last executing test programs: 20.313288053s ago: executing program 1 (id=293): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x0) close_range(r0, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)="03", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000500)={0x6}) recvmmsg(r2, &(0x7f0000001140), 0x700, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000094c0)=ANY=[@ANYBLOB="8c4200416ec366166e031400000400458074f305"], 0x458c}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f000001aa40)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) 19.16960452s ago: executing program 1 (id=302): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905a1e7"], 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c20000030180c200000e88a817008100f0ff0800450800240068000000119078ac1e020100000000000017c100109078020000018000000063e213e17ea5a6f1d3c4f83756adbe796c45abb5e45ad41295f28d73"], 0x3a) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000003f00), 0x0, 0x0) recvmmsg(r3, &(0x7f0000002ac0)=[{{&(0x7f0000000340)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/127, 0x7f}], 0x1, &(0x7f00000004c0)=""/193, 0xc1}, 0x7}, {{&(0x7f00000005c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000640)=""/241, 0xf1}, {&(0x7f0000000740)=""/244, 0xf4}, {&(0x7f0000001640)=""/78, 0x4e}, {&(0x7f00000016c0)=""/10, 0xa}, {&(0x7f0000001700)=""/153, 0x99}], 0x5, &(0x7f0000001840)=""/27, 0x1b}, 0xfffffff5}], 0x2, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r5 = socket(0x2b, 0x80801, 0x1) getpeername$packet(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002e40)=ANY=[@ANYBLOB="3b380700000001047536ea4837bb03390217a7befbe14c000000000040000100000000", @ANYRES32=0x0, @ANYBLOB="fff0000000000000140012800b00010062617461647600000300028008000a00", @ANYRES32=0x0], 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x1000000}, 0xfffffedf, 0x10, &(0x7f0000000040), 0xeafcf7e0, 0x0, 0xffffffffffffffff, 0xd}, 0x48) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000200)=r8, 0x4) r9 = socket$netlink(0x10, 0x3, 0x4) write(r9, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) openat$fb0(0xffffffffffffff9c, 0x0, 0x208001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 16.884432826s ago: executing program 0 (id=307): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000340)) readv(r0, &(0x7f0000003400)=[{0x0}, {&(0x7f00000013c0)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}], 0x5) socket$inet(0x2, 0x4, 0x400a) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket(0x400000000010, 0x3, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) fsopen(&(0x7f0000000040)='afs\x00', 0x0) r5 = userfaultfd(0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x8000000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073027a310000000005000100070000001c0007801800018014000240fe8000000000000000000000000000bbdff75163e8aca9903f6573e68e33f38844db983ee82a08eb37351dafd55829df0b83703d83d97d5b83dd67a7a46169a0853d9613957667e6555fbd85"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) readv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000040)=""/40, 0x28}, {&(0x7f0000000280)=""/4105, 0x1009}], 0x2) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001400000000904"], 0x0) syz_usb_control_io$uac1(r8, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r9, 0x720, &(0x7f0000000080)={0x1, 0x5, 0x4, &(0x7f0000000040)={0x22, "9ead99f0e6880391a01b247a4cf9866ef8741b1300"}}) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x8650b9ebe6c185cf, &(0x7f00000012c0)=0x9, 0x4) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000000200)=0x439a, 0x4) 16.816114775s ago: executing program 3 (id=308): syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x100) fsopen(&(0x7f0000000080)='qnx4\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioprio_get$pid(0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x28383, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000400)='/dev/comedi4\x00', 0x20080, 0x0) syz_usb_connect(0x7, 0x24, &(0x7f0000000300)={{0x12, 0x1, 0x300, 0xbc, 0xc, 0xda, 0x40, 0x403, 0xff3e, 0xfcf3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xd, 0x10, 0x9, "", [{{0x9, 0x4, 0xd6, 0x8, 0x0, 0x1f, 0x43, 0xa4, 0x2}}]}}]}}, 0x0) ioctl$COMEDI_UNLOCK(r1, 0x6406) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x40000000015, 0x5, 0x0) socket$qrtr(0x2a, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) epoll_create1(0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000016c0)=@ipv6_newroute={0x30, 0x18, 0xa01, 0x70bd25, 0x25dfdbfb, {0xa, 0x20, 0x10, 0x0, 0xfc, 0x0, 0xc8, 0x0, 0x2000}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x38}}]}, 0x30}, 0x1, 0x2, 0x0, 0x20008000}, 0x10) socket$inet6(0xa, 0x80003, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x400000, 0x0, 0xffffffffffffff1b, 0x7b}, 0x0, &(0x7f0000000280)={0x3fc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = accept4$phonet_pipe(r2, &(0x7f00000000c0), &(0x7f0000000100)=0x10, 0x80000) accept$phonet_pipe(r4, &(0x7f0000000140), &(0x7f00000003c0)=0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x7, 0x20000000080, 0x0, 0x4, 0x4, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400, 0xffffffffffffffff, 0x6, 0x4, 0xf, 0x4000000007d5}, 0x0, 0x0) 16.669821491s ago: executing program 2 (id=309): socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) io_setup(0x30, &(0x7f00000001c0)=0x0) pipe2$9p(&(0x7f00000000c0), 0x4000) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x24}]) 14.177191531s ago: executing program 1 (id=310): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = inotify_init() r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) inotify_add_watch(r0, &(0x7f00000001c0)='./file0\x00', 0x80000006) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000040)='.\x00', 0x40000f9f) creat(&(0x7f0000000000)='./file0\x00', 0x62) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_NO_ENOBUFS(r6, 0x10e, 0x5, 0x0, 0x0) writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) syz_genetlink_get_family_id$gtp(&(0x7f0000001100), r6) socket$phonet_pipe(0x23, 0x5, 0x2) mount$9p_virtio(&(0x7f00000001c0), &(0x7f00000000c0)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0xffea) 14.093522548s ago: executing program 4 (id=311): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0), 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f00000004c0)={r2, 0x0, 0x4, 0x0, 0x2, [0x0], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={r3}) 14.092190067s ago: executing program 2 (id=312): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x0) close_range(r0, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)="03", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000500)={0x6}) recvmmsg(r2, &(0x7f0000001140), 0x700, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000094c0)=ANY=[@ANYBLOB="8c4200416ec366166e031400000400458074f305"], 0x458c}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f000001aa40)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) 13.910714964s ago: executing program 4 (id=313): syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x40001, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_smc(0x2b, 0x1, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, 0x0, 0x0) r4 = openat$sysfs(0xffffff9c, &(0x7f0000000300)='/sys/kernel/notes', 0xa980, 0x1c8) read$FUSE(r4, 0x0, 0x0) r5 = getpid() sched_setaffinity(r5, 0x8, &(0x7f0000000080)=0x8) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x0, 0x0}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x2041, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 11.385123244s ago: executing program 1 (id=314): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000540), 0x2}, 0x3}], 0x4000048, 0x0, 0x0) 10.917028982s ago: executing program 0 (id=315): openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) r0 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000003180)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)="8c7f93a965", 0xfffffe47}], 0x1}}], 0x1, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r8 = dup(r7) ioctl$FIONCLEX(r8, 0x5450) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90d, 0xff, '\x00', @p_u16=&(0x7f00000001c0)=0x1}}) 10.071715268s ago: executing program 3 (id=316): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000140)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000040)=0x200000000) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x1800, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x4a, &(0x7f0000000500), 0x4) preadv(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x7, 0x1009) read$msr(r1, &(0x7f00000003c0)=""/184, 0xb8) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, 0x0) r4 = dup2(r0, r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r5, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f00000026c0)={0x20, r6, 0x303, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}}, 0x8800) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x6) read$FUSE(r4, &(0x7f00000016c0)={0x2020}, 0x2020) 9.388941948s ago: executing program 2 (id=317): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x83) socket$kcm(0x2, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="30000000210063da00000000fddbdf250200000400000001010001001400030073797a6b616c6c757230000000000000d2b1988c6b2895cfaad723077fb9292e48397cc946ddc921810331861dd3e7a0d3a4f99fa730744b7fc56a9fd38a8df29559c7625cd135bab43a47b6bef18cd5aeecb5a12693a727efc14b3e0e2ad326aa53235e5de5f6be21e7de9df9d4ea94327e25fb05c1ca2989bd5d5d9f9cd3bf9d99d1e2"], 0x30}, 0x1, 0x0, 0x0, 0x880}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x5, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x10, &(0x7f0000000580)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0x6a}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r5, 0x0, 0x10, 0x10, &(0x7f00000006c0)="0000000000000005", &(0x7f0000000700)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101, 0x0) ioctl$BTRFS_IOC_FS_INFO(r6, 0x40043d04, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000005e80)={0x2020}, 0x2020) ioctl$sock_inet_SIOCGARP(r7, 0x8954, &(0x7f0000000000)={{0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x44}}, {0x6, @broadcast}, 0x2e, {0x2, 0x4e21, @multicast2}, 'geneve1\x00'}) read(r4, &(0x7f0000000080)=""/94, 0x5e) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda4"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 8.530634627s ago: executing program 4 (id=318): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x83) socket$kcm(0x2, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="30000000210063da00000000fddbdf250200000400000001010001001400030073797a6b616c6c757230000000000000d2b1988c6b2895cfaad723077fb9292e48397cc946ddc921810331861dd3e7a0d3a4f99fa730744b7fc56a9fd38a8df29559c7625cd135bab43a47b6bef18cd5aeecb5a12693a727efc14b3e0e2ad326aa53235e5de5f6be21e7de9df9d4ea94327e25fb05c1ca2989bd5d5d9f9cd3bf9d99d1e2"], 0x30}, 0x1, 0x0, 0x0, 0x880}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x5, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x10, &(0x7f0000000580)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0x6a}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r5, 0x0, 0x10, 0x10, &(0x7f00000006c0)="0000000000000005", &(0x7f0000000700)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101, 0x0) ioctl$BTRFS_IOC_FS_INFO(r6, 0x40043d04, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000005e80)={0x2020}, 0x2020) ioctl$sock_inet_SIOCGARP(r7, 0x8954, &(0x7f0000000000)={{0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x44}}, {0x6, @broadcast}, 0x2e, {0x2, 0x4e21, @multicast2}, 'geneve1\x00'}) read(r4, &(0x7f0000000080)=""/94, 0x5e) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda4"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 8.279119088s ago: executing program 0 (id=319): r0 = syz_usb_connect$uac3(0x3, 0x97, &(0x7f0000000700)=ANY=[@ANYBLOB="12010003000000103d100001400001020301090285000301d8100c080b0102010130020904000000010130000a2401100a00070000000904010000010230000904010101010230000905010920000e00030a2525ffffff7f0c8001090402000001023000090402010101023000172401060080000007000200000000000000064a0900100905820920"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, &(0x7f00000001c0)=@svm={0x4, 0x1, 0x1080, {0x7000}, {"4a036b2642502e9e1ebb8080e49af91cb1613e9e39395374f3ab790eb1b9f402fe3845ab04653dab9a5717d37f78612cd85ea15d49e7b3ab2b5206375d9f6d5768b98d1aa7359ce2a545d0663bd452e71b6bbfb7795709ca6d81202b4e5df2aec7ffcb136108d37476871ae96537cb9843960a608c0d718a827ec34a4cbf9f80842f4b9ad20001c1d1e3ef9cd01bdda71ae820c84ad61a31c54541b03b874ef0a3818717f49df851ee75cde633e8476a4a201d7eda142527c79aa6636d8ccb554adf467372058a3ffbc16bc7dd225bbff727822ff33c06fc3e08db1bc3b9a6c5c15c2fbd33b2fca4ebce55f95aa38c34551ad2605ddee475418b68e1933815269cf9688c22d74a5f741d816ba94c22d40ebdbd475dc1e31eb87a4c7a5a10c4a78c21f1346878099bddb8024a2ef727e92304017e710f37758c6b8119fb638056c2515e1865e2d40112a2b6aa23acacb95a318c7eff4c1b2f0919346479742dcd596de77ba8610b69a3242b081f1ba9f17a2a1abfcbe4bc12ba9551f53e64eda5d81a2806999dd4c9ca4d8cc8108bc36e0eeb5866302bdc18b33aa948194d0eb99c9b6b147f95e0c1463af998bd9ad4a1c38159ba2f3977c50bca47f3c977b70e27288c141c793c60a42b5f97c31ab45e89ae23be8b92b6ab3d9deaca875d9a75fc17ee78bf603e21eb72e38df2a070a98e9920518659e5f425c2bf7d13afe936dce7ed94ba62651fecda11fd2fef7a0ddbed8149031d1bc0cf1b6afb5afcfa05dcb631cc2bbb8c593e98b0ade4ad8fda943efdfb64c4843313a8d7a3030846fb780e6d1f3ac5e7e1e0f2f5a459512bc756132c33eee6cc246f335b6fc030ebf6bdc558cfce2eeb39ea8a9a19fe7291de2f970b21b5fcd6fe151c32dcc1131ea72abfd61e24098f5669d269d16da091c6037a7871ed4c48ff1bd085ea677ee22c279c05009bcd0d815d83a1e41d6c3429255b53e56b88604e43676548f5af499ba18f95bac202aded4d25b4ad2a940ffba5318819228e03bfdf6776ac57629a388dd549f6be8c53888f2c3abae56504b45d1ce0384fda9104662d231e154091142b15b114ef7eaad46af2a8f3665b1a3457fa66c7a9df892db9933d7f89fb44c4ec2161f34f8e5d17823ae3481db6bcf22d5fe6250832b7ca6119b473678a725037c3fb30ad60696f0168a13147903c9b164b6fcbfe1f3a286d49d488dd6e77c7c0be9f4f0b39454141f19e05bbe305fab37a0db590b24ca3b43604f42ac21a1d0020cb739abe98b3b7186761d4e9fc41ab2c3e482d5b7e1bc2ebec6435eef653176192dd53c24e5ba2d17aa99613373d5db41a054db7fc179b92e71a594b398e970cd7fc4677f203736f6f85639ea1c3c6bb4e619f7f1468839f1bf212183ae815cd3722b6f657ce0c6b2f87371bd1a924e63b79219ba507c238755308f31ea150c9315fce2f9cd83e60c5e0b9e9e2559684d0e04e6644b69eb2e5726a1e69425ce30f8341e6402d59182b01993d59ce7310dfec86063a9ab46c046ba5b82bb80a1cd7a6854753a23d44a6a614d83400ea5714828a93558e32c1e6b5e131c7198303df292d633e27037e460378577c52b54208a36d27f9145dacecf902b5e9e2b1e54638701d0b8a3c64e4e8a1b99dae5cfd1b30381ef2ab5b8ebc6b691ae47550194b790d153d5f0db79045b660b64d67449580c320e6be8efe403bd9820af403b584e93338f0e6a135ace68cea2a6926a22e8df81c76081fa54c30988146cc839dd9736a2ed57e3bec708992a3df3d628d3e256ffff6729f925597051a47f9462ae7d6472f1c038a631d93bf3d1d43fca3ae9de82e7edf3fa4a8ba90028583e42b3f93e2fc5491db526010077a190e73e5fc321145a51f95d0c482633476e7a3bc069e79d98ecac7ee27ead0a96d88d4ea552681164bbacf6163bbe7a6ec60159b6c03013567c081dbb44d10fc651e14e9cb8908b691f7ba41fdd0ffbd1c687416355832ca3e7c4f40f40aafbea81742980a4f6b27e86ca4f0d84c731409d571572ec991a18ef314fcc003fba6b5fac0bfe54a99483eaba9e23f6db42d27770b0694a1b9086228af2d04fb1edf7cbe6f106b159c80dca51da629d6a8a6082a89f216c94b90d02d208707201a95c3f2f8c1e507cfe94a97692750a57889f7f69ff56b92e8bd5a99441a3becab3d57a5ad612f348e4347b795727d77def9cbb450d4a0f514db32f14fae2a0c5932c64c3f338dde12f765d730f745722841622fdcab07b3286913b28bc557fc9e35de9acdde36283a1ee151033d4230deef4abe52054a23561def8a1a95421ca5cafc83e4e57bbb6a45eb0672664d1e6b793ec202236d0c7048e4eb10e542970d588c90795402bc5e6c65f3e953ab9ac3db76b233193e8f96beca26b14b97ed24a814f42d86dab85de630c0b5fbb1a235c2bf39fea0e812aed76f4129efe5b8c53080ddb913aa01c8b31dbfd49c2707b108c12da3b648dc33a80b1809018fcb8f46546428a5224ee73d3c2bbbdcf2713aff0a130b443bf31d0d49584ffa6c06052ed65e3b35752eb2cf7be9978455146eb5325a5b324b636d7e2ae9ed41580a610862f1577f6198128ae452979bdfc28e9ffe49e918a7f70de775a0c3a181d715087ec5bd1ad176b31fdcb344e15c5d16e52e24c5b4b57e5756216bb420d0026dfb32476201a23352d5fd2e2fc350d31e2b4ee1ae24785eb7bed6c759d27754988588b1a8ff557f5115687abbd568a5cc843f2f4d7ff37c95ed372ce1113e7c4331644b9d8840c0a6e1799a8714077f9411082a8f998adbedc4a7b19b6948c29e9ae1d323c929f1c93fcf2a8227c0e475e199f4f3ef6bdccc072f6c00c9a7d7c6591f03c5ae05b3041b15af09e24e03df981bc6bc566eb4f0763151287ce0ee17f0f9cad3f18ed43c5bb8f23a8e6721342da5e265cfd62f3714f72b179c8074f4eb74a16ac647e7e34923478f171701b16a33ece46d48ad29e2b704d99ebbfa585191f70bcf2076e1577fdfc71446f9610dfe1eba28acba340eb820cd7fcd079b6e8bdb86f4e943c29e0eb7de3297affc39b0831c02f6b70f84c64cdd59cfa905e4788d143b038b551c9507be9e44a095fbb4655dafb27ee865c8f43f13d106dbaa1e0d0e83a72d9a763e3a6a24411c6b8eefb650e8ac97dd956c9330c930ac499094ed100b55f420d8cb1918e888b43cdc5de3f790d6993aae2ae00fc4bfcd3d01711249f6abca4931fa18bfac636ab23d0c531d043d9b72cf42c6faa1d073acf48c484d960ecc9b2136e74cda1e15b1d729f86bbc033cacab9ce2e21f462c52b50b5ef60fd09fe254d3ccc83fa3317db6191758b3a27b8fef622d491fe2a64706cf5b9107bb30eb660e73e1cb0ff6f963659d3b46c33d832aafceda341b4c27376b39532f565f89aff850a523943cbdcdc8e60ed15856c2ec87fcf9373df9b85e2b07027d9b0842f3d65de8bd1c5d49042e61a6bb331073cbbc58a83f765aa814c0717f2f26669dc5180dd59c70e7ec09cfe3c2c402fe83bce2f35b3a27af179ed651b7f31bfe6cdbc49b56809d4fd89771431189690cb2f7a024ec8f3c213ac58e05e24d0f28afa328e6b5786a8b517d31be923c7241b8805edb29fe28a79b1788a9db5ec4e47deb69c9db01206584b41f1ce2d772fc9042d2d250959cbcb092aa4cc195aecd7b7bd51f09a204bc0eebaafe4e61ec9ca612c0d4966f17698b9cb9dec65d67a796a49e6b109823c23f63cd8bb100bbaba61db737efc2ba27e6f32e398ec91bff993c1ce95d41554f7acd1ad1082a5f8e7381db0fec25978927316f33ad56b83ba0e63417131038ee64eb4a0f744b2bc5ebfaf8b0fca3b774afdbfb3a31c7321468f2ab846def39d768a6327a992ce95a7455e5e58da2a40c5577e555d8ab08c49d9273c126f2ea23e8c722f253aeab2a833328a2f4262aa2345025867f1414bf2948ff5ec2312fd21cee2aebb595cbf88d789767f9867e4535708a404239690db8f6bac8006b1a94368acdd99188f6a27ae97f99930bae69f519a12f2737cc92d55c5cebbad94ad9980e76a2dd982fe87ba65be5e3c87041bd80fef3f5f92c35cea02a8080fadac9a797f0d7e303f9da76d96b990ce10bcfb6ccac1a22c0cc56ccdc0404110ed76bfe10eb99f59205c7aa351eff09a46ea705852c10e0d9c941e2474ea34f8f57143f4049c7e750d1482b02147e37f6b780f43347db162f7b162bf96eda7c0c9ab0d814793681f404b63f17c185b8883c600fd3e085aaf08b730a6ca68b0822df61d91e5df3273002cbb1258e6cf863eca38113ce2570eeb7ed1e5a91105f108374a762b2cb41b325878ae6a1a89e388cd7e6dd60a91bdbfc69bda6856c046a6e6a4f04544c044438edc99aea1503271a32320cdc85cdad87637e3f84d61a305b8701675db3b991447f897580487bf7fa849e261459efedc0de8ca48c105d4e53c2beef3e902f683ae4b52c7c547ea8a175e12f41cc36a7e876c6e0a3469a2c469083d5e98ef294bd5d989faf5499aeca88fea95dad2ea3608143805428a10d607c93af847a72cc766f53a21be41366f9e2b1f91f0f244ef768edc96d25165ab8f7e3c2bef9dcd1da2133e3305d9c363380a4064e08009cf39df25c011fc70dd8b62e29a5e9af097efff4e57c92b0a0ab069348520a49df6ca2b1e53da27d3051518fcc2343709bb3a2e7160a8db417853250a29de39274c78d7a366a0e97d70ff47e1857fad6053670bfa38c120fa876c3e2345a2df80d09d67f3d5c1008ed4b02fa54ff303478d80a96a6e179fd44d38fd727eddcc8ce506ec789d44279abca1773c812c9efbbe54e57230b8597dc938933492f81ca9875f2db70f57cbf993cd700ae09d3542c4a625f467a365248963ca9250411c6be2692b9f48b6a2de4876296744b3a455d8cdc289f6538f1114f1efc91a27a749e0244107e239cdeed30a07aa1d002131d296d4158627a0621296ec48fdce1b9a827a7fe37e7426c74a132918f9f439b05649ed3115b0ac335b5dd3c5b3985c3794b60474389cb2208b5ea47dd0f395b1a2897a5c664749835b14684d6a83972ebb2df9c55f0869a4ec85d47c9d91ed8972a07a53cbb2396d4381ec85f9e02ea617840dd652e9534ee094fe23f27815dfbd8bafb0ea95473f590cd16c979701feb66f66527b7418a80b97bf28af22f90ed56db546931727a0583b0f4d3712da5eb24a3f4dc900fef0547e38e879633c602853f8dc585f8a4d9cb6fe4dd34d680db8fc8a2e41d9467add098a307d8bea20b3eb008393d066128682588aacd3b27053c1880b5b0c38744d40e0d3b21d1e2af83b7718cd3a244806311d0bc6d07aafc93ef4de49efda64cb2ad43ae1ece757606c047ad8c81f136fc9fdbee3ccee7fb87a71e2839fc1824b2488cc1d6ab5239e99f0363279d311cea67e466ec34875283156112eb7ace502d940843cf840b4d0ce5c2ccb38cbdcecf6c6495d2d9bacb351d63a65b83306f8b67486d494e0b69616d265af7df35e0f49d98344a7161ca9d8aa038b02785c5462099390cea0bd38e4e0c70b56c5810b3091e8f6e85a4587bd011bf77c94a8afa02c94ccd4832db5be44780ef9fb866c92917e8b48f41cfd9057cead58ee6efdcc5c4e40d684e59e6266f835d1ad93b3ca7bf91e4a18cf2790639dc7cb6b12c3fdced9b74bcf60d53933b8c3a479f1bce07583cbdec6958a15e276609923b815863bfd98fc233f45ff335c71bf1463d885cd248bfe58d9c09bfb5d217ba6578989314262982"}}) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000580)={0x2c, &(0x7f0000000240)={0x40, 0xe, 0x2, {0x2, 0x8}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$uac1(0x4, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xc07}}]}) syz_usb_control_io$uac3(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xe, 0x6, {0x6, 0xa, "c39aed3c"}}, 0x0}, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000000140)={0x14, &(0x7f0000000240)=ANY=[], 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r3, 0x29, 0x16, &(0x7f0000fcb000)=0x200, 0x4) setsockopt$inet6_int(r3, 0x29, 0x16, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x18) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1400) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="5c0000000105000000000000000000000a3249d68f40218a460000000c00198008000104ad0800003c00800c000280050001003a0000002c00018014000300"], 0x5c}, 0x1, 0x0, 0x0, 0xc008844}, 0x20040040) 6.852002592s ago: executing program 3 (id=320): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x4, 0x4) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x358, 0xffff8880b8609000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x4940, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x8, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) preadv(r7, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x4d, 0x5, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x3c, 0x44, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002a000701fcffffff00000000057c000008000100", @ANYRES32, @ANYRES8=r8], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0xc000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r1, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000540)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="05000200020075de"], 0xf9e10304749b6155) r10 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r10, 0x11b, 0x5, &(0x7f0000000000)=0x1082, 0x4) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x24) 6.713981533s ago: executing program 1 (id=321): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905a1e7"], 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c20000030180c200000e88a817008100f0ff0800450800240068000000119078ac1e020100000000000017c100109078020000018000000063e213e17ea5a6f1d3c4f83756adbe796c45abb5e45ad41295f28d73"], 0x3a) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000003f00), 0x0, 0x0) recvmmsg(r3, &(0x7f0000002ac0)=[{{&(0x7f0000000340)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/127, 0x7f}], 0x1, &(0x7f00000004c0)=""/193, 0xc1}, 0x7}, {{&(0x7f00000005c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000640)=""/241, 0xf1}, {&(0x7f0000000740)=""/244, 0xf4}, {0x0}, {&(0x7f0000001640)=""/78, 0x4e}, {&(0x7f00000016c0)=""/10, 0xa}, {&(0x7f0000001700)=""/153, 0x99}], 0x6, &(0x7f0000001840)=""/27, 0x1b}, 0xfffffff5}], 0x2, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r5 = socket(0x2b, 0x80801, 0x1) getpeername$packet(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002e40)=ANY=[@ANYBLOB="3b380700000001047536ea4837bb03390217a7befbe14c000000000040000100000000", @ANYRES32=0x0, @ANYBLOB="fff0000000000000140012800b00010062617461647600000300028008000a00", @ANYRES32=0x0], 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x1000000}, 0xfffffedf, 0x10, &(0x7f0000000040), 0xeafcf7e0, 0x0, 0xffffffffffffffff, 0xd}, 0x48) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000200)=r8, 0x4) r9 = socket$netlink(0x10, 0x3, 0x4) write(r9, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) openat$fb0(0xffffffffffffff9c, 0x0, 0x208001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 6.525611708s ago: executing program 3 (id=322): socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) io_setup(0x30, &(0x7f00000001c0)=0x0) pipe2$9p(&(0x7f00000000c0), 0x4000) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x24}]) 6.356453817s ago: executing program 3 (id=323): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f00000004c0)={0x0, 0x0, 0x4, 0x0, 0x2, [0x0], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={r2}) 4.140637716s ago: executing program 3 (id=324): syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioperm(0x5, 0x6, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x20008000) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000000)=0x3, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000100)='mqueue\x00', 0x1) symlinkat(&(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a010200000000000000000200000009000200"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x20, 0x13, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xc085}, 0x40000c0) syz_clone(0x41000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) 3.996385109s ago: executing program 4 (id=325): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x0) close_range(r0, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)="03", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000500)={0x6}) recvmmsg(r2, &(0x7f0000001140), 0x700, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000094c0)=ANY=[@ANYBLOB="8c4200416ec366166e031400000400458074f305"], 0x458c}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) r4 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r4, &(0x7f000001aa40)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, 0x0) io_setup(0x7, &(0x7f0000000280)=0x0) io_pgetevents(r5, 0x4, 0x4, &(0x7f0000000200)=[{}, {}, {}, {}], &(0x7f0000000180), 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32, @ANYBLOB="000000000000000000bfa200000000000007020000f8ffffffb703000008000009000400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000540)={"2c0844ead1f8326c6808c1a39c7faa149d2750373651fd2efcb4ef90604f78a2"}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 3.828663755s ago: executing program 0 (id=326): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f00000008c0), r0) sendmsg$NFC_CMD_DEV_DOWN(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010010bd7000e7dbdf25030000000800010092"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x400c4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000bc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x13a0, 0x11c0, 0xc8, 0x8, 0x0, 0x5803, 0x12d0, 0x2e8, 0x2e8, 0x12d0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x400, 0xa66, 0x2}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x8000000, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1400) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) getrlimit(0xe, &(0x7f0000000000)) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0xc, 0xb}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xffff, 0xa}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000015}, 0x20040054) 3.389862817s ago: executing program 2 (id=327): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40c00, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x20c002, 0x34) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x25}, 0x20000811) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000100)) ioctl$KVM_GET_PIT(r0, 0xc048ae65, &(0x7f0000000200)) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x2000001, 0x31, r0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000a40), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r3, 0xc01064bd, &(0x7f0000000040)={&(0x7f0000000a80)="61f245cafab21e55697298a0ae35e18d14dd4b6592fa14c0489b858840d12654fb8ddbd1563e581b6a29f56e6127a48c40b95af04e135572e6084e5706e88f02b4440c32e93c31603beb0bc2616de2e7f2a3936b7862df4bc4178710a61eb2e0e7b4ac16cde4477d10653b0d6afde80c950848626b7296ec902f7dc875cbb34a73638a2a48eec75667340826ad84022664c0039de213dc5054b5ecc2ea3c385fe8cdeb814e4eb6262fb39fb637c13a6c1b401f1eafc7a09d49980e60e5caca3520ffeeaf9b20a67d680c7ade66ff7398725ab5bfeed67b48888284c03f6c5331b33f5bd12b10f2c9f8a82549939fbf23caba0dfe1cd962f5e97d9a7dbfed7b25dfcd025cafb3c3b34bde13e2cf3684db786b56929bd381fa5e178b268005224cf7d79103524ec32d22509292501062fd2a907f9eb1a564bcb58da00933f9fb49af10ce55617b9edfad6ca5f9060623e0d6fb73aa68c9b5190dc671968ecbf752962f6e3f0ef6b3ff918603cd511ec00dc67ba004c6469380f5c5390226ccd5ebb934a63c103e4fb6b69c42a6e8e8aa434fd0c787de018fc1e25189ba81be91c80d5e3c9d021baa3cb3abaf755b79e41a8604392c68a018e1750ab6d54608969f3c9273b1a08c3b8d7d9b6f03f4bd3a6c64790617d72a891556cba509f21f992c59db9f78853421fb9ec4ddb2fe782f5da26c038626f26d1e4fda289cea520d44630b041e18ea2ecf56852c25f1ddf3bbaed2c17ba898575431134ee7c27fbf8548dfd63364b8beae267085bfa964786745134ae2b64c4a263f885c198952e795c17e04f0d9e4360de13ae3f2481e6d234bb5c54e03d5e0cb27e5b610ea2c0d85d21bc66e5c861f1e8ba66620cb6f590b2fe294013923b7fc9b170f449e7873bb9aa14cf7421e61feaaeb349a2acb5816a51325f45065b035be05f4498e77eb5e875c03b0c41061caadee14eb2764a5846ba0cab400e1676f533abc56930e5acccf331b0611af1e2947b11820d32e142ca885f4df233678ccbcfa63e5cfa708adcfefa34f059f81f14a5ef2538ef446feec5c78828c618576b18b86c7ee37d8182a8dee51d5dd199cd2ee915f5e25be2885822ab3e5b988786764e611f0bb1214bb9d825c9c4e15c061acf2b4e7361831e0fe9fc409e0004631ab31c42bfd962ba7a0e475f3a91643ce65d2efb94976b14fcf7d21c93bd9208b7bb7a3dfc4444cf14d127401c6892ba93ac786476e0885f028ae6141de817d3517cce625eebb50e2c1e5e64ffc50da4d2eaa605501769e4c1a40fd9da7da178b4bf468942514082773698770ef455ea263fefa4fb258c15afb076c7979296f901e84a2b71eb63cb3d9dfd9abb3e1f8f657070d75541c20476f37e14ca43014ef80b33eeca91ace604ec2051d73ec2f69ffa14bcd79ea577e9676825094606343d31874111fbc535d28fa7a9e379d38226001e241d3515e1d63ba56f1eebe8ea788c4d768f4c4fbbaf834ca3f21460613d768dacf2a27778dc2b4598726646b8c06b6e4d38162720c807724f92bdc9f0b0f5d303d5a5a3998aa270a6760c7651df601bc42c78dd9bd53ee960cf80a30a6b7a1a880d37ff31fb2c9bb0c591bba3ef8228a0506f45065c65b131aff8da8eebbd6754b9e5601632da39c329a229062a94833b23c97371d510a19e2d3b5bc516e3d3c8601495fbeecc16c5c50ba6c435974e8275d372add206964f29997b515f63f50121029e61f47db19fc63b07d0f059ca686e80fb6c294667affaea2daff241bdd0945bfbfe28643136bcea9aa345d482fc3b9d872b482463b92b25f0e5157be3fd8b7a328f327ddfa5c05a6f172deb795f19b9f2091386acb060f170540bfa898057c206d81afd85701b8ee030076bc3782d7d8f6673111baf80818aeca7e5944d91a7f4fce840303867ea18d2b92d74c67157284c787fcfde780fc9a53ae5560e101ef125ce707d34f957072958dc9916492e73a90a10f660a221a7c6730ac0ac01e37d54f058b64f41a46be5320800172e2c9fda248a2964548ddf1f53599027c29ede6079a72d454bcf4403808111d00cb4e3aadd060c333e57c64a70bdfbb572fe228538c82ab427416cdcce1dd643ece610ca7042e2a164d3dfdabb966f1a8fc875cd002920321dac62e25f38cb0031e4de6324b0db402b12c4b0e335898e21b7b326ebbeec0b4bc21ef2dd6f9755e8ff35602d30189ae3efe9c487aec2ce90dbbe790c919b77036240786f3fe9441204b81bc43b5f5cbede75702a1c28ab16d2f578dddb3624f596b5b82e2f26b63966ddc78c8ffa13a23b6c4ee2c741820b9738fe881ddeeeba60fa4221885be55a6fdaa0b90b246f5959b844afd6898bc8c0a75fc45fb968d6e8ea6831d15808b23904355c62a8590d1ba51cdb051bd5ccc1b62a8ca520af60daefae7f7f1dcc90a02ab3af5307fcd5fed9af7d9b192f080be6ded768c6d1d4ea0ba5cc996e5c24b8048eeaea09cabcf1c0488a357280395cfc5394ba160c439dda0a7f4ed182d3f33a4addb1c74d7d797179c633013b24c7e0cd2f4b86904bd1d70a4821c7ff619455953d820e1594c7136e66c260c868776129eddedfdec5ebb0da2e5207215f9c47d7bf74319661311232ca1d108da00df2d07ff5720c474981cb54bd185448ae0e3d9d3194614ae67bdb24122cb2207be610456c35ba6e11429a3a6c266b4bfd905c7534de4fe03ac5063cbb08b3a75137e59e3e8b3fee3989bfb0735ea6f948371a60efff49ea51d5825dd61ef9a0b735fc859c9b003325fe6e3a5fdb8d2cf51e2e9a4c73a8af3a702a83d57d3ddb81d5e9342c97f143ed28228c16a1625d8ba4f0ffddc968f37cb07ea09d35703f920cf4e7a1394b7f18e6f2508a4c90acc92710ddce1e7a9a22ad2d540f669411b263b3e20b07131cc17cf20ae8030de00862bdc33b7eb4f8122c47c833e73aed84199e5d584625570193e18c3d165dae7941d17cc07034a2a5c67c708d6c96f9c5595800dfb65f42c413716b952d42727e7117915b359d1f1c0a64f0ee4b4a0bfbc4e9fc794cd02369e9594acb7805a155ec03505df719aa47e5da38fd3ab736fa76acee10abd1b220b32436260f2ab86f7d0c20fd9b3a1e63b9b3dbd91e7579fec104f5a714f4d0a00a03a1848c58508e8ec27c7fa04d3baf64e1258bd1d72465f3a64c793b3e09a97ca1a2efbac7adb6228ef4588be15afc21c80905a26a22f4db7940b9369051dde4e24008a5f7b943d769578ffa46572435c2076c60096252f3b3b5fe6d8f4579d11c9c71cbf7444c661306fa07dd01e670fa8d24071b09d6e74a268a0d43aef3b7f8e126900bf2e21304785712f327275a2e16febd4faaaacce68b92dcc3c27ca035bb4210408a34103719c82d33c8b43dd9a46cc0420a533b906317fb817ef6164286b8ddacee6191027bfa9ed19746c8401bab93d08d028fd9e2203cccf56b22042c402e8a438ed226112fa71d02c4537d4156a3af28ab4ffcf19309d283902f1e70f42d6713782c5e468a086fdb5c8b3e15de36acc4469ec42ea23a1e5e8e399f4d4be71dd4b4c268db2ab91b68ceafb95cbba36228e59bc0cd7f987a2ad4bbd23b67acabb26a0f4c694ff320f2275042c85ef256aeef306cf5e2803d6c55827011e2f98d0e80819e0039a71cc9c59464f209afa7891a359a3f9efb4bba2a18fd013e8664a6bec7e717ffe2f0c06f7268862696cfae0fe6fab5b1a2921c0e29aaa8638f6a18d1cbaaa4aa0d76f66fa9f44511e631f2fde8024210eb39f545a648c1b77ab04a7d110edbd1dce3939b4dee867df3cb3107fffe5ab22fe5e32b38447d32094259cee40c9a5254df72cbd7a29188d7285facd6e2f5c78ee9d11645cf026e99162da9c2d148373018fe8e052ffccc4e3952e86228d7835a3bc9b4a5c6099dd3e802b059ef2225cbe4664458729c78032e184b61a089870c6b3c2bf2e5df6bd65bc195e1ccbe58b9a6dde49897ab59dd269a737f04e37e34d3d10c3b01c744a742d52da1bceca63fcbecc136a80bf3ca1df2f226de073b67a0b646674744acd14d5dab9929f2cb804637ebf211f2b3a8b959723808904e9044deb551b2613c1e501385693e7abff809b641c02107187cf1bd1c9571a9023942f0c78c467611193a7e6900eefc49fded206630336cd8d2849731b73798d9258be75b843f051679e6bd541c78457db5470d3d494f333a81b3ed26b57f9f7726275c12f192f4b1d9615c7fe3e0bb22fb47ae1effea3bd2a0a379593a25f933c8af1f14d08bd8ca692c9af3eaee136664e1829204c171ad6e50fa928a3c1f5ee2c14f984884c2cb0256acfa6172d030940f3f9f99443c730b0f070192d36fb83b3d470cf3098bd8b0f09eb6d1b58efbde00305c3a50e00df17b9963f1c06f26b48e4a166073f3f3119ed2b56af1f8c056c07f65ffc3f2e81efa22f97c66998b35bb2af3ce2d89af5f5b1368ce9148937f826c3ef81a116382bd3f53e26f210aed545f38c1e21400957b824eaa95bb401ef308852c7e5015b89244a403308de785a81739634161e33d79435f18cf378bd9f5eb59b40a55abe627f6944ec239f80fc15526e7f1b2c2949a85b8c15a299cee1c86f61746a4eae3dc5f347225f1965cf09d4457b1a1b692fb108a681607d6276c4a6cf35709dc95aa249ae245a0435c481cbae672037aefc82fee9f249e643e658d173aea1d99e361f383dd674a5f2a6525755eaba2d59928a8d9e2eb1aafd129cb4c2cefd5da0213d900efa938e937a7c4e62243eeb3f5f43be35323f63b0b1ac2a298fcfbf71129da3465e488f52b82ec725bdf2fd943e09004c62abf5332139fb38b797756c5e9de926da21f8d77408ea740cf5ec8a657eae110df0550c6ca2585e0cdd5de1e986da91ca1d112f0d5397fdc612b2163164dedddf60c1e3dcd94195b65f50a9c86fb7b67b91dc7c0b8ab3d1c254663fc09ad5fd2c97221f1c6032557ff0a2fc441b71b3a6a6c52efded4133c8d57ce15523550237e7fef838d66cd77c48a743b2a2cc7c1f0ef3d520eb7ce9c086d73c352fe311337b3558a6985660a19ac852edceed56e3e9bb49b8a788eaa3f9be70b3fd1e764888a35a6c874256f9a8e53790281e30fdc1ed35ef03e9bd805ba3ef6ad07c3eef31fadcaba39c9b793e15d04f096c62f6282e8fc4aa31b275bc7fe5dce144ba736151d046b1285b698422ae84ae222e835e2ea80791082cd1742385764a0b047fcadfd8da7acc8f820dd50444fbbecb18ff5c9df10e08609d4b0f76ce14dc8ab056227e3604b3933df593a1b961fba44678131c958b15246e5054465bfffba1cb05c8d4a3ce7a3473d88c9213b5d8fcef3c46f8650fec5077bffaf9b469051b0e5aa7b55f863f0919ca310505a063890b1560597aac6ca1ed9a7c7ed8e894597098cc9333d687bd8e1b4539bb9f74d034d2fc316ef806d67bcec412fb485a03f87cb89d122809fc55f1a7fb35a74440d661ee736340cdbe70141214e899cf9f907a2463f995d21e2d1d25fe92b47ea198f467bf5e775104bbb0ed11534ef25eabdd6b14e8961ee0534f5ab504151f1b2f1853f7229e07131696deb538114d51df2d5c4145bb53d7292e1544c3075806980d5d595528dcf1ce6d4d35470331f00a7bb00e4a1b38982f5dbd2114715a3bd23fa9dbadfe2970853a89d1abb9ae5d4f3bab355691c3ccbbe4bcb2e44425d6c2c3dc3ddd8d43872a6063f111c1c7e6ed4449b39bbd6df92ed4a0e4808ffad0391f89b509f683061bcbe06369e47d43e9", 0x1000}) syz_emit_ethernet(0x4af, &(0x7f0000001a80)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}, @void, {@mpls_uc={0x8847, {[], @ipv6=@gre_packet={0x7, 0x6, "449d70", 0x479, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @local}, @dev={0xfe, 0x80, '\x00', 0x3a}, {[@srh={0x8, 0x10, 0x4, 0x8, 0x7f, 0x28, 0x0, [@empty, @dev={0xfe, 0x80, '\x00', 0x15}, @empty, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0, @private0, @rand_addr=' \x01\x00']}, @routing={0x87, 0xa, 0x1, 0x3, 0x0, [@loopback, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, @remote, @loopback]}, @hopopts={0xff, 0x2, '\x00', [@pad1, @hao={0xc9, 0x10, @loopback}]}, @routing={0x21, 0x10, 0x0, 0x68, 0x0, [@mcast2, @remote, @local, @mcast2, @empty, @private2, @loopback, @empty]}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x78, 0x2, [0x2], "2200f043c6a2a3768866632ec1677f7f948dd0bd1cca8f64fd273aa0aefabeb0a92974ba272c46f48d059cd3d7a2b7a0f80f977116184ed688fa8b95c805226d547977d1c89068e2ef95febc9aeda288d759db5ddbd9f53a8319cdf73261d267ab0383f14e78b25879f21e5acdc1d3ab151e8f1484cd12a6"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "314533429ee18c73fc31ec9a68b0af8fadb04717190cb795fe132bbad1f1b7a9c42a54d84b08f5383484a00194a0b17c67f3361143ad8c1f6562aa1198176a4d583298f411edcb6e1de1a051925a4bd8beb5196255f726dc1cbc922bcd85027108382d3c107bc3aaf69bb6f81ea5a16e79e080ca5a3b120eb5"}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "6bd4d7335c091d4b55579eda08dffcb1c9dfc2bd516ef18e3f2286bf3a193c3ada1772fd88e49ed356e82d97e0a1190ce1cbf3901e529fd5269d722c99ee537ac8582b112b13ec5d5984761137aa7ed0606a816ba5eee7163693fff2ce79517c7894a2664dd6dc1a68bbece148b9f1757d55d76d3bbe2dd18b5626679a97301ae624d6f8998af747642c25f90bb813260bdb49b254b138cdd44a219dfabc7a67ff7069912fe89ceaa23b3ab520943473ce151857bc2ea815f08b0772eb6ef5639f7f08068dd3a8d73936863d7c98136f30cb"}, {0x8, 0x88be, 0x4, {{0x4, 0x1, 0x8, 0x1, 0x0, 0x3, 0x5, 0x6}, 0x1, {0xffff0000}}}, {0x8, 0x22eb, 0x3, {{0x4, 0x2, 0xa, 0x1, 0x0, 0x3, 0x3}, 0x2, {0x8, 0x7, 0x3, 0x2, 0x0, 0x0, 0x3, 0x1}}}, {0x8, 0x6558, 0x3, "a5d29f29fd65ee3b3f87707e4b145dcda0a0c9370125a1095d8e791dd1a76d58bfb8ea71926e8cec4883540c045a85e2bc2f9fb99d6e609ca8c02af3d937f92ae194f85a9bfe64b7a68d2da67250ed1819cf5c8ee11302f35ae0a89bf56394599483e267e088eda52cdc89414eb7db74844a33600d17fbfac4ded44cd91c6c79251f090c10a11d666663de7aea82d39665c9ea7b29cc0b20a1bb347a60020c1625ecb1a3613dcf20781ce1918c6581ae07b9c7f7dc36d45372cbbe9fd52a0f4a840b4fd6f41673413000ee6af97d4c929218caa485598077afbe5132b3aa585d6b74a63a1fbc4f6b"}}}}}}}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca3", 0x4}], 0x1}], 0x1, 0x40800) mprotect(&(0x7f0000ab4000/0x2000)=nil, 0x2000, 0x5) r4 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0xf, &(0x7f00000000c0), 0x4) sendmsg$inet(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x31, &(0x7f0000000640), 0x4) setsockopt$sock_attach_bpf(r4, 0x1, 0x31, &(0x7f0000000080), 0x4) 2.241388261s ago: executing program 0 (id=328): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000400)={0x0, 0x0, {0x0, @struct, 0x0}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) r4 = socket(0x1, 0x803, 0x0) (async) r5 = syz_open_dev$vim2m(&(0x7f0000000300), 0x400000000000003, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f00000000c0)={0x98f900}) getsockopt$inet_mptcp_buf(r0, 0x11c, 0x3, &(0x7f0000000300)=""/80, &(0x7f00000003c0)=0x50) (async, rerun: 32) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async, rerun: 32) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000140)={'veth0_to_batadv\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2d, 0x4, 0x5, {0xb, @ah_ip6_spec={@ipv4={'\x00', '\xff\xff', @multicast1}, @remote, 0xb, 0x3}, {0x0, @empty, 0x9, 0x401, [0x1, 0x1]}, @usr_ip4_spec={@dev={0xac, 0x14, 0x14, 0x1d}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x1, 0x4, 0x1, 0x94}, {0x0, @local, 0x2, 0x9, [0x100, 0x10]}, 0x102}}}) (async) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4000000) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000001080)={0x4, 0x1, {0x4, @struct={0x1, 0x9}, r2, 0x4, 0x6, 0xb6, 0x80000001, 0x7ff, 0x0, @struct={0x80000001}, 0x203, 0x6, [0x4, 0x7, 0x1, 0xffffffffffffffff, 0x4, 0x1]}, {0x100, @usage=0x40, 0x0, 0x401, 0x6, 0x2, 0x7ff, 0x0, 0x0, @usage=0xff, 0x6, 0x100, [0xee, 0x4, 0x1, 0x8000000000000000, 0x6, 0x258b6064]}, {0x0, @usage=0xff0, 0x0, 0x10, 0x800, 0xe1, 0x2, 0x7, 0x4, @struct={0x7f, 0x8}, 0xc0000000, 0xd, [0x7, 0x7, 0x8, 0xa118930, 0x8, 0xf8]}, {0xfffffffffffff1ac, 0x21f, 0x100}}) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) (async) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r8, 0xfffffffc) (async) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) (async) msync(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x4) (async, rerun: 32) r9 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') (async, rerun: 32) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) preadv(r9, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/183, 0xb7}], 0x1, 0x5fae, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 1.599962958s ago: executing program 4 (id=329): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x0) close_range(r0, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)="03", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000500)={0x6}) recvmmsg(r2, &(0x7f0000001140), 0x700, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r3, &(0x7f000001aa40)=""/102392, 0x18ff8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) 1.483912894s ago: executing program 2 (id=330): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000140)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000040)=0x200000000) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/cpuinfo\x00', 0x1800, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x4a, &(0x7f0000000500), 0x4) preadv(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x7, 0x1009) read$msr(r1, &(0x7f00000003c0)=""/184, 0xb8) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, 0x0) r4 = dup2(r0, r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r5, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f00000026c0)={0x20, r6, 0x303, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}}, 0x8800) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x6) read$FUSE(r4, &(0x7f00000016c0)={0x2020}, 0x2020) 1.328713489s ago: executing program 0 (id=331): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000000)={@fallback=0xffffffffffffffff, 0xb, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x40, &(0x7f00000000c0)=0x3, 0x4) sendto$inet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000d80), 0x36f, 0x20102, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) preadv(r1, &(0x7f0000000080), 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() sched_setscheduler(r6, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x800) recvmmsg$unix(r10, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) 720.743501ms ago: executing program 1 (id=332): add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) (async) r0 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000540)=0x9) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0xef) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)=0x40) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x7e) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x0, 0x0, 0x4, 0xfffffffc}) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000240)='asymmetric\x00', &(0x7f00000001c0)=@keyring) (async) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000240)='asymmetric\x00', &(0x7f00000001c0)=@keyring) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0xa0181) writev(r2, &(0x7f0000002e00)=[{&(0x7f0000000a40)="fdcb6e", 0x3}, {0x0}], 0x2) (async) writev(r2, &(0x7f0000002e00)=[{&(0x7f0000000a40)="fdcb6e", 0x3}, {0x0}], 0x2) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r3, 0x0, 0xe3, 0xd3, &(0x7f00000003c0)="3c1511af133425976387a643af0833a319324070ee02d37740ad16daf2c0a27349d7461f0abb50a2e2e713e91704430ec97481838f4574ba5bfc0493ae5a345e6e167c3bc53dd3b046db58d49fb6085d97c951a603be1d78797dd227349fa8e21faa61487c3c0e24051a5ea7b7f120be04e894b390b795543790094851ac4651a3777b26f03174ccc02d70a6ee7592ae9c61bab691ef4e8fd5a15714ab10852b9ab139883c16b9b638423cd5703d90a41cc2ed7c3fbe70d1669a0b939dcb5c790217e45cfef07d6caa6bad8feb0396a383e8488c9601a9261d3f5143dcac9b548f2048", &(0x7f00000004c0)=""/211, 0x1000, 0x0, 0x74, 0xe5, &(0x7f00000005c0)="9235efb05daac5fa4364eed1ea26387a53596c694cecd033ca566d61dbf805d18a8f80171713598b4284eeb27be2e501a969432d09cf49f1c152c092d278af979a6070fa3080b6af556b9033effd345a13c278d17f73e97ff1c57f3a0788797b162052f3c18dd977d537f97e5eb5aa0c51b96e02", &(0x7f0000000640)="6d794d10107c73a0efd3bec0d683e180026ac2c51f59a3f88802e30ec1d934ebea2a243d422d100d5c1abcb51326d3e6561c44994432cacd27eaec3c263a31486dc4b4f7d43c5205837d092e922524032065076bfc8ee4bb12d8eab2674f0a6989f66dc8436daa6fee83e12fe16a654001f406611ced4f2664ba843f31391e8774a63f059c1ec5adeb033d151439aa04581be7fb78b30210fbedd3dfecbc0e438aef6828cdf9bd4796c5dd495b9afd3ff6292d35d1683ec0ad96766715b37e68f4f7cb73189f6d25a9dd1b4b4d5ea0a1ba5e6b2420c73d01d06697110b219432bded753925", 0x4, 0x0, 0x6}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r3, 0x0, 0xe3, 0xd3, &(0x7f00000003c0)="3c1511af133425976387a643af0833a319324070ee02d37740ad16daf2c0a27349d7461f0abb50a2e2e713e91704430ec97481838f4574ba5bfc0493ae5a345e6e167c3bc53dd3b046db58d49fb6085d97c951a603be1d78797dd227349fa8e21faa61487c3c0e24051a5ea7b7f120be04e894b390b795543790094851ac4651a3777b26f03174ccc02d70a6ee7592ae9c61bab691ef4e8fd5a15714ab10852b9ab139883c16b9b638423cd5703d90a41cc2ed7c3fbe70d1669a0b939dcb5c790217e45cfef07d6caa6bad8feb0396a383e8488c9601a9261d3f5143dcac9b548f2048", &(0x7f00000004c0)=""/211, 0x1000, 0x0, 0x74, 0xe5, &(0x7f00000005c0)="9235efb05daac5fa4364eed1ea26387a53596c694cecd033ca566d61dbf805d18a8f80171713598b4284eeb27be2e501a969432d09cf49f1c152c092d278af979a6070fa3080b6af556b9033effd345a13c278d17f73e97ff1c57f3a0788797b162052f3c18dd977d537f97e5eb5aa0c51b96e02", &(0x7f0000000640)="6d794d10107c73a0efd3bec0d683e180026ac2c51f59a3f88802e30ec1d934ebea2a243d422d100d5c1abcb51326d3e6561c44994432cacd27eaec3c263a31486dc4b4f7d43c5205837d092e922524032065076bfc8ee4bb12d8eab2674f0a6989f66dc8436daa6fee83e12fe16a654001f406611ced4f2664ba843f31391e8774a63f059c1ec5adeb033d151439aa04581be7fb78b30210fbedd3dfecbc0e438aef6828cdf9bd4796c5dd495b9afd3ff6292d35d1683ec0ad96766715b37e68f4f7cb73189f6d25a9dd1b4b4d5ea0a1ba5e6b2420c73d01d06697110b219432bded753925", 0x4, 0x0, 0x6}, 0x50) syz_usb_connect(0x2, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000280)="5b9dbf05fafb4197e2240ad945805b3295cf05b224c7bbafd36b129caaadf624a878d817c223dfb2573d9fc5807ab77e76242233e53e5973e1a232a2fa416c2dad9d5a4758290ccc9ded086115a42648fb2b2749b07f3a1f56ed4cf3842cf77d4ad7c33ec15e98de993ee67cf8745d05b8f5cf0fd420ddd8a4dda9fe3f6fa16cd2395e5cb327cdd487e57e125f9e420de5a9571f719fc82fae7a9f50de4ad90d1691448fde1b30286346d9bea896821cdbd22e90b67914e6716e352af8a00dd1598b0be00f", 0xc5, r0) 26.99768ms ago: executing program 2 (id=333): socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x18}}, 0x0) io_setup(0x30, &(0x7f00000001c0)=0x0) pipe2$9p(&(0x7f00000000c0), 0x4000) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x24}]) 0s ago: executing program 4 (id=334): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f00000004c0)={0x0, 0x0, 0x4, 0x0, 0x2, [0x0], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={r2}) kernel console output (not intermixed with test programs): 7.741288][ T5984] [ 77.741292][ T5984] dump_stack_lvl+0x100/0x190 [ 77.741309][ T5984] should_fail_ex.cold+0x5/0xa [ 77.741325][ T5984] _copy_to_user+0x32/0xd0 [ 77.741343][ T5984] simple_read_from_buffer+0xcb/0x170 [ 77.741365][ T5984] proc_fail_nth_read+0x1af/0x230 [ 77.741383][ T5984] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 77.741401][ T5984] ? rw_verify_area+0xce/0x6d0 [ 77.741417][ T5984] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 77.741435][ T5984] vfs_read+0x1e4/0xb30 [ 77.741455][ T5984] ? __pfx_vfs_read+0x10/0x10 [ 77.741472][ T5984] ? __fget_files+0x215/0x3d0 [ 77.741496][ T5984] ? __fget_files+0x21f/0x3d0 [ 77.741523][ T5984] ksys_read+0x12a/0x250 [ 77.741541][ T5984] ? __pfx_ksys_read+0x10/0x10 [ 77.741561][ T5984] ? rcu_is_watching+0x12/0xc0 [ 77.741590][ T5984] do_syscall_64+0x10b/0xf80 [ 77.741611][ T5984] ? clear_bhb_loop+0x40/0x90 [ 77.741628][ T5984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.741642][ T5984] RIP: 0033:0x7f0fa1f5d68e [ 77.741655][ T5984] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 77.741667][ T5984] RSP: 002b:00007f0fa2e08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 77.741681][ T5984] RAX: ffffffffffffffda RBX: 00007f0fa2e096c0 RCX: 00007f0fa1f5d68e [ 77.741689][ T5984] RDX: 000000000000000f RSI: 00007f0fa2e090a0 RDI: 0000000000000004 [ 77.741702][ T5984] RBP: 00007f0fa2e09090 R08: 0000000000000000 R09: 0000000000000000 [ 77.741710][ T5984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.741717][ T5984] R13: 00007f0fa2216038 R14: 00007f0fa2215fa0 R15: 00007ffc70ecfb78 [ 77.741737][ T5984] [ 77.744854][ T5742] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 77.765312][ T5617] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 77.960139][ T5617] Bluetooth: hci1: Injecting HCI hardware error event [ 77.972735][ T5624] Bluetooth: hci1: hardware error 0x00 [ 77.981890][ T5741] usb 5-1: Product: syz [ 77.986312][ T5741] usb 5-1: Manufacturer: syz [ 77.990914][ T5741] usb 5-1: SerialNumber: syz [ 77.998289][ T5741] usb 5-1: config 0 descriptor?? [ 78.013631][ T5742] dvb-usb: bulk message failed: -22 (4/0) [ 78.062100][ T5742] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 78.116299][ T5742] dvb-usb: bulk message failed: -22 (5/0) [ 78.137290][ T5742] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 78.166286][ T29] audit: type=1400 audit(1778865874.015:263): avc: denied { setopt } for pid=5989 comm="syz.0.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 78.207266][ T5741] radio-si470x 5-1:0.35: this is not a si470x device. [ 78.257383][ T5742] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 78.542138][ T5741] radio-raremono 5-1:0.35: Thanko's Raremono connected: (10C4:818A) [ 78.601657][ T5995] warning: `syz.1.49' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 78.895123][ T5742] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 78.904068][ T5742] usb 4-1: media controller created [ 78.927442][ T5742] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 78.989600][ T5742] usb 4-1: selecting invalid altsetting 3 [ 79.115086][ T5742] ttusb2: set interface to alts=3 failed [ 79.231760][ T5712] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 79.444211][ T5742] DVB: Unable to find symbol tda10086_attach() [ 79.451489][ T5742] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 79.479453][ T5742] dvb-usb: bulk message failed: -22 (4/0) [ 79.501238][ T5742] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 79.534132][ T5742] dvb-usb: bulk message failed: -22 (5/0) [ 79.542939][ T5712] usb 2-1: Using ep0 maxpacket: 8 [ 79.557311][ T5712] usb 2-1: unable to get BOS descriptor or descriptor too short [ 79.569336][ T5742] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 79.591855][ T5712] usb 2-1: config 2 has an invalid interface number: 216 but max is 0 [ 79.592556][ T6007] process 'syz.0.51' launched './file2' with NULL argv: empty string added [ 79.613124][ T5742] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 79.631476][ T5712] usb 2-1: config 2 has no interface number 0 [ 79.659203][ T5712] usb 2-1: config 2 interface 216 has no altsetting 0 [ 79.671713][ T5742] usb 4-1: USB disconnect, device number 3 [ 79.698040][ T5712] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=66.58 [ 79.720157][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.916075][ T5807] IPVS: starting estimator thread 0... [ 80.064006][ T6011] IPVS: using max 38 ests per chain, 91200 per kthread [ 80.083338][ T5624] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 80.528584][ T5712] usb 2-1: Product: syz [ 80.532827][ T5712] usb 2-1: Manufacturer: syz [ 80.537980][ T5712] usb 2-1: SerialNumber: syz [ 80.602262][ T5741] radio-raremono 5-1:0.35: raremono_cmd_main failed (-71) [ 80.638220][ T5742] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 80.684203][ T5741] radio-raremono 5-1:0.35: V4L2 device registered as radio48 [ 80.732549][ T5741] usb 5-1: USB disconnect, device number 4 [ 80.778849][ T5741] radio-raremono 5-1:0.35: Thanko's Raremono disconnected [ 80.854935][ T6014] FAULT_INJECTION: forcing a failure. [ 80.854935][ T6014] name failslab, interval 1, probability 0, space 0, times 0 [ 80.906645][ T6014] CPU: 1 UID: 0 PID: 6014 Comm: syz.3.53 Tainted: G L syzkaller #0 PREEMPT(full) [ 80.906672][ T6014] Tainted: [L]=SOFTLOCKUP [ 80.906677][ T6014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 80.906686][ T6014] Call Trace: [ 80.906691][ T6014] [ 80.906697][ T6014] dump_stack_lvl+0x100/0x190 [ 80.906725][ T6014] should_fail_ex.cold+0x5/0xa [ 80.906749][ T6014] should_failslab+0xc2/0x120 [ 80.906768][ T6014] __kmalloc_node_track_caller_noprof+0xe3/0x850 [ 80.906795][ T6014] ? sidtab_sid2str_get+0x17a/0x670 [ 80.906823][ T6014] kmemdup_noprof+0x29/0x60 [ 80.906839][ T6014] sidtab_sid2str_get+0x17a/0x670 [ 80.906864][ T6014] security_sid_to_context_core+0x35a/0x6d0 [ 80.906886][ T6014] ? avc_audit_post_callback+0x115/0x900 [ 80.906913][ T6014] avc_audit_post_callback+0x1aa/0x900 [ 80.906940][ T6014] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 80.906964][ T6014] ? skb_put+0x138/0x180 [ 80.906985][ T6014] ? audit_log_n_string+0x256/0x550 [ 80.907009][ T6014] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 80.907035][ T6014] common_lsm_audit+0x23f/0x2b0 [ 80.907058][ T6014] ? __pfx_common_lsm_audit+0x10/0x10 [ 80.907083][ T6014] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 80.907110][ T6014] slow_avc_audit+0x186/0x210 [ 80.907138][ T6014] ? __pfx_slow_avc_audit+0x10/0x10 [ 80.907168][ T6014] ? avc_denied+0x14a/0x190 [ 80.907197][ T6014] ? avc_has_perm_noaudit+0x2fc/0x3b0 [ 80.907217][ T6014] avc_has_perm+0x1a6/0x1e0 [ 80.907242][ T6014] ? __pfx_avc_has_perm+0x10/0x10 [ 80.907258][ T6014] ? get_pid_task+0x106/0x250 [ 80.907281][ T6014] sock_has_perm+0x253/0x2f0 [ 80.907299][ T6014] ? __pfx_sock_has_perm+0x10/0x10 [ 80.907320][ T6014] ? ksys_write+0x190/0x250 [ 80.907345][ T6014] ? find_held_lock+0x2b/0x80 [ 80.907363][ T6014] ? __fget_files+0x215/0x3d0 [ 80.907389][ T6014] selinux_socket_setsockopt+0x41/0x80 [ 80.907412][ T6014] security_socket_setsockopt+0x9b/0x230 [ 80.907434][ T6014] do_sock_setsockopt+0x53/0x1d0 [ 80.907458][ T6014] __sys_setsockopt+0x195/0x220 [ 80.907489][ T6014] __x64_sys_setsockopt+0xbd/0x160 [ 80.907515][ T6014] ? do_syscall_64+0x90/0xf80 [ 80.907538][ T6014] ? lockdep_hardirqs_on+0x78/0x100 [ 80.907562][ T6014] do_syscall_64+0x10b/0xf80 [ 80.907584][ T6014] ? clear_bhb_loop+0x40/0x90 [ 80.907605][ T6014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.907622][ T6014] RIP: 0033:0x7f91ad19ce59 [ 80.907638][ T6014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.907654][ T6014] RSP: 002b:00007f91ab3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 80.907671][ T6014] RAX: ffffffffffffffda RBX: 00007f91ad415fa0 RCX: 00007f91ad19ce59 [ 80.907682][ T6014] RDX: 000000000000002a RSI: 0000000000000000 RDI: 0000000000000004 [ 80.907692][ T6014] RBP: 00007f91ab3f6090 R08: 0000000000000088 R09: 0000000000000000 [ 80.907702][ T6014] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000001 [ 80.907711][ T6014] R13: 00007f91ad416038 R14: 00007f91ad415fa0 R15: 00007ffd608b03e8 [ 80.907734][ T6014] [ 81.362876][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 81.427328][ T29] kauditd_printk_skb: 8 callbacks suppressed [ 81.427344][ T29] audit: type=1400 audit(1778865876.715:272): avc: denied { setopt } for pid=6012 comm="syz.3.53" scontext=root:sysadm_r:sysadm_t tsid=148 tclass=ieee802154_socket permissive=1 [ 81.507392][ T6016] tmpfs: Unknown parameter 'rootv¯Kû\ÔDÊ £Š¬Î8(ªmó9d"‘‚–-¼<©cont' [ 81.562081][ T29] audit: type=1400 audit(1778865877.415:273): avc: denied { read } for pid=6015 comm="syz.4.54" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 81.587061][ T29] audit: type=1400 audit(1778865877.435:274): avc: denied { ioctl } for pid=6015 comm="syz.4.54" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 81.655997][ T29] audit: type=1400 audit(1778865877.515:275): avc: denied { create } for pid=6018 comm="syz.3.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 81.846923][ T5712] legousbtower 2-1:2.216: interrupt endpoints not found [ 81.921976][ T5712] usb 2-1: USB disconnect, device number 2 [ 82.157772][ T6030] netlink: 8 bytes leftover after parsing attributes in process `syz.4.58'. [ 82.263443][ T5712] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 82.332669][ T29] audit: type=1400 audit(1778865878.185:276): avc: denied { bind } for pid=6031 comm="syz.0.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 82.411241][ T29] audit: type=1400 audit(1778865878.225:277): avc: denied { write } for pid=6031 comm="syz.0.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 82.462958][ T5712] usb 2-1: Using ep0 maxpacket: 32 [ 82.478152][ T5712] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 82.504519][ T5712] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.538704][ T5712] usb 2-1: config 0 descriptor?? [ 82.557796][ T5712] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 82.795997][ T5712] gspca_vc032x: reg_r err -32 [ 82.808915][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.248975][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.344341][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.391894][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.439285][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.504558][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.538718][ T29] audit: type=1400 audit(1778865879.315:278): avc: denied { write } for pid=6025 comm="syz.1.56" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 83.581239][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.708020][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.782607][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.886062][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 83.959230][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.024180][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.100062][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.142299][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.208896][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.276516][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.344441][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.409561][ T5712] gspca_vc032x: I2c Bus Busy Wait 00 [ 84.465440][ T5712] gspca_vc032x: Unknown sensor... [ 84.538307][ T5712] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 84.882007][ T6048] misc userio: Begin command sent, but we're already running [ 85.556319][ T6052] xt_hashlimit: size too large, truncated to 1048576 [ 85.814095][ T29] audit: type=1400 audit(1778865881.585:279): avc: denied { create } for pid=6053 comm="syz.3.64" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 86.502988][ T29] audit: type=1400 audit(1778865882.275:280): avc: denied { setopt } for pid=6066 comm="syz.4.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 86.762962][ T29] audit: type=1400 audit(1778865882.275:281): avc: denied { sqpoll } for pid=6066 comm="syz.4.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 86.804062][ T29] audit: type=1400 audit(1778865882.285:282): avc: denied { map } for pid=6066 comm="syz.4.66" path="/dev/comedi3" dev="devtmpfs" ino=1278 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.844063][ T29] audit: type=1400 audit(1778865882.285:283): avc: denied { execute } for pid=6066 comm="syz.4.66" path="/dev/comedi3" dev="devtmpfs" ino=1278 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.868971][ T29] audit: type=1400 audit(1778865882.295:284): avc: denied { write } for pid=6066 comm="syz.4.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 86.903434][ T29] audit: type=1400 audit(1778865882.295:285): avc: denied { connect } for pid=6066 comm="syz.4.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 86.924522][ T24] usb 2-1: USB disconnect, device number 3 [ 86.947854][ T29] audit: type=1400 audit(1778865882.295:286): avc: denied { name_connect } for pid=6066 comm="syz.4.66" dest=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 86.994016][ T29] audit: type=1400 audit(1778865882.755:287): avc: denied { write } for pid=6071 comm="syz.2.67" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 87.169088][ T29] audit: type=1400 audit(1778865883.025:288): avc: denied { read write } for pid=6075 comm="syz.1.70" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 87.201779][ T6076] netlink: 'syz.1.70': attribute type 10 has an invalid length. [ 87.210917][ T29] audit: type=1400 audit(1778865883.055:289): avc: denied { open } for pid=6075 comm="syz.1.70" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 87.458964][ T6074] mmap: syz.4.69 (6074) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 88.052980][ T24] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 88.065713][ T6047] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 88.076510][ T6047] batman_adv: batadv0: Adding interface: dummy0 [ 88.085185][ T6047] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.111540][ T6047] batman_adv: batadv0: Interface activated: dummy0 [ 88.134710][ T6049] batadv0: mtu less than device minimum [ 88.141152][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.152796][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.163765][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.176048][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.187031][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.197826][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.209047][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.219998][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.222948][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 88.231163][ T6049] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 88.239324][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 88.258544][ T24] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 88.270527][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.285157][ T6076] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.293799][ T6076] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.307827][ T6076] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.315080][ T6076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.323601][ T6076] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.330755][ T6076] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.357558][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.371455][ T24] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 88.380765][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.391922][ T24] usb 5-1: Product: syz [ 88.405764][ T6076] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 88.415633][ T24] usb 5-1: Manufacturer: syz [ 88.427902][ T24] usb 5-1: SerialNumber: syz [ 88.452473][ T6080] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.482807][ T24] usb 5-1: config 0 descriptor?? [ 88.494741][ T24] appledisplay 5-1:0.0: Submitting URB failed [ 88.503478][ T6080] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.510666][ T24] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -5 [ 89.608573][ T6104] random: crng reseeded on system resumption [ 91.233478][ T6116] FAULT_INJECTION: forcing a failure. [ 91.233478][ T6116] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 91.834310][ T6116] CPU: 0 UID: 0 PID: 6116 Comm: syz.1.80 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.834329][ T6116] Tainted: [L]=SOFTLOCKUP [ 91.834332][ T6116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 91.834338][ T6116] Call Trace: [ 91.834342][ T6116] [ 91.834346][ T6116] dump_stack_lvl+0x100/0x190 [ 91.834363][ T6116] should_fail_ex.cold+0x5/0xa [ 91.834378][ T6116] _copy_from_user+0x2e/0xd0 [ 91.834394][ T6116] video_usercopy+0xe74/0x1700 [ 91.834410][ T6116] ? __pfx___video_do_ioctl+0x10/0x10 [ 91.834425][ T6116] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 91.834441][ T6116] ? __pfx_video_usercopy+0x10/0x10 [ 91.834463][ T6116] v4l2_ioctl+0x1bd/0x250 [ 91.834478][ T6116] ? __pfx_v4l2_ioctl+0x10/0x10 [ 91.834493][ T6116] __x64_sys_ioctl+0x18e/0x210 [ 91.834506][ T6116] do_syscall_64+0x10b/0xf80 [ 91.834522][ T6116] ? clear_bhb_loop+0x40/0x90 [ 91.834534][ T6116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.834545][ T6116] RIP: 0033:0x7f1c3cf9ce59 [ 91.834554][ T6116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.834564][ T6116] RSP: 002b:00007f1c3de5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 91.834574][ T6116] RAX: ffffffffffffffda RBX: 00007f1c3d216090 RCX: 00007f1c3cf9ce59 [ 91.834580][ T6116] RDX: 0000200000000040 RSI: 00000000c008561c RDI: 0000000000000003 [ 91.834586][ T6116] RBP: 00007f1c3de5c090 R08: 0000000000000000 R09: 0000000000000000 [ 91.834592][ T6116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 91.834598][ T6116] R13: 00007f1c3d216128 R14: 00007f1c3d216090 R15: 00007ffe3df52db8 [ 91.834610][ T6116] [ 92.008207][ T24] usb 5-1: USB disconnect, device number 5 [ 92.480464][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 92.480480][ T29] audit: type=1400 audit(1778865888.335:300): avc: denied { append } for pid=6129 comm="syz.4.83" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 92.872735][ T29] audit: type=1400 audit(1778865888.635:301): avc: denied { create } for pid=6129 comm="syz.4.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 93.032731][ T29] audit: type=1400 audit(1778865888.755:302): avc: denied { execute } for pid=6129 comm="syz.4.83" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=10330 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 93.367582][ T29] audit: type=1400 audit(1778865889.145:303): avc: denied { ioctl } for pid=6133 comm="syz.1.85" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x127d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 93.590391][ T29] audit: type=1400 audit(1778865889.155:304): avc: denied { ioctl } for pid=6127 comm="syz.2.84" path="socket:[10332]" dev="sockfs" ino=10332 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 94.422158][ T6156] random: crng reseeded on system resumption [ 95.467786][ T6170] overlay: Bad value for 'verity' [ 95.558093][ T29] audit: type=1400 audit(1778865891.325:305): avc: denied { mount } for pid=6165 comm="syz.4.90" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 96.609208][ T29] audit: type=1400 audit(1778865892.415:306): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 96.892948][ T5741] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 97.422932][ T5741] usb 5-1: Using ep0 maxpacket: 16 [ 97.578753][ T5741] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 97.874712][ T6181] random: crng reseeded on system resumption [ 97.926056][ T5741] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 98.069519][ T5741] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.246908][ T5741] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.457083][ T5741] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 98.494932][ T5741] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.056067][ T5741] usb 5-1: Product: syz [ 99.060945][ T5741] usb 5-1: Manufacturer: syz [ 99.065607][ T5741] usb 5-1: SerialNumber: syz [ 99.096889][ T5741] usb 5-1: config 0 descriptor?? [ 99.136350][ T5741] appledisplay 5-1:0.0: Submitting URB failed [ 99.144137][ T5741] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -5 [ 99.322934][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 99.482953][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 99.630935][ T9] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 99.664743][ T9] usb 2-1: config 0 has no interface number 0 [ 99.689549][ T9] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 99.719731][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.741807][ T9] usb 2-1: Product: syz [ 99.753018][ T9] usb 2-1: Manufacturer: syz [ 99.768574][ T9] usb 2-1: SerialNumber: syz [ 99.788864][ T9] usb 2-1: config 0 descriptor?? [ 99.807635][ T9] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 99.828207][ T9] usb 2-1: selecting invalid altsetting 1 [ 99.848879][ T9] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 99.892690][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 99.922187][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 99.953117][ T9] usb 2-1: media controller created [ 100.006528][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.242315][ T6197] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 101.471750][ T9] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 101.547268][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 101.634457][ T9] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 101.657965][ T29] audit: type=1400 audit(1778865897.515:307): avc: denied { name_bind } for pid=6225 comm="syz.2.103" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 101.680823][ T29] audit: type=1400 audit(1778865897.515:308): avc: denied { create } for pid=6225 comm="syz.2.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 101.701531][ T29] audit: type=1400 audit(1778865897.515:309): avc: denied { execute } for pid=6225 comm="syz.2.103" name="file2" dev="tmpfs" ino=130 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 101.709947][ T9] usb 2-1: USB disconnect, device number 4 [ 101.729674][ T29] audit: type=1400 audit(1778865897.535:310): avc: denied { execute_no_trans } for pid=6225 comm="syz.2.103" path="/21/file2" dev="tmpfs" ino=130 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 101.753258][ T29] audit: type=1400 audit(1778865897.555:311): avc: denied { read } for pid=6225 comm="syz.2.103" name="usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 101.787429][ T29] audit: type=1400 audit(1778865897.555:312): avc: denied { open } for pid=6225 comm="syz.2.103" path="/dev/usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 101.940114][ T5741] usb 5-1: USB disconnect, device number 6 [ 102.048880][ T6232] overlayfs: upper fs does not support file handles, falling back to index=off. [ 102.096712][ T6235] netem: change failed [ 102.101506][ T6232] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 102.232924][ T5807] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 102.269250][ T29] audit: type=1400 audit(1778865898.125:313): avc: denied { create } for pid=6231 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 102.376814][ T29] audit: type=1400 audit(1778865898.155:314): avc: denied { bind } for pid=6231 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 102.462899][ T5807] usb 4-1: Using ep0 maxpacket: 16 [ 102.469540][ T5807] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.480249][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 102.480882][ T6241] libceph: secret too big 289 [ 102.498015][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 102.509378][ T5741] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 102.520355][ T5807] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 102.552584][ T5807] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 102.596872][ T5807] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 102.614911][ T5807] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 102.624546][ T5807] usb 4-1: Manufacturer: syz [ 102.650504][ T5807] usb 4-1: config 0 descriptor?? [ 102.671011][ T29] audit: type=1400 audit(1778865901.530:315): avc: denied { create } for pid=6242 comm="syz.2.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 102.695402][ T5741] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 102.705862][ T5741] usb 5-1: config 0 has no interface number 0 [ 102.774244][ T5741] usb 5-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 102.792189][ T5741] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.802333][ T5741] usb 5-1: Product: syz [ 102.808171][ T5741] usb 5-1: Manufacturer: syz [ 102.813278][ T5741] usb 5-1: SerialNumber: syz [ 102.828084][ T5741] usb 5-1: config 0 descriptor?? [ 102.845560][ T5741] usb 5-1: selecting invalid altsetting 1 [ 102.851787][ T5741] dvb_ttusb_budget: ttusb_init_controller: error [ 102.858879][ T5741] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 102.920244][ T5741] DVB: Unable to find symbol stv0299_attach() [ 102.942929][ T5807] rc_core: IR keymap rc-hauppauge not found [ 102.960442][ T5807] Registered IR keymap rc-empty [ 102.966811][ T5741] DVB: Unable to find symbol tda8083_attach() [ 102.973700][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 102.980900][ T5741] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 103.003653][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.052313][ T5807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 103.090852][ T5807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input6 [ 103.431540][ T6235] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.447478][ T6235] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.453812][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.503054][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.530138][ T5622] usb 5-1: USB disconnect, device number 7 [ 103.545739][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.613945][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.659909][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.684110][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.717506][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.852266][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 103.967012][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 104.112439][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 104.546137][ T5807] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 104.571016][ T5807] mceusb 4-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 104.634695][ T5807] usb 4-1: USB disconnect, device number 4 [ 104.999603][ T29] audit: type=1400 audit(1778865903.850:316): avc: denied { create } for pid=6283 comm="syz.2.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 105.041085][ T6286] netlink: 64 bytes leftover after parsing attributes in process `syz.2.120'. [ 105.134912][ T5807] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 105.165272][ T5741] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 105.366836][ T5807] usb 4-1: Using ep0 maxpacket: 16 [ 105.387596][ T5807] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.423136][ T5741] usb 1-1: Using ep0 maxpacket: 16 [ 105.449063][ T5741] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 105.482056][ T5807] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 105.533864][ T5741] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 105.568173][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.672399][ T5741] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 105.715449][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.783919][ T5741] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.811895][ T5807] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 105.843109][ T5741] usb 1-1: Product: syz [ 105.848815][ T6291] trusted_key: syz.1.123 sent an empty control message without MSG_MORE. [ 105.857563][ T5741] usb 1-1: Manufacturer: syz [ 105.857584][ T5741] usb 1-1: SerialNumber: syz [ 105.858770][ T5807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.890918][ T5741] usb 1-1: config 0 descriptor?? [ 105.918837][ T5807] usb 4-1: Product: syz [ 105.930030][ T5741] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 105.944655][ T6293] syzkaller0: entered promiscuous mode [ 105.951952][ T5807] usb 4-1: Manufacturer: syz [ 105.968585][ T5807] usb 4-1: SerialNumber: syz [ 105.973444][ T5741] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 105.980566][ T6293] syzkaller0: entered allmulticast mode [ 105.989484][ T5807] usb 4-1: config 0 descriptor?? [ 106.007034][ T5807] appledisplay 4-1:0.0: Submitting URB failed [ 106.015823][ T5807] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -5 [ 106.053860][ T6297] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 106.125900][ T6299] netlink: 48 bytes leftover after parsing attributes in process `syz.4.125'. [ 106.193374][ T6300] netlink: 48 bytes leftover after parsing attributes in process `syz.4.125'. [ 106.306095][ T6299] comedi comedi2: ni_at_a2150: I/O base address or length out of range [ 106.565534][ T5741] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 106.650889][ T5741] em28xx 1-1:0.0: Config register raw data: 0x41 [ 106.966101][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 106.966135][ T29] audit: type=1400 audit(1778865905.820:323): avc: denied { setopt } for pid=6307 comm="syz.2.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 107.092032][ T6312] FAULT_INJECTION: forcing a failure. [ 107.092032][ T6312] name failslab, interval 1, probability 0, space 0, times 0 [ 107.120573][ T6312] CPU: 1 UID: 0 PID: 6312 Comm: syz.2.128 Tainted: G L syzkaller #0 PREEMPT(full) [ 107.120605][ T6312] Tainted: [L]=SOFTLOCKUP [ 107.120610][ T6312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 107.120619][ T6312] Call Trace: [ 107.120625][ T6312] [ 107.120631][ T6312] dump_stack_lvl+0x100/0x190 [ 107.120655][ T6312] should_fail_ex.cold+0x5/0xa [ 107.120679][ T6312] ? tomoyo_realpath_from_path+0xb6/0x690 [ 107.120702][ T6312] should_failslab+0xc2/0x120 [ 107.120721][ T6312] __kmalloc_noprof+0xe0/0x850 [ 107.120745][ T6312] ? kfree+0x1dd/0x6c0 [ 107.120771][ T6312] tomoyo_realpath_from_path+0xb6/0x690 [ 107.120798][ T6312] tomoyo_mount_acl+0x1b6/0x8b0 [ 107.120818][ T6312] ? is_bpf_text_address+0x8a/0x1a0 [ 107.120841][ T6312] ? bpf_ksym_find+0x128/0x1c0 [ 107.120866][ T6312] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 107.120886][ T6312] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 107.120903][ T6312] ? kernel_text_address+0x8d/0x100 [ 107.120927][ T6312] ? unwind_get_return_address+0x59/0xa0 [ 107.120975][ T6312] ? tomoyo_domain+0xb2/0x150 [ 107.120989][ T6312] ? tomoyo_profile+0x47/0x60 [ 107.121016][ T6312] tomoyo_mount_permission+0x214/0x460 [ 107.121035][ T6312] ? tomoyo_mount_permission+0x1f6/0x460 [ 107.121056][ T6312] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 107.121093][ T6312] security_sb_mount+0xdd/0x270 [ 107.121115][ T6312] path_mount+0x158/0x23d0 [ 107.121145][ T6312] ? __pfx_path_mount+0x10/0x10 [ 107.121168][ T6312] ? lockdep_hardirqs_on+0x78/0x100 [ 107.121198][ T6312] ? putname+0xb1/0x110 [ 107.121219][ T6312] ? kmem_cache_free+0x127/0x6c0 [ 107.121249][ T6312] ? __x64_sys_mount+0x293/0x310 [ 107.121271][ T6312] __x64_sys_mount+0x293/0x310 [ 107.121297][ T6312] ? __pfx___x64_sys_mount+0x10/0x10 [ 107.121331][ T6312] do_syscall_64+0x10b/0xf80 [ 107.121353][ T6312] ? clear_bhb_loop+0x40/0x90 [ 107.121374][ T6312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.121391][ T6312] RIP: 0033:0x7f7a9e99ce59 [ 107.121406][ T6312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.121421][ T6312] RSP: 002b:00007f7a9f785028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 107.121438][ T6312] RAX: ffffffffffffffda RBX: 00007f7a9ec15fa0 RCX: 00007f7a9e99ce59 [ 107.121449][ T6312] RDX: 0000200000000480 RSI: 0000200000000040 RDI: 0000000000000000 [ 107.121459][ T6312] RBP: 00007f7a9f785090 R08: 0000200000000140 R09: 0000000000000000 [ 107.121468][ T6312] R10: 0000000002004888 R11: 0000000000000246 R12: 0000000000000001 [ 107.121477][ T6312] R13: 00007f7a9ec16038 R14: 00007f7a9ec15fa0 R15: 00007ffceacf5908 [ 107.121500][ T6312] [ 107.122663][ T6312] ERROR: Out of memory at tomoyo_realpath_from_path. [ 107.403536][ T6313] netlink: 'syz.0.119': attribute type 11 has an invalid length. [ 107.414327][ T6313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.432247][ T6313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 107.643682][ T6313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.655715][ T6313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 107.781940][ T29] audit: type=1400 audit(1778865906.630:324): avc: denied { setopt } for pid=6324 comm="syz.2.132" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 107.803424][ T29] audit: type=1400 audit(1778865906.630:325): avc: denied { ioctl } for pid=6324 comm="syz.2.132" path="socket:[10924]" dev="sockfs" ino=10924 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 108.079147][ T6331] netlink: 64 bytes leftover after parsing attributes in process `syz.2.133'. [ 108.727789][ T9] usb 1-1: USB disconnect, device number 4 [ 108.733749][ T5712] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 108.742977][ T5741] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 108.750282][ T9] em28xx 1-1:0.0: Disconnecting em28xx [ 108.788657][ T9] em28xx 1-1:0.0: Freeing device [ 108.841855][ T5807] usb 4-1: USB disconnect, device number 5 [ 108.906301][ T5712] usb 2-1: unable to get BOS descriptor or descriptor too short [ 108.916794][ T5712] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 108.926415][ T5741] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.928008][ T5712] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 108.947782][ T5712] usb 2-1: config 63 has no interface number 0 [ 108.955111][ T5712] usb 2-1: config 63 interface 66 has no altsetting 0 [ 108.965443][ T5741] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 108.975091][ T5712] usb 2-1: language id specifier not provided by device, defaulting to English [ 109.001302][ T5712] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 109.012196][ T5741] usb 5-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 109.020894][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.032548][ T5741] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.050348][ T5741] usb 5-1: Product: syz [ 109.057616][ T5712] usb 2-1: SerialNumber: 腖ꡎ뒻蕕ç®ã¢§ï¢«âŸ¶å„«é—£æ‹–줈舥 [ 109.064787][ T5741] usb 5-1: Manufacturer: syz [ 109.210012][ T6339] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'. [ 109.263384][ T5741] usb 5-1: SerialNumber: syz [ 109.308432][ T29] audit: type=1400 audit(1778865908.150:326): avc: denied { shutdown } for pid=6342 comm="syz.3.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 109.477129][ T29] audit: type=1400 audit(1778865908.330:327): avc: denied { connect } for pid=6342 comm="syz.3.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 109.479875][ T5712] uvcvideo 2-1:63.66: probe with driver uvcvideo failed with error -22 [ 109.696041][ T5712] usb 2-1: USB disconnect, device number 5 [ 109.772796][ T29] audit: type=1400 audit(1778865908.560:328): avc: denied { accept } for pid=6349 comm="syz.2.141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 109.908371][ T29] audit: type=1400 audit(1778865908.590:329): avc: denied { accept } for pid=6342 comm="syz.3.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 109.959164][ T6346] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input7 [ 109.966592][ T29] audit: type=1400 audit(1778865908.610:330): avc: denied { ioctl } for pid=6342 comm="syz.3.139" path="socket:[11004]" dev="sockfs" ino=11004 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 110.126756][ T5741] usb 5-1: 0:1 : does not exist [ 110.133368][ T5741] usb 5-1: BAAD SPEAKER p_chmask mismatch [ 110.288630][ T5741] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 110.311701][ T5741] usb 5-1: USB disconnect, device number 8 [ 110.350111][ T5619] udevd[5619]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 110.395496][ T6365] netlink: 4 bytes leftover after parsing attributes in process `syz.3.144'. [ 111.370650][ T6374] netlink: 4 bytes leftover after parsing attributes in process `syz.3.144'. [ 111.619469][ T6387] netlink: 64 bytes leftover after parsing attributes in process `syz.4.147'. [ 112.678218][ T1095] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.690408][ T1095] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.727045][ T1095] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.757373][ T1095] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.912936][ T5741] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 112.981331][ T6399] random: crng reseeded on system resumption [ 113.103063][ T5741] usb 5-1: Using ep0 maxpacket: 16 [ 113.153077][ T5741] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 113.249167][ T5741] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 113.367291][ T5741] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.471486][ T5741] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 113.601150][ T5741] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 113.706665][ T5741] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.776112][ T5741] usb 5-1: Product: syz [ 113.829502][ T5741] usb 5-1: Manufacturer: syz [ 113.884641][ T5741] usb 5-1: SerialNumber: syz [ 113.932139][ T5741] usb 5-1: config 0 descriptor?? [ 113.964715][ T5741] appledisplay 5-1:0.0: Submitting URB failed [ 113.985142][ T5741] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -5 [ 114.129763][ T29] audit: type=1400 audit(1778865912.980:331): avc: denied { ioctl } for pid=6409 comm="syz.0.155" path="socket:[11549]" dev="sockfs" ino=11549 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 114.451236][ T29] audit: type=1400 audit(1778865913.300:332): avc: denied { read } for pid=6421 comm="syz.1.157" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 114.475995][ T29] audit: type=1400 audit(1778865913.300:333): avc: denied { open } for pid=6421 comm="syz.1.157" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 114.513406][ T5622] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 114.559170][ T29] audit: type=1400 audit(1778865913.300:334): avc: denied { ioctl } for pid=6421 comm="syz.1.157" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 115.865108][ T5622] usb 1-1: unable to get BOS descriptor or descriptor too short [ 115.892626][ T6430] netlink: 64 bytes leftover after parsing attributes in process `syz.2.159'. [ 116.157021][ T5741] usb 5-1: USB disconnect, device number 9 [ 116.163337][ T5622] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0xF is Bulk; changing to Interrupt [ 116.183670][ T5622] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 is Bulk; changing to Interrupt [ 116.258210][ T5622] usb 1-1: New USB device found, idVendor=0582, idProduct=0048, bcdDevice= 0.40 [ 116.273884][ T5622] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.291316][ T5622] usb 1-1: Product: 㛊í¥î¤·áŽ‰ïª¨èŠ­æ¨¹ãꂅ즺櫬ê«Ä‘曨å˜ä½®æ¢¡è¤é…Ÿê©å‘·ç¥Œæ¶µã¢é–€ì±ë¥æ¯–䷑ဿꜼ잆ꙷ㿇뻭쟾튑㰿 [ 116.292341][ T29] audit: type=1400 audit(1778865915.130:335): avc: denied { name_bind } for pid=6433 comm="syz.3.160" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 116.307124][ T5622] usb 1-1: Manufacturer: 〉 [ 116.587250][ T5622] usb 1-1: SerialNumber: 显䔅侂缠ﭵ᪕栞舔腎竈㑉è²ì’¶é¹·î³¤ë¾Ÿç´·é˜´â„´ãº€è«ë™¯è…»ï­šè‰‹ë¹…ã¼¥å…癩澑扩䥨瀪ᨖ翉⋺ﳷï ç¢Šì °îŒ±ç­®ì² î¬²ë‰’ㇸ࿱艗êˆá³Šãº·á˜™ãœ…ꘗ嘀ﺛ쑕Ꞌ隬筄⧟嗳撡īæ›ïŽƒá¹ [ 116.605227][ T29] audit: type=1400 audit(1778865915.130:336): avc: denied { node_bind } for pid=6433 comm="syz.3.160" saddr=255.255.255.255 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 116.658694][ T6411] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 116.673206][ T6411] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 116.689308][ T29] audit: type=1400 audit(1778865915.190:337): avc: denied { mounton } for pid=6433 comm="syz.3.160" path="/proc/89/task" dev="proc" ino=11145 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 116.712679][ T29] audit: type=1400 audit(1778865915.540:338): avc: denied { link } for pid=6436 comm="syz.2.161" name="#7" dev="tmpfs" ino=247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 116.742724][ T29] audit: type=1400 audit(1778865915.600:339): avc: denied { rename } for pid=6436 comm="syz.2.161" name="#8" dev="tmpfs" ino=247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 117.045021][ T29] audit: type=1400 audit(1778865915.600:340): avc: denied { read write } for pid=6438 comm="syz.3.162" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 117.071098][ T6442] random: crng reseeded on system resumption [ 117.105815][ T5622] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 117.132497][ T5622] usb 1-1: invalid MIDI in EP 0 [ 117.935145][ T6452] vivid-001: ================= START STATUS ================= [ 117.965400][ T6452] vivid-001: Radio HW Seek Mode: Bounded [ 118.007320][ T6452] vivid-001: Radio Programmable HW Seek: false [ 118.034779][ T6452] vivid-001: RDS Rx I/O Mode: Block I/O [ 118.037651][ T5622] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 118.075607][ T6452] vivid-001: Generate RBDS Instead of RDS: false [ 118.089654][ T5622] usb 1-1: USB disconnect, device number 5 [ 118.133866][ T6452] vivid-001: RDS Reception: true [ 118.134098][ T6456] comedi comedi0: Minor 2 could not be opened [ 118.151240][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 118.232968][ T6452] vivid-001: RDS Program Type: 0 inactive [ 118.239082][ T6452] vivid-001: RDS PS Name: inactive [ 118.944478][ T6452] vivid-001: RDS Radio Text: inactive [ 118.957341][ T6452] vivid-001: RDS Traffic Announcement: false inactive [ 118.994656][ T6452] vivid-001: RDS Traffic Program: false inactive [ 119.010441][ T6452] vivid-001: RDS Music: false inactive [ 119.018647][ T6452] vivid-001: ================== END STATUS ================== [ 119.155743][ T5622] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 119.220098][ T6464] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 119.253115][ T5720] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 119.281069][ T6465] netlink: 48 bytes leftover after parsing attributes in process `syz.1.163'. [ 119.293504][ T6465] netlink: 48 bytes leftover after parsing attributes in process `syz.1.163'. [ 119.319213][ T6465] comedi comedi2: ni_at_a2150: I/O base address or length out of range [ 119.333442][ T5622] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 119.346083][ T5622] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.355483][ T5622] usb 1-1: Product: syz [ 119.359992][ T5622] usb 1-1: Manufacturer: syz [ 119.369326][ T5622] usb 1-1: SerialNumber: syz [ 119.463057][ T5720] usb 4-1: Using ep0 maxpacket: 8 [ 119.476190][ T5720] usb 4-1: unable to get BOS descriptor or descriptor too short [ 119.620998][ T5720] usb 4-1: config 1 has an invalid descriptor of length 221, skipping remainder of the config [ 119.846405][ T5720] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 119.932740][ T5720] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 120.122392][ T5720] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 120.200835][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=232, SerialNumber=3 [ 120.265314][ T5720] usb 4-1: Product: syz [ 120.305400][ T5720] usb 4-1: Manufacturer: syz [ 120.365646][ T5720] usb 4-1: SerialNumber: syz [ 120.511768][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 120.511786][ T29] audit: type=1400 audit(1778865919.360:346): avc: denied { name_bind } for pid=6453 comm="syz.0.167" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 120.590845][ T5622] net_ratelimit: 10 callbacks suppressed [ 120.590873][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 120.685668][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 121.238475][ T5720] cdc_ncm 4-1:1.0: invalid descriptor buffer length [ 121.345687][ T5720] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 121.381832][ T5720] cdc_ncm 4-1:1.0: bind() failure [ 121.420307][ T5720] usb 4-1: USB disconnect, device number 6 [ 121.607475][ T6473] netlink: 64 bytes leftover after parsing attributes in process `syz.2.171'. [ 122.266098][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 122.439430][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 122.451714][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 122.463696][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 122.473848][ T5622] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 122.523073][ T5622] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 122.545552][ T5622] usb 1-1: USB disconnect, device number 6 [ 122.596462][ T29] audit: type=1400 audit(1778865921.450:347): avc: denied { write } for pid=6477 comm="syz.1.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 122.862942][ T24] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 122.884897][ T5741] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 123.038644][ T24] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 123.052094][ T5741] usb 3-1: Using ep0 maxpacket: 16 [ 123.080119][ T5741] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.103254][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.193641][ T5741] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 123.205490][ T24] usb 2-1: Product: syz [ 123.213716][ T24] usb 2-1: Manufacturer: syz [ 123.218585][ T24] usb 2-1: SerialNumber: syz [ 123.260548][ T5741] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.313017][ T5741] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.401743][ T24] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 123.430727][ T5741] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 123.462059][ T5741] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.500316][ T5741] usb 3-1: Product: syz [ 123.512281][ T5741] usb 3-1: Manufacturer: syz [ 123.518365][ T5741] usb 3-1: SerialNumber: syz [ 123.524971][ T5622] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 123.545604][ T5741] usb 3-1: config 0 descriptor?? [ 123.555346][ T5741] appledisplay 3-1:0.0: Submitting URB failed [ 123.561625][ T5741] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -5 [ 123.799710][ T6497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.948369][ T6497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.094744][ T29] audit: type=1400 audit(1778865922.930:348): avc: denied { search } for pid=5273 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.123020][ T29] audit: type=1400 audit(1778865922.950:349): avc: denied { search } for pid=5273 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.147366][ T29] audit: type=1400 audit(1778865922.950:350): avc: denied { search } for pid=5273 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.187945][ T29] audit: type=1400 audit(1778865922.950:351): avc: denied { read } for pid=5273 comm="dhcpcd" name="n30" dev="tmpfs" ino=2652 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 124.619389][ T5622] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 124.642933][ T5622] ath9k_htc: Failed to initialize the device [ 124.700779][ T29] audit: type=1400 audit(1778865922.950:352): avc: denied { open } for pid=5273 comm="dhcpcd" path="/run/udev/data/n30" dev="tmpfs" ino=2652 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 124.745884][ T5622] usb 2-1: ath9k_htc: USB layer deinitialized [ 124.843910][ T29] audit: type=1400 audit(1778865922.950:353): avc: denied { getattr } for pid=5273 comm="dhcpcd" path="/run/udev/data/n30" dev="tmpfs" ino=2652 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 125.025598][ T29] audit: type=1400 audit(1778865923.480:354): avc: denied { create } for pid=6502 comm="syz.4.177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 125.173083][ T29] audit: type=1400 audit(1778865923.490:355): avc: denied { create } for pid=6502 comm="syz.4.177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 126.147078][ T24] usb 2-1: USB disconnect, device number 6 [ 126.214439][ T5741] usb 3-1: USB disconnect, device number 3 [ 126.412750][ T6522] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 126.474166][ T6525] netlink: 48 bytes leftover after parsing attributes in process `syz.4.182'. [ 126.486494][ T6525] netlink: 48 bytes leftover after parsing attributes in process `syz.4.182'. [ 126.504075][ T6525] comedi comedi2: ni_at_a2150: I/O base address or length out of range [ 126.536233][ T5712] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 126.783129][ T5712] usb 1-1: Using ep0 maxpacket: 32 [ 126.905274][ T5712] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 127.096598][ T5712] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 127.261455][ T5712] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 127.393534][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.401433][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.575309][ T5712] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 127.674896][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 127.674915][ T29] audit: type=1400 audit(1778865926.530:360): avc: denied { read write } for pid=6530 comm="syz.2.183" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 127.773731][ T5712] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 127.838806][ T6532] fuse: Bad value for 'fd' [ 127.957616][ T5712] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 128.017659][ T29] audit: type=1400 audit(1778865926.580:361): avc: denied { open } for pid=6530 comm="syz.2.183" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 128.192026][ T5712] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 128.329988][ T5712] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.396554][ T29] audit: type=1400 audit(1778865927.240:362): avc: denied { write } for pid=6508 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.450165][ T5712] usb 1-1: config 0 descriptor?? [ 128.500207][ T6542] netlink: 104 bytes leftover after parsing attributes in process `syz.1.185'. [ 128.537189][ T29] audit: type=1400 audit(1778865927.240:363): avc: denied { add_name } for pid=6508 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.571839][ T6545] overlayfs: workdir and upperdir must be separate subtrees [ 128.608223][ T29] audit: type=1400 audit(1778865927.240:364): avc: denied { create } for pid=6508 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 128.703222][ T29] audit: type=1400 audit(1778865927.240:365): avc: denied { write } for pid=6508 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.sl0.link" dev="tmpfs" ino=2685 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 128.868060][ T29] audit: type=1400 audit(1778865927.240:366): avc: denied { append } for pid=6508 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" dev="tmpfs" ino=2685 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 129.486510][ T5622] IPVS: starting estimator thread 0... [ 129.875754][ T29] audit: type=1400 audit(1778865927.300:367): avc: denied { write } for pid=6539 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.898298][ T29] audit: type=1400 audit(1778865927.300:368): avc: denied { remove_name } for pid=6539 comm="rm" name="resolv.conf.sl0.link" dev="tmpfs" ino=2685 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.940563][ T6560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.974472][ T29] audit: type=1400 audit(1778865927.300:369): avc: denied { unlink } for pid=6539 comm="rm" name="resolv.conf.sl0.link" dev="tmpfs" ino=2685 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 130.082966][ T6556] IPVS: using max 55 ests per chain, 132000 per kthread [ 130.150218][ T5712] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 130.675864][ T6560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.678117][ T5712] usb 1-1: USB disconnect, device number 7 [ 131.016113][ T5712] usblp0: removed [ 131.372930][ T5742] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 131.555167][ T5742] usb 4-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 131.573330][ T5742] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.595855][ T5742] usb 4-1: config 0 descriptor?? [ 132.073615][ T5712] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 132.343075][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 132.372915][ T5712] usb 1-1: Using ep0 maxpacket: 16 [ 132.450103][ T5712] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.496760][ T5712] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 132.547557][ T5712] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.599194][ T5712] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.645188][ T5742] hackrf 4-1:0.0: usb_control_msg() failed -110 request 0e [ 132.675501][ T5742] hackrf 4-1:0.0: Could not detect board [ 132.702434][ T5712] usb 1-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 132.725129][ T5742] hackrf 4-1:0.0: probe with driver hackrf failed with error -110 [ 132.752448][ T5712] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.779646][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 132.779662][ T29] audit: type=1400 audit(1778865931.630:374): avc: denied { unmount } for pid=5618 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 132.809163][ T6597] random: crng reseeded on system resumption [ 132.850120][ T5712] usb 1-1: Product: syz [ 132.887534][ T5712] usb 1-1: Manufacturer: syz [ 132.933464][ T5712] usb 1-1: SerialNumber: syz [ 133.091108][ T5712] usb 1-1: config 0 descriptor?? [ 133.368875][ T5712] appledisplay 1-1:0.0: Submitting URB failed [ 133.564859][ T5712] appledisplay 1-1:0.0: probe with driver appledisplay failed with error -5 [ 134.733274][ T5622] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 135.373126][ T5622] usb 3-1: Using ep0 maxpacket: 32 [ 135.622853][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 136.047733][ T5622] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 136.076792][ T5622] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.122868][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 136.145205][ T5622] usb 3-1: config 0 descriptor?? [ 136.166034][ T5622] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 136.357943][ T6622] netlink: 16 bytes leftover after parsing attributes in process `syz.1.200'. [ 136.380683][ T5622] gspca_vc032x: reg_r err -32 [ 136.393737][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.411315][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.426987][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.456049][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.471775][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.489253][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.507585][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.530526][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.536314][ T6625] netlink: 1024 bytes leftover after parsing attributes in process `syz.1.200'. [ 136.560112][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.574365][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.590121][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.604001][ T5712] usb 1-1: USB disconnect, device number 8 [ 136.624554][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.644820][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.665194][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.687354][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.704135][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.721769][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.746765][ T5622] gspca_vc032x: I2c Bus Busy Wait 00 [ 136.781219][ T5622] gspca_vc032x: Unknown sensor... [ 136.815842][ T5622] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 140.277915][ T5720] usb 3-1: USB disconnect, device number 4 [ 140.426242][ T29] audit: type=1400 audit(1778865939.280:375): avc: denied { bind } for pid=6650 comm="syz.2.206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 140.769301][ T42] usb 4-1: USB disconnect, device number 7 [ 140.859482][ T6654] random: crng reseeded on system resumption [ 142.199144][ T6665] xt_ecn: cannot match TCP bits for non-tcp packets [ 142.342019][ T6674] netlink: 8 bytes leftover after parsing attributes in process `syz.0.208'. [ 142.534394][ T6664] syz.0.208 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 142.563314][ T5742] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 142.693718][ T6677] netlink: 'syz.3.212': attribute type 1 has an invalid length. [ 142.753464][ T5742] usb 3-1: Using ep0 maxpacket: 8 [ 142.822705][ T5742] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 142.878283][ T5742] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 142.946313][ T5742] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 143.006839][ T5742] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 143.040646][ T5742] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 143.089552][ T5742] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 143.120814][ T5742] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.410190][ T5742] usb 3-1: usb_control_msg returned -32 [ 143.425067][ T5742] usbtmc 3-1:16.0: can't read capabilities [ 143.426545][ T6669] fuse: Bad value for 'rootmode' [ 143.441196][ T29] audit: type=1400 audit(1778865942.280:376): avc: denied { mounton } for pid=6657 comm="syz.2.209" path="/53/file0" dev="tmpfs" ino=315 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 143.488625][ T6677] 8021q: adding VLAN 0 to HW filter on device bond1 [ 143.782280][ T6680] vlan2: entered allmulticast mode [ 143.813640][ T6680] bond1: entered allmulticast mode [ 143.862856][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 143.922859][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 143.932857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #84!!! [ 144.074036][ T6686] No such timeout policy "syz0" [ 145.056457][ T6682] bond1: (slave geneve2): making interface the new active one [ 145.072855][ T0] NOHZ tick-stop error: local softirq work is pending, handler #86!!! [ 145.073084][ T6682] geneve2: entered allmulticast mode [ 145.702281][ T6682] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 147.542626][ T29] audit: type=1400 audit(1778865946.390:377): avc: denied { write } for pid=6705 comm="syz.1.220" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 147.569395][ T6707] netlink: 8 bytes leftover after parsing attributes in process `syz.1.220'. [ 147.611424][ T5720] usb 3-1: USB disconnect, device number 5 [ 147.986781][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 148.162981][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 148.199960][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 148.229595][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 148.256217][ T29] audit: type=1400 audit(1778865947.110:378): avc: denied { ioctl } for pid=6713 comm="syz.2.221" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 148.338130][ T29] audit: type=1400 audit(1778865947.110:379): avc: denied { set_context_mgr } for pid=6713 comm="syz.2.221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 148.381804][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 148.420489][ T6714] binder_alloc: 6713: binder_alloc_buf, no vma [ 148.428964][ T29] audit: type=1400 audit(1778865947.270:380): avc: denied { map } for pid=6713 comm="syz.2.221" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 148.492675][ T29] audit: type=1400 audit(1778865947.270:381): avc: denied { call } for pid=6713 comm="syz.2.221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 148.516129][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.577532][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 148.601712][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.620192][ T9] usb 4-1: Product: syz [ 148.631824][ T9] usb 4-1: Manufacturer: syz [ 148.633582][ T29] audit: type=1400 audit(1778865947.270:382): avc: denied { transfer } for pid=6713 comm="syz.2.221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 148.700966][ T9] usb 4-1: SerialNumber: syz [ 148.728867][ T9] usb 4-1: config 0 descriptor?? [ 148.754840][ T6718] random: crng reseeded on system resumption [ 149.662714][ T9] appledisplay 4-1:0.0: Submitting URB failed [ 149.669569][ T9] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -5 [ 150.058207][ T42] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 150.299458][ T42] usb 3-1: Using ep0 maxpacket: 16 [ 150.501028][ T42] usb 3-1: config index 0 descriptor too short (expected 274, got 18) [ 150.519518][ T29] audit: type=1400 audit(1778865949.370:383): avc: denied { bind } for pid=6737 comm="syz.4.227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 150.544571][ T42] usb 3-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 150.558893][ T6738] FAULT_INJECTION: forcing a failure. [ 150.558893][ T6738] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 150.572555][ T6738] CPU: 1 UID: 0 PID: 6738 Comm: syz.1.226 Tainted: G L syzkaller #0 PREEMPT(full) [ 150.572584][ T6738] Tainted: [L]=SOFTLOCKUP [ 150.572590][ T6738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 150.572599][ T6738] Call Trace: [ 150.572605][ T6738] [ 150.572610][ T6738] dump_stack_lvl+0x100/0x190 [ 150.572637][ T6738] should_fail_ex.cold+0x5/0xa [ 150.572655][ T6738] ? prepare_alloc_pages+0x16d/0x5f0 [ 150.572675][ T6738] should_fail_alloc_page+0xeb/0x140 [ 150.572692][ T6738] prepare_alloc_pages+0x1f0/0x5f0 [ 150.572708][ T6738] ? debug_object_assert_init+0x1c4/0x300 [ 150.572736][ T6738] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 150.572759][ T6738] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 150.572782][ T6738] ? rcu_is_watching+0x12/0xc0 [ 150.572803][ T6738] ? trace_hrtimer_start+0x79/0x230 [ 150.572829][ T6738] ? hrtimer_start_range_ns+0x860/0x1a50 [ 150.572852][ T6738] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 150.572875][ T6738] ? mark_held_locks+0x40/0x70 [ 150.572892][ T6738] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 150.572913][ T6738] ? __lock_acquire+0x4a5/0x2630 [ 150.572930][ T6738] ? __mod_zone_page_state+0xe2/0x190 [ 150.572950][ T6738] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 150.572968][ T6738] ? policy_nodemask+0xed/0x4f0 [ 150.572985][ T6738] alloc_pages_mpol+0x1fb/0x540 [ 150.573000][ T6738] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 150.573021][ T6738] folio_alloc_mpol_noprof+0x36/0x260 [ 150.573040][ T6738] alloc_migration_target_by_mpol+0x2c1/0x650 [ 150.573060][ T6738] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 150.573078][ T6738] ? __pfx___might_resched+0x10/0x10 [ 150.573098][ T6738] ? debug_object_assert_init+0x1c4/0x300 [ 150.573121][ T6738] migrate_pages_batch+0x5dc/0x45c0 [ 150.573141][ T6738] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 150.573164][ T6738] ? hrtimer_start_range_ns+0x860/0x1a50 [ 150.573187][ T6738] ? __pfx_migrate_pages_batch+0x10/0x10 [ 150.573204][ T6738] ? mark_held_locks+0x40/0x70 [ 150.573221][ T6738] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 150.573235][ T6738] ? lockdep_hardirqs_on+0x78/0x100 [ 150.573255][ T6738] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 150.573270][ T6738] ? rcu_is_watching+0x12/0xc0 [ 150.573292][ T6738] ? trace_sched_exit_tp+0x11c/0x160 [ 150.573309][ T6738] ? __schedule+0x12a7/0x67a0 [ 150.573328][ T6738] migrate_pages_sync+0x12c/0x880 [ 150.573346][ T6738] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 150.573370][ T6738] ? __pfx_migrate_pages_sync+0x10/0x10 [ 150.573393][ T6738] ? irqentry_exit+0x24d/0x7e0 [ 150.573414][ T6738] migrate_pages+0x1aa5/0x2880 [ 150.573434][ T6738] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 150.573459][ T6738] ? __pfx_migrate_pages+0x10/0x10 [ 150.573477][ T6738] ? mas_next_slot+0x10a3/0x1960 [ 150.573499][ T6738] ? find_held_lock+0x2b/0x80 [ 150.573514][ T6738] ? do_mbind+0x555/0xfd0 [ 150.573535][ T6738] ? up_write+0x28c/0x4f0 [ 150.573558][ T6738] do_mbind+0x5a4/0xfd0 [ 150.573582][ T6738] ? __pfx_do_mbind+0x10/0x10 [ 150.573600][ T6738] ? hrtimer_bases_first+0x1a0/0x210 [ 150.573624][ T6738] ? sched_clock+0x38/0x60 [ 150.573647][ T6738] ? __pfx_get_nodes+0x10/0x10 [ 150.573660][ T6738] ? handle_softirqs+0x1ea/0xa00 [ 150.573688][ T6738] kernel_mbind+0x1b7/0x200 [ 150.573712][ T6738] ? __pfx_kernel_mbind+0x10/0x10 [ 150.573745][ T6738] ? rcu_is_watching+0x12/0xc0 [ 150.573775][ T6738] do_syscall_64+0x10b/0xf80 [ 150.573797][ T6738] ? clear_bhb_loop+0x40/0x90 [ 150.573818][ T6738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.573834][ T6738] RIP: 0033:0x7f1c3cf9ce59 [ 150.573849][ T6738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.573865][ T6738] RSP: 002b:00007f1c3de3b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 150.573882][ T6738] RAX: ffffffffffffffda RBX: 00007f1c3d216180 RCX: 00007f1c3cf9ce59 [ 150.573893][ T6738] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 0000200000000000 [ 150.573903][ T6738] RBP: 00007f1c3de3b090 R08: 0000000000000000 R09: 0000000000000002 [ 150.573913][ T6738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.573923][ T6738] R13: 00007f1c3d216218 R14: 00007f1c3d216180 R15: 00007ffe3df52db8 [ 150.573944][ T6738] [ 150.636103][ T29] audit: type=1400 audit(1778865949.420:384): avc: denied { create } for pid=6731 comm="syz.1.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 150.643122][ T42] usb 3-1: config 32 has 0 interfaces, different from the descriptor's value: 3 [ 150.666555][ T29] audit: type=1326 audit(1778865949.420:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6731 comm="syz.1.226" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c3cf9ce59 code=0x7fc00000 [ 150.872853][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 151.091516][ T42] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 151.105792][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.126239][ T42] usb 3-1: Product: syz [ 151.134633][ T42] usb 3-1: Manufacturer: syz [ 151.139281][ T42] usb 3-1: SerialNumber: syz [ 151.197607][ T29] audit: type=1400 audit(1778865949.440:386): avc: denied { write } for pid=6737 comm="syz.4.227" path="socket:[13063]" dev="sockfs" ino=13063 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 152.685822][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 152.685874][ T29] audit: type=1400 audit(1778865951.250:392): avc: denied { setopt } for pid=6741 comm="syz.4.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 152.831414][ T6749] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 153.776932][ T9] usb 4-1: USB disconnect, device number 8 [ 153.923054][ T5720] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 154.119919][ T5720] usb 2-1: config 1 has an invalid descriptor of length 132, skipping remainder of the config [ 154.137141][ T6762] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 154.215441][ T5720] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 154.296882][ T5720] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 154.362662][ T5720] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 154.429736][ T5720] usb 2-1: SerialNumber: syz [ 154.951081][ T5720] usb 2-1: can't set config #1, error -71 [ 155.014992][ T29] audit: type=1400 audit(1778865953.870:393): avc: denied { bind } for pid=6755 comm="syz.0.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 155.095109][ T5720] usb 2-1: USB disconnect, device number 7 [ 155.157096][ T5741] usb 3-1: USB disconnect, device number 6 [ 155.436610][ T6772] random: crng reseeded on system resumption [ 155.930845][ T6777] No such timeout policy "syz0" [ 156.249376][ T5741] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 156.487800][ T5741] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13961, setting to 64 [ 156.601346][ T5741] usb 4-1: New USB device found, idVendor=056a, idProduct=5000, bcdDevice= 0.00 [ 156.673099][ T5720] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 156.689673][ T5741] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.841037][ T5741] usb 4-1: config 0 descriptor?? [ 156.896426][ T5720] usb 1-1: Using ep0 maxpacket: 32 [ 156.927424][ T6777] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 157.001772][ T5720] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 157.120684][ T5720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.320969][ T5720] usb 1-1: config 0 descriptor?? [ 157.367967][ T5741] hid (null): unknown global tag 0xd [ 157.442411][ T5741] hid (null): unknown global tag 0xc [ 157.484006][ T5741] hid (null): invalid report_size 1668165699 [ 157.509746][ T5720] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 157.520481][ T5741] hid (null): unknown global tag 0xd [ 157.539600][ T6777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.548443][ T6777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.559934][ T5741] hid (null): unknown global tag 0xc [ 157.585743][ T5741] hid (null): unknown global tag 0xe [ 157.612656][ T5741] hid (null): report_id 0 is invalid [ 157.634821][ T5741] hid (null): report_id 38086 is invalid [ 157.650210][ T5741] hid (null): unknown global tag 0xca [ 157.666452][ T5741] hid (null): report_id 0 is invalid [ 157.681966][ T5741] hid (null): unknown global tag 0xc [ 157.699576][ T5741] hid (null): invalid report_count -868990611 [ 157.722075][ T5720] gspca_vc032x: reg_r err -32 [ 157.737304][ T5741] hid (null): report_id 0 is invalid [ 157.746610][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.764537][ T5741] hid (null): unknown global tag 0xc [ 157.775271][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.784059][ T5741] hid (null): unknown global tag 0xd [ 157.795639][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.815135][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.836932][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.844681][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.859072][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.872304][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.881971][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.894306][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.900741][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.913551][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.920343][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.931144][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.938406][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.945805][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.951101][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.971932][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 157.992920][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 157.998334][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 158.007640][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 158.014939][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 158.023927][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 158.036720][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 158.042409][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 158.055254][ T6786] netlink: 'syz.4.241': attribute type 10 has an invalid length. [ 158.065529][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 158.070940][ T5741] wacom 0003:056A:5000.0001: unknown main item tag 0x0 [ 158.079686][ T5720] gspca_vc032x: I2c Bus Busy Wait 00 [ 158.085958][ T6786] bridge0: port 2(bridge_slave_1) entered disabled state [ 158.093402][ T6786] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.102523][ T5741] wacom 0003:056A:5000.0001: unknown global tag 0xd [ 158.112632][ T5720] gspca_vc032x: Unknown sensor... [ 158.134707][ T5720] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 158.142540][ T5741] wacom 0003:056A:5000.0001: item 0 4 1 13 parsing failed [ 158.147066][ T6786] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.157587][ T6786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.167769][ T6786] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.175615][ T6786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.185575][ T5741] wacom 0003:056A:5000.0001: parse failed [ 159.808773][ T5741] wacom 0003:056A:5000.0001: probe with driver wacom failed with error -22 [ 160.369100][ T5741] usb 4-1: USB disconnect, device number 9 [ 160.496098][ T6786] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 160.522366][ T6792] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 160.551737][ T29] audit: type=1326 audit(1778865959.400:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6801 comm="syz.2.245" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7a9e99ce59 code=0x0 [ 160.581650][ T6792] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 160.712931][ T5741] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 160.863320][ T5741] usb 4-1: Using ep0 maxpacket: 16 [ 160.874401][ T5741] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.901969][ T5741] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 160.929250][ T5741] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 160.948466][ T5741] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 160.970097][ T5741] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 160.979928][ T5741] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.993206][ T5741] usb 4-1: Product: syz [ 160.999380][ T5741] usb 4-1: Manufacturer: syz [ 161.009487][ T5741] usb 4-1: SerialNumber: syz [ 161.023794][ T5741] usb 4-1: config 0 descriptor?? [ 161.043796][ T5741] appledisplay 4-1:0.0: Submitting URB failed [ 161.050662][ T5741] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -5 [ 161.193395][ T9] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 161.517352][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 161.556451][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 161.598026][ T5712] usb 1-1: USB disconnect, device number 9 [ 161.655419][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 161.730784][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.756621][ T6822] Driver unsupported XDP return value 0 on prog (id 31) dev N/A, expect packet loss! [ 161.879555][ T29] audit: type=1400 audit(1778865960.730:395): avc: denied { setopt } for pid=6825 comm="syz.2.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 161.938652][ T29] audit: type=1400 audit(1778865960.730:396): avc: denied { read } for pid=6825 comm="syz.2.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 161.990930][ T6814] netlink: 100 bytes leftover after parsing attributes in process `syz.4.247'. [ 162.228407][ T6833] netlink: 20 bytes leftover after parsing attributes in process `syz.2.249'. [ 162.963937][ T9] usb 5-1: usb_control_msg returned -32 [ 162.977272][ T9] usbtmc 5-1:16.0: can't read capabilities [ 163.445336][ T29] audit: type=1400 audit(1778865962.300:397): avc: denied { mount } for pid=6813 comm="syz.4.247" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 163.959293][ T42] usb 5-1: USB disconnect, device number 10 [ 164.060075][ T29] audit: type=1400 audit(1778865962.910:398): avc: denied { connect } for pid=6844 comm="syz.0.251" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 164.241982][ T5741] usb 4-1: USB disconnect, device number 10 [ 164.472847][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 164.590064][ T6851] FAULT_INJECTION: forcing a failure. [ 164.590064][ T6851] name failslab, interval 1, probability 0, space 0, times 0 [ 164.603172][ T6851] CPU: 1 UID: 0 PID: 6851 Comm: syz.0.253 Tainted: G L syzkaller #0 PREEMPT(full) [ 164.603199][ T6851] Tainted: [L]=SOFTLOCKUP [ 164.603206][ T6851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 164.603216][ T6851] Call Trace: [ 164.603221][ T6851] [ 164.603228][ T6851] dump_stack_lvl+0x100/0x190 [ 164.603255][ T6851] should_fail_ex.cold+0x5/0xa [ 164.603281][ T6851] should_failslab+0xc2/0x120 [ 164.603300][ T6851] __kvmalloc_node_noprof+0xfa/0xa00 [ 164.603327][ T6851] ? hashlimit_mt_check_common+0x822/0x12e0 [ 164.603361][ T6851] hashlimit_mt_check_common+0x822/0x12e0 [ 164.603394][ T6851] hashlimit_mt_check_v2+0x2fe/0x370 [ 164.603421][ T6851] ? __pfx_hashlimit_mt_check_v2+0x10/0x10 [ 164.603453][ T6851] ? xt_find_match+0x1dc/0x280 [ 164.603478][ T6851] ? __pfx_hashlimit_mt_check_v2+0x10/0x10 [ 164.603504][ T6851] xt_check_match+0x117/0x1c0 [ 164.603530][ T6851] find_check_entry.isra.0+0x323/0x990 [ 164.603563][ T6851] ? __pfx_find_check_entry.isra.0+0x10/0x10 [ 164.603598][ T6851] ? kasan_quarantine_put+0x104/0x240 [ 164.603624][ T6851] ? lockdep_hardirqs_on+0x78/0x100 [ 164.603650][ T6851] ? translate_table+0xa20/0x1630 [ 164.603680][ T6851] ? translate_table+0xaf2/0x1630 [ 164.603706][ T6851] ? kfree+0x223/0x6c0 [ 164.603727][ T6851] ? xt_check_table_hooks+0x206/0x330 [ 164.603753][ T6851] translate_table+0xbcd/0x1630 [ 164.603789][ T6851] ? __pfx_translate_table+0x10/0x10 [ 164.603822][ T6851] do_ipt_set_ctl+0x57c/0xb90 [ 164.603849][ T6851] ? find_held_lock+0x2b/0x80 [ 164.603870][ T6851] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 164.603897][ T6851] ? sockopt_release_sock+0x57/0x70 [ 164.603913][ T6851] ? __local_bh_enable_ip+0x9e/0x120 [ 164.603940][ T6851] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 164.603978][ T6851] ? nf_sockopt_find.isra.0+0x222/0x290 [ 164.604007][ T6851] nf_setsockopt+0x8d/0xf0 [ 164.604036][ T6851] ip_setsockopt+0xcb/0xf0 [ 164.604055][ T6851] tcp_setsockopt+0xa7/0x100 [ 164.604075][ T6851] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 164.604098][ T6851] do_sock_setsockopt+0xf3/0x1d0 [ 164.604121][ T6851] __sys_setsockopt+0x195/0x220 [ 164.604152][ T6851] __x64_sys_setsockopt+0xbd/0x160 [ 164.604178][ T6851] ? do_syscall_64+0x90/0xf80 [ 164.604201][ T6851] ? lockdep_hardirqs_on+0x78/0x100 [ 164.604225][ T6851] do_syscall_64+0x10b/0xf80 [ 164.604247][ T6851] ? clear_bhb_loop+0x40/0x90 [ 164.604269][ T6851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.604287][ T6851] RIP: 0033:0x7f0fa1f9ce59 [ 164.604302][ T6851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.604318][ T6851] RSP: 002b:00007f0fa2dc7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 164.604336][ T6851] RAX: ffffffffffffffda RBX: 00007f0fa2216180 RCX: 00007f0fa1f9ce59 [ 164.604347][ T6851] RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000005 [ 164.604357][ T6851] RBP: 00007f0fa2dc7090 R08: 0000000000000448 R09: 0000000000000000 [ 164.604367][ T6851] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000001 [ 164.604377][ T6851] R13: 00007f0fa2216218 R14: 00007f0fa2216180 R15: 00007ffc70ecfb78 [ 164.604401][ T6851] [ 165.021045][ T29] audit: type=1400 audit(1778865963.870:399): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 166.297694][ T5712] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 166.660373][ T5741] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 166.730183][ T29] audit: type=1400 audit(1778865965.580:400): avc: denied { write } for pid=6860 comm="syz.1.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 166.742926][ T5712] usb 4-1: Using ep0 maxpacket: 16 [ 166.758253][ T5712] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 166.770147][ T29] audit: type=1400 audit(1778865965.600:401): avc: denied { ioctl } for pid=6860 comm="syz.1.256" path="socket:[13199]" dev="sockfs" ino=13199 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 166.770189][ T29] audit: type=1400 audit(1778865965.600:402): avc: denied { setopt } for pid=6860 comm="syz.1.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 166.844381][ T5741] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13961, setting to 64 [ 166.887244][ T5741] usb 1-1: New USB device found, idVendor=056a, idProduct=5000, bcdDevice= 0.00 [ 166.893206][ T5712] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 166.910038][ T5741] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.933802][ T5712] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 166.954686][ T5712] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.955792][ T5741] usb 1-1: config 0 descriptor?? [ 166.974230][ T6849] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 166.984962][ T5712] usb 4-1: Product: syz [ 166.995830][ T5712] usb 4-1: Manufacturer: syz [ 167.013395][ T5712] usb 4-1: SerialNumber: syz [ 167.023590][ T5712] usb 4-1: config 0 descriptor?? [ 167.043488][ T5712] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 167.075574][ T5712] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 167.163848][ T42] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 167.343387][ T42] usb 2-1: Using ep0 maxpacket: 32 [ 167.354786][ T42] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 167.368957][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.384476][ T5741] hid (null): unknown global tag 0xd [ 167.490954][ T5741] hid (null): unknown global tag 0xc [ 167.584050][ T6849] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 167.592736][ T6849] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 167.729490][ T5712] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 167.738746][ T5712] em28xx 4-1:0.0: Config register raw data: 0x41 [ 167.775586][ T42] usb 2-1: config 0 descriptor?? [ 167.851642][ T5741] hid (null): invalid report_size 1668165699 [ 167.869508][ T42] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 167.880028][ T5741] hid (null): unknown global tag 0xd [ 167.885569][ T5741] hid (null): unknown global tag 0xc [ 167.891041][ T5741] hid (null): unknown global tag 0xe [ 167.896703][ T5741] hid (null): report_id 0 is invalid [ 167.902140][ T5741] hid (null): report_id 38086 is invalid [ 167.930684][ T5741] hid (null): unknown global tag 0xca [ 167.947510][ T5741] hid (null): report_id 0 is invalid [ 167.965825][ T5741] hid (null): unknown global tag 0xc [ 167.980808][ T5741] hid (null): invalid report_count -868990611 [ 167.999483][ T5741] hid (null): report_id 0 is invalid [ 168.014742][ T5741] hid (null): unknown global tag 0xc [ 168.026475][ T5741] hid (null): unknown global tag 0xd [ 168.043439][ T5741] hid_parser_main: 175 callbacks suppressed [ 168.043459][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.070120][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.082619][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.089689][ T42] gspca_vc032x: reg_r err -32 [ 168.094864][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.101735][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.107547][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.114499][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.119814][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.126722][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.132010][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.207294][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.214276][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.219619][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.230230][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.235617][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.242495][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.247871][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.253223][ T5741] wacom 0003:056A:5000.0002: unknown main item tag 0x0 [ 168.260114][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.266570][ T5741] wacom 0003:056A:5000.0002: unknown global tag 0xd [ 168.274971][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.280284][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.285636][ T5741] wacom 0003:056A:5000.0002: item 0 4 1 13 parsing failed [ 168.292782][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.298677][ T5741] wacom 0003:056A:5000.0002: parse failed [ 168.304458][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.311123][ T5741] wacom 0003:056A:5000.0002: probe with driver wacom failed with error -22 [ 168.319829][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.325321][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.333249][ T24] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 168.341990][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.350201][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.355562][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 168.360847][ T42] gspca_vc032x: Unknown sensor... [ 168.366153][ T42] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 168.383567][ T6885] netlink: 'syz.3.254': attribute type 11 has an invalid length. [ 168.398437][ T6885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.410101][ T6885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.492890][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 168.522872][ T5712] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 168.813987][ T9] usb 1-1: USB disconnect, device number 10 [ 168.861801][ T6885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 169.054586][ T5712] usb 3-1: unable to get BOS descriptor or descriptor too short [ 169.454562][ T5712] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 169.490559][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.572877][ T6885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 170.187834][ T5712] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 170.447828][ T5712] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.448504][ T24] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 170.468300][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.479285][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 170.492485][ T24] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 170.501751][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.509882][ T24] usb 5-1: Product: syz [ 170.510118][ T5712] usb 3-1: Product: syz [ 170.514138][ T24] usb 5-1: Manufacturer: syz [ 170.514165][ T24] usb 5-1: SerialNumber: syz [ 170.517775][ T24] usb 5-1: config 0 descriptor?? [ 170.537971][ T24] appledisplay 5-1:0.0: Submitting URB failed [ 170.539532][ T5712] usb 3-1: Manufacturer: syz [ 170.547510][ T24] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -5 [ 170.558054][ T29] audit: type=1400 audit(1778865969.410:403): avc: denied { ioctl } for pid=6889 comm="syz.0.266" path="socket:[13240]" dev="sockfs" ino=13240 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 170.566741][ T5742] usb 4-1: USB disconnect, device number 11 [ 170.625594][ T5712] usb 3-1: SerialNumber: syz [ 170.674521][ T5742] em28xx 4-1:0.0: Disconnecting em28xx [ 170.694858][ T5742] em28xx 4-1:0.0: Freeing device [ 170.862056][ T6894] netlink: 64 bytes leftover after parsing attributes in process `syz.3.267'. [ 170.933527][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 171.532994][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 171.621710][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 171.847881][ T9] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 171.862481][ T5712] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 171.886023][ T9] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 171.899518][ T5821] usb 2-1: USB disconnect, device number 8 [ 171.923497][ T5712] usb 3-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 171.951856][ T9] usb 1-1: Product: syz [ 171.967418][ T5712] usb 3-1: found format II with max.bitrate = 4, frame size=7372 [ 171.987164][ T9] usb 1-1: Manufacturer: syz [ 172.008514][ T9] usb 1-1: SerialNumber: syz [ 172.050120][ T9] usb 1-1: config 0 descriptor?? [ 172.079702][ T6890] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 172.221925][ T5712] usb 3-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 172.232644][ T5712] usb 3-1: found format II with max.bitrate = 4, frame size=7372 [ 172.403153][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 172.434893][ T5712] usb 3-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 172.558646][ T6908] xt_ecn: cannot match TCP bits for non-tcp packets [ 172.573021][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 172.591766][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 172.614629][ T9] usb 2-1: config 255 has an invalid interface number: 157 but max is 0 [ 172.624794][ T5712] usb 3-1: USB disconnect, device number 7 [ 172.638727][ T9] usb 2-1: config 255 has no interface number 0 [ 172.668680][ T9] usb 2-1: config 255 interface 157 altsetting 6 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 172.727274][ T9] usb 2-1: config 255 interface 157 has no altsetting 0 [ 172.768719][ T5619] udevd[5619]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 172.799288][ T9] usb 2-1: New USB device found, idVendor=2c7c, idProduct=0121, bcdDevice=83.3f [ 172.841621][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.866530][ T9] usb 2-1: Product: syz [ 172.884873][ T9] usb 2-1: Manufacturer: syz [ 172.901852][ T9] usb 2-1: SerialNumber: syz [ 173.164494][ T24] usb 5-1: USB disconnect, device number 11 [ 173.217541][ T9] option 2-1:255.157: GSM modem (1-port) converter detected [ 173.300512][ T9] usb 2-1: USB disconnect, device number 9 [ 173.349814][ T9] option 2-1:255.157: device disconnected [ 173.599287][ T9] usb 1-1: USB disconnect, device number 11 [ 173.852541][ T29] audit: type=1400 audit(1778865972.700:404): avc: denied { create } for pid=6922 comm="syz.4.274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 173.937638][ T29] audit: type=1400 audit(1778865972.700:405): avc: denied { ioctl } for pid=6922 comm="syz.4.274" path="socket:[13912]" dev="sockfs" ino=13912 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 174.091053][ T29] audit: type=1400 audit(1778865972.700:406): avc: denied { bind } for pid=6922 comm="syz.4.274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 174.611197][ T6936] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 174.740041][ T29] audit: type=1400 audit(1778865973.590:407): avc: denied { append } for pid=6938 comm="syz.1.279" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 174.772783][ T6939] 8021q: VLANs not supported on vcan0 [ 174.782745][ T6921] netlink: 2120 bytes leftover after parsing attributes in process `syz.0.273'. [ 174.794237][ T6939] netlink: 14 bytes leftover after parsing attributes in process `syz.1.279'. [ 174.845475][ T6941] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 174.905656][ T6939] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 175.049615][ T6939] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 175.103587][ T6939] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 175.174070][ T6939] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.181411][ T6939] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.241590][ T6939] bond0 (unregistering): Released all slaves [ 175.431933][ T6957] team0: No ports can be present during mode change [ 175.432092][ T6955] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 175.445363][ T6955] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 175.489726][ T6955] vhci_hcd vhci_hcd.0: Device attached [ 175.495971][ T29] audit: type=1400 audit(1778865974.350:408): avc: denied { write } for pid=6948 comm="syz.4.283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 176.022585][ T5742] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 176.079862][ T24] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 176.173189][ T9] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 176.193798][ T5742] usb 1-1: Using ep0 maxpacket: 16 [ 176.202187][ T5742] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 177.018392][ T5742] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 177.050683][ T24] usb 3-1: config 0 has no interfaces? [ 177.070364][ T5742] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 177.076800][ T24] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 177.308899][ T5742] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 177.347452][ T5742] usb 1-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 177.356992][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.359507][ T24] usb 3-1: config 0 descriptor?? [ 177.388562][ T5742] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.417786][ T5742] usb 1-1: Product: syz [ 177.428427][ T5742] usb 1-1: Manufacturer: syz [ 177.472613][ T5742] usb 1-1: SerialNumber: syz [ 177.499308][ T5742] usb 1-1: config 0 descriptor?? [ 177.522673][ T5742] appledisplay 1-1:0.0: Submitting URB failed [ 177.536571][ T5742] appledisplay 1-1:0.0: probe with driver appledisplay failed with error -5 [ 179.092444][ T6955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.128121][ T6955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.143813][ T5742] usb 1-1: USB disconnect, device number 12 [ 179.222352][ T6955] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 179.239587][ T6956] usbip_core: unknown command [ 179.256647][ T5821] usb 3-1: USB disconnect, device number 8 [ 179.265749][ T6956] vhci_hcd: unknown pdu 67108864 [ 179.291537][ T6956] usbip_core: unknown command [ 179.322611][ T79] vhci_hcd vhci_hcd.2: stop threads [ 179.335301][ T79] vhci_hcd vhci_hcd.2: release socket [ 179.367409][ T79] vhci_hcd vhci_hcd.2: disconnect device [ 179.654165][ T5742] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 179.844810][ T5742] usb 1-1: Using ep0 maxpacket: 16 [ 179.869355][ T5742] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 179.898699][ T5742] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 179.943983][ T5742] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 179.969251][ T5742] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.999729][ T5742] usb 1-1: Product: syz [ 180.009586][ T5742] usb 1-1: Manufacturer: syz [ 180.027792][ T5742] usb 1-1: SerialNumber: syz [ 180.055263][ T5742] usb 1-1: config 0 descriptor?? [ 180.074201][ T5742] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 180.098642][ T5742] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 180.233166][ T5820] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 180.372965][ T42] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 180.402965][ T5820] usb 3-1: Using ep0 maxpacket: 16 [ 180.412338][ T5820] usb 3-1: unable to get BOS descriptor or descriptor too short [ 180.427772][ T5820] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.440225][ T5820] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 180.469099][ T5820] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 180.497089][ T5820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.510522][ T5820] usb 3-1: Product: syz [ 180.519597][ T5820] usb 3-1: Manufacturer: syz [ 180.529239][ T5820] usb 3-1: SerialNumber: syz [ 180.533002][ T42] usb 5-1: Using ep0 maxpacket: 16 [ 180.565101][ T42] usb 5-1: unable to get BOS descriptor or descriptor too short [ 180.599153][ T42] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.622926][ T42] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 180.644534][ T42] usb 5-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 180.663915][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.678909][ T42] usb 5-1: Product: syz [ 180.687470][ T42] usb 5-1: Manufacturer: syz [ 180.697583][ T42] usb 5-1: SerialNumber: syz [ 180.703200][ T5742] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 180.712238][ T5742] em28xx 1-1:0.0: Config register raw data: 0x41 [ 180.770250][ T5820] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 180.781389][ T5820] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 180.883035][ T5821] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 181.063075][ T5821] usb 2-1: Using ep0 maxpacket: 16 [ 181.078898][ T5821] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 181.091544][ T5821] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 181.104091][ T5821] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.115572][ T5821] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.134179][ T5821] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 181.143653][ T5821] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.151971][ T5821] usb 2-1: Product: syz [ 181.156556][ T5821] usb 2-1: Manufacturer: syz [ 181.161696][ T5821] usb 2-1: SerialNumber: syz [ 181.166855][ T5820] usb 3-1: 2:1 : bogus bTerminalLink 6 [ 181.176192][ T5821] usb 2-1: config 0 descriptor?? [ 181.185781][ T5821] appledisplay 2-1:0.0: Submitting URB failed [ 181.192203][ T5821] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -5 [ 181.333009][ T24] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 181.343770][ T7015] netlink: 'syz.0.292': attribute type 11 has an invalid length. [ 181.356309][ T7015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.365080][ T7015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.578855][ T7015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.593076][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 181.604710][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.605337][ T7015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.616956][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 181.647059][ T24] usb 4-1: New USB device found, idVendor=041e, idProduct=30df, bcdDevice= 0.40 [ 181.662533][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.685648][ T24] usb 4-1: Product: syz [ 181.694264][ T24] usb 4-1: Manufacturer: syz [ 181.704562][ T24] usb 4-1: SerialNumber: syz [ 181.936172][ T7024] FAULT_INJECTION: forcing a failure. [ 181.936172][ T7024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 181.949827][ T7014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.960167][ T7014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.970211][ T7024] CPU: 1 UID: 0 PID: 7024 Comm: syz.4.305 Tainted: G L syzkaller #0 PREEMPT(full) [ 181.970240][ T7024] Tainted: [L]=SOFTLOCKUP [ 181.970247][ T7024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 181.970256][ T7024] Call Trace: [ 181.970262][ T7024] [ 181.970268][ T7024] dump_stack_lvl+0x100/0x190 [ 181.970294][ T7024] should_fail_ex.cold+0x5/0xa [ 181.970318][ T7024] _copy_from_iter+0x1f4/0x1690 [ 181.970348][ T7024] ? __pfx__copy_from_iter+0x10/0x10 [ 181.970371][ T7024] ? _parse_integer_limit+0x17f/0x1d0 [ 181.970393][ T7024] ? _kstrtoull+0x13c/0x1f0 [ 181.970410][ T7024] ? __pfx__kstrtoull+0x10/0x10 [ 181.970430][ T7024] tun_get_user+0x265/0x3c20 [ 181.970464][ T7024] ? __pfx_tun_get_user+0x10/0x10 [ 181.970487][ T7024] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 181.970515][ T7024] ? find_held_lock+0x2b/0x80 [ 181.970531][ T7024] ? tun_get+0x191/0x370 [ 181.970552][ T7024] ? tun_get+0x191/0x370 [ 181.970581][ T7024] tun_chr_write_iter+0xdc/0x200 [ 181.970606][ T7024] vfs_write+0x6ac/0x1070 [ 181.970626][ T7024] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 181.970651][ T7024] ? __pfx_vfs_write+0x10/0x10 [ 181.970668][ T7024] ? find_held_lock+0x2b/0x80 [ 181.970698][ T7024] ksys_write+0x12a/0x250 [ 181.970717][ T7024] ? __pfx_ksys_write+0x10/0x10 [ 181.970737][ T7024] ? rcu_is_watching+0x12/0xc0 [ 181.970765][ T7024] do_syscall_64+0x10b/0xf80 [ 181.970787][ T7024] ? clear_bhb_loop+0x40/0x90 [ 181.970808][ T7024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.970825][ T7024] RIP: 0033:0x7f8b66b9ce59 [ 181.970840][ T7024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.970857][ T7024] RSP: 002b:00007f8b6797e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 181.970876][ T7024] RAX: ffffffffffffffda RBX: 00007f8b66e15fa0 RCX: 00007f8b66b9ce59 [ 181.970888][ T7024] RDX: 000000000000004e RSI: 0000200000000280 RDI: 0000000000000004 [ 181.970898][ T7024] RBP: 00007f8b6797e090 R08: 0000000000000000 R09: 0000000000000000 [ 181.970908][ T7024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 181.970918][ T7024] R13: 00007f8b66e16038 R14: 00007f8b66e15fa0 R15: 00007ffdbb6ac778 [ 181.970941][ T7024] [ 182.263004][ T9] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 182.306642][ T42] usb 5-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 182.318654][ T5820] usb 3-1: USB disconnect, device number 9 [ 182.322944][ T42] usb 5-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 182.434326][ T24] usb 4-1: 0:1 : does not exist [ 182.439321][ T24] usb 4-1: unit 8 not found! [ 182.452258][ T42] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 182.481712][ T42] usb 5-1: USB disconnect, device number 12 [ 182.507506][ T5610] udevd[5610]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 182.537217][ T24] usb 4-1: USB disconnect, device number 12 [ 182.796057][ T5741] usb 1-1: USB disconnect, device number 13 [ 182.815325][ T5741] em28xx 1-1:0.0: Disconnecting em28xx [ 182.837320][ T5741] em28xx 1-1:0.0: Freeing device [ 183.092329][ T29] audit: type=1400 audit(1778865981.930:409): avc: denied { connect } for pid=7033 comm="syz.3.308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 183.121485][ T7035] IPv6: NLM_F_CREATE should be specified when creating new route [ 183.617713][ T29] audit: type=1400 audit(1778865982.100:410): avc: denied { accept } for pid=7033 comm="syz.3.308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 184.283017][ T5741] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 185.558122][ T5821] usb 2-1: USB disconnect, device number 10 [ 185.576374][ T5741] usb 1-1: Using ep0 maxpacket: 32 [ 185.618984][ T5741] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 185.639130][ T5741] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.672068][ T29] audit: type=1400 audit(1778865984.520:411): avc: denied { watch } for pid=7045 comm="syz.1.310" path="/65/file0" dev="tmpfs" ino=360 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 185.726520][ T29] audit: type=1400 audit(1778865984.520:412): avc: denied { watch watch_reads } for pid=7045 comm="syz.1.310" path="/65" dev="tmpfs" ino=355 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 185.942470][ T7053] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7053 comm=syz.1.310 [ 185.965237][ T7053] 9pnet_virtio: no channels available for device syz [ 186.112947][ T29] audit: type=1400 audit(1778865984.810:413): avc: denied { create } for pid=7045 comm="syz.1.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 186.828193][ T4928] Bluetooth: hci0: command 0x0406 tx timeout [ 186.839651][ T4928] Bluetooth: hci2: command 0x0406 tx timeout [ 186.844147][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 187.973435][ T5741] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 188.003129][ T7051] random: crng reseeded on system resumption [ 189.031535][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 189.065053][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.670875][ T5741] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 190.386862][ T29] audit: type=1400 audit(1778865989.240:414): avc: denied { firmware_load } for pid=5741 comm="kworker/1:7" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 190.407359][ T5741] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 190.964878][ T7069] netlink: 12 bytes leftover after parsing attributes in process `syz.0.315'. [ 191.043081][ T5807] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 191.213252][ T5807] usb 3-1: Using ep0 maxpacket: 32 [ 191.241726][ T5807] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 191.271551][ T5807] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.629640][ T5807] usb 3-1: config 0 descriptor?? [ 192.668778][ T5807] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 192.892457][ T5807] gspca_vc032x: reg_r err -32 [ 192.908587][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 192.933058][ T42] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 192.944574][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 192.962154][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 192.972620][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.014942][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.029569][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.038295][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.052085][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.060934][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.066550][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.072079][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.077628][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.080109][ T7077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.320'. [ 193.083225][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.092964][ T7077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.320'. [ 193.099864][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.112080][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.120359][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.126458][ T42] usb 5-1: Using ep0 maxpacket: 32 [ 193.132012][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.137634][ T29] audit: type=1400 audit(1778865991.990:415): avc: denied { create } for pid=7076 comm="syz.3.320" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 193.161121][ T5807] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.167480][ T42] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 193.182912][ T5807] gspca_vc032x: Unknown sensor... [ 193.187986][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.198322][ T5807] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 193.213545][ T29] audit: type=1400 audit(1778865991.990:416): avc: denied { write } for pid=7076 comm="syz.3.320" name="file0" dev="tmpfs" ino=302 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 193.238673][ T29] audit: type=1400 audit(1778865991.990:417): avc: denied { open } for pid=7076 comm="syz.3.320" path="/54/file0" dev="tmpfs" ino=302 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 193.239883][ T42] usb 5-1: config 0 descriptor?? [ 193.278067][ T29] audit: type=1400 audit(1778865992.020:418): avc: denied { unlink } for pid=5615 comm="syz-executor" name="file0" dev="tmpfs" ino=302 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 193.303500][ T5622] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 193.313560][ T42] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 193.462886][ T5622] usb 2-1: Using ep0 maxpacket: 16 [ 193.534583][ T5622] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.545382][ T5622] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 193.557422][ T42] gspca_vc032x: reg_r err -32 [ 193.563142][ T5622] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.574158][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.579823][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.585344][ T5622] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.595228][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.600849][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.606640][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.612198][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.618491][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.624403][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.630008][ T5622] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 193.639164][ T5622] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.647709][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.653202][ T5622] usb 2-1: Product: syz [ 193.657469][ T5622] usb 2-1: Manufacturer: syz [ 193.662109][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 193.668798][ T5622] usb 2-1: SerialNumber: syz [ 193.673476][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.134103][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.544610][ T5622] usb 2-1: config 0 descriptor?? [ 195.561400][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.573153][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.579757][ T5622] appledisplay 2-1:0.0: Submitting URB failed [ 195.587925][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.596978][ T5622] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -5 [ 195.606255][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.616829][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.622207][ T42] gspca_vc032x: I2c Bus Busy Wait 00 [ 195.629325][ T42] gspca_vc032x: Unknown sensor... [ 195.634485][ T42] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 195.687055][ T5821] usb 5-1: USB disconnect, device number 13 [ 195.752317][ T42] usb 3-1: USB disconnect, device number 10 [ 198.165427][ T5622] usb 2-1: USB disconnect, device number 11 [ 199.116633][ T29] audit: type=1400 audit(1778865997.890:419): avc: denied { read } for pid=7123 comm="syz.0.331" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 199.657227][ T7131] capability: warning: `syz.1.332' uses 32-bit capabilities (legacy support in use) [ 304.712782][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 304.719763][ C1] rcu: 0-...!: (0 ticks this GP) idle=53c4/1/0x4000000000000000 softirq=24646/24646 fqs=1 [ 304.730409][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P7107/1:b..l [ 304.738312][ C1] rcu: (detected by 1, t=10502 jiffies, g=23153, q=484 ncpus=2) [ 304.746020][ C1] Sending NMI from CPU 1 to CPUs 0: [ 304.746046][ C0] NMI backtrace for cpu 0 [ 304.746062][ C0] CPU: 0 UID: 0 PID: 5821 Comm: kworker/0:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 304.746082][ C0] Tainted: [L]=SOFTLOCKUP [ 304.746086][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 304.746097][ C0] Workqueue: events_power_efficient gc_worker [ 304.746115][ C0] RIP: 0010:__lock_acquire+0x201/0x2630 [ 304.746134][ C0] Code: 00 48 0f a3 05 00 6e 2d 14 0f 83 c1 05 00 00 48 8d 04 80 48 8d 04 80 48 8d 04 c5 60 cb 11 96 0f b6 90 c4 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 d0 6d 2d 14 0f 83 b6 05 00 00 48 [ 304.746147][ C0] RSP: 0000:ffffc90000007d30 EFLAGS: 00000003 [ 304.746157][ C0] RAX: 0000000000004070 RBX: ffff888029ab5608 RCX: 0000000000000003 [ 304.746166][ C0] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff8880b84284d8 [ 304.746174][ C0] RBP: ffff888029ab4a00 R08: 0000000000000001 R09: 0000000000080000 [ 304.746183][ C0] R10: ffff8880b84284d8 R11: 0000000000000001 R12: 0000000000000000 [ 304.746191][ C0] R13: 0000000000000070 R14: 0000000000000000 R15: 0000000000000000 [ 304.746199][ C0] FS: 0000000000000000(0000) GS:ffff888124370000(0000) knlGS:0000000000000000 [ 304.746213][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 304.746222][ C0] CR2: 00007f7a9ebec4b8 CR3: 000000005e71d000 CR4: 00000000003526f0 [ 304.746231][ C0] Call Trace: [ 304.746236][ C0] [ 304.746243][ C0] ? find_held_lock+0x2b/0x80 [ 304.746257][ C0] ? advance_sched+0x76b/0xd20 [ 304.746277][ C0] ? advance_sched+0x76b/0xd20 [ 304.746297][ C0] lock_acquire+0x1b1/0x370 [ 304.746312][ C0] ? __hrtimer_run_queues+0x1bd/0xa00 [ 304.746335][ C0] _raw_spin_lock_irq+0x36/0x50 [ 304.746352][ C0] ? __hrtimer_run_queues+0x1bd/0xa00 [ 304.746370][ C0] __hrtimer_run_queues+0x1bd/0xa00 [ 304.746392][ C0] hrtimer_interrupt+0x3e5/0x940 [ 304.746409][ C0] __sysvec_apic_timer_interrupt+0x10b/0x460 [ 304.746430][ C0] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 304.746447][ C0] [ 304.746451][ C0] [ 304.746456][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 304.746471][ C0] RIP: 0010:lock_acquire+0x5e/0x370 [ 304.746487][ C0] Code: 05 3b 82 26 12 83 f8 07 0f 87 d9 02 00 00 48 0f a3 05 46 43 f3 0e 0f 82 a4 02 00 00 8b 35 ce 76 f3 0e 85 f6 0f 85 bf 00 00 00 <48> 8b 44 24 30 65 48 2b 05 dd 81 26 12 0f 85 ed 02 00 00 48 83 c4 [ 304.746499][ C0] RSP: 0000:ffffc90004c3fac8 EFLAGS: 00000206 [ 304.746509][ C0] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000002 [ 304.746517][ C0] RDX: 0000000000000000 RSI: ffffffff8defc944 RDI: ffffffff8c1c3800 [ 304.746526][ C0] RBP: ffffffff8e7e57a0 R08: 00000000ae191b69 R09: 0000000000000007 [ 304.746534][ C0] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 [ 304.746542][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 304.746555][ C0] ? __pfx___might_resched+0x10/0x10 [ 304.746579][ C0] ? gc_worker+0x949/0x1630 [ 304.746591][ C0] gc_worker+0x222/0x1630 [ 304.746602][ C0] ? gc_worker+0x211/0x1630 [ 304.746616][ C0] ? __pfx_gc_worker+0x10/0x10 [ 304.746628][ C0] ? rcu_is_watching+0x12/0xc0 [ 304.746650][ C0] process_one_work+0xa0e/0x1980 [ 304.746671][ C0] ? __pfx_process_one_work+0x10/0x10 [ 304.746690][ C0] ? __pfx_gc_worker+0x10/0x10 [ 304.746702][ C0] worker_thread+0x5ef/0xe50 [ 304.746721][ C0] ? __pfx_worker_thread+0x10/0x10 [ 304.746738][ C0] ? kthread+0x13a/0x450 [ 304.746753][ C0] ? __pfx_worker_thread+0x10/0x10 [ 304.746769][ C0] kthread+0x370/0x450 [ 304.746783][ C0] ? __pfx_kthread+0x10/0x10 [ 304.746799][ C0] ret_from_fork+0x72b/0xd50 [ 304.746816][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 304.746833][ C0] ? __switch_to+0x800/0x1100 [ 304.746853][ C0] ? __pfx_kthread+0x10/0x10 [ 304.746868][ C0] ret_from_fork_asm+0x1a/0x30 [ 304.746892][ C0] [ 304.747039][ C1] task:syz.3.324 state:R running task stack:23592 pid:7107 tgid:7107 ppid:7101 task_flags:0x400640 flags:0x00080000 [ 305.136599][ C1] Call Trace: [ 305.139865][ C1] [ 305.142786][ C1] __schedule+0x1295/0x67a0 [ 305.147301][ C1] ? __pfx___schedule+0x10/0x10 [ 305.152164][ C1] ? mark_held_locks+0x40/0x70 [ 305.156925][ C1] preempt_schedule_irq+0x50/0x90 [ 305.161957][ C1] irqentry_exit+0x205/0x7e0 [ 305.166547][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 305.172515][ C1] RIP: 0010:unwind_next_frame+0xd46/0x2090 [ 305.178317][ C1] Code: 03 4c 8b 44 24 18 80 3c 16 00 0f 85 b2 0f 00 00 48 8b 14 24 49 89 45 48 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 <0f> 85 e8 0d 00 00 4c 89 e2 4d 89 75 38 48 b8 00 00 00 00 00 fc ff [ 305.197911][ C1] RSP: 0000:ffffc90003b16378 EFLAGS: 00000246 [ 305.203962][ C1] RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff9182dda2 [ 305.211921][ C1] RDX: 1ffff92000762c84 RSI: 1ffff92000762c86 RDI: ffffc90003b16e70 [ 305.219877][ C1] RBP: ffffc90003b16430 R08: ffffffff9182dda6 R09: 0000000000000007 [ 305.227834][ C1] R10: 0000000000000200 R11: 00000000000151b5 R12: ffffc90003b16438 [ 305.235791][ C1] R13: ffffc90003b163e8 R14: ffffc90003b16e78 R15: ffffc90003b1641c [ 305.243761][ C1] ? unwind_next_frame+0xd07/0x2090 [ 305.248955][ C1] ? shmem_write_begin+0x1a4/0x420 [ 305.254064][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 305.260209][ C1] arch_stack_walk+0x94/0xf0 [ 305.264799][ C1] ? generic_perform_write+0x292/0xa40 [ 305.270254][ C1] stack_trace_save+0x8e/0xc0 [ 305.274920][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 305.280291][ C1] save_stack+0x162/0x1e0 [ 305.284608][ C1] ? __pfx_save_stack+0x10/0x10 [ 305.289458][ C1] ? post_alloc_hook+0x153/0x170 [ 305.294406][ C1] ? get_page_from_freelist+0x11a6/0x33b0 [ 305.300132][ C1] ? __alloc_frozen_pages_noprof+0x27c/0x2bc0 [ 305.306205][ C1] ? alloc_pages_mpol+0x1fb/0x540 [ 305.311220][ C1] ? folio_alloc_mpol_noprof+0x36/0x260 [ 305.316757][ C1] ? shmem_alloc_folio+0x135/0x160 [ 305.321861][ C1] ? shmem_alloc_and_add_folio+0x371/0xd40 [ 305.327661][ C1] ? shmem_get_folio_gfp+0x6ab/0x1900 [ 305.333030][ C1] ? shmem_write_begin+0x1a4/0x420 [ 305.338135][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.343070][ C1] __set_page_owner+0x8c/0x540 [ 305.347832][ C1] ? __pfx___set_page_owner+0x10/0x10 [ 305.353192][ C1] ? bad_range+0x257/0x3f0 [ 305.357598][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 305.362799][ C1] post_alloc_hook+0x153/0x170 [ 305.367559][ C1] get_page_from_freelist+0x11a6/0x33b0 [ 305.373104][ C1] ? __pfx___might_resched+0x10/0x10 [ 305.378396][ C1] __alloc_frozen_pages_noprof+0x27c/0x2bc0 [ 305.384289][ C1] ? clockevents_program_event+0x111/0x820 [ 305.390095][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.395024][ C1] ? __pfx_clockevents_program_event+0x10/0x10 [ 305.401177][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.406108][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 305.412436][ C1] ? do_raw_spin_lock+0x128/0x260 [ 305.417457][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 305.422825][ C1] ? find_held_lock+0x2b/0x80 [ 305.427499][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.432429][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 305.438315][ C1] ? policy_nodemask+0xed/0x4f0 [ 305.443158][ C1] alloc_pages_mpol+0x1fb/0x540 [ 305.448001][ C1] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 305.453361][ C1] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 305.459249][ C1] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 305.465160][ C1] folio_alloc_mpol_noprof+0x36/0x260 [ 305.470528][ C1] shmem_alloc_folio+0x135/0x160 [ 305.475463][ C1] shmem_alloc_and_add_folio+0x371/0xd40 [ 305.481099][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 305.487253][ C1] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 305.493238][ C1] shmem_get_folio_gfp+0x6ab/0x1900 [ 305.498441][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 305.504076][ C1] shmem_write_begin+0x1a4/0x420 [ 305.509020][ C1] ? __pfx_shmem_write_begin+0x10/0x10 [ 305.514470][ C1] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 305.521312][ C1] generic_perform_write+0x292/0xa40 [ 305.526598][ C1] ? __pfx_generic_perform_write+0x10/0x10 [ 305.532402][ C1] ? file_update_time_flags+0x373/0x500 [ 305.537948][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 305.543745][ C1] shmem_file_write_iter+0x10e/0x140 [ 305.549019][ C1] __kernel_write_iter+0x2ac/0x920 [ 305.554123][ C1] ? __pfx___kernel_write_iter+0x10/0x10 [ 305.559742][ C1] ? cgroup1_freezing+0x12c/0x3b0 [ 305.564761][ C1] ? cgroup1_freezing+0x136/0x3b0 [ 305.569773][ C1] ? freezing_slow_path+0xb5/0x1a0 [ 305.574876][ C1] dump_user_range+0x3f9/0xad0 [ 305.579634][ C1] ? __pfx_dump_user_range+0x10/0x10 [ 305.584914][ C1] ? __pfx_writenote+0x10/0x10 [ 305.589668][ C1] ? elf_core_dump+0x277d/0x3d10 [ 305.594597][ C1] elf_core_dump+0x2d5f/0x3d10 [ 305.599381][ C1] ? __pfx_elf_core_dump+0x10/0x10 [ 305.604513][ C1] ? 0xffffffffff600000 [ 305.608664][ C1] ? __pfx___schedule+0x10/0x10 [ 305.613519][ C1] ? irqentry_exit+0x24d/0x7e0 [ 305.618309][ C1] ? vfs_coredump+0x29a0/0x5770 [ 305.623149][ C1] vfs_coredump+0x29a0/0x5770 [ 305.627823][ C1] ? __pfx_vfs_coredump+0x10/0x10 [ 305.632836][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.637777][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.642718][ C1] ? do_raw_spin_lock+0x128/0x260 [ 305.647746][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 305.653547][ C1] ? debug_object_assert_init+0x1c4/0x300 [ 305.659266][ C1] ? do_raw_spin_lock+0x128/0x260 [ 305.664315][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 305.669716][ C1] ? __lock_acquire+0x4a5/0x2630 [ 305.674657][ C1] ? rcu_is_watching+0x12/0xc0 [ 305.679428][ C1] ? trace_hrtimer_start+0x79/0x230 [ 305.684631][ C1] ? hrtimer_start_range_ns+0x860/0x1a50 [ 305.690284][ C1] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 305.696169][ C1] ? finish_task_switch.isra.0+0x384/0x1010 [ 305.702055][ C1] ? rcu_is_watching+0x12/0xc0 [ 305.706817][ C1] ? trace_sched_exit_tp+0x11c/0x160 [ 305.712095][ C1] ? __schedule+0x12a7/0x67a0 [ 305.716777][ C1] ? rcu_is_watching+0x12/0xc0 [ 305.721539][ C1] ? __pfx___schedule+0x10/0x10 [ 305.726397][ C1] ? trace_reschedule_exit.constprop.0+0x6b/0x220 [ 305.732804][ C1] ? proc_coredump_connector+0x2d3/0x4f0 [ 305.738431][ C1] ? __pfx_proc_coredump_connector+0x10/0x10 [ 305.744416][ C1] get_signal+0x2162/0x2210 [ 305.748926][ C1] ? __pfx_get_signal+0x10/0x10 [ 305.753772][ C1] ? __pfx_force_sig_fault+0x10/0x10 [ 305.759060][ C1] arch_do_signal_or_restart+0x91/0x7e0 [ 305.764608][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 305.770770][ C1] ? rcu_is_watching+0x12/0xc0 [ 305.775534][ C1] irqentry_exit+0x410/0x7e0 [ 305.780124][ C1] asm_exc_page_fault+0x26/0x30 [ 305.784965][ C1] RIP: 0033:0x7f91ad19ce61 [ 305.789366][ C1] RSP: 002b:000000000000ff30 EFLAGS: 00010217 [ 305.795419][ C1] RAX: 0000000000000000 RBX: 00007f91ad416090 RCX: 00007f91ad19ce59 [ 305.803376][ C1] RDX: 0000000000000000 RSI: 000000000000ff30 RDI: 0000000000002000 [ 305.811334][ C1] RBP: 00007f91ad232d6f R08: 0000000000000000 R09: 0000000000000000 [ 305.819291][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 305.827248][ C1] R13: 00007f91ad416128 R14: 00007f91ad416090 R15: 00007ffd608b03e8 [ 305.835222][ C1] [ 305.838228][ C1] rcu: rcu_preempt kthread starved for 10495 jiffies! g23153 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 305.849407][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 305.859359][ C1] rcu: RCU grace-period kthread stack dump: [ 305.865234][ C1] task:rcu_preempt state:R running task stack:27752 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 305.878800][ C1] Call Trace: [ 305.882065][ C1] [ 305.885003][ C1] __schedule+0x1295/0x67a0 [ 305.889516][ C1] ? __pfx___schedule+0x10/0x10 [ 305.894357][ C1] ? find_held_lock+0x2b/0x80 [ 305.899022][ C1] ? schedule+0x2bf/0x390 [ 305.903348][ C1] schedule+0xdd/0x390 [ 305.907409][ C1] schedule_timeout+0x127/0x280 [ 305.912251][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 305.917614][ C1] ? __pfx_process_timeout+0x10/0x10 [ 305.922891][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 305.928690][ C1] ? prepare_to_swait_event+0xdf/0x4a0 [ 305.934147][ C1] rcu_gp_fqs_loop+0x1a9/0x900 [ 305.938908][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 305.944190][ C1] ? prepare_to_swait_event+0xae/0x4a0 [ 305.949644][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 305.954578][ C1] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 305.959767][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 305.965567][ C1] rcu_gp_kthread+0x179/0x230 [ 305.970236][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 305.975423][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 305.981223][ C1] ? __kthread_parkme+0x18c/0x230 [ 305.986239][ C1] ? kthread+0x13a/0x450 [ 305.990473][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 305.995661][ C1] kthread+0x370/0x450 [ 305.999721][ C1] ? __pfx_kthread+0x10/0x10 [ 306.004303][ C1] ret_from_fork+0x72b/0xd50 [ 306.008887][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 306.013994][ C1] ? __switch_to+0x800/0x1100 [ 306.018675][ C1] ? __pfx_kthread+0x10/0x10 [ 306.023257][ C1] ret_from_fork_asm+0x1a/0x30 [ 306.028031][ C1] [ 306.031035][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 306.037346][ C1] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 306.048183][ C1] Tainted: [L]=SOFTLOCKUP [ 306.052493][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 306.062533][ C1] Workqueue: events_unbound toggle_allocation_gate [ 306.069029][ C1] RIP: 0010:smp_call_function_many_cond+0x58e/0x1700 [ 306.075694][ C1] Code: 00 fc ff df 48 8b 54 24 08 49 89 d5 49 89 d4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 39 83 0c 00 f3 90 41 0f b6 45 00 <41> 38 c4 7c 08 84 c0 0f 85 63 0f 00 00 8b 45 08 31 ff 83 e0 01 41 [ 306.095287][ C1] RSP: 0018:ffffc90000127870 EFLAGS: 00000293 [ 306.101340][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81fc1bcd [ 306.109301][ C1] RDX: ffff88801e2b8000 RSI: ffffffff81fc1ba7 RDI: ffff88801e2b8000 [ 306.117259][ C1] RBP: ffff8880b8443320 R08: 0000000000000005 R09: 0000000000000000 [ 306.125215][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 [ 306.133172][ C1] R13: ffffed1017088665 R14: 0000000000000001 R15: ffff8880b853c5c0 [ 306.141134][ C1] FS: 0000000000000000(0000) GS:ffff888124470000(0000) knlGS:0000000000000000 [ 306.150053][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 306.156624][ C1] CR2: 00007f1c3d340300 CR3: 000000000e596000 CR4: 00000000003526f0 [ 306.164584][ C1] Call Trace: [ 306.167849][ C1] [ 306.170772][ C1] ? __pfx_do_sync_core+0x10/0x10 [ 306.175797][ C1] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 306.182116][ C1] ? __pfx_text_poke_memcpy+0x10/0x10 [ 306.187488][ C1] ? __pfx___text_poke+0x10/0x10 [ 306.192419][ C1] ? __pfx_do_sync_core+0x10/0x10 [ 306.197440][ C1] on_each_cpu_cond_mask+0x40/0x90 [ 306.202543][ C1] ? kmem_cache_alloc_from_sheaf_noprof+0x39/0x190 [ 306.209033][ C1] smp_text_poke_batch_finish+0x337/0xc60 [ 306.214745][ C1] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 306.220978][ C1] ? arch_jump_label_transform_queue+0xc0/0x120 [ 306.227207][ C1] ? find_held_lock+0x2b/0x80 [ 306.231878][ C1] arch_jump_label_transform_apply+0x1c/0x30 [ 306.237845][ C1] jump_label_update+0x37a/0x550 [ 306.242778][ C1] static_key_enable_cpuslocked+0x1bc/0x270 [ 306.248663][ C1] static_key_enable+0x1a/0x20 [ 306.253416][ C1] toggle_allocation_gate+0xfe/0x2d0 [ 306.258692][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 306.264579][ C1] ? rcu_is_watching+0x12/0xc0 [ 306.269345][ C1] process_one_work+0xa0e/0x1980 [ 306.274289][ C1] ? __pfx_process_one_work+0x10/0x10 [ 306.279661][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 306.285543][ C1] worker_thread+0x5ef/0xe50 [ 306.290134][ C1] ? kthread+0x13a/0x450 [ 306.294366][ C1] ? __pfx_worker_thread+0x10/0x10 [ 306.299469][ C1] kthread+0x370/0x450 [ 306.303538][ C1] ? __pfx_kthread+0x10/0x10 [ 306.308135][ C1] ret_from_fork+0x72b/0xd50 [ 306.312730][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 306.317845][ C1] ? __switch_to+0x800/0x1100 [ 306.322528][ C1] ? __pfx_kthread+0x10/0x10 [ 306.327114][ C1] ret_from_fork_asm+0x1a/0x30 [ 306.331891][ C1]