last executing test programs: 2m45.938777265s ago: executing program 4 (id=1890): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@uexit={0x0, 0x18, 0x5}, @uexit={0x0, 0x18, 0x8}, @uexit={0x0, 0x18, 0x3ff}, @cpuid={0x2, 0x18, {0x0, 0x800}}, @cpuid={0x2, 0x18, {0xe00, 0x6}}], 0x78}) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000100)="0f20e06635200000000f22e00f01c30f8ae61a0fc75c2b0f0966b90e0a00000f32660f3802430a6766660f3acf5d0000ba4200ec09cf", 0x36}], 0x1, 0x14, &(0x7f00000001c0)=[@flags={0x3, 0x800}, @cr4={0x1, 0x10400}], 0x2) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x23b) openat$sysfs(0xffffffffffffff9c, 0x0, 0x200000, 0x48) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$kcm(0xa, 0x5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, r3, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0\x00') pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r7, 0x40096101, &(0x7f0000000100)={{}, 0x7}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r8, 0x1, 0x44, &(0x7f0000000040), 0x5d) 2m42.760764996s ago: executing program 4 (id=1899): r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCOUTQ(r0, 0x5411, 0x0) 2m42.562165311s ago: executing program 4 (id=1901): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b40)=@filter={'filter\x00', 0x4, 0x4, 0x4b8, 0xffffffff, 0x260, 0x260, 0xe8, 0xfeffffff, 0xffffffff, 0x3e8, 0x3e8, 0x3e8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffffff], 'hsr0\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [], [0x0, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00'}, 0x0, 0x138, 0x178, 0x0, {}, [@common=@srh1={{0x90}, {0x21, 0x12, 0xbe, 0x7, 0x5aa9, @ipv4={'\x00', '\xff\xff', @empty}, @private1, @local, [0xff000000, 0xff000000, 0x0, 0xff], [0xffffff00, 0xff000000, 0xff], [0x0, 0xffffff, 0xffffff00, 0x7fffff7f], 0x3c80}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x2000010}}}}, {{@uncond, 0x0, 0x160, 0x188, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x21, 0x180, 0x5}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x3, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, @private1, [0x0, 0x0, 0xff, 0xff], [0x0, 0xffffff00], [0x0, 0xff000000], 0x843, 0x1400}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x518) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000001080)=[{0x20, 0x0, 0x5, 0xfffff010}, {0x20, 0x1, 0x0, 0xfffff034}, {0x6, 0x0, 0x0, 0x400004}]}, 0x10) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000005c0), 0x10) recvmmsg(r4, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0xc251}, {{0x0, 0x0, &(0x7f0000000480)=[{0x0}], 0x1}, 0x7f}], 0x2, 0x10002, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000001801000020646c4300000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x36e, @void, @value}, 0x94) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) getsockopt$bt_hci(r1, 0x84, 0x85, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) 2m41.836318972s ago: executing program 4 (id=1906): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="06000000045acf140e00"/27, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lirc_mode2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000080)={0x40, 0xd, 0x4d, 0x7fff, 0x91, 0x6, &(0x7f0000000180)="5fcec9a9f7de37aa47e6263fc219a8acf31bf1734002646df7f5f2da18205b053a2f71488b6b820e34fb2fe578789dde56b7a31b74560be1bea01b06a4680cccbcc3f6a710064057db9d0208908830cde87539909ae31ccae2b27466ce0bc418640c42265bb5d893c0dec2a1aae016afbd4a460b25e5a38fa99700a837c89a7b49a2955d61e7629708f6163e3547c2c4fe"}) r2 = socket$inet6(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r3}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r7}, 0x10) sendto$inet6(r2, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0008000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x44, 0x0, 0x0) r8 = openat(0xffffffffffffff9c, 0x0, 0x88882, 0x0) r9 = openat(0xffffffffffffff9c, 0x0, 0x1c1002, 0x0) sendfile(r9, r8, 0x0, 0x7ffff000) write$cgroup_subtree(r8, &(0x7f0000000280)={[{0x2d, 'blkio'}, {0x2d, 'io'}, {0x86f5b1e757e3b225, 'perf_event'}]}, 0x17) 2m41.24677199s ago: executing program 4 (id=1908): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000ff01000000000000002000007b1af8ff00000000bf"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) getpriority(0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000001c0)=0x2) connect$unix(r3, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_REGISTER_COALESCED_MMIO(r7, 0x4010ae67, &(0x7f00000000c0)={0x0, 0xc000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r7, 0x4010ae68, &(0x7f0000000000)={0x2000}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x600, 0x2) 2m40.142419953s ago: executing program 4 (id=1916): mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0x3fff, 0x40001, 0x40000000, 0x10}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) recvmsg$kcm(r1, &(0x7f0000000440)={&(0x7f00000003c0)=@nl=@unspec, 0x80, &(0x7f0000000340)=[{&(0x7f0000000500)=""/234, 0xea}, {&(0x7f00000006c0)=""/182, 0xb6}], 0x2}, 0x10040) 2m24.833558412s ago: executing program 32 (id=1916): mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0x3fff, 0x40001, 0x40000000, 0x10}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) recvmsg$kcm(r1, &(0x7f0000000440)={&(0x7f00000003c0)=@nl=@unspec, 0x80, &(0x7f0000000340)=[{&(0x7f0000000500)=""/234, 0xea}, {&(0x7f00000006c0)=""/182, 0xb6}], 0x2}, 0x10040) 11.646666519s ago: executing program 1 (id=2365): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000040)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000080)) r2 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = syz_usb_connect$cdc_ncm(0x2, 0x168, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010002020000102505a1a44020010203010902560102010380090904000001020d00000b2406000194a3f397480805240000000d240f01d1000000001001000606241a80000c0724140011000007241400000b00df24130589a317ef7ae5d40b582a448cb874032e7f0a60bcef49a248bb1108655d84d55c1d17bc71107e1e2f0e2b8e20975c3ad23d874d73d97d46c5e16c3dc85d933d88bb8a7eb04e2b78526dffe353a5f8fbfb29dcd82fc8ef77d3425b8393a3bb48cc7f9ab9fbb9a2da3dfa6ed2f8e2953bf6c70f40460ece3c3b88febc7aac750cb15a8384d79bac4890552d6fc833be8edcd308aae1571f2956950162d9f6245528cd7a3f967c2e47b344b2f71f3b282939f99b23d6947a1fc8b8d3907f8abe66ff293b836ac0665ac19e4462eadde045c6fb43e28e435ecc7943a1bd07241409000a000905810308000701040904010000020d00000904010102020d000009058202400006100309050302200001ac05"], &(0x7f0000000880)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x6, 0x10, 0x3, 0x40, 0xf}, 0xc4, &(0x7f0000000440)=ANY=[@ANYBLOB="050fc4000510100ac6410000000ff00600deff00000a1003020e00ef04060010100a020100000000f00800300000000710021a0c05008e100a7823966091ed43312f0b45a3dc1f34983bdb141c6227fdea3b81103f37da87e9c7c0e6a48a2fde44a1f6fecfda08cd6167bea597fcbb9eacca8da65eb3759db08a12132ac618d9128c893db3fb0a179dffcc983cbfde9b54b4a90f0933d7e336b60973b0e34462910557ad7b52c151f32283dde1f9c571c88d7dac407364bc58dafd5b0000000000000000"], 0x9, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x459}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x100c}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x843}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x430}}, {0x93, &(0x7f0000000580)=@string={0x93, 0x3, "d8fee4cd4db97833bdc93f0abb0436d58778a5cfbe433681c5431492939d5105ef5614399cf515edb8f80c74340e7e4d9c54507bd4a319a28d805aab7a967d22a9cc857dc736d91099bd687e2dec109470a9ceec9b0518c81933006d95b13d379020aaaeaac4ac944b8d0bf9886f42d288ba263ccd53e1d91dfbe8ec6ccb5a9edbc8272626bfecd0a5929c252d29aac485"}}, {0xda, &(0x7f0000000640)=@string={0xda, 0x3, "8385412ea78111022408db841fa1212fa9f87937ec292fadcc5ccafb1a2299f896a62b74e0830494a1247389714e56b6615c3b09ab5a89aedcd86f69199800ffc15bc5eadae1ba052dfb087237ab4037c0cf8f5d6551858b6927ee6e3f8a0884bb2e353fa37237467bd9b4f34433bb556f723dd7b04d610ccf5d5d188411d75183b7e88af6a4512a7fe2f5f8fb8f02cbaff45aa9d1be89d8778ce0652b19562391498b831df1add28fd69687f89731b799939aba4fa5dd8b8adb3f7fba8fc045acc72afc367988a25d7b8d3e168c38f254dbe309686c192b"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0xc01}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x801}}, {0xa1, &(0x7f00000007c0)=@string={0xa1, 0x3, "487ef3775c2b3b7f890f601225f73f77c2f0e2ff1b72fe0cd9289bac60a8cf92196d8edcc5b59d625010f87d90eb063bd0744390d45d654f263646c63ed1ecc2a152442dedb73e4c52a43d39834aa879bedfa9bd869b865c8ad8c6a19416909521499481629e485e39f6fe9036ceb83b4978abc4f7c411e376cede1f8304fb1583859198f475a0e5141b98e6f44e18b6fec0842fd4bf0ae23288eeac311b73"}}]}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) epoll_create1(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000110f"], 0x58}}, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000940)=0xf) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x20, 0x80, 0x1c, {0x3, 0x9, 0xe4c, 0x2, 0x3, 0x3865, 0x8, 0x9, 0x1, 0x5, 0x4, 0x81}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r4 = gettid() r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r6, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000fa3000/0x4000)=nil}) r7 = syz_open_procfs(r4, &(0x7f0000000040)='timerslack_ns\x00') write$tun(r7, &(0x7f0000000140)=ANY=[@ANYRESDEC=r4], 0xfce) 11.583398788s ago: executing program 3 (id=2366): socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000005c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendto$inet(r2, &(0x7f00000011c0)="3ac253963b486d38dfc8e4b2c65647f2c2", 0x11, 0x2000c884, 0x0, 0x0) recvmmsg$unix(r2, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1}}], 0x1, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x180, 0x940c, 0x3002, 0x180, 0x2c0, 0x298, 0x3d8, 0x3d8, 0x298, 0x3d8, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xffffff00, 0xffffff00, 0xffffffff, 0xffffff00], [0xffffffff, 0xffffffff, 0xff000000, 0xff], 'geneve0\x00', 'veth1_to_bridge\x00', {}, {}, 0x84, 0x81, 0x2, 0x1d}, 0x0, 0x120, 0x180, 0x0, {}, [@common=@hl={{0x28}, {0x1, 0x7}}, @common=@inet=@multiport={{0x50}, {0xff, 0xb, [0x4e24, 0x4e22, 0x4e23, 0x4e22, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x4e20, 0x4e20, 0x4e23, 0x4e24, 0x4e22, 0x4e22, 0x4e21], [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x10]}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@remote, [0x0, 0xff000000, 0xffffffff, 0xff], 0x4e24, 0x4e24, 0x4e22, 0x4e21, 0xf, 0x21e8, 0x9, 0x1, 0x1}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xe}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'veth1_to_team\x00', {0x12}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = syz_io_uring_setup(0x5ce, &(0x7f0000000240)={0x0, 0x7734, 0x800, 0x3ffff, 0x34f}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2f, 0x0, 0x0, 0x4}]}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_NESTED_STATE(r6, 0xc080aebe, 0xfffffffffffffffe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0xb2752a96f73d6e14, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r3, 0x47bc, 0x3da8, 0x6, 0x0, 0x0) 11.284955607s ago: executing program 3 (id=2369): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\b\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x9, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fe, 0x5, 0x3, 0x9, 0x8, 0x45ff, 0x7ffffffc}, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB='&'], 0x10) close(r1) 10.572812767s ago: executing program 2 (id=2371): r0 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x4, 0xfffffffb}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f00000003c0)={0xfffffff9, 0x0, &(0x7f0000000240), 0x0, 0x5a}, 0x20) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) 10.035089706s ago: executing program 1 (id=2372): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x0) 8.494346515s ago: executing program 3 (id=2373): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[@cpuid={0x2, 0x18, {0xfffff000}}], 0x47}) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_ifreq(r4, 0x8931, &(0x7f0000000000)={'macsec0\x00', @ifru_hwaddr}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x0, 0xe, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 8.154721161s ago: executing program 1 (id=2376): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getrlimit(0xa, 0x0) getpid() r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r1, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000600)={0x88, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x44000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000000)={0x0, 0x3, 0xa5}) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r5, &(0x7f0000000380)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff0055e5c0d48bd63ffdb93bd43a847a1597c8ef039a5be422", 0x38}, 0x60) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000001080), 0x4) 7.714719832s ago: executing program 5 (id=2378): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) 7.700186483s ago: executing program 3 (id=2379): r0 = socket$nl_generic(0x10, 0x3, 0x10) eventfd2(0x0, 0x0) io_setup(0x81, &(0x7f0000000400)) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f0000000100)=0x1ff, 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000005c40)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000005d00)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f0000005c80)={0x1c, 0x0, 0x711, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000084}, 0x10) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r7 = open(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r6, 0xc018937d, &(0x7f0000000680)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)={0x38, r9, 0x1, 0x2, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x2}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20024010) 6.24265751s ago: executing program 5 (id=2382): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYRES32=r0], 0x38}}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES16=r1], 0x70}}, 0x24004801) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) r2 = fsopen(&(0x7f0000000000)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b//\\\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8br0], 0x38}}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES16=r1], 0x70}}, 0x24004801) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) r2 = fsopen(&(0x7f0000000000)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b//\\\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x2d) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, r8, 0x331, 0x0, 0x0, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4804}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x80000000000000, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0x200000b}, r10}}, 0x30) r11 = semget$private(0x0, 0x1, 0x5ca) semctl$IPC_RMID(r11, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r12 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r12, 0x40045010, &(0x7f0000000040)=0x5) 4.660783272s ago: executing program 0 (id=2385): ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x1, 'veth0_to_team\x00', {}, 0xff91}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000000000007000000ffffffff"]) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x1714, &(0x7f0000000300)={0x0, 0xfffffffc, 0x10100}, &(0x7f0000000100), &(0x7f0000000080)) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x1a4881) getsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x7, &(0x7f0000000200), &(0x7f0000000240)=0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e23, 0x7ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8008000}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000640)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r5, &(0x7f0000002540)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x19, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x14, @void, @value}, 0x94) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x27, 0x0, 0x1}, 0x6) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, @void}, 0x10) 4.420397126s ago: executing program 3 (id=2386): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='erofs\x00', 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000980)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="2000000004000000020000000000000001020000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ef00000005"], 0x50) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000180)}) unshare(0x40000000) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20000009, 0x0, &(0x7f0000000240)={0x80, 0x0, 0xfefc, 0x360}, 0x8, 0x9, 0x80, 0x0, 0x0, 0x103, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0xab}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x4) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, 0x0, 0x0) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000000)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = socket(0x1e, 0x4, 0x0) connect$tipc(r5, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r5, &(0x7f0000004400), 0x400000000000203, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) io_uring_setup(0x57c9, 0x0) pipe2$watch_queue(&(0x7f0000001180), 0x80) add_key(&(0x7f0000000000)='id_legacy\x00', 0x0, &(0x7f0000000080), 0x0, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x18, 0x2d, 0x1, 0x70bd28, 0x25dfdbfc, {0x4}, [@nested={0x4, 0xf}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x4040028) 4.210795679s ago: executing program 1 (id=2387): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r3 = fcntl$dupfd(r2, 0x406, r1) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x4c, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x31}, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000440), 0x2) r8 = memfd_create(&(0x7f00000009c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3) ftruncate(r8, 0xffff) fcntl$addseals(r8, 0x409, 0x7) r9 = ioctl$UDMABUF_CREATE(r7, 0x40187542, &(0x7f0000000100)={r8, 0x1, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f0000000080)=0x2) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f00000000c0)=0x1) r10 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x1000, 0x3}) setsockopt$inet_int(r10, 0x0, 0x15, &(0x7f0000000140)=0x400030, 0x4) bind$inet(r6, &(0x7f0000000180)={0x2, 0xce24, @broadcast}, 0x10) 4.20993065s ago: executing program 2 (id=2388): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x15, 0x10, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x20000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r4 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) recvfrom$llc(r4, &(0x7f0000000240)=""/189, 0xbd, 0x40000000, &(0x7f0000000040)={0x1a, 0x20, 0x3, 0x8, 0x40, 0xf7, @remote}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x8, 0xf, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {0x7, 0x0, 0xb, 0x2}, {0x85, 0x0, 0x0, 0x51}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000300)="85e3de50d5b66bd8f1ff08251a6c", 0x0, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.178230368s ago: executing program 5 (id=2389): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000000)) 3.480277712s ago: executing program 5 (id=2390): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) futex(0x0, 0xc, 0x1, 0x0, &(0x7f0000048000)=0x2, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="10000000031401002dbd700000030000"], 0x10}, 0x1, 0x0, 0x0, 0x854}, 0x0) connect$inet(r3, &(0x7f0000001980)={0x2, 0x1, @loopback}, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) r4 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x40a00, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TIOCMIWAIT(r5, 0x545c, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28010000060a0b04f1ffffffffffffff0200000034000480240001800b000100736f636b6574000014000280080002400000000008000140000000020c000180080001006e6174000900010073797a3000000000d200074043de2d0d7d11e597d6f86e88c53caaeb2a8d4f5ecca24c6b379e2aa468fdc984a35c56d0085440f7dca074a5e1783066b19d54c165cd09f7bc86c10299be480ef39c07085b6a1d48299b0bb40e11ceca700b5790ca70a2fc3671d30c3ceeed01dfbcbc703ce025470f17ef3f7156bccb680b707cb766d909be3e97547dc387f1b51cd86bdf0f1f0f178799e1d5045c74b42e8f0de06ffae642c6f33f6b2946262aa558e7c03277705cbc17e913cf8ff4b01c390e6a0d6516b9f425cc4ca83080528e3b551402263065b1f68c086d000014000000110001000000"], 0x150}}, 0x0) 3.469719763s ago: executing program 1 (id=2391): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x29, 0x80805, 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x2d) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, r8, 0x331, 0x0, 0x0, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4804}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x80000000000000, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0x200000b}, r10}}, 0x30) semctl$IPC_RMID(0x0, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r11 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r11, 0x40045010, &(0x7f0000000040)=0x5) 2.687377772s ago: executing program 0 (id=2392): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) 2.521938925s ago: executing program 1 (id=2393): r0 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x4, 0xfffffffb}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f00000003c0)={0xfffffff9, 0x0, &(0x7f0000000240), 0x0, 0x5a}, 0x20) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) 2.508588259s ago: executing program 0 (id=2394): fsopen(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, &(0x7f00000003c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000080)=0x48) mkdir(&(0x7f0000000400)='./file0\x00', 0x103) socket(0x8, 0x1, 0x6) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a3200000000140000"], 0x7c}, 0x1, 0x0, 0x0, 0xc800}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCOUTQ(r5, 0x5411, &(0x7f0000000000)) 1.54292152s ago: executing program 0 (id=2395): r0 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x4, 0xfffffffb}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f00000003c0)={0xfffffff9, 0x0, 0x0, 0x0}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) 1.454933644s ago: executing program 2 (id=2396): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000000)) 1.402665645s ago: executing program 2 (id=2397): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x19, &(0x7f0000000080), 0x4) bind$bt_hci(r0, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="3b00000001001f", 0x7) 365.995215ms ago: executing program 2 (id=2398): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000002f009500000000000000c77853c3247ad42600"/46], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r1}, 0x18) remap_file_pages(&(0x7f0000157000/0x2000)=nil, 0x1fffff, 0x0, 0x0, 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x10002, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fstat(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000001c0)={0x0, 0x100, {r3}, {r4}, 0x7, 0xfffffffffffffffe}) 357.742881ms ago: executing program 0 (id=2399): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) prlimit64(0x0, 0xb, &(0x7f0000000140), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = syz_io_uring_setup(0x65ac, &(0x7f0000000380)={0x0, 0xa482, 0x10, 0x200000, 0x33e, 0x0, r2}, &(0x7f0000000340)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r4, 0x0, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x40, 0x0, 0x3, 0x1, 0x0, 0xce}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000300)=ANY=[@ANYRESOCT=r4], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_MKDIRAT={0x25, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r3, 0x2d3e, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102400, 0x19000) socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x6, 0x4, 0x599, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340), &(0x7f0000000900), 0x404, r8, 0x0, 0x1ba8847c99}, 0x38) 182.984087ms ago: executing program 5 (id=2400): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0xffffffffffffffff, 0x8, &(0x7f00000000c0)=0x1000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) msgctl$IPC_RMID(0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102376, 0x18fe8) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r2, &(0x7f0000000300)=[{&(0x7f0000000000)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000b00)="92", 0x1}], 0x1, &(0x7f00000005c0)=[@dstaddrv6={0x20, 0x84, 0x8, @remote}], 0x20, 0x20000015}], 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) accept$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f0000000200)=0x10) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$SG_GET_PACK_ID(r4, 0x227c, &(0x7f0000000000)) 148.468318ms ago: executing program 0 (id=2401): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x0, 0x8, 0x2, {0x2, @win={{0x8, 0x8, 0x5, 0x3}, 0x0, 0x1, 0x0, 0x5, 0x0, 0x8}}}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000200)=ANY=[@ANYRESOCT=0x0], 0x18}}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = accept$alg(r3, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000002880)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}], 0x1, 0x4815) recvmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0x4000000f}], 0x1, 0x2101, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000180)=[{0x6, 0x8, 0x6, 0x7fff0006}]}) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@base={0x1, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r8, 0x2, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) close_range(r7, 0xffffffffffffffff, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000080)={0x4000, 0x3, 0x0, 0xffdfffff}, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000160001f47efde4be701161000a00"], 0x1c}}, 0x0) r10 = open(&(0x7f0000000140)='./bus\x00', 0x8000, 0x10b) linkat(r10, &(0x7f0000000000)='./file1\x00', r10, &(0x7f0000000240)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1e000000020000000b0000007f00000010000000", @ANYRES32=0x1, @ANYBLOB, @ANYRES32=r6, @ANYRES32=r10, @ANYBLOB="0300000004000000010000000d000000000000000000000000000000abf0f7f037513bab3be2a30c706b8a9cf01879987906492f21ebc8db4722e0b26455f1ba5b89bd224467151d6e3ec395461be164a017b55bb2c0728ba4da75d72af61e035f98291767700a69ac793282eda861"], 0x50) r11 = accept$unix(r10, &(0x7f0000001700)=@abs, &(0x7f0000000080)=0x6e) recvmmsg$unix(r11, &(0x7f0000000100)=[{{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000300)=""/241, 0xf1}, {&(0x7f0000000400)=""/70, 0x46}, {&(0x7f0000000480)=""/108, 0x6c}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000500)=""/86, 0x56}], 0x5, &(0x7f0000001640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x1, 0x4000, &(0x7f00000001c0)) io_setup(0x409, &(0x7f0000000600)=0x0) r13 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r12, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r13, &(0x7f00000000c0)="01", 0x24}]) 0s ago: executing program 5 (id=2402): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x1, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f00000006c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) connect$unix(r5, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x55c1, &(0x7f0000000180)={0x0, 0xd1bf, 0x40, 0x1, 0x378}, &(0x7f00000002c0), &(0x7f0000000300)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f00000020c0)=ANY=[@ANYBLOB="016f0800010000000000200000004600003f00000000008490783fffffffac1414aa000000001d467b30ca26998d5456a3a7cb7e7488558bedf7ff350f864f6ee0f89f54309613a2c5704bf6ba927ed00f644c55a3242bddc66b2a1b4c2ca2448f15b0087575fcc59eeedc7dedd634c77942e0d144bf3647ca243848f7df9e5dfd", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ba0007009078001409c400050200000000000000000002d58838068b91000000"], 0x4e) socket$inet6(0xa, 0x4, 0x3) io_uring_register$IORING_REGISTER_RING_FDS(r4, 0x14, &(0x7f0000001ec0)=[{0x6, 0x1, 0x0, &(0x7f0000000740)=[{&(0x7f0000000540)=""/124, 0x7c}, {&(0x7f0000000400)=""/221, 0xdd}, {&(0x7f0000002000)=""/160, 0xa0}, {&(0x7f0000000640)=""/94, 0x5e}, {&(0x7f0000001f40)=""/170, 0xaa}, {&(0x7f0000000500)=""/4, 0x4}], &(0x7f00000007c0)=[0x1000, 0x8, 0x2, 0x2, 0x0, 0x4, 0xdd90]}, {0x1, 0x1, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000800)=""/179, 0xb3}], &(0x7f0000000900)=[0x6000107, 0x4c254152, 0x0]}, {0x5, 0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000940)=""/27, 0x1b}, {&(0x7f0000000980)=""/123, 0xfffffe13}, {&(0x7f0000000a00)=""/134, 0x86}, {&(0x7f0000000ac0)=""/9, 0x9}, {&(0x7f0000000b00)=""/158, 0x9e}], &(0x7f0000000380)=[0x5, 0x5, 0xda, 0x8, 0x8, 0x8, 0x19c, 0x6]}, {0x5, 0x1, 0x0, &(0x7f0000001e00)=[{&(0x7f0000000c80)=""/4096, 0x1000}, {&(0x7f0000001c80)=""/7, 0x9}, {&(0x7f0000001cc0)=""/101, 0x65}, {&(0x7f0000001d40)=""/176, 0xb0}, {&(0x7f0000002500)=""/4096, 0x1000}], 0x0}], 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8000, &(0x7f00000024c0)=ANY=[@ANYBLOB='quota']) r8 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x250942, 0x1cd) quotactl_fd$Q_GETNEXTQUOTA(r8, 0xffffffff80000901, 0xee00, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x0) kernel console output (not intermixed with test programs): ummy_hcd [ 454.191917][ T7791] Bluetooth: (null): Invalid header checksum [ 454.331905][ T49] Bluetooth: (null): Invalid header checksum [ 454.584625][ T7791] Bluetooth: (null): Invalid header checksum [ 454.593451][ T7791] Bluetooth: (null): Invalid header checksum [ 454.602604][ T9790] usb 5-1: Using ep0 maxpacket: 32 [ 454.612659][ T9790] usb 5-1: config 0 has no interfaces? [ 454.618149][ T9790] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 454.639210][ T7791] Bluetooth: (null): Invalid header checksum [ 454.654986][T10745] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1322'. [ 454.754901][ T4535] Bluetooth: (null): Invalid header checksum [ 454.762794][ T9790] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.680590][ T5886] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 455.689254][ T9790] usb 5-1: config 0 descriptor?? [ 455.689927][ T4535] Bluetooth: (null): Invalid header checksum [ 455.712741][ T4535] Bluetooth: (null): Invalid header checksum [ 455.719340][ T4535] Bluetooth: (null): Invalid header checksum [ 455.727271][ T4535] Bluetooth: (null): Invalid header checksum [ 455.733722][ T4535] Bluetooth: (null): Invalid header checksum [ 455.741088][ T4535] Bluetooth: (null): Invalid header checksum [ 455.747228][ T4535] Bluetooth: (null): Invalid header checksum [ 455.753762][ T4535] Bluetooth: (null): Invalid header checksum [ 455.759874][ T4535] Bluetooth: (null): Invalid header checksum [ 455.950079][ T7791] Bluetooth: (null): Invalid header checksum [ 455.958506][ T7791] Bluetooth: (null): Invalid header checksum [ 456.062890][ T13] Bluetooth: (null): Invalid header checksum [ 456.075208][ T5886] usb 4-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 456.085480][ T5886] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 456.100561][ T5886] usb 4-1: Product: syz [ 456.105025][ T5886] usb 4-1: Manufacturer: syz [ 456.110016][ T5886] usb 4-1: SerialNumber: syz [ 456.126067][ T5886] usb 4-1: config 0 descriptor?? [ 456.511416][ T7778] Bluetooth: (null): Invalid header checksum [ 456.512715][ T5886] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 456.525806][ T7778] Bluetooth: (null): Invalid header checksum [ 456.526095][ T5886] dvb-usb: bulk message failed: -22 (2/0) [ 456.539971][ T5886] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 456.550572][ T7778] Bluetooth: (null): Invalid header checksum [ 456.550603][ T5886] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 456.556671][ T7778] Bluetooth: (null): Invalid header checksum [ 456.564768][ T5886] usb 4-1: media controller created [ 456.591679][ T5886] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 456.613205][ T7778] Bluetooth: (null): Invalid header checksum [ 456.702898][T10767] netlink: 'syz.0.1328': attribute type 10 has an invalid length. [ 456.731754][ T12] Bluetooth: (null): Invalid header checksum [ 456.744371][T10767] 8021q: adding VLAN 0 to HW filter on device team0 [ 456.858121][ T12] Bluetooth: (null): Invalid header checksum [ 456.867666][T10767] bond0: (slave team0): Enslaving as an active interface with an up link [ 456.941021][ T12] Bluetooth: (null): Invalid header checksum [ 457.074599][ T7778] Bluetooth: (null): Invalid header checksum [ 457.252058][ T12] Bluetooth: (null): Invalid header checksum [ 457.270838][ T7778] Bluetooth: (null): Invalid header checksum [ 457.821638][ T12] Bluetooth: (null): Invalid header checksum [ 457.850105][ T9808] usb 5-1: USB disconnect, device number 23 [ 457.868503][ T12] Bluetooth: (null): Invalid header checksum [ 457.874964][ T12] Bluetooth: (null): Invalid header checksum [ 457.887046][ T12] Bluetooth: (null): Invalid header checksum [ 458.003624][T10770] infiniband syz2: set down [ 458.037677][ T5886] cxusb: set interface failed [ 458.046219][ T5886] dvb-usb: bulk message failed: -22 (1/0) [ 458.060723][T10770] infiniband syz2: added team_slave_0 [ 458.066669][T10770] syz2: rxe_create_cq: returned err = -12 [ 458.073986][T10770] infiniband syz2: Couldn't create ib_mad CQ [ 458.080132][T10770] infiniband syz2: Couldn't open port 1 [ 458.106343][T10770] RDS/IB: syz2: added [ 458.112017][T10770] smc: adding ib device syz2 with port count 1 [ 458.118239][T10770] smc: ib device syz2 port 1 has pnetid [ 458.136498][T10781] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1333'. [ 458.148524][ T5886] DVB: Unable to find symbol mt352_attach() [ 458.362597][ T5886] dvb-usb: bulk message failed: -22 (5/0) [ 458.389277][T10781] 8021q: adding VLAN 0 to HW filter on device bond1 [ 458.389598][ T5886] zl10353_read_register: readreg error (reg=127, ret==-121) [ 458.410650][ T5886] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 458.452916][T10790] cgroup: Invalid name [ 458.457957][T10781] 8021q: adding VLAN 0 to HW filter on device bond1 [ 458.472467][T10781] bond1: (slave vcan1): The slave device specified does not support setting the MAC address [ 458.508299][T10791] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1333'. [ 458.639263][T10781] bond1: (slave vcan1): Error -95 calling set_mac_address [ 458.670492][ T5886] rc_core: IR keymap rc-dvico-mce not found [ 458.685323][ T5886] Registered IR keymap rc-empty [ 458.710583][ T5886] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 458.897346][ T5886] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input21 [ 459.098771][ T5886] dvb-usb: schedule remote query interval to 100 msecs. [ 459.107831][ T5886] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 459.131701][ T5886] usb 4-1: USB disconnect, device number 37 [ 459.221025][ T5886] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 460.722847][T10809] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1337'. [ 460.747734][T10810] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1337'. [ 465.856743][T10850] program syz.3.1346 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 466.680558][ T30] audit: type=1400 audit(1750048618.022:769): avc: denied { setopt } for pid=10851 comm="syz.3.1349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 466.930512][ T5886] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 467.110665][ T5886] usb 1-1: Using ep0 maxpacket: 32 [ 467.130192][ T5886] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 467.198271][ T5886] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 467.215618][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 467.255987][ T5886] usb 1-1: Product: syz [ 467.293170][ T5886] usb 1-1: Manufacturer: syz [ 467.297850][ T5886] usb 1-1: SerialNumber: syz [ 467.332678][ T5886] usb 1-1: config 0 descriptor?? [ 467.338328][T10857] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 468.372759][ T5871] usb 1-1: USB disconnect, device number 21 [ 469.560888][T10857] QAT: Device 7 not found [ 471.951467][T10908] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 471.968821][T10908] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 472.968195][T10914] afs: Unknown parameter 'dyn/wireless' [ 472.987934][T10912] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 473.105353][T10924] lo speed is unknown, defaulting to 1000 [ 474.083854][T10950] program syz.3.1371 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 474.478398][T10951] syz_tun: entered allmulticast mode [ 474.514213][T10951] dvmrp1: entered allmulticast mode [ 474.535557][T10949] syz_tun: left allmulticast mode [ 476.468501][ T30] audit: type=1400 audit(1750048627.832:770): avc: denied { create } for pid=10959 comm="syz.3.1377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 479.978260][T10986] tmpfs: Unknown parameter 'q' [ 480.675403][ T30] audit: type=1400 audit(1750048632.012:771): avc: denied { map } for pid=10994 comm="syz.4.1387" path="socket:[32358]" dev="sockfs" ino=32358 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 480.861001][ T30] audit: type=1400 audit(1750048632.012:772): avc: denied { read } for pid=10994 comm="syz.4.1387" path="socket:[32358]" dev="sockfs" ino=32358 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 482.039056][ T30] audit: type=1400 audit(1750048633.362:773): avc: denied { ioctl } for pid=11017 comm="syz.1.1391" path="/333/file0" dev="tmpfs" ino=1820 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 483.333985][T10996] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.343112][T10996] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.352574][T10996] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.361602][T10996] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.432895][T10996] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.442410][T10996] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.451419][T10996] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.460343][T10996] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.575370][ T30] audit: type=1400 audit(1750048635.942:774): avc: denied { write } for pid=11045 comm="syz.3.1397" name="btrfs-control" dev="devtmpfs" ino=1310 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 484.614823][ T30] audit: type=1400 audit(1750048635.962:775): avc: denied { write } for pid=11045 comm="syz.3.1397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 485.330997][T11059] program syz.3.1400 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 485.737459][T11064] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 487.074814][T11076] afs: Unknown parameter 'dyn/wireless' [ 487.263165][T11072] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 487.843939][T11085] 9pnet_fd: Insufficient options for proto=fd [ 488.698820][T11093] tmpfs: Unknown parameter 'quota$' [ 489.414685][T11098] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1410'. [ 489.932329][T11109] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47 sclass=netlink_route_socket pid=11109 comm=syz.3.1413 [ 491.242680][T11132] overlayfs: failed to resolve './bus/file0': -2 [ 492.259437][T11127] cgroup: fork rejected by pids controller in /syz4 [ 492.327587][T11144] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1422'. [ 492.622639][T11237] sch_fq: defrate 0 ignored. [ 495.135591][T11271] netlink: 'syz.2.1433': attribute type 4 has an invalid length. [ 495.166247][T11271] netlink: 'syz.2.1433': attribute type 10 has an invalid length. [ 495.210564][T11271] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1433'. [ 495.506026][T11277] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 495.514742][T11277] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 495.522951][T11277] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 495.875675][T11277] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 495.886824][T11277] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 495.977212][ T30] audit: type=1400 audit(1750048647.312:776): avc: denied { mounton } for pid=11274 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 495.998680][ C0] vkms_vblank_simulate: vblank timer overrun [ 496.081342][T11287] sch_fq: defrate 0 ignored. [ 496.260485][ T30] audit: type=1400 audit(1750048647.622:777): avc: denied { name_bind } for pid=11293 comm="syz.2.1440" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 496.612756][T11302] afs: Unknown parameter 'dyn/wireless' [ 496.807960][T11296] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 497.581219][ T7778] bond0 (unregistering): Released all slaves [ 497.718007][T11328] xt_hashlimit: overflow, try lower: 17592186044416/2047 [ 497.732416][T11328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1447'. [ 497.866888][T11274] lo speed is unknown, defaulting to 1000 [ 497.921193][T11277] Bluetooth: hci0: command tx timeout [ 498.175786][T11329] veth0_vlan: entered allmulticast mode [ 498.183735][T11330] veth0_vlan: left promiscuous mode [ 498.190258][T11330] veth0_vlan: entered promiscuous mode [ 498.217033][T11331] lo speed is unknown, defaulting to 1000 [ 499.347165][T11345] program syz.0.1452 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 500.333878][T11277] Bluetooth: hci0: command tx timeout [ 500.660597][ T5831] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 500.964522][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.971182][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.363605][ T5831] usb 1-1: Using ep0 maxpacket: 8 [ 501.377653][ T5831] usb 1-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 501.411621][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.444455][ T5831] usb 1-1: Product: syz [ 501.451908][ T5831] usb 1-1: Manufacturer: syz [ 501.482683][ T5831] usb 1-1: SerialNumber: syz [ 501.509822][ T5831] usb 1-1: config 0 descriptor?? [ 501.542378][ T5831] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 501.557436][T11277] Bluetooth: hci3: Malformed Event: 0x02 [ 502.401269][T11277] Bluetooth: hci0: command tx timeout [ 502.560409][ T7778] hsr_slave_0: left promiscuous mode [ 502.630898][ T5831] gspca_sonixj: reg_r err -71 [ 502.635679][ T5831] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 502.651494][ T7778] hsr_slave_1: left promiscuous mode [ 502.653535][ T5831] usb 1-1: USB disconnect, device number 22 [ 502.659081][T11374] overlay: ./file0 is not a directory [ 502.697432][T11374] autofs: Bad value for 'fd' [ 504.520308][T11277] Bluetooth: hci0: command tx timeout [ 505.631757][T11274] chnl_net:caif_netlink_parms(): no params data found [ 505.762792][T11398] lo speed is unknown, defaulting to 1000 [ 505.859349][T11274] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.879570][T11274] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.895753][T11274] bridge_slave_0: entered allmulticast mode [ 505.913703][T11274] bridge_slave_0: entered promiscuous mode [ 505.931766][T11274] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.949180][T11274] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.965380][T11274] bridge_slave_1: entered allmulticast mode [ 505.984171][T11274] bridge_slave_1: entered promiscuous mode [ 506.051233][T11274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 506.073056][T11274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 506.135828][T11407] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11407 comm=syz.0.1465 [ 506.234966][T11274] team0: Port device team_slave_0 added [ 506.265838][T11274] team0: Port device team_slave_1 added [ 506.360034][T11274] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 506.380538][T11274] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 506.448061][T11274] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 506.483352][T11274] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 506.490314][T11274] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 506.516189][ C0] vkms_vblank_simulate: vblank timer overrun [ 506.560673][T11274] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 506.961715][T11274] hsr_slave_0: entered promiscuous mode [ 507.001796][T11274] hsr_slave_1: entered promiscuous mode [ 507.019992][T11274] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 507.082586][T11430] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 507.543314][ T9808] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 507.554693][T11274] Cannot create hsr debugfs directory [ 507.760981][ T9808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 507.780475][ T9808] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42240, setting to 1024 [ 507.794923][ T9808] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 507.809834][ T9808] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.002124][ T9808] usb 4-1: config 0 descriptor?? [ 508.504205][T11420] bio_check_eod: 2 callbacks suppressed [ 508.504221][T11420] syz.3.1472: attempt to access beyond end of device [ 508.504221][T11420] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 508.595117][T11420] syz.3.1472: attempt to access beyond end of device [ 508.595117][T11420] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 508.652123][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 508.661940][T11420] syz.3.1472: attempt to access beyond end of device [ 508.661940][T11420] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 508.662313][T11277] Bluetooth: hci1: Malformed Event: 0x02 [ 508.674909][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 508.675641][T11420] syz.3.1472: attempt to access beyond end of device [ 508.675641][T11420] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 508.725405][T11420] syz.3.1472: attempt to access beyond end of device [ 508.725405][T11420] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 508.738829][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 508.748552][T11420] syz.3.1472: attempt to access beyond end of device [ 508.748552][T11420] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 508.762000][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 508.772217][T11420] syz.3.1472: attempt to access beyond end of device [ 508.772217][T11420] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 508.785281][T11420] syz.3.1472: attempt to access beyond end of device [ 508.785281][T11420] nbd3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 508.808821][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 508.891734][T11420] syz.3.1472: attempt to access beyond end of device [ 508.891734][T11420] nbd3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 508.928656][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 509.084076][ T9808] ath6kl: Failed to submit usb control message: -110 [ 509.168426][T11420] syz.3.1472: attempt to access beyond end of device [ 509.168426][T11420] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 509.253459][ T9808] ath6kl: unable to send the bmi data to the device: -110 [ 509.353853][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 509.364077][ T9808] ath6kl: Unable to send get target info: -110 [ 509.364292][T11420] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 509.380955][T11420] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 509.416054][ T9808] ath6kl: Failed to init ath6kl core: -110 [ 509.429490][ T9808] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 509.499657][ T973] usb 4-1: USB disconnect, device number 38 [ 510.445695][T11274] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 510.471710][T11274] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 510.496835][T11274] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 510.535106][T11274] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 510.552288][T11464] overlayfs: failed to clone upperpath [ 510.778271][T11274] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.883766][T11274] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.380847][ T3547] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.387959][ T3547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.398511][ T30] audit: type=1400 audit(1750048662.772:778): avc: denied { execute } for pid=11478 comm="syz.3.1484" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=34122 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 511.403478][ T3547] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.434491][ T3547] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.660583][ T5886] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 511.850603][ T5886] usb 4-1: device descriptor read/64, error -71 [ 511.937004][T11274] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 512.539957][ T5886] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 512.790512][ T5886] usb 4-1: device descriptor read/64, error -71 [ 513.315549][ T5886] usb usb4-port1: attempt power cycle [ 513.581150][T11521] program syz.0.1495 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 513.626894][T11274] veth0_vlan: entered promiscuous mode [ 513.681820][T11526] netlink: 192 bytes leftover after parsing attributes in process `syz.2.1497'. [ 513.717676][T11274] veth1_vlan: entered promiscuous mode [ 513.815730][T11274] veth0_macvtap: entered promiscuous mode [ 513.824370][T11274] veth1_macvtap: entered promiscuous mode [ 513.865032][ T5886] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 514.038776][T11274] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 514.290652][ T5886] usb 4-1: device not accepting address 41, error -71 [ 514.395312][T11532] program syz.3.1498 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 514.948445][T11274] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 514.978163][T11274] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.997438][T11274] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.017134][T11274] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.043406][T11274] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.336194][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.404651][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.469353][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.481296][T11536] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 517.503815][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.633149][ T30] audit: type=1400 audit(1750048668.992:779): avc: denied { ioctl } for pid=11541 comm="syz.0.1502" path="socket:[33619]" dev="sockfs" ino=33619 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 517.724697][ T30] audit: type=1400 audit(1750048669.042:780): avc: denied { mounton } for pid=11274 comm="syz-executor" path="/root/syzkaller.mHHeFO/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=34356 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 517.760545][ T30] audit: type=1400 audit(1750048669.062:781): avc: denied { mount } for pid=11274 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 517.797614][ T30] audit: type=1400 audit(1750048669.062:782): avc: denied { mounton } for pid=11274 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 520.077848][ T30] audit: type=1400 audit(1750048671.442:783): avc: denied { read } for pid=11561 comm="syz.0.1507" path="socket:[34397]" dev="sockfs" ino=34397 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 520.115050][ T30] audit: type=1400 audit(1750048671.442:784): avc: denied { getopt } for pid=11561 comm="syz.0.1507" lport=50240 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 521.810602][ T5886] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 522.169284][T11591] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 522.337522][ T5886] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 522.409940][ T5886] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42240, setting to 1024 [ 522.451277][ T5886] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 522.471099][ T5886] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.512261][ T5886] usb 4-1: config 0 descriptor?? [ 522.990678][T11582] bio_check_eod: 2 callbacks suppressed [ 522.990695][T11582] syz.3.1511: attempt to access beyond end of device [ 522.990695][T11582] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 523.131285][T11277] Bluetooth: hci1: Malformed Event: 0x02 [ 523.148268][T11582] syz.3.1511: attempt to access beyond end of device [ 523.148268][T11582] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 523.188163][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 523.338568][T11582] syz.3.1511: attempt to access beyond end of device [ 523.338568][T11582] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 523.450659][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 523.491427][T11582] syz.3.1511: attempt to access beyond end of device [ 523.491427][T11582] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 523.506001][T11582] syz.3.1511: attempt to access beyond end of device [ 523.506001][T11582] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 523.517181][T11615] syz.0.1519: attempt to access beyond end of device [ 523.517181][T11615] loop0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 523.519857][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 523.649580][T11582] syz.3.1511: attempt to access beyond end of device [ 523.649580][T11582] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 523.682267][ T5886] ath6kl: Failed to submit usb control message: -110 [ 523.693806][ T5886] ath6kl: unable to send the bmi data to the device: -110 [ 523.726651][ T5886] ath6kl: Unable to send get target info: -110 [ 523.772791][ T5886] ath6kl: Failed to init ath6kl core: -110 [ 523.780554][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 523.953582][T11629] syz.0.1521: attempt to access beyond end of device [ 523.953582][T11629] nbd0: rw=0, sector=2, nr_sectors = 2 limit=0 [ 523.966547][T11629] vxfs: unable to read disk superblock at 1 [ 523.972841][T11629] syz.0.1521: attempt to access beyond end of device [ 523.972841][T11629] nbd0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 523.985650][T11629] vxfs: unable to read disk superblock at 8 [ 523.991569][T11629] vxfs: can't find superblock. [ 524.211442][T11582] syz.3.1511: attempt to access beyond end of device [ 524.211442][T11582] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 524.220937][ T5886] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 524.224572][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 524.248259][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 524.259342][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 524.269360][T11582] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 524.295600][T11582] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 524.351357][ T5831] usb 4-1: USB disconnect, device number 43 [ 524.811711][T11639] program syz.0.1525 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 525.216434][T11277] Bluetooth: hci1: unexpected event for opcode 0x0c1b [ 525.667740][T11666] trusted_key: syz.3.1533 sent an empty control message without MSG_MORE. [ 526.396652][T11684] sch_tbf: burst 5 is lower than device bond0 mtu (1514) ! [ 526.840585][ T9808] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 527.062180][ T9808] usb 1-1: config 0 has an invalid interface number: 84 but max is 0 [ 527.070289][ T9808] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 527.100476][ T9808] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 527.109456][ T9808] usb 1-1: config 0 has no interface number 0 [ 527.127542][ T9808] usb 1-1: config 0 has no interface number 1 [ 527.140486][ T9808] usb 1-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 527.293873][T11691] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nullb0": -EINTR [ 527.302008][ T9808] usb 1-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 527.325717][ T9808] usb 1-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 527.337483][ T9808] usb 1-1: config 0 interface 66 altsetting 153 bulk endpoint 0x5 has invalid maxpacket 32 [ 527.347548][ T9808] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0x12, changing to 0x2 [ 527.359277][ T9808] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 527.443411][T11706] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1542'. [ 527.826698][ T9808] usb 1-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 53 [ 527.836864][ T9808] usb 1-1: config 0 interface 66 altsetting 153 has 3 endpoint descriptors, different from the interface descriptor's value: 216 [ 527.850963][ T9808] usb 1-1: config 0 interface 66 has no altsetting 0 [ 527.859624][ T9808] usb 1-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 527.869025][ T9808] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.877052][ T9808] usb 1-1: Product: syz [ 527.890466][ T9808] usb 1-1: Manufacturer: syz [ 527.895092][ T9808] usb 1-1: SerialNumber: syz [ 527.911821][ T9808] usb 1-1: config 0 descriptor?? [ 527.921857][ T9808] ljca 1-1:0.84: bulk endpoints not found [ 528.070553][ T5851] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 528.177103][ T9808] ljca 1-1:0.66: probe with driver ljca failed with error -71 [ 528.235376][ T9808] usb 1-1: USB disconnect, device number 23 [ 529.516251][ T5851] usb 5-1: Using ep0 maxpacket: 16 [ 529.675536][ T5851] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 7.00 [ 529.686307][ T5851] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.696808][ T5851] usb 5-1: Product: syz [ 529.798824][ T5851] usb 5-1: Manufacturer: syz [ 529.803867][ T5851] usb 5-1: SerialNumber: syz [ 529.831215][ T5851] usb 5-1: config 0 descriptor?? [ 529.838235][ T5851] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 529.848256][ T5851] usb 5-1: Detected FT2232H [ 529.866992][T11720] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1548'. [ 531.643117][T11730] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1551'. [ 531.687807][T11731] netlink: 'syz.1.1550': attribute type 13 has an invalid length. [ 531.720491][T11732] overlayfs: missing 'lowerdir' [ 531.738567][ T30] audit: type=1400 audit(1750048683.102:785): avc: denied { write } for pid=11729 comm="syz.0.1551" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 531.881399][T11737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.897421][T11737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.934758][T11277] Bluetooth: hci3: Malformed Event: 0x02 [ 532.160762][ T5831] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 532.229168][ T5851] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 532.238766][ T5851] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 532.261495][ T5851] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 532.272534][ T5851] usb 5-1: USB disconnect, device number 24 [ 532.282432][ T5851] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 532.292225][ T5851] ftdi_sio 5-1:0.0: device disconnected [ 532.297840][ T30] audit: type=1400 audit(1750048683.662:786): avc: denied { append } for pid=11750 comm="syz.4.1558" name="ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 532.325051][ T30] audit: type=1400 audit(1750048683.672:787): avc: denied { bind } for pid=11750 comm="syz.4.1558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 532.349519][ T5831] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 532.370864][ T5831] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.378849][ T5831] usb 4-1: Product: syz [ 532.390819][ T5831] usb 4-1: Manufacturer: syz [ 532.395421][ T5831] usb 4-1: SerialNumber: syz [ 532.421071][ T5831] usb 4-1: config 0 descriptor?? [ 532.427518][ T5831] ch341 4-1:0.0: ch341-uart converter detected [ 532.535816][T11754] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 532.924951][T11765] program syz.0.1563 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 533.059633][ T30] audit: type=1400 audit(1750048684.422:788): avc: denied { ioctl } for pid=11766 comm="syz.4.1565" path="socket:[34732]" dev="sockfs" ino=34732 ioctlcmd=0x3b85 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 533.105960][ T5822] block nbd0: Receive control failed (result -107) [ 533.210501][T11774] nbd0: detected capacity change from 0 to 67108884 [ 533.220563][T11770] block nbd0: Dead connection, failed to find a fallback [ 533.228889][ T5831] ch341-uart ttyUSB0: break control not supported, using simulated break [ 533.252202][ T5831] usb 4-1: ch341-uart converter now attached to ttyUSB0 [ 533.259257][T11770] block nbd0: shutting down sockets [ 533.269826][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.291700][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.299718][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.349450][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.384122][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.455415][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.488840][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.508127][ T30] audit: type=1400 audit(1750048684.872:789): avc: denied { getopt } for pid=11778 comm="syz.2.1569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 533.521185][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.566446][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.656583][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.667630][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.678824][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.691252][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.700954][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.709110][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.719547][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.746431][T11770] ldm_validate_partition_table(): Disk read failed. [ 533.754553][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.763903][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.830926][T11770] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.849998][T11770] Buffer I/O error on dev nbd0, logical block 0, async page read [ 533.854402][ T5822] Bluetooth: hci3: Malformed Event: 0x02 [ 533.879861][T11770] Dev nbd0: unable to read RDB block 0 [ 533.925935][T11770] nbd0: unable to read partition table [ 533.963316][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 533.994543][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554441, location=33554441 [ 534.011957][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554185, location=33554185 [ 534.023101][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554440, location=33554440 [ 534.038477][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554184, location=33554184 [ 534.049062][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554439, location=33554439 [ 534.059741][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554183, location=33554183 [ 534.071076][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554291, location=33554291 [ 534.094958][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554035, location=33554035 [ 534.117723][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554289, location=33554289 [ 534.129698][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=33554033, location=33554033 [ 534.143135][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 534.166709][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 534.176796][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16777220, location=16777220 [ 534.187843][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16776964, location=16776964 [ 534.202299][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16777219, location=16777219 [ 534.222875][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16776963, location=16776963 [ 534.235737][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16777218, location=16777218 [ 534.247961][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16776962, location=16776962 [ 534.262490][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16777070, location=16777070 [ 534.273289][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16776814, location=16776814 [ 534.300772][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16777068, location=16777068 [ 534.321544][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=16776812, location=16776812 [ 534.335844][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 534.367237][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 534.389217][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388609, location=8388609 [ 534.401634][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388353, location=8388353 [ 534.413273][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388608, location=8388608 [ 534.484173][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388352, location=8388352 [ 534.529687][T11813] openvswitch: netlink: Flow key attr not present in new flow. [ 534.531385][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388607, location=8388607 [ 534.574914][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388351, location=8388351 [ 534.597691][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388459, location=8388459 [ 534.608627][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388203, location=8388203 [ 534.619065][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388457, location=8388457 [ 534.629527][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=8388201, location=8388201 [ 534.639939][T11770] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 534.649846][T11770] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 534.815137][ T5831] usb 4-1: USB disconnect, device number 44 [ 534.835010][ T5831] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 534.862560][ T5831] ch341 4-1:0.0: device disconnected [ 534.906021][T11823] program syz.3.1587 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 534.957187][T11828] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1585'. [ 535.133606][ T5822] Bluetooth: hci0: command 0x0405 tx timeout [ 535.448837][T11833] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 535.616052][T11847] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1593'. [ 535.760029][ T5851] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 536.296044][ T5851] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 536.342768][ T5851] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42240, setting to 1024 [ 536.355052][ T5851] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 536.386160][ T5851] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.396342][ T5851] usb 1-1: config 0 descriptor?? [ 536.629903][T11277] Bluetooth: hci2: Malformed Event: 0x02 [ 536.750822][ T5851] ath6kl: Failed to submit usb control message: -71 [ 536.882887][ T5851] ath6kl: unable to send the bmi data to the device: -71 [ 537.570515][ T5851] ath6kl: Unable to send get target info: -71 [ 537.597884][ T5851] ath6kl: Failed to init ath6kl core: -71 [ 538.080880][ T5851] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 538.163128][ T5851] usb 1-1: USB disconnect, device number 24 [ 541.330870][T11277] Bluetooth: hci0: link tx timeout [ 541.337510][T11277] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 541.625898][ T5822] Bluetooth: hci0: Malformed Event: 0x02 [ 541.850055][T11935] sch_fq: defrate 0 ignored. [ 542.050933][ T10] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 542.120664][T11939] program syz.0.1621 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 542.220661][ T10] usb 4-1: device descriptor read/64, error -71 [ 542.460827][ T10] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 542.640789][ T10] usb 4-1: device descriptor read/64, error -71 [ 543.274840][ T10] usb usb4-port1: attempt power cycle [ 543.738630][T11277] Bluetooth: hci0: command 0x0405 tx timeout [ 545.180217][ T10] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 545.930562][ T10] usb 4-1: device descriptor read/8, error -71 [ 546.320837][ T10] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 546.449622][ T10] usb 4-1: device descriptor read/8, error -71 [ 546.522495][T11962] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 546.590256][ T10] usb usb4-port1: unable to enumerate USB device [ 547.859414][ T30] audit: type=1400 audit(1750048699.222:790): avc: denied { map } for pid=11989 comm="syz.0.1638" path="socket:[35485]" dev="sockfs" ino=35485 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 548.223966][ T30] audit: type=1400 audit(1750048699.592:791): avc: denied { getopt } for pid=12000 comm="syz.0.1641" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 549.771188][T12037] program syz.0.1648 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 553.818934][ T30] audit: type=1400 audit(1750048705.182:792): avc: denied { write } for pid=12069 comm="syz.1.1660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 555.171084][ T30] audit: type=1326 audit(1750048706.522:793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.303702][ T30] audit: type=1326 audit(1750048706.522:794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.340771][ T30] audit: type=1326 audit(1750048706.532:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.458233][ T30] audit: type=1326 audit(1750048706.532:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.595115][ T30] audit: type=1326 audit(1750048706.532:797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.823638][ T30] audit: type=1326 audit(1750048706.532:798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.849409][ T30] audit: type=1326 audit(1750048706.532:799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 555.851370][T12110] program syz.3.1668 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 555.878394][ T30] audit: type=1326 audit(1750048706.532:800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 556.148464][ T30] audit: type=1326 audit(1750048706.532:801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12097 comm="syz.4.1669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc3898e929 code=0x7ffc0000 [ 556.488707][T12116] program syz.0.1673 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 557.156314][T12123] sch_fq: defrate 0 ignored. [ 557.494776][T12135] program syz.3.1681 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 558.054354][T12132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1680'. [ 558.074093][T12132] netlink: 'syz.1.1680': attribute type 20 has an invalid length. [ 558.160581][T12132] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1680'. [ 558.312537][T12146] overlayfs: failed to clone upperpath [ 560.712859][T12175] sch_fq: defrate 0 ignored. [ 561.438664][T11277] Bluetooth: hci0: Malformed Event: 0x02 [ 562.405451][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.412176][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.530779][ T5851] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 562.560471][ T9808] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 562.638441][T12209] 8021q: adding VLAN 0 to HW filter on device bond3 [ 562.690471][ T5851] usb 1-1: Using ep0 maxpacket: 16 [ 562.705063][ T5851] usb 1-1: config 1 has an invalid descriptor of length 237, skipping remainder of the config [ 562.810059][ T5851] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 562.820460][ T9808] usb 4-1: Using ep0 maxpacket: 32 [ 562.831842][ T9808] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 562.853515][ T9808] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 562.866152][ T9808] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 562.883857][ T5851] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 562.921940][ T9808] usb 4-1: Product: syz [ 562.926210][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.934254][ T9808] usb 4-1: Manufacturer: syz [ 562.938919][ T9808] usb 4-1: SerialNumber: syz [ 562.943569][ T5851] usb 1-1: Product: syz [ 562.949038][ T5851] usb 1-1: Manufacturer: syz [ 562.970540][ T5851] usb 1-1: SerialNumber: syz [ 563.072964][ T9808] usb 4-1: config 0 descriptor?? [ 563.081154][T12207] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 563.619480][ T5851] usb 1-1: invalid UAC_HEADER (v1) [ 563.657523][ T3077] usb 4-1: USB disconnect, device number 49 [ 563.677380][ T5851] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 563.709078][ T5851] usb 1-1: USB disconnect, device number 25 [ 564.634347][T12227] QAT: Device 7 not found [ 567.999231][T12244] netlink: 'syz.1.1714': attribute type 1 has an invalid length. [ 568.861139][T12244] netlink: 'syz.1.1714': attribute type 2 has an invalid length. [ 569.140536][ T5831] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 569.323970][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 569.670297][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42240, setting to 1024 [ 569.817852][ T5831] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 570.020712][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.049424][ T5831] usb 4-1: config 0 descriptor?? [ 570.109754][T12259] program syz.0.1719 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 570.822274][T11277] Bluetooth: hci1: Malformed Event: 0x02 [ 570.828426][ T5831] ath6kl: Failed to submit usb control message: -71 [ 570.836110][ T5831] ath6kl: unable to send the bmi data to the device: -71 [ 570.843465][ T5831] ath6kl: Unable to send get target info: -71 [ 571.022456][ T5831] ath6kl: Failed to init ath6kl core: -71 [ 571.038928][ T5831] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 571.074791][ T5831] usb 4-1: USB disconnect, device number 50 [ 571.340860][ T5851] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 571.492724][ T5851] usb 1-1: Using ep0 maxpacket: 16 [ 571.511369][ T5851] usb 1-1: config 1 has an invalid descriptor of length 237, skipping remainder of the config [ 571.534202][ T5851] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 571.562743][ T5851] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 571.581459][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.600787][ T5851] usb 1-1: Product: syz [ 571.605050][ T5851] usb 1-1: Manufacturer: syz [ 571.609645][ T5851] usb 1-1: SerialNumber: syz [ 572.322308][ T5851] usb 1-1: invalid UAC_HEADER (v1) [ 572.336237][ T5851] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 572.346531][ T5851] usb 1-1: USB disconnect, device number 26 [ 573.748371][T12297] afs: Unknown parameter 'obj_user' [ 574.486471][T12307] sch_fq: defrate 0 ignored. [ 575.260495][ T973] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 576.293702][T12320] lo speed is unknown, defaulting to 1000 [ 577.202175][ T973] usb 1-1: Using ep0 maxpacket: 16 [ 577.778955][ T973] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 577.834075][ T973] usb 1-1: can't read configurations, error -71 [ 577.942725][T12335] lo speed is unknown, defaulting to 1000 [ 578.191055][ T973] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 578.253535][T12345] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 578.262821][T12345] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 578.362037][ T973] usb 1-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 36, changing to 9 [ 578.373618][ T973] usb 1-1: config 0 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.383725][ T973] usb 1-1: config 0 interface 0 has no altsetting 0 [ 578.390657][ T973] usb 1-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 578.399887][ T973] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.410187][ T973] usb 1-1: config 0 descriptor?? [ 578.697367][T12331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 578.708067][T12331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.970061][ T973] usbhid 1-1:0.0: can't add hid device: -71 [ 578.987652][ T973] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 579.012822][ T973] usb 1-1: USB disconnect, device number 28 [ 581.840720][ T5851] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 581.861065][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 582.806280][ T30] audit: type=1400 audit(1750048733.222:838): avc: denied { write } for pid=12381 comm="syz.3.1757" name="mouse0" dev="devtmpfs" ino=988 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 582.829540][ C1] vkms_vblank_simulate: vblank timer overrun [ 583.932534][ T30] audit: type=1400 audit(1750048733.292:839): avc: denied { setopt } for pid=12381 comm="syz.3.1757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 584.538841][T12397] : entered promiscuous mode [ 585.118388][T12399] kAFS: No cell specified [ 585.352380][T12393] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 585.490835][T12407] sch_fq: defrate 0 ignored. [ 585.614288][T11277] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 585.623358][T11277] Bluetooth: hci2: Injecting HCI hardware error event [ 585.631796][T11277] Bluetooth: hci2: hardware error 0x00 [ 585.890988][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 586.081118][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 586.297504][ T5851] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 586.305187][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 42240, setting to 1024 [ 586.359209][ T10] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 586.422394][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.462419][ T5851] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 586.472353][ T5851] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 586.472988][ T10] usb 1-1: config 0 descriptor?? [ 586.714424][ T10] ath6kl: Failed to submit usb control message: -71 [ 586.721396][ T5851] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 587.066655][ T5822] Bluetooth: hci2: Malformed Event: 0x02 [ 587.066666][ T10] ath6kl: unable to send the bmi data to the device: -71 [ 587.066683][ T10] ath6kl: Unable to send get target info: -71 [ 587.367487][ T10] ath6kl: Failed to init ath6kl core: -71 [ 587.374761][ T10] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 587.404768][ T10] usb 1-1: USB disconnect, device number 30 [ 587.410895][ T5851] usb 4-1: config 1 has no interface number 1 [ 587.428868][ T5851] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 587.493042][ T5851] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 587.504038][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.518615][ T5851] usb 4-1: Product: syz [ 587.546302][ T5851] usb 4-1: Manufacturer: syz [ 587.663043][ T5851] usb 4-1: SerialNumber: syz [ 587.680536][T11277] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 588.035252][ T5851] usb 4-1: Failed to set altset [ 588.052037][ T5851] usb 4-1: 0:2: cannot create sequencer device [ 588.122688][ T5851] usb 4-1: Failed to set altset [ 588.264430][ T5851] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 588.356168][ T5851] usb 4-1: USB disconnect, device number 51 [ 588.651769][T12440] netlink: 'syz.2.1774': attribute type 13 has an invalid length. [ 588.744088][T12443] netlink: 'syz.4.1775': attribute type 16 has an invalid length. [ 588.793935][T12443] netlink: 64138 bytes leftover after parsing attributes in process `syz.4.1775'. [ 588.909196][ T30] audit: type=1400 audit(1750048740.272:840): avc: denied { setattr } for pid=12445 comm="syz.3.1776" name="/" dev="configfs" ino=1141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 590.124704][T12481] netlink: 296 bytes leftover after parsing attributes in process `syz.2.1786'. [ 590.134462][T12481] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 590.201882][T12485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 590.624847][T12488] siw: device registration error -23 [ 591.389489][T12510] netlink: 'syz.2.1796': attribute type 1 has an invalid length. [ 591.857064][ T30] audit: type=1400 audit(1750048743.222:841): avc: denied { unmount } for pid=5813 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 592.560536][ T10] usb 4-1: new low-speed USB device number 52 using dummy_hcd [ 592.634355][T12529] netlink: 'syz.2.1801': attribute type 13 has an invalid length. [ 592.792086][ T10] usb 4-1: device descriptor read/64, error -71 [ 593.053102][T12538] ip6erspan0: entered allmulticast mode [ 593.510534][ T10] usb 4-1: new low-speed USB device number 53 using dummy_hcd [ 593.600564][ T5851] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 593.641136][ T10] usb 4-1: device descriptor read/64, error -71 [ 593.725155][T12551] afs: Unknown parameter 'net/wireless' [ 593.733230][T12550] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 593.765234][ T10] usb usb4-port1: attempt power cycle [ 593.780484][ T5851] usb 1-1: device descriptor read/64, error -71 [ 593.805786][T12555] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1812'. [ 593.815016][T12555] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1812'. [ 593.825685][T12557] overlayfs: failed to clone upperpath [ 593.838032][T12557] overlayfs: failed to resolve './file1': -2 [ 593.959913][ T30] audit: type=1400 audit(1750048745.322:842): avc: denied { setopt } for pid=12564 comm="syz.2.1816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 594.050709][ T5851] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 594.190539][ T5851] usb 1-1: device descriptor read/64, error -71 [ 594.212156][ T10] usb 4-1: new low-speed USB device number 54 using dummy_hcd [ 594.241100][ T10] usb 4-1: device descriptor read/8, error -71 [ 594.300898][ T5851] usb usb1-port1: attempt power cycle [ 594.480504][ T10] usb 4-1: new low-speed USB device number 55 using dummy_hcd [ 594.501146][ T10] usb 4-1: device descriptor read/8, error -71 [ 594.610994][ T10] usb usb4-port1: unable to enumerate USB device [ 594.652527][ T5851] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 595.084092][ T5851] usb 1-1: device descriptor read/8, error -71 [ 595.136633][T12585] sch_fq: defrate 0 ignored. [ 595.185957][T12587] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1824'. [ 595.195688][T12587] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1824'. [ 595.330517][ T5851] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 595.373432][ T5851] usb 1-1: device descriptor read/8, error -71 [ 595.450869][ T10] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 595.490641][ T5851] usb usb1-port1: unable to enumerate USB device [ 595.626381][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 595.637852][ T10] usb 4-1: config 1 has an invalid descriptor of length 237, skipping remainder of the config [ 595.668977][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 595.697603][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 595.708294][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.760640][ T10] usb 4-1: Product: syz [ 595.764897][ T10] usb 4-1: Manufacturer: syz [ 595.769526][ T10] usb 4-1: SerialNumber: syz [ 596.012821][ T10] usb 4-1: invalid UAC_HEADER (v1) [ 596.046301][ T10] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 596.063169][ T10] usb 4-1: USB disconnect, device number 56 [ 597.196054][T12627] sch_fq: defrate 0 ignored. [ 597.205633][T11277] Bluetooth: hci3: unexpected event for opcode 0x0c1b [ 599.003303][ T973] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 599.870514][ T973] usb 1-1: device descriptor read/64, error -71 [ 600.028727][T12652] siw: device registration error -23 [ 600.130579][T12653] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31 sclass=netlink_route_socket pid=12653 comm=syz.2.1842 [ 600.560494][ T973] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 600.695433][ T973] usb 1-1: device descriptor read/64, error -71 [ 600.750700][ T10] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 600.751406][T12662] x_tables: duplicate underflow at hook 2 [ 600.810720][ T973] usb usb1-port1: attempt power cycle [ 600.902246][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 600.915271][ T10] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 600.925128][ T10] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 600.940825][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 600.950022][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 600.959209][ T10] usb 4-1: SerialNumber: syz [ 601.097475][T12673] overlayfs: failed to clone upperpath [ 601.152025][ T973] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 601.182294][ T973] usb 1-1: device descriptor read/8, error -71 [ 601.352825][ T10] usbtest 4-1:1.0: Linux user mode ISO test driver [ 601.359613][ T10] usbtest 4-1:1.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 601.371464][ T10] usb 4-1: USB disconnect, device number 57 [ 601.430724][ T973] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 601.856825][ T973] usb 1-1: device descriptor read/8, error -71 [ 602.041904][ T973] usb usb1-port1: unable to enumerate USB device [ 602.257855][T12685] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1855'. [ 602.466749][T12695] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1855'. [ 602.478491][T12695] xt_hashlimit: max too large, truncated to 1048576 [ 603.026169][T12699] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1858'. [ 603.289776][T12709] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1861'. [ 604.015132][ T30] audit: type=1400 audit(1750048755.382:843): avc: denied { watch watch_reads } for pid=12700 comm="syz.3.1859" path="/proc/1092/net/udplite6" dev="proc" ino=4026532995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 604.105340][T12721] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1859'. [ 604.183129][T12723] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1867'. [ 604.405879][ T5831] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 606.103465][ T5831] usb 1-1: device descriptor read/64, error -71 [ 606.750510][ T5831] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 606.890772][ T5831] usb 1-1: device descriptor read/64, error -71 [ 607.101303][ T30] audit: type=1400 audit(1750048758.442:844): avc: denied { map } for pid=12757 comm="syz.4.1875" path="socket:[37870]" dev="sockfs" ino=37870 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 607.815308][T12771] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 608.397838][ T5831] usb usb1-port1: attempt power cycle [ 608.457978][T12781] overlayfs: failed to clone upperpath [ 608.739627][ T30] audit: type=1400 audit(1750048760.112:845): avc: denied { setopt } for pid=12786 comm="syz.4.1884" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 608.763957][T12783] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1883'. [ 608.889609][T12800] overlayfs: failed to clone upperpath [ 609.954909][T11277] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 609.955251][ T5822] Bluetooth: hci5: command 0x1003 tx timeout [ 612.369781][T12843] netlink: 'syz.1.1900': attribute type 2 has an invalid length. [ 612.559242][T12843] netlink: 'syz.1.1900': attribute type 1 has an invalid length. [ 612.592264][T12843] netlink: 'syz.1.1900': attribute type 2 has an invalid length. [ 612.600502][T12846] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 612.600657][T12843] netlink: 'syz.1.1900': attribute type 2 has an invalid length. [ 613.589887][T12866] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1906'. [ 615.582175][ T30] audit: type=1400 audit(1750048766.952:846): avc: denied { write } for pid=12901 comm="syz.3.1918" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 616.003939][ T30] audit: type=1326 audit(1750048767.382:847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12906 comm="syz.2.1919" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8250d8e929 code=0x0 [ 616.029476][T12910] netlink: 'syz.3.1920': attribute type 2 has an invalid length. [ 617.558769][T12925] sch_fq: defrate 0 ignored. [ 620.410579][ T5851] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 620.589023][ T5851] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 620.614437][ T5851] usb 4-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 620.646129][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.583171][ T5851] usb 4-1: Product: syz [ 621.597414][ T5851] usb 4-1: Manufacturer: syz [ 621.610451][ T5851] usb 4-1: SerialNumber: syz [ 621.645042][ T5851] usb 4-1: config 0 descriptor?? [ 621.669589][ T5851] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 621.695079][ T5851] dvb-usb: bulk message failed: -22 (3/0) [ 621.864946][ T5851] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 621.874390][ T5851] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 621.886147][ T5851] usb 4-1: media controller created [ 622.233568][ T5851] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 622.247307][ T5851] dvb-usb: bulk message failed: -22 (6/0) [ 622.253603][ T5851] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 622.270250][ T5851] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input22 [ 622.307120][ T5851] dvb-usb: schedule remote query interval to 150 msecs. [ 622.325470][ T5851] dvb-usb: bulk message failed: -22 (3/0) [ 622.350661][ T5851] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 622.586514][ T5851] dvb-usb: bulk message failed: -22 (1/0) [ 622.593045][ T5851] dvb-usb: error while querying for an remote control event. [ 622.881843][ T5851] dvb-usb: bulk message failed: -22 (1/0) [ 623.515372][ T5851] dvb-usb: error while querying for an remote control event. [ 623.528213][T12989] [U]  [ 623.532929][ T5851] usb 4-1: USB disconnect, device number 58 [ 623.550126][ T5851] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 623.878359][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.885054][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 623.983452][T13003] team0: Mode changed to "loadbalance" [ 623.994321][T13003] netlink: 'syz.3.1945': attribute type 10 has an invalid length. [ 624.010633][ T30] audit: type=1400 audit(1750048775.342:848): avc: denied { watch } for pid=13001 comm="syz.3.1945" path="anon_inode:[fanotify]" dev="anon_inodefs" ino=1054 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:anon_inodefs_t tclass=filesystem permissive=1 [ 624.046986][T13010] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1945'. [ 624.178261][T13003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 624.190923][T13003] team0: Port device bond0 added [ 624.415160][T13010] team0 (unregistering): Port device bond0 removed [ 625.545244][T13021] program syz.3.1948 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 625.948683][T13022] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1949'. [ 626.071435][T13026] netlink: 'syz.1.1951': attribute type 1 has an invalid length. [ 626.079210][T13026] netlink: 'syz.1.1951': attribute type 2 has an invalid length. [ 626.087186][T13026] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1951'. [ 627.197292][T13041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1956'. [ 627.440515][ T10] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 627.520018][ T5831] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 627.764509][T13050] : entered promiscuous mode [ 628.490328][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 628.503203][ T10] usb 1-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 628.516081][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.524217][ T10] usb 1-1: Product: syz [ 628.528410][ T10] usb 1-1: Manufacturer: syz [ 628.684354][ T10] usb 1-1: SerialNumber: syz [ 628.695054][ T10] usb 1-1: config 0 descriptor?? [ 628.711435][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 628.732240][ T10] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 628.760484][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.770355][ T5831] usb 4-1: New USB device found, idVendor=0404, idProduct=0755, bcdDevice= 0.00 [ 628.852189][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 628.860249][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.892429][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 628.935634][ T10] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 628.961550][T13059] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1961'. [ 628.972924][ T5831] usb 4-1: config 0 descriptor?? [ 629.366823][T13039] dvb-usb: bulk message failed: -22 (2/0) [ 629.393203][ T10] usb 1-1: media controller created [ 629.408188][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 629.445631][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 629.462894][ T10] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 629.493090][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input23 [ 629.527661][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 629.542765][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 629.570518][ T10] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 629.666968][ T5831] usbhid 4-1:0.0: can't add hid device: -71 [ 629.681014][ T5831] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 629.703773][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 629.718767][ T10] dvb-usb: error while querying for an remote control event. [ 629.728481][ T5831] usb 4-1: USB disconnect, device number 59 [ 629.911403][ T5831] dvb-usb: bulk message failed: -22 (1/0) [ 629.929315][ T5831] dvb-usb: error while querying for an remote control event. [ 630.129247][T13074] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1964'. [ 630.140519][ T5831] dvb-usb: bulk message failed: -22 (1/0) [ 630.250271][ T5831] dvb-usb: error while querying for an remote control event. [ 630.430905][ T5831] dvb-usb: bulk message failed: -22 (1/0) [ 630.459926][ T5831] dvb-usb: error while querying for an remote control event. [ 630.526470][T13060] [U]  [ 630.538480][ T5851] usb 1-1: USB disconnect, device number 42 [ 630.642824][ T5831] dvb-usb: bulk message failed: -22 (1/0) [ 630.676759][ T5831] dvb-usb: error while querying for an remote control event. [ 631.334950][ T5851] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 631.641874][ T5822] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 632.242428][ T5822] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 632.252142][ T5822] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 632.280554][ T5822] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 632.288695][ T5822] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 632.409358][ T7185] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 632.580875][ T7185] usb 4-1: Using ep0 maxpacket: 16 [ 633.228102][T13085] lo speed is unknown, defaulting to 1000 [ 633.245563][ T7185] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 633.620530][ T7185] usb 4-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 633.629675][ T7185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.731262][ T7185] usb 4-1: config 0 descriptor?? [ 634.172097][ T30] audit: type=1400 audit(1750048785.542:849): avc: denied { map } for pid=13084 comm="syz.3.1968" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 634.200809][ T7185] usbhid 4-1:0.0: can't add hid device: -71 [ 634.433383][T13103] : entered promiscuous mode [ 635.222847][ T7185] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 635.242449][T11277] Bluetooth: hci5: command tx timeout [ 635.252980][ T7185] usb 4-1: USB disconnect, device number 60 [ 635.430610][ T30] audit: type=1400 audit(1750048786.032:850): avc: denied { read } for pid=13099 comm="syz.1.1973" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 635.821233][T13119] vlan0: entered promiscuous mode [ 636.358032][ T30] audit: type=1400 audit(1750048787.722:851): avc: denied { connect } for pid=13118 comm="syz.2.1978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 637.539028][T11277] Bluetooth: hci5: command tx timeout [ 638.656512][T13085] chnl_net:caif_netlink_parms(): no params data found [ 638.948986][T13146] afs: Unknown parameter 'dyn/wireless' [ 639.040638][ T30] audit: type=1400 audit(1750048790.332:852): avc: denied { map } for pid=13147 comm="syz.1.1984" path="socket:[39835]" dev="sockfs" ino=39835 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 639.130691][T13144] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 639.328637][T13085] bridge0: port 1(bridge_slave_0) entered blocking state [ 639.398120][T13085] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.415623][T13085] bridge_slave_0: entered allmulticast mode [ 639.456315][T13085] bridge_slave_0: entered promiscuous mode [ 639.491904][T13085] bridge0: port 2(bridge_slave_1) entered blocking state [ 639.600463][T11277] Bluetooth: hci5: command tx timeout [ 639.615160][T13085] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.766776][T13085] bridge_slave_1: entered allmulticast mode [ 639.864691][T13158] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1987'. [ 640.109309][T13085] bridge_slave_1: entered promiscuous mode [ 640.916873][T13167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1989'. [ 640.938656][T13167] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1989'. [ 641.131834][T13085] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 641.324876][T13085] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 641.949426][T11277] Bluetooth: hci5: command tx timeout [ 642.197924][T13085] team0: Port device team_slave_0 added [ 642.244712][T13085] team0: Port device team_slave_1 added [ 642.670602][T13180] : entered promiscuous mode [ 643.026068][T13085] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 643.050276][T13085] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 643.076234][ C0] vkms_vblank_simulate: vblank timer overrun [ 643.264373][T13085] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 643.280596][ T5851] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 643.320190][T13183] netlink: 'syz.3.1994': attribute type 1 has an invalid length. [ 643.329641][T13085] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 643.404471][T13085] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 643.464844][ T5851] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 643.503276][ T5851] usb 1-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 643.535463][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.536016][T13085] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 643.558911][ T5851] usb 1-1: Product: syz [ 643.565310][ T5851] usb 1-1: Manufacturer: syz [ 643.570075][ T5851] usb 1-1: SerialNumber: syz [ 643.584869][ T5851] usb 1-1: config 0 descriptor?? [ 643.635874][ T5851] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 643.669507][ T5851] dvb-usb: bulk message failed: -22 (3/0) [ 643.705456][ T5851] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 643.732103][T13085] hsr_slave_0: entered promiscuous mode [ 643.738562][ T5851] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 643.751608][T13085] hsr_slave_1: entered promiscuous mode [ 643.758191][ T5851] usb 1-1: media controller created [ 643.771002][T13085] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 643.828044][ T5851] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 643.837405][T13179] dvb-usb: bulk message failed: -22 (2/0) [ 643.871429][T13085] Cannot create hsr debugfs directory [ 645.452166][ T5851] dvb-usb: bulk message failed: -22 (6/0) [ 645.459119][ T5851] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 645.472660][ T5851] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input24 [ 645.522216][ T5851] dvb-usb: schedule remote query interval to 150 msecs. [ 645.529225][ T5851] dvb-usb: bulk message failed: -22 (3/0) [ 645.550428][ T5851] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 645.591644][T13178] [U]  [ 645.606862][ T5851] usb 1-1: USB disconnect, device number 43 [ 645.893889][T13213] openvswitch: : Dropping previously announced user features [ 646.343042][ T5851] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 648.847836][T13085] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 649.997738][T13085] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 650.244801][T13085] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 650.359871][T13085] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 651.377663][T13262] sch_fq: defrate 0 ignored. [ 651.389241][T13265] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2011'. [ 651.448116][T13085] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.535993][T13085] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.608457][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.615641][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.689751][T12385] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.696931][T12385] bridge0: port 2(bridge_slave_1) entered forwarding state [ 652.399011][T11277] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 653.705889][T13296] openvswitch: : Dropping previously announced user features [ 654.367378][T13085] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 654.855183][T13306] bio_check_eod: 5 callbacks suppressed [ 654.855201][T13306] syz.3.2021: attempt to access beyond end of device [ 654.855201][T13306] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 654.880933][T13306] syz.3.2021: attempt to access beyond end of device [ 654.880933][T13306] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 654.958224][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 655.019265][T13306] syz.3.2021: attempt to access beyond end of device [ 655.019265][T13306] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 655.072065][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 655.098466][T13306] syz.3.2021: attempt to access beyond end of device [ 655.098466][T13306] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 655.135327][T13306] syz.3.2021: attempt to access beyond end of device [ 655.135327][T13306] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 655.150594][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 655.167695][T13306] syz.3.2021: attempt to access beyond end of device [ 655.167695][T13306] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 655.194360][T13085] veth0_vlan: entered promiscuous mode [ 655.211915][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 655.237530][T13085] veth1_vlan: entered promiscuous mode [ 655.247834][T13306] syz.3.2021: attempt to access beyond end of device [ 655.247834][T13306] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 655.288788][T13085] veth0_macvtap: entered promiscuous mode [ 655.304279][T13306] syz.3.2021: attempt to access beyond end of device [ 655.304279][T13306] nbd3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 655.323192][T13085] veth1_macvtap: entered promiscuous mode [ 655.344424][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 655.360129][T13085] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 655.382404][T13306] syz.3.2021: attempt to access beyond end of device [ 655.382404][T13306] nbd3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 655.387357][T13085] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 655.435290][T13085] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.444175][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 655.462009][T13085] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.476023][T13306] syz.3.2021: attempt to access beyond end of device [ 655.476023][T13306] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 655.489737][T13085] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.505396][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 655.515727][T13085] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.536926][T13306] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 655.550549][ T5851] usb 1-1: new low-speed USB device number 44 using dummy_hcd [ 655.572407][T13306] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 655.669129][T12385] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.697413][T12385] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.715660][ T5851] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 655.732539][ T5851] usb 1-1: config 0 has no interface number 0 [ 655.753635][ T5851] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 655.797813][ T5851] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 655.900896][T12386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.950925][ T5851] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 656.012635][T12386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 656.056518][ T5851] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.247697][ T5851] usb 1-1: config 0 descriptor?? [ 656.720058][T13323] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 656.783763][ T5851] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 657.665075][ T5851] usb 1-1: USB disconnect, device number 44 [ 659.315510][T13358] Bluetooth: MGMT ver 1.23 [ 659.793567][T13355] openvswitch: : Dropping previously announced user features [ 659.983129][T13361] overlayfs: missing 'lowerdir' [ 660.223863][T13367] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input25 [ 664.480677][ T5831] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 665.470444][ T5831] usb 6-1: Using ep0 maxpacket: 8 [ 665.497724][ T5831] usb 6-1: config index 0 descriptor too short (expected 6445, got 45) [ 665.567284][ T5831] usb 6-1: config 0 has an invalid descriptor of length 189, skipping remainder of the config [ 666.159078][ T5831] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 666.284763][ T5831] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 666.325079][ T5831] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 666.336352][T13415] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2049'. [ 666.361395][ T5831] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 666.539840][ T5831] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 666.549430][ T5831] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.559639][ T5831] usb 6-1: config 0 descriptor?? [ 666.972044][T13423] program syz.3.2050 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 667.016663][T11277] Bluetooth: hci0: command 0x0405 tx timeout [ 667.068083][T13396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 667.077003][T13396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 667.091640][T13426] overlayfs: failed to clone upperpath [ 667.158111][ T30] audit: type=1400 audit(1750048818.512:853): avc: denied { map } for pid=13394 comm="syz.5.2045" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 667.334713][ T30] audit: type=1400 audit(1750048818.512:854): avc: denied { execute } for pid=13394 comm="syz.5.2045" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 667.377916][T13396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 667.390819][T13396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 667.445257][T13436] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2055'. [ 667.464646][ T3077] usb 6-1: USB disconnect, device number 2 [ 667.640656][ T9808] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 667.780447][ T9808] usb 4-1: device descriptor read/64, error -71 [ 668.336505][ T30] audit: type=1400 audit(1750048819.702:855): avc: denied { getopt } for pid=13437 comm="syz.0.2056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 668.537061][ T9808] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 668.750733][ T9808] usb 4-1: device descriptor read/64, error -71 [ 668.871311][T13451] openvswitch: : Dropping previously announced user features [ 668.889021][ T9808] usb usb4-port1: attempt power cycle [ 668.914462][ T30] audit: type=1326 audit(1750048820.282:856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13444 comm="syz.5.2059" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa83b98e929 code=0x0 [ 669.260547][ T9808] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 669.311615][ T9808] usb 4-1: device descriptor read/8, error -71 [ 670.381190][ T9808] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 670.421000][ T9808] usb 4-1: device descriptor read/8, error -71 [ 670.566367][ T9808] usb usb4-port1: unable to enumerate USB device [ 670.997709][T13473] trusted_key: encrypted_key: keyword 'woad' not recognized [ 671.271575][T13482] 9pnet: Unknown protocol version 9 [ 672.966093][ T5831] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 673.310719][ T5831] usb 1-1: Using ep0 maxpacket: 32 [ 673.332646][ T5831] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 673.362428][ T5831] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 673.660930][T13509] openvswitch: : Dropping previously announced user features [ 674.058604][ T5831] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 674.080509][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 674.104963][ T5831] usb 1-1: Product: syz [ 674.117656][ T5831] usb 1-1: Manufacturer: syz [ 674.134289][ T5831] usb 1-1: SerialNumber: syz [ 674.146888][ T5831] usb 1-1: config 0 descriptor?? [ 674.304972][T13519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2078'. [ 675.035295][ T973] usb 1-1: USB disconnect, device number 45 [ 675.231054][ T5822] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 675.301307][T13525] program syz.5.2081 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 675.336227][T13526] QAT: Device 7 not found [ 676.908661][T13534] lo speed is unknown, defaulting to 1000 [ 677.010710][ T973] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 677.570492][ T973] usb 4-1: Using ep0 maxpacket: 16 [ 677.616207][ T973] usb 4-1: config 1 has an invalid descriptor of length 237, skipping remainder of the config [ 677.657531][ T973] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 677.696605][ T973] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 677.731050][ T973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.739144][ T973] usb 4-1: Product: syz [ 677.760840][ T973] usb 4-1: Manufacturer: syz [ 677.770734][ T973] usb 4-1: SerialNumber: syz [ 677.806627][ T30] audit: type=1400 audit(1750048829.172:857): avc: denied { bind } for pid=13542 comm="syz.0.2087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 678.018567][ T973] usb 4-1: invalid UAC_HEADER (v1) [ 678.096081][ T973] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 678.368319][T13551] openvswitch: : Dropping previously announced user features [ 678.488231][ T973] usb 4-1: USB disconnect, device number 65 [ 679.017262][T13554] lo speed is unknown, defaulting to 1000 [ 679.363911][T13561] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2092'. [ 682.321312][T13592] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 682.360004][T13592] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 682.746715][ T973] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 683.390650][ T973] usb 4-1: Using ep0 maxpacket: 8 [ 683.414141][ T973] usb 4-1: config 0 has an invalid interface number: 144 but max is 0 [ 683.458561][ T973] usb 4-1: config 0 has no interface number 0 [ 683.494204][ T973] usb 4-1: New USB device found, idVendor=046d, idProduct=08c5, bcdDevice=45.6f [ 683.510587][ T973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.532085][ T973] usb 4-1: Product: syz [ 683.536312][ T973] usb 4-1: Manufacturer: syz [ 683.554071][ T973] usb 4-1: SerialNumber: syz [ 683.572719][ T973] usb 4-1: config 0 descriptor?? [ 683.617402][T13605] kvm: Disabled LAPIC found during irq injection [ 684.494017][ T30] audit: type=1400 audit(1750048835.542:858): avc: denied { mount } for pid=13595 comm="syz.3.2102" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 684.600198][T13610] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2106'. [ 685.043440][T13616] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2109'. [ 685.334384][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.355439][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.592175][ T973] usb 4-1: Found UVC 0.00 device syz (046d:08c5) [ 685.598700][ T973] usb 4-1: No valid video chain found. [ 685.648413][ T973] usb 4-1: USB disconnect, device number 66 [ 686.461944][ T30] audit: type=1800 audit(1750048837.822:859): pid=13633 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2113" name="nullb0" dev="tmpfs" ino=475 res=0 errno=0 [ 686.563940][T13630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 686.830539][ T3077] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 687.136979][T13645] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2116'. [ 687.522009][ T3077] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 687.786793][ T3077] usb 1-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 687.802623][T13647] lo speed is unknown, defaulting to 1000 [ 687.810645][ T3077] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.818654][ T3077] usb 1-1: Product: syz [ 687.830422][ T3077] usb 1-1: Manufacturer: syz [ 687.835105][ T3077] usb 1-1: SerialNumber: syz [ 687.865810][ T3077] usb 1-1: config 0 descriptor?? [ 687.876280][T13651] fuse: Bad value for 'fd' [ 687.883421][ T3077] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 687.888893][T13652] netlink: 'syz.3.2119': attribute type 1 has an invalid length. [ 687.930019][ T3077] dvb-usb: bulk message failed: -22 (3/0) [ 687.967192][ T3077] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 687.991082][ T3077] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 688.014931][ T3077] usb 1-1: media controller created [ 688.021713][ T3077] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 688.025956][T13652] lo speed is unknown, defaulting to 1000 [ 688.100941][T13632] dvb-usb: bulk message failed: -22 (2/0) [ 688.128022][T13661] netlink: 129704 bytes leftover after parsing attributes in process `syz.3.2119'. [ 688.148742][ T3077] dvb-usb: bulk message failed: -22 (6/0) [ 688.360704][ T3077] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 688.525049][ T3077] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input26 [ 688.676160][ T3077] dvb-usb: schedule remote query interval to 150 msecs. [ 688.770883][ T3077] dvb-usb: bulk message failed: -22 (3/0) [ 688.854326][ T3077] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 688.921187][ T5851] dvb-usb: bulk message failed: -22 (1/0) [ 689.509844][ T5851] dvb-usb: error while querying for an remote control event. [ 689.525818][T13629] [U]  [ 689.636157][ T3077] usb 1-1: USB disconnect, device number 46 [ 689.695483][ T3077] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 690.167787][ T30] audit: type=1400 audit(1750048841.532:860): avc: denied { getopt } for pid=13675 comm="syz.5.2125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 692.197681][T13699] No source specified [ 692.990505][ T3077] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 693.240526][ T3077] usb 6-1: Using ep0 maxpacket: 32 [ 693.250615][ T3077] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 693.264096][ T3077] usb 6-1: config 0 has no interface number 0 [ 693.279664][ T3077] usb 6-1: config 0 interface 184 has no altsetting 0 [ 693.299576][ T3077] usb 6-1: New USB device found, idVendor=0424, idProduct=7d00, bcdDevice=69.ee [ 693.316026][ T3077] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.332462][ T3077] usb 6-1: Product: syz [ 693.340606][ T3077] usb 6-1: Manufacturer: syz [ 693.352284][ T3077] usb 6-1: SerialNumber: syz [ 693.365471][ T3077] usb 6-1: config 0 descriptor?? [ 693.551080][T13713] blkio.reset_stats is deprecated [ 693.966941][T13726] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 694.128677][T13726] fuseblk: Bad value for 'user_id' [ 694.496219][ T5851] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 694.505449][T13726] fuseblk: Bad value for 'user_id' [ 694.531183][T13736] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13736 comm=syz.0.2141 [ 694.662835][ T5851] usb 4-1: Using ep0 maxpacket: 32 [ 694.673576][ T5851] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 694.691112][ T5851] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 694.724114][ T5851] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 694.736769][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 694.746746][ T5851] usb 4-1: Product: syz [ 694.751721][ T5851] usb 4-1: Manufacturer: syz [ 694.756504][ T5851] usb 4-1: SerialNumber: syz [ 694.763568][ T5851] usb 4-1: config 0 descriptor?? [ 694.926013][T13746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2146'. [ 694.940130][T13746] xfrm1: entered promiscuous mode [ 694.945297][T13746] xfrm1: entered allmulticast mode [ 695.031455][ T5851] usb 4-1: USB disconnect, device number 67 [ 695.326725][T13753] QAT: Device 7 not found [ 697.217969][ T10] usb 6-1: USB disconnect, device number 3 [ 697.430793][T13762] netlink: 'syz.0.2150': attribute type 1 has an invalid length. [ 698.110430][ T5851] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 698.270483][ T5851] usb 6-1: device descriptor read/64, error -71 [ 698.487341][ T10] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 698.650807][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 698.666785][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 698.686370][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 698.702844][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 698.715633][ T10] usb 1-1: config 0 descriptor?? [ 698.726557][ T10] usbhid 1-1:0.0: can't add hid device: -22 [ 698.740857][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -22 [ 698.772478][ T5851] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 699.050441][ T5851] usb 6-1: device descriptor read/64, error -71 [ 699.187946][ T5851] usb usb6-port1: attempt power cycle [ 699.560566][ T5851] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 699.603572][ T5851] usb 6-1: device descriptor read/8, error -71 [ 699.914051][ T30] audit: type=1400 audit(1750048851.082:861): avc: denied { accept } for pid=13766 comm="syz.0.2153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 699.957038][T13799] openvswitch: : Dropping previously announced user features [ 700.081551][ T5851] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 700.169472][T13800] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13800 comm=syz.0.2153 [ 700.302276][ T5851] usb 6-1: device descriptor read/8, error -71 [ 700.433576][T13803] lo speed is unknown, defaulting to 1000 [ 700.470768][ T5851] usb usb6-port1: unable to enumerate USB device [ 701.081868][T13818] overlayfs: failed to clone upperpath [ 701.750887][ T5851] usb 1-1: USB disconnect, device number 47 [ 709.679181][T13899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2184'. [ 713.088691][T13935] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2194'. [ 713.893686][T13939] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 713.925963][T13939] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2196'. [ 716.940483][ T973] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 717.098969][ T973] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 717.141630][ T973] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 717.167623][ T4535] Bluetooth: hci6: Frame reassembly failed (-84) [ 717.176488][T13988] program syz.5.2211 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 717.193568][ T973] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.213838][ T973] usb 4-1: config 0 descriptor?? [ 717.438101][T11277] Bluetooth: hci1: Malformed Event: 0x02 [ 717.445554][ T973] ath6kl: Failed to submit usb control message: -71 [ 717.452865][ T973] ath6kl: unable to send the bmi data to the device: -71 [ 717.460128][ T973] ath6kl: Unable to send get target info: -71 [ 717.467053][ T973] ath6kl: Failed to init ath6kl core: -71 [ 717.473593][ T973] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 717.486520][ T973] usb 4-1: USB disconnect, device number 68 [ 718.961124][T14004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2215'. [ 718.980729][T14004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2215'. [ 719.204454][T11277] Bluetooth: hci6: command 0x1003 tx timeout [ 719.220617][ T5822] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 720.326840][ T10] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 720.490508][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 720.502623][ T10] usb 4-1: config 8 has an invalid interface number: 39 but max is 0 [ 720.506720][T14026] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2220'. [ 720.611047][ T10] usb 4-1: config 8 has no interface number 0 [ 720.617569][ T10] usb 4-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 720.669153][ T10] usb 4-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 720.738361][ T10] usb 4-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 721.044431][ T10] usb 4-1: config 8 interface 39 has no altsetting 0 [ 721.216008][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 721.258640][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.276963][ T10] usb 4-1: Product: syz [ 721.294777][ T10] usb 4-1: Manufacturer: syz [ 721.301163][ T10] usb 4-1: SerialNumber: syz [ 721.310232][ T10] usb 4-1: can't set config #8, error -71 [ 721.458845][ T10] usb 4-1: USB disconnect, device number 69 [ 722.010552][ T30] audit: type=1400 audit(1750048873.342:862): avc: denied { accept } for pid=14032 comm="syz.5.2223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 722.451163][ T30] audit: type=1400 audit(1750048873.822:863): avc: denied { unmount } for pid=13085 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 723.485166][T14061] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 723.522826][T14061] Illegal XDP return value 4294967282 on prog (id 470) dev N/A, expect packet loss! [ 724.116206][T14070] xt_l2tp: wrong L2TP version: 6 [ 724.370790][T14081] trusted_key: encrypted_key: key description must be 16 hexadecimal characters long [ 725.359241][T14097] can0: slcan on ttyS3. [ 725.475899][ T30] audit: type=1400 audit(1750048876.842:864): avc: denied { ioctl } for pid=14096 comm="syz.3.2242" path="socket:[45396]" dev="sockfs" ino=45396 ioctlcmd=0x5406 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 725.682390][T14097] can0 (unregistered): slcan off ttyS3. [ 726.576547][ T30] audit: type=1400 audit(1750048877.942:865): avc: denied { map } for pid=14104 comm="syz.3.2245" path="pipe:[45418]" dev="pipefs" ino=45418 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 726.980637][T14118] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2248'. [ 726.999258][ T30] audit: type=1400 audit(1750048878.372:866): avc: denied { getopt } for pid=14117 comm="syz.2.2248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 727.393604][ T30] audit: type=1400 audit(1750048878.762:867): avc: denied { write } for pid=14113 comm="syz.5.2247" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 727.420935][T14114] random: crng reseeded on system resumption [ 727.647670][T14135] program syz.3.2253 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 727.711816][T14131] set match dimension is over the limit! [ 730.205863][T14167] lo speed is unknown, defaulting to 1000 [ 730.536341][T14174] lo speed is unknown, defaulting to 1000 [ 730.691605][ T30] audit: type=1400 audit(1750048882.042:868): avc: denied { connect } for pid=14173 comm="syz.2.2264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 733.552515][T14193] netdevsim netdevsim1 : renamed from netdevsim0 [ 733.680221][T14196] input: syz1 as /devices/virtual/input/input27 [ 734.146081][T14198] loop6: detected capacity change from 0 to 524287999 [ 734.560645][T14211] use of bytesused == 0 is deprecated and will be removed in the future, [ 734.569673][T14211] use the actual size instead. [ 734.579564][ T7185] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 734.840881][ T7185] usb 4-1: Using ep0 maxpacket: 8 [ 734.848970][ T7185] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 734.885414][ T7185] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.908622][ T7185] usb 4-1: Product: syz [ 734.921834][ T7185] usb 4-1: Manufacturer: syz [ 734.936658][ T7185] usb 4-1: SerialNumber: syz [ 734.966833][ T7185] usb 4-1: config 0 descriptor?? [ 735.266016][ T7185] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 735.467979][ T5822] Bluetooth: hci3: Malformed Event: 0x02 [ 736.333039][ T7185] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 736.440764][T14241] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x3 [ 736.729524][ T9808] usb 4-1: USB disconnect, device number 70 [ 738.031123][T14261] lo speed is unknown, defaulting to 1000 [ 738.362471][ T5851] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 738.640858][ T5851] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 738.729461][ T5851] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 739.595624][ T5851] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.684854][ T5851] usb 1-1: config 0 descriptor?? [ 739.916858][ T5851] ath6kl: Failed to submit usb control message: -71 [ 739.924293][ T5851] ath6kl: unable to send the bmi data to the device: -71 [ 739.944081][ T5851] ath6kl: Unable to send get target info: -71 [ 739.972850][ T5851] ath6kl: Failed to init ath6kl core: -71 [ 739.985739][ T5851] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 740.027883][ T5851] usb 1-1: USB disconnect, device number 48 [ 744.297406][T12896] syz.4.1916: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 744.509342][T14346] FAULT_INJECTION: forcing a failure. [ 744.509342][T14346] name failslab, interval 1, probability 0, space 0, times 0 [ 744.522241][T14346] CPU: 1 UID: 0 PID: 14346 Comm: syz.3.2310 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 744.522265][T14346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 744.522276][T14346] Call Trace: [ 744.522282][T14346] [ 744.522289][T14346] dump_stack_lvl+0x16c/0x1f0 [ 744.522321][T14346] should_fail_ex+0x512/0x640 [ 744.522347][T14346] ? tomoyo_encode2+0x100/0x3e0 [ 744.522371][T14346] should_failslab+0xc2/0x120 [ 744.522395][T14346] __kmalloc_noprof+0xd2/0x510 [ 744.522418][T14346] ? d_absolute_path+0x136/0x1a0 [ 744.522440][T14346] tomoyo_encode2+0x100/0x3e0 [ 744.522466][T14346] tomoyo_encode+0x29/0x50 [ 744.522489][T14346] tomoyo_realpath_from_path+0x18f/0x6e0 [ 744.522527][T14346] tomoyo_path_number_perm+0x245/0x580 [ 744.522547][T14346] ? tomoyo_path_number_perm+0x237/0x580 [ 744.522571][T14346] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 744.522621][T14346] ? hook_file_ioctl_common+0x145/0x410 [ 744.522641][T14346] ? __rcu_read_unlock+0x2b4/0x580 [ 744.522669][T14346] ? __fget_files+0x20e/0x3c0 [ 744.522697][T14346] security_file_ioctl+0x9b/0x240 [ 744.522723][T14346] __x64_sys_ioctl+0xb7/0x210 [ 744.522744][T14346] do_syscall_64+0xcd/0x4c0 [ 744.522772][T14346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.522790][T14346] RIP: 0033:0x7f252bf8e929 [ 744.522804][T14346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 744.522821][T14346] RSP: 002b:00007f252cdee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 744.522838][T14346] RAX: ffffffffffffffda RBX: 00007f252c1b6160 RCX: 00007f252bf8e929 [ 744.522849][T14346] RDX: 0000200000000140 RSI: 0000000040a85321 RDI: 0000000000000003 [ 744.522860][T14346] RBP: 00007f252cdee090 R08: 0000000000000000 R09: 0000000000000000 [ 744.522870][T14346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 744.522880][T14346] R13: 0000000000000000 R14: 00007f252c1b6160 R15: 00007ffc71bfc428 [ 744.522904][T14346] [ 744.522979][T14346] ERROR: Out of memory at tomoyo_realpath_from_path. [ 744.732513][T12896] CPU: 0 UID: 0 PID: 12896 Comm: syz.4.1916 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 744.732540][T12896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 744.732549][T12896] Call Trace: [ 744.732554][T12896] [ 744.732561][T12896] dump_stack_lvl+0x16c/0x1f0 [ 744.732592][T12896] warn_alloc+0x248/0x3a0 [ 744.732617][T12896] ? __pfx_warn_alloc+0x10/0x10 [ 744.732647][T12896] ? relay_open_buf.part.0+0x194/0xc80 [ 744.732674][T12896] ? __vmalloc_node_noprof+0xad/0xf0 [ 744.732697][T12896] __vmalloc_node_range_noprof+0x101b/0x14b0 [ 744.732716][T12896] ? relay_open+0x653/0xad0 [ 744.732747][T12896] ? relay_open_buf.part.0+0x194/0xc80 [ 744.732781][T12896] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 744.732800][T12896] ? __alloc_pages_noprof+0xb/0x1b0 [ 744.732821][T12896] ? ___kmalloc_large_node+0x84/0x1e0 [ 744.732836][T12896] ? lockdep_hardirqs_on+0x7c/0x110 [ 744.732867][T12896] __kvmalloc_node_noprof+0x30a/0x620 [ 744.732889][T12896] ? relay_open_buf.part.0+0x194/0xc80 [ 744.732915][T12896] ? trace_kmalloc+0x2b/0xd0 [ 744.732938][T12896] ? __kmalloc_noprof.cold+0x5c/0x61 [ 744.732962][T12896] ? relay_open_buf.part.0+0x194/0xc80 [ 744.732993][T12896] ? relay_open_buf.part.0+0x194/0xc80 [ 744.733020][T12896] relay_open_buf.part.0+0x194/0xc80 [ 744.733056][T12896] relay_open+0x653/0xad0 [ 744.733083][T12896] ? debugfs_create_file_full+0x41/0x60 [ 744.733125][T12896] do_blk_trace_setup+0x503/0xb50 [ 744.733155][T12896] blk_trace_setup+0xed/0x1b0 [ 744.733179][T12896] ? __pfx_blk_trace_setup+0x10/0x10 [ 744.733203][T12896] ? __pfx_snprintf+0x10/0x10 [ 744.733239][T12896] blk_trace_ioctl+0x146/0x280 [ 744.733265][T12896] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 744.733297][T12896] ? hook_file_ioctl_common+0x145/0x410 [ 744.733326][T12896] blkdev_ioctl+0x108/0x6d0 [ 744.733346][T12896] ? __pfx_blkdev_ioctl+0x10/0x10 [ 744.733363][T12896] ? selinux_file_ioctl+0x180/0x270 [ 744.733388][T12896] ? selinux_file_ioctl+0xb4/0x270 [ 744.733413][T12896] ? __pfx_blkdev_ioctl+0x10/0x10 [ 744.733434][T12896] __x64_sys_ioctl+0x18e/0x210 [ 744.733460][T12896] do_syscall_64+0xcd/0x4c0 [ 744.733490][T12896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.733508][T12896] RIP: 0033:0x7fcc3898e929 [ 744.733529][T12896] Code: Unable to access opcode bytes at 0x7fcc3898e8ff. [ 744.733538][T12896] RSP: 002b:00007fcc367f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 744.733555][T12896] RAX: ffffffffffffffda RBX: 00007fcc38bb5fa0 RCX: 00007fcc3898e929 [ 744.733566][T12896] RDX: 0000200000000240 RSI: 00000000c0481273 RDI: 0000000000000003 [ 744.733577][T12896] RBP: 00007fcc38a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 744.733588][T12896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 744.733598][T12896] R13: 0000000000000000 R14: 00007fcc38bb5fa0 R15: 00007ffe263b6c68 [ 744.733620][T12896] [ 744.733643][T12896] Mem-Info: [ 745.243557][T12896] active_anon:7177 inactive_anon:35 isolated_anon:0 [ 745.243557][T12896] active_file:3458 inactive_file:277 isolated_file:0 [ 745.243557][T12896] unevictable:768 dirty:425 writeback:0 [ 745.243557][T12896] slab_reclaimable:7966 slab_unreclaimable:138550 [ 745.243557][T12896] mapped:38450 shmem:6648 pagetables:3667 [ 745.243557][T12896] sec_pagetables:0 bounce:0 [ 745.243557][T12896] kernel_misc_reclaimable:0 [ 745.243557][T12896] free:103650 free_pcp:39159 free_cma:0 [ 745.327199][T12896] Node 0 active_anon:8kB inactive_anon:140kB active_file:24kB inactive_file:180kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:108532kB dirty:24kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12144kB pagetables:4216kB sec_pagetables:0kB all_unreclaimable? yes Balloon:0kB [ 745.798975][T12896] Node 1 active_anon:37684kB inactive_anon:0kB active_file:13808kB inactive_file:928kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:42520kB dirty:1676kB writeback:0kB shmem:33756kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:832kB pagetables:10540kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 745.832076][ C0] vkms_vblank_simulate: vblank timer overrun [ 745.892374][T12896] Node 0 DMA free:10116kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:124kB local_pcp:124kB free_cma:0kB [ 745.929342][T12896] lowmem_reserve[]: 0 2481 2482 2482 2482 [ 745.941987][T12896] Node 0 DMA32 free:40896kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8kB inactive_anon:140kB active_file:24kB inactive_file:180kB unevictable:1536kB writepending:24kB present:3129332kB managed:2540624kB mlocked:0kB bounce:0kB free_pcp:33376kB local_pcp:17312kB free_cma:0kB [ 745.973414][ C0] vkms_vblank_simulate: vblank timer overrun [ 746.001566][T12896] lowmem_reserve[]: 0 0 1 1 1 [ 746.006566][T12896] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:40kB local_pcp:12kB free_cma:0kB [ 746.044507][T12896] lowmem_reserve[]: 0 0 0 0 0 [ 746.049571][T12896] Node 1 Normal free:363564kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0KB free_highatomic:0KB active_anon:28908kB inactive_anon:0kB active_file:13808kB inactive_file:928kB unevictable:1536kB writepending:1676kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:122556kB local_pcp:31548kB free_cma:0kB [ 746.081799][ C0] vkms_vblank_simulate: vblank timer overrun [ 746.347246][T12896] lowmem_reserve[]: 0 0 0 0 0 [ 746.352111][T12896] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 1*128kB (U) 1*256kB (U) 1*512kB (U) 1*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 10116kB [ 746.440577][T12896] Node 0 DMA32: 34*4kB (UME) 147*8kB (UME) 220*16kB (ME) 147*32kB (UME) 98*64kB (UME) 58*128kB (UME) 31*256kB (UM) 13*512kB (ME) 3*1024kB (M) 0*2048kB 0*4096kB = 40896kB [ 746.550466][T12896] Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 746.577678][T12896] Node 1 Normal: 172*4kB (ME) 86*8kB (ME) 59*16kB (UME) 117*32kB (UME) 90*64kB (UM) 61*128kB (ME) 26*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 5*2048kB (UME) 81*4096kB (M) = 372912kB [ 746.642648][T12896] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 746.742039][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.742116][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.000743][T12896] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 747.010162][T12896] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 747.065701][T12896] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=1 hugepages_size=2048kB [ 747.096622][T12896] 8464 total pagecache pages [ 747.106743][T12896] 935 pages in swap cache [ 747.128828][T12896] Free swap = 89820kB [ 747.138933][T12896] Total swap = 124996kB [ 747.162336][T12896] 2097051 pages RAM [ 747.184830][T12896] 0 pages HighMem/MovableOnly [ 747.196130][T12896] 429917 pages reserved [ 747.207192][T12896] 0 pages cma reserved [ 747.239004][ T30] audit: type=1400 audit(1750048898.612:869): avc: denied { link } for pid=14376 comm="syz.3.2320" name="#15" dev="tmpfs" ino=2165 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 747.421608][ T30] audit: type=1400 audit(1750048898.612:870): avc: denied { rename } for pid=14376 comm="syz.3.2320" name="#16" dev="tmpfs" ino=2165 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 747.444789][ T30] audit: type=1400 audit(1750048898.622:871): avc: denied { bind } for pid=14376 comm="syz.3.2320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 749.970444][ T7185] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 750.832238][ T7185] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 750.845892][ T7185] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 751.293708][ T7185] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 751.334774][ T7185] usb 4-1: New USB device found, idVendor=1e71, idProduct=200f, bcdDevice= 0.00 [ 751.349714][ T7185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.362863][ T7185] usb 4-1: config 0 descriptor?? [ 751.368896][T14398] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 751.937803][ T7185] nzxt-smart2 0003:1E71:200F.0007: unknown main item tag 0x0 [ 751.947165][ T7185] nzxt-smart2 0003:1E71:200F.0007: item fetching failed at offset 4/5 [ 751.956016][ T7185] nzxt-smart2 0003:1E71:200F.0007: probe with driver nzxt-smart2 failed with error -22 [ 752.493080][ T9808] usb 4-1: USB disconnect, device number 71 [ 754.143621][ T5851] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 754.691171][ T30] audit: type=1400 audit(1750048905.512:872): avc: denied { ioctl } for pid=14452 comm="syz.5.2344" path="socket:[46248]" dev="sockfs" ino=46248 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 754.992097][ T5851] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 755.047842][ T5851] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 755.066167][ T5851] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 755.367125][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.378107][ T5851] usb 4-1: Product: syz [ 755.695385][ T5851] usb 4-1: Manufacturer: syz [ 755.700031][ T5851] usb 4-1: SerialNumber: syz [ 755.834555][ T5851] cdc_mbim 4-1:1.0: skipping garbage [ 756.004149][T14447] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 756.840815][T14447] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 756.853774][ T5851] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 756.871977][ T5851] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 757.837215][ T5851] wwan wwan0: port wwan0mbim0 attached [ 757.891294][ T5851] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, f2:3e:18:57:ab:01 [ 759.028472][ T9808] usb 4-1: USB disconnect, device number 72 [ 759.056212][ T9808] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 759.778677][T14500] fuse: Unknown parameter 'S /Y{{ [ 759.778677][T14500]  ٙa[aN8 [ 759.778677][T14500] ;iZs*(Ptcdҙ&ٱqg5X]}IQCtchlkJfo*G@ޔ1ghЌS挅*)R/8NFޞAKxG͐X[m6 dkcE 8B[yU.(u$!.|+0x0000000000000006' [ 759.866623][T14500] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 760.283463][ T9808] wwan wwan0: port wwan0mbim0 disconnected [ 760.596757][T14510] program syz.3.2356 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 760.633383][T14511] netlink: 'syz.2.2358': attribute type 1 has an invalid length. [ 761.750647][T14511] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2358'. [ 761.813637][T14517] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 761.874981][T14517] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 761.938343][T14517] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 761.947277][T14517] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 761.959442][T14517] bond1: (slave geneve2): making interface the new active one [ 761.972754][T14517] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 762.005095][T14511] 8021q: adding VLAN 0 to HW filter on device bond1 [ 763.032951][T14530] xt_CT: No such helper "syz0" [ 764.608125][T14549] [U]  [ 766.890495][ T30] audit: type=1400 audit(1750048918.252:873): avc: denied { write } for pid=14571 comm="syz.5.2375" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 768.871508][ T30] audit: type=1400 audit(1750048920.252:874): avc: denied { read } for pid=14589 comm="syz.0.2381" name="/" dev="configfs" ino=1141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 769.093775][ T30] audit: type=1400 audit(1750048920.252:875): avc: denied { open } for pid=14589 comm="syz.0.2381" path="/442/file0" dev="configfs" ino=1141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 769.130676][ T30] audit: type=1400 audit(1750048920.272:876): avc: denied { write } for pid=14589 comm="syz.0.2381" name="/" dev="configfs" ino=1141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 770.566537][T14605] erofs (device nbd3): cannot find valid erofs superblock [ 770.634301][T14605] lo speed is unknown, defaulting to 1000 [ 774.881470][ T31] INFO: task syz.4.1916:12898 blocked for more than 143 seconds. [ 774.889225][ T31] Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 [ 774.956036][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 774.980640][ T31] task:syz.4.1916 state:D stack:29288 pid:12898 tgid:12893 ppid:11274 task_flags:0x400040 flags:0x00004004 [ 775.018410][T14664] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2401'. [ 775.040764][ T31] Call Trace: [ 775.044120][ T31] [ 775.047086][ T31] __schedule+0x116a/0x5de0 [ 775.068403][ T31] ? __lock_acquire+0x622/0x1c90 [ 775.309518][ T31] ? __pfx___schedule+0x10/0x10 [ 775.320134][ T31] ? find_held_lock+0x2b/0x80 [ 775.330432][ T31] ? schedule+0x2d7/0x3a0 [ 775.334808][ T31] schedule+0xe7/0x3a0 [ 775.339123][ T31] schedule_preempt_disabled+0x13/0x30 [ 775.360370][ T31] __mutex_lock+0x6c7/0xb90 [ 775.365407][ T31] ? blk_trace_startstop+0x7f/0x480 [ 775.372127][T14667] netlink: 'syz.5.2402': attribute type 10 has an invalid length. [ 775.408245][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 775.412206][T14661] IPVS: Scheduler module ip_vs_sip not found [ 775.429195][ T31] ? avc_has_extended_perms+0x33a/0x1090 [ 775.435233][ T31] ? blk_trace_startstop+0x7f/0x480 [ 775.461975][ T31] blk_trace_startstop+0x7f/0x480 [ 775.470395][ T31] ? __pfx_blk_trace_startstop+0x10/0x10 [ 775.476193][ T31] ? __pfx_avc_has_extended_perms+0x10/0x10 [ 775.495899][ T31] ? kasan_quarantine_put+0x10a/0x240 [ 775.516243][ T31] blk_trace_ioctl+0x1b5/0x280 [ 775.535691][ T31] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 775.549797][ T31] blkdev_common_ioctl+0x176a/0x2480 [ 775.562918][ T31] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 775.577585][ T31] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 775.590898][ T31] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 775.608012][ T31] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 775.625373][ T31] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 775.643501][ T31] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 775.659496][ T31] blkdev_ioctl+0x1cb/0x6d0 [ 775.665903][ T31] ? __pfx_blkdev_ioctl+0x10/0x10 [ 775.671033][ T31] ? selinux_file_ioctl+0x180/0x270 [ 775.676317][ T31] ? selinux_file_ioctl+0xb4/0x270 [ 775.681502][ T31] ? __pfx_blkdev_ioctl+0x10/0x10 [ 775.686593][ T31] __x64_sys_ioctl+0x18e/0x210 [ 775.691423][ T31] do_syscall_64+0xcd/0x4c0 [ 775.695987][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.707411][ T31] RIP: 0033:0x7fcc3898e929 [ 775.717404][ T31] RSP: 002b:00007fcc367d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 775.733857][ T31] RAX: ffffffffffffffda RBX: 00007fcc38bb6080 RCX: 00007fcc3898e929 [ 775.752197][ T31] RDX: 0000000000000000 RSI: 0000000000001274 RDI: 0000000000000003 [ 775.770406][ T31] RBP: 00007fcc38a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 775.786069][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 775.801744][ T31] R13: 0000000000000001 R14: 00007fcc38bb6080 R15: 00007ffe263b6c68 [ 775.819573][ T31] [ 775.822726][ T31] [ 775.822726][ T31] Showing all locks held in the system: [ 775.830590][ T31] 1 lock held by khungtaskd/31: [ 775.835506][ T31] #0: ffffffff8e5c4840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 775.845955][ T31] 2 locks held by getty/5586: [ 775.850931][ T31] #0: ffff8880322270a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 775.860752][ T31] #1: ffffc90002fee2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 775.870941][ T31] 5 locks held by kworker/u8:10/6313: [ 775.876379][ T31] #0: ffff88801b881148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 775.887623][ T31] #1: ffffc9000c287d10 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 775.899806][ T31] #2: ffff8880b843bc98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 775.909820][ T31] #3: ffff8880b8424088 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x2c1/0x8e0 [ 775.930413][ T31] #4: ffffffff9aff3c90 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 [ 775.940936][ T31] 3 locks held by syz.4.1916/12896: [ 775.946177][ T31] 1 lock held by syz.4.1916/12898: [ 775.951532][ T31] #0: ffff888025e27e80 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_startstop+0x7f/0x480 [ 775.962009][ T31] 3 locks held by syz.3.2386/14605: [ 775.967274][ T31] #0: ffffffff903370d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x286/0x5f0 [ 775.976900][ T31] #1: ffffffff9034d128 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0x8b/0xaf0 [ 775.987052][ T31] #2: ffffffff8e5cfe38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 775.997198][ T31] 1 lock held by syz.5.2402/14663: [ 776.002364][ T31] #0: ffffffff9034d128 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 776.011708][ T31] 1 lock held by syz.5.2402/14667: [ 776.016871][ T31] #0: ffffffff9034d128 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x600/0x2000 [ 776.026057][ T31] 1 lock held by syz.5.2402/14668: [ 776.031236][ T31] #0: ffffffff9034d128 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x26d/0x1f50 [ 776.040589][ T31] [ 776.065453][T14667] team0: Device ipvlan1 failed to register rx_handler [ 776.079319][ T31] ============================================= [ 776.079319][ T31] [ 776.139535][ T31] NMI backtrace for cpu 1 [ 776.139553][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 776.139576][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 776.139586][ T31] Call Trace: [ 776.139592][ T31] [ 776.139598][ T31] dump_stack_lvl+0x116/0x1f0 [ 776.139629][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 776.139648][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 776.139673][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 776.139698][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 776.139721][ T31] watchdog+0xf70/0x12c0 [ 776.139744][ T31] ? __pfx_watchdog+0x10/0x10 [ 776.139760][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 776.139786][ T31] ? __kthread_parkme+0x19e/0x250 [ 776.139809][ T31] ? __pfx_watchdog+0x10/0x10 [ 776.139833][ T31] kthread+0x3c2/0x780 [ 776.139850][ T31] ? __pfx_kthread+0x10/0x10 [ 776.139866][ T31] ? rcu_is_watching+0x12/0xc0 [ 776.139886][ T31] ? __pfx_kthread+0x10/0x10 [ 776.139902][ T31] ret_from_fork+0x5d7/0x6f0 [ 776.139926][ T31] ? __pfx_kthread+0x10/0x10 [ 776.139941][ T31] ret_from_fork_asm+0x1a/0x30 [ 776.139971][ T31] [ 776.139978][ T31] Sending NMI from CPU 1 to CPUs 0: [ 776.265295][ C0] NMI backtrace for cpu 0 [ 776.265308][ C0] CPU: 0 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 776.265326][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 776.265335][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 776.265355][ C0] RIP: 0010:__lock_acquire+0x11e/0x1c90 [ 776.265379][ C0] Code: 0a 00 00 48 2d 60 b9 d3 95 49 89 c4 48 b8 29 5c 8f c2 f5 28 5c 8f 49 c1 fc 03 4c 89 e7 4c 8d a5 f0 0a 00 00 48 0f af f8 89 d8 <4c> 8d 14 80 49 c1 e2 03 48 89 7c 24 10 85 db 74 28 f6 84 24 c0 00 [ 776.265393][ C0] RSP: 0018:ffffc90000ba71d8 EFLAGS: 00000803 [ 776.265403][ C0] RAX: 0000000000000003 RBX: 0000000000000003 RCX: 0000000000000002 [ 776.265412][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 776.265419][ C0] RBP: ffff88801bfe0000 R08: 0000000000000000 R09: 0000000000000000 [ 776.265427][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801bfe0af0 [ 776.265436][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff8e5c4840 [ 776.265444][ C0] FS: 0000000000000000(0000) GS:ffff888124753000(0000) knlGS:0000000000000000 [ 776.265457][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 776.265466][ C0] CR2: 00007fd8d8d7e2d8 CR3: 0000000058538000 CR4: 00000000003526f0 [ 776.265475][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 776.265483][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 776.265491][ C0] Call Trace: [ 776.265495][ C0] [ 776.265505][ C0] lock_acquire+0x179/0x350 [ 776.265523][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 776.265545][ C0] ? unwind_next_frame+0x3f4/0x20a0 [ 776.265564][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 776.265582][ C0] unwind_next_frame+0xd1/0x20a0 [ 776.265600][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 776.265619][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 776.265634][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 776.265651][ C0] arch_stack_walk+0x94/0x100 [ 776.265665][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 776.265679][ C0] ? ieee802_11_parse_elems_full+0x1d7/0x3780 [ 776.265697][ C0] stack_trace_save+0x8e/0xc0 [ 776.265712][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 776.265730][ C0] ? find_held_lock+0x2b/0x80 [ 776.265745][ C0] kasan_save_stack+0x33/0x60 [ 776.265761][ C0] ? kasan_save_stack+0x33/0x60 [ 776.265776][ C0] ? kasan_save_track+0x14/0x30 [ 776.265790][ C0] ? __kasan_kmalloc+0xaa/0xb0 [ 776.265805][ C0] ? __kmalloc_noprof+0x223/0x510 [ 776.265820][ C0] ? ieee802_11_parse_elems_full+0x1d7/0x3780 [ 776.265837][ C0] ? ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 776.265853][ C0] ? ieee80211_iface_work+0xbf4/0x1020 [ 776.265868][ C0] ? cfg80211_wiphy_work+0x3df/0x550 [ 776.265881][ C0] ? process_one_work+0x9cc/0x1b70 [ 776.265893][ C0] ? worker_thread+0x6c8/0xf10 [ 776.265905][ C0] ? kthread+0x3c2/0x780 [ 776.265915][ C0] ? ret_from_fork+0x5d7/0x6f0 [ 776.265932][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 776.265955][ C0] kasan_save_track+0x14/0x30 [ 776.265971][ C0] __kasan_kmalloc+0xaa/0xb0 [ 776.265986][ C0] __kmalloc_noprof+0x223/0x510 [ 776.266004][ C0] ieee802_11_parse_elems_full+0x1d7/0x3780 [ 776.266021][ C0] ? mark_held_locks+0x49/0x80 [ 776.266040][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 776.266054][ C0] ? find_held_lock+0x2b/0x80 [ 776.266069][ C0] ? debug_object_activate+0x2ec/0x4c0 [ 776.266088][ C0] ? do_raw_spin_unlock+0x172/0x230 [ 776.266102][ C0] ? __pfx_ieee802_11_parse_elems_full+0x10/0x10 [ 776.266120][ C0] ? debug_object_activate+0x2ec/0x4c0 [ 776.266134][ C0] ? find_held_lock+0x2b/0x80 [ 776.266149][ C0] ? __mod_timer+0x8ed/0xd30 [ 776.266167][ C0] ? rcu_is_watching+0x12/0xc0 [ 776.266184][ C0] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 776.266200][ C0] ? __lock_acquire+0xb8a/0x1c90 [ 776.266221][ C0] ? __pfx_ieee80211_ibss_rx_queued_mgmt+0x10/0x10 [ 776.266239][ C0] ? __pfx___might_resched+0x10/0x10 [ 776.266259][ C0] ? kcov_remote_start+0x3c9/0x6d0 [ 776.266276][ C0] ieee80211_iface_work+0xbf4/0x1020 [ 776.266293][ C0] ? rcu_is_watching+0x12/0xc0 [ 776.266309][ C0] cfg80211_wiphy_work+0x3df/0x550 [ 776.266324][ C0] process_one_work+0x9cc/0x1b70 [ 776.266340][ C0] ? __pfx_process_one_work+0x10/0x10 [ 776.266356][ C0] ? assign_work+0x1a0/0x250 [ 776.266375][ C0] worker_thread+0x6c8/0xf10 [ 776.266391][ C0] ? __pfx_worker_thread+0x10/0x10 [ 776.266404][ C0] kthread+0x3c2/0x780 [ 776.266415][ C0] ? __pfx_kthread+0x10/0x10 [ 776.266428][ C0] ? rcu_is_watching+0x12/0xc0 [ 776.266443][ C0] ? __pfx_kthread+0x10/0x10 [ 776.266454][ C0] ret_from_fork+0x5d7/0x6f0 [ 776.266471][ C0] ? __pfx_kthread+0x10/0x10 [ 776.266482][ C0] ret_from_fork_asm+0x1a/0x30 [ 776.266500][ C0] [ 776.273562][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 776.273578][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 776.273599][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 776.273608][ T31] Call Trace: [ 776.273614][ T31] [ 776.273620][ T31] dump_stack_lvl+0x3d/0x1f0 [ 776.273648][ T31] panic+0x71c/0x800 [ 776.273670][ T31] ? __pfx___irq_work_queue_local+0x10/0x10 [ 776.273690][ T31] ? __pfx_panic+0x10/0x10 [ 776.273710][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 776.273733][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 776.273754][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 776.273774][ T31] ? watchdog+0xdda/0x12c0 [ 776.273790][ T31] ? watchdog+0xdcd/0x12c0 [ 776.273810][ T31] watchdog+0xdeb/0x12c0 [ 776.273836][ T31] ? __pfx_watchdog+0x10/0x10 [ 776.273852][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 776.273875][ T31] ? __kthread_parkme+0x19e/0x250 [ 776.273897][ T31] ? __pfx_watchdog+0x10/0x10 [ 776.273914][ T31] kthread+0x3c2/0x780 [ 776.273928][ T31] ? __pfx_kthread+0x10/0x10 [ 776.273944][ T31] ? rcu_is_watching+0x12/0xc0 [ 776.273963][ T31] ? __pfx_kthread+0x10/0x10 [ 776.273977][ T31] ret_from_fork+0x5d7/0x6f0 [ 776.273999][ T31] ? __pfx_kthread+0x10/0x10 [ 776.274013][ T31] ret_from_fork_asm+0x1a/0x30 [ 776.274039][ T31] [ 776.871263][ T31] Kernel Offset: disabled [ 776.875566][ T31] Rebooting in 86400 seconds..