last executing test programs: 12.873058568s ago: executing program 1 (id=574): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)={'#! ', './file0'}, 0xb) read$FUSE(r0, &(0x7f00000015c0)={0x2020}, 0x2020) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="b0000000000000008d15c937040795e9ec68ba339b8fd15e58983b3da942"], 0xb0) write$FUSE_INTERRUPT(r4, &(0x7f0000000000)={0x10}, 0x10) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f0000000400)=0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',privport,access=', @ANYRESDEC=r5]) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0xa, 0x3, 0x3}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000004c00)=""/102392, 0x18ff8) r9 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8801, 0x0) ioctl$TCSETAF(r9, 0x5408, &(0x7f00000000c0)={0x1, 0xff, 0x5, 0xfffc, 0xe, "f682756c98cc948c"}) fsopen(0x0, 0x0) 12.366724089s ago: executing program 3 (id=575): socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00', @mcast2, 0x8, 0x3c80, 0x85, 0x400, 0x3, 0x60}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x9, 0x0, 0xfffffffffffffffd, 0x400009, 0x8, 0xa}, 0x0) syz_open_dev$media(0x0, 0x80000006, 0xd01840) socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e23, 0x1c, @private0, 0x8}}, 0x0, 0x0, 0x20, 0x0, "ee8b620000db9e8bf9b93129488f651a8da213eb94cd46e19d9c65a01844131f4df57422767e62e2c300009607462029add09240181c788df600000000000000faff00"}, 0xd8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x74, &(0x7f0000006340)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x6, 0x20, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0xfd, 0xb56, 0x1, 0xfc}, {0x6, 0x24, 0x1a, 0x6, 0x3}, [@country_functional={0x6, 0x24, 0x7, 0x2, 0xfffc}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0xb, 0x7, 0xfd}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x8e, 0x5, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x0, 0x7a, 0x4}}}}}}}]}}, &(0x7f00000065c0)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r5, 0x1, 0x2, &(0x7f0000000640), 0x4) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0xffffffff, 0x0, 0x0, 0x4, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x38, 0x2, 0x818, 0x0, 0x0, 0x0, 0x2, 0x7, 0x1, 0x0, 0x0, 0x0, 0x6, 0x9, 0x0, 0x3, [0x1, 0x6]}}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000500)={0x10003, 0x1, 0xf7efe000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) socket(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x2, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 11.813691152s ago: executing program 1 (id=577): arch_prctl$ARCH_FORCE_TAGGED_SVA(0x4004) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b02d25a806f8c6394f90924fc60040f030047000000053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffb}, 0x94) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x42100) r2 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1c, 0x8, &(0x7f00000009c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffefc}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000100000000000000000850000007d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x52) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f00000003c0)='kmem_cache_free\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000340)='kfree\x00', r3}, 0x18) r5 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) pwritev(r5, &(0x7f0000004240)=[{&(0x7f0000002fc0)='v', 0x1}], 0x1, 0x4, 0x4) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x1000000, {0x0, 0x0, 0x0, 0x4006, 0x4000000000500ffd, 0x0, 0x1, 0x1e, 0x3eee4c3395b43b0a, "faf98317e5a1149989fc8dbe43ea6acc96bad0099cebdc25f5ab60c9e6d680f985881ad69098060000004c516bdd8a0f5a8701eb25afd8e600", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e439c00b7ad33", [0x2, 0x7]}}) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000040)={0x3, 0x8}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x200000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x1b, 0x4, 0x1010, 0x89, 0x0, 0xffffffffffffffff, 0x4}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000840)={0x0, &(0x7f0000000780)=""/106, &(0x7f0000000380), &(0x7f0000000000), 0x80, r9, 0x0, 0x7}, 0x38) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r10, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="c80000000002010400000000000000000a0000003c0001800c00028005000100000000002c0001801400030000000000000000000000ffffac1414bb1400040000000000000000000000ffff000000003c0003800c00028005000100000000002c00018014000300fc00000000000000000000000000000014000400fe8000000000000000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014000400"], 0xc8}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x94) socket$packet(0x11, 0x2, 0x300) socket(0x10, 0x3, 0x0) 11.034769974s ago: executing program 1 (id=580): openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="6c0000001000010400"/20, @ANYBLOB="0028000002010a004c0012800900010069706970000000003c00028005000400eb000000060011004e24000008001400ffffffff080002000a01010108000100", @ANYBLOB="05000a000100000008", @ANYRES32=r4, @ANYBLOB="48288fb4bdb539ce04ffd732bd98ddd62ea1c24a467ea9a5baaa64f314eb750451faa1259a7eeb717b6e8b2d248fa5c8064c1d1314ec1d63711ae176c645d73e35b9313f8d64c8f6245d16cd4aeb95c8318a14743b521286ccfdf101f4f24e8aff09ae180b56526661a63557a85c8d97"], 0x6c}}, 0x0) readv(r1, &(0x7f0000000240)=[{&(0x7f0000000040)=""/71, 0x47}], 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000082505a3a440000102030109023b000101000000090400000302060000052406000005240000000d240f0100000000000000000009058202400000000009050302"], 0x0) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r8 = openat$cgroup_int(r7, &(0x7f0000000080)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) sendfile(r8, r8, 0x0, 0x8f) connect$inet(r6, &(0x7f0000000040)={0x2, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_misc(r9, &(0x7f0000000040), 0xe09) r10 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109301) ioctl$USBDEVFS_DROP_PRIVILEGES(r10, 0x4004551e, &(0x7f0000000000)) ioctl$USBDEVFS_RESET(r10, 0x5514) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000002c0)={r9, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x5, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd0007008019000200000000000000022122af0e4ccfb7b3cada00", [0x0, 0x2000000000001]}}) close_range(r0, 0xffffffffffffffff, 0x0) 8.497046149s ago: executing program 3 (id=586): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfe, {0x0, 0x0, 0x0, r4, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}}, 0x24040084) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x31, 0x1) socket$l2tp6(0xa, 0x2, 0x73) clock_adjtime(0x0, &(0x7f0000000100)={0x362, 0x6a, 0x55cd, 0x8000000000000001, 0x48c, 0x5, 0x40000000000000d, 0x424, 0x2, 0xffffffffffffffff, 0xf423f, 0xfffffffffffffff9, 0x7, 0x2, 0x1000000081, 0x5, 0x0, 0x81, 0x2, 0x9220000000000000, 0x3, 0x0, 0x80000001, 0x0, 0x5, 0x7}) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') pread64(r5, &(0x7f0000002180)=""/4101, 0x1005, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r6 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) fsopen(&(0x7f0000000240)='jfs\x00', 0x1) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000000)={0xa, 0x100, 0x1, {0x6, 0x1000, 0x6, 0x86b}}) 7.190832947s ago: executing program 1 (id=590): r0 = socket(0x2, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) dup(0xffffffffffffffff) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x0, 0x0, 0x3, 0x0, 0x40}, 0x9c) bind$inet6(r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = memfd_create(&(0x7f0000000680)='\x103q}2\x9a\xce\xaf^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99\x18\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1f\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\tRJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd99C\x9fF\x9c[M=\xa0^\xa8\xed)\xe8Z\xe8\x9b&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xc9\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8ZmH\x98\xaeb\xa5B5)\x80m\xff\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6\x05\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x19\x06U)j!\x91\'\x98\xd2kFN\xfa\x80)O\xb9(!n\x9d\x13\x15\xf1\x1a\xb8y\x14l\xd1', 0x7) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r5, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x402c5828, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x762}) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_FM_4OP_ENABLE(r6, 0x4004510f, &(0x7f0000000280)=0xfb9fa3e5) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r4, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) 7.0670495s ago: executing program 3 (id=591): prlimit64(0x0, 0xc, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}, @NFT_MSG_NEWSET={0x142c, 0x9, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x8000000000000001}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_EXPRESSIONS={0x78, 0x12, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @void}}, {0x28, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_OSF_TTL={0x5, 0x2, 0x2}, @NFTA_OSF_TTL={0x5, 0x2, 0x7}, @NFTA_OSF_FLAGS={0x8}]}}}, {0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x31}, @NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x9f}]}}}]}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_EXPR={0x1374, 0x11, 0x0, 0x1, @bitwise={{0xc}, @val={0x1364, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0x1350, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x31, 0x1, "f5c0709bc1c09ea2141ceb5ea8f253222d1a906d1425a167a5b8818cf2ba178109a2131ebb2c3eaf656f9e0192"}, @NFTA_DATA_VALUE={0xca, 0x1, "05a1afca000abdd63c1215308d33621206750f9ac1d9b14e655a2e4983f7d8d52c79486cb62f8a6d29fb77455cd3b54ae4fd2e0f66a3fddf85df96547a3c9c44ea171d3494a785d4048fddea4a2b3d1e45c019625fe805525721e10ccc7fbf67954b7d2e7e9f47e1905614e045a19f7ea3697cfe8bb215d4a75a5e7ed8279fae0cc00a4bebd4c3fdc808da7fc862ba94c9cd9d509933fcaca1086ba01686b6284348d8dc984a38cb018332250199563e5e510f07310c5a1481a328cc680b7a1f25c417d80c28"}, @NFTA_DATA_VALUE={0x88, 0x1, "b411e3f2c013ab1f2544bbc0bb295f4b3f1591e80be4624c2c28009fd51c7ab738125af13622177aa8eb7cd859bc3072e2dc14c84f24537186a08ee89a375794d1efd7b119a396f3e37b3d7a563551bc266a08f8261a30280537626d7a04063ede13a4cb6313be2b052f48833943bf6cdd0aecef729af050d1bdf2e71ec24dbe14ae754c"}, @NFTA_DATA_VALUE={0x1004, 0x1, "6c6ede692312c5469d6aa604c848095a10ab9bc06ef892960841f28106501eabfb5b7c3d151788426b18730221c993a1f25010235fdc755120d3425353f624a224ff55a8c31211146964ce0552dd3eef644a3845742cf9a7bc77409097d3441ce43cceff4b60aa9f565e06d5fb5fcd2321b35f51aa806084854dcc70dc2aa8789c6d67e3b51906a20387875f0443249b3401e407e4543055db675ea205e9be97dc730cd3cbaed690dbca158c857978eab377318fd78a3c3b4c51b768b4f3738467c1909b30a334e087857d8908b28718cdd53a1d417fb1e7dba3b9e7b9d23c2223c0166d57296bf9a311e089b526d1bdb1d575f35b40757f1d0bab9ed9a0b6415bf47a2ad8dae6ad757aee10861a66b4f2a880f49ab0452859a4dfb69e8a21bba87605c90af1f06b6c35bb3beebd80a8182457f48372eb3d8c4f16a112886c90807830a778d91811950aeb5f87e79daa77288e33920d3d4e33ae24e868b2c64441bb6c195240acb80f51c2bdbf15738cfd7593e2df9102491ef9c783d48612e3f8c90ebecf83a7ff33920ed7bbc8fe6b75657642637d7cc137cd5524af9e762048d50a4fa7fbdae77e1eb0377e9d33f762def63ef8cc482ccf391c2493b685d3fe341a5a5b3f95b65b7115ce41c01bf0fb8ccb0f1fe5b517d2489829a92ef643d889fe9969819443cfe7881b34e5fb3cc1f8dc9025903bc6ebda34f8035d124d960a92a6653d1d8a486d2ffe0f6041452af52bd1bea9cabe5e8e1d84036a96a42e49ded2b0c01b4d2080be10dea4c28429237a0c07e9049437cf487966f3ecc92c51681761617cd72dfeea06f2e3455f789e3b7d658d888e5ef6c605bc7f040a185692b1455854dbb9d9b2ec30710cd6efdd7cda11e4d6b5fa02d3c90eddc06ee77ab3a9fa67d36d6191fce94c6828053408ec6d9a45d4c7d276e561cee06b226aca0d39557492e52505d3a702ee8ddb6b801b7e7ba1a2975ebfaf470bc2b9183331dd429fa26c9e8ad60f178461daa7875d86c4dabbc41a0427e2f2f8e938b75d637081292687b89f59a79d6ccdc92b44bc90e3ee99d66faa2e898d04f27dd8afcdcba83ffb2117900066b9717c48c5c4c8996930a27969db00d5e3f283e4a806ba905b75f28a5144dc1826378b8364796966205162a7f6f1da6777e31ac6e5443f90d23673e3a8a51859fea037b19d9ea144c357d7e19ae2d99dc4a6a925a153f3c913574c3afd084c064d202234f7b3994a2c618b80ad7f998f5177522db54df4a687cc015042eab53dc1868e85d9933f6e361be6a560bc77330e72b8f9a87e64af6447b3566ad2bed56c496c8be24bf8fea04793c3c59449ed3b59c832cf97d7996dbe285ab1e8217c6e5d7f4fb78dc714bdd3a2ec8a975259e39e9745d270961b564782baf7ac12ff9dbaf755ad1cd4a5d3ffa5e7be86f47e573be2ed11014e0c38dfc981558e5b65072b38e9e0b6a60cc3748727f050ac25fa70f75046fade23f4a8c559d4daf1ce17a40d74e035d1cab0402a0a5c9add06c1542ece5bed7803cfa1e6a576dd79f69b5dde5688dd21d0b5627239ce82d9105d5cb28548a73048aa0175612a0712d8ad24e8ee4f967ec587bd220a998b26d10ab8b7c66340916cfbec7cd9a12d3daa6df639d657d8c801ae71d1968712332fa3b47357b22afc56d09898bdd35fa77e26f2b8177147b9e115f1cf41b46098c492ec4e76a438ddaa44f89b6e7d9f47361ead669f22ac13b2ab5295dd54b4bceb8b4b1eed373140700e25a70f4d1c943ca54cc69d79da5c03b69b1c4a8d6d9174cd7e251ac0782a0efb48918b0cc4599c8146c9be58921ccd87da8160e0143da371cae5511d1193e9ac66e025b2c660c4a95b4a9fd7a380a3feb06de05dfcbde3c701dcc5d143a553f4d6c8e3aab6427a728e1d5912187e5cf169785550a46707fb8edbb60655a8c910b18489c9cee99382d9a47849104199784d7ade3d2addf6ca310990f40a27d93a7a47744f76a34c08953b1b40cca7b1be5d9473ca7b95b58d88bc1e1b97689a372154793ba06b31cfdb6611f6536fc0aea77a32a0acfc6b25cf18596a6410cd39622bcd4a0067e6e5b52045293e830a0bcf7949ee172e99ad71db1bec16539b7fada2d8c70af17d711ad0f78176a0778cf5ca08ccc54fa2ae5e456e1bdd8ac14b69f2871d4c43febe39090866b876ca558e0c572055b195f549789855302b898baf3433490191ab00f0199cdfe52550bd4e536abd041f446241a01c0f6dbfd7eb806b648d70fb5a9ebf568ae2a6e879529abd87699e3599b6557c2f5a6124b73bbaebcde4ab0a6e323378bb6cad626c3d97d874d976f3e3037929ea72283336423ea64eb92ef9f49ad8a5e9c5c6d4d71a6585a40e2c7c65a036639609b9d07753a4030b50447131136cde45fb3c671efda95a22fc15b0c88d8160aeb9269c1ac12309a43ab385aa900dbd67f0e929988a5c6cc55870d2719e9c7c8385bbaa7ef688a91a772cc19c8fe64832f3b517010d50432aeafb399532e57282217dcd701024b39e67734475956775b6b6d5bf9fb31baaa7e8b510d5ea0cafad404363bac3f1fd89f6678bd0425ce99a4569e3d7db218d88e705ec1df61edd50ce1f553475655ea1865140c59028de1af76c71757207cbf9d21ee5c8d9c4d916030cb4e4c1e325ca4bc33ab6df7f13d5c1762eac92bd1bcbe2214f7b39178596cc00960ed31ebd8a3b3a3b9d3f4d18018df3cb31e6af1f044a7611c0f6779d772d6a19c8aee2482f5a50a7eef4be8f76af8815c1e0cbfa53b0b74b6cbfee23e59aa40577cf813224f1e5a932a231f9aabffac015673c0146ce17aa4fdb9a9db27117c26412d2d0bc3bfcbdda07d9b8bc502c6d69dc8bfb73960ce24e244c0563c95c4f4f2262ca7fca562c097098f668d6913d7b188a57534b64df6945adc1e01bc7a2f901dfe8f4a74f9cf68b0a51d9ebc34d6f8a3c3aeba1250039421d77d6b1980462857df95593d9835e37c7165fc76e97e229406d2b66d6f4ef23d597f9f8812ebdde648fe845161da302e3cc3fcf79d60a72ce3a4620fd58300058186806edffba5cc6f164cd73cc4f6b53b4647bf251545d26887a8f5b7e9edee06a286f4ccab6b25214ac7545d1b07f4c017f1d16e36b626c69b2cd90e95d4470edead8d43f517ccb98deffba267ea038a99092fd10430fa8f60c9be5c9acaccc1b6cd2f33003540e8aba74c70c45288084637846efddc99776dee8b7615e106a70c17620a3c00edf964cb7083df5bb0391019f317b4df87d84c6957b1eba8bd147af8f73abff9f212e9107d00e70760215b1c9455f2d556ea441657ac13a92078ed695964244f73357b11862c28f208a506b8bc99912b2c9a8e350cc6eb543a94a37dc94dfa707dcded49fab4c8a57998c4ecfb721e1d8890b779e56ec07afb2910d83323499fc6f5731adaccd9b8ce9f35dd2e9c4dadce94fd869b991c36e49a48284d126c6b9bcc70fccd0200fc7bdfa6195e0c23dbe7e4be7cb5a0eaa745963058cd2faa54f8836b5750846c9dd5746ae600781d10e97977a004e36609626ce7690290ce361cc333146d78309fac5cea9609d2416b37313d531868802bdc5f8b1cd920f9ec011c7d12e90a6561ca0e1204a8be2848b093346040374fde4dee92ca5a4a84bcf2aa276ac3eaec1eb847b06a94f88133ba167fda8b220e90b14b487c98ca97200252bdf3d2254c8134bc4de0302001ecff3a7edbefab1e6dc25ed19c8db18bc747d4873397dd6df4e3a1221c91a10f8325e302a387e1491371879a81672b123c0c07eb3c63a4c7712008b7cd1d1a1bfd6365bf856aee50fb804bfa4f5d74b4a58d53fe2b2ec18c88a84a86bf11bb3500726e72ee6c1bf44e55fb6f2e3c39da1a24d6691fde8fe108d4199337e63dd6c738ace56b2ce394721f6c04c9c60c1dd98fffc64eecc9ea2b34a8a4968e27d690aea47c38dc57562e964ee3df62a54d768c71f881b0236084fbf4515c7b1fd720a2ac4946118eeeac70a8bb9f489dc5e5024e833002b8115358d6e7b29b6e8b8f4c5373e5c76eb5a8d07f14efad953dc21c55cdcc4b5f8486a8f772dcdb869730a760414979f816533840d3affa7c30ffd66405ef5fbef6cea6d268d4a4428113af944deee583761b095e9a1947519b01960ef38fa46ef8b944dc943ed75a006926401e42d8874df7ea0d72113131699f22de8735b183e059a08704b6e8fe9fe1301b98faf20a25c72d5bc8500d1c3ba2ce6fb86d9334b16dd71ad86aa04a4762aadc404e8e9f0adc21e4f1c65b3fcd9dccbbb7c038069c63114539236613a9ec7e7d8661e7f900cec57cd0e1a8fa83626d2fa1493aed43c1fe4c5831eb8681355b4aeebe329acab61b2c4d2e8c1574dfa41df3a9da8e1cb420db9ebc0755bebf6e79fe882378b173b0404ffa53599498427f77e15df7fe5205cb051eb1ff00650349b8d624db8b50e634145bfdd562a85d14832a43df59d0614a457c6e12c4e1831ac45616af9d44bd399cc31f38ff73cdc6ff11c9c1a22e62c9c92f11d885451815d98ea1b30fa9f49d593cf97e8a02cbd443f078250882b427fdb231432e68d9a1ba66e0cff1a2b88223826874c5d7b5c74f30c85fff09684f6859f10c9f6185d103305eec5832e5719c3f85b286436a9618b3f356002ae4e9b20ee0772d31038c4112ae89022caf0b9496981ab937306ca8a5336481a9194c2be2acddfb05d0d00e0d552f2b99bd6d6a846bc590a61bc45acd3e13a3aedfbe54335c52ecad7c9989108d6f003c1025a554b8253f3eaf24b8db520d93f62c64d6ce1229fa433ccea84438a4169490e99a67c40f659cd70bdb68f99550774547909f6bd4f61544966a94b9227bca791cd98e1a3407c720064ad70e3802e61b94fc38219ac83bd731bcb6708f7a829d77a966c44faa91aad5d224ee2649b8a1776a34b390af31630d1dbdf88e7830c387d7f82e6232f4ccdf811a25e79ea8751156d7c4e988656bf3a624c43e6af867f268afab8c0e25608950b7af47959d0f89a07399862bac9388d8f13b314dfa3866faf3404a16501f8ac1f2a68ee2a2b3a3c27d9537fbe942d9679aaf592baef4e1ac28fee880c965893da142169d02b495c81adeb3284b826c02e95c38ffd593c184bf6329e0b9693459b11729c2118159591b686201adbc3596a0d452dc5962fd468fb8a59c5762de07d3218c7604d0f92b75fe4544c0e7c5ba0e03c44b7ba382761cb4d0a49a2338304522d5e69ca617d8d0e3c8e376411e8e6e4fcfabc3265b9f4f81c6330abb4f130abe7ed1704da2966b55d4a4adeb53bc06f069873fecb5c3680a2638fc55f637618d525ee98b08f4360af353b61f8135a7c9b32c4bd211e47610c46d463c6b057fe6666ccdc231217a8830d1264b4a18027abef18a3a68b6a9f22388f780d789411643c3f22236193c366ea2eff1c9f1a2c298219b24d7362ae26b0fb1b0820a3ffa9e6293fe6d3b9d358e4a169a78c99c8d9a49828450d54dcd550692e1ab2ff63f6c63d4cf45c06536905ae435ba47083a2946712d15fff12611a9421a54daca05560be5a59eeff36db3bb6d3760eb5d025d2633624b7d973b8efb60853292f821b7631b2a07b5c27f918e2133bc58cdb4230206c25b6c8106130792ab09f9d07bd3c5d8280d29b1798c096fd953935bbec5036269d81a5a7acb618ba9b6cca59c50e0cc877d453f3cf03b7d92c08af084091cd7f654970e6a12ba83cc6a6843efcca947e0de4a0600d8f03477f92185ff50e90a456ba7f5c"}, @NFTA_DATA_VALUE={0xdb, 0x1, "f0638b47792f1a49d7a3aa154fc04ae8571df9e849789fa2e47ae79637fcf82d4278a6130a6bc7baf0b147ac07ba556a6ce7e6596da86571ce72943b3ba9ffb2078d41337590c34d46ec3f9019a1bba9c6b378d66ac3bca4910bf5cf06a7ef7bced972ccbfa24ef938529220aec1b81ff8a13310500c741c7eedbee7d10f675122d739f5fdac92a565c4a63da7ddc882bff31118cf6ecaec728ec504af7559d6d7fe7863493502b66c4f307c0b3c831aade33482d28c57e8ce26715e36c4dd136c4d834d9e45b855e08afbf8c495163b4c069e7dc845ef"}, @NFTA_DATA_VALUE={0xaa, 0x1, "eb5c305bdc66a95c2efcf358ad75d990ba25ad8a8139b9fdf93802ddbcc43e3ab839af3dff4c0d136bcdbc70dca6ec0adefb8247f6fbfe46458c50c979063adbae24c0012c42e780fa08e30393b023f7301053a9deab6ad12b890e1cfcf71b10ce6bac69d34db33590bb7d195180a79fef4b7fd9b27c5ad61b1c2dec6825cf09261a50bb2af0b8f88d254f68f7f524ce23470aa7f85b8b7f0d15b0a75e038d3bb7e25b1fa288"}]}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x9}]}}}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa1}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}}, 0x1494}}, 0x8814) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) connect$unix(r2, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x4, 0x2ffffffff}, 0x2e) ptrace$ARCH_MAP_VDSO_64(0x1e, r1, 0x5, 0x2003) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x2a, 0x2, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x11, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, 0x0, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) r8 = syz_io_uring_setup(0x3b, &(0x7f0000000400)={0x0, 0x2, 0x10100, 0x2, 0x2b5}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r11, 0x0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f00000002c0)=""/183, 0xb7}], 0x1, 0x0, 0x26}, 0x0, 0x80002101}) io_uring_enter(r8, 0xd81, 0x0, 0x0, 0x0, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) 6.101024529s ago: executing program 3 (id=594): r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x5, 0x40) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000040)=0x7fffffff) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f00000000c0)={"6511cc345a24237d6fea1bd1f4e8f03d", 0x0, 0x0, {0x9, 0x4}, {0x7, 0x1}, 0x6, [0xffff, 0xfffffffffffffffa, 0x7f, 0x80000000, 0x8, 0x3, 0x8001, 0x5, 0x7fff, 0x4d, 0x376a, 0x7, 0x0, 0x0, 0x8, 0x8]}) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000240)={{r0}, r2, 0x2, @inherit={0x68, &(0x7f00000001c0)={0x1, 0x4, 0xfffffffffffffffb, 0xaa, {0x22, 0x3, 0x6, 0x9, 0xed63}, [0x100000000, 0x1, 0x6, 0x8000]}}, @subvolid=0x8}) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000) connect$inet6(r0, &(0x7f0000001240)={0xa, 0x4e21, 0xfff, @empty, 0x8}, 0x1c) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f00000012c0)={0x5, &(0x7f0000001280)=[{}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f0000001300)={r3, 0x3}) getsockopt$inet6_int(r0, 0x29, 0x24, &(0x7f0000001340), &(0x7f0000001380)=0x4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0), 0x20480, 0x0) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000001400)) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000001440), 0x2, 0x0) sendfile(r0, r5, &(0x7f0000001480)=0x4, 0x1) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r7 = fcntl$getown(r6, 0x9) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000014c0), 0x0, 0x0) ioctl$TUNGETVNETBE(r8, 0x800454df, &(0x7f0000001500)) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000001540)) bind$bt_hci(r0, &(0x7f0000001580)={0x1f, 0x3, 0x1}, 0x6) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000015c0)={0x1, r1}, 0x0) write$cgroup_subtree(r0, &(0x7f0000001600)={[{0x6, 'perf_event'}, {0x2d, 'memory'}, {0x2b, 'io'}, {0x2b, 'cpu'}, {0xcab1cb685b8e715d, 'memory'}]}, 0x25) write$cgroup_pid(r0, &(0x7f0000001640)=r7, 0x12) fchmod(r1, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001680), r0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f00000016c0)) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001700)={0x0, 0x4a, 0x100, 0x40}, &(0x7f0000001740)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000001780)={r9, 0x4, 0x20}, 0xc) ioctl$VIDIOC_G_TUNER(r1, 0xc054561d, &(0x7f00000017c0)={0xdfa, "2fb2aad8dbaee128e85c4e0f2a1ed34d1ac7b7bb0f9be8263b0855310f39e9d2", 0x5, 0x100, 0x3ff, 0x6, 0x10, 0x2, 0x0, 0x9}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001840)={'veth0_macvtap\x00'}) 5.933581125s ago: executing program 3 (id=595): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000f1d566201e043c40d7cc000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_io_uring_setup(0x99e, 0x0, 0x0, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}, 0x1c) 5.476480713s ago: executing program 4 (id=596): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) open(&(0x7f00000000c0)='./cgroup/../file0\x00', 0x284800, 0x30) mkdir(0x0, 0x22) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x4, r2}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x8, 0xfffa}, 0x3a, [0x8000, 0x3ff, 0xf, 0x8, 0x80000001, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x7, 0x5, 0x1fd, 0x0, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x22, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x0, 0x7, 0x1, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x0, 0x1, 0x7, 0x3, 0x3e, 0x20018e, 0xa, 0xfffffeff, 0x0, 0x6, 0x4, 0x8, 0x3ff, 0xfffffff9, 0x0, 0x4, 0x6, 0x4, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8008, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0x5, 0x1510edcf, 0x2c3, 0x6c7, 0x9, 0x0, 0x3, 0x7, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x2, 0xff, 0x5, 0x1000005, 0x5f2d, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x44, 0x6, 0x47, 0x8000, 0x1, 0x0, 0xffff, 0x2, 0x4, 0x9, 0x4, 0x3, 0x4000009, 0x46, 0x0, 0x3, 0x1, 0x48c93793, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xffffffff, 0x100, 0x9, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x80, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303e, 0x10003e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x40200, 0xffffffff, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0xf3, 0xa9, 0x20000005, 0x6, 0xac4, 0xbf, 0xfffffffe, 0x3, 0x7ff, 0x12b, 0x4, 0x4, 0xa, 0xffffffff, 0x7, 0x1c, 0x120000, 0x7ff, 0x2009, 0x2, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x4000005, 0x3, 0x2, 0x10001, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000006, 0x150, 0x1, 0x6, 0x6, 0xffffffff, 0x80000004, 0x5, 0x5, 0xc8, 0x1, 0xfffff002, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x8, 0xae, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf3f, 0x7, 0x530e, 0x6a, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, 0x0, 0x48004) bpf$MAP_CREATE(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010000104000000000000000000000200", @ANYRES32=0x0, @ANYBLOB="2008040020000000140012800a000100767863616e0000", @ANYRES32=0x0], 0x3c}}, 0x0) 5.186729078s ago: executing program 2 (id=597): r0 = socket$qrtr(0x2a, 0x2, 0x0) syz_io_uring_setup(0x499, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e22, @broadcast}}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x3) io_uring_enter(r4, 0x1855, 0x31d0, 0x0, &(0x7f0000000000)={[0x1]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000000480)={0x2020}, 0x2020) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000440)={{0xffbe, 0x5, 0x2, 0x5}, 'syz1\x00', 0x53}) 5.144330248s ago: executing program 4 (id=598): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x28040680) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000005c0), 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000300)=[{&(0x7f00000002c0)="94", 0x1}, {0x0}, {&(0x7f0000000500)="8c112945d671aca7077c052ff47a8aa42ca1624f235a412ed7717b096295554953166051fafc3a10a85d00945d276d09ca6e8f7d1717abaa461d2f7b357233cdbecb7ad4e09d31ae8aa03db8c86f1a7f3a7f180e13db4ede7f665d402e2bdd053b1656520ec1fa8795af516efe21469a80309c3380b3026a99bae4ad341119ade0f23f12b1f4a3900087c7d2d0cea249022385baffb86c45dfe887a9b1bd8b2493a89275224568", 0xa7}, {&(0x7f0000000880)="9f36c400d7239a2316496fb0f026c5f961611f873020e238e8a1216f7a270c1cf245b30aff01c32af1e7fbcdce4c4e164922568a6e36acfe0a07dd68a27d6db01ee2c050b1a7c70a4c0fe630c817cd449e91a3952f37ad1f9d46405c09bbaf229422514c37c9da0575685eaf254e85c8d4914dbcb5663bbca73b72579522ab773db70d01d739215c3c9b0c93068dc557d6b415f7a8d5fb46047a09a52523912eba7c12722d9954219c54da0af8f0b65cb1d0a43bf0dd4c621331e8d2035c9643f589dd61470575ec6804a1fa42bc6f102785898025d9fb54a8999569970f6ef18e6f95eb7c1913b872f8533a0d7c8235fff8a11741ada1a4850469d55088a916a08131ff141bc496624e531ccc110d0418946f4090bee4c12c67c6cb9e2c491a7efece5da091952975dd66e5b9b4039def00c817079a716b371f6c3893b2ecbfbaee5b0e5b807b770af5cda2369cf98b3f90dd7f8f2354709427a00ac281fe2e2d948159a861f8f64107b25be5eca6453705b814bd85703adfdd3d1bea117abeeaad3bf8213cc4c017b0cc70e97f9c2cdddd0bb54831c27fbf78c97bd13be72fa1d6aec3b05380faa665a6662f1edff7bb5eef1d1abaab7e6672c686b2ff6cbc8ca64a2fe01d7eafb2368c2901dacd114d581e32ab9a1bd53d6200db0beb196fa485adf789ef488bd2bfb14114de2d9d6cc4e2c9b83be48e8d529584e9981dbfeec868bc977c2cb9b299e0b8b4d0ee0656cfac0f0450311be971104ea361c15e7317b5b5db11ef80f4ac1bc83637e72dc7b20fe80a8084d43c26d20975ba3ccb70c0ce6a610abef72637d7d97d729a73696bace732ee280eec2d3a35eaf2b398c20490b5a329476ab904d79130877a5f8f4c1cb1798b99e09863762c83f109988beb0fb81680af6222daab0c673927c4e14037a92fce3bcfc8f4186fee572fba0f9d2ebd5d0f3c0e8fa6a991929f7f86c1446cddfb5e721e40e7c1af21df4074190cab26e7f4bf20e6c422ecd537c7404ed96200951cd926eb248e214cac520bc95a59f66cccf758704af50669d142ef24ba7c56cc84364c06db64d664a50ce71a7f360f620c5c81e2675d8d759ff4ce8f92035899e3df3feb9b6ce4144a14e4903431f314793c991f8a6b520a1271e9e4fc98da8fd666971a8a16b2d7a429769d5d9d8c021e39f7cc9061df86f7f03bc312d8101703ae44fb8f0d286127893bf59b6ac102f7858a5c40490647f8f7cb2c3144217387ea73d17fd076be79a2f85d5eaabd430fb50ebefe4830e1868ff9995402175287ece6818f123fbe53f8e2b33d4e9229aa4645c496974f0be7e26f4aec1dbde1b180d1352fb06b1290cdac1a429d143ef354b426f342a69bc825777ad22168ac572f9efe24e00dfd4ff6b2ee89d1843d5adcf1d6b79578a0e8d930e9d510a1282e4cb6d13ac5c6425100e3c6d27d2ca94d7fdcb2ac4194f5449cc7460a9c51ca0e8ac3f4a8ee0f8ce15c8074dac1e4761893917677c56dbfe25c613caf67dc8e304f7afb1f66763d2482156e91f421cad8623857cbcb2a910542953a7f2656c8e7acc64962144a77a3b7de032bce6f8c44bd61dddc47c1f8502ddf0ba2aa6f1133136efc6c8eed6809576ae3e2e71f326307df20ed4806ada5a76aab6d46b53dc8e3f2359008beeb1d51ffb968be6422117f121e586890b159c7624d5f24818151b83372ffcc8242bf80a573dba1c0e6281c39d50dc1e1f38df05cf937f4179fd8d4ec179d20c598a561b062898a37e85bb95278aa3147462514d7f326320053782aa5e6ee2683cfd0a3e8ce17926db1643ddb5d7acc5765c1d7c22732b0788a1c6cbfc4745b637335b8b6d4f1308345892f71881794c3465422aa5ad7da5700503e7eb60498111911ed26bc96a6d3a98589c0c4f126d0477f14a6cfeae7c0a600246814bca230cf9eec5c15718f896224688f2ea7ef8aea6c714770078468536b83a8fc49c05b0b0d34be143c96bfe84ecd32f967bf9900d9f23b677bbd77f699fa216a36a020aad71b44c749f948d377bfb08296708eb6db5915119178d667d1557aa12b80cab73b95bdfdb820267906dc1473bc06137a398aadd7b8fc1548d19ceeb9a6837f5a95864ebaa4f4382655e692eb60ce024c279efa0465a1ddbfd5423ae18be9f09b3f07c71442b95bab99beee3b7d3e326bb23feed4ebd4731f3136730b0de6dfe8336ef204c446ef6cdfd092b3061bf72b99ad3289f559dcda74282d96682492133d0610342c5b17b2dc4214364b7d38faf241d6fbcc38ce02f53c5afa89b769214863da784d17910e25ddd715565097746c653266b1c25997ede85d371db67c6c46ede62232ebfb81e7fdfa1fc2b77f3d686e706d7b1824f038c9c9525fdefdbd82ef61cd5b9c874f59d251ed35613125ec6d56c4ed9fc22f7f3e091297e0e8316eb95d40e001051b24323356e9ec791ae51ba05fa82732598c74d88101aa6e1dd2a46e8fbed72f784fb1bcdb02ac3124020031bb015931000a471b23f31eb91f9d265862c3cac3ee3ee76093491c9b4a62a1542638c33aad63cc31ee070080f2eb57b2c976acbb9c3b6b0b81cceed96cd8906829f8dce6c741cbe82fd4ccb39c8d4910bc132d423894c6a1d8c7b06ab72714fa37672daf90dc8228035dcf4c089ddb10ed8d3aea333fd099d4c6e11d2af90a8a0d28c5a2ae7ae5a14b70b9c4cd2d233a23973507e2c65f7074cce0fdd08ef147bdfd8aeb4bbf65b3ffb7d3d1902b8e2b07134fc2a979f88eba792f267dd229be4bb51c438874c1e60e8f6530cf124982c7537602e6980e6db00221cb54a3b52a64c54954719fcc2f7d1645f8864ea32fdcf567108127bf6d40419baa48100e0be94d35cec973711bf37b2256084046c77ab5492ca9bfbbc9b29481d59579b238e9db9a329543b8898b1313d3d6df1f9f0c475f3d408a783feef41b7bb97d992f6ac68bf48d382925b1044b496ff2274a0c1d30023caed4b748fdd618db3b874e765ef1ec177bcea82cc1b84ba9beee293cf0c3d8484ecbbda641903aff478bb0fbc201591b69b2dba6bba5ca5199eb0f4f531732817e0d99a86768e55d7a60ac307d74107c0bf4f5d9995ef33ad79f267419153cc88dd49cff7cefcec3d20189f83fe251b7e5d3f31772e2516ee0ada10c63472b69664bd73c5e26da9d3544af3489ac0eefcff5468a667e8d114289d75d50c0ca3b6e99ebf134968260f5bf11aaf51958484af012cd1f3e582d3771db6786d485279bc55e5154ac474375960ab4197779ace7c8ce60927cb3434ed6f318ebe1b557c8770f72788d2db8f17f7f47337ab9cab563fa419863384d5deb29ed42f504443ef504275e36704b6f23e24c654f310d83caf7aa67b7f6b60193ea114022df2afedc62f1495d02ae4b121562002a703c1580b9c5a6c1822656fa5526a87e9d95877434a8959512a3e10114072b3adf734c673d6d751a0572a78b1dbf5dbfaca443acccbd8903161b4fd1d68da1c8a5194bb6d7f9cec9f76b9fe2ef1732291591877fa8baf9900d4a796abacad105f5a64f089747f623f408c070684769918fd44e3f6a136a634f1c038a47d5e73c0c8aa12298a3c50527aeee20c624fab7c3d141d8aa8cfd45bb2b56f6bd9183c95df9e982d3eeb6857c598cf85d5e2b1b5e12bb5478d0815ed156f8793bb9613f525424f7f426b770137c5c215c74ae43fbe08a22a43bdd42ab495b69d4762311be77b55ae87f4ab53fb092379d989692f8f0c84d7c8c2c3c4c6f683a7dc6ac73b723e3876875051c33e2ceea1f5cc13d6afbb4556eaee1227bffc086651bb29d0bd6bead2638f3df0404ca2c0d31382e768d4703af3b448df540faf5017cb04ad72873ebd98d75d5add409780ec7507911f4e4095c198a09c83ff74fdeb2198c457e4463256460c3e1a63588ba0de2048674b3e8b1feb0dc816e696ca0e6bb790e9ac9431903725e9e27bc29fe60ea24059a5e3d21149293c9f9af781805074b6fa9a534f01c6e4fb49bd8f80220d8af33c344c0be32149122b19e3c2ce70a390b2e0802dedf4e0f6f13e0d0d78b792c7bc1ee10e928bc3ad0093b6dcb528e078c46d09df0c37a3670e3ba37d15a4ba8385a3c14ab3d2c91f8b5469debb7100f3edfb996ad0f09df7f9b465c5368a761ca7f9af3fae00333d525624d3153d77a081f5eae9706111a70d9eae973a811b7e149cbc3d5846f642b7428ad787380693cfa573fae16f23b43f7d4e507429e9075d604d5dd22ea7883f9e71eda0ef1c1b526749dce03db0c301f3a4d758730b721cdf3780bbbf97266c2a84a90e648c177d3dbf0562619b54f29fa872cfea6681d52469501a2078879edf993b79f298f3d50503637f0dd8aff68dc9f904b2f1cdcf7284eefeaac7c992e0692c3d425cd5582ccdc08b555089ae22107849579990d596d721549439e2b739d27a5bec886b61de386b3af2ee3e8bf2a0192c60952d8cd1f7a29ee093561c7d977c85524a8a122dc100261c2a8eb85ada4fb16d36f22f93432672f6dda3678158115b5a8fab6ee778f1ab15016af3146bec2e097d25a924202ea7449bc63cb43bf5f97b9d02e97a4b4421f39af14bdabc6450e05795a0547d4ccda533fabac3151abb3b556b3585e6c4be33f1e5a52e3067b9c4c5bbd6a7ce24baf26560cf0a59f6828243b8de07a1ab1ff9bfe7731efb57bc914bf4fbfd78a2b9ab30ff64a1ffb03dc487d90913d20237777b45c8266075a07193b832159ad4fc2f9a5caf7b7bb51a9d8759a205a4eb24fad8e22cfb7c1a0a5d8ac41086a7ddbb892d777034ec2ee3f0f8734d79d867688a7e1c5e79d9c878fe3cd20145b059b4543f7dd98374307991179fc7e021097983dbed139bfdc98a104576ce6e29b4217f3e55a8ac2da8b054fde9d2afb1311b53eddee1649ec0d8fe123bca4fe61b8d7ec2120ea9e121151e723192b3033c664aab9a01d031419aa40f22a6bab4ff26eb132645b5a977d561e4359149bf5e3d5bad3daf10985b953157fd54e4c584d4e161443bca0155a5216547b1b1913e95dc99630f7da19477adf058559a34f9e2063c6739fde6729fc3350baa7ff85a11ed5f707ca2f263da16dbd5495661b420eeffbad43a141164bc9cf62f7bf28b12acf2ac504442d428260fa438e98660aabc21451cb1947a7e967507f1cf9c1a3f46de100718a7ac094a72dd97b6c9e297d1020cfbf7a543cb11f201e714b92f578d04360ba37c78e37b5ee7025ccf1fa4414d7ecd8cc82b0be6e59da38c3eb5098208dc77c924670049f5d370b9d115c555469508c3defabd5169740a02ab211e6bbd4e04aeb31d81ba3c0f138a65921cf9a0b807994cb693e53e214067baeb1b5179db812ff56ae50c5403d8d46032450aff04cef731f3a614ecb6e4dde660a9d65c546897b62f5f12571e7bd1e0487321a2c6173b63ab0014a0e9c290ee66fd8cf78831e6624762e758e55017bcb60f55d81a3391bdadaf2f72116b202b1fe812c4a4d914a1ddd62a7863adeda0bd7d781db1a6aa3ad5566beeddabda84966a5aa394640809511bba8b70f56a7255b5704632b1f6d8e57091238be179b8f16a1326da335c7d55c56eca242771e9a55ee1e9a3a1876897167ac500eca737f41a8d237a6a39a6c28896ab06245b59ea3e26f9891163e80857f8cd434d591139903371a51ee28c57f8ea236ac9ba5c6f854de986c188df3caea94a03ff3483df15f8d6c4540552c6c6d96bfc8f7a1bec6a49a71277aec8b5bfe2e626a39a058b9632e9d0695dc80ae", 0x1000}, {&(0x7f0000000040)="706daf963df6bf85b0e4", 0xa}, {&(0x7f0000000600)="dd153f9c17f0e56831ecba4a6587cfe4f0f3747948780054200b34d4deb6e37b9471cea2f1f75ea01ac83772adbed52ef072cd70620a4f0014967007eda6a570f4b622a253f1c368a16db1d2f583eb28356c43477e0d476ac96b1dd924a8aa91450c635e0fdc4943314e0b2e5a46ab30c4c766cd2532dd9d069ce0b14576dd2025254e9a02a0cfc52419e49e7f45b90bd161efdfa7317e2b03bd2402bfeb415590d9eacd5b06599211c4700a1c90ff142dac664f", 0xb4}, {&(0x7f00000006c0)="91aa2406d9cc4265779eafc1a8f72e9a3ec8973f53a4e01c2a80d804c50be543820636794511c306eadbc770f88ce3f256e63261edb9c05c90fb5c666e084afdae0dcd7e2a44858755c4b3c6aa9a1fc07df8cb9fd09c1574a7589d0777427112b4033d6d34df30f00e38d2087bf5f729b56cbdc347d334643440d5af5ce9f41baf500a1427e5ccf8377cbbe01b4ec915ed65dadcfa83509b9695659ddfc15779f683cece24882f34ec7243096d55647c203a42ef3c3f491ed807d3", 0xbb}], 0x7) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_io_uring_setup(0xd35, &(0x7f0000000280)={0x0, 0xa2fc, 0x80, 0x1, 0x350}, &(0x7f00000000c0)=0x0, &(0x7f0000000440)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x36, 0x0, 0x0, 0x4, 0x0, 0x1, 0x20}) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000001c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000004800010000000000000000000a00806e0800000000000000140001800d2a79075827af5aa534d6815c2e93f10c000280", @ANYRES32=0x0], 0x3c}}, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xa0000, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) 4.388687524s ago: executing program 0 (id=599): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x1, &(0x7f0000af7000/0x4000)=nil) (async) munlockall() (async) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000380)='/proc/asound/card1/oss_mixer\x00', 0x1, 0x0) writev(r2, &(0x7f00000028c0)=[{&(0x7f0000002600)='u', 0x4000}, {0x0, 0x2}], 0x2) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, 0x0) (async) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x2a0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}) 4.22368572s ago: executing program 2 (id=600): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000940)={0x2c, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x7}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x5}]}, 0x2c}}, 0x64000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="5800000010000d04000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000009000000240012800c0001006d6163766c616e0014000280080001000400000008000900fff33f1beb0035006d6163766c616e30000000000000000029b2831633fa4a9334802cf4b24c353e9cb972056648caa0a64f80b7069c0a293ca7fa894a659fee41edec8c888559475948d52f9e7d7541d99dac236ed85985bb329180c3a9cfed794576eee6d4f8db75d6d6ec1b9033ef95f060c5a1dcfb8cde024100f0b654f64b7a0a83034e3cb7c8334a8e0d697d6ab86769ff57d4b9349a01faab700ca20bffccab6234a3a9212f2cbb94e2322c5d396d6751a6a7d857930dce2f343a60d6893f2395b985dbeee74907f9e275f95aea61"], 0x58}}, 0x8000) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r4, &(0x7f0000000100)={0x1f, 0x0, @none, 0x4}, 0xe) (async) bind$bt_l2cap(r4, &(0x7f0000000100)={0x1f, 0x0, @none, 0x4}, 0xe) socket$nl_generic(0x10, 0x3, 0x10) connect$bt_l2cap(r4, &(0x7f00000000c0)={0x1f, 0x80, @any, 0x0, 0x2}, 0xe) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000005e80)={'#! ', './file0'}, 0xb) socket(0x28, 0x5, 0x0) (async) r5 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) (async) connect$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) ioctl$sock_qrtr_TIOCINQ(r5, 0x541b, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_NAT_PORT_MIN={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) 4.142694413s ago: executing program 4 (id=601): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$evdev(0x0, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FICLONE(r1, 0x40049409, r2) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000001000500050007000000000008000900000000001400200000000001000000000000e1ffe000000108000a0000000000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) ioctl$EVIOCRMFF(r2, 0x4004550e, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000240)=0x10, 0x800) write$P9_RAUTH(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x67, 0x1, {0x80, 0x3}}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x9, 0x0, 0x0, 0x0, 0x69, 0x10, 0xae}, [@ldst={0x4, 0x0, 0x6, 0x9}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x49) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_open_dev$dri(0x0, 0x1, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/timers\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) close(r5) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x50}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x42000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005a1000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ac4000/0x4000)=nil) 3.408361537s ago: executing program 3 (id=602): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001000000000904"], 0x0) syz_usb_connect(0x5, 0x1e0, &(0x7f0000000200)={{0x12, 0x1, 0x201, 0x6a, 0xb8, 0xb7, 0x20, 0x413c, 0x8134, 0xe271, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1ce, 0x2, 0x1, 0x8, 0x0, 0x81, [{{0x9, 0x4, 0x5, 0x0, 0x1, 0x34, 0x55, 0xd9, 0x9, [], [{{0x9, 0x5, 0x5, 0x7, 0x400, 0xc0, 0x7, 0x3, [@generic={0xd4, 0x24, "d72e03c8e7690e63cb90818ae8b190eeccce4d40eb44f0b7e3925f574f09334796def9a5ebf8e12e9129b490f767d121c94ff0a7bd544c7ea7bf96d4cf35a5e84489124540dd0f9ca94de546aae33ab36ba5ba89d73b20d5d5f8e2febcbd7e593373836cbcbf3271dedc6173a710a5f1ebdb7e8cca0a2f023da86744e567fd49aa434a951cb3360e2bf58193b62e1a0f12a8a1e2a12b154516c625ee28d27e709f3ba5de205e993d16123ca036d4cd4ce485a48b1bfd26b6e8cbd74d876f5c2e737baf400ea0b2315c5e4eab1a732f1107d3"}]}}]}}, {{0x9, 0x4, 0x30, 0xf, 0x4, 0xf5, 0x2d, 0xe4, 0xfd, [@generic={0x5e, 0x2, "2c75050dcbcc78e0acda043f28e79b782990c81894d4ac940ef6fdaa6924ca8cc64fb6b885b42f8843aa378c4133342a9e074abf121c9d4e97fe9e4e01022488b2ec685857cc430bb0f8f02b32b22daf4ceaec61f0dd8018ca02f136"}, @uac_as={[@as_header={0x7, 0x24, 0x1, 0xb, 0x9, 0x1002}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x7, 0x3, 0xf0, 0x40, "abae0059"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x0, 0x2, 0x93, 0x1}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x0, 0x3, 0x1, 0x8}, @as_header={0x7, 0x24, 0x1, 0x7, 0x0, 0x1}, @as_header={0x7, 0x24, 0x1, 0x7, 0x5, 0x1}]}], [{{0x9, 0x5, 0x5, 0x3, 0x230, 0x10, 0xee, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x9, 0x40}, @uac_iso={0x7, 0x25, 0x1, 0x103, 0x2d, 0x2}]}}, {{0x9, 0x5, 0x0, 0x3, 0x1ff, 0x7, 0x7, 0xa}}, {{0x9, 0x5, 0x80, 0x0, 0x40, 0x1, 0x8, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x13, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x23, 0x2}]}}, {{0x9, 0x5, 0x1, 0x8, 0x40, 0x4, 0x4, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x6}]}}]}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x7, 0xff, 0x80, 0x8, 0x2}, 0x97, &(0x7f0000000100)={0x5, 0xf, 0x97, 0x6, [@generic={0x74, 0x10, 0xa, "ebf156ca3c604b03c599bd441d84c4cd873a9e00253781aecd17437481a687b8570c25b0b67affd4a8ab71a3f6063e6618dd51df42c8413afbb479ffb44a9b3ebe4a6fee81c53566a4f60afba594eb3aee510cf0a0c95938c235dd3f9bd5942774f0737910f11a6cc428756230a1152420"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x9, 0x4, 0x2, 0x100}, @wireless={0xb, 0x10, 0x1, 0x4, 0x50, 0x9, 0x7f, 0x6}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x7b, &(0x7f0000000400)=@string={0x7b, 0x3, "6a25d563c113724faacbabc29e57f7ecbb973dc7bd15c2a9bcaea5a53ae0bebc83627aac81150583976bd64b5be86a903010ee18a946962795618c9e53d1380ed2a89f51e76f2480a5e7ee900a0ad886418400edfe1e63d8c7e5b717ea5ecebd9b7a7a94e98e8e4297ad4ebcadf98c3f680f92138293340a7b"}}, {0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x40b}}, {0xb4, &(0x7f0000000480)=@string={0xb4, 0x3, "2b52677a81c88fe2257aece7a42f0d6f45b85dc22566ecf5ab879c4a972313b5595a68fa164ef285e0bdc7811bd27bbde2dd138fd1f4303a8b7ffa502906351f788b20978f1ffc034b52c3f74bea2a491abd940da033b065ab23a9153969e4caf3740f580ed9dacdb443b0cacfd21fd8406d3694181733f2e56a9cf4588ec1eb302ee771006b423683f5206cce6c947dbbec2dab518eca1465bba9536efee66aa52d9d443f26526051d726e1b2df3d336d99"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x41c}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x1409}}, {0x2, &(0x7f0000000600)=@string={0x2}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x41b}}]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66", 0x9}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) splice(r4, 0x0, r3, 0x0, 0x10000008ebc, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x400) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f0000000080)) write$cgroup_int(r3, &(0x7f0000000700)=0x59, 0x12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x2, 0xfffff010}, {0x20, 0x0, 0x20, 0xfffff034}, {0x6}]}, 0x10) sendmmsg(r6, &(0x7f0000000180), 0x4000190, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f00000001c0)=ANY=[@ANYRES16=r1, @ANYRES64=r1, @ANYRES64, @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0}) r8 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r9 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r9, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r8, &(0x7f0000001040)={0x27, r10, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) connect$nfc_llcp(r2, &(0x7f0000000740)={0x27, r10, 0x0, 0x7, 0xbd, 0x2, "b5377d09e1632a950d88128820ccefecb96742118e7a511f8bf3c1878488f26614aa73e83ccaabe73f020ed029556883067023ba46d1e6d774fd5814965bdf", 0x3}, 0x60) 3.317842879s ago: executing program 2 (id=603): setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) eventfd(0x3c) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfe000/0x400000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) openat$iommufd(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000400000001"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="17fa00000000090000000400000000001c110000", @ANYRES16=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xe, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000000700000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r3], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r4}, 0x10) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, 0x0) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x7f, &(0x7f0000000300)=0xa) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0xb1dc326431916e94) ioctl$KVM_SET_DEVICE_ATTR_vm(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x4, 0x5, &(0x7f0000000180)=0xfffffffffffff053}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) 3.24300157s ago: executing program 0 (id=604): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000000)=0xd42) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001c00)={0x80, 0xedc4d9ad95901ef4, 0x40000}, 0x20) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="c400000019000100fcffffff00000000ac14142c000000000800000000000000fe8000000000000000000000000000aa4e2200004e2400000a00006000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000010feffffffffffffff000000400000000000000000000000001a000000000000000100000000000000feffffffffffffff7a0000000000000005000000000000000000000000000000ff7f0000000000000800000000000000010003"], 0xc4}}, 0x8044) sendto$inet6(r0, &(0x7f0000000240)="8a", 0x1, 0x40880, &(0x7f0000000080)={0xa, 0x4e24, 0xfffffff3, @local, 0x9}, 0x1c) 2.947625385s ago: executing program 2 (id=605): bpf$BPF_LINK_CREATE(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x10, 0x0, @val=@iter={0x0}}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00') read$FUSE(r1, &(0x7f0000000700)={0x2020}, 0x2020) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x1f, 0x19, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1d, 0x0, 0x0, 0x0, 0x81}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8020}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f0000000ac0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200ebfb}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r6}, 0xc) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) ftruncate(r2, 0x9) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r7 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) lseek(r7, 0x1000000000931f, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0x14, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x1, 0x100000005, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r10 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r10, r9, &(0x7f00000000c0)=0x58, 0x5) setsockopt$sock_attach_bpf(r0, 0x1, 0x2f, &(0x7f0000000040), 0x3b) 2.872707408s ago: executing program 1 (id=606): r0 = socket$qrtr(0x2a, 0x2, 0x0) syz_io_uring_setup(0x499, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e22, @broadcast}}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x3) io_uring_enter(r4, 0x1855, 0x31d0, 0x0, &(0x7f0000000000)={[0x1]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000000480)={0x2020}, 0x2020) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000440)={{0xffbe, 0x5, 0x2, 0x5}, 'syz1\x00', 0x53}) 2.100065277s ago: executing program 0 (id=607): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073"], 0xd8}}, 0x80) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="ef", 0x1}], 0x1) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000040)={0xf0f041, 0xc}) getpeername$inet(0xffffffffffffffff, 0x0, &(0x7f0000000140)) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x7, 0x16, &(0x7f0000000800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18}, 0x94) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) (async) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000004c0)=@newsa={0xf0, 0x10, 0x832152701231f605, 0x70bd27, 0x0, {{@in=@loopback, @in=@remote, 0xfffe, 0x0, 0x2}, {@in6=@remote, 0x0, 0x6c}, @in=@remote, {0x0, 0x8001000000000001, 0x0, 0x400, 0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x20}, 0x0, 0x0, 0x2, 0x4}}, 0xf0}}, 0x40080) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, 0x0, 0x0}, 0x20) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) (async) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 1.992839833s ago: executing program 4 (id=608): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) open(&(0x7f00000000c0)='./cgroup/../file0\x00', 0x284800, 0x30) mkdir(0x0, 0x22) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x4, r2}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x8, 0xfffa}, 0x3a, [0x8000, 0x3ff, 0xf, 0x8, 0x80000001, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x7, 0x5, 0x1fd, 0x0, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x22, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x0, 0x7, 0x1, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x0, 0x1, 0x7, 0x3, 0x3e, 0x20018e, 0xa, 0xfffffeff, 0x0, 0x6, 0x4, 0x8, 0x3ff, 0xfffffff9, 0x0, 0x4, 0x6, 0x4, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8008, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0x5, 0x1510edcf, 0x2c3, 0x6c7, 0x9, 0x0, 0x3, 0x7, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x2, 0xff, 0x5, 0x1000005, 0x5f2d, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x44, 0x6, 0x47, 0x8000, 0x1, 0x0, 0xffff, 0x2, 0x4, 0x9, 0x4, 0x3, 0x4000009, 0x46, 0x0, 0x3, 0x1, 0x48c93793, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xffffffff, 0x100, 0x9, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x80, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303e, 0x10003e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x40200, 0xffffffff, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0xf3, 0xa9, 0x20000005, 0x6, 0xac4, 0xbf, 0xfffffffe, 0x3, 0x7ff, 0x12b, 0x4, 0x4, 0xa, 0xffffffff, 0x7, 0x1c, 0x120000, 0x7ff, 0x2009, 0x2, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x4000005, 0x3, 0x2, 0x10001, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000006, 0x150, 0x1, 0x6, 0x6, 0xffffffff, 0x80000004, 0x5, 0x5, 0xc8, 0x1, 0xfffff002, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x8, 0xae, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf3f, 0x7, 0x530e, 0x6a, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, 0x0, 0x48004) bpf$MAP_CREATE(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010000104000000000000000000000300", @ANYRES32=0x0, @ANYBLOB="2008040020000000140012800a000100767863616e0000", @ANYRES32=0x0], 0x3c}}, 0x0) 1.936890833s ago: executing program 1 (id=609): socket(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000010000009500200c00cfe5253dfad0d469cfaf402250a6721e28e452bcc7361960ed58f1701e2bf7142f1c84e1c2ddb519c230177d7293c5700a47b4f0d703163a3c4577a45166cc0bca5e057ddad17452f396338b114c84081b5d92aba6f3cf89a6e913911595a7330e945160806ee1fb96df"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="d2ffee056003088cb89e08d986dd", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r7 = socket$kcm(0x23, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89ef, 0x0) r8 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x3232, 0x100, 0x0, 0x3de}, &(0x7f0000000040), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_FILES(r8, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000003815c1dcdb8895d9520000000b000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x40010) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c00f0ffffff180e000a001400000002801687121f", 0x2e}], 0x1}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="000000002a71bcb3b2d9721e0b00010062618ef1810800421c5ab84f3b0648df9e83b359e27b0e1400028004a2a7c951d8195ccb552435fd169825228d06a0ff9d347ae0f966908fbb42bc46e79e15a05cfa3f123ede8d5f5aee5f423b0fc3d5ecb0cc6007c7284eea5f99031579051252e37b621024224ecd1dd367076f1d65788ca79c218fccbd063fe15f19a88f810e89be1fd66f55f7d0c57087c130cbae1673f43bbf7f98b1c11abe9a08874dd739ab03eff84f48beef44", @ANYRES32], 0x3c}}, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x63f2, 0x4}, 0x9c) 1.626705364s ago: executing program 4 (id=610): r0 = socket$qrtr(0x2a, 0x2, 0x0) syz_io_uring_setup(0x499, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e22, @broadcast}}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x3) io_uring_enter(r4, 0x1855, 0x31d0, 0x0, &(0x7f0000000000)={[0x1]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000000480)={0x2020}, 0x2020) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000440)={{0xffbe, 0x5, 0x2, 0x5}, 'syz1\x00', 0x53}) 942.298857ms ago: executing program 0 (id=611): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040)=0x24, 0x5) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000280)=@gcm_256={{}, "5462cea39b7c1140", "c9a3315839c227100427fbb86ae6a41547451cdf2031bd38385f6ba0bf0705a4", "5d3e853f", "33fa4a8f2198c12e"}, 0x38) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000000)=0x800, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000004850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x113465e3bbfb1f91) setsockopt$SO_BINDTODEVICE_wg(r2, 0x1, 0x19, &(0x7f00000000c0)='wg0\x00', 0x4) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x40840, 0x1) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', r3, &(0x7f00000001c0)='./file0\x00', 0x7) r4 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) pwrite64(r4, &(0x7f0000000040)="62ed56", 0x3, 0x838) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@mss={0x2, 0x2}, @window={0x3, 0xc, 0x86}, @mss={0x2, 0xa0}, @window={0x3, 0xcc06}, @timestamp, @sack_perm, @window={0x3, 0x9, 0xffff}], 0x7) 913.115307ms ago: executing program 0 (id=612): r0 = socket$inet6(0xa, 0x2, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0x100, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, 0x40c89}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) (async) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @rand_addr=0x3}}}], 0x20}}], 0x1, 0x4040880) 818.695908ms ago: executing program 0 (id=613): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000001c0)=0x64) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f00000000c0)={0x0, 0xc000}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) open_tree(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x100) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r6, 0x0, 0x1}, 0x18) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r4, 0x4010ae68, &(0x7f0000000000)={0x2000}) sched_setattr(0xffffffffffffffff, &(0x7f0000000100)={0x38, 0x5, 0x10000000, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 817.635027ms ago: executing program 2 (id=614): write(0xffffffffffffffff, &(0x7f0000000000)="e015f9b9d301cef0b5e6f178b0cb6a39cd979a5bb7d5e000d2f8aceb449a7d56b3b5fad6f20e9a8885abad9593f3491d064023ccb1f2e6e24561f2e858c687aced0d73c7f8b2639990fc97e08efa70f65b0fff93eade37ca4c8e8fd0723a207c195cdacd06e4a8894fbbc8955dd7", 0x6e) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={'\x00', 0x5, 0x2f, 0x9, 0x1, 0x1, 0xffffffffffffffff}) fcntl$setown(r0, 0x8, r1) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000100)) r3 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x0, r2}, 0x18) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000001c0)=r4, 0x4) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={""/10, ""/2, @remote}}, 0x0, @in6=@empty}}, &(0x7f0000000380)=0xe8) newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x4, &(0x7f0000000480)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@cache_loose}, {@access_uid={'access', 0x3d, r7}}, {@noxattr}, {@privport}, {@noxattr}], [{@uid_gt={'uid>', r8}}]}}) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) quotactl_fd$Q_SYNC(r5, 0xffffffff80000102, 0x0, 0x0) r9 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r9, 0x7a8, &(0x7f00000005c0)={{@my=0x0, 0x80}, @local, 0x4, 0x7, 0x519, 0xc60f, 0x6, 0x9, 0x801}) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl$vim2m_VIDIOC_G_FMT(r10, 0xc0d05604, &(0x7f0000000740)={0x2, @win={{0xfffffffb, 0x95d, 0x8, 0x7ef9b012}, 0x9, 0x400, &(0x7f00000006c0)={{0x7, 0x7, 0x4, 0x5}, &(0x7f0000000680)={{0x8, 0x80000000, 0x0, 0x4}, &(0x7f0000000640)={{0x5ede, 0x3, 0x5, 0x3cbf}}}}, 0x9, &(0x7f0000000700)="1573ef11112caae95c452e95f818068c5db1f115c6cd73d1017319d7cd85e65dbfe9f8fab63152509d4eacdc316c4435cdef5b5fea3daccb15d95fd257", 0xff}}) sched_setattr(r1, &(0x7f0000000840)={0x38, 0x3, 0x1a, 0x7, 0x7, 0x3, 0x1, 0x35, 0x0, 0x100}, 0x0) r11 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000880), 0x2000, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000a00)={'ip6gre0\x00', &(0x7f0000000980)={'syztnl2\x00', r6, 0x4, 0x65, 0x3, 0x2, 0x2, @dev={0xfe, 0x80, '\x00', 0x12}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7, 0x0, 0x1}}) r13 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000a40), 0x4) r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b00)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x6, '\x00', r6, r3, 0x4, 0x2, 0x2}, 0x50) r15 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000b80)={0xffffffffffffffff, 0x5}, 0xc) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000bc0)={{0x1, 0x1, 0x18, r9, {0x4}}, './file0\x00'}) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000c00)={0x3, r2, 'id1\x00'}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d00)={{0x1, 0xffffffffffffffff}, &(0x7f0000000c80), &(0x7f0000000cc0)=r10}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e00)={0x11, 0x10, &(0x7f00000008c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', r12, 0x0, r13, 0x8, &(0x7f0000000a80)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000000ac0)={0x1, 0x7, 0xa, 0x1}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000d80)=[r14, 0xffffffffffffffff, 0xffffffffffffffff, r15, r16, r17, 0x1, r18, 0xffffffffffffffff], &(0x7f0000000dc0)=[{0x4, 0x1, 0xd, 0x7}], 0x10, 0xffff}, 0x94) 723.57983ms ago: executing program 4 (id=615): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000a40), 0x4a00) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000a80)=0x9, 0x4) syz_usb_connect(0x3, 0x34, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103"], 0x0) syz_usb_connect$cdc_ecm(0x1, 0x76, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x64, 0x1, 0x1, 0x6, 0x46333fbefe0ddc07, 0x3, [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x0, 'u^'}, {0x5, 0x24, 0x0, 0xaa01}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x6, 0x7, 0x7}, [@mbim={0xc, 0x24, 0x1b, 0x3, 0x7, 0xec, 0x7, 0x54, 0x78}, @mbim_extended={0x8, 0x24, 0x1c, 0x4, 0x40, 0x4}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0x28}, @obex={0x5, 0x24, 0x15, 0xf466}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3e, 0x3, 0xc}}], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x6, 0x6, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x78, 0x6, 0x5}}}}}]}}]}}, &(0x7f00000001c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0xf, 0xe, 0x9, 0x8, 0x2}, 0xc, &(0x7f00000000c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x1, 0x4}]}, 0x2, [{0x4, &(0x7f0000000100)=@lang_id={0x4}}, {0x67, &(0x7f0000000140)=@string={0x67, 0x3, "4f7f9f14d7108f48de84253f14aea657b1ea4934d7da04dbbe4e88446af135af6d9d89e3c403d6ba0e526f3bfbab4265aa64e0d6058ff1117fbf8d5d07f69d569a438b29e7dd9279678bab6cb182d1c91c2bb955c8047c9faf3d864c314601115f2d3ed334"}}]}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r3, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x40000}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x34, 0x0, @void}, 0x10) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x3, 0x4000000, 0x7}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000400)={@cgroup=r0, 0x24, 0x0, 0x8, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0]}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r5, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) 0s ago: executing program 2 (id=616): pipe(&(0x7f0000000080)) (async) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$I2C(0x0, 0x10001, 0x240000) (async, rerun: 32) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, 0x0) (rerun: 32) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x136) (async, rerun: 64) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) (async, rerun: 64) fcntl$getown(r0, 0x9) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x1, [], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e23, 0x1, @empty, 0x3}, 0x1c) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x1c, r9, 0x331, 0x70bd25, 0x25dfdbfa, {0xb}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r10}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24048800}, 0x4000000) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) (async, rerun: 64) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) kernel console output (not intermixed with test programs): w-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 102.609670][ T24] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 102.735935][ T5936] powermate: unknown product id 0240 [ 102.747153][ T5936] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 102.759633][ T24] usb 3-1: device descriptor read/64, error -71 [ 102.829609][ T5936] input: Griffin SoundKnob as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input6 [ 103.050110][ T24] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 103.090003][ T5913] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 103.189734][ T24] usb 3-1: device descriptor read/64, error -71 [ 103.308683][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.340063][ T24] usb usb3-port1: attempt power cycle [ 103.368558][ T5913] usb 4-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 103.392359][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.421639][ T5913] usb 4-1: config 0 descriptor?? [ 103.719793][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 103.772481][ T24] usb 3-1: device descriptor read/8, error -71 [ 103.846492][ T5913] uclogic 0003:28BD:0071.0003: interface is invalid, ignoring [ 104.019634][ T24] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 104.050108][ T24] usb 3-1: device descriptor read/8, error -71 [ 104.085443][ C1] powermate: config urb returned -71 [ 104.085866][ T5913] usb 5-1: USB disconnect, device number 4 [ 104.090773][ C1] powermate: usb_submit_urb(config) failed [ 104.090829][ C1] powermate 5-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 104.116164][ T976] usb 4-1: USB disconnect, device number 3 [ 104.159973][ T24] usb usb3-port1: unable to enumerate USB device [ 104.227372][ T30] kauditd_printk_skb: 44 callbacks suppressed [ 104.227384][ T30] audit: type=1326 audit(1758128721.759:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6507 comm="syz.4.115" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f82d678eba9 code=0x0 [ 104.262313][ T5936] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 104.420100][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 104.426589][ T5936] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.443027][ T5936] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.454080][ T5936] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 104.465326][ T5936] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.474696][ T5936] usb 1-1: config 0 descriptor?? [ 104.888114][ T5936] konepure 0003:1E7D:2DB4.0004: unknown main item tag 0x0 [ 104.899120][ T5936] konepure 0003:1E7D:2DB4.0004: unknown main item tag 0x0 [ 104.922753][ T5936] konepure 0003:1E7D:2DB4.0004: item fetching failed at offset 2/4 [ 104.931861][ T5936] konepure 0003:1E7D:2DB4.0004: parse failed [ 104.938068][ T5936] konepure 0003:1E7D:2DB4.0004: probe with driver konepure failed with error -22 [ 105.101582][ T5936] usb 1-1: USB disconnect, device number 4 [ 105.669094][ T30] audit: type=1400 audit(1758128723.189:321): avc: denied { create } for pid=6538 comm="syz.2.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 105.919535][ T6548] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=36 sclass=netlink_audit_socket pid=6548 comm=syz.0.122 [ 106.049695][ T30] audit: type=1400 audit(1758128723.199:322): avc: denied { read write } for pid=6538 comm="syz.2.120" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 106.080749][ T30] audit: type=1400 audit(1758128723.199:323): avc: denied { open } for pid=6538 comm="syz.2.120" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 106.163524][ T30] audit: type=1400 audit(1758128723.199:324): avc: denied { prog_load } for pid=6538 comm="syz.2.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 106.183844][ T30] audit: type=1400 audit(1758128723.199:325): avc: denied { bpf } for pid=6538 comm="syz.2.120" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 106.293998][ T30] audit: type=1400 audit(1758128723.199:326): avc: denied { perfmon } for pid=6538 comm="syz.2.120" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 106.315116][ T30] audit: type=1400 audit(1758128723.199:327): avc: denied { map } for pid=6538 comm="syz.2.120" path="socket:[10200]" dev="sockfs" ino=10200 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 106.459386][ T30] audit: type=1400 audit(1758128723.199:328): avc: denied { execmem } for pid=6538 comm="syz.2.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 106.501391][ T5920] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 106.729608][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 106.763087][ T30] audit: type=1400 audit(1758128723.199:329): avc: denied { read accept } for pid=6538 comm="syz.2.120" path="socket:[10200]" dev="sockfs" ino=10200 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 106.798909][ T5920] usb 3-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 106.815005][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.918750][ T5920] usb 3-1: Product: syz [ 106.923017][ T5920] usb 3-1: Manufacturer: syz [ 106.928166][ T5920] usb 3-1: SerialNumber: syz [ 106.962349][ T5920] usb 3-1: config 0 descriptor?? [ 106.986095][ T5920] ssu100 3-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 107.351608][ T5920] ssu100 3-1:0.0: probe with driver ssu100 failed with error -110 [ 107.376382][ T5920] usb 3-1: USB disconnect, device number 7 [ 107.709626][ T5913] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 107.967880][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 107.981215][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 107.993458][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 108.006844][ T5913] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 108.018012][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.029067][ T5913] usb 5-1: Product: syz [ 108.038369][ T5913] usb 5-1: Manufacturer: syz [ 108.048475][ T5913] usb 5-1: SerialNumber: syz [ 108.078482][ T5913] usb 5-1: config 0 descriptor?? [ 108.262427][ T6581] netlink: 36 bytes leftover after parsing attributes in process `syz.2.129'. [ 108.379387][ T5913] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 108.612241][ T6581] process 'syz.2.129' launched './file0' with NULL argv: empty string added [ 109.272803][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 109.272815][ T30] audit: type=1400 audit(1758128726.809:381): avc: denied { module_request } for pid=6589 comm="syz.3.133" kmod="crypto-sha256-arm64-neon" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 109.509454][ T6601] could not allocate digest TFM handle sha256-arm64-neon [ 109.682513][ T30] audit: type=1400 audit(1758128727.189:382): avc: denied { sys_module } for pid=6605 comm="syz.0.135" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 109.869311][ T30] audit: type=1400 audit(1758128727.399:383): avc: denied { open } for pid=6612 comm="syz.2.136" path="/dev/ptyq9" dev="devtmpfs" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 110.008679][ T30] audit: type=1400 audit(1758128727.539:384): avc: denied { create } for pid=6612 comm="syz.2.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 110.031849][ T30] audit: type=1400 audit(1758128727.539:385): avc: denied { setopt } for pid=6612 comm="syz.2.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 110.288378][ T6620] ip6erspan0: entered promiscuous mode [ 110.304759][ T976] usb 5-1: USB disconnect, device number 5 [ 110.317486][ T30] audit: type=1400 audit(1758128727.849:386): avc: denied { read write } for pid=6619 comm="syz.2.138" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 110.402428][ T30] audit: type=1400 audit(1758128727.849:387): avc: denied { open } for pid=6619 comm="syz.2.138" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 110.425278][ C0] vkms_vblank_simulate: vblank timer overrun [ 110.447450][ T30] audit: type=1400 audit(1758128727.979:388): avc: denied { read write } for pid=6623 comm="syz.2.140" name="vbi0" dev="devtmpfs" ino=952 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 110.563562][ T30] audit: type=1400 audit(1758128727.979:389): avc: denied { open } for pid=6623 comm="syz.2.140" path="/dev/vbi0" dev="devtmpfs" ino=952 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 110.689734][ T5913] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 110.787816][ T30] audit: type=1400 audit(1758128727.323:390): avc: denied { create } for pid=6628 comm="syz.2.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 110.839668][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 110.848768][ T5913] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 110.859519][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.916764][ T5913] usb 4-1: Product: syz [ 110.974978][ T5913] usb 4-1: Manufacturer: syz [ 110.993044][ T5913] usb 4-1: SerialNumber: syz [ 111.025004][ T6637] block nbd0: Attempted send on invalid socket [ 111.046202][ T6637] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 111.123955][ T5913] usb 4-1: config 0 descriptor?? [ 111.256724][ T5913] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 111.473357][ T6622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.489881][ T6622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.610922][ T6632] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 111.728573][ T5913] gspca_sonixj: reg_r err -32 [ 111.733334][ T5913] sonixj 4-1:0.0: probe with driver sonixj failed with error -32 [ 111.956874][ T6648] FAULT_INJECTION: forcing a failure. [ 111.956874][ T6648] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 111.973613][ T6648] CPU: 0 UID: 0 PID: 6648 Comm: syz.4.146 Not tainted syzkaller #0 PREEMPT(full) [ 111.973628][ T6648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 111.973634][ T6648] Call Trace: [ 111.973638][ T6648] [ 111.973642][ T6648] dump_stack_lvl+0x16c/0x1f0 [ 111.973660][ T6648] should_fail_ex+0x512/0x640 [ 111.973677][ T6648] _copy_to_user+0x32/0xd0 [ 111.973694][ T6648] simple_read_from_buffer+0xcb/0x170 [ 111.973707][ T6648] proc_fail_nth_read+0x197/0x240 [ 111.973720][ T6648] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 111.973733][ T6648] ? rw_verify_area+0xcf/0x6c0 [ 111.973750][ T6648] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 111.973763][ T6648] vfs_read+0x1e4/0xcf0 [ 111.973775][ T6648] ? __pfx___mutex_lock+0x10/0x10 [ 111.973790][ T6648] ? __pfx_vfs_read+0x10/0x10 [ 111.973804][ T6648] ? __fget_files+0x20e/0x3c0 [ 111.973820][ T6648] ksys_read+0x12a/0x250 [ 111.973831][ T6648] ? __pfx_ksys_read+0x10/0x10 [ 111.973845][ T6648] do_syscall_64+0xcd/0x4e0 [ 111.973860][ T6648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.973872][ T6648] RIP: 0033:0x7f82d678d5bc [ 111.973881][ T6648] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 111.973891][ T6648] RSP: 002b:00007f82d756c030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 111.973901][ T6648] RAX: ffffffffffffffda RBX: 00007f82d69d5fa0 RCX: 00007f82d678d5bc [ 111.973908][ T6648] RDX: 000000000000000f RSI: 00007f82d756c0a0 RDI: 0000000000000007 [ 111.973914][ T6648] RBP: 00007f82d756c090 R08: 0000000000000000 R09: 0000000000000000 [ 111.973920][ T6648] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 111.973926][ T6648] R13: 00007f82d69d6038 R14: 00007f82d69d5fa0 R15: 00007ffc46d74fd8 [ 111.973939][ T6648] [ 112.288827][ T6651] fuse: Bad value for 'fd' [ 113.196598][ T6671] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6671 comm=syz.1.153 [ 113.219479][ T6672] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6672 comm=syz.1.153 [ 113.560517][ T6685] netlink: 36 bytes leftover after parsing attributes in process `syz.1.155'. [ 113.929718][ T5920] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 113.942348][ T878] usb 4-1: USB disconnect, device number 4 [ 114.171137][ T5920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.182165][ T5920] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 114.191301][ T5920] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.205501][ T5920] usb 1-1: config 0 descriptor?? [ 114.321277][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 114.321287][ T30] audit: type=1400 audit(1758128730.853:409): avc: denied { read } for pid=6690 comm="syz.2.159" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 114.416759][ T6692] trusted_key: encrypted_key: key user:syz not found [ 114.491075][ T5920] usbhid 1-1:0.0: can't add hid device: -71 [ 114.728757][ T5920] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 114.761184][ T5920] usb 1-1: USB disconnect, device number 5 [ 114.767174][ T30] audit: type=1400 audit(1758128730.853:410): avc: denied { open } for pid=6690 comm="syz.2.159" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 114.847969][ T30] audit: type=1400 audit(1758128730.943:411): avc: denied { write } for pid=6690 comm="syz.2.159" path="socket:[11441]" dev="sockfs" ino=11441 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 114.858077][ T6701] fuse: Bad value for 'fd' [ 114.884135][ T6703] Bluetooth: (null): Invalid header checksum [ 114.916471][ T30] audit: type=1400 audit(1758128730.963:412): avc: denied { write } for pid=6690 comm="syz.2.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 114.964377][ T30] audit: type=1400 audit(1758128731.083:413): avc: denied { map } for pid=6684 comm="syz.1.155" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 114.993228][ T30] audit: type=1400 audit(1758128731.083:414): avc: denied { execute } for pid=6684 comm="syz.1.155" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 115.067703][ T30] audit: type=1400 audit(1758128731.113:415): avc: denied { append } for pid=6684 comm="syz.1.155" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 115.126253][ T30] audit: type=1400 audit(1758128731.643:416): avc: denied { read } for pid=6707 comm="syz.2.164" name="binder1" dev="binder" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 115.149193][ T30] audit: type=1400 audit(1758128731.643:417): avc: denied { open } for pid=6707 comm="syz.2.164" path="/dev/binderfs/binder1" dev="binder" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 115.414405][ T30] audit: type=1400 audit(1758128731.793:418): avc: denied { ioctl } for pid=6707 comm="syz.2.164" path="/dev/binderfs/binder1" dev="binder" ino=11 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 115.534850][ T6713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.165'. [ 115.586243][ T6713] netlink: 4 bytes leftover after parsing attributes in process `syz.4.165'. [ 115.611081][ T6713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.165'. [ 115.611490][ T1127] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.621974][ T6713] netlink: 4 bytes leftover after parsing attributes in process `syz.4.165'. [ 115.642842][ T12] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.655781][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 115.679507][ T12] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.349439][ T6713] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31504 sclass=netlink_route_socket pid=6713 comm=syz.4.165 [ 116.789669][ T976] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 116.862293][ T6740] capability: warning: `syz.4.171' uses deprecated v2 capabilities in a way that may be insecure [ 116.980302][ T976] usb 4-1: Using ep0 maxpacket: 8 [ 117.005902][ T976] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 117.029663][ T976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.044891][ T976] usb 4-1: Product: syz [ 117.049054][ T976] usb 4-1: Manufacturer: syz [ 117.056528][ T6748] binder: 6747:6748 ioctl 80089418 2000000002c0 returned -22 [ 117.060601][ T976] usb 4-1: SerialNumber: syz [ 117.100582][ T976] usb 4-1: config 0 descriptor?? [ 117.105319][ T6748] usb usb7: usbfs: process 6748 (syz.4.172) did not claim interface 0 before use [ 117.124869][ T976] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 117.156876][ T6758] fuse: Bad value for 'fd' [ 117.312916][ T6729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.329958][ T6729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.584069][ T976] gspca_sonixj: reg_r err -32 [ 117.889639][ T976] sonixj 4-1:0.0: probe with driver sonixj failed with error -32 [ 119.499365][ T6819] random: crng reseeded on system resumption [ 119.505961][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 119.505975][ T30] audit: type=1400 audit(1758128736.023:457): avc: denied { write } for pid=6817 comm="syz.0.184" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 119.857332][ T30] audit: type=1400 audit(1758128736.023:458): avc: denied { open } for pid=6817 comm="syz.0.184" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 119.889531][ T30] audit: type=1400 audit(1758128736.073:459): avc: denied { mount } for pid=6811 comm="syz.4.183" name="/" dev="ramfs" ino=11703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 120.235692][ T5936] usb 4-1: USB disconnect, device number 5 [ 120.510135][ T878] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 121.087736][ T30] audit: type=1400 audit(1758128737.053:460): avc: denied { create } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 121.195198][ T30] audit: type=1400 audit(1758128737.083:461): avc: denied { create } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.271520][ T878] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 121.281964][ T878] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 121.283865][ T30] audit: type=1400 audit(1758128737.273:462): avc: denied { bind } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.309633][ T878] usb 3-1: config 220 interface 0 has no altsetting 0 [ 121.331034][ T878] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 121.378238][ T878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.412044][ T878] usb 3-1: Product: syz [ 121.419334][ T878] usb 3-1: Manufacturer: syz [ 121.424825][ T30] audit: type=1400 audit(1758128737.283:463): avc: denied { listen } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.434835][ T878] usb 3-1: SerialNumber: syz [ 121.479697][ T30] audit: type=1400 audit(1758128737.293:464): avc: denied { connect } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.503123][ T30] audit: type=1400 audit(1758128737.363:465): avc: denied { write } for pid=6827 comm="syz.3.186" path="socket:[10986]" dev="sockfs" ino=10986 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.671107][ T30] audit: type=1400 audit(1758128737.373:466): avc: denied { accept } for pid=6827 comm="syz.3.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.745946][ T878] usb 3-1: Found UVC 0.00 device syz (8086:0b07) [ 121.968516][ T878] usb 3-1: No valid video chain found. [ 122.501336][ T878] usb 3-1: USB disconnect, device number 8 [ 123.799986][ T6869] netlink: 'syz.4.193': attribute type 21 has an invalid length. [ 123.819690][ T6869] netlink: 128 bytes leftover after parsing attributes in process `syz.4.193'. [ 123.828720][ T6869] netlink: 'syz.4.193': attribute type 5 has an invalid length. [ 123.848927][ T6869] netlink: 'syz.4.193': attribute type 6 has an invalid length. [ 123.900218][ T6869] netlink: 3 bytes leftover after parsing attributes in process `syz.4.193'. [ 124.292840][ T6877] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 124.304975][ T6877] (syz.1.196,6877,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 124.312478][ T6877] (syz.1.196,6877,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 124.319754][ T6877] (syz.1.196,6877,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 124.328244][ T6877] (syz.1.196,6877,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 124.916584][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 124.916598][ T30] audit: type=1326 audit(1758128741.443:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6881 comm="syz.2.199" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fce0fb8eba9 code=0x0 [ 124.958494][ T6884] tmpfs: Unknown parameter 'subj_type' [ 124.979960][ T30] audit: type=1400 audit(1758128741.483:478): avc: denied { mount } for pid=6880 comm="syz.4.198" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 125.129333][ T30] audit: type=1400 audit(1758128741.483:479): avc: denied { remount } for pid=6880 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 125.129370][ T30] audit: type=1400 audit(1758128741.493:480): avc: denied { create } for pid=6880 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 125.129401][ T30] audit: type=1400 audit(1758128741.503:481): avc: denied { sys_admin } for pid=6880 comm="syz.4.198" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 125.205078][ T6887] SELinux: failed to load policy [ 125.222438][ T30] audit: type=1400 audit(1758128741.733:482): avc: denied { load_policy } for pid=6882 comm="syz.3.201" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 125.412192][ T30] audit: type=1400 audit(1758128741.883:483): avc: denied { unmount } for pid=6880 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 125.491239][ T6895] netlink: 212388 bytes leftover after parsing attributes in process `syz.4.198'. [ 125.694846][ T6895] netlink: get zone limit has 8 unknown bytes [ 125.983904][ T30] audit: type=1400 audit(1758128742.493:484): avc: denied { create } for pid=6898 comm="syz.0.203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 126.073529][ T6913] mkiss: ax0: crc mode is auto. [ 126.203685][ T30] audit: type=1400 audit(1758128742.493:485): avc: denied { setopt } for pid=6898 comm="syz.0.203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 126.268472][ T30] audit: type=1400 audit(1758128742.593:486): avc: denied { create } for pid=6906 comm="syz.1.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 126.289747][ T976] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 126.930922][ T976] usb 1-1: device descriptor read/64, error -71 [ 126.945200][ T6930] netlink: 'syz.4.209': attribute type 21 has an invalid length. [ 126.970517][ T6930] netlink: 128 bytes leftover after parsing attributes in process `syz.4.209'. [ 127.114412][ T6930] netlink: 'syz.4.209': attribute type 5 has an invalid length. [ 127.132173][ T6930] netlink: 'syz.4.209': attribute type 6 has an invalid length. [ 127.149630][ T6930] netlink: 3 bytes leftover after parsing attributes in process `syz.4.209'. [ 127.179653][ T976] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 127.530167][ T976] usb 1-1: device descriptor read/64, error -71 [ 127.641770][ T976] usb usb1-port1: attempt power cycle [ 128.393708][ T976] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 128.422156][ T6951] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 128.430408][ T976] usb 1-1: device descriptor read/8, error -71 [ 128.462135][ T6951] kvm: pic: non byte read [ 128.468073][ T6951] kvm: pic: level sensitive irq not supported [ 128.468142][ T6951] kvm: pic: non byte read [ 128.479231][ T6951] kvm: pic: level sensitive irq not supported [ 128.479323][ T6951] kvm: pic: non byte read [ 128.490897][ T6951] kvm: pic: level sensitive irq not supported [ 128.490951][ T6951] kvm: pic: non byte read [ 128.669630][ T976] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 128.737647][ T976] usb 1-1: device descriptor read/8, error -71 [ 128.905051][ T976] usb usb1-port1: unable to enumerate USB device [ 129.509281][ T6963] netlink: 8 bytes leftover after parsing attributes in process `syz.4.219'. [ 129.518086][ T6963] netlink: 4 bytes leftover after parsing attributes in process `syz.4.219'. [ 130.848581][ T6994] bridge_slave_0: left allmulticast mode [ 130.854305][ T6994] bridge_slave_0: left promiscuous mode [ 130.861387][ T6994] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.888711][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 130.889113][ T30] audit: type=1400 audit(1758128747.363:508): avc: denied { accept } for pid=6986 comm="syz.4.224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 131.046136][ T6994] bridge_slave_1: left allmulticast mode [ 131.496177][ T6994] bridge_slave_1: left promiscuous mode [ 132.112186][ T6994] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.248191][ T6994] bond0: (slave bond_slave_0): Releasing backup interface [ 132.268674][ T30] audit: type=1400 audit(1758128748.793:509): avc: denied { bind } for pid=7008 comm="syz.3.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 132.312307][ T6994] bond0: (slave bond_slave_1): Releasing backup interface [ 132.338593][ T6994] team0: Port device team_slave_0 removed [ 132.353577][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.359957][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.371578][ T6994] team0: Port device team_slave_1 removed [ 132.378032][ T6994] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 132.390841][ T6994] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 132.401797][ T6994] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 132.409258][ T6994] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 132.576059][ T7017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.231'. [ 132.585173][ T7017] netlink: 4 bytes leftover after parsing attributes in process `syz.0.231'. [ 132.632421][ T7016] netlink: 'syz.2.230': attribute type 21 has an invalid length. [ 132.764583][ T7016] netlink: 128 bytes leftover after parsing attributes in process `syz.2.230'. [ 132.892299][ T30] audit: type=1400 audit(1758128749.423:510): avc: denied { read } for pid=7018 comm="syz.1.232" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 132.927723][ T30] audit: type=1400 audit(1758128749.423:511): avc: denied { open } for pid=7018 comm="syz.1.232" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 132.953724][ T7016] netlink: 'syz.2.230': attribute type 5 has an invalid length. [ 132.961976][ T7016] netlink: 'syz.2.230': attribute type 6 has an invalid length. [ 132.983319][ T7016] netlink: 3 bytes leftover after parsing attributes in process `syz.2.230'. [ 133.212831][ T30] audit: type=1400 audit(1758128749.743:512): avc: denied { getopt } for pid=7029 comm="syz.1.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 133.241193][ T7031] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 133.250863][ T7031] (syz.0.233,7031,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 133.258360][ T7031] (syz.0.233,7031,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 133.265612][ T7031] (syz.0.233,7031,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 133.274162][ T7031] (syz.0.233,7031,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 133.545456][ T30] audit: type=1400 audit(1758128749.823:513): avc: denied { connect } for pid=7029 comm="syz.1.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 133.568444][ T30] audit: type=1400 audit(1758128750.093:514): avc: denied { create } for pid=7027 comm="syz.3.234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 133.587603][ C0] vkms_vblank_simulate: vblank timer overrun [ 133.705980][ T30] audit: type=1400 audit(1758128750.123:515): avc: denied { ioctl } for pid=7027 comm="syz.3.234" path="socket:[12161]" dev="sockfs" ino=12161 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 133.738511][ T30] audit: type=1400 audit(1758128750.263:516): avc: denied { create } for pid=7027 comm="syz.3.234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 133.821237][ T30] audit: type=1400 audit(1758128750.263:517): avc: denied { wake_alarm } for pid=7027 comm="syz.3.234" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 135.591696][ T7071] bridge1: entered promiscuous mode [ 135.654278][ T7073] netlink: 8 bytes leftover after parsing attributes in process `syz.2.244'. [ 135.663214][ T7073] netlink: 4 bytes leftover after parsing attributes in process `syz.2.244'. [ 136.320286][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 136.381005][ T30] audit: type=1400 audit(1758128752.853:524): avc: denied { bind } for pid=7080 comm="syz.2.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 136.588381][ T30] audit: type=1400 audit(1758128752.933:525): avc: denied { create } for pid=7080 comm="syz.2.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 136.798862][ T30] audit: type=1400 audit(1758128753.323:526): avc: denied { mount } for pid=7078 comm="syz.4.248" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 136.820846][ C0] vkms_vblank_simulate: vblank timer overrun [ 136.844697][ T7083] overlayfs: failed to clone upperpath [ 136.912466][ T7091] random: crng reseeded on system resumption [ 137.379790][ T878] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 137.520751][ T7106] netlink: 'syz.0.253': attribute type 21 has an invalid length. [ 137.528492][ T7106] netlink: 128 bytes leftover after parsing attributes in process `syz.0.253'. [ 137.639664][ T5913] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 137.679630][ T878] usb 3-1: Using ep0 maxpacket: 8 [ 137.689141][ T878] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 137.718030][ T878] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 137.746814][ T878] usb 3-1: config 0 has no interface number 0 [ 137.779525][ T878] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 138.046597][ T7106] netlink: 'syz.0.253': attribute type 5 has an invalid length. [ 138.055974][ T7106] netlink: 'syz.0.253': attribute type 6 has an invalid length. [ 138.068260][ T7106] netlink: 3 bytes leftover after parsing attributes in process `syz.0.253'. [ 138.075398][ T878] usb 3-1: config 0 interface 186 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 138.114696][ T7097] netlink: 28 bytes leftover after parsing attributes in process `syz.4.252'. [ 138.126468][ T878] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 138.135858][ T878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.155612][ T878] usb 3-1: Product: syz [ 138.168384][ T878] usb 3-1: Manufacturer: syz [ 138.174218][ T878] usb 3-1: SerialNumber: syz [ 138.182061][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 138.189183][ T878] usb 3-1: config 0 descriptor?? [ 138.199856][ T878] iowarrior 3-1:0.186: no interrupt-in endpoint found [ 138.286188][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 138.312441][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.353589][ T5913] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 138.374038][ T5913] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 138.386134][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.449873][ T5913] usb 4-1: config 0 descriptor?? [ 138.530914][ T7093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.552204][ T7093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.585190][ T7117] netlink: 28 bytes leftover after parsing attributes in process `syz.4.258'. [ 138.603747][ T30] audit: type=1400 audit(1758128755.135:527): avc: denied { ioctl } for pid=7092 comm="syz.2.251" path="socket:[12283]" dev="sockfs" ino=12283 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 138.661563][ T30] audit: type=1400 audit(1758128755.135:528): avc: denied { write } for pid=7092 comm="syz.2.251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 138.664974][ T5920] usb 3-1: USB disconnect, device number 9 [ 138.877166][ T7120] netlink: 8 bytes leftover after parsing attributes in process `syz.4.259'. [ 138.886068][ T7120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.259'. [ 138.923868][ T5913] microsoft 0003:045E:07DA.0005: unknown main item tag 0x0 [ 138.941934][ T5913] microsoft 0003:045E:07DA.0005: unknown main item tag 0x0 [ 138.963357][ T5913] microsoft 0003:045E:07DA.0005: unknown main item tag 0x0 [ 138.980086][ T30] audit: type=1400 audit(1758128755.505:529): avc: denied { bind } for pid=7121 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 138.999390][ T30] audit: type=1400 audit(1758128755.505:530): avc: denied { node_bind } for pid=7121 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 139.018444][ T5913] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0005/input/input7 [ 139.105439][ T30] audit: type=1400 audit(1758128755.505:531): avc: denied { setopt } for pid=7121 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 139.257512][ T30] audit: type=1400 audit(1758128755.785:532): avc: denied { read } for pid=5205 comm="acpid" name="js0" dev="devtmpfs" ino=2860 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 139.293343][ T5913] microsoft 0003:045E:07DA.0005: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 139.346254][ T30] audit: type=1400 audit(1758128755.785:533): avc: denied { open } for pid=5205 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=2860 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 139.372173][ T7126] SELinux: failed to load policy [ 139.400417][ T5913] usb 4-1: USB disconnect, device number 6 [ 140.391654][ T7129] fido_id[7129]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 140.424142][ T7135] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 140.587748][ T7152] bridge_slave_0: left allmulticast mode [ 140.613337][ T7152] bridge_slave_0: left promiscuous mode [ 140.632425][ T7152] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.665888][ T7157] FAULT_INJECTION: forcing a failure. [ 140.665888][ T7157] name failslab, interval 1, probability 0, space 0, times 1 [ 140.680501][ T7157] CPU: 0 UID: 0 PID: 7157 Comm: syz.0.265 Not tainted syzkaller #0 PREEMPT(full) [ 140.680523][ T7157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 140.680532][ T7157] Call Trace: [ 140.680538][ T7157] [ 140.680545][ T7157] dump_stack_lvl+0x16c/0x1f0 [ 140.680572][ T7157] should_fail_ex+0x512/0x640 [ 140.680594][ T7157] ? fs_reclaim_acquire+0xae/0x150 [ 140.680620][ T7157] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 140.680645][ T7157] should_failslab+0xc2/0x120 [ 140.680665][ T7157] __kmalloc_noprof+0xd2/0x510 [ 140.680689][ T7157] tomoyo_realpath_from_path+0xc2/0x6e0 [ 140.680716][ T7157] ? tomoyo_profile+0x47/0x60 [ 140.680736][ T7157] tomoyo_path_number_perm+0x245/0x580 [ 140.680757][ T7157] ? tomoyo_path_number_perm+0x237/0x580 [ 140.680781][ T7157] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 140.680802][ T7157] ? find_held_lock+0x2b/0x80 [ 140.680837][ T7157] ? find_held_lock+0x2b/0x80 [ 140.680852][ T7157] ? hook_file_ioctl_common+0x145/0x410 [ 140.680872][ T7157] ? __fget_files+0x20e/0x3c0 [ 140.680891][ T7157] security_file_ioctl+0x9b/0x240 [ 140.680913][ T7157] __x64_sys_ioctl+0xb7/0x210 [ 140.680936][ T7157] do_syscall_64+0xcd/0x4e0 [ 140.680960][ T7157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.680974][ T7157] RIP: 0033:0x7f34def8eba9 [ 140.680985][ T7157] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 140.680998][ T7157] RSP: 002b:00007f34dfe7a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.681012][ T7157] RAX: ffffffffffffffda RBX: 00007f34df1d6180 RCX: 00007f34def8eba9 [ 140.681021][ T7157] RDX: 0000200000000080 RSI: 00000000c0d05640 RDI: 0000000000000006 [ 140.681034][ T7157] RBP: 00007f34dfe7a090 R08: 0000000000000000 R09: 0000000000000000 [ 140.681043][ T7157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.681050][ T7157] R13: 00007f34df1d6218 R14: 00007f34df1d6180 R15: 00007fff9fc8f828 [ 140.681069][ T7157] [ 140.681126][ T7157] ERROR: Out of memory at tomoyo_realpath_from_path. [ 140.886899][ T7152] bridge_slave_1: left allmulticast mode [ 140.895882][ T7152] bridge_slave_1: left promiscuous mode [ 140.922226][ T7152] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.035929][ T7165] netlink: 4 bytes leftover after parsing attributes in process `syz.2.267'. [ 141.065828][ T7152] bond0: (slave bond_slave_0): Releasing backup interface [ 141.143170][ T7152] bond0: (slave bond_slave_1): Releasing backup interface [ 141.230123][ T7152] team0: Port device team_slave_0 removed [ 141.251568][ T7152] team0: Port device team_slave_1 removed [ 141.257870][ T7152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 141.296226][ T7152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 141.322852][ T7152] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 141.341506][ T7152] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 141.805273][ T7176] netlink: 48 bytes leftover after parsing attributes in process `syz.4.271'. [ 141.912669][ T7167] bridge0: entered promiscuous mode [ 141.918148][ T7167] macvlan2: entered promiscuous mode [ 142.450361][ T7191] bridge_slave_0: left allmulticast mode [ 142.456137][ T7191] bridge_slave_0: left promiscuous mode [ 142.462268][ T7191] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.501967][ T7191] bridge_slave_1: left allmulticast mode [ 142.507781][ T7191] bridge_slave_1: left promiscuous mode [ 142.514049][ T7191] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.547094][ T7191] bond0: (slave bond_slave_0): Releasing backup interface [ 142.650466][ T1097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 142.660612][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 142.684683][ T7191] bond0: (slave bond_slave_1): Releasing backup interface [ 142.701195][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 143.469128][ T7191] team0: Port device team_slave_0 removed [ 143.609601][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 143.609615][ T30] audit: type=1400 audit(1758128760.135:537): avc: denied { ioctl } for pid=7200 comm="syz.0.279" path="/dev/input/event0" dev="devtmpfs" ino=918 ioctlcmd=0x4590 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 143.642709][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 143.666919][ T30] audit: type=1400 audit(1758128760.135:538): avc: denied { read write } for pid=7200 comm="syz.0.279" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 143.751070][ T7191] team0: Port device team_slave_1 removed [ 143.757596][ T7191] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.768244][ T7191] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.798781][ T30] audit: type=1400 audit(1758128760.135:539): avc: denied { open } for pid=7200 comm="syz.0.279" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 143.937740][ T7191] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.059691][ T7191] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.111398][ T30] audit: type=1400 audit(1758128760.325:540): avc: denied { create } for pid=7205 comm="syz.3.280" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 144.189909][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 144.420737][ T7213] I/O error, dev loop3, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 144.430618][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 144.491678][ T7213] overlayfs: overlapping lowerdir path [ 144.507856][ T7207] netlink: 'syz.3.280': attribute type 1 has an invalid length. [ 145.926604][ T7224] ubi31: attaching mtd0 [ 145.944425][ T7229] usb usb8: usbfs: process 7229 (syz.0.284) did not claim interface 0 before use [ 145.955078][ T7227] usb usb8: usbfs: process 7227 (syz.0.284) did not claim interface 0 before use [ 145.990434][ T7224] ubi31: scanning is finished [ 145.995121][ T7224] ubi31: empty MTD device detected [ 146.211196][ T7224] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 146.385867][ T7239] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.394226][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.687424][ T976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 147.001509][ T30] audit: type=1326 audit(1758128763.535:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7251 comm="syz.4.290" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f82d678eba9 code=0x0 [ 147.573788][ T7265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.294'. [ 147.583525][ T7265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.294'. [ 148.340873][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.179600][ T976] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 149.429840][ T976] usb 1-1: Using ep0 maxpacket: 16 [ 149.469799][ T976] usb 1-1: New USB device found, idVendor=10b9, idProduct=8000, bcdDevice=c0.fa [ 149.480435][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.495131][ T976] usb 1-1: Product: syz [ 149.506101][ T976] usb 1-1: Manufacturer: syz [ 149.523065][ T976] usb 1-1: SerialNumber: syz [ 149.699709][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.718370][ T976] usb 1-1: config 0 descriptor?? [ 149.946389][ T7314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.306'. [ 149.955295][ T7314] netlink: 4 bytes leftover after parsing attributes in process `syz.2.306'. [ 150.001176][ T30] audit: type=1400 audit(1758128766.535:542): avc: denied { write } for pid=7301 comm="syz.0.303" name="kcm" dev="proc" ino=4026533184 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 150.007212][ T976] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 150.212019][ T976] dvb_usb_af9015 1-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 150.277714][ T976] usb 1-1: USB disconnect, device number 10 [ 150.342618][ T30] audit: type=1400 audit(1758128766.865:543): avc: denied { read write } for pid=7319 comm="syz.3.308" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 150.396292][ T30] audit: type=1400 audit(1758128766.875:544): avc: denied { open } for pid=7319 comm="syz.3.308" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 150.570989][ T30] audit: type=1400 audit(1758128767.105:545): avc: denied { mounton } for pid=7319 comm="syz.3.308" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 150.602432][ T7324] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 150.848492][ T7336] veth1_macvtap: left promiscuous mode [ 150.854059][ T7336] macsec0: entered promiscuous mode [ 150.859253][ T7336] macsec0: entered allmulticast mode [ 150.866191][ T7336] veth1_macvtap: entered promiscuous mode [ 150.871950][ T7336] veth1_macvtap: entered allmulticast mode [ 150.877822][ T7336] macsec0: left promiscuous mode [ 150.882967][ T7336] macsec0: left allmulticast mode [ 150.887985][ T7336] veth1_macvtap: left allmulticast mode [ 151.194679][ T30] audit: type=1400 audit(1758128767.725:546): avc: denied { write } for pid=7341 comm="syz.4.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 151.589311][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 151.693865][ T7364] SELinux: Context system_u:object_r:userio_device_t:s0 is not valid (left unmapped). [ 151.783511][ T30] audit: type=1400 audit(1758128768.225:547): avc: denied { mac_admin } for pid=7343 comm="syz.3.318" capability=33 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 151.809653][ T30] audit: type=1400 audit(1758128768.235:548): avc: denied { relabelto } for pid=7343 comm="syz.3.318" name="file1" dev="tmpfs" ino=352 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:userio_device_t:s0" [ 151.922481][ T976] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 151.989601][ T878] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 151.998384][ T30] audit: type=1400 audit(1758128768.235:549): avc: denied { associate } for pid=7343 comm="syz.3.318" name="file1" dev="tmpfs" ino=352 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:userio_device_t:s0" [ 152.037970][ T30] audit: type=1400 audit(1758128768.235:550): avc: denied { ioctl } for pid=7343 comm="syz.3.318" path="socket:[14368]" dev="sockfs" ino=14368 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 152.071944][ T30] audit: type=1400 audit(1758128768.235:551): avc: denied { write } for pid=7343 comm="syz.3.318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 152.140959][ T976] usb 3-1: config 1 has an invalid interface number: 32 but max is 1 [ 152.149621][ T878] usb 1-1: Using ep0 maxpacket: 16 [ 152.156418][ T878] usb 1-1: config 235 has an invalid interface number: 120 but max is 0 [ 152.164011][ T976] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.179857][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 152.188365][ T976] usb 3-1: config 1 has no interface number 0 [ 152.188418][ T878] usb 1-1: config 235 has no interface number 0 [ 152.198314][ T976] usb 3-1: config 1 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 152.233457][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 152.245180][ T878] usb 1-1: config 235 interface 120 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 152.253474][ T976] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.1f [ 152.266590][ T878] usb 1-1: config 235 interface 120 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 152.279081][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.280383][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 152.298819][ T878] usb 1-1: config 235 interface 120 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 152.319621][ T878] usb 1-1: config 235 interface 120 altsetting 12 has a duplicate endpoint with address 0x6, skipping [ 152.324923][ T976] usb 3-1: Product: syz [ 152.331542][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0x4 has invalid wMaxPacketSize 0 [ 152.346321][ T7373] netlink: 24 bytes leftover after parsing attributes in process `syz.4.324'. [ 152.349576][ T976] usb 3-1: Manufacturer: syz [ 152.356249][ T7373] netlink: 24 bytes leftover after parsing attributes in process `syz.4.324'. [ 152.382769][ T976] usb 3-1: SerialNumber: syz [ 152.383609][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 152.406875][ T7375] netlink: 24 bytes leftover after parsing attributes in process `syz.4.324'. [ 152.408800][ T976] cdc_ncm 3-1:1.32: skipping garbage [ 152.426431][ T976] cdc_ncm 3-1:1.32: NCM or ECM functional descriptors missing [ 152.434081][ T976] cdc_ncm 3-1:1.32: bind() failure [ 152.436089][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 152.454525][ T7375] netlink: 24 bytes leftover after parsing attributes in process `syz.4.324'. [ 152.464250][ T878] usb 1-1: config 235 interface 120 altsetting 12 has a duplicate endpoint with address 0xD, skipping [ 152.498463][ T878] usb 1-1: config 235 interface 120 altsetting 12 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 152.510316][ T878] usb 1-1: config 235 interface 120 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 152.522624][ T878] usb 1-1: config 235 interface 120 altsetting 12 has a duplicate endpoint with address 0xD, skipping [ 152.533819][ T878] usb 1-1: config 235 interface 120 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 152.608053][ T878] usb 1-1: config 235 interface 120 has no altsetting 0 [ 152.627408][ T878] usb 1-1: New USB device found, idVendor=19d2, idProduct=1071, bcdDevice=73.2a [ 152.629498][ T976] usb 3-1: USB disconnect, device number 10 [ 152.636753][ T878] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.697681][ T878] usb 1-1: Product: syz [ 152.717393][ T878] usb 1-1: Manufacturer: syz [ 152.732674][ T878] usb 1-1: SerialNumber: syz [ 152.761789][ T7367] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 153.091245][ T7367] ======================================================= [ 153.091245][ T7367] WARNING: The mand mount option has been deprecated and [ 153.091245][ T7367] and is ignored by this kernel. Remove the mand [ 153.091245][ T7367] option from the mount to silence this warning. [ 153.091245][ T7367] ======================================================= [ 153.126049][ C0] vkms_vblank_simulate: vblank timer overrun [ 153.195688][ T7396] netlink: 'syz.3.325': attribute type 4 has an invalid length. [ 154.113852][ T7410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.332'. [ 154.122779][ T7410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.332'. [ 154.475309][ T7414] SELinux: policydb magic number 0x69662f2e does not match expected magic number 0xf97cff8c [ 154.493380][ T7414] SELinux: failed to load policy [ 154.688500][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 154.911638][ T24] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 154.936073][ T878] option 1-1:235.120: GSM modem (1-port) converter detected [ 155.000452][ T878] usb 1-1: USB disconnect, device number 11 [ 155.289921][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 155.306591][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 155.320317][ T878] option 1-1:235.120: device disconnected [ 155.329216][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 155.547235][ T5928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 155.585691][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 155.605570][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.624266][ T24] usb 3-1: Product: syz [ 155.633129][ T24] usb 3-1: Manufacturer: syz [ 155.648033][ T24] usb 3-1: SerialNumber: syz [ 155.662778][ T24] usb 3-1: config 0 descriptor?? [ 155.670768][ T24] appledisplay 3-1:0.0: Could not find int-in endpoint [ 155.678392][ T24] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 155.819374][ T7431] netlink: 'syz.3.338': attribute type 21 has an invalid length. [ 155.828458][ T7431] netlink: 128 bytes leftover after parsing attributes in process `syz.3.338'. [ 155.838851][ T7431] netlink: 'syz.3.338': attribute type 5 has an invalid length. [ 155.846890][ T7431] netlink: 'syz.3.338': attribute type 6 has an invalid length. [ 155.856316][ T7431] netlink: 3 bytes leftover after parsing attributes in process `syz.3.338'. [ 155.891042][ T7418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.907338][ T7418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.117843][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 156.117859][ T30] audit: type=1400 audit(1758128772.633:568): avc: denied { create } for pid=7434 comm="syz.0.339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 156.412439][ T30] audit: type=1400 audit(1758128772.633:569): avc: denied { write } for pid=7434 comm="syz.0.339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 157.229472][ T30] audit: type=1400 audit(1758128773.753:570): avc: denied { create } for pid=7456 comm="syz.3.343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 157.699812][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 157.839669][ T5928] usb 3-1: USB disconnect, device number 11 [ 158.147529][ T30] audit: type=1400 audit(1758128774.673:571): avc: denied { write } for pid=7473 comm="syz.2.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 159.279619][ T878] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 159.397083][ T7488] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.420209][ T7488] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.502520][ T878] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 159.512754][ T878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.526230][ T7493] random: crng reseeded on system resumption [ 159.539253][ T878] usb 1-1: config 0 descriptor?? [ 159.659626][ T5928] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 159.851319][ T5928] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 159.865176][ T5928] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 159.925286][ T5928] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 159.937370][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.955790][ T5928] usb 3-1: Product: syz [ 160.006828][ T30] audit: type=1400 audit(1758128776.533:572): avc: denied { append } for pid=7485 comm="syz.3.352" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 160.030888][ T30] audit: type=1400 audit(1758128776.563:573): avc: denied { open } for pid=7485 comm="syz.3.352" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 160.139573][ T5928] usb 3-1: Manufacturer: syz [ 160.144178][ T5928] usb 3-1: SerialNumber: syz [ 160.180262][ T5928] usb 3-1: config 0 descriptor?? [ 160.199891][ T7489] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 160.207783][ T7489] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 160.711550][ T878] usb 1-1: Cannot set autoneg [ 160.717207][ T878] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -61 [ 160.897954][ T976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.109737][ T878] usb 1-1: USB disconnect, device number 12 [ 161.829455][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.881645][ T7529] trusted_key: encrypted_key: insufficient parameters specified [ 162.139922][ T24] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 162.400094][ T5928] dm9601 3-1:0.0: probe with driver dm9601 failed with error -71 [ 162.416167][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 162.430984][ T5928] usb 3-1: USB disconnect, device number 12 [ 162.442097][ T878] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 162.477406][ T24] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 162.544375][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.643623][ T24] usb 1-1: config 0 descriptor?? [ 162.664212][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 162.737239][ T878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 163.172131][ T878] usb 4-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 163.188699][ T5905] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 163.202303][ T878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.227469][ T878] usb 4-1: config 0 descriptor?? [ 163.538591][ T30] audit: type=1400 audit(1758128780.053:574): avc: denied { create } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.566375][ T30] audit: type=1400 audit(1758128780.053:575): avc: denied { connect } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.594569][ T30] audit: type=1400 audit(1758128780.113:576): avc: denied { bind } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.633194][ T30] audit: type=1400 audit(1758128780.113:577): avc: denied { listen } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.662149][ T30] audit: type=1400 audit(1758128780.113:578): avc: denied { accept } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.754157][ T30] audit: type=1400 audit(1758128780.113:579): avc: denied { accept } for pid=7543 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 163.774602][ T7546] block nbd1: shutting down sockets [ 163.782753][ T7546] binder: 7539:7546 ioctl c0145401 2000000000c0 returned -22 [ 163.854054][ T30] audit: type=1400 audit(1758128780.323:580): avc: denied { unlink } for pid=7530 comm="syz.3.361" name="#7" dev="tmpfs" ino=405 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 163.916974][ T878] logitech-djreceiver 0003:046D:C71F.0006: hidraw0: USB HID v0.00 Device [HID 046d:c71f] on usb-dummy_hcd.3-1/input0 [ 163.939736][ T976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 164.002857][ T7553] ptrace attach of "./syz-executor exec"[5843] was attempted by "./syz-executor exec"[7553] [ 164.142239][ T878] usb 4-1: USB disconnect, device number 7 [ 164.218154][ T30] audit: type=1400 audit(1758128780.373:581): avc: denied { remount } for pid=7530 comm="syz.3.361" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 164.824718][ T7552] fido_id[7552]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 165.029574][ T7561] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 165.037873][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 165.051038][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 165.296682][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 165.653879][ T5928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 166.096524][ T7578] netlink: 76 bytes leftover after parsing attributes in process `syz.1.371'. [ 166.493368][ T24] pwc: recv_control_msg error -71 req 02 val 2b00 [ 166.510869][ T24] pwc: recv_control_msg error -71 req 02 val 2700 [ 166.526681][ T24] pwc: recv_control_msg error -71 req 02 val 2c00 [ 166.626060][ T7583] random: crng reseeded on system resumption [ 166.724370][ T24] pwc: recv_control_msg error -71 req 04 val 1000 [ 166.760308][ T24] pwc: recv_control_msg error -71 req 04 val 1300 [ 166.774763][ T24] pwc: recv_control_msg error -71 req 04 val 1400 [ 166.789831][ T24] pwc: recv_control_msg error -71 req 02 val 2000 [ 166.834878][ T24] pwc: recv_control_msg error -71 req 02 val 2100 [ 166.941303][ T24] pwc: recv_control_msg error -71 req 04 val 1500 [ 166.968953][ T24] pwc: recv_control_msg error -71 req 02 val 2500 [ 167.009886][ T24] pwc: recv_control_msg error -71 req 02 val 2400 [ 167.091940][ T30] audit: type=1400 audit(1758128783.563:582): avc: denied { setopt } for pid=7584 comm="syz.1.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 167.092244][ T24] pwc: recv_control_msg error -71 req 02 val 2600 [ 167.155473][ T24] pwc: recv_control_msg error -71 req 02 val 2900 [ 167.172691][ T24] pwc: recv_control_msg error -71 req 02 val 2800 [ 167.199643][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 167.216949][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 167.255647][ T24] pwc: Registered as video103. [ 167.269886][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input8 [ 167.298486][ T24] usb 1-1: USB disconnect, device number 13 [ 167.779789][ T24] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 168.013351][ T24] usb 1-1: config 0 has an invalid descriptor of length 53, skipping remainder of the config [ 168.037520][ T24] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 168.185491][ T24] usb 1-1: New USB device found, idVendor=0925, idProduct=0005, bcdDevice= 0.00 [ 168.227571][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.249997][ T24] usb 1-1: config 0 descriptor?? [ 169.149213][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 169.158783][ T7626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 169.159073][ T7626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 169.578934][ T30] audit: type=1400 audit(1758128786.103:583): avc: denied { read } for pid=7632 comm="syz.4.386" path="socket:[14323]" dev="sockfs" ino=14323 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 169.790135][ T7639] netlink: 8 bytes leftover after parsing attributes in process `syz.3.387'. [ 169.799023][ T7639] netlink: 4 bytes leftover after parsing attributes in process `syz.3.387'. [ 170.433204][ T7647] 9pnet_fd: Insufficient options for proto=fd [ 170.445178][ T7647] fuse: Bad value for 'user_id' [ 170.450107][ T7647] fuse: Bad value for 'user_id' [ 170.552020][ T30] audit: type=1400 audit(1758128786.943:584): avc: denied { read } for pid=7644 comm="syz.3.389" name="event1" dev="devtmpfs" ino=919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 170.723570][ T30] audit: type=1400 audit(1758128786.953:585): avc: denied { write } for pid=7644 comm="syz.3.389" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 170.747689][ T30] audit: type=1400 audit(1758128786.953:586): avc: denied { open } for pid=7644 comm="syz.3.389" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 170.747736][ T5928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 170.784146][ T30] audit: type=1400 audit(1758128786.963:587): avc: denied { mounton } for pid=7644 comm="syz.3.389" path="/syzcgroup/net/syz3/cgroup.procs" dev="cgroup" ino=183 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 170.848902][ T878] usb 1-1: USB disconnect, device number 14 [ 170.920606][ T7654] Driver unsupported XDP return value 0 on prog (id 114) dev N/A, expect packet loss! [ 171.105130][ T30] audit: type=1400 audit(1758128787.623:588): avc: denied { write } for pid=7660 comm="syz.3.394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 171.380181][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 171.608318][ T5928] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 173.017662][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 173.169612][ T5928] usb 4-1: device descriptor read/64, error -71 [ 173.619995][ T5928] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 174.277339][ T7671] Set syz1 is full, maxelem 65536 reached [ 174.895861][ T30] audit: type=1400 audit(1758128791.213:589): avc: denied { relabelfrom } for pid=7676 comm="syz.0.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 175.042229][ T7688] netlink: 'syz.3.399': attribute type 21 has an invalid length. [ 175.050498][ T7688] netlink: 128 bytes leftover after parsing attributes in process `syz.3.399'. [ 175.063735][ T7688] netlink: 'syz.3.399': attribute type 4 has an invalid length. [ 175.077690][ T30] audit: type=1400 audit(1758128791.213:590): avc: denied { relabelto } for pid=7676 comm="syz.0.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 175.105416][ T7688] netlink: 3 bytes leftover after parsing attributes in process `syz.3.399'. [ 175.179874][ T30] audit: type=1400 audit(1758128791.703:591): avc: denied { create } for pid=7691 comm="syz.1.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 175.208861][ T7690] batadv1: entered promiscuous mode [ 175.216777][ T7690] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 175.662072][ T7699] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 175.890276][ T7705] fuse: Unknown parameter 'fN~ky4f?jV'5le!ONEgT>0ig>[c$4O5^$ק' [ 175.911773][ T7712] fuse: Unknown parameter 'fN~ky4f?jV'5le!ONEgT>0ig>[c$4O5^$ק' [ 175.932112][ T7699] netlink: 36 bytes leftover after parsing attributes in process `syz.1.402'. [ 176.401826][ T976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 176.463651][ T7714] netlink: 28 bytes leftover after parsing attributes in process `syz.2.406'. [ 176.484704][ T30] audit: type=1400 audit(1758128793.013:592): avc: denied { write } for pid=7706 comm="syz.2.406" path="socket:[14952]" dev="sockfs" ino=14952 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 176.685358][ T7724] SELinux: Context system_u:object is not valid (left unmapped). [ 176.696286][ T30] audit: type=1400 audit(1758128793.223:593): avc: denied { relabelto } for pid=7723 comm="syz.0.411" name="cgroup.procs" dev="cgroup" ino=62 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object" [ 176.939090][ T30] audit: type=1400 audit(1758128793.253:594): avc: denied { associate } for pid=7723 comm="syz.0.411" name="cgroup.procs" dev="cgroup" ino=62 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 srawcon="system_u:object" [ 177.037171][ T7729] tmpfs: Bad value for 'mpol' [ 177.100118][ T30] audit: type=1400 audit(1758128793.263:595): avc: denied { write } for pid=7723 comm="syz.0.411" name="sg0" dev="devtmpfs" ino=773 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 177.828668][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 177.907956][ T7753] netlink: 32 bytes leftover after parsing attributes in process `syz.3.415'. [ 178.319966][ T5920] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 178.347903][ T30] audit: type=1400 audit(1758128794.873:596): avc: denied { ioctl } for pid=7744 comm="syz.3.415" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64c8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 178.469698][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 178.486994][ T5920] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.506163][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 178.528426][ T5920] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 178.555806][ T5920] usb 3-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice=50.0d [ 178.566668][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.638140][ T5920] usb 3-1: Product: syz [ 178.644751][ T5920] usb 3-1: Manufacturer: syz [ 178.649359][ T5920] usb 3-1: SerialNumber: syz [ 178.658091][ T5920] usb 3-1: config 0 descriptor?? [ 178.676412][ T5920] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 178.701969][ T5920] gspca_stv06xx: st6422 sensor detected [ 179.028956][ T7776] batadv1: left promiscuous mode [ 179.337960][ T5920] STV06xx 3-1:0.0: probe with driver STV06xx failed with error -71 [ 179.361164][ T5920] usb 3-1: USB disconnect, device number 13 [ 179.461194][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 179.700275][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 180.167259][ T7803] netlink: 8 bytes leftover after parsing attributes in process `syz.0.434'. [ 180.379629][ T5920] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 180.532526][ T30] audit: type=1400 audit(1758128797.063:597): avc: denied { nlmsg_read } for pid=7793 comm="syz.4.432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 180.553064][ T5920] usb 3-1: Using ep0 maxpacket: 16 [ 180.562647][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.597881][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.719699][ T5920] usb 3-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 180.739685][ T5920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.779654][ T976] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 180.850940][ T5920] usb 3-1: config 0 descriptor?? [ 180.953090][ T976] usb 1-1: Using ep0 maxpacket: 8 [ 180.970556][ T976] usb 1-1: config 0 has an invalid interface number: 96 but max is 0 [ 180.978759][ T976] usb 1-1: config 0 has no interface number 0 [ 180.990461][ T976] usb 1-1: config 0 interface 96 altsetting 3 endpoint 0x88 has an invalid bInterval 254, changing to 11 [ 181.001895][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 181.121234][ T976] usb 1-1: config 0 interface 96 has no altsetting 0 [ 181.147592][ T976] usb 1-1: New USB device found, idVendor=0b57, idProduct=2a8d, bcdDevice=33.74 [ 181.171769][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.199787][ T976] usb 1-1: Product: syz [ 181.212033][ T976] usb 1-1: Manufacturer: syz [ 181.241764][ T976] usb 1-1: SerialNumber: syz [ 181.273396][ T976] usb 1-1: config 0 descriptor?? [ 181.368368][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.427369][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.468816][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.495120][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.516115][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.537173][ T5920] ntrig 0003:1B96:0008.0007: unknown main item tag 0x0 [ 181.566317][ T7788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.580527][ T5928] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 181.601092][ T7788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.662751][ T5920] ntrig 0003:1B96:0008.0007: item fetching failed at offset 6/7 [ 181.684643][ T976] usb 1-1: USB disconnect, device number 15 [ 181.738659][ T5920] ntrig 0003:1B96:0008.0007: parse failed [ 181.740794][ T5928] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 181.751258][ T5920] ntrig 0003:1B96:0008.0007: probe with driver ntrig failed with error -22 [ 181.760144][ T5928] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.782111][ T5920] usb 3-1: USB disconnect, device number 14 [ 181.811085][ T5928] usb 4-1: config 0 descriptor?? [ 182.222484][ T5928] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 182.236735][ T5928] [drm:udl_init] *ERROR* Selecting channel failed [ 182.283274][ T5928] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 182.294213][ T5928] [drm] Initialized udl on minor 2 [ 182.304119][ T5928] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 182.351544][ T5928] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 182.405702][ T878] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 182.555418][ T5920] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 182.575256][ T5928] usb 4-1: USB disconnect, device number 10 [ 182.585938][ T878] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 182.763193][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 182.787881][ T5920] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 182.808034][ T5920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 182.883420][ T5920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 182.935097][ T5920] usb 1-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 182.949434][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.963395][ T5920] usb 1-1: Product: syz [ 182.984137][ T5920] usb 1-1: Manufacturer: syz [ 183.009295][ T5920] usb 1-1: SerialNumber: syz [ 183.043722][ T5913] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 183.066454][ T5920] usb 1-1: config 0 descriptor?? [ 183.081077][ T5920] iguanair 1-1:0.0: probe with driver iguanair failed with error -12 [ 183.409779][ T5913] usb 3-1: Using ep0 maxpacket: 32 [ 183.417132][ T5913] usb 3-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 183.426320][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.435588][ T5913] usb 3-1: config 0 descriptor?? [ 183.464190][ T5913] gspca_main: sq930x-2.14.0 probing 041e:403c [ 183.497261][ T7842] netlink: 188 bytes leftover after parsing attributes in process `syz.3.447'. [ 183.542177][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 183.684745][ T7817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.439'. [ 183.698105][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.698196][ T7817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.439'. [ 183.709124][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.727180][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.736343][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 183.750793][ T878] usb 1-1: USB disconnect, device number 16 [ 184.012292][ T7862] usb usb8: usbfs: process 7862 (syz.0.451) did not claim interface 0 before use [ 184.188340][ T5913] gspca_sq930x: reg_w 0305 fd00 failed -71 [ 184.194610][ T5913] sq930x 3-1:0.0: probe with driver sq930x failed with error -71 [ 184.209724][ T5913] usb 3-1: USB disconnect, device number 15 [ 185.164088][ T30] audit: type=1400 audit(1758128801.683:598): avc: denied { override_creds } for pid=7871 comm="syz.2.454" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 185.487573][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 185.628138][ T7889] netlink: 4 bytes leftover after parsing attributes in process `syz.3.457'. [ 185.700739][ T50] Bluetooth: hci5: sending frame failed (-49) [ 185.707832][ T5863] Bluetooth: hci5: Opcode 0x1003 failed: -49 [ 185.787879][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 185.979706][ T30] audit: type=1400 audit(1758128802.503:599): avc: denied { create } for pid=7893 comm="syz.1.461" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 186.007280][ T7894] (syz.1.461,7894,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 186.096007][ T7894] (syz.1.461,7894,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 186.199632][ T30] audit: type=1400 audit(1758128802.533:600): avc: denied { append } for pid=7893 comm="syz.1.461" name="file0" dev="tmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 186.392418][ T7909] syz_tun: entered allmulticast mode [ 186.437509][ T30] audit: type=1400 audit(1758128802.533:601): avc: denied { open } for pid=7893 comm="syz.1.461" path="/70/file0" dev="tmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 186.486679][ T7909] netlink: 4 bytes leftover after parsing attributes in process `syz.0.464'. [ 186.639232][ T7912] netlink: 12 bytes leftover after parsing attributes in process `syz.1.463'. [ 186.758648][ T30] audit: type=1400 audit(1758128803.153:602): avc: denied { setopt } for pid=7904 comm="syz.1.463" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 186.855594][ T7909] syz_tun (unregistering): left allmulticast mode [ 188.384295][ T7929] netlink: 8 bytes leftover after parsing attributes in process `syz.0.468'. [ 188.399658][ T7929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.468'. [ 188.819933][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 188.870260][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 188.878929][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 189.020768][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 189.430264][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 190.415040][ T7960] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 190.444236][ T1127] Bluetooth: hci5: Frame reassembly failed (-84) [ 190.447063][ T30] audit: type=1400 audit(1758128806.953:603): avc: denied { connect } for pid=7952 comm="syz.0.474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 190.543492][ T30] audit: type=1400 audit(1758128806.953:604): avc: denied { bind } for pid=7952 comm="syz.0.474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 190.588250][ T7961] netlink: 'syz.3.475': attribute type 10 has an invalid length. [ 190.797084][ T7961] batman_adv: batadv0: Adding interface: team0 [ 190.799732][ T30] audit: type=1400 audit(1758128807.113:605): avc: denied { ioctl } for pid=7957 comm="syz.3.475" path="socket:[16470]" dev="sockfs" ino=16470 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 190.849724][ T7961] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 190.878186][ T7961] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 191.050705][ T7965] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 191.057347][ T7965] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 191.110946][ T7965] vhci_hcd vhci_hcd.0: Device attached [ 191.192206][ T7967] vhci_hcd: connection closed [ 191.193450][ T1127] vhci_hcd: stop threads [ 191.203057][ T1127] vhci_hcd: release socket [ 191.225869][ T1127] vhci_hcd: disconnect device [ 191.468854][ T7974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.477917][ T7974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.539736][ T5920] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 191.686016][ T30] audit: type=1400 audit(1758128808.213:606): avc: denied { read write } for pid=5860 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 191.691267][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 191.730942][ T30] audit: type=1400 audit(1758128808.213:607): avc: denied { open } for pid=5860 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 191.755276][ T5920] usb 4-1: New USB device found, idVendor=05ac, idProduct=027b, bcdDevice= 0.00 [ 191.764350][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.803118][ T30] audit: type=1400 audit(1758128808.213:608): avc: denied { ioctl } for pid=5860 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 191.812997][ T5920] usb 4-1: config 0 descriptor?? [ 191.842696][ T30] audit: type=1400 audit(1758128808.223:609): avc: denied { ioctl } for pid=7971 comm="syz.3.477" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 191.878704][ T30] audit: type=1400 audit(1758128808.403:610): avc: denied { map_create } for pid=7981 comm="syz.2.481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 191.893807][ T7983] netlink: 28 bytes leftover after parsing attributes in process `syz.1.480'. [ 191.913357][ T30] audit: type=1400 audit(1758128808.443:611): avc: denied { execmem } for pid=7981 comm="syz.2.481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 191.937208][ T30] audit: type=1400 audit(1758128808.473:612): avc: denied { create } for pid=7980 comm="syz.1.480" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 192.010417][ T30] audit: type=1400 audit(1758128808.493:613): avc: denied { connect } for pid=7980 comm="syz.1.480" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 192.034110][ T30] audit: type=1400 audit(1758128808.493:614): avc: denied { create } for pid=7980 comm="syz.1.480" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 192.034266][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 192.065132][ T30] audit: type=1400 audit(1758128808.593:615): avc: denied { connect } for pid=7980 comm="syz.1.480" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 192.579718][ T50] Bluetooth: hci5: command 0x1003 tx timeout [ 192.590529][ T5863] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 192.611329][ T878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 192.621374][ T1127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 192.997979][ T5920] apple 0003:05AC:027B.0008: hidraw0: USB HID v0.00 Device [HID 05ac:027b] on usb-dummy_hcd.3-1/input0 [ 193.114524][ T7972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.159867][ T7972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.182861][ T24] usb 4-1: USB disconnect, device number 11 [ 193.786263][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.802140][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.808479][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.815691][ T5928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.912162][ T1151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 194.872526][ T8025] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 194.882013][ T8025] (syz.3.491,8025,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 194.889497][ T8025] (syz.3.491,8025,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 194.896756][ T8025] (syz.3.491,8025,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 194.905292][ T8025] (syz.3.491,8025,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 194.929496][ T8025] netlink: 16 bytes leftover after parsing attributes in process `syz.3.491'. [ 195.650531][ T8029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.492'. [ 196.210209][ T8048] vivid-002: disconnect [ 196.290766][ T8041] vivid-002: reconnect [ 196.949320][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 196.961963][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 196.961976][ T30] audit: type=1400 audit(1758128813.493:681): avc: denied { mounton } for pid=8057 comm="syz.4.501" path="/111/file0" dev="tmpfs" ino=605 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 196.969734][ T8058] fuse: Bad value for 'fd' [ 197.048352][ T878] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 197.285744][ T8060] ceph: No mds server is up or the cluster is laggy [ 197.353379][ T30] audit: type=1400 audit(1758128813.883:682): avc: denied { read } for pid=8062 comm="syz.0.502" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 197.510971][ T878] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 197.581762][ T30] audit: type=1400 audit(1758128813.883:683): avc: denied { open } for pid=8062 comm="syz.0.502" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 197.657353][ T8074] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 197.666715][ T8074] (syz.1.504,8074,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 197.674198][ T8074] (syz.1.504,8074,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 197.681428][ T8074] (syz.1.504,8074,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 197.689941][ T8074] (syz.1.504,8074,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 197.701082][ T8074] netlink: 16 bytes leftover after parsing attributes in process `syz.1.504'. [ 197.712152][ T878] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.069695][ T878] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 198.079795][ T878] usb 4-1: config 1 has no interface number 0 [ 198.085937][ T30] audit: type=1400 audit(1758128813.893:684): avc: denied { ioctl } for pid=8062 comm="syz.0.502" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d08 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 198.113913][ T30] audit: type=1400 audit(1758128813.893:685): avc: denied { read } for pid=8062 comm="syz.0.502" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 198.124596][ T878] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 198.197741][ T30] audit: type=1326 audit(1758128814.723:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8075 comm="syz.2.505" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fce0fb8eba9 code=0x0 [ 198.205937][ T878] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 198.259961][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 198.271005][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 198.279084][ T878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.351976][ T878] usb 4-1: Product: syz [ 198.356117][ T878] usb 4-1: Manufacturer: syz [ 198.370474][ T878] usb 4-1: SerialNumber: syz [ 198.390681][ T878] cdc_wdm 4-1:1.128: skipping garbage [ 198.397674][ T878] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 198.445245][ T30] audit: type=1400 audit(1758128814.973:687): avc: denied { setopt } for pid=8077 comm="syz.1.507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 198.466229][ T8080] overlayfs: failed to clone upperpath [ 198.477482][ T30] audit: type=1400 audit(1758128814.993:688): avc: denied { mounton } for pid=8079 comm="syz.4.506" path="/112/file0" dev="tmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 198.609714][ T878] usb 4-1: USB disconnect, device number 12 [ 198.694369][ T30] audit: type=1400 audit(1758128815.223:689): avc: denied { create } for pid=8084 comm="syz.0.508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 198.713901][ T30] audit: type=1400 audit(1758128815.223:690): avc: denied { sqpoll } for pid=8084 comm="syz.0.508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 198.920798][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 198.979902][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 199.429158][ T8099] netlink: 68 bytes leftover after parsing attributes in process `syz.3.512'. [ 200.061011][ T5905] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 200.089973][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 200.593238][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.604197][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.628628][ T5905] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 200.641910][ T5905] usb 3-1: New USB device found, idVendor=0079, idProduct=0011, bcdDevice= 0.00 [ 200.651217][ T5905] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.667377][ T5905] usb 3-1: config 0 descriptor?? [ 201.024951][ T5905] usbhid 3-1:0.0: can't add hid device: -22 [ 201.046267][ T5905] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 201.673068][ T8123] FAULT_INJECTION: forcing a failure. [ 201.673068][ T8123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.686228][ T8123] CPU: 0 UID: 0 PID: 8123 Comm: syz.3.516 Not tainted syzkaller #0 PREEMPT(full) [ 201.686250][ T8123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 201.686260][ T8123] Call Trace: [ 201.686266][ T8123] [ 201.686273][ T8123] dump_stack_lvl+0x16c/0x1f0 [ 201.686301][ T8123] should_fail_ex+0x512/0x640 [ 201.686328][ T8123] _copy_from_user+0x2e/0xd0 [ 201.686355][ T8123] copy_msghdr_from_user+0x98/0x160 [ 201.686377][ T8123] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 201.686412][ T8123] ___sys_sendmsg+0xfe/0x1d0 [ 201.686435][ T8123] ? __pfx____sys_sendmsg+0x10/0x10 [ 201.686488][ T8123] __sys_sendmsg+0x16d/0x220 [ 201.686510][ T8123] ? __pfx___sys_sendmsg+0x10/0x10 [ 201.686549][ T8123] do_syscall_64+0xcd/0x4e0 [ 201.686580][ T8123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.686598][ T8123] RIP: 0033:0x7fe1f8b8eba9 [ 201.686613][ T8123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.686630][ T8123] RSP: 002b:00007fe1f9a5e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.686649][ T8123] RAX: ffffffffffffffda RBX: 00007fe1f8dd6180 RCX: 00007fe1f8b8eba9 [ 201.686661][ T8123] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 201.686672][ T8123] RBP: 00007fe1f9a5e090 R08: 0000000000000000 R09: 0000000000000000 [ 201.686683][ T8123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.686693][ T8123] R13: 00007fe1f8dd6218 R14: 00007fe1f8dd6180 R15: 00007ffdeeed9488 [ 201.686718][ T8123] [ 202.084275][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 202.084285][ T30] audit: type=1400 audit(1758128818.613:704): avc: denied { read } for pid=8124 comm="syz.1.517" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 202.138260][ T8131] bridge1: left promiscuous mode [ 202.174846][ T30] audit: type=1400 audit(1758128818.653:705): avc: denied { open } for pid=8124 comm="syz.1.517" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 202.241350][ T30] audit: type=1326 audit(1758128818.773:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8134 comm="syz.1.520" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f08a558eba9 code=0x0 [ 202.267533][ T24] usb 3-1: USB disconnect, device number 16 [ 203.139624][ T30] audit: type=1400 audit(1758128819.663:707): avc: denied { bind } for pid=8143 comm="syz.4.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 203.140140][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 203.199583][ T30] audit: type=1400 audit(1758128819.663:708): avc: denied { listen } for pid=8143 comm="syz.4.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 203.219340][ T30] audit: type=1400 audit(1758128819.663:709): avc: denied { connect } for pid=8143 comm="syz.4.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 203.239184][ T30] audit: type=1400 audit(1758128819.703:710): avc: denied { write } for pid=8143 comm="syz.4.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 203.258862][ T30] audit: type=1400 audit(1758128819.703:711): avc: denied { setopt } for pid=8143 comm="syz.4.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 204.033575][ T24] usb 3-1: new low-speed USB device number 17 using dummy_hcd [ 204.040875][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 204.152321][ T8160] IPv6: Can't replace route, no match found [ 204.163821][ T30] audit: type=1400 audit(1758128820.543:712): avc: denied { ioctl } for pid=8146 comm="syz.3.524" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16844 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 204.194359][ T30] audit: type=1400 audit(1758128820.603:713): avc: denied { ioctl } for pid=8146 comm="syz.3.524" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 204.415957][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034063c00: rx timeout, send abort [ 204.510058][ T24] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 204.518369][ T24] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 204.528145][ T24] usb 3-1: config 0 has no interface number 0 [ 204.535786][ T24] usb 3-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 204.551628][ T24] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 204.567593][ T24] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 204.578784][ T24] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 204.591080][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.675526][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 204.696195][ T24] usb 3-1: config 0 descriptor?? [ 204.710125][ T8145] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 204.916307][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805acab800: rx timeout, send abort [ 204.924669][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034063c00: abort rx timeout. Force session deactivation [ 205.424532][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805acab800: abort rx timeout. Force session deactivation [ 205.758982][ T24] input: USB Keyspan Remote 06cd:0202 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.21/input/input13 [ 206.047994][ T1127] Bluetooth: Error in BCSP hdr checksum [ 206.096629][ T8192] syz.4.537 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 206.198899][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 207.840569][ T50] Bluetooth: hci5: command 0x1003 tx timeout [ 207.847334][ T5863] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 208.038854][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 208.038868][ T30] audit: type=1400 audit(1758128824.553:741): avc: denied { setopt } for pid=8216 comm="syz.1.543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 208.523837][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 208.551117][ T5905] usb 3-1: USB disconnect, device number 17 [ 208.557041][ C1] keyspan_remote 3-1:0.21: keyspan_irq_recv - usb_submit_urb failed with result: -19 [ 208.701041][ T30] audit: type=1400 audit(1758128825.213:742): avc: denied { append } for pid=8227 comm="syz.0.545" name="ubi_ctrl" dev="devtmpfs" ino=706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 208.977595][ T8232] ubi31: attaching mtd0 [ 209.005055][ T30] audit: type=1400 audit(1758128825.533:743): avc: denied { getopt } for pid=8230 comm="syz.2.546" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 209.043719][ T8231] sock: sock_set_timeout: `syz.2.546' (pid 8231) tries to set negative timeout [ 209.220736][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 209.450058][ T8240] netlink: 148 bytes leftover after parsing attributes in process `syz.3.548'. [ 209.459836][ T8240] netlink: 56 bytes leftover after parsing attributes in process `syz.3.548'. [ 209.468880][ T8240] netlink: 32 bytes leftover after parsing attributes in process `syz.3.548'. [ 209.882054][ T30] audit: type=1400 audit(1758128826.343:744): avc: denied { name_bind } for pid=8236 comm="syz.3.548" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 209.922328][ T1127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 209.939571][ T30] audit: type=1400 audit(1758128826.343:745): avc: denied { ioctl } for pid=8236 comm="syz.3.548" path="socket:[17435]" dev="sockfs" ino=17435 ioctlcmd=0x48d2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 210.432304][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 210.467397][ T30] audit: type=1400 audit(1758128826.983:746): avc: denied { connect } for pid=8247 comm="syz.2.550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 210.515934][ T30] audit: type=1400 audit(1758128827.023:747): avc: denied { read } for pid=8247 comm="syz.2.550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 210.516981][ T6206] tipc: Subscription rejected, illegal request [ 210.535761][ T8250] netlink: 16 bytes leftover after parsing attributes in process `syz.3.551'. [ 210.668621][ T8250] netlink: 24 bytes leftover after parsing attributes in process `syz.3.551'. [ 210.690448][ T8250] netlink: 'syz.3.551': attribute type 10 has an invalid length. [ 210.729959][ T8250] team0: Port device dummy0 added [ 210.735340][ T30] audit: type=1400 audit(1758128827.193:748): avc: denied { bind } for pid=8249 comm="syz.3.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 210.859597][ T30] audit: type=1400 audit(1758128827.223:749): avc: denied { setopt } for pid=8249 comm="syz.3.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 210.891597][ T8258] netlink: 'syz.3.551': attribute type 10 has an invalid length. [ 210.900535][ T8258] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 210.909555][ T30] audit: type=1400 audit(1758128827.263:750): avc: denied { create } for pid=8253 comm="syz.1.552" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 211.181214][ T8258] team0: Failed to send options change via netlink (err -105) [ 211.188936][ T8258] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 211.213389][ T8258] team0: Port device dummy0 removed [ 211.242849][ T8258] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 212.208858][ T8283] ieee802154 phy0 wpan0: encryption failed: -22 [ 212.340787][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 212.418475][ T8292] netlink: 'syz.2.559': attribute type 2 has an invalid length. [ 212.827149][ T8291] bridge_slave_0: left allmulticast mode [ 212.827201][ T8291] bridge_slave_0: left promiscuous mode [ 212.827659][ T8291] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.833882][ T8291] bridge_slave_1: left allmulticast mode [ 212.833902][ T8291] bridge_slave_1: left promiscuous mode [ 212.834437][ T8291] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.845165][ T8291] bond0: (slave bond_slave_0): Releasing backup interface [ 212.861975][ T8291] bond0: (slave bond_slave_1): Releasing backup interface [ 212.920501][ T8291] team0: Port device team_slave_0 removed [ 212.926682][ T8291] team0: Port device team_slave_1 removed [ 212.927711][ T8291] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 212.927732][ T8291] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 212.954192][ T8291] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 212.954204][ T8291] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 212.970749][ T8291] bond1: (slave vlan2): Releasing active interface [ 215.261246][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 215.261262][ T30] audit: type=1400 audit(1758128831.743:764): avc: denied { execute_no_trans } for pid=8298 comm="syz.0.562" path="/121/file1" dev="tmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 215.349941][ T30] audit: type=1400 audit(1758128831.873:765): avc: denied { watch watch_reads } for pid=8311 comm="syz.3.566" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 215.379875][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.472089][ T8321] : entered promiscuous mode [ 215.574710][ T1127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.907858][ T8325] 8021q: adding VLAN 0 to HW filter on device bond2 [ 216.130452][ T1097] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 216.142915][ T8325] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 216.182950][ T1097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 216.262134][ T6206] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 216.263038][ T8332] netlink: 8 bytes leftover after parsing attributes in process `syz.3.570'. [ 216.280760][ T8332] netlink: 4 bytes leftover after parsing attributes in process `syz.3.570'. [ 216.476990][ T8327] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 216.506098][ T8327] bond2: (slave macvlan2): Enslaving as a backup interface with a down link [ 216.727464][ T30] audit: type=1400 audit(1758128833.253:766): avc: denied { bind } for pid=8335 comm="syz.0.573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 216.728444][ T8337] netlink: 'syz.0.573': attribute type 1 has an invalid length. [ 216.756202][ T30] audit: type=1400 audit(1758128833.253:767): avc: denied { write } for pid=8335 comm="syz.0.573" path="socket:[17077]" dev="sockfs" ino=17077 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 216.824700][ T8341] netlink: 56 bytes leftover after parsing attributes in process `syz.3.572'. [ 216.843617][ T8341] fuse: Bad value for 'fd' [ 217.238745][ T8344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.573'. [ 217.248934][ T8337] 8021q: adding VLAN 0 to HW filter on device bond3 [ 217.380277][ T30] audit: type=1400 audit(1758128833.833:768): avc: denied { mount } for pid=8345 comm="syz.1.574" name="/" dev="9p" ino=4412287765254868893 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 217.510739][ T30] audit: type=1400 audit(1758128833.883:769): avc: denied { read write } for pid=8345 comm="syz.1.574" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 217.685386][ T30] audit: type=1400 audit(1758128833.883:770): avc: denied { open } for pid=8345 comm="syz.1.574" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 217.899841][ T30] audit: type=1400 audit(1758128834.423:771): avc: denied { mount } for pid=8345 comm="syz.1.574" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 218.101641][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 218.840206][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 218.852819][ T8344] bond3 (unregistering): Released all slaves [ 218.865082][ T8362] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.577'. [ 218.915354][ T24] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 218.977677][ T30] audit: type=1400 audit(1758128835.483:772): avc: denied { validate_trans } for pid=8361 comm="syz.1.577" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 219.135310][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 219.145064][ T8367] tmpfs: Bad value for 'mpol' [ 219.180463][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 219.194151][ T24] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 219.204580][ T24] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 219.228860][ T8367] netlink: 'syz.0.578': attribute type 1 has an invalid length. [ 219.234230][ T24] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 219.274908][ T8367] netlink: 'syz.0.578': attribute type 1 has an invalid length. [ 219.278046][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 219.317648][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.328097][ T24] usb 4-1: Product: syz [ 219.338789][ T8374] netlink: 36 bytes leftover after parsing attributes in process `syz.4.579'. [ 219.410086][ T24] usb 4-1: Manufacturer: syz [ 219.415544][ T24] usb 4-1: SerialNumber: syz [ 219.824189][ T8334] Set syz1 is full, maxelem 65536 reached [ 219.978309][ T30] audit: type=1400 audit(1758128836.503:773): avc: denied { read } for pid=8381 comm="syz.0.581" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 220.158313][ T8363] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.219873][ T5928] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 220.672219][ T5928] usb 3-1: Using ep0 maxpacket: 16 [ 220.811692][ T5928] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.865016][ T5928] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.899817][ T5928] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 220.912910][ T5928] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 220.923852][ T5928] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.942438][ T5928] usb 3-1: config 0 descriptor?? [ 221.088328][ T8386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.583'. [ 221.097373][ T8386] netlink: 4 bytes leftover after parsing attributes in process `syz.0.583'. [ 221.309988][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.362707][ T8380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.409910][ T8380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.429565][ T8380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.444950][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 221.444962][ T30] audit: type=1400 audit(1758128837.973:776): avc: denied { name_connect } for pid=8388 comm="syz.4.584" dest=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 221.478471][ T8380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.635605][ T24] cdc_ncm 4-1:1.0: bind() failure [ 221.644279][ T8391] netlink: 24 bytes leftover after parsing attributes in process `syz.4.584'. [ 221.698038][ T24] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 221.737445][ T24] cdc_ncm 4-1:1.1: bind() failure [ 221.741991][ T8380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.755270][ T30] audit: type=1400 audit(1758128838.023:777): avc: denied { listen } for pid=8388 comm="syz.4.584" lport=40731 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 221.786952][ T24] usb 4-1: USB disconnect, device number 13 [ 221.842108][ T8380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.856087][ T8380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.859678][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.866448][ T8380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.883505][ T8380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.892416][ T30] audit: type=1400 audit(1758128838.023:778): avc: denied { accept } for pid=8388 comm="syz.4.584" lport=40731 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 221.911995][ T8380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.010438][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 222.035855][ T30] audit: type=1400 audit(1758128838.563:779): avc: denied { bind } for pid=8379 comm="syz.2.582" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 222.521312][ T30] audit: type=1400 audit(1758128839.054:780): avc: denied { listen } for pid=8407 comm="syz.2.587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 222.552576][ T30] audit: type=1400 audit(1758128839.054:781): avc: denied { accept } for pid=8407 comm="syz.2.587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 222.679873][ T5928] usbhid 3-1:0.0: can't add hid device: -71 [ 222.802126][ T8416] netlink: 51 bytes leftover after parsing attributes in process `syz.4.589'. [ 222.890658][ T5928] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 222.962525][ T5928] usb 3-1: USB disconnect, device number 18 [ 223.163663][ T30] audit: type=1400 audit(1758128839.684:782): avc: denied { ioctl } for pid=8419 comm="syz.1.590" path="socket:[17239]" dev="sockfs" ino=17239 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 224.238859][ T30] audit: type=1400 audit(1758128840.764:783): avc: denied { bind } for pid=8419 comm="syz.1.590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 224.510002][ T5965] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 224.659909][ T5965] usb 4-1: Using ep0 maxpacket: 32 [ 224.722053][ T5965] usb 4-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 224.735769][ T5965] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.856805][ T5965] usb 4-1: config 0 descriptor?? [ 224.877562][ T5965] gspca_main: sq930x-2.14.0 probing 041e:403c [ 224.928726][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 224.945859][ T8441] netlink: 8 bytes leftover after parsing attributes in process `syz.4.596'. [ 224.954673][ T8441] netlink: 4 bytes leftover after parsing attributes in process `syz.4.596'. [ 225.229198][ T30] audit: type=1400 audit(1758128841.724:784): avc: denied { cmd } for pid=8443 comm="syz.4.598" path="socket:[17872]" dev="sockfs" ino=17872 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 225.726520][ T5965] gspca_sq930x: ucbus_write failed -110 [ 225.732158][ T5965] sq930x 4-1:0.0: probe with driver sq930x failed with error -110 [ 225.757185][ T24] usb 4-1: USB disconnect, device number 14 [ 225.837191][ T8450] PID 8450 killed due to inadequate hugepage pool [ 226.070550][ T8461] netlink: 20 bytes leftover after parsing attributes in process `syz.2.600'. [ 226.115154][ T30] audit: type=1400 audit(1758128842.614:785): avc: denied { connect } for pid=8457 comm="syz.2.600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 227.138250][ T6206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.425103][ T24] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 227.705798][ T54] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.903231][ T5965] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.948528][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.968471][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 227.980930][ T24] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 228.013475][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.085914][ T24] usb 4-1: config 0 descriptor?? [ 228.101692][ T24] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 228.301291][ T8469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.380480][ T8469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.416779][ T8490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.608'. [ 228.425882][ T8490] netlink: 4 bytes leftover after parsing attributes in process `syz.4.608'. [ 228.486708][ T8494] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 228.503854][ T30] audit: type=1400 audit(1758128845.014:786): avc: denied { name_bind } for pid=8487 comm="syz.1.609" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 228.642305][ T30] audit: type=1400 audit(1758128845.014:787): avc: denied { node_bind } for pid=8487 comm="syz.1.609" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 229.073343][ T24] gspca_nw80x: reg_r err -110 [ 229.088000][ T24] nw80x 4-1:0.0: probe with driver nw80x failed with error -110 [ 229.123079][ T8494] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 229.345962][ T30] audit: type=1400 audit(1758128845.874:788): avc: denied { create } for pid=8487 comm="syz.1.609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 229.443158][ T8502] netlink: 'syz.1.609': attribute type 10 has an invalid length. [ 229.466541][ T30] audit: type=1400 audit(1758128845.914:789): avc: denied { create } for pid=8512 comm="syz.2.614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 229.487646][ T8494] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 229.500488][ T30] audit: type=1400 audit(1758128845.974:790): avc: denied { create } for pid=8467 comm="syz.3.602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 229.534077][ T30] audit: type=1400 audit(1758128846.054:791): avc: denied { bind } for pid=8467 comm="syz.3.602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 229.591063][ T8502] batman_adv: batadv0: Adding interface: team0 [ 229.597270][ T8502] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.598716][ T8494] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 230.069055][ T8502] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 230.092496][ T8508] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 230.102071][ T8508] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 230.368482][ T8511] page: refcount:515 mapcount:0 mapping:ffff88805406aaa0 index:0x0 pfn:0x4c600 [ 230.377741][ T8511] head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0 [ 230.386239][ T8511] aops:hugetlbfs_aops ino:43eb dentry name(?):"anon_hugepage" [ 230.393696][ T8511] flags: 0xfff00000000041(locked|head|node=0|zone=1|lastcpupid=0x7ff) [ 230.401843][ T8511] page_type: f4(hugetlb) [ 230.406080][ T8511] raw: 00fff00000000041 ffffc9001be57d68 ffffc9001be57d68 ffff88805406aaa0 [ 230.414658][ T8511] raw: 0000000000000000 0000000000000000 00000203f4000000 0000000000000000 [ 230.423239][ T8511] head: 00fff00000000041 ffffc9001be57d68 ffffc9001be57d68 ffff88805406aaa0 [ 230.431907][ T8511] head: 0000000000000000 0000000000000000 00000203f4000000 0000000000000000 [ 230.440577][ T8511] head: 00fff00000000009 ffffea0001318001 0000000000000000 0000000000000000 [ 230.449245][ T8511] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000200 [ 230.457901][ T8511] page dumped because: VM_BUG_ON_FOLIO(folio_mapped(folio)) [ 230.465171][ T8511] page_owner tracks the page as allocated [ 230.471176][ T8511] page last allocated via order 9, migratetype Movable, gfp_mask 0x146cca(GFP_HIGHUSER_MOVABLE|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 8437, tgid 8419 (syz.1.590), ts 225022266691, free_ts 214999283261 [ 230.491664][ T8511] post_alloc_hook+0x1c0/0x230 [ 230.496441][ T8511] get_page_from_freelist+0x132b/0x38e0 [ 230.501981][ T8511] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 230.507869][ T8511] alloc_surplus_hugetlb_folio+0x1ad/0x4a0 [ 230.513678][ T8511] hugetlb_acct_memory.part.0+0x3cd/0xd10 [ 230.519401][ T8511] hugetlb_reserve_pages+0xa69/0xf40 [ 230.524687][ T8511] hugetlbfs_file_mmap+0x4a1/0x730 [ 230.529794][ T8511] __mmap_region+0x1314/0x27b0 [ 230.534552][ T8511] mmap_region+0x1ab/0x3f0 [ 230.538962][ T8511] do_mmap+0xa3e/0x1210 [ 230.543116][ T8511] vm_mmap_pgoff+0x29e/0x470 [ 230.547704][ T8511] ksys_mmap_pgoff+0x1c8/0x5c0 [ 230.552467][ T8511] __x64_sys_mmap+0x125/0x190 [ 230.557137][ T8511] do_syscall_64+0xcd/0x4e0 [ 230.561638][ T8511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.567523][ T8511] page last free pid 8282 tgid 8279 stack trace: [ 230.573836][ T8511] __free_frozen_pages+0x7d5/0x10f0 [ 230.579034][ T8511] __folio_put+0x329/0x450 [ 230.583444][ T8511] hugetlb_free_folio+0xfc/0x140 [ 230.588377][ T8511] __update_and_free_hugetlb_folio+0x1e3/0x420 [ 230.594524][ T8511] update_and_free_hugetlb_folio+0xce/0x210 [ 230.600411][ T8511] free_huge_folio+0x85b/0x1050 [ 230.605256][ T8511] folios_put_refs+0x4e7/0x740 [ 230.610013][ T8511] remove_inode_hugepages+0xbef/0xed0 [ 230.615384][ T8511] hugetlbfs_evict_inode+0x90/0x250 [ 230.620573][ T8511] evict+0x3e6/0x920 [ 230.624467][ T8511] iput+0x521/0x880 [ 230.628275][ T8511] dentry_unlink_inode+0x29c/0x480 [ 230.633384][ T8511] __dentry_kill+0x1d0/0x600 [ 230.637970][ T8511] dput.part.0+0x4b1/0x9b0 [ 230.642383][ T8511] dput+0x1f/0x30 [ 230.646015][ T8511] __fput+0x51c/0xb70 [ 230.650101][ T8511] ------------[ cut here ]------------ [ 230.655540][ T8511] kernel BUG at mm/filemap.c:154! [ 230.660556][ T8511] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 230.666959][ T8511] CPU: 1 UID: 0 PID: 8511 Comm: syz.0.613 Not tainted syzkaller #0 PREEMPT(full) [ 230.676140][ T8511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 230.686183][ T8511] RIP: 0010:filemap_unaccount_folio+0xef/0x8c0 [ 230.692326][ T8511] Code: 07 20 c9 ff 89 ee 31 ff 4c 8d 6b 30 e8 3a 1b c9 ff 85 ed 7e 17 e8 f1 1f c9 ff 48 c7 c6 c0 1f b9 8b 48 89 df e8 c2 cf 11 00 90 <0f> 0b e8 da 1f c9 ff 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 230.711915][ T8511] RSP: 0018:ffffc9001c077310 EFLAGS: 00010046 [ 230.717955][ T8511] RAX: 0000000000080000 RBX: ffffea0001318000 RCX: ffffc90004f02000 [ 230.725897][ T8511] RDX: 0000000000080000 RSI: ffffffff81f27d5e RDI: ffff88802d8d0444 [ 230.733842][ T8511] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 230.741786][ T8511] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88805406aaa0 [ 230.749731][ T8511] R13: ffffea0001318030 R14: 00000000000007e0 R15: ffffea0001318000 [ 230.757689][ T8511] FS: 00007f34dfebc6c0(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000 [ 230.766602][ T8511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 230.773167][ T8511] CR2: 000020000016e030 CR3: 0000000033812000 CR4: 00000000003526f0 [ 230.781120][ T8511] Call Trace: [ 230.784379][ T8511] [ 230.787290][ T8511] filemap_remove_folio+0xf1/0x250 [ 230.792388][ T8511] remove_inode_hugepages+0x74a/0xed0 [ 230.797744][ T8511] ? __schedule+0x11a3/0x5de0 [ 230.802406][ T8511] ? mark_held_locks+0x49/0x80 [ 230.807161][ T8511] ? __pfx_remove_inode_hugepages+0x10/0x10 [ 230.813036][ T8511] ? __pfx___schedule+0x10/0x10 [ 230.817866][ T8511] ? __pfx_try_to_wake_up+0x10/0x10 [ 230.823054][ T8511] ? up_write+0x209/0x520 [ 230.827365][ T8511] hugetlbfs_fallocate+0xf3f/0x12e0 [ 230.832547][ T8511] ? __pfx_hugetlbfs_fallocate+0x10/0x10 [ 230.838168][ T8511] ? __pfx_hugetlbfs_fallocate+0x10/0x10 [ 230.843781][ T8511] ? vfs_fallocate+0x5b1/0x10e0 [ 230.848611][ T8511] vfs_fallocate+0x5b1/0x10e0 [ 230.853266][ T8511] ? __pfx_vfs_fallocate+0x10/0x10 [ 230.858357][ T8511] ? madvise_vma_behavior+0x2b20/0x2d60 [ 230.863888][ T8511] madvise_vma_behavior+0x2ad7/0x2d60 [ 230.869242][ T8511] ? mas_prev_setup.constprop.0+0xb6/0x9d0 [ 230.875031][ T8511] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 230.881256][ T8511] ? __pfx_mas_prev+0x10/0x10 [ 230.885918][ T8511] ? find_vma_prev+0xda/0x160 [ 230.890575][ T8511] ? find_held_lock+0x2b/0x80 [ 230.895240][ T8511] ? __pfx_find_vma_prev+0x10/0x10 [ 230.900345][ T8511] ? futex_unqueue+0x133/0x2c0 [ 230.905098][ T8511] ? __futex_wait+0x24c/0x2f0 [ 230.909756][ T8511] madvise_walk_vmas+0x31f/0x9c0 [ 230.914679][ T8511] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 230.920124][ T8511] madvise_do_behavior+0x1e2/0x530 [ 230.925219][ T8511] ? futex_private_hash_put+0x18a/0x300 [ 230.930753][ T8511] ? __pfx_madvise_do_behavior+0x10/0x10 [ 230.936368][ T8511] ? down_read+0x13d/0x480 [ 230.940774][ T8511] do_madvise+0x176/0x240 [ 230.945088][ T8511] ? __pfx_do_madvise+0x10/0x10 [ 230.949922][ T8511] ? do_futex+0x122/0x350 [ 230.954246][ T8511] ? xfd_validate_state+0x61/0x180 [ 230.959348][ T8511] __x64_sys_madvise+0xa9/0x110 [ 230.964187][ T8511] ? lockdep_hardirqs_on+0x7c/0x110 [ 230.969371][ T8511] do_syscall_64+0xcd/0x4e0 [ 230.973859][ T8511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.979732][ T8511] RIP: 0033:0x7f34def8eba9 [ 230.984125][ T8511] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 231.003715][ T8511] RSP: 002b:00007f34dfebc038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 231.012105][ T8511] RAX: ffffffffffffffda RBX: 00007f34df1d5fa0 RCX: 00007f34def8eba9 [ 231.020056][ T8511] RDX: 0000000000000009 RSI: 0000000000600002 RDI: 0000200000000000 [ 231.028011][ T8511] RBP: 00007f34df011e19 R08: 0000000000000000 R09: 0000000000000000 [ 231.035965][ T8511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.043913][ T8511] R13: 00007f34df1d6038 R14: 00007f34df1d5fa0 R15: 00007fff9fc8f828 [ 231.051868][ T8511] [ 231.054863][ T8511] Modules linked in: [ 231.058736][ T8511] ---[ end trace 0000000000000000 ]--- [ 231.064166][ T8511] RIP: 0010:filemap_unaccount_folio+0xef/0x8c0 [ 231.070301][ T8511] Code: 07 20 c9 ff 89 ee 31 ff 4c 8d 6b 30 e8 3a 1b c9 ff 85 ed 7e 17 e8 f1 1f c9 ff 48 c7 c6 c0 1f b9 8b 48 89 df e8 c2 cf 11 00 90 <0f> 0b e8 da 1f c9 ff 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 231.089887][ T8511] RSP: 0018:ffffc9001c077310 EFLAGS: 00010046 [ 231.095932][ T8511] RAX: 0000000000080000 RBX: ffffea0001318000 RCX: ffffc90004f02000 [ 231.103881][ T8511] RDX: 0000000000080000 RSI: ffffffff81f27d5e RDI: ffff88802d8d0444 [ 231.111829][ T8511] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 231.119777][ T8511] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88805406aaa0 [ 231.127729][ T8511] R13: ffffea0001318030 R14: 00000000000007e0 R15: ffffea0001318000 [ 231.135684][ T8511] FS: 00007f34dfebc6c0(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000 [ 231.144600][ T8511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.151167][ T8511] CR2: 000020000016e030 CR3: 0000000033812000 CR4: 00000000003526f0 [ 231.159122][ T8511] Kernel panic - not syncing: Fatal exception [ 231.165351][ T8511] Kernel Offset: disabled [ 231.169648][ T8511] Rebooting in 86400 seconds..