last executing test programs: 2m45.317016091s ago: executing program 4 (id=1773): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) futex(&(0x7f000000cffc)=0x1, 0x80, 0x2, 0x0, 0x0, 0xfffffffc) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000001c0)={0x2, 0x0, [{0x1000, 0x5f, &(0x7f0000000140)=""/95}, {0x4, 0x1000, &(0x7f00000006c0)=""/4096}]}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r6, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x4c0c0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x70, 0x10, 0x401, 0x70bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8, 0x10000}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x30, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_INGRESS_QOS={0x1c, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5, 0x800}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x81, 0xffffff81}}]}]}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x70}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) 2m43.430200025s ago: executing program 4 (id=1777): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000380)=@delqdisc={0x24, 0x25, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0x2}, {0xa, 0x3}, {0x0, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) (async) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000280), &(0x7f00000002c0)=0x4) (async, rerun: 64) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) (rerun: 64) prlimit64(r1, 0x5, &(0x7f00000000c0)={0x2, 0xffffffff7fffffff}, &(0x7f0000000240)) (async, rerun: 32) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) (rerun: 32) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e28, 0x0, @mcast2, 0x7}, 0x1c) socket(0xa, 0x3, 0x3a) (async, rerun: 64) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) syz_open_dev$vim2m(0x0, 0x3fe, 0x2) (async, rerun: 64) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) (async, rerun: 64) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8101, 0x0, 0x7, 0x0, 0x3ff, 0xfa11, 0xffffffff}, 0x0) (rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_NOP={0x0, 0x2}) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) (async) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) (async) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async, rerun: 64) socket(0x40000000015, 0x5, 0x0) (async, rerun: 64) syz_open_procfs$pagemap(0x0, &(0x7f0000000380)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000100)) (async) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) 2m40.828591055s ago: executing program 4 (id=1783): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x7, 0x8, 0xc}, 0xffffffffffffffd6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) io_getevents(0x0, 0x3, 0x0, 0x0, 0x0) io_destroy(0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e00)=ANY=[@ANYBLOB="c003000040000701feffffff00000000017c0000a803428008009e00", @ANYRES32=r0, @ANYBLOB="23009000ac17c1878e2afe1e0ea6d81630aa7322b8e0f22169d793d37ea7722a303875007503eb80db656e55fb98ad6819f4f28a5ea78c79e5592958fe6be870398523ba3fc3a14ac84cd3a25e19057171a93bb7bac7e68ec1018776378dba945b6e7708001700", @ANYRES32, @ANYBLOB="88cac2da661f4c1f2661038a0be2f786cb7f7c26383ffa1af1a914de4be8e1caef7ae69dc887640696f05901163649fd3f15077befbe78e53d2e5c12bd3efad23d3bf87e0b6a94b7f21dbcd9c1349a88e38a7190463b6fad8721f18089a1da7a2bf3a4e25367a3c0de9695c3ed1743ebd4c3fec6ae69248a01cf802eca4562536d3cd6dc081361a74c228b8907237183e5f1ef0d759566d21b7f645f0e9d0f6b912f1c7a132c3992cf8ab60bd70e338a176f2e6203ee27c493e2784b805f4a084844d1c812a40d835d2067af2743b470e9928569754e7c118ee55d18001f9628840a938a6037698381cba24a0c6b77432fd195c845171971c4cec0590c8fce1682b7b628bdf05b9aae0d6ecd8e9b75676aff5dd1414170be9d8f007b3bae14b777658a031d76d036b86b13b551e8774efb71cca516e2ef60b3a4dab11ae26e801e2a8e29bfeb0206c3eeca55300720b9cbb6245633029c3a81d1155a0a3d750ddc986564b3b0a77bef5817de72b75e4da0a080834c286e3c40111bca460faf3bc5fdeaaaf796d847333c6748c4c40c726db92dd656e4e9fceb8cc89ba994eaaa0c6e3882dfc88822e23d128745b3f05fda352f63e3c3660ea2cbb75f560079191f767a2e0da23d77aae7998be258b27a9cf865ec0d6cf03f14c7e8ca429ae7b194104d65adbb020716f8f240000c006c00040000000000000008007b006700000000004e022628f2c7f6e799e04fdb39e2f5fb80348dad9f0a70315f9441208560b21d44ca030492373fe14a430c7dd2bd733b16b6ae5cbcfe1828bdb539c9f38e9340a9443074cdc99dd10037001cb6a70a5555252e1f21bae34e457d9f22628c219f42794e4fa7a2b6b7cc49678443bb00d9432b4ddd97d7bb29a5cad4133fb248d2dc7bb7292e477b6170ffc8736d7cd2030b571b0c9c8df7da5d59f47bc6c590792a069287f59e2347a6cf97e193a277f838c9d0cf17556c01f3453f6c42f04aedf91e2e8e82b05a0c392ff77a4737386bb03489f427297720812c206115b4075ed22f1c91f13d6b6531247102c38527c37916b6e58c4ee333571f8d4a2a841269d3ab95b3e24f29cbab228ed8190aab578373d544af31710d0000000d0043002f6465762f6b766d0000000000000004000180"], 0x3c0}}, 0xc000) sendmsg(r2, &(0x7f0000000740)={&(0x7f0000000540)=@pptp={0x18, 0x2, {0x2, @private=0xa010102}}, 0x80, &(0x7f0000000300)=[{0x0}, {&(0x7f0000001400)}], 0x2, &(0x7f0000002b80)=ANY=[@ANYBLOB="d0050000000000000100000008000000244df5680b8203b6b985638f2545f2ac042a9aee660edf5459c22ed1ed6026739f79e286a1f42ab62b2270f719c0ea01f4cfde2afa600b46d7d34e10f60c895126a9adf4a9885156ee2178974a935091e8c514514f31db8fcb6395a59a1710c7cff57d7f512eb909c22710e93086e706d2a3e4c1a121465944394844b45ed609c9fabb4edaf37a3df4d37a5ea7e027b1c5b22dd328957ae0b6f90667ae9f43322d694eebddddf7f23f1943855002a99e58c8402393d5a7dfd8d88cd1fcb86fe7aac690f8fcffa5b9dc3fdbb4822e588b7773ff35873a5ea7cc83b006d00e70987f313f1b9ba1b1b93ed3eb0362a138f2fba123982919b7aa914be8ba9c71a8d76f7045daafabfb4a50993005e0686440e9f97cc259b5350c86a0effdea17facf052b6772c96ea5fedb6b9497e591f51bd0e02ac86402d6f3fe7d0e856a69c6e3d49d89ba91e2fe519d5ac2186091766c178f274e81493af54a02f7e0b3e47c0a862bd7af9712e65f74595e8c63c91a45ebd081ad910d95f26192ead1daf401b015eb772f4b91bbacf26157d5d6d626eff439e238a6dd9ebce65fb960ae90ec490d5014589a24d107c8b66a587166ce85e9bffd33d975eee0c3333d15ed629874fb3259217911d50a1eec22b3c205b3c2068bdbe9d0145de5536049af47bea81d4cffdc45b277e8c06249510d2d429cb3e606d27f40918bd250818d0a09512ed8a2727c81a38e44366deb7ca5e30556b03305ae54b19cc17f6a543a9d397676d1d18c873c30f02a873c6fe6cb1c21d0ebf78c1bc732ef62cbc92e71d461886c9fa5f04d28dc4c7e3b3ed55fb39603c041d27017322610ac1a16c63c91ed376d9bba0df833d185fff47bad14a8911c26a5918034211a3dbe77663f21a22b4bed8a3cbabfcd5622a1bbc3c015d1890391c5f5f57ff316718f57d7927f41724ee25f274c98a22d8cc1f7348cdd5ff604f4fe21d50f21a1638a75b39c6a5e5c0470812e9e7a663f4f61e6f8b008d31c6e9bd4686a17e0f4fb42c06a19436731d612990f7dbdc2d9b6dd4a5152b8cdbef0906e6f6dd07ad305da2d579fb968b000ad7075c91d35f1af5c3783cbeb9306de0cb3f086a0e2950f564b6e1d0ff9bc785d53ed0176c3feaa5356559ebf4508bccc9202ee45d1c20f768f98f60aed75b7da8dba4f1c36a8b668e3a9a19eb431d4759a7b6840c888774194f60f872790fb243fdb2fb1184bc6dd225bfdb447cc1cfa5277569536d051e8069185956aaa7c34217597ab9c93e3ac647542aab63a11dce2a50d9ae996bb2477afc23d2456f36c58a8ca9308aea7548ea875ed4159d2df58cc3edcc0f1afd5fbed7e8fd540a9e97009a801e6d1397670d528f6c8ebbfce8ac7196efb13d05df6d95942f3a5f7629c857e558f0f408cfe6c5d7b9b3c07ac388904b79ffa7f897c0738b1722e6c817cb87cbee4d26d29ac34205523c121677cf55e891a681e9e4a1847ff29a8f440a427ebb9fa040f212b558c0932ad7f7e1115f48c52adcfbfb13ca9fe08f5507a74b04fee211674865f4ffa3f5cfba2fa7640a055efb6e848f4b6f9222bbe3b26a3721ddabc492c0586ca63fb03cc73007bef0e35606cfc629fa1c551eee50593712449e31c730042128ecdf57b35c79d040c6c23c663c5d30e2f3e711c8a9b9949814afee7117207a2d1c19c67d8edf72d997b3baa3ad5b700a8bf3c29d347094df4864bd4f4c234d5ef682b20f2664f7af13ec91c2490b0ddaff7cb2214d84a0a4486e6c51db48c21b6ef2bccf637bd589204716b019f976491ec9eedea1e67d48521a6e42cbc77c808e597a876226ba352c79e5f485ce3dd499f7eb22831a3951b70c5c869c90596fa211a1b9844c8a80e3fccaef546d08c4599f43b08bf198d8ed3b666088b191103f477bcf885bee9e280c9c126f1a2ddff0963ef5da8136f405dd5479e121fccbfa18c290acbeeff0000000000000073a3da5db87b29c6ee7d66d2340bc053b83d600b5aaab198965f691aa52be98fda0998bb6a330f54575429a3cb7dcca97db0cdf3a2f1003514b1c213875e5306feb23a152800000000000030000000000000000801000002000000d1cb82e1ba3f7b288450fd50da072eb1dd2d3d71fdbd35d588ac369a7700000000010000000000009c0100000300000014de4e11cc1b7b9c87cb283c35ed2161798d1ff02f43f9040dbd96a4a31979463a557b963633819542a4dbff22946796f56173f2dcfa3a07ab17cf12afccbad562e51b8730a884d42aec71e6a411d62fd76b05b7baf008f6b781fa2c381c42907a2298b01b9341a64fcba61b45edd16e32a049db6f7531740ee2cc5bdd533d3aae7f3c911dba00a82d4dc36159c1ea023056cb6ec7379e6c33461a2422a3e1639c833116b5480f74d4cf5b59450ec4f14c278f029e60700638a59e224a42760a4deac19e6f5ed15c79802ab0c7202996abfa04d7f13e7160dfeaae2f58574d96cf8a405acc4b8858290000000000000004d4e3d4dda403308953322775216f6f150bd8f3ae6dbd08e80596cc01006498cb8c72a8aa380eb105909c48af86b0f1222be3060fd3e2ff9adf966360ab56e80a4e029f283b4d12c38ef7c720a14f28973314ce7ae57dc3f230d55c067df1d694973732c410f4c2862531ac483b"], 0x700}, 0x40000) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r3, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000400)=""/179, 0xb3, 0x0, 0x2, 0x4}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000640)={0x2, 0x0, {&(0x7f0000001900)=""/4096, 0x1000, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r3, &(0x7f0000000100)={0x1, {&(0x7f00000007c0)=""/194, 0xc2, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r3, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000002b00)={0x2, 0x0, {&(0x7f0000000600)=""/13, 0xd, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) socket$alg(0x26, 0x5, 0x0) r4 = socket(0x2, 0x2, 0x1) bind$unix(r4, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) 2m37.940417618s ago: executing program 4 (id=1793): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0aca6020"], 0xd) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x180, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="600100001000130726bd7000000000000000000000000004f48d5e92396fb818981c62f595000000ffff0a010102ac1414bb0000000000030000000000004e22", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff0100000000000000000000000000010000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000200000000000000f8ffffffffffffff0c000000000000000200000029bd70000000000002000100280000000000000068001200726663343534332867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e000000080000000316f74eeac053df08b8b0984dc48bf03b88bbaf79899289a451c00aa0800160004"], 0x160}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f00000033c0), 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r6, 0x6fd3041c41726615, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x14, r7, 0x1, 0x70bd2c, 0x400, {0x1a}}, 0x14}, 0x1, 0x0, 0x0, 0x20008840}, 0x8040) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08"], 0xb4}, 0x1, 0x0, 0x0, 0x24040850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r8, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, {0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "ac"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$TIOCGSOFTCAR(r1, 0x5414, &(0x7f00000000c0)) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) setsockopt$sock_void(r2, 0x1, 0x24, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x20004080}, 0x600c0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="010027bd7000fedbdf254100000008000300", @ANYRES32=r12, @ANYBLOB="08e0c7c1d5df8eaa5cdc6c112e291df18af4a1318724e8149b0ab8bbfd19e973bb749134d7ec447ba256d7eb28f37c54913b53d50366c7747618098d0b561b2d9c98be69dd019f0eead393688a833260c77139171ab69fa01bd0db29c59a58158e9cab99827e868d851769535cdc1c37046a12031a76317fe48d44906579c6b66d13267238155a6036dc6b0f47bf846ae1c5854da7dd7945053cd03bf21716"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x4040004) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r11, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1120, 0x64}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x24}}, 0x20000080) 2m37.727498545s ago: executing program 4 (id=1794): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_udp(0xa, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) r0 = gettid() r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f00000003c0)=""/234, 0xea}], 0x1) (async) rt_sigqueueinfo(r0, 0x21, &(0x7f0000000180)={0x33, 0x40000020, 0xfffffffb}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) (async) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) unshare(0x2040400) pselect6(0x40, &(0x7f0000000100)={0x2, 0x0, 0xfffffffffffffff8, 0x10000000000000, 0x1, 0x2, 0xa8, 0xa11}, 0x0, &(0x7f0000000000)={0x1f, 0x4, 0x9, 0x2, 0x2, 0x80000000000000, 0x7, 0x20000}, 0x0, 0x0) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$dri(0x0, 0xfffffffffffffffd, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0xc744, 0x2) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) r6 = syz_io_uring_setup(0xd2, &(0x7f00000000c0)={0x0, 0xdffd, 0x10800, 0x3, 0x4f}, &(0x7f0000000240)=0x0, &(0x7f0000004200)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) (async) io_uring_enter(r6, 0x47ba, 0x0, 0x0, 0x0, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) 2m37.550898735s ago: executing program 4 (id=1795): r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r0], 0x40}}, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff7ffc}, {0x4, 0xf2, 0x11}, {0xfffa, 0x7, 0x3, 0xfffffff4}]}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x5) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x8) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$inet_sctp(r5, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@sndrcv={0x30, 0x84, 0x1, {0xf, 0x3, 0x6, 0x21, 0x6740, 0x9, 0xffffffff, 0x5}}], 0x30, 0x4040000}, 0x20000841) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000540)=ANY=[@ANYRESOCT=r2, @ANYRESHEX=r3, @ANYBLOB="2c726fa7251c6964653d3030303030303030303130303030301caefebb442c757365725f69643df33aa1ac7089ffc9f4fa3e568883ea5ffd8cc47945f77e8bde728870980101000000000000f11d66622ab400983c0f6e1f08517cb6c3945ceba16d857d54b0bb9ba07e41fd23ff0ad69be45539bf31a1186c5e202049ba92c8c33181cfcf084069d517e2d31ef5b9cde04712afbd2fcabbcae2b2d3aa15f3899065b0c11ffd9d3a43094524df863e1693327421ea95ebcb0607e3456650f94a0f4a51bdc6d74a14298cb7e1cf0d8850016172d7515d859c69ff675b630002fc8d7aea87f577f9b6a3ee0fb45d145eeef9e08ae7e4bd009d1b33417742f3897893325d7763c7a838f7bfcc166f953375f2e3068a251a95a6fbba3848eb20dc8c6cd1813ffa4c1ce4652f98fde58dd7962411f7eda9c24e20ccafd9c0adceefed9864d6a644ae5b2c381448fbbb9b4a78797399c9dff9e97238e43a7300dc1f7820e4f4ca3bdbeae4fecdc7d1f9d07bfa86f51d80e54d5123b4465fb041799991da5760e4c5576486b07ee4a9698bb07deffa82007d78", @ANYRESDEC=r2, @ANYBLOB=',group_id=', @ANYRES32=r5]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, 0x0) sync() close_range(r2, 0xffffffffffffffff, 0x0) 2m22.244392748s ago: executing program 32 (id=1795): r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r0], 0x40}}, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff7ffc}, {0x4, 0xf2, 0x11}, {0xfffa, 0x7, 0x3, 0xfffffff4}]}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x5) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x8) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$inet_sctp(r5, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@sndrcv={0x30, 0x84, 0x1, {0xf, 0x3, 0x6, 0x21, 0x6740, 0x9, 0xffffffff, 0x5}}], 0x30, 0x4040000}, 0x20000841) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000540)=ANY=[@ANYRESOCT=r2, @ANYRESHEX=r3, @ANYBLOB="2c726fa7251c6964653d3030303030303030303130303030301caefebb442c757365725f69643df33aa1ac7089ffc9f4fa3e568883ea5ffd8cc47945f77e8bde728870980101000000000000f11d66622ab400983c0f6e1f08517cb6c3945ceba16d857d54b0bb9ba07e41fd23ff0ad69be45539bf31a1186c5e202049ba92c8c33181cfcf084069d517e2d31ef5b9cde04712afbd2fcabbcae2b2d3aa15f3899065b0c11ffd9d3a43094524df863e1693327421ea95ebcb0607e3456650f94a0f4a51bdc6d74a14298cb7e1cf0d8850016172d7515d859c69ff675b630002fc8d7aea87f577f9b6a3ee0fb45d145eeef9e08ae7e4bd009d1b33417742f3897893325d7763c7a838f7bfcc166f953375f2e3068a251a95a6fbba3848eb20dc8c6cd1813ffa4c1ce4652f98fde58dd7962411f7eda9c24e20ccafd9c0adceefed9864d6a644ae5b2c381448fbbb9b4a78797399c9dff9e97238e43a7300dc1f7820e4f4ca3bdbeae4fecdc7d1f9d07bfa86f51d80e54d5123b4465fb041799991da5760e4c5576486b07ee4a9698bb07deffa82007d78", @ANYRESDEC=r2, @ANYBLOB=',group_id=', @ANYRES32=r5]) setresgid(0x0, 0x0, 0xee01) utimes(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, 0x0) sync() close_range(r2, 0xffffffffffffffff, 0x0) 46.450859028s ago: executing program 3 (id=2118): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) futex(&(0x7f0000000540)=0x2, 0x8c, 0x1, 0x0, 0x0, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local={0x3}, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}}}}}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x2000, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r4 = socket$pppoe(0x18, 0x1, 0x0) syz_emit_ethernet(0x3d, &(0x7f00000005c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}, @void, {@llc_tr={0x11, {@snap={0xaa, 0xab, '\x00', "d91980", 0x809b, "678d2cb56397c3192167a495fe5629db2f987c17fb414291c8fa6ec212110a08880596bad4211f"}}}}}, 0x0) connect$pppoe(r4, &(0x7f0000000400)={0x18, 0x0, {0x4, @link_local, 'lo\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r4, 0x4008b100, 0x0) 44.952694746s ago: executing program 3 (id=2120): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000140)={0x0, 0x12, 0x6, "3432028f267f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="4016010000008bffb3e1e7af4ee0cb065d1fc18885c22ad38cd0b678319a55f2617357a9bebd7c9665a150f3"], 0x0, 0x0}) 39.376576162s ago: executing program 3 (id=2135): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket(0x10, 0x80805, 0x2) sendmmsg$inet(r0, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000004c0)=ANY=[@ANYRES32=r1, @ANYBLOB="03000000009a"], 0xa) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000040)=0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d0000000000000000020000000000fc05000000000600"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') lseek(r5, 0xffffffffffffffff, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) ioctl$UI_SET_MSCBIT(r9, 0x40045568, 0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) write$sysctl(r4, &(0x7f00000002c0)='4\x00', 0x2) 38.456329929s ago: executing program 3 (id=2138): r0 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x100, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000240)="9fa299c1612890e15978d2582a65561e29d0941f547771cfcf539318f4f315317fd354232c6235f273892715c12a34594688cc9cefcf600a23000f623594bb464d2e3f5aa965cba04a120680e321", &(0x7f00000002c0), 0x5, 0x0, 0x5}, 0x50) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000080)={0x3, 'hsr0\x00', {0x2d}, 0x7d}) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000002c0), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r4, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000140)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r5}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000000000000000000005000000b7080000000000007b8af8ff00000000b70800000e0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r5, @ANYBLOB="0000000000003f00b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)=ANY=[], 0x20) 37.501786933s ago: executing program 3 (id=2139): r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x3) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x20000, 0x3806}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_LINK={0x8, 0x1, 0x3}, @IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, &(0x7f0000000100)=0xe8) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x40, &(0x7f0000000380)={'trans=unix,', {[{@msize={'msize', 0x3d, 0x64190719}}], [{@subj_type={'subj_type', 0x3d, ')^]-$(*'}}, {@subj_type={'subj_type', 0x3d, 'xfrm\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '{:]'}}, {@uid_eq={'uid', 0x3d, r1}}, {@obj_role={'obj_role', 0x3d, '\xaa'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}]}}) socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101) (async) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) (async) chdir(&(0x7f0000000080)='./file1\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) (async) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x3) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x20000, 0x3806}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_LINK={0x8, 0x1, 0x3}, @IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) (async) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@dev, @in6=@local}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, &(0x7f0000000100)=0xe8) (async) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x40, &(0x7f0000000380)={'trans=unix,', {[{@msize={'msize', 0x3d, 0x64190719}}], [{@subj_type={'subj_type', 0x3d, ')^]-$(*'}}, {@subj_type={'subj_type', 0x3d, 'xfrm\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '{:]'}}, {@uid_eq={'uid', 0x3d, r1}}, {@obj_role={'obj_role', 0x3d, '\xaa'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}]}}) (async) 36.140545233s ago: executing program 3 (id=2145): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f00000000c0)) r4 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xa, @loopback, 0x4}, 0x1c, &(0x7f0000000380)}, 0x4048043) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r6, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='batadv_slave_1\x00', 0x10) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x7baf, 0x20000, 0x8000, 0x40024e}, &(0x7f0000000340), &(0x7f0000000040)) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x84, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x111, 0x6}}, 0xfef9) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0xd5d02562c143c395}, 0xc, &(0x7f0000000480)={&(0x7f00000006c0)=ANY=[@ANYBLOB="04000000e84d6d4d484facda855e929708217f53d9ca30e26d4f566dcce5e6943e56987027480f94e60f495a95246a477c520171fd0725cd4ec485fc8897f7b57844c63fb9ec0bae10eb839f425bcc337a25c9fa9aee39ad0ec9aa73f74a43ed6a1162a637ed4976766a02be0810cec49c8f196e222fc8fc1e48657984dcb3447d5d7ab60dcc1c04fe2c00902538af4b7b2100000021f300000000000000", @ANYRES16=r8, @ANYBLOB="010026bd7000ffdbdf256300000096fc0300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x24000004}, 0x20008851) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000600)={0x0, @in={{0x2, 0x4e21, @empty}}, 0xfffffffe, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000000101010100000000000000000a000009100002800c000280050001003a1000000c0019800800020008", @ANYRES16=r1], 0x30}, 0x1, 0x0, 0x0, 0x200488d0}, 0x6010) socket(0x2, 0x80805, 0x0) r9 = socket(0x2b, 0x1, 0x0) r10 = syz_io_uring_setup(0x110, &(0x7f0000000480)={0x0, 0xfad6, 0x400, 0x2}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x0, &(0x7f00000003c0)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r11, r12, &(0x7f0000000180)=@IORING_OP_POLL_ADD={0x6, 0x44, 0x0, @fd=r9, 0x0, 0x0, 0x0, {0x200}}) io_uring_enter(r10, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r10, 0x18, &(0x7f0000000000)={0xfeffffff, r9, 0x23, {0x3b4, 0x6d3}, 0x6}, 0x1) 21.044207786s ago: executing program 33 (id=2145): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f00000000c0)) r4 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xa, @loopback, 0x4}, 0x1c, &(0x7f0000000380)}, 0x4048043) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r6, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='batadv_slave_1\x00', 0x10) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x7baf, 0x20000, 0x8000, 0x40024e}, &(0x7f0000000340), &(0x7f0000000040)) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x84, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x111, 0x6}}, 0xfef9) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0xd5d02562c143c395}, 0xc, &(0x7f0000000480)={&(0x7f00000006c0)=ANY=[@ANYBLOB="04000000e84d6d4d484facda855e929708217f53d9ca30e26d4f566dcce5e6943e56987027480f94e60f495a95246a477c520171fd0725cd4ec485fc8897f7b57844c63fb9ec0bae10eb839f425bcc337a25c9fa9aee39ad0ec9aa73f74a43ed6a1162a637ed4976766a02be0810cec49c8f196e222fc8fc1e48657984dcb3447d5d7ab60dcc1c04fe2c00902538af4b7b2100000021f300000000000000", @ANYRES16=r8, @ANYBLOB="010026bd7000ffdbdf256300000096fc0300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x24000004}, 0x20008851) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000600)={0x0, @in={{0x2, 0x4e21, @empty}}, 0xfffffffe, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000000101010100000000000000000a000009100002800c000280050001003a1000000c0019800800020008", @ANYRES16=r1], 0x30}, 0x1, 0x0, 0x0, 0x200488d0}, 0x6010) socket(0x2, 0x80805, 0x0) r9 = socket(0x2b, 0x1, 0x0) r10 = syz_io_uring_setup(0x110, &(0x7f0000000480)={0x0, 0xfad6, 0x400, 0x2}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x0, &(0x7f00000003c0)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r11, r12, &(0x7f0000000180)=@IORING_OP_POLL_ADD={0x6, 0x44, 0x0, @fd=r9, 0x0, 0x0, 0x0, {0x200}}) io_uring_enter(r10, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r10, 0x18, &(0x7f0000000000)={0xfeffffff, r9, 0x23, {0x3b4, 0x6d3}, 0x6}, 0x1) 12.886512425s ago: executing program 5 (id=2214): r0 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x100, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000240)="9fa299c1612890e15978d2582a65561e29d0941f547771cfcf539318f4f315317fd354232c6235f273892715c12a34594688cc9cefcf600a23000f623594bb464d2e3f5aa965cba04a120680e321", &(0x7f00000002c0), 0x5, 0x0, 0x5}, 0x50) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000080)={0x3, 'hsr0\x00', {0x2d}, 0x7d}) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000002c0), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r4, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000140)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r5}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000000000000000000005000000b7080000000000007b8af8ff00000000b70800000e0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000006b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)=ANY=[], 0x20) 12.100968148s ago: executing program 5 (id=2215): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x2d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x0, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x50) kexec_load(0x0, 0x2, &(0x7f0000000800)=[{&(0x7f0000000680)="63468e878a5c93", 0x7, 0x9, 0x1}, {&(0x7f0000000700)="bfde6fe3b88a7d10a80782c57bbee29e419a1ec3dad4b095f80f19313ef28c922487bfa35acaa1a9f250adce6d4d421a11cad859ac37be716cba1eacf9a417b2a98faf2dd01d6fa077fe5f5cfc7bc795040a8120c54b3127f09ed134c61968085c77866c2fdaebe4344b28ca26f0605c0a83226530f81f790c425ab2119f758619fdbebac5554f70725f7a53b9b9fcd2268c7844d39edaaa88caa98bb511419d4de35b8f3e320f23efc6f47d5cb61735c8c211c668fc1b3bdfeef348464d59e50b243f9e35f2803dfd2ef64d0d6036c72667", 0xd2, 0x8}], 0x30000) unshare(0x62040200) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r2, 0x4018f50b, &(0x7f0000000100)={0xfffffffb, 0x0, 0x40}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x40180) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a6970"], 0x60}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000042}, 0x90) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f00000005c0)={0x80, 0xf0, 0x800, 0x320, 0x80, 0x2, 0x20, 0x0, {0x8, 0x7}, {0xa263, 0x100, 0x1}, {0x9, 0x1}, {0x3d5c, 0x7}, 0x2, 0x10, 0x9, 0x400, 0x0, 0x7, 0x7, 0x0, 0x8001, 0x9, 0x400, 0xf032, 0x34, 0x0, 0x3, 0xb}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000840)=ANY=[@ANYRESDEC=r7, @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d6f64653d303030303030303030309935d77dcd610561343030303d000000000000000000", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x14) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x8, 0x7fff0000}]}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000280)={&(0x7f0000000140)="a3e0003ca1b60a575bae3e37e6a71ccb4e557d038233a9d03cde713ebd294592d90835850ce33882cf66ae7de4eb4cab1aff36bbe576690934ac21e0b7ad9bc71a759088526cfabc7d62e2f7fb9b513e345b835977cbf023c4", &(0x7f00000001c0)=""/64, &(0x7f0000000480)="89c14b7a1d4f3554a81daba2839f838ef46370a428c1f979fc969c159bd30ab59c8be6f66968d138e5c65ae96cb04775546428eca5a6200a0937cdcfa1c5286042c951b44a2b4f5d75ca14adb1929aabd269966e91a43d6eed5bb0b72008f1130357549facc6381dc1715a30a3beb06fe52acf0dee937a076e5e7fe41028ca42cf6c32b9140095", &(0x7f0000000540)="3f59faa5d06947cca4c625265f88f56535c68d65a4b978fc8ac4162f65e1bada4dcd8585219e7243729923e227e82ddfc1a31469ec26b1900e99efce0376c3d20622c7ad41f613664e7f3f8b7a57201f6d57c5d1775aef24bf7674ae034e8650c17c082fb278245ccd9fc41cdee5fceda4", 0x0, r2, 0x4}, 0x38) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) 8.788910819s ago: executing program 2 (id=2225): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000080)={{{@in=@broadcast, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x6, 0x20000000000, 0xffffffffffffffff}, {0xfffffffffffffffe}, 0x0, 0x0, 0x1, 0x0, 0x2, 0x2}, {{@in6=@remote, 0x4d5, 0x32}, 0x0, @in6=@loopback, 0x1, 0x3, 0x1, 0xb7, 0x1fb, 0xfffffffb, 0xfffffff9}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) sendmmsg(r2, &(0x7f0000000180), 0x400000000000077, 0x7600) r4 = syz_usb_connect(0x1, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x8, 0x8, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x7, 0x1, 0x1, 0x9, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0x1, 0xa, 0x4}}, [{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x5, 0x9a, 0x2}}]}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x3, 0x2b, 0x4, 0x9f, 0x3a}, 0x12b, &(0x7f00000000c0)={0x5, 0xf, 0x12b, 0x5, [@generic={0x100, 0x10, 0x3, "a4ad49f4b11ac76c836c3be2c6bdaec8cadd8835507e02cdad5ccb551983e828849d529fb22bf9da0ce1b10c2dea6088fd186a5d12f8577f7d6c65e11e99c4ebf2305b877d11c8ca305349f401e2d6d0601668d0baa8baf81eaca6a44f6044bd7548a3d4d11beacf6b766d8b1692088f86fad9339129e78c4b3dd45cb67200feadd87788765c7b5b72373769f4fa26ce638ce323f4b228ae61b904f3b2e95859779bbcbd95e8f818de306239030e70f1256488a935c993feaf8d6d1c3272fa50f921ab1119dfe159fc035df921bb5b4304784df654b28be63ee1e13889c2cf45cffad0c2aea3a79b9a9fa413ba5d777f61dd80e665cb856e81c06bc436"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x9, 0x0, 0x5}, @wireless={0xb, 0x10, 0x1, 0x2, 0x0, 0x8, 0x3, 0xc, 0x7}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0x7, 0x8, 0x1c9f}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0x67, 0x4}]}, 0x6, [{0xd6, &(0x7f0000000200)=@string={0xd6, 0x3, "f7bd3ac6aba46ff6d574d97f1beedc64653ad42bbae0a74d369577091e511f7fc837a793033e00d0626c816e921d2bd292fea8fd11080b04b0e1f0c8e1477347fe14331b9935b844ebbd430d5d8b9598759945834b2494d2c533d297d77933189cf46dabdb225dd63cd166ad911a38dd6902a5f0bededf754e650e514423f373ebd9c8b4ae611aeadaa96ef25b28cc8e0658ce9e9151b7b57e722c2a24de7d3be119cb02bf3b7712b58ab033a7a692f8c10b3dbe0bec1b0534304119e70c5a5d247d956f0f9bcef53ae19f4eeff8caf529554693"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x402}}, {0xb5, &(0x7f0000000340)=@string={0xb5, 0x3, "67e9f190ca13c783dbdfd7fa00af45319df971283d73ffab12e8d8c69187e4d5a60190db6c7cfabc45ae82bb403416ff769ad4d3e21dc3c4c30fcd08cecb59fc8853be82ffffc01deb3c2eca475d423a729a1481ab0e78f31aa6d08a0a26798d3ec4d022f342657259acdfd5cbccbf3358b4fe5d911dc3a2930fecd614a5cf599b5ff14fe79a4330249c1c4922ae2e090fb09c0d971a3c0f680581cbeefa140e4a1f2c8f525bff68599b9c0b375e273075852c"}}, {0xcb, &(0x7f0000000400)=@string={0xcb, 0x3, "da13eac320a43c6da2e995e9c179521e97b3fdc8cf5d548626273b765c9c740f0638886d67681596718987ca8183da828e06bcddb3d8d8dcb386b06e1781f514d0ec1bb45a05670ecfaf648f2bb6055acccb0a397430267de041e8955bb779b1208264fee9b00f6095373ec4cfd0cb78010bebc7ed9a9dc131ba3e1f5198bbe8ec2ba39c92cef49ec57d1bcd1f4308eff218b3dc4c7f83d21d2c02b36293de2d5600342316a3f48e00c9d41bd9b88b42d89790b956a13270afc800ad64f42beac15561c11a10be61a8"}}, {0x18, &(0x7f0000000500)=@string={0x18, 0x3, "9857c868128ae460af94c0bd36ffc52c24135424d871"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x41a}}]}) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000a00)={0x0, &(0x7f00000009c0)=[@nested_amd_clgi={0x17f, 0x10}], 0x10}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000a40)={[0xfffffffffffffff7, 0x5, 0xf, 0xae4b, 0xf, 0x3, 0x7, 0x8, 0x1, 0x1834, 0x7fff, 0x4, 0x1, 0x0, 0x11, 0x7ff], 0x200000, 0x40700}) openat$nvram(0xffffffffffffff9c, &(0x7f0000000b00), 0x4000, 0x0) r6 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0xc0, 0xb, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x7, 0x1, 0x2, 0x8, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0xc, 0x7, 0x7}}, [{{0x9, 0x5, 0x82, 0x2, 0x400, 0x8e, 0x40}}]}}}]}}]}}, &(0x7f0000000980)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x110, 0x4, 0x6, 0x4b, 0xff, 0x5}, 0xd5, &(0x7f00000007c0)={0x5, 0xf, 0xd5, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x8, 0x6, 0x4}, @wireless={0xb, 0x10, 0x1, 0x8, 0x14, 0x5, 0x1, 0x66, 0x7f}, @ssp_cap={0x24, 0x10, 0xa, 0xf7, 0x6, 0x4, 0x1e000, 0x8001, [0x0, 0x0, 0x101ff0f, 0xffc00f, 0xc0, 0x3f00]}, @generic={0x8a, 0x10, 0x3, "b877fe7e2eea26320b355828d1f21d4a2ec2df49cfe4aacffe3bb0f64d6e850757b837e5d9b439e224f1d0d6f6432926dcf3fc0a8642a1e95a9285d27195909b10b661aff79a9a369aabcd86ffe43b18ec4aa94b51e60128817296d4da672436c0717504fc839e3055408df2b183aa8f1cdd21fac4f7d00b670b7ef92fe492fad8b69f6f7be2e5"}, @ssp_cap={0x10, 0x10, 0xa, 0x1, 0x1, 0x9, 0xf, 0xbb, [0x3f3f]}]}, 0x2, [{0x56, &(0x7f0000000700)=@string={0x56, 0x3, "24c5b94240885df1e89fb7c154cfa974d5c9db12d40b69ebf6ecec3bf211ee1597c84e3440542c1237ff26be4cc45716a4583b3274841edf0d9f042f133517c8b02405b5c9da3664a48476b2cca46f34d0585f17"}}, {0xab, &(0x7f00000008c0)=@string={0xab, 0x3, "d6ac632e96cf5db26c27d5cb01e3dfde7fe7f041351e55f606726f0634b1fb9010774f28c92aca0299a48167f19fd22611c5145e0e82012e93952f505147888142e158fe4f09131caa748aa20e37305b4c342fd12dd80906e1d95c19d06b47f2db2d28dbb36e3fa4af756824803b43ca9845e1ffa67ebfd9f744f18a582c3d8721ed0b0d051a41101b3671c48e96cd44daa7788ad266089850bf6b2658e017da80554500d2ed4ca105"}}]}) syz_usb_control_io$printer(r6, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000080)={0x2c, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGMASK(r7, 0x5b03, 0x0) 8.643140633s ago: executing program 5 (id=2226): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000100)) fdatasync(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) tkill(0x0, 0xb) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r5, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)={0x1c8, r6, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x83f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x699f476f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xd553}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2371}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x55c}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA={0x68, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9be3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3580000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xe}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5d2b}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7fff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x31}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x2040800}, 0x8040) futex_waitv(&(0x7f0000001b00)=[{0xfff, &(0x7f0000000340)=0xfffffffffffff697, 0x6}], 0x1, 0x0, 0x0, 0x1) io_uring_setup(0x68d2, &(0x7f0000000080)={0x0, 0x0, 0x4000, 0x2, 0x4210}) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0xc0686611, &(0x7f0000000180)={0x3, 0x0, 0x17, 0x2000, &(0x7f0000000000/0x2000)=nil}) r8 = socket$kcm(0x2b, 0x1, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r8, 0x18, &(0x7f0000000380)={0xd7fa, r2, 0x20, {0x3, 0x3}, 0x4}, 0x1) sendmsg$inet(r8, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) setsockopt$sock_attach_bpf(r8, 0x1, 0xd, &(0x7f0000000080), 0x24) close(r8) 6.424450344s ago: executing program 0 (id=2230): syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='clear_refs\x00') ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000100)={{&(0x7f000062c000/0x2000)=nil, 0x2000}}) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000240)=@attr_other={0x0, 0x0, 0x3, 0x0}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) pwrite64(r4, 0x0, 0x0, 0x10000) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000002100)={0x18, {"a2e3ad2119c70e0d8a267fd5d89dcd939b324d078b089b3b0838721a0890e0878f0e1ac6e7049b3d63959b509a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b32320d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70d998ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f0000000c558cdc0a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5af098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000108000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62437264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d637545c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4953a9737d214060005ea6f1783e287b3bee96e3a726eafe2fd12a78d1f48c13b64df07847754b8010000009bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f577dcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b2fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2010891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57ccb938e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f794c9eee11987f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b4907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d847dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e7832b625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859add50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195301000000aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d0d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb4d600000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de4f8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b3442bab515b0000348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de0000d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bdc8f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d8872fe174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62f46fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f980000000203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00", 0x1000}}, 0x1006) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x4400) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x20004888}, 0x0) recvmsg(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000480)=""/70, 0x46}, {&(0x7f0000000380)=""/244, 0xf4}, {&(0x7f0000000700)=""/207, 0xcf}, {&(0x7f0000000500)=""/222, 0xde}, {&(0x7f0000000940)=""/135, 0x87}, {&(0x7f0000000b80)=""/169, 0xa9}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000000240)=""/171, 0xab}], 0x8}, 0x22120) 6.354447091s ago: executing program 5 (id=2231): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001280)=@newtaction={0x18, 0x31, 0x3d, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1c3425, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)={[&(0x7f0000000300)=' wO\xd5\xce\x82\x89r=\r\xc4Z\x15\xfds\x17g\n\xee\x9f\a0\xc3\x80\xbf\x80j$\xe6Z\xde\xf1pc\x96\x8f\xb5\x9d\xe3\x11m\x88~\xe3\xc7\xe3\t\xab\xbb@\xd9\xf8\xa2N\x03\xcf\xe4\xd6\x0ew\x10\xc2\xaa\x84bC\xc8\xd0\xe07\xa1\rIa\xb1^\xc5WG\xccV\xd3\x91\x84x\x9d\x8eg\x84\xeb\x9e;\x8f\xa1\xa3\xcf]@\x82\xcf\x01$;\xd5\xc0\xa8\xc8r\x0e_\xac\xef\xf5\r\xd5Q\v\b#E\xcf@a\xa2\xaa#\x13S\x04\x12$\xcb\xbeV!\x1d\xc7\x84_\\ \xc7oh$\xc9\x06m']}) r2 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x47e00, 0x19) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="400981"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r2, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) readv(r3, &(0x7f0000000180)=[{&(0x7f0000000340)=""/217, 0xd9}], 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$I2C(&(0x7f0000000180), 0x19a, 0x200) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 5.355773399s ago: executing program 1 (id=2235): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)=ANY=[@ANYBLOB="240000000f060108000000000000000005000001050001"], 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x800) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x400400, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f00000008c0), &(0x7f0000000340)=0x8) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 5.248372039s ago: executing program 0 (id=2236): r0 = socket$key(0xf, 0x3, 0x2) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x21, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000000)=0x40000000) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000200)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, 0x0, 0x0, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x2c1c2, 0x1f2) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getsockopt$bt_BT_POWER(r9, 0x12, 0x4, 0x0, &(0x7f0000000200)=0x3e) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000025c0)={0x6, 0xf, &(0x7f0000002340)=ANY=[@ANYBLOB="180000000800000000000000ffffffff9500000000000000185b0000090000000000000000000000184600000600000000000000000000002345180008000000182b000097f9b2381dd96a763f9f01c118e78b2a4f48a588225dd7ec7421f647053ef6e468d8738ab2940fd77a96436ed6e3dfc278e3ba1202018071531c3b321534871aa5939c8aa25fff5ccdcde2385becd45388f8a27cf00ebb366ddd96458f19097eab82", @ANYRES32=r8, @ANYBLOB="000000000100000018410000060000000000000000000000185b00000400000000000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0xa, 0x6a, &(0x7f00000022c0)=""/106, 0x40f00, 0x23, '\x00', 0x0, 0x25, r7, 0x8, &(0x7f00000024c0)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000002500)={0x1, 0xc, 0x80000001, 0x3}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000002540)=[r8, r8, r0, r8], &(0x7f0000002580)=[{0x4, 0x1, 0x5, 0x3}, {0x5, 0x4, 0xd, 0xb}], 0x10, 0x9}, 0x94) syz_usb_connect(0x0, 0x5f, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd70102030109024d00010000000009040000050095c20009050000000000000007058433c4"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r10 = getpgrp(0x0) sched_setaffinity(r10, 0x8, &(0x7f0000000040)=0x10000005) 4.557891833s ago: executing program 2 (id=2237): r0 = creat(&(0x7f0000000080)='./file0\x00', 0x114) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[], 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x54}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x6, 0x0, &(0x7f0000000000)="259a53f28847", 0x0, 0x5, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000, 0x3}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mount$binder(0x0, 0x0, 0x0, 0x80000, &(0x7f00000003c0)=ANY=[@ANYBLOB]) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_ima(&(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000380)=@v2={0x3, 0x2, 0xfe, 0xe79f, 0x1, 'J'}, 0xa, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000015000200071b1750bd030100000000009500000000000000bc26080000000000bf67000000000000070300000fff0700670200000300000016060a000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$kcm(0x10, 0x2, 0x0) ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4) 4.144027894s ago: executing program 6 (id=2238): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000000)="e9cb60ba73406ae6949da9c452848ae83447") syz_clone(0x24080200, &(0x7f0000000040)="b265bc9e976d56b5a36563f7b73e78a7fd90018b4671d118ca63f546f7ba09de21d736119233b1ad187551dae080f19d6a9eabea112b059c458de30c528ad08d2190ad94b6bb67562090b190ef0de5c0d749c868b8f906010bf9535d1b50ad51e66c15811748099ab408fc064315aeccd1da4c78d3bfa19a4ec3256e604923325d50bfb3fbddf0dabb", 0x89, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="40fedf86eb3eb58c7acae53051bfd7d087f14b450608f09871d40d8f5d3ce8d6c1100a349012ea4f0e2a1a724431966f6826c2c36a07928ccc7ece6a42c65c6056d27c031f18bbab17c084e2b65ec4430fe27bdf069f46dfb03379edc57e39a021f1ad16527c13f4b2") getpid() r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3670}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x34}}, 0x801) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000300)) (async) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000340)={'veth0_macvtap\x00', 0x400}) r3 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000380)={0xe0000013}) (async) ioctl$TCXONC(r0, 0x540a, 0x1) (async) r4 = socket$kcm(0x29, 0x7, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0x4) (async) flock(r4, 0x2) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000400)={r3, 0x1, 0x8, 0x9b3}) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000440)=0x0) connect$nfc_raw(r5, &(0x7f0000000480)={0x27, r6, 0x1, 0x4}, 0x10) r7 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x20010, r7, 0x9a34f000) (async) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/meminfo\x00', 0x0, 0x0) (async) r9 = syz_open_dev$loop(&(0x7f0000000540), 0x2, 0x240000) ioctl$BLKFINISHZONE(r9, 0x40101288, &(0x7f0000000580)={0x1, 0x1000}) close(r3) ioctl$RTC_UIE_OFF(r5, 0x7004) (async) ioctl$FS_IOC_GETFSSYSFSPATH(r4, 0x80811501, &(0x7f00000005c0)={0x80}) (async) r10 = geteuid() quotactl_fd$Q_SETQUOTA(r7, 0xffffffff80000802, r10, &(0x7f0000000680)={0x7, 0x7, 0x6, 0x1729, 0x10000, 0x4, 0x9, 0x7f}) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000700)=0x1) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000740), &(0x7f0000000780)=0xc) 3.664530377s ago: executing program 6 (id=2239): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x58}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newsa={0x144, 0x10, 0x1, 0xfffffffe, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x80, 0x3c}, {@in=@broadcast, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8, 0x2}, {0xffffffffffffffff, 0x2a, 0x1f, 0x7b8}, {0x2, 0xfffffffc, 0xfffffbbc}, 0x70bd2a, 0x0, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075b, 0x8}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) preadv(r3, &(0x7f00000010c0)=[{&(0x7f0000000380)=""/245, 0xf5}], 0x1, 0x40000004, 0x6) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x22, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in=@multicast2, 0x4e21, 0x0, 0x0, 0x0, 0x2, 0x80, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, {}, 0xfffffffe, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.527267284s ago: executing program 2 (id=2240): r0 = socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) connect$unix(r3, &(0x7f0000000400)=@abs={0x1, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x0, 0x40010043, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRESHEX, @ANYRESHEX=r6], 0x3) pipe2$9p(0x0, 0x800) dup(0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000e40), 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r4]) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), r0) ioctl$KVM_SET_CPUID(r5, 0x4008ae8a, &(0x7f0000000800)={0x9, 0x0, [{0x80000001, 0x9, 0x5, 0xed24, 0x5}, {0x6, 0x10, 0x51f, 0x9000, 0x2}, {0xd, 0x2, 0x81, 0x400, 0x1}, {0x40000003, 0x4, 0x6, 0x0, 0x4}, {0xc0000001, 0xb6, 0x6, 0x2, 0x2}, {0xc0000000, 0x5, 0x5, 0x9d, 0x10}, {0x7, 0x7, 0x8, 0x3, 0x10001}, {0xe0000000, 0x9, 0x8f, 0x8, 0x7}, {0x0, 0x0, 0x4, 0x3, 0xfc}]}) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB="3401d701", @ANYRES16=r8, @ANYBLOB="04002dbd7000fedbdf2513000000080001007063690011000200303030303a30303a31302e3000000000080003000300000008000b000200000006001100050000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000100000008000b000900000006001100030000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000100000008000b00050000000600110001000000080001007063690011000200303030303a30303a31302e3000000000080003000000000008000b000600000006001100010400000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000300000008000b00080000000600110005000000"], 0x124}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="2400000041e6d74460030099f5d32059a2405bc819ddec33de7cff5e2c1c45c916a89edbf25ea325f851278809a916a7ba5860d013448596c42c4b1984487e39dc74b2b6c375512ae19149cbbe55afda27dd2de7332458c62db26d011978fd8015ac301362a915d86b9300c91d872bb6603a83d8d0865c2bec39", @ANYRES16, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r7, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r7, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4044001}, 0x24040090) 3.188238582s ago: executing program 1 (id=2241): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000007000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x3, 0x0, 0x0, {0xa}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x78}}, 0x20000800) 3.030642275s ago: executing program 1 (id=2242): r0 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x82002) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f0000000140)=0x12) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xca) (async) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000001340)) (async) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f) (async) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) bind$ax25(r1, &(0x7f0000000000)={{0x3, @default, 0xffffffff}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r3) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)=@expire={0x220, 0x18, 0x1, 0x70bd2d, 0x25dfdbfe, {{{@in=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e22, 0x4e44, 0x4e24, 0x6, 0x2, 0xa0, 0x20}, {@in=@local, 0x4d5, 0xff}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x8, 0xff, 0x0, 0x5, 0xfffffffffffffff3, 0x8, 0x6, 0x101}, {0x732, 0x7f, 0xac62, 0x3}, {0x100, 0x0, 0xc}, 0xf, 0x3506, 0xa, 0x1, 0x7}, 0x7}, [@tfcpad={0x8, 0x16, 0xb}, @offload={0xc, 0x1c, {0x0, 0x1}}, @algo_aead={0x111, 0x12, {{'ccm(cast6)\x00'}, 0x628, 0x200, "11c04a247aa1eb33df4cd93763fc0e5ba5d828fd0c2f711a7c4657c58a084a4aa5cb939e2052e63115917ec8b24699f44b96c8b789edc3c43182449af77e22862eb4cb40bf81d8753df852c696c0c18eeac8032128e608f75468524ead7d1fc38385362defe84ae883217a3cee8ac16f005599454838b0e97259cd42570d3630c65fefa3e64a493608109dc161f5f6e3ff926d344c0faf63121ec30cd92fb988fef1eb5ec889256539ea95d5745713485e0c2b1671e917969ed4a769772599f1b508f0ac02"}}]}, 0x220}, 0x1, 0x0, 0x0, 0x80}, 0x810) (async) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) (async) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000040)) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'bridge_slave_1\x00'}) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) unshare(0x28000600) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x6f67}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) (async) r7 = fsopen(&(0x7f0000000bc0)='binder\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r7, 0x0, 0x0, 0x0, 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) 3.024092127s ago: executing program 6 (id=2243): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r0, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xbda}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0xff0f, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc, 0x2, 0x0, 0x3f}, {0x18, 0x6, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.916598594s ago: executing program 1 (id=2244): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 64) r1 = socket(0x400000000010, 0x3, 0x0) (rerun: 64) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dbdc00, {0x0, 0x0, 0x0, r3, {0xfff5}, {0x6}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x80, 0xfffffffffffffff0, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x20400000bd2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002000)=""/102400, 0x19000) (async, rerun: 64) r6 = socket$qrtr(0x2a, 0x2, 0x0) (rerun: 64) setsockopt$sock_int(r6, 0x1, 0x13, &(0x7f0000000000)=0x6, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) (async) syz_open_dev$video(&(0x7f00000001c0), 0xa7, 0x0) (async) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000002c0)={0x1, @sliced={0xf, [0x7, 0x2, 0xffc0, 0x5, 0x2, 0x8, 0x4, 0x4, 0xff00, 0xfffd, 0x3, 0x3, 0x8, 0x6, 0x4, 0xfc01, 0x7ff, 0x1df, 0x4, 0x0, 0x0, 0x7ff, 0xddb, 0x7be, 0xd1, 0x5, 0x4, 0x0, 0x9, 0x1, 0x6, 0x1, 0x8, 0xff, 0x4, 0x2, 0x2, 0x7, 0x0, 0x5, 0xff, 0x200, 0x10, 0x7ff, 0x9, 0x7ff, 0x2, 0x1], 0x1}}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r7 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r7, &(0x7f0000000080)={0xa, 0x4e22, 0x40000002, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xa77}, 0x1c) (async) close(r4) (async) socket$kcm(0x10, 0x400000002, 0x0) (async, rerun: 64) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (rerun: 64) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) r9 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x458, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r9, 0xc10c5541, &(0x7f0000000040)) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r3, 0xc}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 2.877309023s ago: executing program 6 (id=2245): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="5c0100001000130700000000fcdbdf25e0000001000000000000000000000000ff02000000000000000000020000000100040b6e4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000004d632000000e0000002000000000000000000000000000000000000000000000000000000000100008000000000010000000000008001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f0000000000000000fdffffffffffffff0000000000000000000000002cbd70000035000002000000500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r1], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 2.680374131s ago: executing program 6 (id=2246): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50020000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008"], 0x250}, 0x1, 0x0, 0x0, 0xc080}, 0x2000c000) 2.504283024s ago: executing program 2 (id=2247): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0xdb) syz_init_net_socket$rose(0xb, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) syz_emit_ethernet(0x45, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) getitimer(0xe, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) connect$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000080), 0x9, 0x0) read$msr(r1, &(0x7f00000002c0)=""/78, 0x4e) fcntl$setlease(r1, 0x400, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r3, 0x4b45, 0x0) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x300, 0x300, 0x8, 0x300}}) fcntl$setlease(r0, 0x400, 0x0) fcntl$getflags(r0, 0x401) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x8008) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x7fffd, 0x522, 0x0, 0x1}, 0x50) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000000)=0x20) 2.475366422s ago: executing program 5 (id=2248): pipe(&(0x7f0000000080)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) (async) r1 = getpid() sched_setscheduler(r1, 0x6, &(0x7f0000000200)=0x7) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) write$binfmt_misc(r0, &(0x7f0000000180)="aa7d0613c849f9f996e35f56199380282082945199fa0b561ccee74fca1c580f4e31bf8909d6f833fedcf73e1a7eb7e51140fd6bd079b5b6bd9a7b8581c0806c6a335a59ba5be33e2abd3d6038c3d466a71128d0c6096d1b6b282355c2940d8fc7", 0x61) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x1) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='hfs\x00', 0x8000, 0x0) 2.447567069s ago: executing program 1 (id=2249): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x500, 0x0) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000200)) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000440)={0x2, @output={0x0, 0x0, {0x5, 0xc}, 0x2, 0x3}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) fcntl$setsig(r1, 0xa, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2b, 0x25dfdbff, {0x2, 0x0, 0x0, r3, 0x80, 0x1e2, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @empty}, @NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x20025094) 1.924673817s ago: executing program 5 (id=2250): syz_io_uring_setup(0x10e, &(0x7f0000000280)={0x0, 0x334e, 0x10000, 0x2004, 0x1000030e}, &(0x7f0000000200), 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) tgkill(0x0, r1, 0x27) ioctl$RTC_IRQP_READ(r0, 0x40187013, 0x0) pipe2$9p(0x0, 0x84880) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) renameat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000040)='./file0\x00') getdents(r4, &(0x7f0000000400)=""/205, 0xcd) r5 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r5, 0xc1205531, &(0x7f0000000540)={0x1, 0x6, 0x0, 0x0, '\x00', '\x00', '\x00', 0x0, 0x0, 0x0, 0x0, "b6855a32474ffa64f778ddcf29c94337"}) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) writev(r7, &(0x7f0000000000)=[{&(0x7f0000000100)="080000001f0137f7", 0x8}], 0x1) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200800c0}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@ipmr_getroute={0x1c, 0x1a, 0x100, 0x70bd27, 0x25dfdbfe, {0x80, 0x10, 0x80, 0x7, 0x0, 0x3, 0xff, 0x2, 0x3900}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008100}, 0x4000090) bind$802154_dgram(r6, &(0x7f0000000040)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) 1.919967268s ago: executing program 2 (id=2251): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000000), r2) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000004700)) add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) prlimit64(0x0, 0x5, &(0x7f0000000140)={0xe, 0x8c}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000600)={0x3, 0x2, 0x8000000000, 0x0, r4}) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x320, 0x18c, 0x203, 0x320, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x1f, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x10}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x1, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}, @inet=@rpfilter={{0x28}, {0xd}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) fsopen(&(0x7f0000000000)='exfat\x00', 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, 0x0, 0x40094) syz_open_dev$dri(&(0x7f0000000180), 0x1ff, 0x141941) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, 0xffffffffffffffff, &(0x7f0000000280)={0xffffffffffffffff, r5, 0x7}) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(0xffffffffffffffff, 0xc008aec1, 0x0) socket(0xa, 0x3, 0x3a) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 1.915529927s ago: executing program 1 (id=2252): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) io_uring_setup(0x7c4f, &(0x7f0000000040)={0x0, 0x2154, 0x20, 0x6, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {&(0x7f0000000100)}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x13, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda107000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020c31af8ff00000000bfa100000000000007010000b8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$kcm(0xa, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)={0xb8, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x7c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x15}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_LABELS={0x4}]}, 0xb8}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB], 0x30}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102352, 0x18fd0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) io_submit(0x0, 0x1, &(0x7f0000001400)=[&(0x7f0000001000)={0x0, 0x0, 0x0, 0x7, 0xe98d, 0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x5}]) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f00000006c0)={'bridge_slave_0\x00', 0x600}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) 1.865560856s ago: executing program 6 (id=2253): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000004102, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000000340)=[{{&(0x7f00000003c0)={0xa, 0x4c20, 0x800000, @dev={0xfe, 0x80, '\x00', 0x22}, 0x10}, 0x1c, 0x0}}, {{&(0x7f0000000200)={0xa, 0x4e20, 0x4a, @mcast2, 0x81}, 0x1c, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="240000000000000029000000320000002001000000000000000000000000000174"], 0x28}}], 0x2, 0x6b38deb179a2b498) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fe07124081173809499b010203010902240001000000000904"], 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581"], 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x110) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = syz_io_uring_setup(0x8f, &(0x7f0000000440)={0x0, 0x74c5, 0x2, 0x9, 0x18f}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r5, 0x20847ba, 0x0, 0xc, 0x0, 0x0) 1.770185997s ago: executing program 0 (id=2254): ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x40002) r1 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x10c, &(0x7f0000000180)=0x80000ffb, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r1, 0x627, 0x4c1, 0x43, 0x0, 0x30) (async) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x4) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x2, 0x4}}) syz_io_uring_setup(0x10f, &(0x7f0000000380)={0x0, 0x46ee, 0x400, 0xffffdffe, 0x32e}, &(0x7f0000000140)=0x0, &(0x7f0000000200)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x40180, 0x0) ioctl$XFS_IOC_SCRUB_METADATA(r6, 0xc040583c, &(0x7f0000000180)={0x23, 0xb9, 0x100000000, 0x2, 0xa60b}) (async) r7 = creat(&(0x7f00000001c0)='./file0\x00', 0xecf86c37d53049cc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRESHEX=r8, @ANYRES32=r7, @ANYRES16, @ANYRES8=r6], 0x14}, 0x1, 0x0, 0x0, 0x88c4}, 0x880) ioctl$USBDEVFS_SUBMITURB(r7, 0x8038550a, &(0x7f0000000300)=@urb_type_control={0x2, {0x6}, 0x3, 0x80, &(0x7f0000000000)={0x1f, 0x17, 0x6, 0x40, 0x8}, 0x8, 0x7, 0x800, 0x0, 0x6, 0x5c, &(0x7f0000000240)="95896527230d0b81a4d7cbbd9300506390b506c6df9f65db9d2662f10ec2873529e2ade99ea3eb64f7"}) 1.112711097s ago: executing program 0 (id=2255): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r0, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xbda}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa, 0xfff0, 0x1f}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc, 0x2, 0x0, 0x3f}, {0x18, 0x6, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 805.259196ms ago: executing program 0 (id=2256): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x7, 0x8, 0xc}, 0xffffffffffffffd6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) io_getevents(0x0, 0x3, 0x0, 0x0, 0x0) io_destroy(0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e00)=ANY=[@ANYBLOB="c003000040000701feffffff00000000017c0000a803428008009e00", @ANYRES32=r0, @ANYBLOB="23009000ac17c1878e2afe1e0ea6d81630aa7322b8e0f22169d793d37ea7722a303875007503eb80db656e55fb98ad6819f4f28a5ea78c79e5592958fe6be870398523ba3fc3a14ac84cd3a25e19057171a93bb7bac7e68ec1018776378dba945b6e7708001700", @ANYRES32, @ANYBLOB="88cac2da661f4c1f2661038a0be2f786cb7f7c26383ffa1af1a914de4be8e1caef7ae69dc887640696f05901163649fd3f15077befbe78e53d2e5c12bd3efad23d3bf87e0b6a94b7f21dbcd9c1349a88e38a7190463b6fad8721f18089a1da7a2bf3a4e25367a3c0de9695c3ed1743ebd4c3fec6ae69248a01cf802eca4562536d3cd6dc081361a74c228b8907237183e5f1ef0d759566d21b7f645f0e9d0f6b912f1c7a132c3992cf8ab60bd70e338a176f2e6203ee27c493e2784b805f4a084844d1c812a40d835d2067af2743b470e9928569754e7c118ee55d18001f9628840a938a6037698381cba24a0c6b77432fd195c845171971c4cec0590c8fce1682b7b628bdf05b9aae0d6ecd8e9b75676aff5dd1414170be9d8f007b3bae14b777658a031d76d036b86b13b551e8774efb71cca516e2ef60b3a4dab11ae26e801e2a8e29bfeb0206c3eeca55300720b9cbb6245633029c3a81d1155a0a3d750ddc986564b3b0a77bef5817de72b75e4da0a080834c286e3c40111bca460faf3bc5fdeaaaf796d847333c6748c4c40c726db92dd656e4e9fceb8cc89ba994eaaa0c6e3882dfc88822e23d128745b3f05fda352f63e3c3660ea2cbb75f560079191f767a2e0da23d77aae7998be258b27a9cf865ec0d6cf03f14c7e8ca429ae7b194104d65adbb020716f8f240000c006c00040000000000000008007b006700000000004e022628f2c7f6e799e04fdb39e2f5fb80348dad9f0a70315f9441208560b21d44ca030492373fe14a430c7dd2bd733b16b6ae5cbcfe1828bdb539c9f38e9340a9443074cdc99dd10037001cb6a70a5555252e1f21bae34e457d9f22628c219f42794e4fa7a2b6b7cc49678443bb00d9432b4ddd97d7bb29a5cad4133fb248d2dc7bb7292e477b6170ffc8736d7cd2030b571b0c9c8df7da5d59f47bc6c590792a069287f59e2347a6cf97e193a277f838c9d0cf17556c01f3453f6c42f04aedf91e2e8e82b05a0c392ff77a"], 0x3c0}}, 0xc000) sendmsg(r2, &(0x7f0000000740)={&(0x7f0000000540)=@pptp={0x18, 0x2, {0x2, @private=0xa010102}}, 0x80, &(0x7f0000000300)=[{0x0}, {&(0x7f0000001400)}], 0x2, &(0x7f0000002b80)=ANY=[@ANYBLOB="d0050000000000000100000008000000244df5680b8203b6b985638f2545f2ac042a9aee660edf5459c22ed1ed6026739f79e286a1f42ab62b2270f719c0ea01f4cfde2afa600b46d7d34e10f60c895126a9adf4a9885156ee2178974a935091e8c514514f31db8fcb6395a59a1710c7cff57d7f512eb909c22710e93086e706d2a3e4c1a121465944394844b45ed609c9fabb4edaf37a3df4d37a5ea7e027b1c5b22dd328957ae0b6f90667ae9f43322d694eebddddf7f23f1943855002a99e58c8402393d5a7dfd8d88cd1fcb86fe7aac690f8fcffa5b9dc3fdbb4822e588b7773ff35873a5ea7cc83b006d00e70987f313f1b9ba1b1b93ed3eb0362a138f2fba123982919b7aa914be8ba9c71a8d76f7045daafabfb4a50993005e0686440e9f97cc259b5350c86a0effdea17facf052b6772c96ea5fedb6b9497e591f51bd0e02ac86402d6f3fe7d0e856a69c6e3d49d89ba91e2fe519d5ac2186091766c178f274e81493af54a02f7e0b3e47c0a862bd7af9712e65f74595e8c63c91a45ebd081ad910d95f26192ead1daf401b015eb772f4b91bbacf26157d5d6d626eff439e238a6dd9ebce65fb960ae90ec490d5014589a24d107c8b66a587166ce85e9bffd33d975eee0c3333d15ed629874fb3259217911d50a1eec22b3c205b3c2068bdbe9d0145de5536049af47bea81d4cffdc45b277e8c06249510d2d429cb3e606d27f40918bd250818d0a09512ed8a2727c81a38e44366deb7ca5e30556b03305ae54b19cc17f6a543a9d397676d1d18c873c30f02a873c6fe6cb1c21d0ebf78c1bc732ef62cbc92e71d461886c9fa5f04d28dc4c7e3b3ed55fb39603c041d27017322610ac1a16c63c91ed376d9bba0df833d185fff47bad14a8911c26a5918034211a3dbe77663f21a22b4bed8a3cbabfcd5622a1bbc3c015d1890391c5f5f57ff316718f57d7927f41724ee25f274c98a22d8cc1f7348cdd5ff604f4fe21d50f21a1638a75b39c6a5e5c0470812e9e7a663f4f61e6f8b008d31c6e9bd4686a17e0f4fb42c06a19436731d612990f7dbdc2d9b6dd4a5152b8cdbef0906e6f6dd07ad305da2d579fb968b000ad7075c91d35f1af5c3783cbeb9306de0cb3f086a0e2950f564b6e1d0ff9bc785d53ed0176c3feaa5356559ebf4508bccc9202ee45d1c20f768f98f60aed75b7da8dba4f1c36a8b668e3a9a19eb431d4759a7b6840c888774194f60f872790fb243fdb2fb1184bc6dd225bfdb447cc1cfa5277569536d051e8069185956aaa7c34217597ab9c93e3ac647542aab63a11dce2a50d9ae996bb2477afc23d2456f36c58a8ca9308aea7548ea875ed4159d2df58cc3edcc0f1afd5fbed7e8fd540a9e97009a801e6d1397670d528f6c8ebbfce8ac7196efb13d05df6d95942f3a5f7629c857e558f0f408cfe6c5d7b9b3c07ac388904b79ffa7f897c0738b1722e6c817cb87cbee4d26d29ac34205523c121677cf55e891a681e9e4a1847ff29a8f440a427ebb9fa040f212b558c0932ad7f7e1115f48c52adcfbfb13ca9fe08f5507a74b04fee211674865f4ffa3f5cfba2fa7640a055efb6e848f4b6f9222bbe3b26a3721ddabc492c0586ca63fb03cc73007bef0e35606cfc629fa1c551eee50593712449e31c730042128ecdf57b35c79d040c6c23c663c5d30e2f3e711c8a9b9949814afee7117207a2d1c19c67d8edf72d997b3baa3ad5b700a8bf3c29d347094df4864bd4f4c234d5ef682b20f2664f7af13ec91c2490b0ddaff7cb2214d84a0a4486e6c51db48c21b6ef2bccf637bd589204716b019f976491ec9eedea1e67d48521a6e42cbc77c808e597a876226ba352c79e5f485ce3dd499f7eb22831a3951b70c5c869c90596fa211a1b9844c8a80e3fccaef546d08c4599f43b08bf198d8ed3b666088b191103f477bcf885bee9e280c9c126f1a2ddff0963ef5da8136f405dd5479e121fccbfa18c290acbeeff0000000000000073a3da5db87b29c6ee7d66d2340bc053b83d600b5aaab198965f691aa52be98fda0998bb6a330f54575429a3cb7dcca97db0cdf3a2f1003514b1c213875e5306feb23a152800000000000030000000000000000801000002000000d1cb82e1ba3f7b288450fd50da072eb1dd2d3d71fdbd35d588ac369a7700000000010000000000009c0100000300000014de4e11cc1b7b9c87cb283c35ed2161798d1ff02f43f9040dbd96a4a31979463a557b963633819542a4dbff22946796f56173f2dcfa3a07ab17cf12afccbad562e51b8730a884d42aec71e6a411d62fd76b05b7baf008f6b781fa2c381c42907a2298b01b9341a64fcba61b45edd16e32a049db6f7531740ee2cc5bdd533d3aae7f3c911dba00a82d4dc36159c1ea023056cb6ec7379e6c33461a2422a3e1639c833116b5480f74d4cf5b59450ec4f14c278f029e60700638a59e224a42760a4deac19e6f5ed15c79802ab0c7202996abfa04d7f13e7160dfeaae2f58574d96cf8a405acc4b8858290000000000000004d4e3d4dda403308953322775216f6f150bd8f3ae6dbd08e80596cc01006498cb8c72a8aa380eb105909c48af86b0f1222be3060fd3e2ff9adf966360ab56e80a4e029f283b4d12c38ef7c720a14f28973314ce7ae57dc3f230d55c067df1d694973732c410f4c2862531ac483b"], 0x700}, 0x40000) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r3, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000400)=""/179, 0xb3, 0x0, 0x2, 0x4}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000640)={0x2, 0x0, {&(0x7f0000001900)=""/4096, 0x1000, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r3, &(0x7f0000000100)={0x1, {&(0x7f00000007c0)=""/194, 0xc2, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r3, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000002b00)={0x2, 0x0, {&(0x7f0000000600)=""/13, 0xd, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r3, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) socket$alg(0x26, 0x5, 0x0) r4 = socket(0x2, 0x2, 0x1) bind$unix(r4, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) 206.864443ms ago: executing program 2 (id=2257): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="5c0100001000130700000000fcdbdf25e0000001000000000000000000000000ff02000000000000000000040000000100040b6e4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000004d632000000e0000002000000000000000000000000000000000000000000000000000000000100008000000000010000000000008001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f0000000000000000fdffffffffffffff0000000000000000000000002cbd70000035000002000000500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r1], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 0s ago: executing program 0 (id=2258): r0 = socket(0x1d, 0x2, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) bind$bt_hci(r1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000037c2000040042801c0001800600060080350000100015"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8927, &(0x7f0000000040)={'vxcan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r4, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) kernel console output (not intermixed with test programs): 66][T13078] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 651.009855][T13078] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 651.029598][ T5936] usb 4-1: USB disconnect, device number 77 [ 651.042865][T13075] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 651.235396][T13075] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.283268][T13075] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.330731][T11584] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.337830][T11584] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.376646][T13114] openvswitch: netlink: Flow actions attr not present in new flow. [ 651.428768][T11584] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.435926][T11584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 651.626231][T13117] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1852'. [ 651.749532][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 652.507411][T13075] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 653.238715][T11584] Bluetooth: (null): Invalid header checksum [ 653.668679][T11587] Bluetooth: (null): Invalid header checksum [ 653.674758][T11587] Bluetooth: (null): Invalid header checksum [ 653.706187][T11587] Bluetooth: (null): Invalid header checksum [ 653.723245][T11587] Bluetooth: (null): Invalid header checksum [ 653.803636][T13152] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 653.911945][T13075] veth0_vlan: entered promiscuous mode [ 653.924590][T13075] veth1_vlan: entered promiscuous mode [ 653.980233][ T30] audit: type=1400 audit(1773778429.621:572): avc: denied { bind } for pid=13157 comm="syz.1.1858" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 654.005142][T13075] veth0_macvtap: entered promiscuous mode [ 654.028631][T13075] veth1_macvtap: entered promiscuous mode [ 655.072181][T13075] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 655.119756][T13075] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 655.167400][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.193894][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.237978][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.283141][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.410932][T11587] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.426648][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 655.434768][T11587] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.495922][T11587] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.539437][T11587] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.561236][ T30] audit: type=1400 audit(1773778431.201:573): avc: denied { mounton } for pid=13075 comm="syz-executor" path="/root/syzkaller.CMeRuO/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 656.226505][T13182] netlink: 'syz.5.1843': attribute type 1 has an invalid length. [ 656.361068][ T30] audit: type=1400 audit(1773778431.561:574): avc: denied { mounton } for pid=13075 comm="syz-executor" path="/root/syzkaller.CMeRuO/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 656.399829][T13184] xt_TCPMSS: Only works on TCP SYN packets [ 656.603750][ T30] audit: type=1400 audit(1773778431.561:575): avc: denied { mounton } for pid=13075 comm="syz-executor" path="/root/syzkaller.CMeRuO/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=45586 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 656.743282][T13189] openvswitch: netlink: Flow actions attr not present in new flow. [ 657.064169][ T30] audit: type=1400 audit(1773778431.781:576): avc: denied { mounton } for pid=13075 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 658.082199][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 659.262681][ T9] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 659.406149][ T29] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 659.452300][ T9] usb 2-1: config 0 has no interfaces? [ 659.466309][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 659.503320][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.532706][ T9] usb 2-1: config 0 descriptor?? [ 659.566534][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 659.600744][ T29] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 659.638555][ T29] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 659.666681][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.708068][ T29] usb 1-1: Product: syz [ 659.712265][ T29] usb 1-1: Manufacturer: syz [ 659.729116][ T29] usb 1-1: SerialNumber: syz [ 659.747226][ T29] usb 1-1: config 0 descriptor?? [ 659.756958][ T29] usb 1-1: bad CDC descriptors [ 659.780478][ T29] usb 1-1: unsupported MDLM descriptors [ 659.790728][ T791] usb 2-1: USB disconnect, device number 72 [ 659.937949][T13213] loop5: detected capacity change from 0 to 7 [ 660.156052][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 660.156532][ T29] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 660.286727][ T791] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 660.510997][ T29] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 660.536853][ T29] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 660.554505][ T29] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 660.566284][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.583310][T13213] Dev loop5: unable to read RDB block 7 [ 660.596279][T13213] loop5: unable to read partition table [ 660.596651][ T29] usb 4-1: Product: syz [ 660.604098][T11737] usb 1-1: USB disconnect, device number 95 [ 660.606806][T13213] loop5: partition table beyond EOD, truncated [ 660.632339][ T29] usb 4-1: Manufacturer: syz [ 660.646481][ T29] usb 4-1: SerialNumber: syz [ 660.647850][ T791] usb 2-1: unable to get BOS descriptor or descriptor too short [ 660.651189][T13213] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 660.660870][ T791] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 660.703374][ T29] cdc_mbim 4-1:1.0: skipping garbage [ 660.753664][ T791] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 660.779268][ T791] usb 2-1: string descriptor 0 read error: -22 [ 660.794925][ T791] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 660.817283][ T791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.988807][T13224] netlink: 'syz.2.1875': attribute type 3 has an invalid length. [ 660.997387][T13224] netlink: 'syz.2.1875': attribute type 3 has an invalid length. [ 661.107289][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 661.219903][ T791] usb 2-1: Can't get UAC3 power state for id 10 [ 661.228817][ T791] usb 2-1: 2:0: failed to get current value for ch 0 (-71) [ 661.252321][ T791] usb 2-1: 2:0: cannot get min/max values for control 2 (id 2) [ 661.297500][T13211] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 661.347054][T13227] netlink: 'syz.1.1876': attribute type 3 has an invalid length. [ 661.355503][T13227] netlink: 'syz.1.1876': attribute type 3 has an invalid length. [ 661.439467][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 661.645220][ T9] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 661.667486][ T5885] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 661.695008][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 661.733152][ T9] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 661.746793][ T791] usb 2-1: USB disconnect, device number 73 [ 661.776693][ T9] usb 6-1: too many endpoints for config 1 interface 1 altsetting 1: 37, using maximum allowed: 30 [ 661.786669][T13230] netlink: 'syz.0.1877': attribute type 5 has an invalid length. [ 661.815472][ T9] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 661.849507][ T9] usb 6-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 661.866233][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.874393][ T9] usb 6-1: Product: syz [ 661.880694][ T9] usb 6-1: Manufacturer: syz [ 661.886328][ T9] usb 6-1: SerialNumber: syz [ 661.891115][ T5885] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 661.916699][ T5885] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 661.946645][ T5885] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 661.955800][ T5885] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 662.096830][ T5885] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 662.326350][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 662.513260][ T5885] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 662.527388][T13228] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 662.531752][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 662.537521][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 662.551337][ T6030] udevd[6030]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 662.567288][ T791] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 662.578584][ T9] usb 6-1: USB disconnect, device number 2 [ 662.595401][ T29] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 662.606808][ T5885] usb 3-1: Product: syz [ 662.615757][ T29] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 662.625366][ T5885] usb 3-1: Manufacturer: syz [ 662.648539][ T5885] cdc_wdm 3-1:1.0: skipping garbage [ 662.658267][ T5885] cdc_wdm 3-1:1.0: skipping garbage [ 662.663704][ T29] wwan wwan0: port wwan0mbim0 attached [ 662.683188][ T29] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 42:07:e3:6d:86:6f [ 662.697951][ T5885] cdc_wdm 3-1:1.0: cdc-wdm1: USB WDM device [ 662.704059][ T5885] cdc_wdm 3-1:1.0: Unknown control protocol [ 662.756390][ T791] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 662.814556][ C1] wdm_int_callback: 147 callbacks suppressed [ 662.814579][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.827245][ C1] wdm_int_callback: 147 callbacks suppressed [ 662.827264][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.844981][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.851689][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.852087][ T791] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 662.858571][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.874859][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.886673][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.893363][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.899575][ T791] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 662.900150][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.915175][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.921698][ T791] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 662.926583][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.939297][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.946932][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.953619][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.960293][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.966948][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.973633][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.980295][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 662.986929][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 662.993591][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 663.019688][ T791] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 663.070974][ T791] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 663.091183][T11737] usb 4-1: USB disconnect, device number 78 [ 663.117865][T11737] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 663.136144][ T791] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 663.144233][ T791] usb 2-1: Product: syz [ 663.289291][ T791] usb 2-1: Manufacturer: syz [ 663.330198][T11737] wwan wwan0: port wwan0mbim0 disconnected [ 663.338284][T13244] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 663.338577][ T791] cdc_wdm 2-1:1.0: skipping garbage [ 663.348426][T13244] overlayfs: missing 'lowerdir' [ 663.370232][ T791] cdc_wdm 2-1:1.0: skipping garbage [ 663.396240][ T9] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 663.511168][ T791] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 663.539926][ T791] cdc_wdm 2-1:1.0: Unknown control protocol [ 663.586921][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 663.601702][ T9] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 663.624975][ T9] usb 1-1: config 0 has no interface number 0 [ 663.635326][ T9] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 663.649218][ T9] usb 1-1: config 0 interface 196 has no altsetting 0 [ 663.661112][ T9] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 663.688277][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.704772][ T9] usb 1-1: Product: syz [ 663.711157][ T9] usb 1-1: Manufacturer: syz [ 663.720998][ T9] usb 1-1: SerialNumber: syz [ 663.740323][ T9] usb 1-1: config 0 descriptor?? [ 663.755672][T13240] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 664.423263][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 664.723286][T13264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 664.841361][T13264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 664.860190][ T29] usb 2-1: USB disconnect, device number 74 [ 664.868879][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 666.259841][T13283] ceph: No mds server is up or the cluster is laggy [ 666.503574][ T5936] libceph: connect (1)[c::]:6789 error -13 [ 666.514546][ T5936] libceph: mon0 (1)[c::]:6789 connect error [ 666.571522][ T791] usb 3-1: USB disconnect, device number 80 [ 666.616248][ T9] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 666.623840][ T9] ipheth 1-1:0.196: probe with driver ipheth failed with error -71 [ 666.755642][ T9] usb 1-1: USB disconnect, device number 96 [ 666.846797][ T5885] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 666.959607][ T30] audit: type=1326 audit(1773778442.601:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.2.1887" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4feb79c799 code=0x0 [ 667.036196][T11737] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 667.038075][ T5885] usb 2-1: New USB device found, idVendor=046d, idProduct=08b3, bcdDevice=ca.8e [ 667.069357][ T5885] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.016303][ T5898] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 668.031145][ T5885] pwc: Logitech QuickCam Zoom USB webcam detected. [ 668.086138][T11737] usb 6-1: Using ep0 maxpacket: 8 [ 668.098006][T11737] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 668.118382][T11737] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 668.148807][T11737] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 668.177418][T11737] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 668.191405][ T5898] usb 4-1: config 0 has no interfaces? [ 668.216177][T11737] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 668.216642][ T5898] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 668.271181][T11737] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.272191][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.333583][ T5898] usb 4-1: config 0 descriptor?? [ 668.594294][ T791] usb 4-1: USB disconnect, device number 79 [ 668.666173][ T9] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 668.702024][ T30] audit: type=1326 audit(1773778444.341:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.741612][ T30] audit: type=1326 audit(1773778444.341:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.795817][ T30] audit: type=1326 audit(1773778444.341:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=154 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.826949][T11737] usb 6-1: usb_control_msg returned -71 [ 668.832549][T11737] usbtmc 6-1:16.0: can't read capabilities [ 668.843647][ T30] audit: type=1326 audit(1773778444.341:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.871010][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 668.876368][ T30] audit: type=1326 audit(1773778444.341:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.902556][T11737] usb 6-1: USB disconnect, device number 3 [ 668.909102][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 668.922606][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 668.939042][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 668.953927][ T30] audit: type=1326 audit(1773778444.371:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.978737][ T9] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 668.979370][ T30] audit: type=1326 audit(1773778444.461:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 668.988235][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.995830][ T9] usb 3-1: config 0 descriptor?? [ 669.013126][ T30] audit: type=1326 audit(1773778444.461:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13296 comm="syz.5.1888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f4499c799 code=0x7ffc0000 [ 669.076184][ T791] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 669.228059][ T791] usb 4-1: unable to get BOS descriptor or descriptor too short [ 669.237425][ T791] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 669.276787][ T5885] pwc: Failed to set LED on/off time (-71) [ 669.283929][ T5885] pwc: send_video_command error -71 [ 669.295615][ T5885] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 669.312509][ T5885] Philips webcam 2-1:127.0: probe with driver Philips webcam failed with error -71 [ 669.333848][ T791] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 669.347199][ T2985] block nbd0: Possible stuck request ffff888027d20000: control (read@0,1024B). Runtime 60 seconds [ 669.359567][ T2985] block nbd0: Possible stuck request ffff888027d20200: control (read@1024,1024B). Runtime 60 seconds [ 669.360764][ T791] usb 4-1: string descriptor 0 read error: -22 [ 669.371699][ T2985] block nbd0: Possible stuck request ffff888027d20400: control (read@2048,1024B). Runtime 60 seconds [ 669.388083][ T2985] block nbd0: Possible stuck request ffff888027d20600: control (read@3072,1024B). Runtime 60 seconds [ 669.407890][ T5885] usb 2-1: USB disconnect, device number 75 [ 669.555169][ T9] hid_parser_main: 175 callbacks suppressed [ 669.555188][ T9] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 669.570389][ T791] usb 4-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 669.579608][ T9] microsoft 0003:045E:07DA.0020: ignoring exceeding usage max [ 669.587772][ T791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.614037][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0020/input/input53 [ 669.987493][ T5885] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 670.187130][ T9] microsoft 0003:045E:07DA.0020: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 670.298015][ T5885] usb 2-1: Using ep0 maxpacket: 16 [ 670.302698][ T791] usb 4-1: Can't get UAC3 power state for id 10 [ 670.307413][ T5885] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 670.326681][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.349890][ T5885] usb 2-1: Product: syz [ 670.354194][ T5885] usb 2-1: Manufacturer: syz [ 670.441630][ T5885] usb 2-1: SerialNumber: syz [ 670.647885][ T5885] usb 2-1: config 0 descriptor?? [ 670.858420][ T791] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 670.889678][ T791] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 670.994348][T13335] cgroup: Unknown subsys name 'subj_type' [ 671.122123][ T791] usb 4-1: USB disconnect, device number 80 [ 671.282014][ T5885] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 671.287083][ T9] usb 3-1: reset high-speed USB device number 81 using dummy_hcd [ 671.316449][ T5885] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 671.342587][ T5885] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 671.375499][ T5885] usb 2-1: media controller created [ 671.421616][ T5885] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 671.460499][ T5936] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 671.561635][ T5885] zl10353_read_register: readreg error (reg=127, ret==0) [ 671.574683][ T5885] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 671.594920][ T5885] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 671.627452][ T791] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 671.688400][ T5936] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 671.700564][ T5936] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 671.759931][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.804568][ T5936] usb 6-1: config 0 descriptor?? [ 671.821212][ T5936] pwc: Askey VC010 type 2 USB webcam detected. [ 671.826195][ T791] usb 4-1: Using ep0 maxpacket: 32 [ 671.838120][ T791] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 671.848123][ T791] usb 4-1: config 0 has no interface number 0 [ 671.854890][ T791] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 671.865623][ T791] usb 4-1: config 0 interface 196 has no altsetting 0 [ 671.881959][ T791] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 671.894947][ T791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.909399][ T791] usb 4-1: Product: syz [ 671.914172][ T791] usb 4-1: Manufacturer: syz [ 671.919983][ T791] usb 4-1: SerialNumber: syz [ 671.936808][ T791] usb 4-1: config 0 descriptor?? [ 671.947011][T13341] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 672.223258][ T5936] pwc: recv_control_msg error -32 req 02 val 2b00 [ 672.231421][ T5936] pwc: recv_control_msg error -32 req 02 val 2700 [ 672.242441][ T5936] pwc: recv_control_msg error -32 req 02 val 2c00 [ 672.262343][ T5936] pwc: recv_control_msg error -32 req 04 val 1000 [ 672.294568][ T5936] pwc: recv_control_msg error -32 req 04 val 1300 [ 672.307733][T11737] usb 3-1: USB disconnect, device number 81 [ 672.308199][ T5936] pwc: recv_control_msg error -32 req 04 val 1400 [ 672.337387][ T5936] pwc: recv_control_msg error -32 req 02 val 2000 [ 672.559458][ T11] block nbd256: Possible stuck request ffff888052d90000: control (read@0,1024B). Runtime 60 seconds [ 672.593336][ T11] block nbd256: Possible stuck request ffff888052d90200: control (read@1024,1024B). Runtime 60 seconds [ 672.604794][ T11] block nbd256: Possible stuck request ffff888052d90400: control (read@2048,1024B). Runtime 60 seconds [ 672.615952][ T11] block nbd256: Possible stuck request ffff888052d90600: control (read@3072,1024B). Runtime 60 seconds [ 672.692551][ T9] usb 2-1: USB disconnect, device number 76 [ 672.733826][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 672.788124][ T5936] pwc: recv_control_msg error -71 req 04 val 1500 [ 672.835075][ T5936] pwc: recv_control_msg error -71 req 02 val 2500 [ 672.904253][ T5936] pwc: recv_control_msg error -71 req 02 val 2400 [ 672.930698][ T5936] pwc: recv_control_msg error -71 req 02 val 2600 [ 673.015234][ T5936] pwc: recv_control_msg error -71 req 02 val 2900 [ 673.034593][ T5936] pwc: recv_control_msg error -71 req 02 val 2800 [ 673.069303][ T5936] pwc: recv_control_msg error -71 req 04 val 1100 [ 673.084381][ T5936] pwc: recv_control_msg error -71 req 04 val 1200 [ 673.181149][ T5936] pwc: Registered as video103. [ 673.212305][ T5936] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input54 [ 673.226358][ T791] ipheth 4-1:0.196: ipheth_enable_ncm: usb_control_msg: -110 [ 673.242940][ T5936] usb 6-1: USB disconnect, device number 4 [ 673.307924][ T791] ipheth 4-1:0.196: Apple iPhone USB Ethernet device attached [ 673.396902][ T5898] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 673.731772][ T5898] usb 2-1: config 0 has no interfaces? [ 673.738140][ T5898] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 673.748565][ T5898] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.767773][ T5898] usb 2-1: config 0 descriptor?? [ 674.432259][ T791] usb 4-1: USB disconnect, device number 81 [ 674.434797][ T5936] usb 2-1: USB disconnect, device number 77 [ 674.482895][ T5898] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 675.228111][ T791] ipheth 4-1:0.196: Apple iPhone USB Ethernet now disconnected [ 675.299685][T13405] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=13405 comm=syz.2.1910 [ 675.315777][T13405] PKCS7: Unknown OID: [4] 0.0.0.0(bad) [ 675.321878][T13405] PKCS7: Only support pkcs7_signedData type [ 675.332287][T13405] PM: Enabling pm_trace changes system date and time during resume. [ 675.332287][T13405] PM: Correct system time has to be restored manually after resume. [ 675.413385][ T5898] usb 6-1: Using ep0 maxpacket: 32 [ 675.435801][ T5898] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 675.550816][ T5898] usb 6-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 675.566918][ T5898] usb 6-1: config 0 interface 0 has no altsetting 0 [ 675.577023][ T5898] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 675.586954][ T5898] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.088410][T13368] overlayfs: statfs failed on './file0' [ 676.118961][ T5936] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 676.194140][ T5898] usb 6-1: Product: syz [ 676.199166][ T5898] usb 6-1: Manufacturer: syz [ 676.206697][ T5898] usb 6-1: SerialNumber: syz [ 676.213763][ T5898] usb 6-1: config 0 descriptor?? [ 676.887935][T13384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 676.906850][ T5936] usb 2-1: device descriptor read/64, error -71 [ 676.907242][T13384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 676.938432][T13381] team_slave_0: entered promiscuous mode [ 676.944240][T13381] team_slave_0: entered allmulticast mode [ 676.959376][T13381] netlink: 'syz.5.1907': attribute type 2 has an invalid length. [ 676.961673][T13384] netlink: 'syz.5.1907': attribute type 2 has an invalid length. [ 677.012390][ T5898] gs_usb 6-1:0.0: Configuring for 1 interfaces [ 677.182662][ T5936] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 677.222166][T13381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 677.249423][T13381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 677.258543][T13431] fuse: Unknown parameter '0x0000000000000004' [ 677.337835][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 677.353921][ T5936] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 677.406769][ T5936] usb 2-1: config 0 has no interface number 0 [ 677.444427][ T5936] usb 2-1: config 0 interface 184 has no altsetting 0 [ 677.463761][ T5936] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 677.473483][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.673466][ T5936] usb 2-1: Product: syz [ 677.685913][ T5936] usb 2-1: Manufacturer: syz [ 677.704574][ T5936] usb 2-1: SerialNumber: syz [ 677.718761][ T30] audit: type=1400 audit(1773778453.351:586): avc: denied { mount } for pid=13430 comm="syz.0.1917" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 677.748089][ T5936] usb 2-1: config 0 descriptor?? [ 677.755763][ T30] audit: type=1400 audit(1773778453.351:587): avc: denied { search } for pid=13430 comm="syz.0.1917" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 677.800479][ T30] audit: type=1400 audit(1773778453.351:588): avc: denied { search } for pid=13430 comm="syz.0.1917" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 677.826277][T11737] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 677.900466][ T30] audit: type=1400 audit(1773778453.351:589): avc: denied { search } for pid=13430 comm="syz.0.1917" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 678.098874][ T5898] gs_usb 6-1:0.0: Couldn't get bit timing const for channel 0 (-ETIMEDOUT) [ 678.143765][ T5898] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -110 [ 678.427590][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 678.452428][ T5898] usb 6-1: USB disconnect, device number 5 [ 678.521687][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 679.234222][T11737] usb 3-1: config index 0 descriptor too short (expected 8192, got 18) [ 679.246583][T11737] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 679.257075][T11737] usb 3-1: config 0 has no interfaces? [ 679.263220][T11737] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 679.272777][T11737] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 679.292863][T11737] usb 3-1: config 0 descriptor?? [ 679.467522][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 680.026769][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 680.096848][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 680.175905][ T5936] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 680.229384][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.235754][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.833448][ T5936] usb 2-1: USB disconnect, device number 79 [ 682.510965][T10069] usb 3-1: USB disconnect, device number 82 [ 683.395196][T13500] netlink: 'syz.1.1928': attribute type 39 has an invalid length. [ 683.686856][T13504] netlink: 27 bytes leftover after parsing attributes in process `syz.0.1932'. [ 683.706743][T10069] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 683.729630][T13497] input: syz1 as /devices/virtual/input/input55 [ 683.739608][T13504] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1932'. [ 683.869702][T10069] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 683.886666][T10069] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.905241][T10069] usb 3-1: Product: syz [ 683.926677][T10069] usb 3-1: Manufacturer: syz [ 683.931639][T10069] usb 3-1: SerialNumber: syz [ 683.946496][T11737] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 683.958972][T10069] usb 3-1: config 0 descriptor?? [ 683.981375][T10069] hub 3-1:0.0: bad descriptor, ignoring hub [ 684.005612][T13514] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=13514 comm=syz.0.1934 [ 684.021842][T10069] hub 3-1:0.0: probe with driver hub failed with error -5 [ 684.054575][T13514] PKCS7: Unknown OID: [4] 0.0.0.0(bad) [ 684.060733][T13514] PKCS7: Only support pkcs7_signedData type [ 684.072030][T13514] PM: Enabling pm_trace changes system date and time during resume. [ 684.072030][T13514] PM: Correct system time has to be restored manually after resume. [ 684.226290][T11737] usb 4-1: Using ep0 maxpacket: 32 [ 684.232962][T11737] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 684.241724][T11737] usb 4-1: config 0 has no interface number 0 [ 684.245431][T13495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 684.248315][T11737] usb 4-1: config 0 interface 184 has no altsetting 0 [ 684.250032][T11737] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 684.277650][T13495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 684.299252][T13516] veth1_virt_wifi: default FDB implementation only supports local addresses [ 684.551494][T13520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1937'. [ 684.560722][T13520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1937'. [ 684.605584][T11737] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 684.652211][T10069] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 684.720464][T11737] usb 4-1: Product: syz [ 684.735928][T10069] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 685.152779][T11737] usb 4-1: Manufacturer: syz [ 685.173634][T11737] usb 4-1: SerialNumber: syz [ 685.203498][T11737] usb 4-1: config 0 descriptor?? [ 685.232028][T10069] dib0700: firmware download failed at 7 with -22 [ 685.291733][T10069] usb 3-1: USB disconnect, device number 83 [ 685.459712][T13527] syzkaller0: entered promiscuous mode [ 685.516195][T13527] syzkaller0: entered allmulticast mode [ 685.849589][T11737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 685.862788][T11737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 686.875171][T11737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 686.905544][T11737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 686.967547][T11737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 687.003143][T11737] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -32 [ 687.042800][T11737] usb 4-1: USB disconnect, device number 82 [ 687.254470][T13553] netlink: 'syz.2.1946': attribute type 7 has an invalid length. [ 687.916737][ T5936] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 688.038051][ T30] audit: type=1400 audit(1773778463.681:590): avc: denied { write } for pid=13562 comm="syz.3.1949" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 688.208250][T13567] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=65539 (131078 ns) > initial count (2 ns). Using initial count to start timer. [ 688.489456][ T5936] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 688.506591][ T5936] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 688.518101][ T5936] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 688.527744][ T5936] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 688.539695][ T5936] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 688.578396][ T5936] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 688.595351][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 688.617550][ T5936] usb 1-1: Product: syz [ 688.630112][ T5936] usb 1-1: Manufacturer: syz [ 688.650025][T13570] netdevsim netdevsim5 netdevsim0: IPsec offload requires 128 bit authentication [ 688.660498][ T5936] cdc_wdm 1-1:1.0: skipping garbage [ 688.665704][ T5936] cdc_wdm 1-1:1.0: skipping garbage [ 688.672355][ T5936] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 688.678888][ T5936] cdc_wdm 1-1:1.0: Unknown control protocol [ 690.905817][T13559] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 691.437365][T10069] usb 1-1: USB disconnect, device number 97 [ 691.577949][T13598] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1957'. [ 691.636953][T13598] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 691.683799][T13598] tipc: Started in network mode [ 691.689050][T13598] tipc: Node identity ac14140f, cluster identity 4711 [ 691.696321][T13598] tipc: New replicast peer: 255.255.255.255 [ 691.704305][T13598] tipc: Enabled bearer , priority 10 [ 692.076135][ T791] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 692.356374][T10069] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 692.526206][ T791] usb 6-1: device descriptor read/64, error -71 [ 692.549594][T10069] usb 3-1: Using ep0 maxpacket: 32 [ 692.571888][T10069] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 692.589548][T10069] usb 3-1: config 0 has no interface number 0 [ 692.617846][T10069] usb 3-1: config 0 interface 184 has no altsetting 0 [ 692.638466][T10069] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 692.649623][T10069] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.746597][T10069] usb 3-1: Product: syz [ 692.750806][T10069] usb 3-1: Manufacturer: syz [ 692.792109][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 693.187727][ T791] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 693.201846][T11737] tipc: Node number set to 2886997007 [ 693.593961][T10069] usb 3-1: SerialNumber: syz [ 693.625516][T10069] usb 3-1: config 0 descriptor?? [ 693.826986][ T9] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 693.987059][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 693.998070][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 694.015603][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 694.028940][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 694.046617][ T9] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 694.070110][ T9] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 694.079922][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.126308][T11748] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 694.308430][ T9] usb 4-1: GET_CAPABILITIES returned 0 [ 694.314267][T11748] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 694.315091][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 694.323744][ T9] usbtmc 4-1:16.0: can't read capabilities [ 694.361181][T11748] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 694.371955][T11748] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 694.382200][T11748] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 694.394169][T11748] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 694.405768][T11748] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 694.539734][T13631] vxcan1: tx drop: invalid sa for name 0xfffffffffffffffe [ 695.186661][T11748] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 695.195856][T11748] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 695.204049][T11748] usb 2-1: Product: syz [ 695.208547][T11748] usb 2-1: Manufacturer: syz [ 695.227853][T13625] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 695.236475][T11748] cdc_wdm 2-1:1.0: skipping garbage [ 695.241690][T11748] cdc_wdm 2-1:1.0: skipping garbage [ 695.276196][T11748] cdc_wdm 2-1:1.0: cdc-wdm1: USB WDM device [ 695.288277][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 695.300638][T11748] cdc_wdm 2-1:1.0: Unknown control protocol [ 695.336529][T11748] usb 4-1: USB disconnect, device number 83 [ 695.346977][ T5885] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 695.355462][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 695.376650][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 695.387197][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 695.419262][T10069] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 695.532517][T11737] usb 2-1: USB disconnect, device number 80 [ 695.534280][T10069] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 696.236926][ T5885] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 696.257926][ T5885] usb 6-1: config 1 has no interface number 0 [ 696.264106][ T5885] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 696.281572][T10069] usb 3-1: USB disconnect, device number 84 [ 696.288386][T13649] netlink: 2028 bytes leftover after parsing attributes in process `syz.1.1966'. [ 696.298220][T13649] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1966'. [ 696.359915][ T5885] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 696.391506][ T5885] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 104 [ 696.481670][ T5885] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 696.752161][ T791] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 696.776827][ T5885] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 696.811764][ T5885] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.829663][ T5885] usb 6-1: Product: syz [ 696.864230][ T5885] usb 6-1: Manufacturer: syz [ 696.887616][ T5885] usb 6-1: SerialNumber: syz [ 696.904722][T13663] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=13663 comm=syz.1.1973 [ 696.918798][T13663] PKCS7: Unknown OID: [4] 0.0.0.0(bad) [ 696.924348][T13663] PKCS7: Only support pkcs7_signedData type [ 696.953238][T13663] PM: Enabling pm_trace changes system date and time during resume. [ 696.953238][T13663] PM: Correct system time has to be restored manually after resume. [ 697.332313][ T5885] usb 6-1: can't set config #1, error -71 [ 697.335656][ T791] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 697.410988][ T5885] usb 6-1: USB disconnect, device number 8 [ 697.635810][T13667] lo speed is unknown, defaulting to 1000 [ 697.745041][ T791] usb 1-1: config 1 has no interface number 0 [ 697.752481][ T791] usb 1-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 697.769456][ T791] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 697.779356][ T791] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 104 [ 697.789283][ T791] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 697.836894][ T791] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 697.846028][ T791] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.875368][T13669] binder: BINDER_SET_CONTEXT_MGR already set [ 697.882832][T13669] binder: 13668:13669 ioctl 4018620d 200000000040 returned -16 [ 697.891252][T13669] binder: 13668:13669 ioctl 4147 0 returned -22 [ 697.906380][ T791] usb 1-1: Product: syz [ 697.910633][ T791] usb 1-1: Manufacturer: syz [ 697.915303][ T791] usb 1-1: SerialNumber: syz [ 697.995045][T13671] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 698.052057][T13650] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 698.059882][T13650] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 698.088630][ T30] audit: type=1400 audit(1773778473.681:591): avc: denied { accept } for pid=13672 comm="syz.5.1978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 699.076237][T11748] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 699.176788][T10069] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 699.471688][T11748] usb 6-1: Using ep0 maxpacket: 32 [ 699.487647][T11748] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 699.496351][T11748] usb 6-1: config 0 has no interface number 0 [ 699.509054][T11748] usb 6-1: config 0 interface 184 has no altsetting 0 [ 699.516822][ T2985] block nbd0: Possible stuck request ffff888027d20000: control (read@0,1024B). Runtime 90 seconds [ 699.518370][T11748] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 699.527593][ T2985] block nbd0: Possible stuck request ffff888027d20200: control (read@1024,1024B). Runtime 90 seconds [ 699.548025][ T2985] block nbd0: Possible stuck request ffff888027d20400: control (read@2048,1024B). Runtime 90 seconds [ 699.566739][ T2985] block nbd0: Possible stuck request ffff888027d20600: control (read@3072,1024B). Runtime 90 seconds [ 699.591223][ T791] usb 1-1: Error in usbnet_get_endpoints (-71) [ 699.620952][T11748] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.644382][ T791] usb 1-1: USB disconnect, device number 98 [ 699.656693][T10069] usb 2-1: Using ep0 maxpacket: 16 [ 699.671169][T11748] usb 6-1: Product: syz [ 699.671224][T10069] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 699.696646][T10069] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 699.716561][T10069] usb 2-1: config 0 interface 0 has no altsetting 0 [ 699.723271][T10069] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 699.733000][T10069] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.736662][T11748] usb 6-1: Manufacturer: syz [ 699.762466][T11748] usb 6-1: SerialNumber: syz [ 699.829443][T11748] usb 6-1: config 0 descriptor?? [ 699.830667][T10069] usb 2-1: config 0 descriptor?? [ 700.780497][T11748] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 700.801698][T11748] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 701.016322][T13695] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 701.339024][T10069] usbhid 2-1:0.0: can't add hid device: -71 [ 701.346774][T10069] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 701.372311][T10069] usb 2-1: USB disconnect, device number 81 [ 701.523609][T11748] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 701.536521][T11748] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 701.546918][T11748] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 701.571809][T11748] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -32 [ 701.592274][T11748] usb 6-1: USB disconnect, device number 9 [ 701.806851][ T29] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 701.973631][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 701.985618][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 702.024607][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 702.267977][ T29] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 702.270586][T13712] kvm: pic: non byte write [ 702.320053][ T29] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 702.329675][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.455576][ T29] usb 1-1: config 0 descriptor?? [ 702.476869][T13724] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=13724 comm=syz.1.1991 [ 702.891386][ T11] block nbd256: Possible stuck request ffff888052d90000: control (read@0,1024B). Runtime 90 seconds [ 702.902346][ T11] block nbd256: Possible stuck request ffff888052d90200: control (read@1024,1024B). Runtime 90 seconds [ 702.913502][ T11] block nbd256: Possible stuck request ffff888052d90400: control (read@2048,1024B). Runtime 90 seconds [ 702.925184][ T11] block nbd256: Possible stuck request ffff888052d90600: control (read@3072,1024B). Runtime 90 seconds [ 703.007036][T13727] PKCS7: Unknown OID: [4] 0.0.0.0(bad) [ 703.022332][T13727] PKCS7: Only support pkcs7_signedData type [ 703.076933][T13724] PM: Enabling pm_trace changes system date and time during resume. [ 703.076933][T13724] PM: Correct system time has to be restored manually after resume. [ 703.127017][ T29] HID 045e:07da: Invalid code 65791 type 1 [ 703.453441][ T29] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0021/input/input56 [ 703.521240][T13734] random: crng reseeded on system resumption [ 703.993583][ T29] microsoft 0003:045E:07DA.0021: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 704.754073][ T5936] usb 1-1: USB disconnect, device number 99 [ 705.123242][T13748] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1997'. [ 705.132421][T13748] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 705.170471][T13748] tipc: Enabling of bearer rejected, already enabled [ 706.371653][T13761] could not allocate digest TFM handle sha224-asm [ 707.155368][T13785] geneve1: entered allmulticast mode [ 707.156599][ T5936] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 707.459955][ T5936] usb 2-1: unable to get BOS descriptor or descriptor too short [ 707.589022][ T5936] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 708.082447][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.091776][ T5936] usb 2-1: Product: syz [ 708.095948][ T5936] usb 2-1: Manufacturer: syz [ 708.150675][ T5936] usb 2-1: SerialNumber: syz [ 708.430856][T13799] netlink: 'syz.5.2011': attribute type 1 has an invalid length. [ 708.451631][ T5936] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 708.825069][T13801] syzkaller0: entered promiscuous mode [ 708.830807][T13801] syzkaller0: entered allmulticast mode [ 708.846239][ T5936] usb 2-1: MIDIStreaming interface descriptor not found [ 708.958238][ T5936] usb 2-1: USB disconnect, device number 82 [ 709.138930][ T791] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 709.600384][ T791] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 709.650170][ T791] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 709.680084][ T791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.701631][ T791] usb 3-1: Product: syz [ 709.732802][T13816] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=13816 comm=syz.0.2014 [ 709.756907][T13814] PKCS7: Unknown OID: [4] 0.0.0.0(bad) [ 709.762413][T13814] PKCS7: Only support pkcs7_signedData type [ 709.846830][ T791] usb 3-1: Manufacturer: syz [ 709.851555][ T791] usb 3-1: SerialNumber: syz [ 709.925819][ T791] usb 3-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 710.348610][ T791] usb 3-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 710.370177][ T791] usb 3-1: USB disconnect, device number 85 [ 710.421689][T11748] libceph: connect (1)[c::]:6789 error -101 [ 710.428949][T11748] libceph: mon0 (1)[c::]:6789 connect error [ 710.570381][T13824] ceph: No mds server is up or the cluster is laggy [ 710.604790][ T143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 710.622745][ T143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 710.632117][T13824] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2018'. [ 710.641644][T13824] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2018'. [ 710.706568][ T791] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 710.868986][ T791] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 710.891908][ T791] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 710.913498][ T791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.933787][ T791] usb 3-1: Product: syz [ 710.943351][ T791] usb 3-1: Manufacturer: syz [ 710.958961][ T791] usb 3-1: SerialNumber: syz [ 711.026058][ T791] usb 3-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 711.544075][ T791] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 712.655538][ T791] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 712.666538][ T791] usb 3-1: media controller created [ 712.686648][ T791] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 713.692700][ T791] usb 3-1: USB disconnect, device number 86 [ 714.497374][T13884] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 714.756179][T11737] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 715.239675][T11737] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 715.265053][T11737] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.328888][T11737] usb 3-1: Product: syz [ 715.346131][T11737] usb 3-1: Manufacturer: syz [ 715.350763][T11737] usb 3-1: SerialNumber: syz [ 715.390482][T11737] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 715.420328][T11748] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 716.394305][ T9] usb 3-1: USB disconnect, device number 87 [ 716.415379][ T30] audit: type=1400 audit(1773778492.051:592): avc: denied { setopt } for pid=13910 comm="syz.1.2038" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 716.708679][ T6613] kworker/1:7 (6613) used greatest stack depth: 18104 bytes left [ 716.725930][T11748] usb 3-1: Service connection timeout for: 256 [ 716.766289][T11748] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 716.775203][T11748] ath9k_htc: Failed to initialize the device [ 716.790599][ T9] usb 3-1: ath9k_htc: USB layer deinitialized [ 719.721545][ T9] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 721.125554][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 721.148477][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 721.166735][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.186657][ T9] usb 4-1: config 0 descriptor?? [ 722.081341][T13974] netdevsim netdevsim5 netdevsim0: IPsec offload requires 128 bit authentication [ 722.434383][T13980] fuse: Unknown parameter 'rooY' [ 722.685076][T13982] /dev/nullb0: Can't open blockdev [ 723.470724][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 723.487987][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 723.490129][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 723.581452][ T9] usb 4-1: USB disconnect, device number 84 [ 724.117434][T13996] fuse: Unknown parameter '0x00000000000000030x0000000000000003' [ 724.481643][T14003] kAFS: unparsable volume name [ 724.494195][ T30] audit: type=1400 audit(1773778500.131:593): avc: denied { write } for pid=14005 comm="syz.1.2063" name="file0" dev="tmpfs" ino=2125 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 724.577411][ T30] audit: type=1400 audit(1773778500.161:594): avc: denied { open } for pid=14005 comm="syz.1.2063" path="/400/file0" dev="tmpfs" ino=2125 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 724.651324][ T30] audit: type=1400 audit(1773778500.161:595): avc: denied { ioctl } for pid=14005 comm="syz.1.2063" path="/400/file0" dev="tmpfs" ino=2125 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 724.874924][T14015] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2064'. [ 724.883898][T14015] openvswitch: netlink: Flow key attr not present in new flow. [ 725.155523][T14017] netlink: 'syz.1.2065': attribute type 3 has an invalid length. [ 725.163703][T14017] netlink: 'syz.1.2065': attribute type 3 has an invalid length. [ 725.455821][T14021] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2066'. [ 725.464938][T14021] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 725.482952][T14021] tipc: Enabling of bearer rejected, already enabled [ 726.136695][T14025] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 726.158341][T14025] PM: Enabling pm_trace changes system date and time during resume. [ 726.158341][T14025] PM: Correct system time has to be restored manually after resume. [ 726.397776][T14029] 9pnet_fd: Insufficient options for proto=fd [ 726.428308][T14017] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 726.686726][ T5936] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 726.696692][ T29] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 727.486846][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 727.816654][ T5885] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 727.956638][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 727.964927][ T5936] usb 6-1: Using ep0 maxpacket: 32 [ 727.972012][ T29] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 727.981544][ T5936] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 727.990643][ T29] usb 4-1: config 0 has no interface number 0 [ 727.997377][ T5936] usb 6-1: config 0 has no interface number 0 [ 728.003463][ T5936] usb 6-1: config 0 interface 184 has no altsetting 0 [ 728.011308][ T29] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 728.022309][ T29] usb 4-1: config 0 interface 196 has no altsetting 0 [ 728.024098][ T5936] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 728.041001][ T5936] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.049983][ T5936] usb 6-1: Product: syz [ 728.054860][ T5936] usb 6-1: Manufacturer: syz [ 728.060308][ T5936] usb 6-1: SerialNumber: syz [ 728.066603][ T29] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 728.076585][ T5885] usb 2-1: device descriptor read/64, error -71 [ 728.085767][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.099362][ T29] usb 4-1: Product: syz [ 728.106531][ T29] usb 4-1: Manufacturer: syz [ 728.111263][ T29] usb 4-1: SerialNumber: syz [ 728.123650][ T5936] usb 6-1: config 0 descriptor?? [ 728.132875][ T29] usb 4-1: config 0 descriptor?? [ 728.154905][T14029] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 728.316510][ T5885] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 728.457386][ T5885] usb 2-1: device descriptor read/64, error -71 [ 728.632667][ T5885] usb usb2-port1: attempt power cycle [ 728.977032][ T5885] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 729.055867][ T5936] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 729.089708][ T5936] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 729.105606][ T5885] usb 2-1: device descriptor read/8, error -71 [ 729.382202][ T5885] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 729.407259][ T5885] usb 2-1: device descriptor read/8, error -71 [ 729.453280][T14052] random: crng reseeded on system resumption [ 729.517137][ T5885] usb usb2-port1: unable to enumerate USB device [ 729.591611][T14059] netlink: 'syz.2.2078': attribute type 3 has an invalid length. [ 729.600876][T14059] netlink: 'syz.2.2078': attribute type 3 has an invalid length. [ 729.727667][ T5936] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 729.738930][ T5936] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 729.749105][ T5936] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 729.761390][ T5936] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -61 [ 729.806747][ T5924] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 729.896828][ T29] ipheth 4-1:0.196: ipheth_enable_ncm: usb_control_msg: -110 [ 729.923900][ T29] ipheth 4-1:0.196: Apple iPhone USB Ethernet device attached [ 729.966471][ T9] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 729.996538][ T5924] usb 1-1: Using ep0 maxpacket: 16 [ 730.008442][ T5924] usb 1-1: config 3 has an invalid interface number: 114 but max is 0 [ 730.025867][ T5924] usb 1-1: config 3 has no interface number 0 [ 730.033530][ T5924] usb 1-1: config 3 interface 114 has no altsetting 0 [ 730.052312][ T5924] usb 1-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice= d.d3 [ 730.072739][ T5924] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.083704][ T5924] usb 1-1: Product: syz [ 730.093851][ T5924] usb 1-1: Manufacturer: syz [ 730.099236][ T5924] usb 1-1: SerialNumber: syz [ 730.147353][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 730.160020][ T2985] block nbd0: Possible stuck request ffff888027d20000: control (read@0,1024B). Runtime 120 seconds [ 730.171282][ T2985] block nbd0: Possible stuck request ffff888027d20200: control (read@1024,1024B). Runtime 120 seconds [ 730.182802][ T2985] block nbd0: Possible stuck request ffff888027d20400: control (read@2048,1024B). Runtime 120 seconds [ 730.194554][ T2985] block nbd0: Possible stuck request ffff888027d20600: control (read@3072,1024B). Runtime 120 seconds [ 730.207085][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 730.226661][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 730.254484][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 730.275813][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 730.305404][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 730.342653][ T5924] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 730.366343][ T5924] gspca_sn9c2028: read1 error -71 [ 730.372050][ T5924] gspca_sn9c2028: read1 error -71 [ 730.377627][ T5924] gspca_sn9c2028: read1 error -71 [ 730.377700][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 730.392937][ T5924] sn9c2028 1-1:3.114: probe with driver sn9c2028 failed with error -71 [ 730.415366][ T5924] usb 1-1: USB disconnect, device number 100 [ 730.423246][ T9] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 730.443108][ T9] usb 2-1: Manufacturer: syz [ 730.452208][ T9] usb 2-1: config 0 descriptor?? [ 730.703401][ T29] usb 4-1: USB disconnect, device number 85 [ 730.756297][ T9] rc_core: IR keymap rc-hauppauge not found [ 730.767147][ T9] Registered IR keymap rc-empty [ 730.772118][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 730.813141][ T5936] usb 6-1: USB disconnect, device number 10 [ 730.816176][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 730.860463][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 730.905018][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input57 [ 731.028297][T14089] netlink: 6364 bytes leftover after parsing attributes in process `syz.3.2082'. [ 731.030077][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.096222][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.170865][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.214746][ T29] ipheth 4-1:0.196: Apple iPhone USB Ethernet now disconnected [ 731.226911][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.291154][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.326899][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.359060][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.396176][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.482255][ T30] audit: type=1400 audit(1773778507.071:596): avc: denied { mounton } for pid=14108 comm="syz.5.2087" path="/51/file0" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 731.510846][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 731.527189][ T30] audit: type=1400 audit(1773778507.071:597): avc: denied { read } for pid=14108 comm="syz.5.2087" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 731.829695][ T30] audit: type=1400 audit(1773778507.071:598): avc: denied { read } for pid=14108 comm="syz.5.2087" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 731.995236][ T30] audit: type=1400 audit(1773778507.071:599): avc: denied { open } for pid=14108 comm="syz.5.2087" path="/51/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 732.096478][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 732.117740][ T9] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 732.144479][ T30] audit: type=1400 audit(1773778507.071:600): avc: denied { read } for pid=14108 comm="syz.5.2087" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 732.177663][ T9] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 732.199882][ T9] usb 2-1: USB disconnect, device number 87 [ 732.208427][ T30] audit: type=1400 audit(1773778507.071:601): avc: denied { read } for pid=14108 comm="syz.5.2087" name="/" dev="configfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 732.377068][ T30] audit: type=1400 audit(1773778508.021:602): avc: denied { unmount } for pid=13075 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 733.372104][ T11] block nbd256: Possible stuck request ffff888052d90000: control (read@0,1024B). Runtime 120 seconds [ 733.384527][ T11] block nbd256: Possible stuck request ffff888052d90200: control (read@1024,1024B). Runtime 120 seconds [ 733.396554][ T11] block nbd256: Possible stuck request ffff888052d90400: control (read@2048,1024B). Runtime 120 seconds [ 733.407774][ T11] block nbd256: Possible stuck request ffff888052d90600: control (read@3072,1024B). Runtime 120 seconds [ 733.836147][ T5936] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 734.016740][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 734.050698][ T5936] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 734.072523][ T5936] usb 2-1: config 0 has no interface number 0 [ 734.110243][ T5936] usb 2-1: config 0 interface 184 has no altsetting 0 [ 734.140560][ T5936] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 734.191341][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.211563][ T5936] usb 2-1: Product: syz [ 734.259839][ T5936] usb 2-1: Manufacturer: syz [ 734.296847][ T5936] usb 2-1: SerialNumber: syz [ 734.328380][ T5936] usb 2-1: config 0 descriptor?? [ 734.550559][ T29] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 734.607649][ T9] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 734.729717][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.744114][ T29] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 734.753838][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.776694][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.777713][ T29] usb 6-1: config 0 descriptor?? [ 734.833514][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 734.886274][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.936322][T14180] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2096'. [ 734.949754][ T9] usb 4-1: config 0 descriptor?? [ 734.963715][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 734.976305][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 735.359495][ T29] keytouch 0003:0926:3333.0022: fixing up Keytouch IEC report descriptor [ 735.416812][ T29] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0022/input/input59 [ 735.630196][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 735.641743][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 735.706714][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 735.724132][ T29] keytouch 0003:0926:3333.0022: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 735.827704][ T5936] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 736.127562][T11737] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 736.351560][T11737] usb 1-1: Using ep0 maxpacket: 32 [ 736.365245][T11737] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 736.375174][T11737] usb 1-1: config 0 has no interface number 0 [ 736.384951][T11737] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 736.401800][ T30] audit: type=1400 audit(1773778512.041:603): avc: denied { bind } for pid=14197 comm="syz.2.2101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 736.410325][T11737] usb 1-1: config 0 interface 196 has no altsetting 0 [ 736.469050][ T30] audit: type=1400 audit(1773778512.041:604): avc: denied { ioctl } for pid=14197 comm="syz.2.2101" path="socket:[50822]" dev="sockfs" ino=50822 ioctlcmd=0x5869 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 736.470101][T11737] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 736.528139][T11737] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.541378][T11737] usb 1-1: Product: syz [ 736.545645][T11737] usb 1-1: Manufacturer: syz [ 736.553224][T11737] usb 1-1: SerialNumber: syz [ 736.604470][T11737] usb 1-1: config 0 descriptor?? [ 736.645533][T14196] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 736.875639][ T29] usb 2-1: USB disconnect, device number 88 [ 737.252200][T14212] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.264243][T14212] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 737.822260][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 737.832163][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 737.909764][ T9] usb 4-1: USB disconnect, device number 86 [ 738.043105][T14220] : renamed from vlan0 [ 739.795924][ T5936] usb 6-1: USB disconnect, device number 11 [ 739.947227][T11737] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 739.978279][T11737] ipheth 1-1:0.196: probe with driver ipheth failed with error -71 [ 740.004895][T14230] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2109'. [ 740.078035][T11737] usb 1-1: USB disconnect, device number 101 [ 740.426141][ T5924] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 740.437767][ T5898] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 740.599586][ T5924] usb 4-1: config 1 interface 0 has no altsetting 0 [ 740.827839][ T5898] usb 6-1: Using ep0 maxpacket: 8 [ 740.851790][ T5924] usb 4-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.40 [ 740.876214][ T5924] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.905949][ T5924] usb 4-1: Product: syz [ 740.908649][ T5898] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 740.910974][ T5924] usb 4-1: Manufacturer: 枵ԏ傈ㆬ덊쉗윉ᮕ⅙೑ﵧঝ돜否锇﻽㱰异쐵魂쎟♵聚㝫㹀魇♓塊琉㨡䥒⺦෌飼삷䋳䪋疻爔ﶴ䬇沔룂ꜜ租꟒⶘暙듲ꃪ⍣컯旑谼ꪓ⮄ᭊ໑완銚ﳴ뺾錑໨㛟ᕮ踨盥ἶ䗈妘㢢徃ᔃ簫雌┺穙莰굕밮૊ꃕ㷝嬢畑鸼痜ၫꅗ쨜馤櫘㨖옃ワオ䞆闰 [ 741.006972][ T5898] usb 6-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 741.016096][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.038756][ T5898] usb 6-1: config 0 descriptor?? [ 741.046629][ T5924] usb 4-1: SerialNumber: syz [ 741.054135][ T5898] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 741.062344][ T5924] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 741.079337][ T5924] usb 4-1: no configuration chosen from 1 choice [ 741.087525][T14246] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 741.146119][T11737] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 741.297638][T11737] usb 3-1: Using ep0 maxpacket: 32 [ 741.304490][T11737] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 741.387893][T11737] usb 3-1: config 0 has no interface number 0 [ 741.418077][T11737] usb 3-1: config 0 interface 184 has no altsetting 0 [ 741.578392][T11737] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 741.636190][T11737] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.644206][T11737] usb 3-1: Product: syz [ 741.670588][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 741.677139][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 741.690406][T11737] usb 3-1: Manufacturer: syz [ 741.696694][T11737] usb 3-1: SerialNumber: syz [ 741.705667][ T30] audit: type=1400 audit(1773778517.341:605): avc: denied { accept } for pid=14229 comm="syz.5.2109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 741.726985][ T9] usb 6-1: USB disconnect, device number 12 [ 741.748650][T11737] usb 3-1: config 0 descriptor?? [ 741.896708][ T5898] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 742.048423][ T5898] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 742.068415][ T5898] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 742.100595][ T5898] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.124299][ T5898] usb 2-1: config 0 descriptor?? [ 742.273224][ T30] audit: type=1400 audit(1773778517.911:606): avc: denied { read write } for pid=13075 comm="syz-executor" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 742.340376][ T30] audit: type=1400 audit(1773778517.951:607): avc: denied { open } for pid=13075 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 742.365533][ T30] audit: type=1400 audit(1773778517.951:608): avc: denied { ioctl } for pid=13075 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 742.366678][T11737] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 742.459331][T14261] FAULT_INJECTION: forcing a failure. [ 742.459331][T14261] name failslab, interval 1, probability 0, space 0, times 0 [ 742.496133][T14261] CPU: 0 UID: 0 PID: 14261 Comm: syz.5.2117 Tainted: G L syzkaller #0 PREEMPT(full) [ 742.496163][T14261] Tainted: [L]=SOFTLOCKUP [ 742.496169][T14261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 742.496180][T14261] Call Trace: [ 742.496186][T14261] [ 742.496193][T14261] dump_stack_lvl+0x100/0x190 [ 742.496224][T14261] should_fail_ex.cold+0x5/0xa [ 742.496247][T14261] should_failslab+0xc2/0x120 [ 742.496264][T14261] __kvmalloc_node_noprof+0xfa/0xa00 [ 742.496289][T14261] ? xt_alloc_table_info+0x44/0xa0 [ 742.496321][T14261] xt_alloc_table_info+0x44/0xa0 [ 742.496347][T14261] do_ip6t_set_ctl+0x504/0xba0 [ 742.496373][T14261] ? nf_sockopt_find.isra.0+0x222/0x290 [ 742.496404][T14261] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 742.496433][T14261] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 742.496471][T14261] ? nf_sockopt_find.isra.0+0x222/0x290 [ 742.496500][T14261] nf_setsockopt+0x8d/0xf0 [ 742.496527][T14261] ipv6_setsockopt+0x135/0x170 [ 742.496555][T14261] udpv6_setsockopt+0x7d/0xd0 [ 742.496572][T14261] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 742.496599][T14261] do_sock_setsockopt+0xf3/0x1d0 [ 742.496627][T14261] __sys_setsockopt+0x195/0x220 [ 742.496652][T14261] __x64_sys_setsockopt+0xbd/0x160 [ 742.496671][T14261] ? do_syscall_64+0x95/0xf80 [ 742.496691][T14261] ? lockdep_hardirqs_on+0x78/0x100 [ 742.496711][T14261] do_syscall_64+0x106/0xf80 [ 742.496728][T14261] ? clear_bhb_loop+0x40/0x90 [ 742.496743][T14261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.496754][T14261] RIP: 0033:0x7f1f4499c799 [ 742.496765][T14261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 742.496777][T14261] RSP: 002b:00007f1f457ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 742.496788][T14261] RAX: ffffffffffffffda RBX: 00007f1f44c16090 RCX: 00007f1f4499c799 [ 742.496796][T14261] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000008 [ 742.496802][T14261] RBP: 00007f1f457ac090 R08: 0000000000000590 R09: 0000000000000000 [ 742.496809][T14261] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.496815][T14261] R13: 00007f1f44c16128 R14: 00007f1f44c16090 R15: 00007ffc6b20dc58 [ 742.496829][T14261] [ 742.807973][T14256] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 742.832593][T14256] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2116'. [ 742.842074][T11737] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 743.069063][ T5898] keytouch 0003:0926:3333.0023: fixing up Keytouch IEC report descriptor [ 743.149091][ T5885] usb 4-1: USB disconnect, device number 87 [ 743.387082][T11737] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 743.392285][ T5898] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0023/input/input60 [ 743.415238][T11737] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 743.483331][T11737] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 743.497712][T11737] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -61 [ 744.599868][T14264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 744.609785][T14264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 744.629786][ T5885] usb 3-1: USB disconnect, device number 88 [ 744.702416][ T5898] keytouch 0003:0926:3333.0023: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 744.849014][T11737] usb 2-1: USB disconnect, device number 89 [ 744.887890][T14271] fido_id[14271]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 745.519366][T14282] netlink: 'syz.0.2122': attribute type 3 has an invalid length. [ 745.529031][T14282] netlink: 'syz.0.2122': attribute type 3 has an invalid length. [ 745.826557][T11737] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 745.905258][T14286] netlink: 'syz.2.2124': attribute type 3 has an invalid length. [ 745.977582][T14286] netlink: 'syz.2.2124': attribute type 3 has an invalid length. [ 746.026146][T11737] usb 2-1: Using ep0 maxpacket: 32 [ 746.036363][T11737] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 746.071350][T11737] usb 2-1: config 0 has no interface number 0 [ 746.096802][T11737] usb 2-1: config 0 interface 184 has no altsetting 0 [ 746.120442][T11737] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 746.134334][T11737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.143107][T11737] usb 2-1: Product: syz [ 746.152620][T11737] usb 2-1: Manufacturer: syz [ 746.157493][T11737] usb 2-1: SerialNumber: syz [ 746.221332][T11737] usb 2-1: config 0 descriptor?? [ 746.879526][T11737] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 746.892562][T14282] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 746.917354][T11737] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 746.958106][ T30] audit: type=1400 audit(1773778522.601:609): avc: denied { ioctl } for pid=14290 comm="syz.5.2125" path="socket:[51530]" dev="sockfs" ino=51530 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 746.969190][T14291] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2125'. [ 747.080501][T14296] netlink: 'syz.0.2127': attribute type 39 has an invalid length. [ 747.136283][ T9] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 747.220134][T14301] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2128'. [ 747.229169][T14301] openvswitch: netlink: Flow key attr not present in new flow. [ 747.376976][ T5898] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 747.576257][ T5898] usb 1-1: Using ep0 maxpacket: 8 [ 747.576341][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 747.692966][ T5898] usb 1-1: config 1 has an invalid interface number: 128 but max is 1 [ 747.703745][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 747.756162][T11737] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 747.796868][T11737] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 747.806996][T11737] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 747.816987][T11737] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 747.825357][ T9] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 747.825436][ T5898] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 747.834077][ T9] usb 4-1: config 1 has no interface number 0 [ 747.834117][ T9] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 747.893294][ T9] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 747.903524][ T5898] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 747.903551][ T5898] usb 1-1: config 1 has no interface number 0 [ 747.903587][ T5898] usb 1-1: config 1 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 747.903610][ T5898] usb 1-1: config 1 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 747.905425][ T5898] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 747.913330][ T9] usb 4-1: config 1 interface 105 has no altsetting 0 [ 747.915095][ T9] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 747.967989][ T9] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 747.979320][T11737] usb 2-1: USB disconnect, device number 90 [ 747.998435][ T9] usb 4-1: Product: syz [ 748.003247][ T9] usb 4-1: Manufacturer: syz [ 748.008197][ T9] usb 4-1: SerialNumber: syz [ 748.022956][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 748.031274][T14289] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 748.031381][T14289] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 748.084195][ T5898] usb 1-1: Product: syz [ 748.089196][T14306] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 748.103792][ T5898] usb 1-1: Manufacturer: syz [ 748.118233][ T5898] usb 1-1: SerialNumber: syz [ 748.138142][ T5898] cdc_wdm 1-1:1.128: skipping garbage [ 748.149921][ T5898] cdc_wdm 1-1:1.128: cdc-wdm0: USB WDM device [ 748.176632][ T5898] cdc_wdm 1-1:1.128: Unknown control protocol [ 748.346748][ T5898] usb 1-1: USB disconnect, device number 102 [ 748.436873][T14289] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 748.444189][T14289] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 748.486225][T11737] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 749.066113][T11737] usb 6-1: Using ep0 maxpacket: 32 [ 749.073948][T11737] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 749.083273][T11737] usb 6-1: config 0 has no interface number 0 [ 749.089755][T11737] usb 6-1: config 0 interface 184 has no altsetting 0 [ 749.104318][T11737] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 749.114350][T11737] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.128842][T11737] usb 6-1: Product: syz [ 749.133093][T11737] usb 6-1: Manufacturer: syz [ 749.159689][T11737] usb 6-1: SerialNumber: syz [ 749.178274][T11737] usb 6-1: config 0 descriptor?? [ 749.252574][ T9] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 749.472087][ T9] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 749.541457][ T9] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 34:32:02:8f:26:7f [ 749.582959][ T9] usb 4-1: USB disconnect, device number 88 [ 749.610339][ T9] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 750.085353][T11737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 750.105574][ T9] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 750.115025][T11737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 750.147201][ T9] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 750.167331][ T9] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 750.269632][T14330] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2135'. [ 750.837122][T11737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 750.849203][T11737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 750.859169][T11737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 750.916195][T11737] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -61 [ 750.969844][T14342] SELinux: syz.0.2137 (14342) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 752.606456][ T5924] usb 6-1: USB disconnect, device number 13 [ 753.006418][ T5924] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 753.196293][ T5924] usb 6-1: Using ep0 maxpacket: 16 [ 753.215238][ T5924] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.247613][ T5924] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 753.279909][ T5924] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 753.292618][ T30] audit: type=1400 audit(1773778528.931:610): avc: denied { mount } for pid=14380 comm="syz.3.2139" name="/" dev="autofs" ino=51024 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 753.306106][ T5924] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 753.328964][T14381] 9pnet_fd: p9_fd_create_unix (14381): problem connecting socket: ./file0: -111 [ 753.338177][ T5924] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 753.339731][ T5924] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 753.361217][ T30] audit: type=1400 audit(1773778528.961:611): avc: denied { mounton } for pid=14380 comm="syz.3.2139" path="/428/file1/file0" dev="autofs" ino=51025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 753.384627][ T5924] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 753.384651][ T5924] usb 6-1: Manufacturer: syz [ 753.395503][ T5924] usb 6-1: config 0 descriptor?? [ 753.418311][ T30] audit: type=1400 audit(1773778529.061:612): avc: denied { unmount } for pid=5804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 753.656276][ T5924] rc_core: IR keymap rc-hauppauge not found [ 753.663269][ T5924] Registered IR keymap rc-empty [ 753.668347][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.696324][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.726950][ T5924] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 753.740058][ T5924] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input62 [ 753.755056][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.776747][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.801869][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.830815][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.856267][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.877008][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.896293][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.926344][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.956229][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 753.976252][ T5924] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 754.010173][ T5924] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 754.021948][ T5924] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 754.187396][ T5924] usb 6-1: USB disconnect, device number 14 [ 754.814589][T14400] netlink: 'syz.1.2148': attribute type 3 has an invalid length. [ 754.828658][T14400] netlink: 'syz.1.2148': attribute type 3 has an invalid length. [ 756.157418][T14411] Invalid argument reading file caps for ./file0 [ 756.193766][ T30] audit: type=1400 audit(1773778531.821:613): avc: denied { getopt } for pid=14412 comm="syz.0.2152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 756.277339][ T30] audit: type=1400 audit(1773778531.911:614): avc: denied { create } for pid=14414 comm="syz.1.2153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 756.323060][ T30] audit: type=1400 audit(1773778531.911:615): avc: denied { write } for pid=14414 comm="syz.1.2153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 756.365820][ T30] audit: type=1400 audit(1773778531.981:616): avc: denied { append } for pid=14418 comm="syz.2.2155" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 757.236088][ T29] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 757.319982][T14430] netlink: 'syz.1.2158': attribute type 10 has an invalid length. [ 757.329025][T14430] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 757.347133][T14430] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 757.366477][ T29] usb 1-1: device descriptor read/64, error -71 [ 757.377695][T14430] pimreg: entered allmulticast mode [ 757.739841][ T30] audit: type=1400 audit(1773778533.301:617): avc: denied { shutdown } for pid=14434 comm="syz.1.2159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 757.769083][ T29] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 757.974992][T14436] tipc: Enabling of bearer rejected, already enabled [ 757.997044][ T29] usb 1-1: device descriptor read/64, error -71 [ 758.106947][ T29] usb usb1-port1: attempt power cycle [ 758.530085][ T29] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 758.580547][ T29] usb 1-1: device descriptor read/8, error -71 [ 758.856625][ T5936] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 758.864229][ T29] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 758.897040][ T29] usb 1-1: device descriptor read/8, error -71 [ 759.016554][ T5936] usb 3-1: Using ep0 maxpacket: 16 [ 759.022250][ T29] usb usb1-port1: unable to enumerate USB device [ 759.030013][ T5936] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 759.046140][ T5936] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 759.067570][ T5936] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 759.078127][ T5936] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 759.092824][ T5936] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 759.109302][ T5936] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 759.123116][ T5936] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 759.133215][ T5936] usb 3-1: Manufacturer: syz [ 759.154830][ T5936] usb 3-1: config 0 descriptor?? [ 759.416668][ T5936] rc_core: IR keymap rc-hauppauge not found [ 759.425875][ T5936] Registered IR keymap rc-empty [ 759.438691][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 759.472766][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 759.523364][T14446] x_tables: unsorted underflow at hook 3 [ 759.781717][ T5936] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 759.818959][ T5936] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input64 [ 759.836720][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 759.946847][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 759.997834][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.026992][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.057645][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.076846][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.116800][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.146805][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.234245][ T2985] block nbd0: Possible stuck request ffff888027d20000: control (read@0,1024B). Runtime 150 seconds [ 760.246255][ T2985] block nbd0: Possible stuck request ffff888027d20200: control (read@1024,1024B). Runtime 150 seconds [ 760.699652][ T2985] block nbd0: Possible stuck request ffff888027d20400: control (read@2048,1024B). Runtime 150 seconds [ 760.711693][ T2985] block nbd0: Possible stuck request ffff888027d20600: control (read@3072,1024B). Runtime 150 seconds [ 760.756669][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.793384][ T5936] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 760.970307][ T5936] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 761.001255][ T5936] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 761.023654][ T5936] usb 3-1: USB disconnect, device number 89 [ 761.070102][ T6676] udevd[6676]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 761.089467][ T6676] udevd[6676]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 761.446777][ T5936] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 761.520948][T14491] ip6gretap0: entered promiscuous mode [ 761.527586][T14491] vlan2: entered promiscuous mode [ 761.586126][ T30] audit: type=1400 audit(1773778537.131:618): avc: denied { connect } for pid=14478 comm="syz.0.2169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 761.800912][ T5936] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 761.817853][ T5936] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 761.836662][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.910242][ T5936] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 762.963685][ T5936] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 762.970792][T14507] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2177'. [ 762.980904][ T5936] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -32 [ 763.089056][ T5936] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 763.516311][ T11] block nbd256: Possible stuck request ffff888052d90000: control (read@0,1024B). Runtime 150 seconds [ 763.527244][ T11] block nbd256: Possible stuck request ffff888052d90200: control (read@1024,1024B). Runtime 150 seconds [ 763.538401][ T11] block nbd256: Possible stuck request ffff888052d90400: control (read@2048,1024B). Runtime 150 seconds [ 763.549542][ T11] block nbd256: Possible stuck request ffff888052d90600: control (read@3072,1024B). Runtime 150 seconds [ 763.575831][ T5936] usb 2-1: USB disconnect, device number 91 [ 763.824138][T14520] 9p: Bad value for 'rfdno' [ 764.461836][T14528] SELinux: Context system_u:object_r:systemd_passwd_var_run_t:s0 is not valid (left unmapped). [ 764.492748][ T30] audit: type=1400 audit(1773778540.111:619): avc: denied { relabelto } for pid=14525 comm="syz.1.2183" name="429" dev="tmpfs" ino=2272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 764.824717][ T30] audit: type=1400 audit(1773778540.111:620): avc: denied { associate } for pid=14525 comm="syz.1.2183" name="429" dev="tmpfs" ino=2272 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 765.026655][ T5936] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 765.178078][ T5936] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 765.209078][ T5936] usb 2-1: config 4 has 0 interfaces, different from the descriptor's value: 1 [ 765.226081][ T5936] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 765.248646][T14531] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.258493][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.359176][T14531] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.435729][T14531] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.712135][T14538] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 765.750028][T14538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2185'. [ 765.759277][T14538] openvswitch: netlink: Missing key (keys=40, expected=80) [ 765.772857][T14531] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.911609][T11584] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.925773][T11584] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.944858][T11584] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.964318][T11584] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.108861][T11737] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 766.205655][T11748] IPVS: starting estimator thread 0... [ 766.296173][T11737] usb 3-1: Using ep0 maxpacket: 16 [ 766.296604][T14547] IPVS: using max 46 ests per chain, 110400 per kthread [ 766.317973][T11737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 766.466651][T11737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 766.489153][T11737] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 766.524381][T11737] usb 3-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 766.533725][T11737] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 766.551205][T11737] usb 3-1: config 0 descriptor?? [ 767.013425][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.020375][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.027836][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.036282][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.044582][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.053449][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.061409][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.525625][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.532871][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.544291][ T5936] usb 2-1: USB disconnect, device number 92 [ 767.559080][ T30] audit: type=1400 audit(1773778543.201:621): avc: denied { remove_name } for pid=5802 comm="syz-executor" name="binderfs" dev="tmpfs" ino=2276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 767.595945][T11737] apple 0003:05AC:027D.0024: unknown main item tag 0x0 [ 767.606218][T11737] apple 0003:05AC:027D.0024: hidraw0: USB HID v0.00 Device [HID 05ac:027d] on usb-dummy_hcd.2-1/input0 [ 767.676118][T11748] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 767.683061][ T30] audit: type=1400 audit(1773778543.201:622): avc: denied { rmdir } for pid=5802 comm="syz-executor" name="429" dev="tmpfs" ino=2272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 767.916452][T11748] usb 1-1: Using ep0 maxpacket: 16 [ 767.935534][T11748] usb 1-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 767.971263][T11748] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.388539][T11748] usb 1-1: Product: syz [ 768.400302][ T30] audit: type=1400 audit(1773778544.031:623): avc: denied { read } for pid=14567 comm="syz.5.2192" name="file0" dev="fuse" ino=9223372036854775872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 768.433626][T11748] usb 1-1: Manufacturer: syz [ 768.453175][T14572] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 768.463730][T11748] usb 1-1: SerialNumber: syz [ 768.466599][T14572] block device autoloading is deprecated and will be removed. [ 768.473301][ T30] audit: type=1400 audit(1773778544.071:624): avc: denied { open } for pid=14567 comm="syz.5.2192" path="/70/file0/file0" dev="fuse" ino=9223372036854775872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 768.853492][T14582] fuse: Bad value for 'fd' [ 768.861581][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 768.871666][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 768.880019][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 768.900375][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 768.926681][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 768.967493][T14583] vxcan1: tx drop: invalid sa for name 0xfffffffffffffffe [ 769.423436][T14578] lo speed is unknown, defaulting to 1000 [ 769.486604][ T5885] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 769.524195][T14586] netlink: 'syz.1.2196': attribute type 3 has an invalid length. [ 769.556611][T14586] netlink: 'syz.1.2196': attribute type 3 has an invalid length. [ 769.643703][ T1707] usb 3-1: USB disconnect, device number 90 [ 769.651670][ T5885] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 769.684391][ T5885] usb 6-1: config 1 has no interface number 0 [ 769.711601][ T5885] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 769.759331][ T5885] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 769.794487][ T5885] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 104 [ 769.815495][ T5885] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 769.815922][T14589] xt_hashlimit: size too large, truncated to 1048576 [ 770.674831][ T5885] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 770.706850][ T5885] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.714906][ T5885] usb 6-1: Product: syz [ 770.747990][ T5885] usb 6-1: Manufacturer: syz [ 770.752691][ T5885] usb 6-1: SerialNumber: syz [ 770.763122][T11748] usb 1-1: USB disconnect, device number 107 [ 770.832295][T14583] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 770.840153][T14583] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 770.908724][ T6672] udevd[6672]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 771.410244][ T51] Bluetooth: hci6: command tx timeout [ 771.612751][T14586] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 771.671155][T14586] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 771.760405][T14586] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 771.802995][T14586] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 772.194276][ T5885] usb 6-1: Error in usbnet_get_endpoints (-71) [ 772.263371][T14578] chnl_net:caif_netlink_parms(): no params data found [ 772.296377][ T5885] usb 6-1: USB disconnect, device number 15 [ 772.469299][T14578] bridge0: port 1(bridge_slave_0) entered blocking state [ 772.486339][T14578] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.493541][T14578] bridge_slave_0: entered allmulticast mode [ 772.501301][T14578] bridge_slave_0: entered promiscuous mode [ 772.517307][T14578] bridge0: port 2(bridge_slave_1) entered blocking state [ 772.524528][T14578] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.534905][T14578] bridge_slave_1: entered allmulticast mode [ 772.546217][T14578] bridge_slave_1: entered promiscuous mode [ 772.552728][T14608] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2201'. [ 772.629492][T14578] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 772.678119][T14578] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 772.756741][ T5885] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 772.762795][T14611] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 772.796566][ T5821] Bluetooth: hci5: command 0x041b tx timeout [ 772.926743][ T5885] usb 6-1: Using ep0 maxpacket: 32 [ 772.948391][ T5885] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 773.004648][ T5885] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 773.062339][ T5885] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 773.103895][ T5885] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.115117][ T5885] usb 6-1: config 0 descriptor?? [ 773.123974][T14578] team0: Port device team_slave_0 added [ 773.135369][T14578] team0: Port device team_slave_1 added [ 773.166677][ T29] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 773.190604][ T5885] hub 6-1:0.0: USB hub found [ 773.221086][T14578] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 773.236378][T14578] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 773.276655][T14578] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 773.307822][T14578] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 773.314984][T14578] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 773.342397][T14578] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 773.354600][ T5885] hub 6-1:0.0: 6 ports detected [ 773.359906][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 773.366935][ T5885] hub 6-1:0.0: insufficient power available to use all downstream ports [ 773.375399][ T29] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 773.384064][ T29] usb 2-1: config 0 has no interface number 0 [ 773.390678][ T29] usb 2-1: config 0 interface 184 has no altsetting 0 [ 773.414439][ T29] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 773.444457][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.484941][ T29] usb 2-1: Product: syz [ 773.505114][ T29] usb 2-1: Manufacturer: syz [ 773.515350][T14578] hsr_slave_0: entered promiscuous mode [ 773.521703][ T29] usb 2-1: SerialNumber: syz [ 773.537124][T14578] hsr_slave_1: entered promiscuous mode [ 773.546926][T14578] debugfs: 'hsr0' already exists in 'hsr' [ 773.552555][ T29] usb 2-1: config 0 descriptor?? [ 773.552663][T14578] Cannot create hsr debugfs directory [ 773.713779][T14623] fuse: Bad value for 'fd' [ 773.747944][ T5821] Bluetooth: hci6: command 0x040f tx timeout [ 774.063094][T14578] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 774.075508][T14629] overlayfs: unescaped trailing colons in lowerdir mount option. [ 774.076521][T14578] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 774.098526][T14578] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 774.110388][T14578] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 774.210128][ T30] audit: type=1400 audit(1773778549.841:625): avc: denied { create } for pid=14627 comm="syz.0.2207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 774.341711][ T30] audit: type=1400 audit(1773778549.841:626): avc: denied { bind } for pid=14627 comm="syz.0.2207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 774.416193][ T5821] Bluetooth: hci2: command 0x1003 tx timeout [ 774.446235][ T51] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 774.492323][T14578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 774.554250][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 774.565707][ T5885] hub 6-1:0.0: hub_hub_status failed (err = -71) [ 774.573083][ T5885] hub 6-1:0.0: config failed, can't get hub status (err -71) [ 774.581837][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 774.591165][ T30] audit: type=1400 audit(1773778549.851:627): avc: denied { write } for pid=14627 comm="syz.0.2207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 774.613941][T14578] 8021q: adding VLAN 0 to HW filter on device team0 [ 774.627209][ T5885] usbhid 6-1:0.0: can't add hid device: -71 [ 774.634384][ T5885] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 774.650917][ T143] bridge0: port 1(bridge_slave_0) entered blocking state [ 774.658074][ T143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 774.708338][ T143] bridge0: port 2(bridge_slave_1) entered blocking state [ 774.715509][ T143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 774.797616][ T5885] usb 6-1: USB disconnect, device number 16 [ 775.109833][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 775.134245][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 775.536495][ T30] audit: type=1400 audit(1773778550.851:628): avc: denied { map } for pid=14647 comm="syz.2.2209" path="/proc/1646/net/rt6_stats" dev="proc" ino=4026532943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 775.568190][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 775.635203][ T29] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 775.648886][T14578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 775.656408][T14655] netlink: 552 bytes leftover after parsing attributes in process `syz.5.2210'. [ 775.705102][ T29] usb 2-1: USB disconnect, device number 93 [ 775.826495][ T51] Bluetooth: hci6: command 0x040f tx timeout [ 777.478767][T14578] veth0_vlan: entered promiscuous mode [ 777.512041][ T30] audit: type=1400 audit(1773778553.151:629): avc: denied { getopt } for pid=14678 comm="syz.1.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 777.513756][T14578] veth1_vlan: entered promiscuous mode [ 777.641130][T14578] veth0_macvtap: entered promiscuous mode [ 777.689425][T14578] veth1_macvtap: entered promiscuous mode [ 777.740183][T14578] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 777.783278][T14578] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 777.846795][ T78] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.862153][ T78] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.897022][ T78] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 777.906602][ T51] Bluetooth: hci6: command 0x040f tx timeout [ 778.578396][ T78] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.746738][ T29] usb 1-1: new full-speed USB device number 108 using dummy_hcd [ 778.757297][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.781870][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.846860][T11579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.855041][T11579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.977942][ T29] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 778.987815][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.009149][ T29] usb 1-1: config 0 descriptor?? [ 779.095900][ T29] as10x_usb: device has been detected [ 779.127255][ T29] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 779.172354][ T29] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 779.244398][ T29] as10x_usb: error during firmware upload part1 [ 779.253158][ T30] audit: type=1400 audit(1773778554.891:630): avc: denied { ioctl } for pid=14691 comm="syz.5.2215" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 779.253411][T14694] fuse: Unknown parameter '000000000000000000090x0000000000000008' [ 779.257961][T14693] lo speed is unknown, defaulting to 1000 [ 779.356305][T14695] SET target dimension over the limit! [ 779.382704][ T30] audit: type=1400 audit(1773778554.991:631): avc: denied { listen } for pid=14684 comm="syz.0.2218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 779.382755][ T29] Registered device nBox DVB-T Dongle [ 779.987185][ T51] Bluetooth: hci6: command 0x040f tx timeout [ 780.407014][T14704] netlink: 552 bytes leftover after parsing attributes in process `syz.2.2220'. [ 780.495288][T11748] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 780.555932][T14706] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2222'. [ 780.565407][T14706] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 780.605164][T14706] tipc: Enabling of bearer rejected, already enabled [ 780.691192][T11748] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 780.704367][T11748] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.736536][T11748] usb 2-1: Product: syz [ 780.740771][T11748] usb 2-1: Manufacturer: syz [ 780.775813][T11748] usb 2-1: SerialNumber: syz [ 780.837177][T11748] usb 2-1: config 0 descriptor?? [ 781.156559][T11748] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 781.762542][ T29] usb 1-1: USB disconnect, device number 108 [ 781.887870][ T1707] usb 3-1: new low-speed USB device number 91 using dummy_hcd [ 781.914930][ T29] Unregistered device nBox DVB-T Dongle [ 781.920199][ T29] as10x_usb: device has been disconnected [ 781.997381][T14701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.012548][T14701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.066728][ T51] Bluetooth: hci6: command 0x040f tx timeout [ 782.090777][ T1707] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 782.099587][ T1707] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 is Bulk; changing to Interrupt [ 782.161651][ T1707] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 782.235494][ T1707] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B is Bulk; changing to Interrupt [ 782.257005][ T1707] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 782.294027][ T1707] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 782.316640][ T1707] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.450616][ T1707] usbtmc 3-1:16.0: bulk endpoints not found [ 782.471537][T11748] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 782.493650][ T5924] libceph: connect (1)[c::]:6789 error -101 [ 782.499877][ T5924] libceph: mon0 (1)[c::]:6789 connect error [ 782.520427][ T30] audit: type=1400 audit(1773778558.161:632): avc: denied { write } for pid=14714 comm="syz.5.2226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 782.648611][T14727] ceph: No mds server is up or the cluster is laggy [ 782.676406][T14732] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2228'. [ 783.413930][T14719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.423181][T14719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.437198][T14719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.446049][T14719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.501886][ T1707] usb 2-1: USB disconnect, device number 94 [ 783.786158][T14743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2232'. [ 783.916788][ T5885] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 784.079023][ T5885] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 784.088871][T14750] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 784.101568][ T5885] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 784.168577][ T5885] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 784.196103][ T5885] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 784.223358][ T5885] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 784.258527][ T5885] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 784.283275][ T5885] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 784.292748][ T5885] usb 6-1: Product: syz [ 784.298253][ T5885] usb 6-1: Manufacturer: syz [ 784.317347][ T5885] cdc_wdm 6-1:1.0: skipping garbage [ 784.324288][ T5885] cdc_wdm 6-1:1.0: skipping garbage [ 784.340209][ T5885] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 784.354476][ T5885] cdc_wdm 6-1:1.0: Unknown control protocol [ 784.383052][T14756] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2235'. [ 785.051235][ T5885] usb 3-1: USB disconnect, device number 91 [ 785.953346][T14771] netlink: 'syz.6.2239': attribute type 5 has an invalid length. [ 786.364008][T14771] ip6erspan0: entered promiscuous mode [ 786.855523][T14793] netdevsim netdevsim6 netdevsim0: IPsec offload requires 128 bit authentication [ 787.057646][T14739] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 787.063887][T14739] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 787.117544][ T5885] usb 6-1: USB disconnect, device number 17 [ 787.238725][T14798] netlink: 536 bytes leftover after parsing attributes in process `syz.6.2246'. [ 787.496269][ T5924] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 788.380684][T14819] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 788.468480][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 788.930609][T14829] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2256'. [ 788.940560][T14829] openvswitch: netlink: Flow key attr not present in new flow. [ 789.270633][ T51] Bluetooth: hci6: command 0x040f tx timeout [ 789.562855][T14834] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 789.667773][ T31] INFO: task syz.4.1795:12895 blocked for more than 143 seconds. [ 789.677119][ T31] Tainted: G L syzkaller #0 [ 789.683946][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 789.696934][ T31] task:syz.4.1795 state:D stack:28024 pid:12895 tgid:12892 ppid:5811 task_flags:0x400140 flags:0x00080002 [ 789.717500][T14837] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2258'. [ 789.726542][T14837] openvswitch: netlink: Missing key (keys=200040, expected=2000) [ 789.747726][T14837] tipc: Enabling of bearer rejected, already enabled [ 789.752686][ T30] audit: type=1400 audit(1773778565.351:633): avc: denied { map_create } for pid=14835 comm="syz.0.2258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 790.026536][ T31] Call Trace: [ 790.029894][ T31] [ 790.033985][ T31] __schedule+0xfee/0x6120 [ 790.064644][ T31] ? __lock_acquire+0x4a5/0x2630 [ 790.091126][ T31] ? __pfx___schedule+0x10/0x10 [ 790.108109][ T31] ? find_held_lock+0x2b/0x80 [ 790.123187][ T31] ? schedule+0x2bf/0x390 [ 790.135858][ T31] schedule+0xdd/0x390 [ 790.151850][ T31] schedule_preempt_disabled+0x13/0x30 [ 790.170275][ T31] __mutex_lock+0xc9a/0x1b90 [ 790.174910][ T31] ? sync_bdevs+0x153/0x480 [ 790.200069][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 790.205154][ T31] ? __pfx___might_resched+0x10/0x10 [ 790.230310][ T31] ? sync_bdevs+0x11c/0x480 [ 790.246217][ T31] ? sync_bdevs+0x153/0x480 [ 790.250844][ T31] sync_bdevs+0x153/0x480 [ 790.257545][ T31] ksys_sync+0xb0/0xf0 [ 790.270373][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 790.278468][ T31] ? do_syscall_64+0x95/0xf80 [ 790.284313][ T31] __do_sys_sync+0xe/0x20 [ 790.289870][ T31] do_syscall_64+0x106/0xf80 [ 790.300962][ T31] ? clear_bhb_loop+0x40/0x90 [ 790.305708][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.314363][ T2985] block nbd0: Possible stuck request ffff888027d20000: control (read@0,1024B). Runtime 180 seconds [ 790.314370][ T31] RIP: 0033:0x7f7acad9c799 [ 790.314389][ T31] RSP: 002b:00007f7acbb86028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 790.370712][ T31] RAX: ffffffffffffffda RBX: 00007f7acb016090 RCX: 00007f7acad9c799 [ 790.388232][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 790.413783][ T31] RBP: 00007f7acb016090 R08: 0000000000000000 R09: 0000000000000000 [ 790.439349][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 790.467782][ T31] R13: 00007f7acb016128 R14: 00007f7acb016090 R15: 00007ffe3d2873c8 [ 790.481454][ T31] [ 790.487993][ T31] [ 790.487993][ T31] Showing all locks held in the system: [ 790.514639][ T31] 1 lock held by khungtaskd/31: [ 790.528121][ T31] #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 790.540320][ T31] 2 locks held by getty/5564: [ 790.546993][ T31] #0: ffff8880359930a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 790.568407][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 790.589594][ T31] 1 lock held by udevd/5796: [ 790.600576][ T31] #0: ffff88805782d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 790.610238][ T31] 1 lock held by udevd/6671: [ 790.614845][ T31] #0: ffff888027ca3358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 790.636502][ T31] 1 lock held by syz.4.1795/12895: [ 790.644985][ T31] #0: ffff88805782d358 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x153/0x480 [ 790.664802][ T31] 2 locks held by syz.2.2251/14811: [ 790.676961][ T31] [ 790.681497][ T31] ============================================= [ 790.681497][ T31] [ 790.700818][ T31] NMI backtrace for cpu 0 [ 790.700839][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 790.700854][ T31] Tainted: [L]=SOFTLOCKUP [ 790.700858][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 790.700865][ T31] Call Trace: [ 790.700870][ T31] [ 790.700874][ T31] dump_stack_lvl+0x100/0x190 [ 790.700896][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 790.700909][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 790.700928][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 790.700953][ T31] sys_info+0x141/0x190 [ 790.700969][ T31] watchdog+0xd25/0x1050 [ 790.700989][ T31] ? __pfx_watchdog+0x10/0x10 [ 790.701004][ T31] ? __kthread_parkme+0x18c/0x230 [ 790.701022][ T31] ? kthread+0x13a/0x450 [ 790.701031][ T31] ? __pfx_watchdog+0x10/0x10 [ 790.701045][ T31] kthread+0x370/0x450 [ 790.701055][ T31] ? __pfx_kthread+0x10/0x10 [ 790.701066][ T31] ret_from_fork+0x754/0xd80 [ 790.701078][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 790.701090][ T31] ? __switch_to+0x7b4/0x1120 [ 790.701104][ T31] ? __pfx_kthread+0x10/0x10 [ 790.701115][ T31] ret_from_fork_asm+0x1a/0x30 [ 790.701134][ T31] [ 790.701152][ T31] Sending NMI from CPU 0 to CPUs 1: [ 790.827834][ C1] NMI backtrace for cpu 1 [ 790.827852][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 790.827871][ C1] Tainted: [L]=SOFTLOCKUP [ 790.827876][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 790.827884][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 790.827904][ C1] Code: 88 82 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 71 1b 00 fb f4 fc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 790.827917][ C1] RSP: 0018:ffffc90000197df0 EFLAGS: 00000242 [ 790.827929][ C1] RAX: 0000000004204907 RBX: ffff88801e6aa4c0 RCX: ffffffff8b901c75 [ 790.827938][ C1] RDX: 0000000000000000 RSI: ffffffff8de76c97 RDI: ffffffff8c1b0720 [ 790.827947][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed10170a6795 [ 790.827955][ C1] R10: ffff8880b8533cab R11: 0000000000000000 R12: ffffed1003cd5498 [ 790.827963][ C1] R13: 0000000000000001 R14: ffffffff90d99110 R15: 0000000000000000 [ 790.827973][ C1] FS: 0000000000000000(0000) GS:ffff888124442000(0000) knlGS:0000000000000000 [ 790.827988][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 790.827997][ C1] CR2: 000055556ce24a28 CR3: 000000000e598000 CR4: 00000000003526f0 [ 790.828005][ C1] Call Trace: [ 790.828010][ C1] [ 790.828015][ C1] default_idle+0x9/0x10 [ 790.828033][ C1] default_idle_call+0x6c/0xb0 [ 790.828056][ C1] do_idle+0x43a/0x550 [ 790.828075][ C1] ? __pfx_do_idle+0x10/0x10 [ 790.828093][ C1] cpu_startup_entry+0x4f/0x60 [ 790.828109][ C1] start_secondary+0x21d/0x2d0 [ 790.828129][ C1] ? __pfx_start_secondary+0x10/0x10 [ 790.828150][ C1] common_startup_64+0x13e/0x148 [ 790.828169][ C1] [ 791.000942][ T2985] block nbd0: Possible stuck request ffff888027d20200: control (read@1024,1024B). Runtime 180 seconds [ 791.012786][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 791.019661][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 791.030316][ T31] Tainted: [L]=SOFTLOCKUP [ 791.034625][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 791.044677][ T31] Call Trace: [ 791.047952][ T31] [ 791.050857][ T31] dump_stack_lvl+0x100/0x190 [ 791.055517][ T31] vpanic+0x552/0x970 [ 791.059478][ T31] ? __pfx_vpanic+0x10/0x10 [ 791.063956][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 791.070089][ T31] panic+0xd1/0xe0 [ 791.073793][ T31] ? __pfx_panic+0x10/0x10 [ 791.078191][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 791.084324][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 791.090462][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 791.096616][ T31] ? watchdog.cold+0x198/0x1ca [ 791.101360][ T31] ? watchdog+0xd35/0x1050 [ 791.105765][ T31] watchdog.cold+0x1a9/0x1ca [ 791.110357][ T31] ? __pfx_watchdog+0x10/0x10 [ 791.115018][ T31] ? __kthread_parkme+0x18c/0x230 [ 791.120027][ T31] ? kthread+0x13a/0x450 [ 791.124255][ T31] ? __pfx_watchdog+0x10/0x10 [ 791.128918][ T31] kthread+0x370/0x450 [ 791.132970][ T31] ? __pfx_kthread+0x10/0x10 [ 791.137541][ T31] ret_from_fork+0x754/0xd80 [ 791.142113][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 791.147229][ T31] ? __switch_to+0x7b4/0x1120 [ 791.151891][ T31] ? __pfx_kthread+0x10/0x10 [ 791.156552][ T31] ret_from_fork_asm+0x1a/0x30 [ 791.161315][ T31] [ 791.164577][ T31] Kernel Offset: disabled [ 791.168876][ T31] Rebooting in 86400 seconds..