436][ T5936] usb usb6-port1: unable to enumerate USB device [ 689.815917][T14452] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 689.819694][ T5891] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 689.840920][T14452] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 689.857977][T14452] wireguard: wg0: Could not create IPv4 socket [ 689.865633][T14452] wireguard: wg1: Could not create IPv4 socket [ 689.873094][T14452] wireguard: wg2: Could not create IPv4 socket [ 690.101621][ T5891] usb 7-1: Using ep0 maxpacket: 32 [ 690.112065][ T5891] usb 7-1: config 0 has an invalid interface number: 83 but max is 0 [ 690.120143][ T5891] usb 7-1: config 0 has no interface number 0 [ 690.141267][ T5891] usb 7-1: config 0 interface 83 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 194 [ 690.163142][ T5891] usb 7-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 690.188768][ T5891] usb 7-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=d8.11 [ 690.198129][ T5891] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 690.206554][ T5891] usb 7-1: Product: syz [ 690.210701][ T5891] usb 7-1: Manufacturer: syz [ 690.215303][ T5891] usb 7-1: SerialNumber: syz [ 690.221042][ T5891] usb 7-1: config 0 descriptor?? [ 690.226461][T14535] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 690.233628][ T1203] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 690.241249][ T5936] usb 3-1: new low-speed USB device number 64 using dummy_hcd [ 690.383592][ T5891] redrat3 7-1:0.83: Couldn't find all endpoints [ 690.460444][ T5891] usb 7-1: USB disconnect, device number 27 [ 690.543039][ T5936] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 690.550805][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 690.561782][ T1203] usb 6-1: config 7 has an invalid interface number: 101 but max is 0 [ 690.570305][ T5936] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 690.582197][ T1203] usb 6-1: config 7 has no interface number 0 [ 690.588393][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 690.600158][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 690.612711][ T1203] usb 6-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 690.621830][ T5936] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 690.629199][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 690.639881][ T1203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 690.647880][ T1203] usb 6-1: Product: syz [ 690.652423][ T1203] usb 6-1: Manufacturer: syz [ 690.657004][ T1203] usb 6-1: SerialNumber: syz [ 690.661607][ T5936] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 690.674922][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 690.686062][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 690.698041][ T5936] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 690.705465][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 690.716158][ T5936] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 690.727806][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 690.739020][ T5936] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 690.753042][ T5936] usb 3-1: string descriptor 0 read error: -22 [ 690.759273][ T5936] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 690.768358][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 690.780243][ T5936] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 691.031873][ T5936] usb 3-1: USB disconnect, device number 64 [ 691.103971][ T1203] as10x_usb: device has been detected [ 691.114380][ T1203] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 691.164520][ T1203] usb 6-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 691.302400][ T1203] as10x_usb: error during firmware upload part1 [ 691.310712][ T1203] Registered device Elgato EyeTV DTT Deluxe [ 691.315874][ T1203] usb 6-1: USB disconnect, device number 50 [ 691.345483][ T1203] Unregistered device Elgato EyeTV DTT Deluxe [ 691.346681][ T1203] as10x_usb: device has been disconnected [ 691.610444][T14555] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1960'. [ 693.070040][T14561] mkiss: ax0: crc mode is auto. [ 693.377118][ T1203] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 693.511982][ T5936] usb 7-1: new full-speed USB device number 28 using dummy_hcd [ 693.555104][ T1203] usb 6-1: device descriptor read/64, error -71 [ 693.686144][ T5936] usb 7-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 693.725227][ T5936] usb 7-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 693.769876][ T5936] usb 7-1: Product: syz [ 693.787793][ T5936] usb 7-1: Manufacturer: syz [ 693.807865][ T5936] usb 7-1: SerialNumber: syz [ 693.831224][ T1203] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 693.867751][ T5936] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 694.021223][ T1203] usb 6-1: device descriptor read/64, error -71 [ 694.131792][ T1203] usb usb6-port1: attempt power cycle [ 694.231633][ T5936] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 694.242080][ T5936] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 694.472060][ T1203] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 694.491615][ T1203] usb 6-1: device descriptor read/8, error -71 [ 694.731234][ T1203] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 694.767760][ T1203] usb 6-1: device descriptor read/8, error -71 [ 694.796109][T14584] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1966'. [ 694.842344][T14586] FAULT_INJECTION: forcing a failure. [ 694.842344][T14586] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 694.865195][T14586] CPU: 0 UID: 0 PID: 14586 Comm: syz.4.1968 Not tainted syzkaller #0 PREEMPT(full) [ 694.865220][T14586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 694.865229][T14586] Call Trace: [ 694.865235][T14586] [ 694.865243][T14586] dump_stack_lvl+0x16c/0x1f0 [ 694.865275][T14586] should_fail_ex+0x512/0x640 [ 694.865305][T14586] _copy_from_iter+0x29f/0x1720 [ 694.865337][T14586] ? rcu_is_watching+0x12/0xc0 [ 694.865368][T14586] ? __pfx__copy_from_iter+0x10/0x10 [ 694.865395][T14586] ? __asan_memset+0x23/0x50 [ 694.865412][T14586] ? __build_skb_around+0x278/0x3b0 [ 694.865435][T14586] ? is_vmalloc_addr+0x86/0xa0 [ 694.865465][T14586] netlink_sendmsg+0x820/0xdd0 [ 694.865498][T14586] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.865533][T14586] __sys_sendto+0x4a3/0x520 [ 694.865557][T14586] ? __pfx___sys_sendto+0x10/0x10 [ 694.865600][T14586] ? ksys_write+0x1ac/0x250 [ 694.865620][T14586] ? __pfx_ksys_write+0x10/0x10 [ 694.865641][T14586] __x64_sys_sendto+0xe0/0x1c0 [ 694.865664][T14586] ? do_syscall_64+0x91/0x4e0 [ 694.865688][T14586] ? lockdep_hardirqs_on+0x7c/0x110 [ 694.865712][T14586] do_syscall_64+0xcd/0x4e0 [ 694.865739][T14586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.865763][T14586] RIP: 0033:0x7fe74598eec9 [ 694.865777][T14586] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 694.865794][T14586] RSP: 002b:00007fe746754038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 694.865811][T14586] RAX: ffffffffffffffda RBX: 00007fe745be5fa0 RCX: 00007fe74598eec9 [ 694.865823][T14586] RDX: 0000000000010a73 RSI: 0000200000000000 RDI: 0000000000000003 [ 694.865834][T14586] RBP: 00007fe746754090 R08: 0000000000000000 R09: 4b6ae4f95a5de35b [ 694.865845][T14586] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 694.865855][T14586] R13: 00007fe745be6038 R14: 00007fe745be5fa0 R15: 00007ffde4917808 [ 694.865879][T14586] [ 694.921716][ T1203] usb usb6-port1: unable to enumerate USB device [ 695.021007][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 695.088242][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 695.123509][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 695.144210][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 695.158131][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 695.206269][T14591] Failed to initialize the IGMP autojoin socket (err -2) [ 695.242601][T14596] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1971'. [ 695.317318][ C1] vcan0: j1939_tp_rxtimer: 0xffff888055314000: rx timeout, send abort [ 695.327727][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888055314000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 695.336123][ C0] vcan0: j1939_tp_rxtimer: 0xffff888046f72400: rx timeout, send abort [ 695.350482][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888046f72400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 695.373450][ T5904] usb 7-1: USB disconnect, device number 28 [ 697.231397][ T5145] Bluetooth: hci5: command tx timeout [ 697.317789][T14615] netlink: 256 bytes leftover after parsing attributes in process `syz.6.1974'. [ 697.330054][T14615] netlink: 72 bytes leftover after parsing attributes in process `syz.6.1974'. [ 698.274128][T14591] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 698.340486][T14591] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 698.381820][T14591] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 698.410444][T14591] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 698.614375][T14636] fuse: Bad value for 'group_id' [ 698.619342][T14636] fuse: Bad value for 'group_id' [ 698.691511][ T5891] usb 3-1: new full-speed USB device number 65 using dummy_hcd [ 698.873764][ T5891] usb 3-1: config 7 has an invalid interface number: 101 but max is 0 [ 698.893835][ T5891] usb 3-1: config 7 has no interface number 0 [ 698.902621][ T5891] usb 3-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 698.922582][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.935533][ T5891] usb 3-1: Product: syz [ 698.939728][T14650] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 698.939799][ T5891] usb 3-1: Manufacturer: syz [ 698.946242][T14650] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 698.949287][T14650] vhci_hcd vhci_hcd.0: Device attached [ 698.961274][ T5891] usb 3-1: SerialNumber: syz [ 698.978294][T14650] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(9) [ 698.985224][T14650] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 698.993484][T14650] vhci_hcd vhci_hcd.0: Device attached [ 699.000021][T14650] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 699.008314][ T5904] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 699.019695][T14650] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(14) [ 699.026288][T14650] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 699.036347][T14650] vhci_hcd vhci_hcd.0: Device attached [ 699.044341][T14654] vhci_hcd: connection closed [ 699.045324][T14658] vhci_hcd: connection closed [ 699.050940][ T9742] vhci_hcd: stop threads [ 699.051051][T14651] vhci_hcd: connection closed [ 699.055789][ T9742] vhci_hcd: release socket [ 699.069446][ T9742] vhci_hcd: disconnect device [ 699.080319][ T9742] vhci_hcd: stop threads [ 699.084712][ T9742] vhci_hcd: release socket [ 699.090540][ T9742] vhci_hcd: disconnect device [ 699.095569][ T9742] vhci_hcd: stop threads [ 699.099847][ T9742] vhci_hcd: release socket [ 699.104464][ T9742] vhci_hcd: disconnect device [ 699.131247][ T5934] vhci_hcd: vhci_device speed not set [ 699.162987][ T5904] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 699.175163][ T5904] usb 7-1: config 0 has no interfaces? [ 699.180716][ T5904] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 699.180742][T14591] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 699.208634][ T5904] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.216870][T14591] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 699.221987][ T5904] usb 7-1: config 0 descriptor?? [ 699.235633][T14591] wireguard: wg0: Could not create IPv4 socket [ 699.245975][T14591] wireguard: wg1: Could not create IPv4 socket [ 699.254070][T14591] wireguard: wg2: Could not create IPv4 socket [ 699.734220][ T5891] as10x_usb: device has been detected [ 699.739918][ T5891] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 699.753555][ T5891] usb 3-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 699.965655][ T5891] as10x_usb: error during firmware upload part1 [ 699.972566][ T5891] Registered device Elgato EyeTV DTT Deluxe [ 699.974664][ T5891] usb 3-1: USB disconnect, device number 65 [ 699.994329][ T5891] Unregistered device Elgato EyeTV DTT Deluxe [ 699.995022][ T5891] as10x_usb: device has been disconnected [ 701.787271][ T5934] usb 7-1: USB disconnect, device number 29 [ 701.910665][T14687] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1990'. [ 702.889704][T14702] netlink: 88 bytes leftover after parsing attributes in process `syz.5.1992'. [ 702.911905][ T30] kauditd_printk_skb: 1883 callbacks suppressed [ 702.911917][ T30] audit: type=1400 audit(1759495109.368:3541): avc: denied { map } for pid=14701 comm="syz.4.1994" path="socket:[49928]" dev="sockfs" ino=49928 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 702.958200][ T30] audit: type=1400 audit(1759495109.398:3542): avc: denied { read accept } for pid=14701 comm="syz.4.1994" path="socket:[49928]" dev="sockfs" ino=49928 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 702.981988][ C1] vkms_vblank_simulate: vblank timer overrun [ 703.071909][T14702] batadv1: entered promiscuous mode [ 703.078461][T14702] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 704.615478][T14715] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1996'. [ 704.645233][T14715] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1996'. [ 705.123534][T14728] libceph: resolve '0..' (ret=-3): failed [ 705.251226][ T5934] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 705.432972][ T5934] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 705.451165][ T5934] usb 5-1: config 0 has no interfaces? [ 705.461202][ T5934] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 705.470380][ T5934] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.501053][ T5934] usb 5-1: config 0 descriptor?? [ 706.396012][ T30] audit: type=1400 audit(1759495112.848:3543): avc: denied { map } for pid=14733 comm="syz.5.2001" path="/dev/comedi4" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 706.578081][ T5837] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 706.586508][ T5837] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 706.813852][ T5837] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 706.823971][ T5837] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 706.831505][ T5837] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 706.861398][T14740] mkiss: ax0: crc mode is auto. [ 706.872130][T14744] Failed to initialize the IGMP autojoin socket (err -2) [ 706.879784][ T30] audit: type=1400 audit(1759495113.328:3544): avc: denied { listen } for pid=14735 comm="syz.2.2003" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 707.342066][T14744] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 707.352578][T14744] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 707.364145][T14744] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 707.374334][T14744] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 707.446331][T14759] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2004'. [ 707.554690][ T1203] usb 5-1: USB disconnect, device number 73 [ 708.201485][ T30] audit: type=1400 audit(1759495114.278:3545): avc: denied { mount } for pid=14763 comm="syz.4.2006" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 708.911228][ T5145] Bluetooth: hci5: command tx timeout [ 709.463235][T14780] SELinux: Context system_u:object_r: is not valid (left unmapped). [ 710.380705][T14744] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 710.467875][T14744] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 710.707691][T14744] wireguard: wg0: Could not create IPv4 socket [ 710.779984][T14805] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28944 sclass=netlink_route_socket pid=14805 comm=syz.5.2013 [ 710.796775][T14805] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2013'. [ 710.991201][ T5145] Bluetooth: hci5: command 0x041b tx timeout [ 711.174557][T14744] wireguard: wg1: Could not create IPv4 socket [ 711.194022][T14744] wireguard: wg2: Could not create IPv4 socket [ 711.291193][ T5905] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 711.451624][ T5905] usb 7-1: Using ep0 maxpacket: 32 [ 711.471537][ T5905] usb 7-1: config 0 has an invalid interface number: 8 but max is 0 [ 711.479676][ T5905] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 711.516629][ T5905] usb 7-1: config 0 has no interface number 0 [ 711.545259][ T5905] usb 7-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 711.589468][ T5905] usb 7-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 711.603978][ T5905] usb 7-1: config 0 interface 8 has no altsetting 0 [ 711.711662][ T5905] usb 7-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 711.721411][ T5905] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.766536][ T5905] usb 7-1: Product: syz [ 711.780063][ T5905] usb 7-1: Manufacturer: syz [ 711.805387][ T5905] usb 7-1: SerialNumber: syz [ 711.833800][ T5905] usb 7-1: config 0 descriptor?? [ 711.882426][T14811] bridge_slave_0: left allmulticast mode [ 711.888176][T14811] bridge_slave_0: left promiscuous mode [ 711.893970][T14811] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.986813][T14813] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2017'. [ 712.200599][ T30] audit: type=1326 audit(1759495118.648:3546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.201900][T14811] bridge_slave_1: left allmulticast mode [ 712.233783][T14811] bridge_slave_1: left promiscuous mode [ 712.238676][ T30] audit: type=1326 audit(1759495118.648:3547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.239660][T14811] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.272812][ T30] audit: type=1326 audit(1759495118.688:3548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=79 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.301255][T14811] bond0: (slave bond_slave_0): Releasing backup interface [ 712.304738][ T30] audit: type=1326 audit(1759495118.688:3549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.332059][ T30] audit: type=1326 audit(1759495118.688:3550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.358049][ T30] audit: type=1326 audit(1759495118.688:3551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.358914][T14811] bond0: (slave bond_slave_1): Releasing backup interface [ 712.393200][ T30] audit: type=1326 audit(1759495118.688:3552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.418972][T14803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.427718][T14803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.436934][ T30] audit: type=1326 audit(1759495118.688:3553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe74598eec9 code=0x7ffc0000 [ 712.461239][ T30] audit: type=1326 audit(1759495118.688:3554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14814 comm="syz.4.2018" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe74598eacb code=0x7ffc0000 [ 712.487942][T14811] team0: Port device team_slave_0 removed [ 712.525413][T14811] team0: Port device team_slave_1 removed [ 712.532329][T14811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 712.546842][T14811] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 712.556377][T14811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 712.564478][T14811] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 712.573165][T14811] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 712.600411][T14812] team0: Mode changed to "loadbalance" [ 712.801304][ T1203] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 712.951268][ T1203] usb 5-1: Using ep0 maxpacket: 8 [ 712.957731][ T1203] usb 5-1: config 0 has an invalid interface number: 246 but max is 0 [ 712.966048][ T1203] usb 5-1: config 0 has no interface number 0 [ 712.973973][ T1203] usb 5-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 712.983125][ T1203] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.991101][ T1203] usb 5-1: Product: syz [ 712.995365][ T1203] usb 5-1: Manufacturer: syz [ 712.999966][ T1203] usb 5-1: SerialNumber: syz [ 713.006213][ T1203] usb 5-1: config 0 descriptor?? [ 713.045689][ T1203] msi2500 5-1:0.246: Registered as swradio24 [ 713.052718][ T1203] msi2500 5-1:0.246: SDR API is still slightly experimental and functionality changes may follow [ 713.233657][ T1203] usb 5-1: USB disconnect, device number 74 [ 713.569140][ T5905] ath6kl: Failed to submit usb control message: -71 [ 713.601512][ T5905] ath6kl: unable to send the bmi data to the device: -71 [ 713.612491][ T5905] ath6kl: Unable to send get target info: -71 [ 713.627010][ T5905] ath6kl: Failed to init ath6kl core: -71 [ 713.659244][ T5905] ath6kl_usb 7-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 713.712722][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 713.712763][ T30] audit: type=1400 audit(1759495120.168:3587): avc: denied { bind } for pid=14831 comm="syz.6.2023" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 713.747859][ T30] audit: type=1400 audit(1759495120.198:3588): avc: denied { accept } for pid=14831 comm="syz.6.2023" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 713.767467][ T30] audit: type=1400 audit(1759495120.218:3589): avc: denied { ioctl } for pid=14831 comm="syz.6.2023" path="socket:[51459]" dev="sockfs" ino=51459 ioctlcmd=0x5828 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 713.850744][ T5905] usb 7-1: USB disconnect, device number 30 [ 714.195618][ T30] audit: type=1400 audit(1759495120.648:3590): avc: denied { create } for pid=14839 comm="syz.5.2027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 714.234144][ T30] audit: type=1400 audit(1759495120.678:3591): avc: denied { write } for pid=14839 comm="syz.5.2027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 714.254763][ C0] vkms_vblank_simulate: vblank timer overrun [ 714.319587][ T30] audit: type=1400 audit(1759495120.768:3592): avc: denied { getopt } for pid=14845 comm="syz.5.2028" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 714.531295][ T5905] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 714.705249][ T5905] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 714.715616][ T5905] usb 5-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 714.729126][ T5905] usb 5-1: config 2 interface 0 has no altsetting 0 [ 714.744225][ T5905] usb 5-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 714.754425][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 714.762550][ T5905] usb 5-1: SerialNumber: syz [ 715.165769][ T30] audit: type=1400 audit(1759495121.608:3593): avc: denied { read write } for pid=14863 comm="syz.6.2033" name="loop-control" dev="devtmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 715.599613][ T30] audit: type=1400 audit(1759495121.608:3594): avc: denied { open } for pid=14863 comm="syz.6.2033" path="/dev/loop-control" dev="devtmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 715.624562][ C0] vkms_vblank_simulate: vblank timer overrun [ 715.646661][ T30] audit: type=1400 audit(1759495121.608:3595): avc: denied { ioctl } for pid=14863 comm="syz.6.2033" path="/dev/loop-control" dev="devtmpfs" ino=645 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 715.672974][ C0] vkms_vblank_simulate: vblank timer overrun [ 715.690985][ T5905] ims_pcu 5-1:2.0: Union descriptor too short (2 vs 5) [ 715.697986][ T5905] ims_pcu 5-1:2.0: probe with driver ims_pcu failed with error -22 [ 715.712922][ T5905] usb 5-1: USB disconnect, device number 75 [ 717.393059][T14878] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2037'. [ 717.511304][ T30] audit: type=1326 audit(1759495123.948:3596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14881 comm="syz.5.2036" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ab978eec9 code=0x7ffc0000 [ 717.680601][ T5145] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 717.691913][ T5145] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 717.700550][ T5145] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 717.711650][ T5145] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 717.721396][ T5145] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 717.891448][T14884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 718.086552][T14886] Failed to initialize the IGMP autojoin socket (err -2) [ 718.131290][T14884] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2038'. [ 719.791219][ T5145] Bluetooth: hci5: command tx timeout [ 719.901982][ T5905] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 720.051199][ T5905] usb 6-1: device descriptor read/64, error -71 [ 720.134384][T14886] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 720.144904][T14886] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 720.155898][T14886] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 720.166943][T14886] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 720.301612][ T5905] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 720.461254][ T5905] usb 6-1: device descriptor read/64, error -71 [ 720.639032][ T5905] usb usb6-port1: attempt power cycle [ 721.071334][ T5905] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 721.164134][ T5905] usb 6-1: device descriptor read/8, error -71 [ 721.771213][ T5905] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 721.911347][ T5145] Bluetooth: hci5: command tx timeout [ 722.056876][ T5905] usb 6-1: device not accepting address 58, error -71 [ 722.102902][ T5905] usb usb6-port1: unable to enumerate USB device [ 722.137434][T14886] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 722.197723][T14886] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 722.217087][T14886] wireguard: wg0: Could not create IPv4 socket [ 722.339712][T14886] wireguard: wg1: Could not create IPv4 socket [ 722.409974][T14886] wireguard: wg2: Could not create IPv4 socket [ 722.911407][ T5891] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 723.085812][ T5891] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 723.113798][ T5891] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 723.123145][ T5891] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 723.132576][ T5891] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 723.182034][ T5891] usb 6-1: config 0 descriptor?? [ 724.104077][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 724.104088][ T30] audit: type=1400 audit(1759495130.558:3608): avc: denied { write } for pid=14971 comm="syz.2.2062" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 [ 724.161447][ T30] audit: type=1400 audit(1759495130.598:3609): avc: denied { open } for pid=14971 comm="syz.2.2062" path="/354/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 [ 724.432005][ T5905] usb 5-1: new full-speed USB device number 76 using dummy_hcd [ 724.583530][ T5905] usb 5-1: config index 0 descriptor too short (expected 19492, got 36) [ 724.593077][ T5905] usb 5-1: config 0 has too many interfaces: 36, using maximum allowed: 32 [ 724.602683][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 36 [ 724.671617][ T5905] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 724.702065][T14983] bridge1: entered promiscuous mode [ 724.707404][ T5905] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 724.727038][ T5905] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 724.762252][ T5905] usb 5-1: New USB device found, idVendor=046d, idProduct=c225, bcdDevice= 0.00 [ 724.773121][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.788039][ T5905] usb 5-1: config 0 descriptor?? [ 725.112118][ T5905] usbhid 5-1:0.0: can't add hid device: -71 [ 725.132281][ T5905] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 725.148160][ T5905] usb 5-1: USB disconnect, device number 76 [ 725.417894][T14997] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2067'. [ 725.696610][ T5891] usb 6-1: USB disconnect, device number 59 [ 726.729954][T15023] vimc link validate: Scaler:src:16x16 (0x33424752, 4, 0, 6, 2) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 727.348022][T15031] bridge4: entered promiscuous mode [ 727.539455][T15018] IPv6: Can't replace route, no match found [ 728.977628][T15046] autofs: Bad value for 'fd' [ 729.096937][T15054] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 729.168150][T15054] team0: Unable to change to the same mode the team is in [ 729.186867][T15054] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2082'. [ 729.968829][ T5837] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 729.979671][ T5837] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 729.988865][ T5837] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 729.997950][ T5837] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 730.006057][ T5837] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 730.035803][T15062] Failed to initialize the IGMP autojoin socket (err -2) [ 732.032851][ T5145] Bluetooth: hci5: command tx timeout [ 732.542585][T15062] netdevsim netdevsim7 netdevsim0: renamed from eth9 [ 732.561854][T15095] netlink: 'syz.5.2091': attribute type 10 has an invalid length. [ 732.590615][T15062] netdevsim netdevsim7 netdevsim1: renamed from eth10 [ 732.638872][T15062] netdevsim netdevsim7 netdevsim2: renamed from eth11 [ 732.744962][T15102] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2094'. [ 732.760283][T15104] netlink: 104 bytes leftover after parsing attributes in process `syz.6.2094'. [ 732.785228][T15062] netdevsim netdevsim7 netdevsim3: renamed from eth12 [ 732.822328][T15101] FAULT_INJECTION: forcing a failure. [ 732.822328][T15101] name failslab, interval 1, probability 0, space 0, times 0 [ 732.871189][T15101] CPU: 0 UID: 0 PID: 15101 Comm: syz.5.2093 Not tainted syzkaller #0 PREEMPT(full) [ 732.871214][T15101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 732.871224][T15101] Call Trace: [ 732.871230][T15101] [ 732.871237][T15101] dump_stack_lvl+0x16c/0x1f0 [ 732.871264][T15101] should_fail_ex+0x512/0x640 [ 732.871288][T15101] ? fs_reclaim_acquire+0xae/0x150 [ 732.871311][T15101] should_failslab+0xc2/0x120 [ 732.871336][T15101] __kmalloc_noprof+0xdd/0x880 [ 732.871360][T15101] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 732.871391][T15101] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 732.871415][T15101] tomoyo_realpath_from_path+0xc2/0x6e0 [ 732.871442][T15101] ? tomoyo_profile+0x47/0x60 [ 732.871460][T15101] tomoyo_path_number_perm+0x245/0x580 [ 732.871479][T15101] ? tomoyo_path_number_perm+0x237/0x580 [ 732.871501][T15101] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 732.871524][T15101] ? find_held_lock+0x2b/0x80 [ 732.871567][T15101] ? find_held_lock+0x2b/0x80 [ 732.871590][T15101] ? hook_file_ioctl_common+0x145/0x410 [ 732.871612][T15101] ? __fget_files+0x20e/0x3c0 [ 732.871636][T15101] security_file_ioctl+0x9b/0x240 [ 732.871662][T15101] __x64_sys_ioctl+0xb7/0x210 [ 732.871689][T15101] do_syscall_64+0xcd/0x4e0 [ 732.871716][T15101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.871733][T15101] RIP: 0033:0x7f8ab978eec9 [ 732.871748][T15101] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 732.871764][T15101] RSP: 002b:00007f8aba53f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 732.871781][T15101] RAX: ffffffffffffffda RBX: 00007f8ab99e5fa0 RCX: 00007f8ab978eec9 [ 732.871793][T15101] RDX: 0000200000000000 RSI: 00000000800448d2 RDI: 0000000000000004 [ 732.871809][T15101] RBP: 00007f8aba53f090 R08: 0000000000000000 R09: 0000000000000000 [ 732.871820][T15101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.871829][T15101] R13: 00007f8ab99e6038 R14: 00007f8ab99e5fa0 R15: 00007fff032f9e68 [ 732.871853][T15101] [ 732.871884][T15101] ERROR: Out of memory at tomoyo_realpath_from_path. [ 733.211886][T15115] netlink: 'syz.4.2097': attribute type 4 has an invalid length. [ 733.406918][T15124] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2096'. [ 733.780971][T15118] block nbd2: shutting down sockets [ 734.111186][ T5145] Bluetooth: hci5: command tx timeout [ 734.591391][ T31] INFO: task kworker/u8:0:12 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 734.824090][ T30] audit: type=1400 audit(1759495141.278:3610): avc: denied { write } for pid=5807 comm="syz-executor" path="pipe:[5186]" dev="pipefs" ino=5186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 734.851080][ T31] Not tainted syzkaller #0 [ 734.856178][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 734.974170][ T31] task:kworker/u8:0 state:D stack:23544 pid:12 tgid:12 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 735.041173][ T31] Workqueue: events_unbound netfs_write_collection_worker [ 735.048336][ T31] Call Trace: [ 735.081235][ T31] [ 735.084252][ T31] __schedule+0x1190/0x5de0 [ 735.088829][ T31] ? __lock_acquire+0x62e/0x1ce0 [ 735.098034][ T31] ? __pfx___schedule+0x10/0x10 [ 735.103110][ T31] ? find_held_lock+0x2b/0x80 [ 735.107854][ T31] ? schedule+0x2d7/0x3a0 [ 735.112272][ T31] schedule+0xe7/0x3a0 [ 735.116402][ T31] netfs_wait_for_in_progress_stream+0x17a/0x440 [ 735.125523][ T31] ? __pfx_netfs_wait_for_in_progress_stream+0x10/0x10 [ 735.134231][ T31] ? finish_task_switch.isra.0+0x221/0xc10 [ 735.141960][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 735.148109][ T31] ? rcu_is_watching+0x12/0xc0 [ 735.152915][ T31] ? trace_sched_exit_tp+0xd1/0x120 [ 735.158118][ T31] netfs_retry_writes+0x1394/0x19c0 [ 735.163444][ T31] ? ret_from_fork_asm+0x1a/0x30 [ 735.168453][ T31] ? __pfx_netfs_retry_writes+0x10/0x10 [ 735.174060][ T31] ? __pfx___schedule+0x10/0x10 [ 735.178918][ T31] ? check_path.constprop.0+0x24/0x50 [ 735.184458][ T31] netfs_write_collection+0x19ee/0x36d0 [ 735.190094][ T31] netfs_write_collection_worker+0xea/0x1d0 [ 735.196044][ T31] process_one_work+0x9cf/0x1b70 [ 735.201461][ T31] ? __pfx_process_one_work+0x10/0x10 [ 735.206903][ T31] ? assign_work+0x1a0/0x250 [ 735.211632][ T31] worker_thread+0x6c8/0xf10 [ 735.216239][ T31] ? __pfx_worker_thread+0x10/0x10 [ 735.221418][ T31] kthread+0x3c2/0x780 [ 735.225515][ T31] ? __pfx_kthread+0x10/0x10 [ 735.230114][ T31] ? rcu_is_watching+0x12/0xc0 [ 735.238895][ T31] ? __pfx_kthread+0x10/0x10 [ 735.245576][ T31] ret_from_fork+0x56a/0x730 [ 735.250231][ T31] ? __pfx_kthread+0x10/0x10 [ 735.255744][ T31] ret_from_fork_asm+0x1a/0x30 [ 735.260579][ T31] [ 735.264009][ T31] [ 735.264009][ T31] Showing all locks held in the system: [ 735.341244][ T31] 2 locks held by kworker/u8:0/12: [ 735.353856][ T31] #0: ffff88801b069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 735.411194][ T31] #1: ffffc90000117d10 ((work_completion)(&rreq->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 735.437458][ T31] 1 lock held by khungtaskd/31: [ 735.451260][ T31] #0: ffffffff8e1c4120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 735.475216][ T31] 3 locks held by kworker/u8:6/1158: [ 735.484004][ T31] #0: ffff88801b069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 735.509316][ T31] #1: ffffc90003d6fd10 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 735.541265][ T31] #2: ffffffff8fedd008 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 735.550619][ T31] 3 locks held by kworker/0:3/5904: [ 735.573506][ T31] #0: ffff88801b051948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 735.621343][ T31] #1: ffffc9000523fd10 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 735.640776][ T31] #2: ffff888032c0b240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1bb/0x2e80 [ 735.662927][ T31] 3 locks held by kworker/0:5/5934: [ 735.671132][ T31] #0: ffff88801b051948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 735.681757][ T31] #1: ffffc900052dfd10 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 735.692826][ T31] #2: ffffffff8e1cf6b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 735.702985][ T31] 2 locks held by syz-executor/8875: [ 735.708273][ T31] #0: ffffffff8fedd008 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 735.717924][ T31] #1: ffffffff8e1cf6b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 735.728023][ T31] 1 lock held by syz.2.996/10475: [ 735.733279][ T31] #0: ffffffff8fedd008 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 735.742502][ T31] 1 lock held by syz.3.1624/12996: [ 735.747626][ T31] #0: ffff888054d59e70 (&ctx->wb_lock){+.+.}-{4:4}, at: netfs_writepages+0xba/0x920 [ 735.757366][ T31] 2 locks held by getty/14104: [ 735.762161][ T31] #0: ffff88814da150a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 735.772083][ T31] #1: ffffc900031402f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 735.782403][ T31] 4 locks held by syz-executor/15062: [ 735.787776][ T31] #0: ffff888027b38dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 735.797598][ T31] #1: ffff888027b380b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 735.807297][ T31] #2: ffffffff901457c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 735.817936][ T31] #3: ffff88802506d338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 [ 735.827507][ T31] 1 lock held by syz.6.2102/15141: [ 735.832696][ T31] #0: ffffffff8fedd008 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 735.852635][ T31] [ 735.854974][ T31] ============================================= [ 735.854974][ T31] [ 735.867480][ T31] NMI backtrace for cpu 0 [ 735.867505][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 735.867526][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 735.867536][ T31] Call Trace: [ 735.867542][ T31] [ 735.867550][ T31] dump_stack_lvl+0x116/0x1f0 [ 735.867580][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 735.867598][ T31] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 735.867622][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 735.867641][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 735.867663][ T31] watchdog+0xf3f/0x1170 [ 735.867690][ T31] ? rcu_is_watching+0x12/0xc0 [ 735.867715][ T31] ? __pfx_watchdog+0x10/0x10 [ 735.867736][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 735.867761][ T31] ? __kthread_parkme+0x19e/0x250 [ 735.867780][ T31] ? __pfx_watchdog+0x10/0x10 [ 735.867802][ T31] kthread+0x3c2/0x780 [ 735.867822][ T31] ? __pfx_kthread+0x10/0x10 [ 735.867843][ T31] ? rcu_is_watching+0x12/0xc0 [ 735.867867][ T31] ? __pfx_kthread+0x10/0x10 [ 735.867887][ T31] ret_from_fork+0x56a/0x730 [ 735.867905][ T31] ? __pfx_kthread+0x10/0x10 [ 735.867925][ T31] ret_from_fork_asm+0x1a/0x30 [ 735.867958][ T31] [ 735.867978][ T31] Sending NMI from CPU 0 to CPUs 1: [ 735.993668][ C1] NMI backtrace for cpu 1 [ 735.993687][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 735.993703][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 735.993712][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 735.993735][ C1] Code: ae 60 02 e9 d3 09 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 2e 1e 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 735.993748][ C1] RSP: 0018:ffffc90000197df8 EFLAGS: 000002c6 [ 735.993761][ C1] RAX: 00000000036d8baf RBX: 0000000000000001 RCX: ffffffff8b4bda89 [ 735.993776][ C1] RDX: 0000000000000000 RSI: ffffffff8d820d97 RDI: ffffffff8bd011c0 [ 735.993785][ C1] RBP: ffffed1003bd4490 R08: 0000000000000001 R09: ffffed10170e6655 [ 735.993795][ C1] R10: ffff8880b87332ab R11: 0000000000000000 R12: 0000000000000001 [ 735.993803][ C1] R13: ffff88801dea2480 R14: ffffffff905f3590 R15: 0000000000000000 [ 735.993814][ C1] FS: 0000000000000000(0000) GS:ffff888124f85000(0000) knlGS:0000000000000000 [ 735.993828][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 735.993837][ C1] CR2: 000020000001e000 CR3: 000000000df82000 CR4: 00000000003526f0 [ 735.993847][ C1] Call Trace: [ 735.993852][ C1] [ 735.993857][ C1] default_idle+0x13/0x20 [ 735.993871][ C1] default_idle_call+0x6c/0xb0 [ 735.993883][ C1] do_idle+0x38d/0x500 [ 735.993904][ C1] ? __pfx_do_idle+0x10/0x10 [ 735.993921][ C1] ? trace_sched_exit_tp+0x2f/0x120 [ 735.993941][ C1] cpu_startup_entry+0x4f/0x60 [ 735.993958][ C1] start_secondary+0x21d/0x2b0 [ 735.993973][ C1] ? __pfx_start_secondary+0x10/0x10 [ 735.993988][ C1] common_startup_64+0x13e/0x148 [ 735.994009][ C1] [ 735.995135][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 736.171026][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 736.180169][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 736.190214][ T31] Call Trace: [ 736.193485][ T31] [ 736.196400][ T31] dump_stack_lvl+0x3d/0x1f0 [ 736.200983][ T31] vpanic+0x640/0x6f0 [ 736.204953][ T31] panic+0xca/0xd0 [ 736.208662][ T31] ? __pfx_panic+0x10/0x10 [ 736.213064][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 736.218425][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 736.224564][ T31] ? watchdog+0xe48/0x1170 [ 736.228966][ T31] ? watchdog+0xe3b/0x1170 [ 736.233367][ T31] watchdog+0xe59/0x1170 [ 736.237597][ T31] ? rcu_is_watching+0x12/0xc0 [ 736.242348][ T31] ? __pfx_watchdog+0x10/0x10 [ 736.247005][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 736.252188][ T31] ? __kthread_parkme+0x19e/0x250 [ 736.257192][ T31] ? __pfx_watchdog+0x10/0x10 [ 736.261857][ T31] kthread+0x3c2/0x780 [ 736.265906][ T31] ? __pfx_kthread+0x10/0x10 [ 736.270477][ T31] ? rcu_is_watching+0x12/0xc0 [ 736.275226][ T31] ? __pfx_kthread+0x10/0x10 [ 736.279799][ T31] ret_from_fork+0x56a/0x730 [ 736.284370][ T31] ? __pfx_kthread+0x10/0x10 [ 736.288942][ T31] ret_from_fork_asm+0x1a/0x30 [ 736.293695][ T31] [ 736.296885][ T31] Kernel Offset: disabled [ 736.301182][ T31] Rebooting in 86400 seconds..