last executing test programs: 7m16.004543424s ago: executing program 2 (id=198): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000ffff000000800000000000000000"], 0x50) r1 = socket(0x848000000015, 0x805, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x80000000, @empty}, 0x1b) (async) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) (async, rerun: 64) write(0xffffffffffffffff, &(0x7f00000000c0)="24000000200099f0000000000000000002", 0x11) (async, rerun: 64) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="021380ee02"], 0x10}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x30, 0x40, 0x9, 0xffffffff, 0x25dfdbfd, {0x2}, [@typed={0x4, 0x11f}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x1f}]}, @nested={0x10, 0x4, 0x0, 0x1, [@nested={0xc, 0x65, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid=0xffffffffffffffff}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x800) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300090c00000000420b00000000000200130002000000000000000000001f0300060000000051020049e4f0000001c99a00000000000002000100002000100000000200000000030005"], 0x60}}, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmmsg(r3, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x4, 0xffbffffffffffffd, &(0x7f0000006680)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7ff, 0x80000001, &(0x7f0000000240)) sync_file_range(0xffffffffffffffff, 0x100000000, 0x8d4, 0x3) (async, rerun: 32) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000000082f1797b7437215720000000000a01040000000000000000040000020900010073797a30000000002c000000030a010200000000000000000100fffe0900010073797a300000000009000386744314300000000078000000060a010400000000000000000100000008000b4000000000500004803c0001800e000100696d6d6564696174650000002800028008000140000000001c0002801800028008000340000000010900020073797a3000000000100001800a0001006c696d69740000000900010073797a3000009f00140000001100010000000000000000000000000a"], 0xec}}, 0x0) (rerun: 32) 7m15.726630787s ago: executing program 2 (id=202): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), r0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000240), r0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @timestamp={0xd, 0x0, 0x0, 0x9, 0x4, 0x1, 0x3, 0x10}}}}}, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0x13) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket(0x10, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}}, 0x0) syz_open_dev$MSR(0x0, 0xffffffffffff058e, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000600)={@private1, 0x68, r8}) openat$tun(0xffffffffffffff9c, &(0x7f0000010140), 0x48c02, 0x0) 7m15.230065401s ago: executing program 0 (id=206): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="3800000010003704feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="8b040400000000001800128008000100736974"], 0x38}, 0x1, 0x0, 0x0, 0x4c050}, 0x20000000) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) r2 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) socketpair(0x18, 0x2, 0x77f, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) sendmsg$can_bcm(r3, &(0x7f00000004c0)={&(0x7f00000001c0)={0x1d, r4}, 0x10, &(0x7f0000000440)={&(0x7f0000000380)={0x7, 0xd4c, 0x3d, {}, {r5, r6/1000+60000}, {0x4}, 0x1, @canfd={{0x4}, 0x24, 0x0, 0x0, 0x0, "b0f109a6bd15917641b2321acf4d0374fdb0dfa7661cd8d37cd1861ea0561b6bcfd03f19b38e24bb68d4213c6e95d4bbc0d78775851e8794658eb764491caf98"}}, 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x8000) r7 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) wait4(r2, &(0x7f0000000080), 0x80000000, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) timerfd_create(0x9, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0100001000010000000000000000000a010100000000000000000000000000ac1e0101000000000000000000000000000000004e2300000200000087000000e83d0e7a086ceb4a040132ee9b1592ef0a73775b7a5d30709aab931f87d657595ec80000000000000000eda26b83c8331a004b7f7f0df5f2bbcaadb698e47458c113ff47c21c3b4f0b5b3ad243067a77a98155c21d1f7a841b8ea4c6ab25af0ffe", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000006c000000fc010000000000000000000000000001000000000200000000000000000000000700000000000000000000000000000000000000300000000000000000000000ffffffffffffff0f000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000002abd7000000000000a0001060000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008001d00080000000c0015005c07350002000000"], 0x14c}, 0x1, 0x0, 0x0, 0x1}, 0x10) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') tkill(r2, 0xb) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) pselect6(0x40, &(0x7f00000002c0), 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x65}, 0x0, 0x0) connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) getgroups(0xfffffffffffffdb2, 0xfffffffffffffffe) 7m14.676705133s ago: executing program 2 (id=208): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000002340)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e22, 0xe5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10000}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000180)="b0", 0x1}], 0x1}, 0x4000}], 0x2, 0x0) shutdown(r0, 0x1) 7m14.55698417s ago: executing program 4 (id=209): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000004e00)=[{{&(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000300)="1fbad2814c8bc4a21fab9a028d48e0d76ad5f77d4cca42213b577342f5f7dd9311b1dcb7a8851e886e17d8cb32dd821ac09d1abfe7b7237373372a4feb2726d246d0952d8b4b1548f04fa90b92cb2407d00ba7bac16e51d0fbf289c64197fa8cfcfda3272c78dd3a4b0fa5dd34ab6e4eebc6300c0642045c1741f10085fbe87c1bcabd8d1df2c8772b68a1c8294a1208575f57294e799bc1841cec4b6388a340d1f66dc60d193584511643b24fb2f12f30964185fc02ab3798f4b3d5c7ad1f729901bd84afaa9554e6bd97462921ef65b6a701186461", 0xd6}, {&(0x7f0000000580)="5dfe75dd39c8a0a35335d564b97cb631ffa9d21947f6032709f54055dbaeab21f6a15570994a1ab6d952b2d6f66deaeda167604517a73a4a942d483298cae4c624954a7af47a4b386c098de58038c6615dd711ce0eb7804987bd6b0e73764bf70c1281f8d5e36ee48638ac409c1ebe91c76a507a7042d3d2f1c19c330f5c8513d4d6aa9c74fc23abfc78d26dc7575244e3b0e30ed8b4910ea45886e462e1b69b552e3230a585fdb66d1db0a62f5bbd69aea2ab6f9c491774b98556f6d87d04666bec8e088bbc780abe7f4a06ed23b347ba3ece705888ce9aef4b6444bcdeb4aa69d65be56e41cf0366892e4ec333112af9f41c53dfea3170e3bb572625cae9738df928b86581d1a7158da3c935812d4d29e2b4c18c05d6bacbec33ad8e74e696b5944584dfadd14b8b30ab63d6aa65dd139ebe84e6749a50af71739ce353b287e354b0ee1dd581972562fcc2f8b518c007f6c5086bf59837befe1ff0da6ddd2639796b89dfb61c7722a48991b0010e0eaddda9057ac7976f1c00b0f3299b702d4a6518c33e47618da4720d27f7b17b30add764f27c4c67f8a379c59dafe893aab826a5dbeb6bc543ea5b010c03ea4fcd73206010b2c0459bd12d0567caa2cef493fd8dd3956e8fe809e711a20c216d5410767f592c928c83b27841b857bd1fa5d18180666be584cc3d1677dd22f72ac34f470b0653bd2d9634738f7152204b531bfa7a183b5b06fb2d70d849ee9cf55215552372ca6ed830fe3fdb1d64f606493975463d65cdd6cd2891f94ce213c5fcd967e3f8760edd678d112dad0f0d425a91e8666ca3590e9c0d33201d3237396f1e297dd2de828b28983ec65eeea5be75be7dd3ffd00b99ec6c9462d96c909edcd00b93b380e2de256d62fa653f5c2304b0024e424f947e71c1cfd7a66013881295abab2f6a7992f6bbeca5a5f2dc779fc6f752586dc884d301315e46d5764af081caf4b3926bb54d00566a74834ee25ce0f51936f321a4ccd37d6da1858833955fe478fe16684081aaa61a20fe9134422aba13f356503e88fc84e5080faa020356b58f581afdf32924c4fbdabfd8937ff28277b08b51749bb3e41abfcc0f89f9f5c769166253cfc0818467b0c6f303603fa35daf2f437896b04945c841183ec08808e69ec63367c5188cd6b62b97bd2fd3344d523a461244f0bb5ff1e121383c4eae3b4556d5c9f157645a45e81cabc66946e1e353b02aa1b63c07fcdf1cf3e757733f6004a7c664d8a041f04d53265371168f7260512e6a5618c6d00fa53936a36e8735b7eae52de3346cbafa139b6c664599c804eb10b858b7af9e5a0a9c7f958c00bd4e06ff43d1212139b3b39c836aed53d46aafe3d8f289e81b76915d90398afb94fd8b90c1cc8370963df6b67efb77a7b64678f6e5f4b7ce12d27ac2e2198eac903fbd48e201c22295f1a254bb29fc907bc4df40de8526d1fec50fa606a052922a70d1ec45c8b94be5629b041df7839aff84f23cd9a7922674d1344713d7befd8a42bbc72b0ff1019d8660be0f42086e51834b00a5dc906af8ad555a0d76de3aa01067dc46b8802db2112c745337c8c677a15dd0f7622fae49e2de6ec01c8cb9ac512be028e0915a6cf2e5652c5d9db1a42ddb74eef6d2ed2403134f00bb540e06813db9bb7b84c6d6de5200cb1f0adb2a8ec586f36103529ef13482ba96e418784b9014a9f61f159d4318805afc698bd1c8e7f26cd733fa8eca51906d8ffda0d4b749d5503becef287799960d9388cd4b297cfd5290a32ad1aac6094c29a7a7122fd86eb1d2995dc0ee4a1988da6be71a58c3914a136008f80b3c93d6861eaf23e77a2d4134ef9a544da86b87fcba89864b159dbfc2355bd16e963163026f82b168c573e680c2b32505067671ceebb154da8044c3b0f4fa1147896314c4d161884e7675246ad76a29d140d54d8fee8fc6f28402902bd33ffac29a25691ba1df29cb711d517bc9e0753ce63fae647a3ce8efcac29172265a9b8431a6ee35433b77d795a08d7bcc8818bbc142233509a7484c9382aa77da75a8f7168e4f795b4f320058b7de58bb493bba9cfaeb0078c76b287532cae6fe1bf5b93600d8ce3cc990788e4ccb0c182447e1f0a501831f700125e6b32b6901bdfecdb1d0397c1abd84350ea9e087fd5e24e445327092c26facfe4091c6688138b8cb8ac9af15da2835205707626b349abbaba8c0fdc4d9f21ad2ca521fcb1c0b10e5aa38a511f74e8611dcd66a4333cb98c825142cdba926c8295faa679e4ed4859fc7e88f007a7bf11223634586d28aecb49c458c11554d25688f55fa4a3bd52f39784775a02118ff98decaca4976b9a295c6b81dedb6a0641b074ac5e4a23eb1a983f9176c62057ea4b7f5d18373c3e1fb4340e8f6a394bfc3d73b7c1de5c5356e16ceb90270aab7af28da3a2aa48d86d46b6ac51740d2f08fd04f190d06042b19295d1778ba241997099e135c416b0eda1f635d757fe0f76bec7c429df93d285a31f161569225f23fdfa12eb030d79c50cd7df04357454c4abc020be4da9b4f5866ffc854aa3bbb3d12ea88e67e1e7cd04ce5c618a0abf11d12c3de9665c3640c3b154ffb64aeaa63a71b8d0cba4483aa7bb8cc2dde4277020f2e670e6d04755ed2713dd383bc56a197107c01fb0fc2cfb850c2fae794d3b4a36d76a68eca95294772cbaac078349f96d089eae58f23d7a4ff433029a86315369d8d00a4482738c62aba8c6f6709298fedcb8798c743b81ff5c7021eb6e0ffe87ba5c67d840a6b5f5705ba572ce33638fca554870f977643635da891369c3bb2b8050e6a9e4f21fad58566f7699d62ad22cae3ed7c411159d7c291b5a314e45a9a1039b6dcef3f810d98a0b1f7b88c0c7af70f2511f8e99d54266afdda7285c189180925d8cfb2df1cf64b938945a4019a5ac62d1556ec535200401c1663306fddd1870173d8b3d124b402e130237f6aded0f7bbaca455b23d996e6c66d39017d3848fc9b812357bb534e6eb627886acefb6646c92e8bb91420400432fba97335e79fe3ab3da4d9967659c221db52bbc06d8ab4049763de94536a59ddb4afef2b69ba6f5f674ce1049103b7eafb93feba0e1c0cb3d114c4cf30663b3389068d4f68c195b1d660ba0aef5427d0fc803622e0178516939a6b0eb695a087c95738b3347e02ab7480fbdb9037fc091cf7a067d027cc70c3416d918c23c075b84a5ad72076c219f25c50b704424973348cbda2c1d83fd97d8337f6a043c3571bb90c78997ddd55b800fb757579714b48a9a60fcb3bd96acad3b1da534361d841816f31aa861cb582f7f496bcbbb6536ad6cce833912f20f4ef8162f9a34e2d89c10fcad7bc934e307d64613932b945ea5b2324583b5676509e0b26bf88b2c38ad3489b7d39000bceb4fbb5a97af3bfe6ccd81bb44f81cb684263360800648133bc8ef9a9d3d6ea556b25339419b53483ff11a7fc256eb79a0f086dc77ee7ef6b2c96e53ae4fc5419be3be8ac7892009da277851f887281eed1f5c63a9ddd751c46c70d8d58f43e69380197c962ad23c1c2c43151d2d704d8eed0f01e92c2724a60518937da6c5ef45fb4093a432a31085139278fa9f33645845bad37262db7733304780f39b080702378b85255b6819a7f38d6ddd1eed6dd1c47215ffe8ceb1f03c53650a1e5ce6cda810a30c2ca0bbe6c639befd96dd0d6988570cfd805e7a1a0806debdf0eee24fcf06afd04b2b9b65a88af4bda1db2dcda52b6d7e900606e4663c4b4fa88d3618e9fda8b68c1471dcaecfe37e00a656a83fa1bb9bb4c59e2fdcaa5242466bf569564ae76261376c93a5a6bf9258ea13fa08efeca8ad0127d856c59e0e8c0ffeae1ca5bac36351f67d5fb824b71be1adfc2d26c38b0bb8daa00d86f24f323b036b8787c100ccfa8c7c8072498316d9ba247cc6502234051d3b0ee2dfbc1323e51b9f371f3c68dce16392a6f95348e3d63c92ee47f7586b33795a0a1f9155bd9a70f8f4b015f072a37b955f48f8440542aeb323f4e02dd8fe8c3226d44d07d6367d8f7d7694bf7a9d2bf6ba56e2d22b91fca7c0d3df148725609338402a1e3602d275f89b3094b3a646f5342462ba87c715ce3a0aeb06bce72b2d3122d293fd5b3d84fc8204934490a14462f008e6553b71358f32dfd4102d88d0c877454959d5d6f2ab6d7700eb730bfd5fe4653456baee8085e41b453ad37c90522188c73cf2e9411c83183c0ca6da0b9c485475f119de60879e46ef9bfe2b06168cb5b7d7cdfdb887be72c60a25a722c8caea6ce8bf2a9fe707c848e035546c1b1087f2bb2f6c78b508eb767d450f558ea436a78cc4d5a17bae0ebb5f8faad2e55548188a7fbafa1cb6d01761455bf1ab02a6ba74aabacc5c9d8ded423610eb6e34d83c2a98c3c830ba1eb369f52ad0484402be5564238c9067a3bce320a3438937fda7c1718c3d3a650582250c38f30b32e05e838e488c486bfd0b0ce6d78d7527bf6bc28affa0545f66541f64dab89a0e40bf00ce20b09afb6ad24434cdf5aa6d0e65cc23e382d99b5e8090f7f3c18ec60e2256c35e2dfea8edd57a057b12db1cd45416a589f42f563047e09f7b07840fc364f4099814ae9b131e43f00d1656ecf1e1ac0a02dc093e2a5a6177acfbea958d5b0e7f0d9f7322723765390152750b115662511675864969ffb473dafa2bad687205b5385c645eb5ed9d569cd4f49d3145a53ae07b5c3f125fb2dcee63f79d702ac687ace1bea7c189f10253e1e4fb35e1bedf31418e5c698779bfb78335f14ab1f64f14891852ef23d0a5040cb0045725a370045babcdd0809d47b3493ddd80e17efd037b8431bd70b69e6643129d889df9f4873c3d5e5c6faf877c36d56d6bc4ad713e2394348c3e53ac96018de81616f67d5e9e262fbbe5706f2a874b8c3f3af6c8caa455b8b0e5a5f18a2c02b9e54425293857c82f3da17cc1fbb0363ed65c1b2c74c3fe1b5ced2e0ccdac2956a2c0c0318e9496b32e58aee43470065ed2461d1d40920ee9133b88e94875732fdee631e472b80ceb225eab71366037da40671050d29b5aa28fa3d231032d1cb474a465eef655df7c9ac1947861391c4813225e849b6819a22ead5edee205efac5447f7c33f33a0306eccae99251cacce681da1e87e194956a449bdce2bd293bce305e163c7ca9104c86c69dffa93b1e6abe4ea79127f0aba882f10481a999e85f60a6039f7203154491fb612901246b957fc47b3c0e3d9ca4b9ea6c073ea6aadaa965d70396fddb2e8f5347d7dde458fa66b7b1a09ee05caeb9f0513b3b4be483300ab820504095a3bd5f2dee4965fe21869d26db680c2c63a4988544e70d8f6a999e71bccc823656f7c5109c567bb6a16a38fe0e228900186728d7cd9dedd15c49e69019f192e6c69a3327cabd63c815135a98f117161f9c19d632683127d0c2e560c9a4401f28bea70434e38883ddf1869aefd02a5f0f39addb2a18eb7250d2abf2d6160a4a644fd90250bd9cd9a7d0863c70463b3561267d405afec9a27bd24ca6fb85e0563b25559bd98c95680fb2fe8ba19bf2c2847f166c305b3ef30e22b511ecaf46ebe1c1a3a0cffab11360eafbc910d1ab5c7f3de3b2209f3740e7b9b16dc79f54e3f4352c55d5d43a8dcb45fa0e671fa52c1cdd6b89a388a2ee29db54adc7f75b5bcd64a89e7b95cf0913f29b1fdaffe8a36c7cbf1735921f733e77f115d59a9f3de1f35ead1058a24de43bb560a263e60fdafa4c229e80a5250d2810c20ed7e08574ce6f6e2b803256a1d50ba6733a5f5d1de52", 0x1000}], 0x2, &(0x7f0000001580)=[@rights={{0x28, 0x1, 0x1, [r1, r3, r2, r2, r2, r1]}}, @rights={{0x24, 0x1, 0x1, [r2, r0, r1, r1, r3]}}, @rights={{0x18, 0x1, 0x1, [r1, r0]}}, @rights={{0x1c, 0x1, 0x1, [r0, r1, 0xffffffffffffffff]}}], 0x88, 0x84}}, {{&(0x7f0000001640)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002a00)=[{&(0x7f00000016c0)="b2d925a68b0c82ab0476b36cf6defef4a63e8e6daff055abcecab54bcff42e0294a5637e29b8094212a34b3989de1dfbe67bddfdfb143670b42421e5a24e7599e2f5b1604d415e3d673ae4a63420bef0445bc8a2499bfaef09748481c308d7231c7a746a3d2ce9290ec6267640d7d38713721065ea532dbfd4df964c5ef0be3114968a597eb63b7d72d797f51992bcb753a8cd852a6ed6f3c177cb8571c573c57687b23cfebef37739f12b513b55fd672bd3455abec409624091f1c9d99e0df1c10cd67a0f8b518c56268bf2b709971ba60d7942dbac04f215c832bf9a51eb276aa16ee6298170ce75ed2f325583506565c0a42fff83e8ea8d621bee0b8ed33cddc56d883173e3da170e6302c67927419d8e9a3a464797dbd2d8510ca1b6241b72a8319f55b2eb2015d42c11892e7d328d70a0c9399918440e41aaed5cf8f856b72692964bb71ed38fbc3ea93935a1f42787235a7c3933dbdb8e0dc8eb5e5295a9e2d1e8ba64b4f743fbc6f91aad922524831a6a1c25da631a4e755343336e71a47779dee123386c9cdd2ccdcc706a706237a0086e1cc4df2394f3cf9a1530f8309bd7ee3ab06419e3506a7b71ec3a1d69ed720feda5f6727bf0efe93929e156aa060a22ffa91829e58f36d81c52c691a15bb42b551e9be9eef5d5e251cd86fada3e1500c1d1dbc3f8e6c3081a2f73205d206efefbeff37b2256fa376b2c7fd1653d4c48f23d2963093e6529e2d9c5abf6e9433c13c4ea3864e77ab97be53322aeb2a7c6169e617da09eb88688a76c69cc4156096132b1995a4ced0b954f1f50ca73cc25cca5bc90cc8c7eb4620f979a7cf3477b9039bc47a6d7881bc064ec53ce4c2dae67fee437518efa04a7ea52f8d4385081d80f0f82c1f94696ee48b027ca880243232568ec076588fe32602e55ec817474f21793ed90bdc2cf1c41094c661498ed49cc5a2c1a073b28ef58057554f83d208a349f6d8d67d22d8449105797dd57b03cd6cf0539a1672fc10db0f5c9ba6bf4752c68ec087bdb95c8db84da272cb432e1909c0dc086eaef750e85d9a3a8c4406e97c59c3ac36b35ce8ef4eaa70f5c6dbdee662c6c4ea7358d6894aaa5aa970b0dfba069f4fb073fc7f0cb87b7cc6453c86451415ef0d931c31201d92f27f583721b917746d25e52d774cfd60b3b27808ad1002786897f428ee5b485106fa3cba9b48f4af2e87a8942364c7560e97b78ef7413d3560ad94f95e8a68ae2688673f6ffd9b710a29a9bbacb05c5a105d7a534c4302557ee0bd0c46b7b3e976b513cdd3b69762eb252e4f72ab6e67c7f18c02c11ea22a9ce66fc05bd3630d3896f14277ca735ba27d0268641eeaf5825e1f8853e2ce3685461ecdb176e34dbb24873d5163ae953aff5aa632f7e546d43994d18ae9805ca3549a805324ce612c834224fa570bfa2b4558404a606b5757a97fff0d2b0a8eda53fdd2109ab5ed71a1f4a12b461e11d5c37e05e6ebf3eb0b0cd97b5252585f92bd324918e816de26cf7b972644e403634d32bff490ddc184527b7554ddf895d09db78824b952cf7793a226f7d4c237d80c1ea6e0db71ac25db89508d317998858115d6307e1425ea3268f3dd9ac77bbd0c45435c90a553d8a2f9d11577c7a56c82923432635d206f80e39d8e65d8b7244f9a01fe4bb45b163901ee199cb3502ac66b5f48ec532d9c3fba8f9e85891fa32ea2760f211047d0037d6130cb4f9c3b52b7711d93ac2e7a8a7b90895c0eeddafea4f358c3e39bddef56b993d03414edbae270a92856ad6e2b78c64ab9b29c28c0465e90e7fb2faaab57eefa9d18ac7dddc44dd0a1b5aaeb39a21348f403e10c0d3c3263261423b2fca5b21e2b99b83848bf8ed0e6388f91ca442c31e122d00d4c09cff1568a99a969fd94a0e710fc6202348398523b084dd85964e1aea1a4cc93fa90677363d3b54e7f711d5aab97125b64e5303b85dc45a69c591a83d0c949097d94e2e8e990fc2f7eff48e1b0b689402876637a23a7c320ea2b9a2cec34db41b009813fd400d2d78980ad90de414f1878886d46accb5542f3ad271e3be1d7d36a8eb4003251c543cea1c0cbcae9bd382800f067cf36d03742dd5edc3c59c5e51e643169edbc7bf4ddb7e39bb17dce87fafbbb1cad6a40f1bd3a603b431f3a1c0a552c17801eaeea2e49d4fce44f7298809231f3f523b69bfdcfa97df8cb298046386cbb973808fab20606073a89272acaeda95673df484a39f725bcb0d4a782eef286c63d0cb9369bdf15c23dc624a7dc5cf4bfc7b71cfb9ee7ebbce14c41ba528ee3f3b982a1bdc7569ffc3d8bf8ba761b3b1d50e575a9efaab73b7c715a90514bd1241690d92f11eebb62e363768b42967d09c7106077c695342ce513f3bc002d17313bb7fa4e963f0982c2ccc292d9d4c2d3ff4ba4850e71657fc8a65d6dcf6963dee2c2a6dea370dea0a6b162fda99b0cd8362c942e479c4c984777f5f28b7491a5bb97e9ca1858552681a8dc581950d78e9a5d4d6f825c1dbc42d5cd6899e9477f67b3a352dfc6c7138b7de5a57b53417f451c5e5979bcdf5e0c976e250e9fb3424bc537240d2e8af90a241dd10153dc08ea01b2849b4b5204e50577cc1e23a19ce241beaef3cdd769d19e8f99f3981aed739b3831fcd688c85e56967af66d34efdf625274da898504595f1a06082320a9ae94cc53d1004a93dd398924fce9314f4113d21b6bfdc650e3a4ba1a2f323219b3b85b2d5b53cfde32f0bf704b33fd0793607a5e0c677c55195726384f987f4249798043a387ddbb278f60cd33314826a7a49a13f62bdc0116eaf1b2530f94e9bb38793327be04bf69ffbae0929c83f679224c031d808dfd4ec0c82e78fefeb54d8ec8c3e5a285315b5cfa9c619a80ab8f7d34c6e03fecfc0d91fe35e0f73fe43acd06970ff6d502f5634140243f5383d10a602cfb4a88aa47c9cf86260f0782891c0c7a015c0ac742d0092c4532cdc9c56606803c7ed70382b39d72c7d9305ef723336bd963f92a791bba99ef1faf9b0c1285568bc1d37d07d0ef171d38612a03860e403484077dcf82ef504e74eeb7d1a79f7e59d707851cf4545412a63fa51e895e1c1281ba77259b37a90cb5f86f267ceef6fc6115fd9467988bdd3fe3b4beb05c0935f8145d915b1178b7239c28d4eb37579a33740b371049d6d86e4ea90c2d5e79cebd574882717b52fe2423ab7a84578b21e310f812e07b0d871f964b06d99a02a841bd7301327cd84b80302a7d37dd6ef2ff3547fe2dffc461247e7ff723f2434855afb5926affcd9f44d612a6e19baa17eea78bc46860faeb211799a07528a7b937d2c0224dcc5b0ab7b4c32a62e614d256728c702f28227d1cc1581702c588ec5a3b19e9501c276c0f48a8129a761332a07784986eb125ed309ee4a75a6bff035b2fd0047605fdb6c07aacef3aba0b7ecf7d11a1ed63e0b41a7dc8c9842c2ac9bbebfc8a94c07287b43311f6cd3841d9f9eb9c15b5253b3127936c0a5ebedbdd852974542ae28ee9021fc32711252692cb0c7dbcab6119abe7dd3acd914f0857e4c75144c04546c009ad8fbcee48ca77851e3afd4c9baa95303de763d5a1a2eee1b153e8c260b631741729bb7127a67a2496c6ca376abc70bad279a40d8b70e6d0aa6cd76eeb22f5b95b26148147f86f1466c690941d52cd242e815b2014c3682c9e118b8f4903876f1780bbec88363847351190fa6c3549f97cf241e336dbc75797cde96abb89ccfdc840d55bc9b5b8d94638bbe785fd2e9be383651931860a17a37cf7e9aed56540b46fef177767398bf577a9d40c2c0cbe5303c8fba4cb677986cfe1ab09a91371e4333ec014689990cf7ea01817884bc8133a453a3911b5d32464a7d04f145ae0b29f8e8fa53aada0f231454341ffc75a3c2349355169aa9a48cbf09c0bbf8e8aafaee25d1f98ef6f69e455992457ecffbecc190b0a6b5c320c33c634e5a8508d9f545442cc9e0404ef45bb714e3df62538d5ea077a6d9e9e723821dba021e01ce3a754db5515b46aebe17d2145b38144526743730b06a5b66ce9381be71b76f0dfa905a2ab46a67914a0f1f68cd0131dba2e6a55ff2087e5ba36541dc2a7b57a23fa3a1f5229cb0caf95ebd93f1cbe3b6dcf74c79f020b688ee893bba52541f4be9a6500c34964a19377d568d48a067cda54d517bf30af1c5c17b5662f06e3b1717d66af008711da05f6ef19dd76c5d4d9fb35f458f0c2d4baa8cebc4f7397946025d4cb4d6bb22d67bcd359063c44e9c569f9ea8ea885cd8106a74b30f8c031f72b6e0340d02927abeaa9647cbfda0c5379231e87d954cb5bf489261bac1c2011a599515cd46537ce21f8fb6026cfe3f9a9a3032e9a133d794370ae00374015e85ff71f3e1d389b1c3ed392f54c19bd57a14893e3ad0a8bcc20a1c26805cd3ed40f559c3d829bb3e16a25d3b68c4bb4d8438ea7459a2867ccfd6362bcce443a47659f91fc79452ebc847dceda336287e3c7f7b590490a656986f4c70c24d609618250ccbffe26723f2f7cb10e6259708609ba89c42b65f2b31ef72e6c6bf92e0d96415d4de777d43ded12219b790060a3c3609d7ad7eea997ef61aa939a748e25af470fba11da090d668054b96e1f7b17d54f0641477365aa5f96723e6b7cf959b4817151c8348b352aeaa3773db71345b01712cea849bfe79d95b30d9031be3f82394777217a1449fc1c90ae57642f5a56dfc26302b789ac65f2480fbb1782837829583dcc3b056ebe86b29dc7818c4931955888e8a781670cdaef4283d6c96c3a0e683cd30c747011c9c61a45058bfafd0a5ff789b4a7f7b79f1b7c0719eb093c964b45599f17ad887ea1a0b2e37d10317d1a0f9b07c756de501df0ca40463f48a34cdb54a3e646e6a83a8a8d792870b5055bc365a4835b673b63dc755339299bac65c07aa47a93b51583fe7f89a34c67fc408dd5dd321a81fad4d950e3245addd2b2c735d48e3f83c890c751d5e24daa76e601c58a58f1a1122589fb62ce157ce6124fa5f916dd7fb87b0c44d8574e3ecc30a1f0d480a2ea8109ba5aef2890ac6f2799d0724fb6d6a76339c3750bb97586924839f624cd08b85c0445ebd4452f221d3e15301f368fcef8745494dcfc7d62b7f0c389cc1c0609c7bb5e0988a7a734d628a200536c1071579f2c802a329f48864181ae6878f937d57226752721844e67345cc172c9e0b30f423bfb0384bc4fb4e55887085b2e267ee8e0c8cbdd0740bb27383614063a71556a0a8797f787ec96f9d5e06006f8a9003047cc5d37c64132ee6f2995fd814ae1f0282a3b7ca842f1fff8d26177f727d24242b9d118ebf9e8b9c30489b68850d5183be8d6fc429372fbc1ab3e05244ac4c59d6b3764ae6736d43837b9887e621097d37be8c7dff6ba4da598bc35d4ae24e6f572d5fd8f9c1a2829c5027db51c1c72babb92ebf149d9ff788a1a3f18714b0dae519abb007530a41243039b4d5d61ba13c103b994256364b17ada6edcf20d53f14dfe917deeb470355ecee6f6b9810562714f38ceb9f37e6261f7f101c37ee7d0dabfac7bd6cfa7bba5e8648599e63cd645cf8e0156b169ebe67de8bc38c2ba59ce8e8bbe048d81206de5c6e1e0b4466a6d11fd725fc993deb9ad20d119c3d940d3e3d205e0296a065a5081c0ceb35545c3c74a421648cc9307114d9cacb6f90a03336802f3885b8f108ff9e6a8c88525cfca0286060983c19a5b6816a6419f6882182f9f8f6ec7afa7f214bd6ed5523ec5dbec6a0a3a9c78cb8320b3e23e95fb0c95847435c", 0x1000}, {&(0x7f00000026c0)="02c715b58aca470a8cf3de9c019eff55bef947899e56d65ef1670ceb4111fd406c99", 0x22}, {&(0x7f0000002700)="8acd3809f4531e686f62e7b44a4ad72e76d1ce1d6709fa675096dc8584a27580e523c589c2d5dbe90a554c5f1b9680063ebe49b01fb97e643d3f0b218dea8750d426cec9435330e1ef9add062e11ce19e2c28ba9afea02e94c699fb2cfda7b4ad175f36bb0bfe6605411aec79fbd0a99c125fe314b93248787b943225bd9228b8e0596b06732a8c21bb086ec359b9a640d9ca6", 0x93}, {&(0x7f00000027c0)="8a95a959e05c102009beef2f41d87ffa7c7d8d0d2976bbe106581a95df19cd153413d31b9e59095d96c105c170079a00c268944b81fbeeabdcdaf1d1e8bfda22dace8a9b60eb9146ba5d256c026893dc77635b00753a823992d9aef5e41b1ab37d289ecf48f0267e54da211563cdb590431bfe2bb120bfde8cc7ed6080af54dbc68babf2dd7f3b316ce0abad905b9b67749e42aa22a0e2cf85c4f03c502461bb977e6ca7a6733b6c584732e978777034571e5cc5e1ae1314fe", 0xb9}, {&(0x7f0000002880)="4079794aa63b2314ca16bb04e8eabb1ed2c642f2403934641646a09ffb508ae555dc838faa2e64aafd9c370b551af0e839f2bd36325c6eaed9c233781111089cb19178259ea33dd50e0c348e3afe3272f99eb06a24a03368c0bee8d4ac35648b1729945f42549094ec85e5d9ed4bbfc066fff0f212cd50bfb671661af9d35512ffad27f8035908f9f08918fb96112e4e0e5d63fc866797ba0d75c45b112aedc5a039e8c214fc1c4c0974d9edc51b2c0af285447b131564b774", 0xb9}, {&(0x7f0000002940)="e36ed0aa36e5c7ae873096f8aad26c95cbe1ead9be3e76f47e6f5337ab0f8b7954563f5c76e8a2dec4e7ec64ace9b597594f0bfac84402febd367ec1659fbbc40aaf1d90dbdf845c75681b9c327a8e8ea8890463c334cc97b3159d0ac8156192325fbc893c3acf3d5991d011e99be9151fe0734f6e17b25e78b584b00a1833b71193d9399858ac3b9b6f9c7ad066acbac8", 0x91}], 0x6, &(0x7f0000002f00)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x880}}, {{&(0x7f0000004200)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f0000004340)=[{&(0x7f0000004280)="9f137479e0f7135994e8b1263294b3c2c4b271994ee2267d0f2ca1edee020775b9068591310ff778377b3b565b4078f2ec64b437353dd95ca7cf2e9ff82923b725592f2e011311cf9160c07504dc0c895e379687ef687344174db562a8b542fcafcb77beea39ec6f8376037c65b14e5ecb395c29a3ab84f0e56ac310e746838bc3794a48c9fdee893277ba8025bf38a4c3e1546944f0997d9a7de1df9aaeac123c418e47f4c1f7dd49b09c09ec538a72c44ef109d5", 0xb5}], 0x1, &(0x7f0000004500)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r2, r3, r0, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [r1, r3, 0xffffffffffffffff, r0]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [r2, r3, r0, 0xffffffffffffffff]}}], 0xf0, 0x840}}, {{&(0x7f0000004600)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f0000004740)=[{&(0x7f0000004680)="348f792fc8d036a4c53f05913331331a16a1d2d1c4e286522d403f2e1bb2ca3dff7e72f977e761feafeaf7ed5400fa39a824eac48947ad82187f3000af2bf605640e55fec09e9f88f689da55a63857f63fc4b2a7beeb841e4d1d5b00d932916c862f78da526b27a74efff6ab2147bdc3b5cc69306e503053a02c35d6c25b33c52d1a8bd776", 0x85}], 0x1, 0x0, 0x0, 0x4008000}}, {{&(0x7f0000004780)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000004c00)=[{&(0x7f0000004800)="b7040c3547c588113f215dbf7535697d3355f9257fe1b7f61975477daac34f5fe89bbebf930a901a3e558bcecc754ea0c4a7b67dae93d40aa286680281cc7a61c9b4fbabffa7a57466e553d102abed235c99c8bd7b5890baa728175df077e37a5548", 0x62}, {&(0x7f0000004880)="a0f68470ee95d357bfe5d390a1489d8887d0317cc54e773cfe8fa9e337e51edd4f95950b838cba7825b2b99ab752b2d76b33566cdfae30b9f606", 0x3a}, {&(0x7f00000048c0)="526c884f7acc6d0b5828e30a58627f5787484dcbad881215e4055f40f29e392460e5352be23ee4369a9d64d6fed90d036d5095187f9f89f4308637f598ab1393e2d8c4630f1cf2d3a14fc7f5731f4cb0135db4d5dc2db9568e8dcbfe786adb98591ffaf484171922be6a7f4b22228ca9a7443f2921d699bd801858312942dfd8053d97c652ed39ef1f7ef1eb8853aab60e6d2aa8c0847960761b2360aee5836ff9102e326d2743246451cf82449b5804012818b0f0fbe21c9e21baf5e5bd64bc8e27d965cc6eaecb12", 0xc9}, {&(0x7f00000049c0)="4bf3c410fdc73e4792b73f2e6f87c2195f273498656fa971a3d7052c4e68e8c9808419fbadeb3ff202e8132eb0871c8797462ce77c4646d03f319ac44befbcb99278ce344305cb3ded4695e3ecde5c7283882b4f8e2b0d8dd13fbc4448fe1c0013c3621baab212766a11599700d89de3", 0x70}, {&(0x7f0000004a40)="f4656b007f106df489ef692e5cdf5d345b4064f0439310cc1ecaa7b3d54a71e0ea4f9b543daf32d3f1ae85cc90b01f29c71c776c175085f04bb42bf1afc3fc74f7d14f923e1fccf8e07b43ce249b59b1", 0x50}, {&(0x7f0000004ac0)="dec3fc28af9522e4ac0b775fc9eea14f8648e4227a0547f69b502241678a6b389eb8a97dd4d7847dcdc0e5fc9f643949eda0c1301d40dc1357237219125ee20e08905ce5e4f548bc3d84cf338f83cf90d2cf61d10dcbfc3c", 0x58}, {&(0x7f0000004b40)="23cfea1513037e7c465e6e2fd035632a4a3915a6ac93e46768cd6600b33209aaf4dff4a5f79fd78ae75ab1223b679f33e7c09d857da5c2c15d342bb7449d4246142973ec16b3debe4e040bbb85fdaba9f6fb47398802a80b7594e65279fd509ce3b0a3a73dd633d67d4ca2baa85f345c2d2687c8c8b36a0f011c2546adb10b38c9c967339d6701c6c247b7f70dc6bf2ee94489ac52a34f5535bb8be91901f088d100e248666711dea9c02967b23867d0aeec9307cdbceedfee", 0xb9}], 0x7, &(0x7f0000004d00)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000038000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r2, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c00412496eae32f5d99aed600000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB='\x00\x00\x00\x00'], 0xe8, 0x4008005}}], 0x5, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x890, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x1, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r4, 0x7323, 0x0, 0x5, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0xa) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r11, 0x8932, &(0x7f00000001c0)={'veth0_to_hsr\x00', @local}) r12 = socket(0x22, 0x2, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r12, 0x80044942, 0xfffffffffffffffe) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x28, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) r13 = socket$kcm(0x10, 0x400000002, 0x0) setsockopt$sock_attach_bpf(r13, 0x10e, 0xb, &(0x7f0000000080), 0x4) sendmsg$kcm(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000440)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000400142603600e1208000f574c000401a8001600200008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a73536138f00001fb791643a5ee4ce1bb25059e55ae3f014d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb3adbb5bdd95cdacdce7ac51d4ddb41e1307a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fe25e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0", 0xffffffffffffffc9}], 0x1}, 0x44850) 7m14.465454417s ago: executing program 2 (id=210): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x8000000000000003, {}, 0x2}, 0x18) r2 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x100000}, 0x14) 7m14.238156874s ago: executing program 0 (id=211): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000010008500000022000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x224e, 0x0, 0x0, 0xf0, 0x0, 0x0}, 0x4c) 7m14.195133919s ago: executing program 0 (id=212): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040)='veth1_to_bridge\x00'}) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)={0x28, r1, 0xe17131a1c005744d, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x5}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40006895}, 0x40010) 7m14.089253888s ago: executing program 0 (id=213): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(echainiv(aegis128))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="b7f228", 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001640)=ANY=[@ANYBLOB="380000001a000100000000000000000080002000", @ANYRES32=0x0, @ANYBLOB="00000000080002000b000000140001"], 0x38}}, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000980), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) memfd_create(&(0x7f0000000bc0)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^+\xcc1l\xcbmA,5\xc4J\xcab\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\xcc{\x9d\xf1\xbd\xb0\xca\x03\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_\x13\x99\xf7\xfdOD\xd3\x9d\x9d\xb8d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9>\x9e\xff\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf10xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}}, 0x0) 7m12.754155539s ago: executing program 4 (id=220): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = semget(0x1, 0x4, 0x39c) semop(r2, &(0x7f0000000080)=[{0x1, 0xfff9, 0x1000}], 0x1) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x4002) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304}, "982e8c12e5407a28", "030f97945be2be0d7639c15eed73d9e3eef85fc33df3a0bb9bdbe7225ca64454", "5ee3e0f8", "e3acd909a6fc2ea6"}, 0x38) sendto$inet6(r4, &(0x7f00000003c0)="d963c9f4e85e727c5964e3143f0f99d23f309eef0a1296e6c7c3704cf6deb8acb341b47e1a60a4a00d725fff3e721fdddd4879fe34dfb940c7e0849e8f3915e8ae01004b9e756c98388bb387ed9f4aa6186f04f561ff629425615736d8b42877970000c03cf51f85a9fbf99e695e98733b538a9dbde6ffa337c9b26bdc72695f05003ec9de5f807dc76e91a7a3db133a8bb5ae4a3c44819aaf56496fbad213f21b1a0a32e2ac17d5069fde917155cb8b1208cd8e08a7c0f480000000", 0x11c259e35b9f2599, 0x0, 0x0, 0x3000137) semctl$SETVAL(0x0, 0x4, 0x10, &(0x7f0000000180)=0xfffffff6) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r5 = socket$kcm(0x2b, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) close(r5) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) 7m11.224489751s ago: executing program 4 (id=222): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x200008d4, &(0x7f000072e000)={0xa, 0x0, 0x0, @loopback, 0x3f00}, 0x1c) 7m11.039937878s ago: executing program 4 (id=223): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001b40)=ANY=[@ANYBLOB="14000000100001000000000000000000020000147c000000060a010400000000000000000a0000050900010073797a3100000000500004804c0001800a000100696e6e65720000003c0002800800044000000017180005800e000100696d6d656469617465000000040002800800034000000002080002400000008408000140000000000900020073797a3200000000140000001100010000000000000000000100000a"], 0xa4}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001b40)=ANY=[@ANYBLOB="14000000100001000000000000000000020000147c000000060a010400000000000000000a0000050900010073797a3100000000500004804c0001800a000100696e6e65720000003c0002800800044000000017180005800e000100696d6d656469617465000000040002800800034000000002080002400000008408000140000000000900020073797a3200000000140000001100010000000000000000000100000a"], 0xa4}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) (async) 7m10.892091534s ago: executing program 4 (id=224): socket$nl_sock_diag(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3e, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3, 0x0, 0x7}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000800000000500000a40000000060a8bae00000000000000000af500010900010073797a31000000001400048010000180090001006d617371000000000900020073797a320000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000007c0)={0xa, 0x2, 0x0, @empty, 0x80000001}, 0x1c) close_range(r5, 0xffffffffffffffff, 0x0) 7m10.528813276s ago: executing program 0 (id=225): io_uring_setup(0x6503, &(0x7f0000001300)={0x0, 0x8d5f, 0x1046, 0x0, 0x264}) socket(0x80000000000000a, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x0, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x0, 0x0, 0x401, 0x101}, 0x10}, 0x94) syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) ioctl$CEC_S_MODE(r6, 0x40046109, &(0x7f0000000080)=0xd0) r7 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) ioctl$CEC_S_MODE(r7, 0x40046109, &(0x7f0000000080)=0xd0) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1200000004000000080000000b00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'/28], 0x50) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000600)=ANY=[@ANYRES32=r8, @ANYRES32, @ANYBLOB='\a\x00'/12, @ANYRES32=r1, @ANYBLOB="d26b32bc08c7f53546fc5fcf516c567a0304831506321d0894a28cec8f4267dc7520413848a689594e2b762dd0fc440286e1e2a19d26dab7ca171ef1b34ecef8df06375517712ef93df0e0b35fce5e01f62f5b30791c3350683c9fb7f2df580c57ba74ee8d69171328cd5e993fb41a8245867eb5216b30dcb68b9fe8117857b71fb4f39514b1474513d796de8fe8c961e4583843aa5b7c4f5a8c89750d1ea8808bc1086978a5bbae5d426983540434bda3393cd69aabc01284776d8ad86ee81daac9b86aff4c2713551726e514c58b92f88ed71aa3ae25758c95200a0264a30ee31c3da50a02caf7ff9a8941711ba897c7417ca973e5bbf62f1872fc978239a693c46f40a0017b80bf77052179492e7a94f82bff1c4c16eaee2e6ca8201f9fd9ae3aebc4b9fb3a224629c0422f563c234304fb7c14d14984984b090aaf4dbe4b5648f86f1a7b722ddd9f8b29cfcd09ced7ae0f5e27aabd6d", @ANYRES64=0x0], 0x10) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f00000001c0)={0x200, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000300), &(0x7f00000000c0), 0x0, 0xb}) 7m9.480348356s ago: executing program 4 (id=226): syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) r0 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r0, 0x541b, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x0, 0xfa, @scatter={0x4, 0x0, &(0x7f0000000a80)=[{0x0}, {&(0x7f00000006c0)=""/235, 0xeb}, {&(0x7f00000008c0)=""/132, 0x84}, {&(0x7f0000000980)=""/221, 0xdd}]}, 0x0, 0x0, 0x0, 0x0, 0x800001, 0x0}) r4 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r4, 0x8, 0x0, 0xff9e, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffedb, 0x0, 0x0, 0x10, 0x4}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000015000200071b1750bd030100000000009500000000000000bc26080000000000bf67000000000000070300000fff0700670200000300000016060a000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000040)) getdents64(r6, &(0x7f0000001f00)=""/4093, 0xffd) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500150002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}, 0x1, 0xff00}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 7m8.103552056s ago: executing program 2 (id=229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) r4 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r5, 0x0, 0x0) syz_usb_disconnect(r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d000000a100010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000006ac0), 0x0, 0x0) fstatfs(r8, &(0x7f0000007580)=""/19) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r2) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9, "c379a944054a34cefe6c2e2bf5bb0c03"}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0x7, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000340)={'wg0\x00'}) sendmsg$ETHTOOL_MSG_RINGS_GET(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x20000040) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x80000, {0x0, 0x0, 0x0, r13, {}, {0xffe0, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0xffffffff}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000540)={'batadv_slave_1\x00', @broadcast}) 6m54.338246631s ago: executing program 32 (id=225): io_uring_setup(0x6503, &(0x7f0000001300)={0x0, 0x8d5f, 0x1046, 0x0, 0x264}) socket(0x80000000000000a, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x0, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x0, 0x0, 0x401, 0x101}, 0x10}, 0x94) syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) ioctl$CEC_S_MODE(r6, 0x40046109, &(0x7f0000000080)=0xd0) r7 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82002) ioctl$CEC_S_MODE(r7, 0x40046109, &(0x7f0000000080)=0xd0) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1200000004000000080000000b00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'/28], 0x50) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000600)=ANY=[@ANYRES32=r8, @ANYRES32, @ANYBLOB='\a\x00'/12, @ANYRES32=r1, @ANYBLOB="d26b32bc08c7f53546fc5fcf516c567a0304831506321d0894a28cec8f4267dc7520413848a689594e2b762dd0fc440286e1e2a19d26dab7ca171ef1b34ecef8df06375517712ef93df0e0b35fce5e01f62f5b30791c3350683c9fb7f2df580c57ba74ee8d69171328cd5e993fb41a8245867eb5216b30dcb68b9fe8117857b71fb4f39514b1474513d796de8fe8c961e4583843aa5b7c4f5a8c89750d1ea8808bc1086978a5bbae5d426983540434bda3393cd69aabc01284776d8ad86ee81daac9b86aff4c2713551726e514c58b92f88ed71aa3ae25758c95200a0264a30ee31c3da50a02caf7ff9a8941711ba897c7417ca973e5bbf62f1872fc978239a693c46f40a0017b80bf77052179492e7a94f82bff1c4c16eaee2e6ca8201f9fd9ae3aebc4b9fb3a224629c0422f563c234304fb7c14d14984984b090aaf4dbe4b5648f86f1a7b722ddd9f8b29cfcd09ced7ae0f5e27aabd6d", @ANYRES64=0x0], 0x10) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f00000001c0)={0x200, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000300), &(0x7f00000000c0), 0x0, 0xb}) 6m53.362417049s ago: executing program 33 (id=226): syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) r0 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r0, 0x541b, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x0, 0xfa, @scatter={0x4, 0x0, &(0x7f0000000a80)=[{0x0}, {&(0x7f00000006c0)=""/235, 0xeb}, {&(0x7f00000008c0)=""/132, 0x84}, {&(0x7f0000000980)=""/221, 0xdd}]}, 0x0, 0x0, 0x0, 0x0, 0x800001, 0x0}) r4 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r4, 0x8, 0x0, 0xff9e, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffedb, 0x0, 0x0, 0x10, 0x4}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000015000200071b1750bd030100000000009500000000000000bc26080000000000bf67000000000000070300000fff0700670200000300000016060a000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000040)) getdents64(r6, &(0x7f0000001f00)=""/4093, 0xffd) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500150002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}, 0x1, 0xff00}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 6m53.032485112s ago: executing program 34 (id=229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) r4 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r5, 0x0, 0x0) syz_usb_disconnect(r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d000000a100010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000006ac0), 0x0, 0x0) fstatfs(r8, &(0x7f0000007580)=""/19) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r2) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9, "c379a944054a34cefe6c2e2bf5bb0c03"}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0x7, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000340)={'wg0\x00'}) sendmsg$ETHTOOL_MSG_RINGS_GET(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x20000040) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x80000, {0x0, 0x0, 0x0, r13, {}, {0xffe0, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0xffffffff}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000540)={'batadv_slave_1\x00', @broadcast}) 6m51.470729362s ago: executing program 1 (id=239): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="88be26a41e041752154256fef69b0428c66de800"], 0x6) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 6m50.789488844s ago: executing program 1 (id=240): r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) 6m50.149007396s ago: executing program 1 (id=243): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="64000000100003040000001f0000000000000000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r0], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 6m49.770942875s ago: executing program 1 (id=246): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) io_setup(0x8, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() getpeername$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f00000700000340", @ANYBLOB], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4}, 0x10) ioprio_get$pid(0x1, r0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000040), &(0x7f0000000080)=r4}, 0x20) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@ipv4_newrule={0x28, 0x20, 0x1, 0xfffffffc, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@FRA_TUN_ID={0xc, 0x14, 0x1, 0x0, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0xc0) sendmsg$NL80211_CMD_JOIN_OCB(r5, 0x0, 0x20000000) unshare(0x62040200) 6m48.396028212s ago: executing program 3 (id=248): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x3e7) 6m46.872672183s ago: executing program 3 (id=249): syz_open_dev$tty1(0xc, 0x4, 0x1) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x101042, 0x45) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) syz_io_uring_setup(0x5a1a, &(0x7f00000000c0)={0x0, 0xae15, 0x1000, 0x3, 0x114, 0x0, r0}, &(0x7f0000000180), &(0x7f0000000240)) r1 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000001c0)=0x0) setpgid(r1, r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) tkill(r3, 0x34) ptrace$peeksig(0x4209, r3, 0x0, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 6m45.168071644s ago: executing program 3 (id=250): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000dc0)={0x1f, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff95}, [@call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) 6m44.990965851s ago: executing program 3 (id=251): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendto$packet(r1, &(0x7f0000000280)="0f30", 0x2, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) (async) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000000, 0x110, r1, 0xa431a000) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES32, @ANYRESOCT, @ANYBLOB="0000000000000000280012000c000150660a4b68"], 0x48}}, 0x0) (rerun: 32) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xe}, {0xfff1, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000800}, 0x88) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async, rerun: 64) r6 = syz_open_dev$vim2m(0x0, 0x1000, 0x2) (rerun: 64) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0xc2, 0x80000001, 0x35315258, 0x2, 0xff, 0x8, 0x6, 0x6, 0x0, 0x0, 0x1}}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) r7 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x89e2, &(0x7f0000000040)) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mount(&(0x7f0000000980)=@filename='./file0\x00', &(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)='ocfs2_dlmfs\x00', 0x100000, &(0x7f0000000a40)='%]^&.\x00') mlockall(0x7) socket$inet_udplite(0x2, 0x2, 0x88) 6m44.625060341s ago: executing program 3 (id=252): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = openat$yama_ptrace_scope(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$F2FS_IOC_RESIZE_FS(r0, 0x4008f510, &(0x7f0000000080)=0x7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {}, [{0x78, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000251401002cbd7000fbdbdf2507000000"], 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x10) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000840)={0x0, 0x8}, 0x8) keyctl$read(0xb, r4, &(0x7f0000000240)=""/112, 0x349b7f55) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r7, 0x10e, 0x5, &(0x7f0000000040)=""/162, &(0x7f0000000100)=0xa2) gettid() bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x3}, @func={0x1, 0x0, 0x0, 0x12}, @ptr={0xf9ffffff, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e, 0x0, 0x0, 0x61]}}, 0x0, 0x46}, 0x28) 6m43.753269172s ago: executing program 1 (id=253): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000006c0)={0x14, r1, 0x1}, 0x14}, 0x1, 0x0, 0x100000000000000, 0x4084}, 0x20000010) 6m43.434207215s ago: executing program 1 (id=254): syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x8000000000000003, {}, 0x2}, 0x18) syz_usb_connect$printer(0x5, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7f, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x7, 0x1, 0x2, 0x1, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x68, 0x3, 0x30}}, [{{0x9, 0x5, 0x82, 0x2, 0x40, 0x7, 0xe, 0x9}}]}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x4, 0x8, 0x5, 0x8, 0x5}, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="050f100041201001024a000800040006"], 0x1, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x1c0a}}]}) r2 = getpid() prlimit64(r2, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r3 = syz_open_dev$sndpcmp(0x0, 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r3, 0xc1004111, &(0x7f0000001580)={0x0, [0x0, 0x100], [{}, {}, {}, {0x1000000, 0x4}, {}, {0x3}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}]}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000004c0)=0x27) r7 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, &(0x7f0000000080)) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB=')\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="004c5fd8f6b27bf0340ff65842c49b9e364d1291c76ed49a1045d2975a36cb40e2d7f1baf8a0cb955dd7f46210853612c6cd0818d799bf157961fe26449bfdbdee2f0b49"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x14) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='sessionid\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r8]) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000140)={0x35cb, 0x1, 0x2, "c9993634bccfb71fc4f56183e9bae578922f00f1e74c59dad75aa9179ff46c1d", 0x38303553}) 6m42.916782507s ago: executing program 3 (id=255): bind$802154_raw(0xffffffffffffffff, &(0x7f0000000000)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0302}}}, 0x14) gettid() mknod(&(0x7f0000000180)='./file0\x00', 0x1ffa, 0x8) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000000)=@req={0x3, 0x10004, 0x800, 0x7}, 0x10) sched_setattr(0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000810001000800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b74000c00e63b9ba2ea4f115a67245b00000000000000000000000000584cbf2649a50f2dbc0000a8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d9cfd56d3c86e55010000000000000000000000004137dfff2f8f00009a3bfbc1f39cb307b3472eb9cdb042d2643fcbb2c5a57df67d544af6e8dafe09"], 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x10080) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f0000000400)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000001010400000000000000000000000093a3f87680dfee04fc4b6cd4999aa17c49adb188bd453aaed828e800859d82cb0f56620b1949f5eac47fef00afe8a88bb9c563e24865987b24c12cb26cf5b1ca64c9921b4cbd514de1cdf98d82b53395c2ac6606d5bc69848fc1c69618db9034442d8eb8b295c5941b88707cd5dfb080f5a85d6f054f4b2ee6997495b9d0ab7d80585f75016666184e64e69b542bdb25d256a58c98553f8d01dc839410fb51cd378f1b1f58e57f17fa9fec491bc1c3571522dcb02d535d29e6fdc18bfd545873e36381c22c"], 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="640100000001010400000000000000000a0000003c0001802c0001801400030000000000532e2e57000000000000000014000400200100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe80000000000000000000000000000014000400ff0200000000000000000000000000010c00028005000100000000000800074000000000d0000d8008000100ac141400080002000000000014000500ff02000000000000000000000000000114000400fe8000"/207, @ANYRESHEX=0x0], 0x164}, 0x1, 0x0, 0x0, 0x8090}, 0x0) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280), 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r7, 0xc0505350, &(0x7f0000000700)={{0x0, 0x1}, {0xf, 0x2f}, 0xfffffffd}) 6m25.66678087s ago: executing program 35 (id=254): syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x8000000000000003, {}, 0x2}, 0x18) syz_usb_connect$printer(0x5, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7f, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x7, 0x1, 0x2, 0x1, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x68, 0x3, 0x30}}, [{{0x9, 0x5, 0x82, 0x2, 0x40, 0x7, 0xe, 0x9}}]}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x4, 0x8, 0x5, 0x8, 0x5}, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="050f100041201001024a000800040006"], 0x1, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x1c0a}}]}) r2 = getpid() prlimit64(r2, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r3 = syz_open_dev$sndpcmp(0x0, 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r3, 0xc1004111, &(0x7f0000001580)={0x0, [0x0, 0x100], [{}, {}, {}, {0x1000000, 0x4}, {}, {0x3}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}]}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000004c0)=0x27) r7 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, &(0x7f0000000080)) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB=')\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="004c5fd8f6b27bf0340ff65842c49b9e364d1291c76ed49a1045d2975a36cb40e2d7f1baf8a0cb955dd7f46210853612c6cd0818d799bf157961fe26449bfdbdee2f0b49"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x14) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='sessionid\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r8]) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000140)={0x35cb, 0x1, 0x2, "c9993634bccfb71fc4f56183e9bae578922f00f1e74c59dad75aa9179ff46c1d", 0x38303553}) 6m16.841059645s ago: executing program 36 (id=255): bind$802154_raw(0xffffffffffffffff, &(0x7f0000000000)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0302}}}, 0x14) gettid() mknod(&(0x7f0000000180)='./file0\x00', 0x1ffa, 0x8) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000000)=@req={0x3, 0x10004, 0x800, 0x7}, 0x10) sched_setattr(0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000810001000800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b74000c00e63b9ba2ea4f115a67245b00000000000000000000000000584cbf2649a50f2dbc0000a8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d9cfd56d3c86e55010000000000000000000000004137dfff2f8f00009a3bfbc1f39cb307b3472eb9cdb042d2643fcbb2c5a57df67d544af6e8dafe09"], 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x10080) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f0000000400)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000001010400000000000000000000000093a3f87680dfee04fc4b6cd4999aa17c49adb188bd453aaed828e800859d82cb0f56620b1949f5eac47fef00afe8a88bb9c563e24865987b24c12cb26cf5b1ca64c9921b4cbd514de1cdf98d82b53395c2ac6606d5bc69848fc1c69618db9034442d8eb8b295c5941b88707cd5dfb080f5a85d6f054f4b2ee6997495b9d0ab7d80585f75016666184e64e69b542bdb25d256a58c98553f8d01dc839410fb51cd378f1b1f58e57f17fa9fec491bc1c3571522dcb02d535d29e6fdc18bfd545873e36381c22c"], 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x40000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="640100000001010400000000000000000a0000003c0001802c0001801400030000000000532e2e57000000000000000014000400200100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe80000000000000000000000000000014000400ff0200000000000000000000000000010c00028005000100000000000800074000000000d0000d8008000100ac141400080002000000000014000500ff02000000000000000000000000000114000400fe8000"/207, @ANYRESHEX=0x0], 0x164}, 0x1, 0x0, 0x0, 0x8090}, 0x0) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280), 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r7, 0xc0505350, &(0x7f0000000700)={{0x0, 0x1}, {0xf, 0x2f}, 0xfffffffd}) 30.209058318s ago: executing program 7 (id=1836): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x200000000000000, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 29.890131316s ago: executing program 7 (id=1839): openat$udambuf(0xffffffffffffff9c, &(0x7f00000002c0), 0x2) r0 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r2, 0x1, &(0x7f0000001640)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r1, &(0x7f0000000380)='a', 0x1, 0xd}]) ftruncate(r0, 0xffff) fcntl$addseals(r0, 0x409, 0x7) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x24000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001f80)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) syz_open_dev$dri(&(0x7f0000000000), 0xe, 0x20c0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r6}, 0x10) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r10, 0x10f, 0x82, &(0x7f0000000100), &(0x7f0000003800)=0x4) bind$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000003040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003080)={0x30, r5, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20040084) 27.969052248s ago: executing program 7 (id=1851): socket$inet_udplite(0x2, 0x2, 0x88) r0 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff00080002ff", @ANYBLOB="35874207"], 0x44}}, 0x0) 26.429379594s ago: executing program 5 (id=1853): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 24.505135306s ago: executing program 7 (id=1863): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_exit\x00', r0}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000001340)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x12, r3, 0x100000000) userfaultfd(0x80001) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) open_by_handle_at(r7, &(0x7f0000000180)=ANY=[@ANYBLOB="15000000fe"], 0x1) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="abfffe076c723a2f1c420b8ad02c6b0382b3e70f70b4788fe36446cc1074932beba6ed90463429918f3a778933eeaf11eeefcf0300000000000000263fbf53f5a52bf92499a06512607c3bb684803780953e50aacb3381ccfc4d6b29afe8fce672fdea"], 0x18}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8b04, &(0x7f0000000040)={'wlan1\x00'}) recvmmsg(r5, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/4082, 0xff2}], 0x1}, 0x5}], 0x40000000000000d, 0x2000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20040040) sendmsg$rds(0xffffffffffffffff, 0x0, 0x4810) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r9, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) socket$inet6(0xa, 0x800000000000002, 0x0) 23.097256748s ago: executing program 5 (id=1867): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) r4 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r5, 0x0, 0x0) syz_usb_disconnect(r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010020000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000006ac0), 0x0, 0x0) fstatfs(r8, &(0x7f0000007580)=""/19) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r2) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9, "c379a944054a34cefe6c2e2bf5bb0c03"}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0x7, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000340)={'wg0\x00'}) sendmsg$ETHTOOL_MSG_RINGS_GET(r2, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x20000040) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x80000, {0x0, 0x0, 0x0, r13, {}, {0xffe0, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0xffffffff}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000540)={'batadv_slave_1\x00', @broadcast}) 22.997401275s ago: executing program 8 (id=1868): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0xd, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000026000000850000002a00000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f00000008c0)) r3 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001", @ANYRES8=r2], 0x0) syz_usb_control_io(r3, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x407}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r3, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3009}}}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000740)={0x20, 0x3, 0x2, "b23b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x82, 0x2, '\x00\x00'}, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="208402"], 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000f80)=ANY=[@ANYBLOB="1201000012c35b400304106098c6f40000010902128001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000a00)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="208402"], 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f00000002c0)={0x84, &(0x7f0000000380)={0x0, 0x1, 0x2, '\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000800)={0x84, &(0x7f00000007c0)={0x40, 0x3, 0x2, "3eb0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000640)="d9b9547ed3c0021a6fd6a67ab922", 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 19.745322985s ago: executing program 5 (id=1874): r0 = socket$kcm(0x10, 0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) inotify_init() r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setscheduler(0x0, 0x2, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000080)=[@enter_looper, @release={0x40046306, 0x2}], 0x99, 0x0, &(0x7f0000000300)="ad4644d0a85aa1cd926c1d2853a6da031ce6e1ee3858ea84b061596a1dfee98f3977af66850f69e850725b601142acaf37a7b87292024ab6defbd3ae9142f1055ead667554531f30e1c8109e0ecfc1401b1736b9d346ac50986eed92d0edd6561666a1b9eac8514e5faba5a8280ad26c3e629f3b84787cd097bfd23a0c1b7b89d56ccca51d42aad846fde2fa30ec8e2ef325e95f46e4856170"}) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r6, 0x80044940, &(0x7f0000000280)=0x14) read(r6, &(0x7f00000019c0)=""/4097, 0x1001) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000100), 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000280)="4d2450d4c3047e6fbe4ce931658250f867", 0x11) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, 0x0) socket$inet6(0xa, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000010c0)={&(0x7f0000001140)={{0xeb9f, 0x1, 0x0, 0x18, 0x2, 0x0, 0x0, 0x2, [@enum64={0x3, 0x0, 0x0, 0x13, 0x1, 0x1, [{0xe, 0x6, 0xfffffff7}]}, @func={0xe, 0x0, 0x0, 0xc, 0x4}, @float={0x2, 0x0, 0x0, 0x10, 0x12}, @func={0x6, 0x0, 0x0, 0xc, 0x1}, @ptr]}}, 0x0, 0x1a}, 0x28) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="89000000120081ae08060cdc030000007f1be3f74001000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e281ad6e747033a0093b837dc6cc01e32efaec80000ec00120c00034006040400090404009bbc7a46e3988285dcdf12f213e6f768fec601955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 19.126217227s ago: executing program 7 (id=1877): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 19.081259255s ago: executing program 5 (id=1878): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000810087406d040e0a759400000001090212000100000000090400200003"], 0x0) r1 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) write$selinux_access(r1, &(0x7f0000000740)=ANY=[@ANYBLOB="73797374656d5f754c6f626a0e000000000000005f736f5f7420704b0b00000069655274203000000000000000"], 0x41) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x20}}, 0x0) r2 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={0x0}, 0x8}, 0x10880) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x0, 0x0, 0xff}, 0x20) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') read$midi(r4, &(0x7f00000001c0)=""/147, 0x93) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020f0509150000002bbd7000fcdbdf2505001a0000000000000000000000000000000000ac1e00010000000000000000000000002500101005001a00fe8000000000000000000000000000aa0000000000000000000000000000000026000018010016004e2300000800120000000000b16b6e00000000000600ff0000010000fcffffff0000000020010000000000000000000000000001ac14141c0000000000000000000000005bae1b136a1db949fef4ddf976053a"], 0xa8}}, 0x840) 18.273390199s ago: executing program 6 (id=1881): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000280)='2', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f0000000100)="23b8c638344ca929e7075acc3e9834a6cd039a14824285d39d85703c53e97e5a0d80c8fc00000000c6340909882d609c66b9ee89cc3432c5da4415a10fd135a56eb71ecbefe790873e0aaa4e0e30c8dfd51072000000008000000015ecc6fad80336f6af0e2c1ece958963715bcb930ae0a336229b702f0eea4c9488a71702da4394ff95af6eac00665bcae3ba8e78112945eaa90daec7d703f2d86620c1f8fc037cd665272754af4509a28dd2ea1fd560803e66a7dd21944db1", 0xfffffffffffffe1b, 0x4000082, 0x0, 0x0) 18.268983728s ago: executing program 6 (id=1882): syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r0}, 0x18) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40002) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000200)) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085", 0xcb}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r3}}, 0x24}}, 0x0) 18.072968931s ago: executing program 6 (id=1885): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 17.981123344s ago: executing program 9 (id=1886): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x0, 0x0, &(0x7f0000000300)='syzkaller\x00', 0x4, 0xb9, &(0x7f0000000440)=""/185, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0x1, 0x5, 0x7}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000740)=[{0x2, 0x5, 0xe, 0x1}, {0x5, 0x3}, {0x3, 0x2, 0x10, 0x3d0fad6d7b6fcb7a}, {0x4, 0x2, 0x1}, {0x3, 0x4, 0x4, 0x6}, {0x1, 0x3, 0xc, 0x7}, {0x2, 0x5, 0x7, 0x4}], 0x10, 0x9}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r3 = accept$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f0000000240)=0x10) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000280)={@private, @loopback}, &(0x7f00000002c0)=0xc) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x6, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000800)=ANY=[@ANYBLOB="9feb010018000000000000000200000002"], 0x0, 0x1a, 0x0, 0x6, 0x5}, 0x28) r5 = syz_open_procfs(0x0, &(0x7f0000000400)='map_files\x00') getdents(r5, &(0x7f0000000000)=""/42, 0x2a) getdents64(r5, &(0x7f0000000080)=""/147, 0x93) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) renameat2(0xffffffffffffffff, &(0x7f0000000d00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x5) lseek(0xffffffffffffffff, 0x2004, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a24000000020a01080000000000000000050000060800024000000003080002400000000014000000110001"], 0x4c}}, 0xc050) syz_emit_vhci(&(0x7f0000001400)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x2, 0xa}, {0x5, 0x2, 0xd3, 0xcb, 0x5}}}}, 0x17) 17.849812741s ago: executing program 8 (id=1887): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), r0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000240), r0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0x13) r2 = socket(0x10, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB], 0x1c}}, 0x0) syz_open_dev$MSR(0x0, 0xffffffffffff058e, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000600)={@private1, 0x68, r7}) openat$tun(0xffffffffffffff9c, &(0x7f0000010140), 0x48c02, 0x0) 17.289168205s ago: executing program 6 (id=1888): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x5, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000008700000000000000a6000000ffffff8595"], &(0x7f0000000100)='GPL\x00', 0x3}, 0x94) socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000540)=@newqdisc={0x50, 0x24, 0xf0b, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x1c, 0x2, [@TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x9}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xffff}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x10}]}}]}, 0x50}}, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) r4 = syz_open_dev$video(&(0x7f0000000000), 0x5, 0x40100) ioctl$VIDIOC_ENUMINPUT(r4, 0xc050561a, &(0x7f00000002c0)={0xf, "cf8854bc99215960c96a75bebcdb4f83e73bfb47c049ec6bcbaa52518bd418e1", 0x1, 0x10000, 0x3, 0x2000, 0x900, 0x2}) (async) ioctl$VIDIOC_ENUMINPUT(r4, 0xc050561a, &(0x7f00000002c0)={0xf, "cf8854bc99215960c96a75bebcdb4f83e73bfb47c049ec6bcbaa52518bd418e1", 0x1, 0x10000, 0x3, 0x2000, 0x900, 0x2}) shutdown(r3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800", 0x9) (async) setsockopt$inet6_buf(r5, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800", 0x9) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000140)=0x7, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f0000000200), 0x2, 0x0) read$msr(r6, &(0x7f000001b700)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) (async) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r8, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket$inet_mptcp(0x2, 0x1, 0x106) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) (async) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) (async) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17.125136592s ago: executing program 9 (id=1889): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000feff00000a20000000000a01040000000000000000010000000900010073797a3100000000ac000000030a010300000000000000000100000014000480080002400000000008000140000000050900030073797a30000000000900010073797a310000000008000b4000000003640008800c0001"], 0x92fc}}, 0x0) 17.049323469s ago: executing program 6 (id=1890): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = mq_open(&(0x7f0000000000)='!selinuxsel\xad\"\x0e\xabx\xb8\xc9\xa8x\x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r3, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) mq_notify(r1, &(0x7f0000000200)={0x0, 0x8, 0x0, @tid=r2}) mq_notify(r1, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000305fcffffff0300000000000000", @ANYBLOB="0000000010a000001c0012800b0001006d616373656700000c0002800500090001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x8090}, 0x44000) 17.031151631s ago: executing program 9 (id=1891): socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000680)="93378efcd17301726272853a9fa88608996042ab60ae09f9a90efedde424f36d", 0x20) r5 = accept4(r4, 0x0, 0x0, 0x0) recvmmsg$unix(r5, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000004c0)=""/101, 0x65}], 0x1}}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f00000000c0)=""/130, 0x82}], 0x1}}], 0x2, 0x40002023, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0xf0, 0x28, 0x7, 0x0, 0x0, {{@in=@private=0xa010102, @in=@empty, 0xffff, 0x0, 0x0, 0x3, 0xa, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in=@multicast1, {0x300, 0xb400, 0x2, 0xfeffff7f00000000, 0x2, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x200000, 0x6, 0xfffffffffffffffd}, {0x3fffc, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x3, 0x0, 0xf9}}, 0xf0}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 16.412822357s ago: executing program 8 (id=1892): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200250c000000000000000000000002000800080000f3fc00000000000000030006000000000002000000ac141400000000000000000002000100000000000000060000000000030005002000000002"], 0x60}, 0x1, 0x7}, 0x0) 16.382701243s ago: executing program 8 (id=1893): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000180)='hugetlbfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x9) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000080), 0x2a) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'xfrm0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3104, 0x1b400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}]}}}]}, 0x3c}}, 0x0) 16.21700068s ago: executing program 8 (id=1894): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{r3}, 0x0, &(0x7f0000000180)='%pK \x00'}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f00000003c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000280)={0x0, 0x1, 0x10000}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000d8d60b007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8002) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d08000000000000140003006970766c616e31000000000000000000240012800b0001006970766c616e00001400028006000200010000000600010002000000"], 0x58}, 0x1, 0x0, 0x0, 0x840}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r9}, 0x18) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={0x0, r9, 0x0, 0x200000010}, 0x18) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000001400090a000000000000fe00021f4800", @ANYRES32=r2, @ANYBLOB="08000200e4d4c21e080008004c06"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 16.07739108s ago: executing program 7 (id=1895): r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0xfffffefffbff7f7e, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, 0x1c) r2 = userfaultfd(0x80801) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x7, 0x1, 0x3, 0x0, 0x0, {0x7, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40c4010}, 0x44044800) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/86, 0x56) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x54d}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) close$fd_v4l2_buffer(r0) syz_clone(0x30000000, 0x0, 0x0, 0x0, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000019180)=""/102355, 0x18fd3, 0xc2a) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r5, 0x0, 0xf69}, 0x18) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000fff500f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) r7 = semget$private(0x0, 0x5, 0x0) semop(r7, &(0x7f0000000180)=[{0x3, 0x44cf, 0x800}], 0x1f4) getsockopt$inet6_buf(r1, 0x29, 0x3d, &(0x7f0000000240)=""/139, &(0x7f0000000000)=0x8b) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x50009405, &(0x7f0000000180)) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) syz_usb_connect(0x2, 0x24, &(0x7f00000043c0)=ANY=[], 0x0) 16.067682709s ago: executing program 9 (id=1896): syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r0}, 0x18) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40002) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000200)) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085", 0xcb}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r3}}, 0x24}}, 0x0) 15.43681464s ago: executing program 5 (id=1897): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x800, 0x2) getpid() writev(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)="ef43", 0x2}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x1100020, &(0x7f0000005380)={[{@gid}, {}]}) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r4, &(0x7f0000003480)={0x2020}, 0x2020) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000240)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003300)=[{{0x0, 0x0, 0x0}, 0x489}], 0x1, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, 0x0, 0x0) accept$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x4, 0x3b5f91, 0x203bac}) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000040)={0xf0f046}) dup(r0) 15.330565672s ago: executing program 8 (id=1898): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}, {&(0x7f0000000300)="ce40bf59add76a244409313a792e8e7210655ef664464b513539a01904192fa76be2c34f7e0e3689316778ea80412c62572dc950974d9987df42d38a044d8267684d8f5a8372c3c9be65fa8ac80b2214101818fce2cd9783862e1ffdcfdd366e5647edcfffc5c9d127bbb2923c8911e056ef53eae3cf2f405d579a9b71616305235df42c630dc0195588ed729825e6d53453d8ca", 0x94}, {&(0x7f0000000480)="a19b1cd54eb48dea1244e4aecdc1a3aa3e5b64f4e91f4223f7014aeeb4be64741ae85e522955f12cbe65881b7b7c3f86a8c7d8c8b0826614695dccde9ace633f08813ca94bae32652c478fe3eb4abaa16ab1d1af5f487e831d4e1aff8993af72fd7bd739536bf1d4330d1f43d053654f0ee2ece8ba4698130df5e77cf8e2bdf27cf9fec359a59a09886689777cdc5b69bdcde1e9939b322f6c63f47fc1", 0x9d}], 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x1810, 0x56487}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_HELLO_TIME={0x8, 0x2, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 14.701531585s ago: executing program 9 (id=1899): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010000304000006000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYBLOB="d6"], 0x40}}, 0x0) 14.504654523s ago: executing program 5 (id=1900): socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0xff863b679b60bf1d) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a42, 0x0) dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r0, 0xffffc000) madvise(&(0x7f0000300000/0x1000)=nil, 0x1000, 0xc) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r7, 0x0) mmap(&(0x7f00009c5000/0x1000)=nil, 0x1000, 0x3, 0x28012, r7, 0x0) listen(r3, 0x8) r8 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f00000000c0)={0x2, 0x0, 0x7, 0x9c}, 0x10) sendto$inet6(r8, 0x0, 0x0, 0x4000050, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x4}, 0x8) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000000040)='ro\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) 14.429316375s ago: executing program 9 (id=1901): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000000)=0x1000, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@broadcast, @multicast2}, &(0x7f0000000340)=0xc) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @empty}, 0x1c) listen(r1, 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)="ac102ff43a278f4be6797ffc2cb0c697", 0x10}, {&(0x7f0000000100)="0d42882bef471db4015814739e1f31eb8b59afd3628cd92fa241f19457ece4018d27a5ca966c452931ff4dd8dd8104325cae20360135bf260302479972d0aa5f83ec8b7c1a521f4bb062ae5708", 0x4d}, {&(0x7f0000000180)="86a86f4d93042742ca115f25783885eb16095b801ec4772f99469eccd7465ac2fc1598db5ff70eeee8be44642c57ce5700b54574bc37f1b8b4720012b794a24278076153fea2bb929c1f1e", 0x4b}, {&(0x7f0000000080)}, {&(0x7f0000000200)="832b385872750e482d88b4f9017bc5526b01ae6196c8851d9ea8176f191470ab3b147d9bd3748c2e6b127b8077bb061d127136bb7a51156558c3648175865d760634781079570083a85212aeb88c5e4cec7af8e4021b1a3433ffdeba48e7fde27c17d20de0bb29a664cf3f419f0e3a9b615746a3d260a46d261e7d20ebf70eef2d3661269ac17cda74216a48a623a02e9f1dfe4a4f48b1", 0x97}], 0x5) 13.5077936s ago: executing program 6 (id=1902): r0 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r0, &(0x7f0000000b80)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0x7ffe, @mcast2, 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000000)=[@hoplimit={{0x14, 0x29, 0x34, 0x2}}], 0x18, 0x30}}], 0x1, 0x4000084) 0s ago: executing program 37 (id=1895): r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0xfffffefffbff7f7e, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, 0x1c) r2 = userfaultfd(0x80801) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x7, 0x1, 0x3, 0x0, 0x0, {0x7, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40c4010}, 0x44044800) getdents64(0xffffffffffffffff, &(0x7f00000002c0)=""/86, 0x56) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x54d}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) close$fd_v4l2_buffer(r0) syz_clone(0x30000000, 0x0, 0x0, 0x0, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000019180)=""/102355, 0x18fd3, 0xc2a) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r5, 0x0, 0xf69}, 0x18) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000fff500f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) r7 = semget$private(0x0, 0x5, 0x0) semop(r7, &(0x7f0000000180)=[{0x3, 0x44cf, 0x800}], 0x1f4) getsockopt$inet6_buf(r1, 0x29, 0x3d, &(0x7f0000000240)=""/139, &(0x7f0000000000)=0x8b) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x50009405, &(0x7f0000000180)) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) syz_usb_connect(0x2, 0x24, &(0x7f00000043c0)=ANY=[], 0x0) kernel console output (not intermixed with test programs): icient options for proto=fd [ 399.222027][ T9] usb 9-1: USB disconnect, device number 10 [ 399.294000][ T5910] usb 8-1: USB disconnect, device number 11 [ 399.513422][T11170] Bluetooth: MGMT ver 1.23 [ 399.519816][T11170] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 400.214077][ T9] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 400.373982][ T9] usb 9-1: Using ep0 maxpacket: 32 [ 400.383229][ T9] usb 9-1: config 0 has an invalid interface number: 146 but max is 0 [ 400.391929][ T9] usb 9-1: config 0 has no interface number 0 [ 400.407025][ T9] usb 9-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 400.436691][ T9] usb 9-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 400.479659][ T9] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 400.514623][ T30] audit: type=1400 audit(2000000068.080:403): avc: denied { create } for pid=11186 comm="syz.6.1242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 400.544042][ T9] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 400.582617][ T9] usb 9-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 400.596175][ T9] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 400.617896][ T9] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 400.639029][ T9] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 29793, setting to 1024 [ 400.676147][ T9] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 400.687582][ T9] usb 9-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 400.717731][ T9] usb 9-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 400.737588][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.753964][ T9] usb 9-1: Product: syz [ 400.787039][ T9] usb 9-1: Manufacturer: syz [ 400.791666][ T9] usb 9-1: SerialNumber: syz [ 400.810467][ T30] audit: type=1400 audit(2000000068.380:404): avc: denied { read write } for pid=11197 comm="syz.6.1246" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 400.826456][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.842476][ T9] usb 9-1: config 0 descriptor?? [ 400.850589][T11168] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 400.859706][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.872232][T11168] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 400.879768][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.887217][ T30] audit: type=1400 audit(2000000068.380:405): avc: denied { open } for pid=11197 comm="syz.6.1246" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 400.890565][ T9] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 400.922024][ T24] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 400.938360][ T9] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 400.941058][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.952613][T11204] cgroup: noprefix used incorrectly [ 400.954738][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.966819][ T30] audit: type=1400 audit(2000000068.540:406): avc: denied { map } for pid=11203 comm="syz.9.1248" path="socket:[33935]" dev="sockfs" ino=33935 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 400.967689][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 400.992580][ T9] scsi host1: microtekX6 [ 401.000879][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 401.011143][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 401.019548][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 401.037493][ T5962] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 401.052909][ T5962] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.03 Device [syz1] on syz1 [ 401.086175][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 401.100337][ T24] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 401.110267][ T24] usb 6-1: config 0 has no interface number 0 [ 401.111788][T11209] fido_id[11209]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 401.196933][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 401.248654][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 401.293967][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 401.323797][ T24] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 401.342070][T11168] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1236'. [ 401.351108][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 401.365366][ T5962] usb 9-1: USB disconnect, device number 11 [ 401.390632][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 401.402806][ T24] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 401.423617][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 29793, setting to 1024 [ 401.445271][ T24] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 401.554877][T11217] SELinux: failed to load policy [ 401.565323][ T30] audit: type=1400 audit(2000000069.090:407): avc: denied { load_policy } for pid=11211 comm="syz.6.1249" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 401.643554][T11223] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1253'. [ 401.660358][T11223] vlan0: entered promiscuous mode [ 401.667069][T11223] gretap0: entered promiscuous mode [ 401.996080][ T24] usb 6-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 402.011079][ T24] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 402.020421][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.030626][ T24] usb 6-1: Product: syz [ 402.036233][ T24] usb 6-1: Manufacturer: syz [ 402.041630][ T24] usb 6-1: SerialNumber: syz [ 402.049233][ T24] usb 6-1: config 0 descriptor?? [ 402.059468][T11190] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 402.067098][T11190] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 402.080210][ T24] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 402.088672][ T24] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 402.106604][ T24] scsi host1: microtekX6 [ 402.283395][T11190] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1243'. [ 403.271582][ T30] audit: type=1400 audit(2000000070.830:408): avc: denied { read } for pid=11230 comm="syz.8.1257" path="socket:[34076]" dev="sockfs" ino=34076 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 403.447844][T11247] tipc: Enabling of bearer rejected, failed to enable media [ 403.499734][ T5962] usb 6-1: USB disconnect, device number 12 [ 403.608443][ T30] audit: type=1400 audit(2000000071.180:409): avc: denied { create } for pid=11253 comm="syz.7.1262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 403.684012][ T30] audit: type=1400 audit(2000000071.180:410): avc: denied { connect } for pid=11253 comm="syz.7.1262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 403.808080][ T30] audit: type=1400 audit(2000000071.190:411): avc: denied { create } for pid=11245 comm="syz.9.1259" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 403.852840][ T30] audit: type=1400 audit(2000000071.420:412): avc: denied { getopt } for pid=11245 comm="syz.9.1259" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 404.306234][T11269] FAULT_INJECTION: forcing a failure. [ 404.306234][T11269] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 404.341051][T11269] CPU: 0 UID: 0 PID: 11269 Comm: syz.5.1265 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 404.341080][T11269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 404.341090][T11269] Call Trace: [ 404.341096][T11269] [ 404.341103][T11269] dump_stack_lvl+0x16c/0x1f0 [ 404.341135][T11269] should_fail_ex+0x512/0x640 [ 404.341156][T11269] _copy_from_user+0x2e/0xd0 [ 404.341177][T11269] kvm_arch_vcpu_ioctl+0xee9/0x52d0 [ 404.341206][T11269] ? kvm_arch_vcpu_ioctl+0xebd/0x52d0 [ 404.341228][T11269] ? stack_trace_save+0x8e/0xc0 [ 404.341257][T11269] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 404.341277][T11269] ? __lock_acquire+0xb97/0x1ce0 [ 404.341308][T11269] ? kasan_save_stack+0x42/0x60 [ 404.341325][T11269] ? kasan_save_stack+0x33/0x60 [ 404.341341][T11269] ? kasan_save_track+0x14/0x30 [ 404.341357][T11269] ? kasan_save_free_info+0x3b/0x60 [ 404.341380][T11269] ? __kasan_slab_free+0x60/0x70 [ 404.341397][T11269] ? kfree+0x2b4/0x4d0 [ 404.341421][T11269] ? tomoyo_path_number_perm+0x470/0x580 [ 404.341444][T11269] ? __lock_acquire+0xb97/0x1ce0 [ 404.341481][T11269] ? __mutex_trylock_common+0xe9/0x250 [ 404.341511][T11269] ? __pfx___mutex_trylock_common+0x10/0x10 [ 404.341540][T11269] ? __pfx___might_resched+0x10/0x10 [ 404.341563][T11269] ? rcu_is_watching+0x12/0xc0 [ 404.341585][T11269] ? trace_contention_end+0xdd/0x130 [ 404.341602][T11269] ? __mutex_lock+0x1c4/0x10b0 [ 404.341624][T11269] ? kasan_quarantine_put+0x10a/0x240 [ 404.341643][T11269] ? __pfx___mutex_lock+0x10/0x10 [ 404.341670][T11269] ? tomoyo_path_number_perm+0x18d/0x580 [ 404.341694][T11269] ? kvm_vcpu_ioctl+0x1236/0x1690 [ 404.341717][T11269] kvm_vcpu_ioctl+0x1236/0x1690 [ 404.341744][T11269] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 404.341768][T11269] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 404.341791][T11269] ? do_vfs_ioctl+0x128/0x14f0 [ 404.341818][T11269] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 404.341844][T11269] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 404.341877][T11269] ? hook_file_ioctl_common+0x145/0x410 [ 404.341910][T11269] ? selinux_file_ioctl+0x180/0x270 [ 404.341931][T11269] ? selinux_file_ioctl+0xb4/0x270 [ 404.341954][T11269] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 404.341979][T11269] __x64_sys_ioctl+0x18e/0x210 [ 404.342008][T11269] do_syscall_64+0xcd/0x4c0 [ 404.342027][T11269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.342045][T11269] RIP: 0033:0x7f89ba18ebe9 [ 404.342060][T11269] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 404.342082][T11269] RSP: 002b:00007f89bafe4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 404.342100][T11269] RAX: ffffffffffffffda RBX: 00007f89ba3b6090 RCX: 00007f89ba18ebe9 [ 404.342111][T11269] RDX: 0000200000000000 RSI: 000000004008ae89 RDI: 0000000000000005 [ 404.342121][T11269] RBP: 00007f89bafe4090 R08: 0000000000000000 R09: 0000000000000000 [ 404.342131][T11269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.342141][T11269] R13: 00007f89ba3b6128 R14: 00007f89ba3b6090 R15: 00007ffeed14fbb8 [ 404.342166][T11269] [ 404.795907][T11272] tipc: Started in network mode [ 404.809058][T11272] tipc: Node identity ac1414aa, cluster identity 4711 [ 404.820288][T11272] tipc: Enabling of bearer rejected, failed to enable media [ 405.024028][T11287] tipc: Enabling of bearer rejected, failed to enable media [ 405.160612][T11294] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1274'. [ 405.758770][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 407.466881][T11346] netlink: 5 bytes leftover after parsing attributes in process `syz.9.1289'. [ 407.487506][T11346] 0ªX¹¦D: renamed from macvtap0 (while UP) [ 407.526682][T11346] 0ªX¹¦D: entered allmulticast mode [ 407.564905][T11357] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1288'. [ 407.577294][T11346] veth0_macvtap: entered allmulticast mode [ 407.584531][T11346] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 407.681171][T11358] syz.8.1291: attempt to access beyond end of device [ 407.681171][T11358] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 408.544993][ T24] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 408.682601][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 408.884098][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 408.970984][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 409.016021][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 409.072035][ T24] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 409.146209][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 409.172245][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 409.228220][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 409.242988][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 409.260266][ T24] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 409.399044][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 409.412130][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 409.433405][ T24] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 409.441003][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 409.452368][ T24] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 409.490768][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 409.690230][T11383] lo speed is unknown, defaulting to 1000 [ 409.933530][ T24] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 409.975283][T11388] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1297'. [ 409.991256][ T24] usb 8-1: string descriptor 0 read error: -22 [ 410.037977][ T24] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 410.057986][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.364966][ T24] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 410.487505][T11400] bad cache= option: no%e [ 410.487505][T11400] [ 410.494329][T11400] CIFS: VFS: bad cache= option: no%e [ 410.817750][ T9] usb 8-1: USB disconnect, device number 12 [ 410.878201][T11405] overlayfs: failed to clone upperpath [ 410.943985][ T5869] Bluetooth: hci2: command 0x0406 tx timeout [ 411.058500][T11363] tipc: Started in network mode [ 411.067889][T11363] tipc: Node identity 82adffc9c298, cluster identity 4711 [ 411.093535][T11363] tipc: Enabled bearer , priority 0 [ 411.128258][T11363] batadv_slave_1: mtu less than device minimum [ 411.147294][T11362] tipc: Disabling bearer [ 411.283596][T11418] FAULT_INJECTION: forcing a failure. [ 411.283596][T11418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 411.298460][T11418] CPU: 0 UID: 0 PID: 11418 Comm: syz.8.1306 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 411.298486][T11418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 411.298495][T11418] Call Trace: [ 411.298500][T11418] [ 411.298506][T11418] dump_stack_lvl+0x16c/0x1f0 [ 411.298536][T11418] should_fail_ex+0x512/0x640 [ 411.298557][T11418] _copy_from_iter+0x29f/0x16f0 [ 411.298579][T11418] ? __alloc_skb+0x200/0x380 [ 411.298604][T11418] ? __pfx__copy_from_iter+0x10/0x10 [ 411.298624][T11418] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 411.298659][T11418] netlink_sendmsg+0x829/0xdd0 [ 411.298679][T11418] ? __pfx_netlink_sendmsg+0x10/0x10 [ 411.298704][T11418] ____sys_sendmsg+0xa95/0xc70 [ 411.298725][T11418] ? copy_msghdr_from_user+0x10a/0x160 [ 411.298751][T11418] ? __pfx_____sys_sendmsg+0x10/0x10 [ 411.298782][T11418] ___sys_sendmsg+0x134/0x1d0 [ 411.298808][T11418] ? __pfx____sys_sendmsg+0x10/0x10 [ 411.298854][T11418] ? __mutex_unlock_slowpath+0x100/0x800 [ 411.298889][T11418] __sys_sendmsg+0x16d/0x220 [ 411.298914][T11418] ? __pfx___sys_sendmsg+0x10/0x10 [ 411.298953][T11418] do_syscall_64+0xcd/0x4c0 [ 411.298971][T11418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.298989][T11418] RIP: 0033:0x7fd76a18ebe9 [ 411.299003][T11418] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.299020][T11418] RSP: 002b:00007fd76af6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 411.299036][T11418] RAX: ffffffffffffffda RBX: 00007fd76a3b5fa0 RCX: 00007fd76a18ebe9 [ 411.299047][T11418] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 411.299057][T11418] RBP: 00007fd76af6a090 R08: 0000000000000000 R09: 0000000000000000 [ 411.299067][T11418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 411.299078][T11418] R13: 00007fd76a3b6038 R14: 00007fd76a3b5fa0 R15: 00007ffd8ca0fc78 [ 411.299107][T11418] [ 411.615438][T11420] vlan2: entered promiscuous mode [ 411.620538][T11420] gretap0: entered promiscuous mode [ 412.118732][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 412.118747][ T30] audit: type=1400 audit(2000000079.690:415): avc: denied { bind } for pid=11424 comm="syz.8.1308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 412.247220][T11435] netlink: 'syz.7.1313': attribute type 10 has an invalid length. [ 412.260305][T11432] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1311'. [ 412.311881][T11432] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1311'. [ 412.323335][ T30] audit: type=1400 audit(2000000079.880:416): avc: denied { checkpoint_restore } for pid=11431 comm="syz.6.1311" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 412.353137][T11440] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 412.365539][T11440] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1310'. [ 412.425015][T11439] overlayfs: failed to clone upperpath [ 412.464350][ T5917] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 412.594274][ T5917] usb 9-1: device descriptor read/64, error -71 [ 413.813997][ T5917] usb 9-1: new full-speed USB device number 13 using dummy_hcd [ 413.983998][ T5917] usb 9-1: device descriptor read/64, error -71 [ 414.279974][ T5917] usb usb9-port1: attempt power cycle [ 414.345581][T11458] netlink: 'syz.7.1319': attribute type 21 has an invalid length. [ 414.353703][T11458] netlink: 156 bytes leftover after parsing attributes in process `syz.7.1319'. [ 414.377900][T11458] netlink: 'syz.7.1319': attribute type 21 has an invalid length. [ 414.386113][T11458] netlink: 156 bytes leftover after parsing attributes in process `syz.7.1319'. [ 414.678896][ T30] audit: type=1326 audit(2000000082.250:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 414.795783][ T30] audit: type=1326 audit(2000000082.250:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 414.837965][ T30] audit: type=1326 audit(2000000082.250:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 414.899725][ T5917] usb 9-1: new full-speed USB device number 14 using dummy_hcd [ 415.064015][ T5917] usb 9-1: device descriptor read/8, error -71 [ 415.066906][ T30] audit: type=1326 audit(2000000082.250:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 415.154030][ T30] audit: type=1326 audit(2000000082.250:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 415.388884][ T30] audit: type=1326 audit(2000000082.250:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 415.412825][ T30] audit: type=1326 audit(2000000082.260:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 415.445402][ T30] audit: type=1326 audit(2000000082.260:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11466 comm="syz.6.1323" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9087b8ebe9 code=0x7ffc0000 [ 416.103995][ T5917] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 416.202919][ T5917] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 416.223337][ T5917] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.248434][ T5917] usb 9-1: Product: syz [ 416.259300][ T5917] usb 9-1: Manufacturer: syz [ 416.271819][ T5917] usb 9-1: SerialNumber: syz [ 417.260788][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 417.260804][ T30] audit: type=1400 audit(2000000084.830:459): avc: denied { getopt } for pid=11504 comm="syz.7.1334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 417.290662][ T30] audit: type=1400 audit(2000000084.830:460): avc: denied { setopt } for pid=11504 comm="syz.7.1334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 417.408489][ T30] audit: type=1400 audit(2000000084.980:461): avc: denied { append } for pid=11508 comm="syz.6.1335" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 417.578427][ T5917] cdc_ncm 9-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 417.588182][ T5917] cdc_ncm 9-1:1.0: setting tx_max = 184 [ 417.814059][ T30] audit: type=1400 audit(2000000085.300:462): avc: denied { getopt } for pid=11508 comm="syz.6.1335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 418.070639][T11516] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1337'. [ 418.215555][ T5917] cdc_ncm 9-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.8-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 418.417191][ T5917] usb 9-1: USB disconnect, device number 15 [ 418.432282][ T5917] cdc_ncm 9-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.8-1, CDC NCM (NO ZLP) [ 418.512432][T11532] wg1: entered promiscuous mode [ 418.520445][T11532] wg1: entered allmulticast mode [ 418.927489][T11557] Bluetooth: hci0: expected 2 bytes, got 7 bytes [ 419.084525][T11564] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1343'. [ 419.201398][T11564] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 421.708668][T11574] netlink: 'syz.8.1346': attribute type 21 has an invalid length. [ 421.716614][T11574] netlink: 156 bytes leftover after parsing attributes in process `syz.8.1346'. [ 421.727114][T11574] netlink: 'syz.8.1346': attribute type 21 has an invalid length. [ 421.736753][T11574] netlink: 156 bytes leftover after parsing attributes in process `syz.8.1346'. [ 421.914180][ T9] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 421.955872][ T5938] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 422.154121][T11594] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1347'. [ 422.222304][ T5938] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 422.233570][ T5938] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 422.249655][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.354030][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 422.357537][ T5938] usb 6-1: config 0 descriptor?? [ 422.360470][ T9] usb 8-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 422.383567][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.385921][ T5938] pwc: Askey VC010 type 2 USB webcam detected. [ 422.434008][ T5850] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 422.463291][ T9] usb 8-1: config 0 descriptor?? [ 422.693185][ T5850] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 422.706651][ T5850] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 422.716503][ T5850] usb 7-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 422.727518][ T5850] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.742543][ T5850] usb 7-1: config 0 descriptor?? [ 422.893777][ T5938] pwc: recv_control_msg error -32 req 02 val 2b00 [ 422.911608][ T5938] pwc: recv_control_msg error -32 req 02 val 2700 [ 422.955959][ T5938] pwc: recv_control_msg error -32 req 02 val 2c00 [ 422.962924][ T5938] pwc: recv_control_msg error -32 req 04 val 1000 [ 422.988613][ T5938] pwc: recv_control_msg error -32 req 04 val 1300 [ 423.038357][ T5938] pwc: recv_control_msg error -32 req 04 val 1400 [ 423.156940][ T5962] libceph: connect (1)[c::]:6789 error -101 [ 423.163819][ T5962] libceph: mon0 (1)[c::]:6789 connect error [ 423.246962][ T5938] pwc: recv_control_msg error -32 req 02 val 2100 [ 423.254906][ T5938] pwc: recv_control_msg error -32 req 04 val 1500 [ 423.261432][T11597] ceph: No mds server is up or the cluster is laggy [ 423.274976][ T5938] pwc: recv_control_msg error -32 req 02 val 2500 [ 423.284923][ T5938] pwc: recv_control_msg error -71 req 02 val 2400 [ 423.305059][ T5938] pwc: recv_control_msg error -71 req 02 val 2600 [ 423.319902][ T5938] pwc: recv_control_msg error -71 req 02 val 2900 [ 423.337853][ T5938] pwc: recv_control_msg error -71 req 02 val 2800 [ 423.368325][ T5938] pwc: recv_control_msg error -71 req 04 val 1100 [ 423.553750][T11603] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1351'. [ 423.569694][T11603] netlink: 'syz.9.1351': attribute type 4 has an invalid length. [ 423.622857][ T5938] pwc: recv_control_msg error -71 req 04 val 1200 [ 423.633658][ T5938] pwc: Registered as video103. [ 423.670770][ T5938] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input7 [ 423.735060][ T5938] usb 6-1: USB disconnect, device number 13 [ 424.008464][T11615] FAULT_INJECTION: forcing a failure. [ 424.008464][T11615] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.022697][T11615] CPU: 1 UID: 0 PID: 11615 Comm: syz.8.1354 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 424.022723][T11615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 424.022732][T11615] Call Trace: [ 424.022738][T11615] [ 424.022744][T11615] dump_stack_lvl+0x16c/0x1f0 [ 424.022773][T11615] should_fail_ex+0x512/0x640 [ 424.022786][T11615] _copy_from_iter+0x29f/0x16f0 [ 424.022799][T11615] ? __alloc_skb+0x200/0x380 [ 424.022815][T11615] ? __pfx___alloc_skb+0x10/0x10 [ 424.022829][T11615] ? __pfx__copy_from_iter+0x10/0x10 [ 424.022849][T11615] ? skb_page_frag_refill+0x11d/0x5c0 [ 424.022870][T11615] ? sk_page_frag_refill+0x6c/0x300 [ 424.022891][T11615] tcp_sendmsg_locked+0x28c7/0x42a0 [ 424.022923][T11615] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 424.022937][T11615] ? do_raw_spin_lock+0x12c/0x2b0 [ 424.022950][T11615] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 424.022964][T11615] ? __local_bh_enable_ip+0xa4/0x120 [ 424.022989][T11615] tcp_sendmsg+0x2e/0x50 [ 424.023007][T11615] ? __pfx_tcp_sendmsg+0x10/0x10 [ 424.023024][T11615] inet6_sendmsg+0xb9/0x140 [ 424.023042][T11615] ____sys_sendmsg+0x705/0xc70 [ 424.023061][T11615] ? copy_msghdr_from_user+0x10a/0x160 [ 424.023077][T11615] ? __pfx_____sys_sendmsg+0x10/0x10 [ 424.023095][T11615] ___sys_sendmsg+0x134/0x1d0 [ 424.023111][T11615] ? __pfx____sys_sendmsg+0x10/0x10 [ 424.023153][T11615] ? __mutex_unlock_slowpath+0x100/0x800 [ 424.023185][T11615] __sys_sendmsg+0x16d/0x220 [ 424.023208][T11615] ? __pfx___sys_sendmsg+0x10/0x10 [ 424.023235][T11615] do_syscall_64+0xcd/0x4c0 [ 424.023245][T11615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.023256][T11615] RIP: 0033:0x7fd76a18ebe9 [ 424.023265][T11615] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 424.023280][T11615] RSP: 002b:00007fd76af6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 424.023298][T11615] RAX: ffffffffffffffda RBX: 00007fd76a3b5fa0 RCX: 00007fd76a18ebe9 [ 424.023308][T11615] RDX: 0000000000004084 RSI: 0000200000000280 RDI: 0000000000000004 [ 424.023318][T11615] RBP: 00007fd76af6a090 R08: 0000000000000000 R09: 0000000000000000 [ 424.023327][T11615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.023336][T11615] R13: 00007fd76a3b6038 R14: 00007fd76a3b5fa0 R15: 00007ffd8ca0fc78 [ 424.023358][T11615] [ 424.845966][ T9] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 424.858241][ T9] asix 8-1:0.0: probe with driver asix failed with error -71 [ 424.914264][ T9] usb 8-1: USB disconnect, device number 13 [ 425.417752][ T5850] usbhid 7-1:0.0: can't add hid device: -71 [ 425.426026][ T5850] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 425.441897][ T5850] usb 7-1: USB disconnect, device number 12 [ 425.601886][T11634] netlink: 'syz.9.1360': attribute type 4 has an invalid length. [ 425.625269][ T30] audit: type=1400 audit(2000000093.140:463): avc: denied { bind } for pid=11631 comm="syz.9.1360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 425.941590][ T30] audit: type=1400 audit(2000000093.150:464): avc: denied { name_bind } for pid=11631 comm="syz.9.1360" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 425.994684][T11636] syz.6.1361 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 426.020380][ T30] audit: type=1400 audit(2000000093.150:465): avc: denied { node_bind } for pid=11631 comm="syz.9.1360" saddr=172.30.0.10 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 426.046549][ T30] audit: type=1400 audit(2000000093.160:466): avc: denied { setopt } for pid=11631 comm="syz.9.1360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 426.535098][ T5854] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 427.382958][T11640] netlink: 'syz.7.1363': attribute type 21 has an invalid length. [ 427.507387][T11652] netlink: 'syz.7.1363': attribute type 21 has an invalid length. [ 427.515469][T11640] netlink: 156 bytes leftover after parsing attributes in process `syz.7.1363'. [ 427.529070][T11652] netlink: 156 bytes leftover after parsing attributes in process `syz.7.1363'. [ 427.681454][T11661] lo speed is unknown, defaulting to 1000 [ 428.623957][ T5917] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 428.774942][ T5917] usb 7-1: Using ep0 maxpacket: 32 [ 428.790231][ T5917] usb 7-1: config 0 has an invalid interface number: 146 but max is 0 [ 428.811867][ T5917] usb 7-1: config 0 has no interface number 0 [ 428.822852][ T5917] usb 7-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 428.834117][ T5917] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 428.846330][ T5917] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 428.858560][ T5917] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 428.872622][ T5917] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 428.888431][ T5917] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 428.898891][ T5917] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 428.931788][ T5917] usb 7-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 428.947373][ T5917] usb 7-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 428.982033][ T5917] usb 7-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 428.992148][ T5917] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.001741][ T5917] usb 7-1: Product: syz [ 429.006845][ T5917] usb 7-1: Manufacturer: syz [ 429.011442][ T5917] usb 7-1: SerialNumber: syz [ 429.034751][ T5917] usb 7-1: config 0 descriptor?? [ 429.042355][T11666] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 429.051735][T11666] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 429.061610][ T5917] microtek usb (rev 0.4.3): expecting 3 got 2 endpoints! Bailing out. [ 429.162864][T11693] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1379'. [ 429.271100][ T5917] usb 7-1: USB disconnect, device number 13 [ 429.513597][T11707] netlink: 'syz.9.1384': attribute type 21 has an invalid length. [ 429.521582][T11707] netlink: 156 bytes leftover after parsing attributes in process `syz.9.1384'. [ 429.531757][T11707] netlink: 'syz.9.1384': attribute type 21 has an invalid length. [ 429.539690][T11707] netlink: 156 bytes leftover after parsing attributes in process `syz.9.1384'. [ 429.998812][T11711] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1386'. [ 430.028790][T11715] overlayfs: missing 'lowerdir' [ 430.034593][T11715] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1387'. [ 430.759856][T11729] loop9: detected capacity change from 0 to 8 [ 430.768786][T11729] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 430.776390][T11729] loop9: partition table partially beyond EOD, truncated [ 430.795223][T11729] loop9: p1 size 81768186 extends beyond EOD, truncated [ 430.881446][T11121] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 430.890851][T11121] loop9: partition table partially beyond EOD, truncated [ 430.900437][T11121] loop9: p1 size 81768186 extends beyond EOD, truncated [ 430.937099][T11732] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 430.942531][T11732] loop9: partition table partially beyond EOD, truncated [ 430.963500][T11732] loop9: p1 size 81768186 extends beyond EOD, truncated [ 431.151481][T11121] udevd[11121]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 431.221451][T11121] udevd[11121]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 433.209807][ T30] audit: type=1400 audit(2000000100.780:467): avc: denied { mounton } for pid=11762 comm="syz.8.1404" path="/189/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 433.521937][T11758] netlink: 'syz.6.1401': attribute type 21 has an invalid length. [ 433.539305][T11780] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1407'. [ 433.554493][ T30] audit: type=1400 audit(2000000101.110:468): avc: denied { ioctl } for pid=11776 comm="syz.8.1408" path="socket:[35667]" dev="sockfs" ino=35667 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 433.634636][T11758] netlink: 156 bytes leftover after parsing attributes in process `syz.6.1401'. [ 433.668040][T11758] netlink: 'syz.6.1401': attribute type 21 has an invalid length. [ 433.689483][ T30] audit: type=1400 audit(2000000101.260:469): avc: denied { ioctl } for pid=11781 comm="syz.7.1409" path="socket:[35686]" dev="sockfs" ino=35686 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 433.718671][T11758] netlink: 156 bytes leftover after parsing attributes in process `syz.6.1401'. [ 433.779664][T11785] tmpfs: Unknown parameter 'q4uota' [ 433.803971][ T5962] usb 9-1: new full-speed USB device number 16 using dummy_hcd [ 434.007318][ T5962] usb 9-1: unable to get BOS descriptor or descriptor too short [ 434.024969][ T5962] usb 9-1: not running at top speed; connect to a high speed hub [ 434.035122][ T5962] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 434.064201][ T5962] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 434.085684][ T5962] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 434.095991][ T5962] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.117221][ T5962] usb 9-1: Product: syz [ 434.121522][ T5962] usb 9-1: Manufacturer: syz [ 434.126985][ T5962] usb 9-1: SerialNumber: syz [ 434.489839][T11796] vlan2: entered promiscuous mode [ 434.944426][ T30] audit: type=1400 audit(2000000102.490:470): avc: denied { setopt } for pid=11776 comm="syz.8.1408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 435.299738][ T5962] usb 9-1: USB disconnect, device number 16 [ 435.402287][T11121] udevd[11121]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 435.631205][ T30] audit: type=1400 audit(2000000103.200:471): avc: denied { getopt } for pid=11818 comm="syz.9.1418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 435.746787][T11820] 9pnet_fd: Insufficient options for proto=fd [ 436.966489][ T30] audit: type=1400 audit(2000000104.530:472): avc: denied { ioctl } for pid=11823 comm="syz.5.1421" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 436.977023][T11834] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1423'. [ 437.190732][T11834] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1423'. [ 437.265043][T11834] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1423'. [ 437.985828][T11850] autofs: Bad value for 'fd' [ 438.018230][T11850] autofs: Bad value for 'fd' [ 438.023067][T11850] autofs: Bad value for 'fd' [ 438.031577][T11850] autofs: Bad value for 'fd' [ 438.055047][T11850] autofs: Bad value for 'fd' [ 438.060622][T11850] autofs: Bad value for 'fd' [ 438.144626][T11850] autofs: Bad value for 'fd' [ 438.153007][T11850] autofs: Bad value for 'fd' [ 438.177139][T11851] syzkaller0: entered promiscuous mode [ 438.198245][T11851] syzkaller0: entered allmulticast mode [ 438.266880][T11851] tipc: Enabled bearer , priority 10 [ 438.306418][T11846] tipc: Resetting bearer [ 438.361959][T11859] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1430'. [ 438.415688][T11846] tipc: Disabling bearer [ 438.825896][T11872] netlink: 'syz.5.1433': attribute type 21 has an invalid length. [ 438.996028][T11868] kvm: user requested TSC rate below hardware speed [ 439.110486][T11875] netlink: 'syz.5.1433': attribute type 21 has an invalid length. [ 439.142648][T11872] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1433'. [ 439.282765][T11875] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1433'. [ 439.797824][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.824334][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.993071][ T30] audit: type=1400 audit(2000000107.500:473): avc: denied { setopt } for pid=11881 comm="syz.9.1437" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 440.349368][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 440.719658][T11891] netlink: 'syz.6.1441': attribute type 3 has an invalid length. [ 440.745902][T11891] netlink: 3 bytes leftover after parsing attributes in process `syz.6.1441'. [ 440.799012][T11895] FAULT_INJECTION: forcing a failure. [ 440.799012][T11895] name failslab, interval 1, probability 0, space 0, times 0 [ 440.817517][T11895] CPU: 1 UID: 0 PID: 11895 Comm: syz.7.1442 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 440.817543][T11895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 440.817553][T11895] Call Trace: [ 440.817559][T11895] [ 440.817565][T11895] dump_stack_lvl+0x16c/0x1f0 [ 440.817595][T11895] should_fail_ex+0x512/0x640 [ 440.817611][T11895] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 440.817634][T11895] should_failslab+0xc2/0x120 [ 440.817654][T11895] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 440.817673][T11895] ? __alloc_skb+0x2b2/0x380 [ 440.817701][T11895] __alloc_skb+0x2b2/0x380 [ 440.817724][T11895] ? __pfx___alloc_skb+0x10/0x10 [ 440.817746][T11895] ? __pfx_rtnl_bridge_setlink+0x10/0x10 [ 440.817780][T11895] netlink_ack+0x15d/0xb80 [ 440.817805][T11895] netlink_rcv_skb+0x332/0x420 [ 440.817820][T11895] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 440.817849][T11895] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 440.817874][T11895] ? netlink_deliver_tap+0x1ae/0xd30 [ 440.817904][T11895] netlink_unicast+0x5aa/0x870 [ 440.817923][T11895] ? __pfx_netlink_unicast+0x10/0x10 [ 440.817950][T11895] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 440.817984][T11895] netlink_sendmsg+0x8d1/0xdd0 [ 440.818004][T11895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 440.818030][T11895] ____sys_sendmsg+0xa95/0xc70 [ 440.818050][T11895] ? copy_msghdr_from_user+0x10a/0x160 [ 440.818080][T11895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 440.818110][T11895] ___sys_sendmsg+0x134/0x1d0 [ 440.818136][T11895] ? __pfx____sys_sendmsg+0x10/0x10 [ 440.818184][T11895] ? __mutex_unlock_slowpath+0x100/0x800 [ 440.818219][T11895] __sys_sendmsg+0x16d/0x220 [ 440.818244][T11895] ? __pfx___sys_sendmsg+0x10/0x10 [ 440.818286][T11895] do_syscall_64+0xcd/0x4c0 [ 440.818304][T11895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.818321][T11895] RIP: 0033:0x7fadb0b8ebe9 [ 440.818336][T11895] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 440.818353][T11895] RSP: 002b:00007fadb19a3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 440.818370][T11895] RAX: ffffffffffffffda RBX: 00007fadb0db5fa0 RCX: 00007fadb0b8ebe9 [ 440.818382][T11895] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 440.818393][T11895] RBP: 00007fadb19a3090 R08: 0000000000000000 R09: 0000000000000000 [ 440.818404][T11895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 440.818414][T11895] R13: 00007fadb0db6038 R14: 00007fadb0db5fa0 R15: 00007ffc226727c8 [ 440.818438][T11895] [ 441.486218][ T5962] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 441.714177][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 442.060965][ T5962] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 442.069957][ T5962] usb 7-1: can't read configurations, error -61 [ 442.206954][ T5962] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 442.450238][ T30] audit: type=1400 audit(2000000110.010:474): avc: denied { create } for pid=11907 comm="syz.8.1445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 442.488717][ T30] audit: type=1400 audit(2000000110.010:475): avc: denied { setopt } for pid=11907 comm="syz.8.1445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 442.844162][ T5962] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 442.854395][ T5962] usb 7-1: can't read configurations, error -61 [ 442.872892][ T5962] usb usb7-port1: attempt power cycle [ 442.893479][T11933] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1450'. [ 442.908166][T11932] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1449'. [ 443.246510][ T5962] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 443.521983][ T30] audit: type=1400 audit(2000000110.890:476): avc: denied { connect } for pid=11936 comm="syz.5.1451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 444.294212][ T30] audit: type=1400 audit(2000000111.230:477): avc: denied { write } for pid=11936 comm="syz.5.1451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 444.461275][ T5962] usb 7-1: device descriptor read/8, error -71 [ 444.519593][T11955] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1454'. [ 445.594631][T11975] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1457'. [ 445.865504][ T5854] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 446.270835][ T5962] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 446.473962][ T5962] usb 6-1: Using ep0 maxpacket: 32 [ 446.482211][ T5962] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 446.498332][ T5962] usb 6-1: config 0 has no interface number 0 [ 446.515053][ T5962] usb 6-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 446.595336][ T5962] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 446.658706][ T5962] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 446.671314][ T5962] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 446.682697][ T5962] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 446.696415][ T5962] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 446.706620][ T5962] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 446.717972][ T5962] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 29793, setting to 1024 [ 446.749684][ T5962] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 446.774069][ T5962] usb 6-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 446.890531][ T5962] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 446.899720][ T5962] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.014488][T11992] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 447.046621][T11992] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 447.411212][ T30] audit: type=1400 audit(2000000114.560:478): avc: denied { mount } for pid=11989 comm="syz.8.1463" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 447.438890][ T5962] usb 6-1: Product: syz [ 447.445868][ T5962] usb 6-1: Manufacturer: syz [ 447.450814][ T30] audit: type=1400 audit(2000000114.780:479): avc: denied { read write } for pid=11989 comm="syz.8.1463" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 447.475356][ T5962] usb 6-1: SerialNumber: syz [ 447.483317][ T30] audit: type=1400 audit(2000000114.780:480): avc: denied { open } for pid=11989 comm="syz.8.1463" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 447.509389][ T5962] usb 6-1: config 0 descriptor?? [ 447.516000][T11980] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 447.668299][T11996] bridge_slave_0: left allmulticast mode [ 447.674167][T11996] bridge_slave_0: left promiscuous mode [ 447.680791][T11996] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.973476][T11980] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 449.031578][ T5962] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 449.041865][ T5962] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 449.064662][ T30] audit: type=1400 audit(2000000116.630:481): avc: denied { unmount } for pid=6923 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 449.095331][T11996] bridge_slave_1: left allmulticast mode [ 449.101381][T11996] bridge_slave_1: left promiscuous mode [ 449.105154][ T5962] scsi host1: microtekX6 [ 449.141175][T11996] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.270745][T12011] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1467'. [ 449.291239][ T9] usb 6-1: USB disconnect, device number 14 [ 449.388735][T11996] bond0: (slave bond_slave_0): Releasing backup interface [ 449.412383][T11996] bond0: (slave bond_slave_1): Releasing backup interface [ 449.460101][T11996] team0: Port device team_slave_0 removed [ 449.483018][T11996] team0: Port device team_slave_1 removed [ 450.285890][ T30] audit: type=1400 audit(2000000117.430:482): avc: denied { connect } for pid=12021 comm="syz.7.1472" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 450.434199][ T5910] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 450.761052][ T5910] usb 9-1: config index 0 descriptor too short (expected 7768, got 18) [ 450.885594][ T5910] usb 9-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=52.4d [ 451.016217][ T5910] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.331405][ T5910] usb 9-1: config 0 descriptor?? [ 451.363759][ T5910] ftdi_sio 9-1:0.0: Ignoring interface reserved for JTAG [ 451.574171][ T30] audit: type=1400 audit(2000000119.140:483): avc: denied { ioctl } for pid=12042 comm="syz.9.1479" path="socket:[37382]" dev="sockfs" ino=37382 ioctlcmd=0x745a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 451.588568][T12043] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1479'. [ 451.781132][T12049] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1481'. [ 452.023336][T12062] netlink: 'syz.9.1486': attribute type 10 has an invalid length. [ 452.118471][T12065] netlink: 16402 bytes leftover after parsing attributes in process `syz.9.1487'. [ 452.128673][T12064] netlink: 16402 bytes leftover after parsing attributes in process `syz.9.1487'. [ 452.324385][T12037] FAULT_INJECTION: forcing a failure. [ 452.324385][T12037] name fail_futex, interval 1, probability 0, space 0, times 1 [ 452.337561][T12037] CPU: 1 UID: 0 PID: 12037 Comm: syz.7.1477 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 452.337589][T12037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 452.337600][T12037] Call Trace: [ 452.337606][T12037] [ 452.337613][T12037] dump_stack_lvl+0x16c/0x1f0 [ 452.337647][T12037] should_fail_ex+0x512/0x640 [ 452.337668][T12037] get_futex_key+0x1d0/0x1560 [ 452.337696][T12037] ? futex_exit_release+0x31/0x220 [ 452.337721][T12037] ? __pfx_get_futex_key+0x10/0x10 [ 452.337743][T12037] ? __pfx___bpf_trace_contention_end+0x10/0x10 [ 452.337782][T12037] futex_wake+0xea/0x530 [ 452.337804][T12037] ? __pfx_futex_wake+0x10/0x10 [ 452.337835][T12037] do_futex+0x1e3/0x350 [ 452.337862][T12037] ? __pfx_do_futex+0x10/0x10 [ 452.337886][T12037] ? __might_fault+0xe3/0x190 [ 452.337911][T12037] mm_release+0x24e/0x300 [ 452.337934][T12037] do_exit+0x68e/0x2bf0 [ 452.337965][T12037] ? __pfx___might_resched+0x10/0x10 [ 452.337993][T12037] ? __pfx_do_exit+0x10/0x10 [ 452.338018][T12037] ? do_raw_spin_lock+0x12c/0x2b0 [ 452.338037][T12037] ? find_held_lock+0x2b/0x80 [ 452.338062][T12037] do_group_exit+0xd3/0x2a0 [ 452.338090][T12037] get_signal+0x2673/0x26d0 [ 452.338112][T12037] ? kick_process+0xf6/0x1a0 [ 452.338136][T12037] ? __pfx_task_work_add+0x10/0x10 [ 452.338157][T12037] ? __pfx_get_signal+0x10/0x10 [ 452.338186][T12037] arch_do_signal_or_restart+0x8f/0x7d0 [ 452.338212][T12037] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 452.338241][T12037] ? ksys_read+0x1ac/0x250 [ 452.338259][T12037] ? __pfx_ksys_read+0x10/0x10 [ 452.338282][T12037] exit_to_user_mode_loop+0x84/0x110 [ 452.338302][T12037] do_syscall_64+0x3f6/0x4c0 [ 452.338320][T12037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.338338][T12037] RIP: 0033:0x7fadb0b8ebe9 [ 452.338354][T12037] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 452.338371][T12037] RSP: 002b:00007fadb19a3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 452.338391][T12037] RAX: fffffffffffffe00 RBX: 00007fadb0db5fa0 RCX: 00007fadb0b8ebe9 [ 452.338403][T12037] RDX: 0000000000002020 RSI: 0000200000002740 RDI: 0000000000000004 [ 452.338413][T12037] RBP: 00007fadb19a3090 R08: 0000000000000000 R09: 0000000000000000 [ 452.338423][T12037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.338433][T12037] R13: 00007fadb0db6038 R14: 00007fadb0db5fa0 R15: 00007ffc226727c8 [ 452.338456][T12037] [ 452.958017][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 453.018122][ T5854] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 453.134876][ T24] usb 9-1: USB disconnect, device number 17 [ 453.603392][T12088] netlink: 220 bytes leftover after parsing attributes in process `syz.9.1492'. [ 453.726177][ T30] audit: type=1400 audit(2000000121.170:484): avc: denied { nlmsg_read } for pid=12081 comm="syz.9.1492" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 454.323540][ T30] audit: type=1400 audit(2000000121.680:485): avc: denied { write } for pid=12086 comm="syz.6.1494" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 454.355466][T12100] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1493'. [ 455.073089][ T5917] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 455.260829][T12117] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1498'. [ 455.293199][T12117] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1498'. [ 455.473950][ T5917] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 455.484555][ T5917] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 455.494569][ T5917] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.531607][ T5917] usb 9-1: config 0 descriptor?? [ 455.545918][ T5917] pwc: Askey VC010 type 2 USB webcam detected. [ 455.834011][ T5962] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 456.134080][ T5917] pwc: recv_control_msg error -32 req 02 val 2b00 [ 456.224022][ T5917] pwc: recv_control_msg error -32 req 02 val 2700 [ 456.254112][ T5962] usb 6-1: device descriptor read/64, error -71 [ 456.704360][ T5917] pwc: recv_control_msg error -32 req 02 val 2c00 [ 456.720311][ T5917] pwc: recv_control_msg error -32 req 04 val 1000 [ 456.728684][ T5917] pwc: recv_control_msg error -32 req 04 val 1300 [ 456.894351][ T5962] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 456.955197][ T5917] pwc: recv_control_msg error -32 req 02 val 2000 [ 457.023184][ T5854] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 457.420783][ T5917] pwc: recv_control_msg error -32 req 02 val 2100 [ 457.427789][ T5917] pwc: recv_control_msg error -32 req 04 val 1500 [ 457.442922][ T5917] pwc: recv_control_msg error -71 req 02 val 2500 [ 457.474151][ T5962] usb 6-1: device descriptor read/64, error -71 [ 457.484090][ T5917] pwc: recv_control_msg error -71 req 02 val 2400 [ 457.492150][ T5917] pwc: recv_control_msg error -71 req 02 val 2600 [ 457.523143][ T5917] pwc: recv_control_msg error -71 req 02 val 2900 [ 457.553774][ T5917] pwc: recv_control_msg error -71 req 02 val 2800 [ 457.581772][ T5917] pwc: recv_control_msg error -71 req 04 val 1100 [ 457.594523][ T5962] usb usb6-port1: attempt power cycle [ 457.604632][ T5917] pwc: recv_control_msg error -71 req 04 val 1200 [ 457.620478][ T5917] pwc: Registered as video103. [ 457.637003][T12141] loop9: detected capacity change from 0 to 8 [ 457.732301][T12141] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 457.737963][ T5917] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input8 [ 457.776639][ T5917] usb 9-1: USB disconnect, device number 18 [ 457.797117][T12141] loop9: partition table partially beyond EOD, truncated [ 457.870881][T12141] loop9: p1 size 81768186 extends beyond EOD, truncated [ 457.930939][T12124] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 457.951482][T12124] loop9: partition table partially beyond EOD, truncated [ 457.971480][T12124] loop9: p1 size 81768186 extends beyond EOD, truncated [ 457.990341][T12145] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 457.999362][T12145] loop9: partition table partially beyond EOD, truncated [ 458.023955][ T5962] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 458.032923][T12145] loop9: p1 size 81768186 extends beyond EOD, truncated [ 458.173115][ T30] audit: type=1400 audit(2000000125.740:486): avc: denied { append } for pid=12151 comm="syz.5.1508" name="usbmon4" dev="devtmpfs" ino=728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 458.218355][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 458.271901][ T5962] usb 6-1: device not accepting address 17, error -71 [ 459.363258][ T30] audit: type=1400 audit(2000000125.740:487): avc: denied { open } for pid=12151 comm="syz.5.1508" path="/dev/usbmon4" dev="devtmpfs" ino=728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 459.414500][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 459.443553][T12153] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1508'. [ 459.446456][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 459.501243][ T30] audit: type=1400 audit(2000000125.770:488): avc: denied { ioctl } for pid=12151 comm="syz.5.1508" path="/dev/usbmon4" dev="devtmpfs" ino=728 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 459.669959][ T30] audit: type=1400 audit(2000000125.810:489): avc: denied { read } for pid=12152 comm="syz.7.1507" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 459.792615][ T30] audit: type=1400 audit(2000000125.810:490): avc: denied { open } for pid=12152 comm="syz.7.1507" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 459.983986][ T24] usb 8-1: new full-speed USB device number 14 using dummy_hcd [ 461.045436][ T24] usb 8-1: config index 0 descriptor too short (expected 1307, got 27) [ 461.053969][ T24] usb 8-1: config 0 has an invalid interface number: 0 but max is -1 [ 461.062128][ T24] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 461.097560][ T24] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 461.109222][ T24] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 461.121058][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 461.133080][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 32768, setting to 64 [ 461.144256][ T24] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 461.160031][ T24] usb 8-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 461.169290][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.177745][ T24] usb 8-1: Product: syz [ 461.182540][ T24] usb 8-1: Manufacturer: syz [ 461.187442][ T24] usb 8-1: SerialNumber: syz [ 461.202972][ T24] usb 8-1: config 0 descriptor?? [ 461.216314][ T24] hub 8-1:0.0: bad descriptor, ignoring hub [ 461.230076][ T24] hub 8-1:0.0: probe with driver hub failed with error -5 [ 461.241286][ T24] input: syz syz as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input9 [ 461.275718][ C0] usb_acecad 8-1:0.0: can't resubmit intr, dummy_hcd.7-1/input0, status -1 [ 461.297426][ C1] usb_acecad 8-1:0.0: can't resubmit intr, dummy_hcd.7-1/input0, status -1 [ 461.304274][ T5910] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 461.440703][ T24] usb 8-1: USB disconnect, device number 14 [ 461.464205][ T5910] usb 7-1: Using ep0 maxpacket: 8 [ 461.476193][ T5910] usb 7-1: config 0 interface 0 has no altsetting 0 [ 461.496089][ T5910] usb 7-1: New USB device found, idVendor=0c70, idProduct=f003, bcdDevice= 0.00 [ 461.548290][ T5910] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.589410][ T5910] usb 7-1: config 0 descriptor?? [ 461.807215][T12199] IPVS: Error connecting to the multicast addr [ 462.365000][T12195] netlink: 'syz.5.1517': attribute type 21 has an invalid length. [ 462.382540][T12195] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1517'. [ 462.394784][T12195] netlink: 'syz.5.1517': attribute type 21 has an invalid length. [ 462.411168][T12195] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1517'. [ 462.448211][ T5910] hid_parser_main: 73 callbacks suppressed [ 462.448225][ T5910] aquacomputer_d5next 0003:0C70:F003.0004: unknown main item tag 0x0 [ 462.525927][ T5910] aquacomputer_d5next 0003:0C70:F003.0004: hidraw0: USB HID v0.00 Device [HID 0c70:f003] on usb-dummy_hcd.6-1/input0 [ 462.678090][ T5910] usb 7-1: USB disconnect, device number 18 [ 462.779025][T12211] fido_id[12211]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 462.874001][ T5967] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 463.026831][ T5967] usb 9-1: Using ep0 maxpacket: 32 [ 463.036512][ T5967] usb 9-1: config 0 has an invalid interface number: 146 but max is 0 [ 463.044953][ T5967] usb 9-1: config 0 has no interface number 0 [ 463.051732][ T5967] usb 9-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 463.064202][ T5967] usb 9-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 463.085613][ T5967] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 463.107036][ T5967] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 463.144341][ T5967] usb 9-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 463.158074][ T5967] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 463.195563][ T5967] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 463.236433][ T5967] usb 9-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 29793, setting to 1024 [ 463.249219][ T5967] usb 9-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 463.297925][ T5967] usb 9-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 463.312194][T12221] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1524'. [ 463.337742][ T5967] usb 9-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 463.347087][ T5967] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.358541][ T5967] usb 9-1: Product: syz [ 463.368016][ T5967] usb 9-1: Manufacturer: syz [ 463.383801][ T5967] usb 9-1: SerialNumber: syz [ 463.428193][ T5967] usb 9-1: config 0 descriptor?? [ 463.461100][T12210] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 463.468721][T12210] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 463.483428][ T5967] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 463.520644][ T5967] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 463.538794][ T5967] scsi host1: microtekX6 [ 463.773279][T12226] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1521'. [ 463.873436][ T5967] usb 9-1: USB disconnect, device number 19 [ 464.231174][T12239] netlink: 'syz.7.1529': attribute type 5 has an invalid length. [ 464.239689][T12239] netlink: 'syz.7.1529': attribute type 7 has an invalid length. [ 464.251131][T12239] : entered promiscuous mode [ 464.494094][ T5967] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 465.821063][T12246] syz.5.1530: attempt to access beyond end of device [ 465.821063][T12246] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 465.836474][T12246] XFS (nbd5): SB validate failed with error -5. [ 465.973439][T12260] syz.5.1530: attempt to access beyond end of device [ 465.973439][T12260] loop5: rw=0, sector=0, nr_sectors = 1 limit=0 [ 465.988322][ T5967] usb 8-1: Using ep0 maxpacket: 32 [ 466.045493][ T5967] usb 8-1: config 0 has an invalid interface number: 85 but max is 0 [ 466.142563][T12260] FAT-fs (loop5): unable to read boot sector [ 466.344745][ T5967] usb 8-1: config 0 has no interface number 0 [ 466.410080][ T5967] usb 8-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 466.432173][ T5967] usb 8-1: config 0 interface 85 has no altsetting 0 [ 466.441598][ T5967] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 466.461872][ T5967] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.494182][ T5967] usb 8-1: Product: syz [ 466.498565][ T5967] usb 8-1: Manufacturer: syz [ 466.509314][ T5967] usb 8-1: SerialNumber: syz [ 466.527408][ T5967] usb 8-1: config 0 descriptor?? [ 467.451187][ T5967] appletouch 8-1:0.85: Failed to read mode from device. [ 467.464134][ T5967] appletouch 8-1:0.85: probe with driver appletouch failed with error -5 [ 467.581432][T12283] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1538'. [ 467.592704][T12282] vlan2: entered allmulticast mode [ 467.598972][T12282] bridge_slave_0: entered allmulticast mode [ 467.665804][T12287] netlink: 'syz.9.1540': attribute type 21 has an invalid length. [ 467.676213][T12239] tmpfs: Bad value for 'mpol' [ 467.689597][T12285] bridge3: entered promiscuous mode [ 467.689981][ T5967] usb 8-1: USB disconnect, device number 15 [ 467.700354][T12287] netlink: 156 bytes leftover after parsing attributes in process `syz.9.1540'. [ 467.721643][T12287] netlink: 'syz.9.1540': attribute type 21 has an invalid length. [ 467.734498][T12287] netlink: 156 bytes leftover after parsing attributes in process `syz.9.1540'. [ 467.944924][ T30] audit: type=1400 audit(2000000135.520:491): avc: denied { write } for pid=12290 comm="syz.8.1544" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 467.969192][T12295] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1545'. [ 468.764023][ T5962] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 468.779317][ T30] audit: type=1400 audit(2000000136.350:492): avc: denied { read } for pid=12309 comm="syz.8.1549" name="usbmon2" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 468.842939][ T30] audit: type=1400 audit(2000000136.410:493): avc: denied { setattr } for pid=12309 comm="syz.8.1549" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 468.914081][ T5962] usb 8-1: Using ep0 maxpacket: 16 [ 468.920874][ T5962] usb 8-1: config 0 has an invalid interface number: 105 but max is 0 [ 468.930353][ T5962] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 468.941390][ T5962] usb 8-1: config 0 has no interface number 0 [ 468.949274][ T5962] usb 8-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 468.958493][ T5962] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.966549][ T5962] usb 8-1: Product: syz [ 468.970874][ T5962] usb 8-1: Manufacturer: syz [ 468.975496][ T5962] usb 8-1: SerialNumber: syz [ 468.982368][ T5962] usb 8-1: config 0 descriptor?? [ 468.990868][ T5962] usb 8-1: Found UVC 0.00 device syz (046d:08f3) [ 468.997275][ T5962] usb 8-1: No valid video chain found. [ 469.266818][ T5962] usb 8-1: USB disconnect, device number 16 [ 469.779722][T12319] FAULT_INJECTION: forcing a failure. [ 469.779722][T12319] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.793175][T12319] CPU: 1 UID: 0 PID: 12319 Comm: syz.8.1552 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 469.793198][T12319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 469.793206][T12319] Call Trace: [ 469.793212][T12319] [ 469.793218][T12319] dump_stack_lvl+0x16c/0x1f0 [ 469.793245][T12319] should_fail_ex+0x512/0x640 [ 469.793262][T12319] _copy_from_user+0x2e/0xd0 [ 469.793277][T12319] evdev_do_ioctl+0xa1e/0x1b30 [ 469.793297][T12319] ? __pfx_evdev_do_ioctl+0x10/0x10 [ 469.793328][T12319] evdev_ioctl+0x16f/0x1a0 [ 469.793343][T12319] ? __pfx_evdev_ioctl+0x10/0x10 [ 469.793359][T12319] __x64_sys_ioctl+0x18e/0x210 [ 469.793382][T12319] do_syscall_64+0xcd/0x4c0 [ 469.793399][T12319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.793413][T12319] RIP: 0033:0x7fd76a18ebe9 [ 469.793424][T12319] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 469.793437][T12319] RSP: 002b:00007fd76af6a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 469.793450][T12319] RAX: ffffffffffffffda RBX: 00007fd76a3b5fa0 RCX: 00007fd76a18ebe9 [ 469.793459][T12319] RDX: 0000000000000000 RSI: 00000000400445a0 RDI: 0000000000000003 [ 469.793467][T12319] RBP: 00007fd76af6a090 R08: 0000000000000000 R09: 0000000000000000 [ 469.793475][T12319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.793483][T12319] R13: 00007fd76a3b6038 R14: 00007fd76a3b5fa0 R15: 00007ffd8ca0fc78 [ 469.793502][T12319] [ 470.006226][T12322] syzkaller0: entered promiscuous mode [ 470.011697][T12322] syzkaller0: entered allmulticast mode [ 470.029064][T12322] tipc: Started in network mode [ 470.034940][T12322] tipc: Node identity 32276a0c41f, cluster identity 4711 [ 470.043476][T12322] tipc: Enabled bearer , priority 10 [ 470.051320][T12321] tipc: Resetting bearer [ 470.068796][T12321] tipc: Disabling bearer [ 470.081816][ T30] audit: type=1400 audit(2000000137.650:494): avc: denied { write } for pid=12320 comm="syz.7.1553" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 471.992712][ T24] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 472.329427][T12356] loop9: detected capacity change from 0 to 8 [ 472.408076][T12356] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 472.413647][T12356] loop9: partition table partially beyond EOD, truncated [ 472.414025][ T24] usb 8-1: device descriptor read/64, error -71 [ 472.422505][T12356] loop9: p1 size 81768186 extends beyond EOD, truncated [ 472.487057][T11956] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 472.493139][T11956] loop9: partition table partially beyond EOD, truncated [ 472.509499][T11956] loop9: p1 size 81768186 extends beyond EOD, truncated [ 472.538077][T12357] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 472.543450][T12357] loop9: partition table partially beyond EOD, truncated [ 472.551504][T12357] loop9: p1 size 81768186 extends beyond EOD, truncated [ 472.558597][ T5850] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 472.615227][T12361] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 472.644202][T12361] loop9: partition table partially beyond EOD, truncated [ 472.654302][T12361] loop9: p1 size 81768186 extends beyond EOD, truncated [ 472.666299][ T24] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 472.684116][T12360] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 472.713973][T12360] loop9: partition table partially beyond EOD, truncated [ 472.717909][ T5850] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 472.734555][ T5850] usb 7-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00 [ 472.743675][ T5850] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.763249][T12360] loop9: p1 size 81768186 extends beyond EOD, truncated [ 472.781724][ T5850] usb 7-1: config 0 descriptor?? [ 472.818872][ T24] usb 8-1: device descriptor read/64, error -71 [ 472.836383][ T30] audit: type=1400 audit(2000000140.400:495): avc: denied { bind } for pid=12362 comm="syz.5.1565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 472.853377][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 472.931940][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 472.947786][ T30] audit: type=1400 audit(2000000140.400:496): avc: denied { setopt } for pid=12362 comm="syz.5.1565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 472.963181][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 472.984231][ T24] usb usb8-port1: attempt power cycle [ 473.125300][ T30] audit: type=1400 audit(2000000140.560:497): avc: denied { nlmsg_read } for pid=12366 comm="syz.5.1567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 473.243085][T12380] pim6reg9: entered allmulticast mode [ 473.273023][T12382] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1570'. [ 473.364521][ T24] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 473.384533][ T24] usb 8-1: device descriptor read/8, error -71 [ 473.394090][ T5850] usb 9-1: new full-speed USB device number 20 using dummy_hcd [ 473.524105][ T5850] usb 9-1: device descriptor read/64, error -71 [ 473.644172][ T24] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 473.665018][ T24] usb 8-1: device descriptor read/8, error -71 [ 473.725274][ T30] audit: type=1400 audit(2000000141.300:498): avc: denied { setattr } for pid=12350 comm="syz.6.1561" name="NETLINK" dev="sockfs" ino=39258 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 473.726349][T12389] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1561'. [ 473.749003][ C0] vkms_vblank_simulate: vblank timer overrun [ 473.764229][ T5850] usb 9-1: new full-speed USB device number 21 using dummy_hcd [ 473.779762][T12389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.784278][ T24] usb usb8-port1: unable to enumerate USB device [ 473.790945][T12389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.904048][ T5850] usb 9-1: device descriptor read/64, error -71 [ 474.025506][ T5850] usb usb9-port1: attempt power cycle [ 474.184993][T12392] overlayfs: missing 'lowerdir' [ 474.454175][ T5850] usb 9-1: new full-speed USB device number 22 using dummy_hcd [ 474.484610][ T5850] usb 9-1: device descriptor read/8, error -71 [ 474.724018][ T5850] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 474.755076][ T5850] usb 9-1: device descriptor read/8, error -71 [ 474.864923][ T5850] usb usb9-port1: unable to enumerate USB device [ 475.520515][ T5850] usb 7-1: USB disconnect, device number 19 [ 475.596734][T12410] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(7) [ 475.603272][T12410] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 475.616372][T12410] vhci_hcd vhci_hcd.0: Device attached [ 475.636348][T12411] vhci_hcd: connection closed [ 475.638038][ T3620] vhci_hcd: stop threads [ 475.649186][ T3620] vhci_hcd: release socket [ 475.653607][ T3620] vhci_hcd: disconnect device [ 475.890960][T12419] input: syz0 as /devices/virtual/input/input11 [ 476.939280][ T61] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 476.967080][T12433] FAULT_INJECTION: forcing a failure. [ 476.967080][T12433] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 476.980331][T12433] CPU: 0 UID: 0 PID: 12433 Comm: syz.6.1589 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 476.980357][T12433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 476.980367][T12433] Call Trace: [ 476.980372][T12433] [ 476.980379][T12433] dump_stack_lvl+0x16c/0x1f0 [ 476.980410][T12433] should_fail_ex+0x512/0x640 [ 476.980435][T12433] _copy_to_user+0x32/0xd0 [ 476.980456][T12433] bpf_test_finish.isra.0+0x53c/0x6e0 [ 476.980486][T12433] ? __pfx_bpf_test_finish.isra.0+0x10/0x10 [ 476.980517][T12433] ? __asan_memset+0x23/0x50 [ 476.980545][T12433] bpf_prog_test_run_skb+0x1368/0x2280 [ 476.980579][T12433] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 476.980607][T12433] ? fput+0x9b/0xd0 [ 476.980632][T12433] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 476.980657][T12433] __sys_bpf+0x1050/0x4de0 [ 476.980683][T12433] ? __pfx___sys_bpf+0x10/0x10 [ 476.980704][T12433] ? ksys_write+0x190/0x250 [ 476.980726][T12433] ? __mutex_unlock_slowpath+0x163/0x800 [ 476.980767][T12433] ? fput+0x9b/0xd0 [ 476.980790][T12433] ? ksys_write+0x1ac/0x250 [ 476.980806][T12433] ? __pfx_ksys_write+0x10/0x10 [ 476.980829][T12433] __x64_sys_bpf+0x78/0xc0 [ 476.980851][T12433] ? lockdep_hardirqs_on+0x7c/0x110 [ 476.980876][T12433] do_syscall_64+0xcd/0x4c0 [ 476.980894][T12433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.980912][T12433] RIP: 0033:0x7f9087b8ebe9 [ 476.980926][T12433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 476.980942][T12433] RSP: 002b:00007f9088a61038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 476.980959][T12433] RAX: ffffffffffffffda RBX: 00007f9087db5fa0 RCX: 00007f9087b8ebe9 [ 476.980970][T12433] RDX: 0000000000000050 RSI: 0000200000000580 RDI: 000000000000000a [ 476.980979][T12433] RBP: 00007f9088a61090 R08: 0000000000000000 R09: 0000000000000000 [ 476.980989][T12433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 476.980998][T12433] R13: 00007f9087db6038 R14: 00007f9087db5fa0 R15: 00007ffc31a8a2a8 [ 476.981022][T12433] [ 478.243651][T12454] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1593'. [ 479.031920][ T5869] Bluetooth: hci4: command 0x1003 tx timeout [ 479.038702][ T5854] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 480.186723][ T30] audit: type=1400 audit(2000000147.760:499): avc: denied { map } for pid=12469 comm="syz.7.1599" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 480.945564][ T30] audit: type=1400 audit(2000000148.490:500): avc: denied { execute } for pid=12479 comm="syz.9.1602" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=38778 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 482.810812][T12503] fuse: Unknown parameter '­' [ 483.484042][ T5910] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 483.606437][T12533] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 0, id = 0 [ 483.875568][ T5910] usb 9-1: device descriptor read/64, error -71 [ 484.324315][ T5910] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 484.489182][ T5910] usb 9-1: device descriptor read/64, error -71 [ 484.553546][T12549] tmpfs: Bad value for 'mpol' [ 484.559692][T12549] batadv_slave_1: entered allmulticast mode [ 484.606473][ T5910] usb usb9-port1: attempt power cycle [ 485.197059][T12549] batadv_slave_1: left allmulticast mode [ 485.343975][ T5910] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 485.914291][ T5910] usb 9-1: device descriptor read/8, error -71 [ 486.353990][ T5910] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 486.638028][ T5910] usb 9-1: device not accepting address 27, error -71 [ 487.096852][ T5910] usb usb9-port1: unable to enumerate USB device [ 487.121585][T12579] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1627'. [ 487.915484][T12598] loop9: detected capacity change from 0 to 8 [ 487.947050][T12188] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 487.959679][ T5854] Bluetooth: hci3: unexpected event for opcode 0x0419 [ 487.985217][T12188] loop9: partition table partially beyond EOD, truncated [ 487.992664][T12188] loop9: p1 size 81768186 extends beyond EOD, truncated [ 488.009188][T12598] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 488.017886][T12598] loop9: partition table partially beyond EOD, truncated [ 488.031669][T12598] loop9: p1 size 81768186 extends beyond EOD, truncated [ 488.177024][T12188] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 488.182350][T12188] loop9: partition table partially beyond EOD, truncated [ 488.241724][T12188] loop9: p1 size 81768186 extends beyond EOD, truncated [ 488.276369][ T30] audit: type=1400 audit(2000000155.850:501): avc: denied { watch_reads } for pid=12607 comm="syz.7.1636" path="/270" dev="tmpfs" ino=1451 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 488.413042][T12605] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 488.421991][T12605] loop9: partition table partially beyond EOD, truncated [ 488.429314][T12605] loop9: p1 size 81768186 extends beyond EOD, truncated [ 489.008803][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 489.095652][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 489.757474][T12624] netlink: 'syz.9.1640': attribute type 10 has an invalid length. [ 489.836279][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 489.902321][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 490.657506][T12635] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12635 comm=syz.6.1642 [ 490.750382][T12635] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4 sclass=netlink_route_socket pid=12635 comm=syz.6.1642 [ 490.850947][T12640] netlink: 68 bytes leftover after parsing attributes in process `syz.9.1644'. [ 490.904159][T12641] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1643'. [ 491.605936][ T5910] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 492.232093][T12663] loop9: detected capacity change from 0 to 8 [ 492.243567][T12663] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 492.263532][T12663] loop9: partition table partially beyond EOD, truncated [ 492.271905][T12663] loop9: p1 size 81768186 extends beyond EOD, truncated [ 492.394169][ T5910] usb 8-1: Using ep0 maxpacket: 32 [ 492.400551][ T5910] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 492.409955][ T5910] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.411942][T12188] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 492.423774][T12188] loop9: partition table partially beyond EOD, truncated [ 492.430932][ T5910] usb 8-1: config 0 descriptor?? [ 492.434156][T12188] loop9: p1 size 81768186 extends beyond EOD, truncated [ 492.535396][ T5854] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 492.933725][T12666] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 492.943213][T12666] loop9: partition table partially beyond EOD, truncated [ 492.957002][T12666] loop9: p1 size 81768186 extends beyond EOD, truncated [ 493.066636][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 493.120692][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 493.160995][ T5910] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 493.193584][ T5910] usb 8-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 493.213430][ T5910] usb 8-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 493.224801][ T30] audit: type=1400 audit(2000000160.780:502): avc: denied { firmware_load } for pid=5910 comm="kworker/0:4" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 493.337243][T12685] FAULT_INJECTION: forcing a failure. [ 493.337243][T12685] name failslab, interval 1, probability 0, space 0, times 0 [ 493.351410][T12685] CPU: 0 UID: 0 PID: 12685 Comm: syz.6.1659 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 493.351438][T12685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 493.351448][T12685] Call Trace: [ 493.351454][T12685] [ 493.351461][T12685] dump_stack_lvl+0x16c/0x1f0 [ 493.351498][T12685] should_fail_ex+0x512/0x640 [ 493.351514][T12685] ? fs_reclaim_acquire+0xae/0x150 [ 493.351538][T12685] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 493.351561][T12685] should_failslab+0xc2/0x120 [ 493.351582][T12685] __kmalloc_noprof+0xd2/0x510 [ 493.351606][T12685] tomoyo_realpath_from_path+0xc2/0x6e0 [ 493.351632][T12685] ? tomoyo_profile+0x47/0x60 [ 493.351660][T12685] tomoyo_path_number_perm+0x245/0x580 [ 493.351678][T12685] ? tomoyo_path_number_perm+0x237/0x580 [ 493.351699][T12685] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 493.351719][T12685] ? find_held_lock+0x2b/0x80 [ 493.351764][T12685] ? find_held_lock+0x2b/0x80 [ 493.351784][T12685] ? hook_file_ioctl_common+0x145/0x410 [ 493.351814][T12685] ? __fget_files+0x20e/0x3c0 [ 493.351836][T12685] security_file_ioctl+0x9b/0x240 [ 493.351860][T12685] __x64_sys_ioctl+0xb7/0x210 [ 493.351887][T12685] do_syscall_64+0xcd/0x4c0 [ 493.351905][T12685] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.351923][T12685] RIP: 0033:0x7f9087b8ebe9 [ 493.351938][T12685] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 493.351955][T12685] RSP: 002b:00007f9088a61038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 493.351972][T12685] RAX: ffffffffffffffda RBX: 00007f9087db5fa0 RCX: 00007f9087b8ebe9 [ 493.351983][T12685] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 493.351993][T12685] RBP: 00007f9088a61090 R08: 0000000000000000 R09: 0000000000000000 [ 493.352003][T12685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.352013][T12685] R13: 00007f9087db6038 R14: 00007f9087db5fa0 R15: 00007ffc31a8a2a8 [ 493.352037][T12685] [ 493.352044][T12685] ERROR: Out of memory at tomoyo_realpath_from_path. [ 493.441710][T12690] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1660'. [ 494.619738][ T24] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 494.820182][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 494.873797][ T24] usb 6-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 494.924206][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.961138][ T24] usb 6-1: config 0 descriptor?? [ 495.166749][T12735] geneve2: entered promiscuous mode [ 495.173740][ T37] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.269032][ T3620] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.288311][ T3620] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.340702][T12741] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1677'. [ 495.355267][ T3620] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.562072][T12753] bridge4: entered allmulticast mode [ 495.667364][ T30] audit: type=1400 audit(2000000163.240:503): avc: denied { getopt } for pid=12759 comm="syz.6.1681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 496.117600][T12765] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 496.130663][T12765] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 496.260150][T12765] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 496.267716][T12765] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 496.371053][T12774] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1683'. [ 496.525278][T12781] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1685'. [ 496.768883][ T1209] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 497.029346][T12786] loop9: detected capacity change from 0 to 8 [ 497.046658][ T1209] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 497.060861][T12786] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 497.072990][T12786] loop9: partition table partially beyond EOD, truncated [ 497.075285][ T1209] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 497.094999][T12786] loop9: p1 size 81768186 extends beyond EOD, truncated [ 497.124980][ T1209] usb 7-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 497.144714][ T1209] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.157316][T12188] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 497.162727][T12188] loop9: partition table partially beyond EOD, truncated [ 497.171464][ T1209] usb 7-1: config 0 descriptor?? [ 497.180859][T12188] loop9: p1 size 81768186 extends beyond EOD, truncated [ 497.208868][T12788] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 497.215730][T12788] loop9: partition table partially beyond EOD, truncated [ 497.223773][T12788] loop9: p1 size 81768186 extends beyond EOD, truncated [ 497.261391][T12708] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 497.267708][T12708] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 497.279664][T12708] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 497.286192][T12708] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 497.294533][T12708] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 497.300440][T12708] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 497.310059][T12708] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 497.316007][T12708] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 497.347037][ T24] usbhid 6-1:0.0: can't add hid device: -71 [ 497.353446][ T24] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 497.367376][ T24] usb 6-1: USB disconnect, device number 19 [ 497.377329][T12790] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 497.391227][T12790] loop9: partition table partially beyond EOD, truncated [ 497.407662][T12790] loop9: p1 size 81768186 extends beyond EOD, truncated [ 497.615175][ T1209] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 497.639847][ T1209] hid-thrustmaster 0003:044F:B65D.0005: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.6-1/input0 [ 497.669014][ T1209] hid-thrustmaster 0003:044F:B65D.0005: Wrong number of endpoints? [ 497.855245][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 499.491674][ C1] hid-thrustmaster 0003:044F:B65D.0005: URB to get model id failed with error -71 [ 499.583471][ T10] usb 7-1: USB disconnect, device number 20 [ 499.705725][ T30] audit: type=1400 audit(2000000167.270:504): avc: denied { map } for pid=12802 comm="syz.7.1691" path="socket:[40506]" dev="sockfs" ino=40506 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 499.731081][ T30] audit: type=1400 audit(2000000167.270:505): avc: denied { read accept } for pid=12802 comm="syz.7.1691" path="socket:[40506]" dev="sockfs" ino=40506 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 499.770824][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 499.880413][ T30] audit: type=1400 audit(2000000167.390:506): avc: denied { ioctl } for pid=12802 comm="syz.7.1691" path="socket:[41129]" dev="sockfs" ino=41129 ioctlcmd=0x89e4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 500.334375][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 500.610672][T12818] tipc: Enabled bearer , priority 0 [ 501.101277][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.107769][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.154093][ T1209] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 501.394043][ T1209] usb 9-1: Using ep0 maxpacket: 32 [ 501.459410][ T1209] usb 9-1: config 0 has an invalid interface number: 35 but max is 0 [ 501.580422][ T1209] usb 9-1: config 0 has no interface number 0 [ 501.719351][ T1209] usb 9-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 501.756283][ T5962] tipc: Node number set to 1943497228 [ 501.858349][ T1209] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.974892][ T1209] usb 9-1: Product: syz [ 502.046576][ T1209] usb 9-1: Manufacturer: syz [ 502.108184][ T1209] usb 9-1: SerialNumber: syz [ 502.305981][ T1209] usb 9-1: config 0 descriptor?? [ 502.669330][ T1209] radio-si470x 9-1:0.35: could not find interrupt in endpoint [ 502.792899][ T1209] radio-si470x 9-1:0.35: probe with driver radio-si470x failed with error -5 [ 503.048896][ T1209] radio-raremono 9-1:0.35: this is not Thanko's Raremono. [ 503.176032][T12839] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 0, id = 0 [ 503.185363][ T1209] usbhid 9-1:0.35: couldn't find an input interrupt endpoint [ 503.202126][ T1209] usb 9-1: USB disconnect, device number 28 [ 503.663035][T12846] wireguard0: entered promiscuous mode [ 503.670999][T12846] wireguard0: entered allmulticast mode [ 504.392724][T12854] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1704'. [ 504.392724][T12853] netlink: 16 bytes leftover after parsing attributes in process `syz.7.1704'. [ 504.403983][ T1209] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 504.592090][T12818] tipc: Disabling bearer [ 504.793961][ T1209] usb 9-1: device not accepting address 29, error -71 [ 505.743476][T12869] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1709'. [ 506.084080][T12881] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12881 comm=syz.8.1714 [ 506.085667][T12886] netlink: 36 bytes leftover after parsing attributes in process `syz.9.1715'. [ 506.304120][ T30] audit: type=1400 audit(2000000173.810:507): avc: denied { connect } for pid=12873 comm="syz.5.1711" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 509.313176][ T5967] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 509.589129][ T5967] usb 9-1: Using ep0 maxpacket: 32 [ 510.073210][ T5967] usb 9-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 510.084179][ T5967] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.100958][ T5967] usb 9-1: Product: syz [ 510.106415][ T5967] usb 9-1: Manufacturer: syz [ 510.111103][ T5967] usb 9-1: SerialNumber: syz [ 510.122578][ T5967] usb 9-1: config 0 descriptor?? [ 510.131987][ T5967] usb 9-1: no audio or video endpoints found [ 510.434051][ T30] audit: type=1400 audit(2000000177.990:508): avc: denied { create } for pid=12909 comm="syz.8.1721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 511.407425][ T10] usb 9-1: USB disconnect, device number 31 [ 511.759711][T12946] netlink: 'syz.6.1730': attribute type 10 has an invalid length. [ 511.793177][T12946] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 512.890285][T12980] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1741'. [ 513.878751][T12991] netlink: 84 bytes leftover after parsing attributes in process `syz.6.1744'. [ 513.905665][T12994] netlink: 'syz.5.1745': attribute type 2 has an invalid length. [ 514.411982][T13008] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1749'. [ 514.693216][T13018] loop9: detected capacity change from 0 to 8 [ 514.712248][T12188] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 514.741587][T12188] loop9: partition table partially beyond EOD, truncated [ 514.760468][T12188] loop9: p1 size 81768186 extends beyond EOD, truncated [ 514.907152][T13018] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 514.923505][T13018] loop9: partition table partially beyond EOD, truncated [ 515.488037][T13018] loop9: p1 size 81768186 extends beyond EOD, truncated [ 517.216272][T13037] FAULT_INJECTION: forcing a failure. [ 517.216272][T13037] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 517.306851][T13037] CPU: 1 UID: 0 PID: 13037 Comm: syz.5.1759 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 517.306871][T13037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 517.306877][T13037] Call Trace: [ 517.306880][T13037] [ 517.306885][T13037] dump_stack_lvl+0x16c/0x1f0 [ 517.306906][T13037] should_fail_ex+0x512/0x640 [ 517.306918][T13037] _copy_to_user+0x32/0xd0 [ 517.306931][T13037] simple_read_from_buffer+0xcb/0x170 [ 517.306944][T13037] proc_fail_nth_read+0x197/0x240 [ 517.306957][T13037] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 517.306970][T13037] ? rw_verify_area+0xcf/0x6c0 [ 517.306989][T13037] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 517.307000][T13037] vfs_read+0x1e1/0xc60 [ 517.307013][T13037] ? __pfx___mutex_lock+0x10/0x10 [ 517.307023][T13037] ? __pfx_vfs_read+0x10/0x10 [ 517.307037][T13037] ? __fget_files+0x20e/0x3c0 [ 517.307053][T13037] ksys_read+0x12a/0x250 [ 517.307063][T13037] ? __pfx_ksys_read+0x10/0x10 [ 517.307078][T13037] do_syscall_64+0xcd/0x4c0 [ 517.307089][T13037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.307100][T13037] RIP: 0033:0x7f89ba18d5fc [ 517.307109][T13037] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 517.307123][T13037] RSP: 002b:00007f89bb006030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 517.307133][T13037] RAX: ffffffffffffffda RBX: 00007f89ba3b5fa0 RCX: 00007f89ba18d5fc [ 517.307139][T13037] RDX: 000000000000000f RSI: 00007f89bb0060a0 RDI: 0000000000000004 [ 517.307145][T13037] RBP: 00007f89bb006090 R08: 0000000000000000 R09: 0000000000000000 [ 517.307152][T13037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 517.307157][T13037] R13: 00007f89ba3b6038 R14: 00007f89ba3b5fa0 R15: 00007ffeed14fbb8 [ 517.307171][T13037] [ 517.334932][T12188] udevd[12188]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 517.844024][ T5967] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 517.931472][ T30] audit: type=1400 audit(2000000185.500:509): avc: denied { setopt } for pid=13039 comm="syz.7.1760" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 518.052347][ T5967] usb 7-1: Using ep0 maxpacket: 32 [ 518.059263][ T5967] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 518.059290][ T5967] usb 7-1: config 0 has no interface number 0 [ 518.059327][ T5967] usb 7-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 518.062433][ T5967] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 518.062457][ T5967] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.062477][ T5967] usb 7-1: Product: syz [ 518.062493][ T5967] usb 7-1: Manufacturer: syz [ 518.062509][ T5967] usb 7-1: SerialNumber: syz [ 518.064753][ T5967] usb 7-1: config 0 descriptor?? [ 518.068702][ T5967] em28xx 7-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 518.068733][ T5967] em28xx 7-1:0.132: Video interface 132 found: [ 518.280761][T13049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.315243][T13049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.328233][T13049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.352148][T13049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.888757][T13076] loop9: detected capacity change from 0 to 8 [ 518.898257][ T5967] em28xx 7-1:0.132: unknown em28xx chip ID (0) [ 518.910434][T13076] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 518.923031][T13076] loop9: partition table partially beyond EOD, truncated [ 519.442447][T13076] loop9: p1 size 81768186 extends beyond EOD, truncated [ 519.515077][ T5967] em28xx 7-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 519.523821][ T5967] em28xx 7-1:0.132: board has no eeprom [ 519.713949][ T5967] em28xx 7-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 519.724025][ T5967] em28xx 7-1:0.132: analog set to bulk mode. [ 519.735733][ T5850] em28xx 7-1:0.132: Registering V4L2 extension [ 519.753762][ T5967] usb 7-1: USB disconnect, device number 21 [ 519.766639][ T5967] em28xx 7-1:0.132: Disconnecting em28xx [ 519.852527][T12127] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 519.880808][T12127] loop9: partition table partially beyond EOD, truncated [ 519.928592][T12127] loop9: p1 size 81768186 extends beyond EOD, truncated [ 519.930409][ T5850] em28xx 7-1:0.132: Config register raw data: 0xffffffed [ 519.957589][ T5850] em28xx 7-1:0.132: AC97 chip type couldn't be determined [ 519.968437][T13082] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 519.973949][ T5850] em28xx 7-1:0.132: No AC97 audio processor [ 519.984036][T13082] loop9: partition table partially beyond EOD, truncated [ 519.991260][T13082] loop9: p1 size 81768186 extends beyond EOD, truncated [ 520.000340][ T5850] usb 7-1: Decoder not found [ 520.006046][ T5850] em28xx 7-1:0.132: failed to create media graph [ 520.012883][ T5850] em28xx 7-1:0.132: V4L2 device video103 deregistered [ 520.075839][ T5850] em28xx 7-1:0.132: Remote control support is not available for this card. [ 520.113973][ T5967] em28xx 7-1:0.132: Closing input extension [ 520.164934][T13097] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1773'. [ 520.200035][ T5967] em28xx 7-1:0.132: Freeing device [ 520.219517][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 520.340397][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 521.049068][T12124] udevd[12124]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 523.154863][ T30] audit: type=1400 audit(2000000190.730:510): avc: denied { ioctl } for pid=13119 comm="syz.5.1780" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 524.525584][ T5967] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 524.756880][ T5967] usb 6-1: device descriptor read/64, error -71 [ 524.765205][T13142] loop5: detected capacity change from 0 to 2527 [ 524.930578][T13143] loop5: detected capacity change from 2527 to 2703 [ 525.052056][T12188] Buffer I/O error on dev loop5, logical block 337, async page read [ 525.074290][ T5967] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 525.186849][T12188] Buffer I/O error on dev loop5, logical block 337, async page read [ 525.207605][T12188] Buffer I/O error on dev loop5, logical block 337, async page read [ 525.235329][ T5967] usb 6-1: device descriptor read/64, error -71 [ 525.354318][ T5967] usb usb6-port1: attempt power cycle [ 526.220179][ T5967] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 526.463018][T13178] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1790'. [ 526.634896][ T5967] usb 6-1: device not accepting address 22, error -71 [ 526.797701][T13182] lo speed is unknown, defaulting to 1000 [ 526.932672][T13183] lo speed is unknown, defaulting to 1000 [ 528.481673][ T30] audit: type=1400 audit(2000000196.040:511): avc: denied { create } for pid=13198 comm="syz.6.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 528.501904][ C0] vkms_vblank_simulate: vblank timer overrun [ 529.069445][ T30] audit: type=1400 audit(2000000196.050:512): avc: denied { execmem } for pid=13198 comm="syz.6.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 529.396150][T13211] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1800'. [ 530.143183][T13223] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.161520][T13223] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1802'. [ 530.386372][ T30] audit: type=1400 audit(2000000197.820:513): avc: denied { create } for pid=13231 comm="syz.8.1805" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 530.816437][T13238] bridge_slave_0: left allmulticast mode [ 530.822317][T13238] bridge_slave_0: left promiscuous mode [ 530.834528][T13238] bridge0: port 1(bridge_slave_0) entered disabled state [ 530.986602][T13238] bridge_slave_1: left allmulticast mode [ 530.992454][T13238] bridge_slave_1: left promiscuous mode [ 530.999399][T13238] bridge0: port 2(bridge_slave_1) entered disabled state [ 532.076587][T13238] bond0: (slave bond_slave_0): Releasing backup interface [ 532.152369][T13238] bond0: (slave bond_slave_1): Releasing backup interface [ 532.254487][T13238] team0: Port device team_slave_0 removed [ 532.368463][T13238] team0: Port device team_slave_1 removed [ 532.388398][T13238] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 532.397430][T13238] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 532.432211][T13238] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 532.440165][T13238] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 533.476355][T13257] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1810'. [ 533.504852][T13257] vlan2: entered promiscuous mode [ 533.637157][ T30] audit: type=1400 audit(2000000201.210:514): avc: denied { bind } for pid=13260 comm="syz.6.1812" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 533.664666][ T30] audit: type=1400 audit(2000000201.210:515): avc: denied { read } for pid=13260 comm="syz.6.1812" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 533.683964][ C0] vkms_vblank_simulate: vblank timer overrun [ 533.697377][ T30] audit: type=1400 audit(2000000201.230:516): avc: denied { setattr } for pid=13260 comm="syz.6.1812" name="misdn" dev="sockfs" ino=43060 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 533.720056][ C0] vkms_vblank_simulate: vblank timer overrun [ 534.573147][T13274] FAULT_INJECTION: forcing a failure. [ 534.573147][T13274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 534.575412][ T30] audit: type=1400 audit(2000000202.150:517): avc: denied { map } for pid=13270 comm="syz.6.1815" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 534.589384][T13274] CPU: 0 UID: 0 PID: 13274 Comm: syz.7.1816 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 534.589408][T13274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 534.589416][T13274] Call Trace: [ 534.589422][T13274] [ 534.589428][T13274] dump_stack_lvl+0x16c/0x1f0 [ 534.589455][T13274] should_fail_ex+0x512/0x640 [ 534.589473][T13274] _copy_from_user+0x2e/0xd0 [ 534.589491][T13274] copy_msghdr_from_user+0x98/0x160 [ 534.589513][T13274] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 534.589537][T13274] ? kfree+0x24f/0x4d0 [ 534.589558][T13274] ? __lock_acquire+0x62e/0x1ce0 [ 534.589585][T13274] ___sys_recvmsg+0xdb/0x1a0 [ 534.589606][T13274] ? __pfx____sys_recvmsg+0x10/0x10 [ 534.589639][T13274] ? __pfx___might_resched+0x10/0x10 [ 534.589662][T13274] do_recvmmsg+0x2fe/0x750 [ 534.589686][T13274] ? __pfx_do_recvmmsg+0x10/0x10 [ 534.589706][T13274] ? ksys_write+0x190/0x250 [ 534.589725][T13274] ? __mutex_unlock_slowpath+0x163/0x800 [ 534.589755][T13274] ? __fget_files+0x20e/0x3c0 [ 534.589777][T13274] __x64_sys_recvmmsg+0x22a/0x280 [ 534.589805][T13274] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 534.589834][T13274] do_syscall_64+0xcd/0x4c0 [ 534.589849][T13274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.589864][T13274] RIP: 0033:0x7fadb0b8ebe9 [ 534.589877][T13274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 534.589891][T13274] RSP: 002b:00007fadb19a3038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 534.589906][T13274] RAX: ffffffffffffffda RBX: 00007fadb0db5fa0 RCX: 00007fadb0b8ebe9 [ 534.589916][T13274] RDX: 04000000000000a1 RSI: 0000200000001680 RDI: 0000000000000005 [ 534.589925][T13274] RBP: 00007fadb19a3090 R08: 0000000000000000 R09: 0000000000000000 [ 534.589934][T13274] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 534.589943][T13274] R13: 00007fadb0db6038 R14: 00007fadb0db5fa0 R15: 00007ffc226727c8 [ 534.589964][T13274] [ 534.871212][ T30] audit: type=1400 audit(2000000202.230:518): avc: denied { execute } for pid=13270 comm="syz.6.1815" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 535.175299][ T5967] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 535.444024][ T5967] usb 6-1: Using ep0 maxpacket: 8 [ 535.462640][T13295] 8021q: VLANs not supported on wg2 [ 535.470863][ T30] audit: type=1400 audit(2000000203.030:519): avc: denied { ioctl } for pid=13290 comm="syz.7.1823" path="socket:[43122]" dev="sockfs" ino=43122 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 535.475255][ T5967] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 535.509554][ T5967] usb 6-1: config 179 has no interface number 0 [ 535.535358][ T5967] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 535.571832][ T5967] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 535.606092][ T5967] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 535.619388][ T5967] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 535.631280][ T5967] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 535.662131][ T5967] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 535.682165][ T5967] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.703501][T13282] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 535.795872][T13302] lo speed is unknown, defaulting to 1000 [ 536.148607][ T5967] usb 6-1: USB disconnect, device number 24 [ 536.154611][ C0] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 536.154655][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 538.168551][T13329] netlink: 220 bytes leftover after parsing attributes in process `syz.7.1834'. [ 538.523977][ T30] audit: type=1400 audit(2000000205.740:520): avc: denied { write } for pid=13321 comm="syz.7.1834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 538.798065][ T30] audit: type=1400 audit(2000000205.740:521): avc: denied { nlmsg_read } for pid=13321 comm="syz.7.1834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 539.688414][ T30] audit: type=1400 audit(2000000207.260:522): avc: denied { getopt } for pid=13340 comm="syz.7.1839" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 539.784076][ T5967] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 539.914016][ T5850] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 539.949818][ T5967] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 539.962185][ T5967] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 539.973241][ T5967] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.985620][ T5967] usb 9-1: config 0 descriptor?? [ 539.995913][ T5967] pwc: Askey VC010 type 2 USB webcam detected. [ 540.056126][ T5850] usb 7-1: device descriptor read/64, error -71 [ 540.319652][T13369] netlink: 220 bytes leftover after parsing attributes in process `syz.5.1847'. [ 540.795452][ T5967] pwc: recv_control_msg error -32 req 02 val 2b00 [ 540.805814][ T5967] pwc: recv_control_msg error -32 req 02 val 2700 [ 540.812919][ T5967] pwc: recv_control_msg error -32 req 02 val 2c00 [ 540.820361][ T5967] pwc: recv_control_msg error -32 req 04 val 1000 [ 540.828467][ T5967] pwc: recv_control_msg error -32 req 04 val 1300 [ 540.836676][ T5967] pwc: recv_control_msg error -32 req 04 val 1400 [ 540.932201][ T5850] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 541.064048][ T5850] usb 7-1: device descriptor read/64, error -71 [ 541.161924][ T5967] pwc: recv_control_msg error -32 req 02 val 2100 [ 541.195633][ T5967] pwc: recv_control_msg error -32 req 04 val 1500 [ 541.276193][T13383] lo speed is unknown, defaulting to 1000 [ 541.296330][T13383] lo speed is unknown, defaulting to 1000 [ 541.307123][T13383] lo speed is unknown, defaulting to 1000 [ 541.738132][ T5850] usb usb7-port1: attempt power cycle [ 541.764664][ T5967] pwc: recv_control_msg error -32 req 02 val 2500 [ 541.789974][T13383] infiniband sz1: set active [ 541.794882][T13383] infiniband sz1: added lo [ 541.808058][ T5967] pwc: recv_control_msg error -32 req 02 val 2400 [ 541.820798][ T1209] lo speed is unknown, defaulting to 1000 [ 541.821112][ T5967] pwc: recv_control_msg error -32 req 02 val 2600 [ 541.835414][ T5967] pwc: recv_control_msg error -32 req 02 val 2900 [ 541.845664][T13383] RDS/IB: sz1: added [ 541.850065][T13383] smc: adding ib device sz1 with port count 1 [ 541.856522][T13383] smc: ib device sz1 port 1 has pnetid [ 541.870451][ T5967] pwc: recv_control_msg error -32 req 02 val 2800 [ 541.906747][ T5967] pwc: recv_control_msg error -32 req 04 val 1100 [ 541.915984][ T5967] pwc: Registered as video103. [ 541.928991][ T5967] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input12 [ 541.947054][T13383] lo speed is unknown, defaulting to 1000 [ 541.971039][ T30] audit: type=1400 audit(2000000209.540:523): avc: denied { bind } for pid=13386 comm="syz.9.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 542.048889][T13383] lo speed is unknown, defaulting to 1000 [ 542.137389][T13383] lo speed is unknown, defaulting to 1000 [ 542.219463][T13383] lo speed is unknown, defaulting to 1000 [ 542.304617][T13383] lo speed is unknown, defaulting to 1000 [ 542.389407][ T5962] lo speed is unknown, defaulting to 1000 [ 542.464050][ T5850] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 542.483494][ T5967] usb 9-1: USB disconnect, device number 32 [ 542.627276][ T5850] usb 7-1: device descriptor read/8, error -71 [ 542.661636][T13394] netlink: 'syz.9.1854': attribute type 5 has an invalid length. [ 542.715062][ T30] audit: type=1400 audit(2000000210.270:524): avc: denied { getopt } for pid=13395 comm="syz.6.1855" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 542.823943][ T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 542.975804][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 543.070998][ T10] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 543.490172][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.509141][ T10] usb 6-1: config 0 descriptor?? [ 543.518819][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 543.861237][T13415] netlink: 220 bytes leftover after parsing attributes in process `syz.8.1860'. [ 544.314006][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 544.325025][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 544.387088][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 544.396244][ T10] pwc: recv_control_msg error -32 req 04 val 1000 [ 544.403758][ T10] pwc: recv_control_msg error -32 req 04 val 1300 [ 544.472916][ T10] pwc: recv_control_msg error -32 req 04 val 1400 [ 544.499781][T13421] tipc: Enabling of bearer rejected, media not registered [ 544.546249][ T10] pwc: recv_control_msg error -32 req 02 val 2000 [ 544.625865][ T10] pwc: recv_control_msg error -32 req 02 val 2100 [ 544.798224][T13427] 9pnet_fd: Insufficient options for proto=fd [ 544.809546][T13427] netlink: 28 bytes leftover after parsing attributes in process `syz.9.1862'. [ 545.241301][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 545.806731][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 545.847230][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 545.927071][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 545.955407][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 545.983013][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 546.023563][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 546.073330][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 546.096621][ T10] pwc: Registered as video103. [ 546.125756][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input13 [ 546.184417][ T10] usb 6-1: USB disconnect, device number 25 [ 546.224169][ T5962] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 546.257685][T13448] netlink: 212408 bytes leftover after parsing attributes in process `syz.6.1869'. [ 546.284780][T13448] netlink: zone id is out of range [ 546.300732][T13448] netlink: zone id is out of range [ 546.309149][T13448] netlink: zone id is out of range [ 546.315712][T13448] netlink: zone id is out of range [ 546.327991][T13448] netlink: zone id is out of range [ 546.333619][T13448] netlink: zone id is out of range [ 546.383816][T13448] netlink: zone id is out of range [ 546.400571][T13448] netlink: get zone limit has 8 unknown bytes [ 546.413945][ T5962] usb 9-1: Using ep0 maxpacket: 16 [ 546.421654][ T5962] usb 9-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 546.450416][ T5962] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 546.462311][ T5962] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 546.482833][ T5962] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 546.508416][ T5962] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.510229][T13456] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1870'. [ 546.528825][ T5962] usb 9-1: Product: syz [ 546.533183][ T5962] usb 9-1: Manufacturer: syz [ 546.538223][ T5962] usb 9-1: SerialNumber: syz [ 546.623941][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 548.514735][ T5962] usb 9-1: 0:2 : does not exist [ 548.534103][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 548.545001][ T10] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 548.552674][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 549.021056][ T10] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 549.038824][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 549.050544][ T10] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 549.069754][ T10] usb 6-1: unable to read config index 1 descriptor/start: -71 [ 549.078649][ T10] usb 6-1: can't read configurations, error -71 [ 549.815332][T13479] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1876'. [ 549.923508][T13482] netlink: 220 bytes leftover after parsing attributes in process `syz.6.1875'. [ 550.115927][T13439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.249664][T13439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 550.574170][ T10] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 550.738843][T13501] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1882'. [ 550.757407][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 550.772713][ T10] usb 6-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 550.789865][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.804617][ T10] usb 6-1: config 0 descriptor?? [ 551.248955][ T5962] usb 9-1: USB disconnect, device number 33 [ 551.594429][T13287] udevd[13287]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.686459][ T30] audit: type=1400 audit(2000000219.260:525): avc: denied { shutdown } for pid=13519 comm="syz.6.1888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 551.843620][T13525] netlink: 84 bytes leftover after parsing attributes in process `syz.9.1889'. [ 552.013403][ T10] video4linux radio48: keene_cmd_set failed (-71) [ 552.024264][T13530] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1890'. [ 552.036151][ T10] radio-keene 6-1:0.0: V4L2 device registered as radio48 [ 552.046743][ T10] usb 6-1: USB disconnect, device number 28 [ 552.139055][T13532] netlink: 220 bytes leftover after parsing attributes in process `syz.9.1891'. [ 552.567819][ T30] audit: type=1400 audit(2000000220.140:526): avc: denied { mount } for pid=13535 comm="syz.8.1893" name="/" dev="hugetlbfs" ino=44527 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 552.575783][T13536] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 552.591198][ T30] audit: type=1400 audit(2000000220.140:527): avc: denied { mounton } for pid=13535 comm="syz.8.1893" path="/282/file1/bus" dev="hugetlbfs" ino=44530 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 552.600587][T13536] overlayfs: failed to set xattr on upper [ 552.632399][T13536] overlayfs: ...falling back to redirect_dir=nofollow. [ 552.639649][T13536] overlayfs: ...falling back to index=off. [ 552.645524][T13536] overlayfs: ...falling back to uuid=null. [ 552.651349][T13536] overlayfs: maximum fs stacking depth exceeded [ 552.673232][ T30] audit: type=1400 audit(2000000220.240:528): avc: denied { unmount } for pid=6923 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 553.481062][T13549] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1896'. [ 554.405450][T13559] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1899'. [ 559.570624][ T5910] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 561.595230][ T5910] dvb_usb_az6027 8-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 564.584700][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 564.601252][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 569.330722][ T5910] usb 8-1: USB disconnect, device number 21 [ 683.223812][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 683.230788][ C0] rcu: (detected by 0, t=10502 jiffies, g=51077, q=1262139 ncpus=2) [ 683.238844][ C0] rcu: All QSes seen, last rcu_preempt kthread activity 9315 (4295005478-4294996163), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 683.252118][ C0] rcu: rcu_preempt kthread starved for 9316 jiffies! g51077 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 683.263220][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 683.273268][ C0] rcu: RCU grace-period kthread stack dump: [ 683.279150][ C0] task:rcu_preempt state:R running task stack:27784 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 683.292649][ C0] Call Trace: [ 683.295931][ C0] [ 683.298862][ C0] __schedule+0x1190/0x5de0 [ 683.303380][ C0] ? __lock_acquire+0x62e/0x1ce0 [ 683.308333][ C0] ? __pfx___schedule+0x10/0x10 [ 683.313194][ C0] ? find_held_lock+0x2b/0x80 [ 683.317871][ C0] ? schedule+0x2d7/0x3a0 [ 683.322203][ C0] schedule+0xe7/0x3a0 [ 683.326275][ C0] schedule_timeout+0x123/0x290 [ 683.331125][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 683.336495][ C0] ? __pfx_process_timeout+0x10/0x10 [ 683.341790][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 683.347602][ C0] ? prepare_to_swait_event+0xf5/0x480 [ 683.353077][ C0] rcu_gp_fqs_loop+0x1ea/0xb00 [ 683.357846][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 683.363125][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 683.368324][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 683.373260][ C0] ? rcu_gp_cleanup+0x7c1/0xd90 [ 683.378108][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 683.383921][ C0] rcu_gp_kthread+0x270/0x380 [ 683.388591][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 683.393782][ C0] ? rcu_is_watching+0x12/0xc0 [ 683.398539][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 683.403748][ C0] ? __kthread_parkme+0x19e/0x250 [ 683.408777][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 683.413969][ C0] kthread+0x3c5/0x780 [ 683.418040][ C0] ? __pfx_kthread+0x10/0x10 [ 683.422625][ C0] ? rcu_is_watching+0x12/0xc0 [ 683.427386][ C0] ? __pfx_kthread+0x10/0x10 [ 683.431969][ C0] ret_from_fork+0x5d4/0x6f0 [ 683.436550][ C0] ? __pfx_kthread+0x10/0x10 [ 683.441135][ C0] ret_from_fork_asm+0x1a/0x30 [ 683.445909][ C0] [ 683.448916][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 683.455231][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 683.466508][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 683.476576][ C0] RIP: 0010:lock_acquire+0x62/0x350 [ 683.481796][ C0] Code: f7 3d 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 62 37 13 0f 0f 82 74 02 00 00 8b 35 2a 69 13 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 b9 f6 3d 12 0f 85 c7 02 00 00 48 83 c4 [ 683.501415][ C0] RSP: 0018:ffffc90000006f70 EFLAGS: 00000206 [ 683.507495][ C0] RAX: 0000000000000046 RBX: ffffffff8e5c1160 RCX: 000000007938eb5a [ 683.515466][ C0] RDX: 0000000000000000 RSI: ffffffff8de29498 RDI: ffffffff8c161180 [ 683.523433][ C0] RBP: 0000000000000002 R08: 39529a686290c103 R09: 0000000000000000 [ 683.531400][ C0] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 [ 683.539364][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 683.547332][ C0] FS: 0000000000000000(0000) GS:ffff8881246c4000(0000) knlGS:0000000000000000 [ 683.556267][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 683.562852][ C0] CR2: fffffffffffffffd CR3: 0000000058f00000 CR4: 00000000003526f0 [ 683.570825][ C0] Call Trace: [ 683.574095][ C0] [ 683.576935][ C0] ? unwind_next_frame+0x3f4/0x20a0 [ 683.582134][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 683.588289][ C0] unwind_next_frame+0xd1/0x20a0 [ 683.593222][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 683.598328][ C0] ? sysvec_apic_timer_interrupt+0xa4/0xc0 [ 683.604136][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 683.610290][ C0] arch_stack_walk+0x94/0x100 [ 683.614968][ C0] ? sysvec_apic_timer_interrupt+0xa4/0xc0 [ 683.620781][ C0] stack_trace_save+0x8e/0xc0 [ 683.625458][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 683.630832][ C0] ? common_startup_64+0x13e/0x148 [ 683.635943][ C0] kasan_save_stack+0x33/0x60 [ 683.640614][ C0] ? kasan_save_stack+0x33/0x60 [ 683.645453][ C0] ? kasan_save_track+0x14/0x30 [ 683.650297][ C0] ? __kasan_slab_alloc+0x89/0x90 [ 683.655313][ C0] ? kmem_cache_alloc_node_noprof+0x1d5/0x3b0 [ 683.661379][ C0] ? __alloc_skb+0x2b2/0x380 [ 683.665982][ C0] ? synproxy_send_client_synack+0x1af/0x8f0 [ 683.671963][ C0] ? nft_synproxy_do_eval+0xa63/0xd80 [ 683.677336][ C0] ? nft_do_chain+0x2e6/0x1920 [ 683.682104][ C0] ? nft_do_chain_inet+0x18a/0x340 [ 683.687231][ C0] ? nf_hook_slow+0xbe/0x200 [ 683.691824][ C0] ? nf_hook.constprop.0+0x422/0x750 [ 683.697106][ C0] ? ip_local_deliver+0x169/0x1f0 [ 683.702127][ C0] ? ip_rcv+0x2e0/0x600 [ 683.706278][ C0] ? __netif_receive_skb_one_core+0x197/0x1e0 [ 683.712342][ C0] ? __netif_receive_skb+0x1d/0x160 [ 683.717537][ C0] ? process_backlog+0x442/0x15e0 [ 683.722559][ C0] ? __napi_poll.constprop.0+0xb7/0x550 [ 683.728099][ C0] ? net_rx_action+0xa9f/0xfe0 [ 683.732860][ C0] ? handle_softirqs+0x216/0x8e0 [ 683.737792][ C0] ? __irq_exit_rcu+0x109/0x170 [ 683.742637][ C0] ? irq_exit_rcu+0x9/0x30 [ 683.747047][ C0] ? sysvec_apic_timer_interrupt+0xa4/0xc0 [ 683.752883][ C0] kasan_save_track+0x14/0x30 [ 683.757554][ C0] __kasan_slab_alloc+0x89/0x90 [ 683.762399][ C0] kmem_cache_alloc_node_noprof+0x1d5/0x3b0 [ 683.768288][ C0] ? __alloc_skb+0x2b2/0x380 [ 683.772879][ C0] __alloc_skb+0x2b2/0x380 [ 683.777296][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 683.782235][ C0] ? kasan_quarantine_put+0x10a/0x240 [ 683.787604][ C0] synproxy_send_client_synack+0x1af/0x8f0 [ 683.793406][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 683.799724][ C0] ? nft_synproxy_validate+0x50/0xe0 [ 683.805013][ C0] nft_synproxy_do_eval+0xa63/0xd80 [ 683.810215][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 683.815938][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 683.820963][ C0] ? __pfx_nft_synproxy_eval+0x10/0x10 [ 683.826419][ C0] nft_do_chain+0x2e6/0x1920 [ 683.831018][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 683.836042][ C0] ? rcu_is_watching+0x12/0xc0 [ 683.840815][ C0] ? nf_conntrack_in+0x8b0/0x1930 [ 683.845842][ C0] nft_do_chain_inet+0x18a/0x340 [ 683.850776][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 683.856237][ C0] ? __pfx_nf_conntrack_in+0x10/0x10 [ 683.861522][ C0] ? lock_acquire+0x179/0x350 [ 683.866208][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 683.871674][ C0] nf_hook_slow+0xbe/0x200 [ 683.876104][ C0] nf_hook.constprop.0+0x422/0x750 [ 683.881259][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 683.887248][ C0] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 683.892887][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 683.898009][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 683.903998][ C0] ip_local_deliver+0x169/0x1f0 [ 683.908852][ C0] ip_rcv+0x2e0/0x600 [ 683.912834][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 683.917338][ C0] __netif_receive_skb_one_core+0x197/0x1e0 [ 683.923239][ C0] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 683.929655][ C0] ? lock_acquire+0x179/0x350 [ 683.934343][ C0] ? process_backlog+0x3f0/0x15e0 [ 683.939364][ C0] __netif_receive_skb+0x1d/0x160 [ 683.944388][ C0] process_backlog+0x442/0x15e0 [ 683.949245][ C0] __napi_poll.constprop.0+0xb7/0x550 [ 683.954639][ C0] ? rcu_is_watching+0x12/0xc0 [ 683.959410][ C0] net_rx_action+0xa9f/0xfe0 [ 683.964014][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 683.969126][ C0] ? rcu_is_watching+0x12/0xc0 [ 683.973890][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 683.979092][ C0] ? tmigr_handle_remote+0x132/0x380 [ 683.984386][ C0] ? run_timer_base+0x121/0x190 [ 683.989247][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 683.994457][ C0] handle_softirqs+0x216/0x8e0 [ 683.999230][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 684.004519][ C0] __irq_exit_rcu+0x109/0x170 [ 684.009199][ C0] irq_exit_rcu+0x9/0x30 [ 684.013452][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 684.019085][ C0] [ 684.022010][ C0] [ 684.024933][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 684.030908][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 684.036543][ C0] Code: 2c 63 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 52 17 00 fb f4 4c 0d 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 684.056151][ C0] RSP: 0018:ffffffff8e207e08 EFLAGS: 000002c2 [ 684.062234][ C0] RAX: 0000000001cb6a97 RBX: 0000000000000000 RCX: ffffffff8b92bc29 [ 684.070217][ C0] RDX: 0000000000000000 RSI: ffffffff8de4e889 RDI: ffffffff8c161180 [ 684.078190][ C0] RBP: fffffbfff1c52ef8 R08: 0000000000000001 R09: ffffed1017086655 [ 684.086164][ C0] R10: ffff8880b84332ab R11: 0000000000000000 R12: 0000000000000000 [ 684.094132][ C0] R13: ffffffff8e2977c0 R14: ffffffff90ab0090 R15: 0000000000000000 [ 684.102106][ C0] ? ct_kernel_exit+0x139/0x190 [ 684.106981][ C0] default_idle+0x13/0x20 [ 684.111314][ C0] default_idle_call+0x6d/0xb0 [ 684.116080][ C0] do_idle+0x391/0x510 [ 684.120152][ C0] ? __pfx_do_idle+0x10/0x10 [ 684.124742][ C0] ? trace_sched_exit_tp+0x2f/0x120 [ 684.129940][ C0] cpu_startup_entry+0x4f/0x60 [ 684.134705][ C0] rest_init+0x16b/0x2b0 [ 684.138946][ C0] ? acpi_subsystem_init+0x133/0x180 [ 684.144233][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 684.149795][ C0] start_kernel+0x3ee/0x4d0 [ 684.154300][ C0] x86_64_start_reservations+0x18/0x30 [ 684.159754][ C0] x86_64_start_kernel+0x130/0x190 [ 684.164864][ C0] common_startup_64+0x13e/0x148 [ 684.169818][ C0] [ 684.603051][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 684.620083][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 689.668909][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 689.685557][ T1301] ieee802154 phy1 wpan1: encryption failed: -22