last executing test programs: 20m23.276091835s ago: executing program 1 (id=1964): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0xfffffffffffffffc, &(0x7f00000005c0)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) unshare(0x2c020400) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r2, r1}}, 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000280)={@remote}, 0x14) close(r3) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000000)=0x1, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r6, &(0x7f0000002a80)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r8, 0x0, r9, 0x0, 0xf3a, 0x0) write$cgroup_pid(r9, &(0x7f0000000000), 0xffffff98) splice(r5, 0x0, r9, 0x0, 0x80, 0x6) write$vhost_msg_v2(r9, &(0x7f0000000200)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) write(r7, 0x0, 0x0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r11 = memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) mmap(&(0x7f00001d1000/0x3000)=nil, 0x3000, 0x6, 0x12, r11, 0x6a360000) read$FUSE(r10, &(0x7f0000000640)={0x2020}, 0x2020) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002140)={0x2020}, 0x2020) syz_fuse_handle_req(r0, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9474a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x90, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x3, {0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x800}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000180)={0x4, &(0x7f0000000080)=[{0xf3, 0x0, 0x8, 0x23}, {0x400, 0x7f, 0xf, 0x1}, {0x6, 0x7e, 0xc}, {0x7405, 0x0, 0x6, 0x9}]}, 0x10) 20m21.583859948s ago: executing program 1 (id=1968): syz_usb_connect(0x0, 0x24, &(0x7f0000006140)={{0x12, 0x1, 0x201, 0x38, 0xb7, 0x21, 0x20, 0x733, 0x430, 0x5726, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x2, 0x90, 0x3a, [{{0x9, 0x4, 0x1, 0x7, 0x0, 0x44, 0xe4, 0x90, 0x73}}]}}]}}, &(0x7f00000064c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mount$9p_virtio(0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x20000480) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0x3) io_submit(0x0, 0x1, &(0x7f0000000480)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x5, r5, 0x0, 0x0, 0x7}]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x338, 0x1d0, 0x43, 0xa0, 0x1d0, 0x98, 0x2a0, 0x178, 0x178, 0x2a0, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x62666fe4d74687b2, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x398) ioctl$KVM_RUN(r3, 0xae80, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='thermal_power_allocator\x00'}, 0x18) 20m18.510731961s ago: executing program 1 (id=1979): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x4, 0xdd, 0xa}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000001340)=@base={0xb, 0x8, 0x2, 0x9, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0ffffff7a0af0ff001f000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db76cf059f40fa2640b6bfb74dd35391b8fa18479da9f4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847db97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ccfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000000000000000000003ba34b611569a451564d3a5400f9097ffe7a37e765be352be71ee24250d6828562c7e24cb763062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89a0000bde05c114e7a020fc1a5fd3eeeb822008b2d7d1cc062b51b0aca4956b557e51a1385cc572b0074b0950fb1437de2590bf99ec7ceb69e1fe2465fce099c992d57b804a22e148ae3411523814aee03ee2df877edfabf4aa94f07c6fdd127e57a8bf7975f2e606c25a299980a6e52fcf7849d45bb38573fbba8afef1aa7a24c805f7aee3e39a3000000000000000000000000000000000000878f88c4742ac490951c36c610a0d266588ec6a0bd300cf160b5a5d9e9fafa49ecc8430832d795e727b7fc2b76e7fc4141fdbb82f45d3cdd3fb8d4b443ab4954fdf5c1b9a6ab3e457f098329307ccb0a1989b6c37509692e952e7244f48bc12569ff8eb30d0f887b85b5ef44fb9a7571319190be0c226ed72f346cc4aa071ae0c72fa8bd00d5590c4f4ba65d0c8e1f4870fe3c414681e41b40163eb1aa2a7429a2208cd6e69c7d959e87da3fd0101159a03ab7fe78881ee7a1ee7a2edff75fb18a181e0c54352be2b7a5b5273198291c28d9141deeb3cdba5d414ae4b0000000000000000000000000009eacd83458d8a606be71970497a4fd4ca3b48ca482ab3804e2fac216b3ba613608b1a465456a33fd08491d337d7344c01cfc9e73"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) 20m18.282994968s ago: executing program 1 (id=1981): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x50, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x403, 0x0, 0x2, {}, [@IFLA_EVENT={0x8, 0x2c, 0xffffff40}, @IFLA_BROADCAST={0xa, 0x2, @multicast}, @IFLA_OPERSTATE={0x0, 0x10, 0xd}]}, 0x48}, 0x1, 0x0, 0x0, 0x600}, 0x0) 20m18.192041371s ago: executing program 1 (id=1983): r0 = add_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x2901090, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/raw6\x00') openat(r1, &(0x7f0000000180)='./file1\x00', 0x21000, 0x10) pivot_root(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0\x00') syz_open_dev$ttys(0xc, 0x2, 0x0) keyctl$revoke(0x3, r0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000009fb6627e64eead570000000000"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) keyctl$read(0xb, r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r8 = getpid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r7, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, r8, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r7, 0xc1105518, &(0x7f0000000c40)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x80000, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, 0x0, 0x7, 0x7ff, 0xfffffffe, 0x0, 0x40, 0x0, 0x0, 0x100000001, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0x200, 0x0, 0xfffffffffffffffd, 0x108000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x4, 0x0, 0x0, 0x2000000000040, 0xfffffffffffffffc, 0x0, 0x0, 0x3, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x400000000000, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x80000000000000, 0x0, 0x1, 0x8, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xde4, 0x7, 0x0, 0x100000000]}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, 0x0, 0x0, 0xa, 0x0) 20m17.587877588s ago: executing program 1 (id=1984): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0x61, 0x0, 0x0, 0x9c4}, @initr0, @exit={0x95, 0x0, 0x0, 0xc0ff}, @printk={@x={0x18, 0x0}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x9e}}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x4}, 0x94) 20m2.133010952s ago: executing program 32 (id=1984): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0x61, 0x0, 0x0, 0x9c4}, @initr0, @exit={0x95, 0x0, 0x0, 0xc0ff}, @printk={@x={0x18, 0x0}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x9e}}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x4}, 0x94) 1m58.681412965s ago: executing program 2 (id=5683): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000d647425ec357e7ee00bf0900050000000055090100000000009500000000000000bf91000000000000b7090000000004008500000085000000b70000003f00000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m57.768513673s ago: executing program 2 (id=5686): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x388, 0xffffffff, 0x0, 0x1e8, 0xd0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @empty, [], [], 'macsec0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x1, 0x46}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@private0, @empty, [], [], 'sit0\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f65318776d8001e770b667f173dfa40b58c10327e3121114449fd20ba2be6e45cae72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x740, 0x120, 0x2f8, 0x440, 0x510, 0x2f8, 0x670, 0x670, 0x670, 0x670, 0x670, 0x6, 0x0, {[{{@ipv6={@private2, @loopback, [0xff000000, 0xffffffff, 0xffffff00, 0xff000000], [0xff000000, 0xffffff00, 0x0, 0xffffff00], 'vlan1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x3, 0x3, 0x14}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x6, 0x7}}}, {{@ipv6={@remote, @local, [0x0, 0xffffffff], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11, 0x0, 0x0, 0x4}, 0x0, 0x198, 0x1d8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv6=@remote, [], @ipv6=@private1, [0xffffffff, 0xff000000, 0xffffffff], @ipv4=@multicast2, [0x0, 0xffffffff, 0xffffffff, 0xffffffff], @ipv4=@empty, [0x0, 0x0, 0xff000000, 0xff], 0x0, 0x0, 0x42, 0x4e22, 0x4e24, 0x4e20, 0x4e24, 0x0, 0x23ccf3e9fd2b5143}, 0x0, 0x80, 0x0, 0x4e20, 0x4e24, 0x4e23}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@private2, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0xc}}}, {{@uncond, 0x0, 0x118, 0x160, 0x0, {0x700}, [@inet=@rpfilter={{0x28}}, @common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x2]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7a0) 1m57.457533126s ago: executing program 2 (id=5689): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x11, 0x4, 0x4, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0xffb0}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m57.316903033s ago: executing program 2 (id=5691): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x52, 0x4007, @fd, 0x6, 0x0, 0x0, 0x2, 0x1}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x5, 0x432, 0xa00, 0x8, 0xd, "a4c42ba02a0b3b4335931f2d038553da933b3a"}) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4000, 0x0, 0x0) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, {0x0, 0x4e22, [0xfffffffc, 0x0, 0xcd7e], [], 0x0, [0x1]}, 0x0, 0x2000}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "06010000"}]}, 0x54}}, 0x20000080) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="2400000076001f03000000000000000008000000ffffffff0c000d8008000300", @ANYRES32], 0x24}], 0x1}, 0x0) r10 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r10, 0x4000000000000, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x41, 0x3, 0x380, 0x0, 0x19, 0x0, 0x0, 0x0, 0x2e8, 0x1f0, 0x1f0, 0x2e8, 0x1f0, 0x3, 0x0, {[{{@ip={@private, @dev, 0x0, 0x0, 'wlan1\x00', 'wg1\x00'}, 0x0, 0x1f8, 0x218, 0x0, {0x0, 0xffffffffa0028000}, [@common=@unspec=@quota={{0x38}}, @common=@inet=@hashlimit2={{0x150}, {'veth1\x00', {0x0, 0x8, 0x0, 0x0, 0x0, 0x687c, 0x1}}}]}, @unspec=@TRACE={0x20}}, {{@ip={@empty, @empty, 0x0, 0x0, 'veth0_vlan\x00', 'netpci0\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3e0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@none}) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000006000/0x4000)=nil) 1m56.306625699s ago: executing program 2 (id=5696): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) syz_open_dev$vbi(0x0, 0x0, 0x2) (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/snmp6\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) (async) read$FUSE(r2, &(0x7f0000006780)={0x2020}, 0x2020) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) (async) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) read$FUSE(r3, 0x0, 0x0) (async) capget(&(0x7f0000000140)={0x20080522}, &(0x7f00000001c0)={0x7, 0x1, 0x2e7, 0x8, 0x1, 0x86d7}) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000700)=ANY=[@ANYBLOB="2802f7011000002c48dec0775bd3bc26884691a39b95210c0062f06cd328d4be90af433b3be478f4a1acc216ee6680592e3d7c378ac6d976996882690ea13b5f381415cbc8f994cf0a8747f3574db42631cb4e78d76e2c705c288fc7ad7ad2864baa4f2ae802eee793a72c0a13ab2980afc7024e18fda60481", @ANYRES32=0x0, @ANYBLOB="100000001102000008021880280001800800010006000000080001000400000014000500ae85719345aea46ab65e6dfaaf295385140001800500060033000000080001000500000094000180140005002085c27a07ea1896ae8fd8cc7fcabb4814000400d14eac771e9e175018f2cd06737723581400050015116644860dece83aa7c6a11cb333870a0002007663616e30000000140004001dd880057285776df14b5a6e16acf85c070002003a26000014000500bd1a751bf3a30f7693ca2111e59c7b38150002002f6465762f7667615f61726269746572000000005000018014000500f8c1b73396f7255f1abd85bff5188cd305000600080000001400040006640cec7432d2125851505e4c95295a0800010002000000140005009fdd0182b5339b7313c74a4f520527f45c00018014000500d58ab6e8f9a019ba81fa8b6b30745b6a1400040053c17045a53610386ec162f27cce743c08000200726e6700140004004aa26e5162275539e5123c86f108c39214000400b5bc56093ab51e3dde5dc7a14adaf51454000180140005004255c74a16760f23b4945649a3149fea14000400a0c04fc8a882f3aad358bb2f1b6057d905000600c00000000c0002002a2a2d2121212e0005000600560000000b00020062726964676500003400018008000100f2ffffff140005001b5aa9a5c14988428b2f71dadd1eda600b00020062726964676500000500020000000000"], 0x228}}, 0x8000) (async) sendto$inet(0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x10, 0x0, 0x0) (async) r6 = socket(0x1e, 0x5, 0x0) shutdown(r6, 0x1) (async) listen(r4, 0x0) (async) unshare(0x28040680) r7 = timerfd_create(0x0, 0x0) timerfd_gettime(r7, &(0x7f0000000000)) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000000c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000140)="8d", 0x1) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000a40)={0x564, 0x12, 0x20, 0x70bd27, 0x25dfdbfd, {0x2b, 0x6, 0xf, 0x6, {0x4e23, 0x4e24, [0x9, 0x9, 0x0, 0x2], [0xf7, 0x9, 0x0, 0x7], 0x0, [0x7fffffff, 0xfffeffff]}, 0x2, 0x7}, [@INET_DIAG_REQ_BYTECODE={0x103, 0x1, "0641adb35e2a21fe163fe49e2f17127e07e548ad0e37f29f4277700cdf4fa5e50ca174d36cca19839be6587e51d0da5c3f6b3d5681d34ecdc80ccefc01c5483edd806ef26cc598e50d2db0f1d963adf79e3919ca99cd3e671a239c1dd649fc3dea44b175906545760445af818b04311a7b42cb39a0c66ef528acd3021b684b57cc7ee3a752202d46538b3dd154032ac09ccc57b5d8f98bbb507cbf37314fa2afefff3dbecc3b0006fcf550b37d60cd22e525461871498af45cdb5ca32507c48da35e5e285a77485c58fbf42f1bbfc46bd878d128ea6e135511ee26c25a14aac574f1f899aae9a11038282500a7a51a95d0168e0377e83c2d280af8c4fa7e88"}, @INET_DIAG_REQ_BYTECODE={0xf, 0x1, "bdc563763a0c7d1c4b252e"}, @INET_DIAG_REQ_BYTECODE={0xb8, 0x1, "cff9d0fe9914f0697ea857a070e6897edc7978e6b89a676a98c91545c042979e6809d94dd27c13ecb6c4ae5852342886cfde9a189859be5d6dd6d611e693a5c210f45efb0021d737cea709a2f7559da76d77a50b0b01132c88fbe463ecc5546e860f720b9e00d45ea295ad3e5bd6498b986d3b9eef9c1c5825b471dfc6d330c80a03c186889199691cc70278eef9fefaecb01ce26c057193ebbba599d431e8aecdcb1977b56901eb84b70bb85ccab06f2043069b"}, @INET_DIAG_REQ_BYTECODE={0xa7, 0x1, "1fa42fa3c308fe9361943583f4aba36101f2dda8623d026cea8a5bd866c2a6d2363c80bbb5372797469decc596ea94252f28d786389c7d8c58f8d23d4ca0edfb2b8db5b40bfebdc7457170a8cb479144e1ec342459faf1ad67cbec23d1e491d862a7593a5a07d5ee84f511104b720cb3add2135e694e4ca4ee920bfd387899bfaf109513ef37ebc7716f21044d195d741883c544bec7c12634439a2f38e9b6d68d5150"}, @INET_DIAG_REQ_BYTECODE={0xf3, 0x1, "1517ea50b811949c593759906ef222f6ca8af0d1aebae100eb95ddaa97596179099af06165960234dfd23298c8ae1831717761f54761ba001c4387c63c6207d3b900434e6dd0d6ff570f65972e25d110c8f9416d330600f9d7f2fd901e6449f0d99df811d2fa4522034c82c3f04f511e9f6589871f6c402d59a7b5a1eef952e8a9c28c27097295d273fa4cf7b63d238c97506925640c7a4b754049cfc291da67b59bf845102d90598ab6102b535a16c33aa08c6790b269bdb2151e936c50039c8d8e46387caa05c95a400423fc170d16a9f6b9b66608ddca3bd58b46a67c74aee657067bc1d1a9c40b7fa1d0b59a61"}, @INET_DIAG_REQ_BYTECODE={0x76, 0x1, "48a95c7f6d55f98dc09124cd588b99b7920e77fe38d9846a09bf95a7b07f55e88127da5d9ccff8f878cb70c8479edc88736839521fbe637976f3791262594ecf3b6c141b7377f5a8bd0d1331934e99c4ee6a5df872e02f33b40712dfba136fd768b53aec1c64d31d3e97ddafc9cd9f0fc8b3"}, @INET_DIAG_REQ_BYTECODE={0x2c, 0x1, "8b9fe7df75ba5137876b25e9d67c4bcef410d8a731fff3a3e66eb91c52a6b08e9e153555ae332013"}, @INET_DIAG_REQ_BYTECODE={0xe7, 0x1, "fac581579b42015255aa1b1832a73ff1b8f0069775445f239abfb44d35892e7a182ae6bcaaf9be95370bf1b45b9a5b775c95d83a8df765f408df4ee1424916f63c4b935eab026e8da34b8c3705a2c20d28c432d56c8124a3a668bcfd377abf8a9f8d7de0d37226b885e0b6299691a3c750ea3a275c10f02a702a8ff4b6d13993e059588db4a7b8fcf1619c2ff9eebb051e449c665e7bc5801675472279cf660ff54e41e7639b16af73ac4454efda5f313fb7cff151ae60cb38509b7cbcadfeff7076e3a31d2ac90acb816c050e7246acd2c63f346268a09b7b5af1c89fd53157d3e289"}, @INET_DIAG_REQ_BYTECODE={0x23, 0x1, "e739bb4bf71b6f45fae6258250092646555de68afca319e3129671ce3598fc"}]}, 0x564}, 0x1, 0x0, 0x0, 0x1}, 0x4) 1m56.11359049s ago: executing program 2 (id=5697): mkdir(0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000200)=""/56, 0x38, 0x100000000) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x101000) r1 = syz_clone(0x100100, &(0x7f0000000100)="eeac2b85824933939adc5106013bb82db18d", 0x12, &(0x7f00000003c0), &(0x7f0000000480), &(0x7f0000000640)="e19eabe879e2ac1737bddf96f15c2c09f61402796487e3f856248c2c2dff17bde821500926780ec7416b580a57e7ae5e47b0423981a6820eea95a23393b7bb4862dd2f3e259c45f1fec863463d4e1b89a33619215b74bd43cb3550f6bea47449c84d756aa5df4bbbe8c06f0d770ce18d27c1282ae2a8a6753f5e2f8de624722a26c17782690ae8a436b564a9714249e45140c23e22784d47e298e1bad797b08dafcfc87a929f3c52d2193a2b76dd06a41811f0a0d73722635a5dbc7c2fac2df26938b9aa8f229966e9d9e6754d03fe4d37a321126e5f4d162587c2000b8b0d22c41a02349097c2c272788f34abfe75bac5a3bd7732d3b3e75d1e3e3235eb9e8dcdce888380d2d58331641c20c6e83a7d8729b9a171c6e3a31bc76dd3984905ce5174d0c998a62b1bb637b5608e6f3902fe964dd974cd884e312ede7b0403d2762e0d3e84b3fc23e6935f05e0b630e7c33e31a3b2a904e8b6d2c642402994dbf9d94e61dc6e29e11f7148e0346766d1506bd0c51969821ea1667dd37ba331f210c707519173d4b1d1b8976b1807eddf456a03f717cc776a7b90f3ea8c02fce67d049d5d3691977b6571a828ead86d153e8b5bad3ebb048e59417d0dfa9ea788f447e2ece667fe5b3e279eff1c868e5016f59eb2a56f53eb1a72c953dcc7ace7fe377892f043184e86fae3692e6834f69a82e3b4fbd0fea5c933bce4e6028a8479b57f79d08864c1d434c74604e4b68b8e8bfc0df47ec68c862b3a5579427cca2817a8dab2a340507d0e3801c5c7c737b1f9d7f61afc2c41076cbc39f018bb20c7e10100531e54001da90dbb12f945d100749e61b1653e2a57db26cf01b1ac18c862ea1a1d95561b1f74b15c349c559dd10ddbc8c66451213843fe740d337e23ba71bcd9ec91784a600dbf872a62518f39c10a40d337f5e39c675acbfecfc235422399421cb312696844f43928db1e868ab41ebfb9ab4fda479bc19fe78f4cb6de8c01c5521e06bf7719b08b85078034b0b6700dce8e0d739a9c572ce640f8b877d86d211baf58f721d0d673c41f1190383ff9b7b468905f311edc9e40c518c2a5694a5d469b0d5077e26ee85bc4082f9c8aa51f5008aac71c31f14476b112a9f5c744a69c17182c766012afa27c41ca01cc39ba4911f1577605d1390c50d5eafbccfb0b87b1bfefb380fcf1e5ef8e75e66a9f793226d13c5d3be83ff1fd97d29fcefc21e1833bc15bbbf84796e9eb299ff11b8b8be478fa37e7e184f57da224ef45dea5616c906dd870f85e027d6c802151bf954db91ac77b8eec3a8c2e35c8be47ff8ef3cf5bdb77fc6d3a822fb6867474c64ceb219cc93b2f873463bcb6185fd915fa2de28d6e4c8f7cf5064d619c21ae511b2fd53da826f4ed2c2eb6f990fcb8080181a340de2b32076f34d3203d227acf85ed931ad38814ba6375c0068e95d69d30484ce3f6d1da47c776aeda574e011789184b2a6692f5f06987024dfd767f778b864e63e9efbb310eca0401289f9479e916f002339e40b3ee774f6440027a5e29fe616077515a6effa241476f6dde80f7dc865688227065e3f37073072b65e36f0196e8a6702582ed24a889265d9bdbf1a0a710c2ed9510718912b4144148ccce2ecb34f6096fe8a64cbdb4531dc63cf8a28dad97da94a9e977be9d3362235112b4a2ba38718949fe33d1ff353c5ca8b0f431fab2b79ecb6eec2e477fe85e8ee3e1423cbc3dec8bbbd0b85a87263aa2db5f7f04c5b24a038a2985711b0ede883dada81f9db6e57b178e8046335206f8db397786dd4586fe063ff7086260bcbceb3900fc83187c4ee33f94469142b39656dc97272b9292792f56c264b9e350c769a71f0ba17f438175700737feb3e78c461a94c2fe8546e7174ec2bd78010cb595996fe8240475b3770e88df9d7ffc3113918fc092962df8afc4ba04edd9b73bc792e9d7ce6b9159c1a8fc9f0f92d0853478ac5e05d76269f89f36517eeda2427809b9d38622ff45b3eecbddb6e17a0315df2023abfbdaa9f5f722a7b02019d2c4a9617c6118d6868fd80533849e019d833986de187459c93bfccba49e03397e8a342ff3556eafe56157d857e77004ea19c75a3d74a41f71803872dd49cd04df0348efecdc35aba906079605936ccd73d5f7c86f9b2ca21f0745c349047a5295ecab9452fed9b2c18035f57d7dd72709a80dd6ca38b29fb0b19ff5aca66b58adc338690673ba0e887f7db75f8667356bf63ee4c831956c6fb02c6a9834b6bbe80eea5b72ee318db61ceb6f00e0f3d092a328b3437039bfd92938141774741c2c7a607585916cddf56f5d9f1252eff0415413bc4f69c45bfae0c4f5f9168f0a5c0c83dc954dc0097034fda05ff012678b59690ced72c7d5eebd02520bdf313fa301764097740569da4b363f91158fa010ae4a00ea9fd27eba79ff4b0d5ee981719e1a222c4f3df647ede386f2023ade2a1e3244f1e1eb7f216f740ced982f3dd219e5fc5047e38cc5bd3eedc6fa100afd8190f687c671df9421c4a5ca68b7bee02877b201e02476a153d945f885602302891ea5460a9ca520aeae7d7466dc650bebeb4a9207243e5a816af97dd3e00d340d423c2eb8bebe98b205eed26e64f073199e5e827e171184fe31729dea3bae9721857039b8742f93f513f4d2619cafbccba325365bec87a218be7fa55a280a72081287a01724e50d4b32c258f6a2b65ae8741e5ecfac45d16be7fbf3adfd1c5077a045db1b94a820bff6ba1960fdc7fc24c85130f1e87b4dfc46e2f08bdb6253359037d22da2fe199f063b2d6bcccb68a39721ce56302b3f62769f5ba02f6fb6ea4b782703b2a7efe7233404dfa47c5733d806cb14e030320f3a51c3ce133252b23908a74c228d81bddfe59de614e3cea6e30d579f9df76e6c26f829686954421aae56ca753aedb19d1f7de4fcbedead36b912fab4b9810778860664e56bc67fd34529be362696bf92f447434bd7c0107dfc2f18646367c49f480a813f3bd8c56ae20ef9ae213719c9c17a77183cd09b42b6d76f136b36afc9eb9171a988a558c9a16d5de9fa9d39410e6b2510b3d5cdab7218fb5b26ad658a029148c02b0eac99cd3c50f33b1cf6fed58030aa69e62a3ad313330ca84ac40b2ff79b0c308f6a25d80bc269b0c1a486115d5764a807ddb4ab16c93e0b976d773e198d1c5b0e207b60e78a92b22b0b045870b5ebaa8c7b39c6e1c5e80c22dbec878324174730d5c040c67892eacfee35624630f40eb734c9f2d07dadb6fcd9b8fc71fb2d87259118a7ceac291e57716eb8345613eadaf35c3cdaa5086b82db9423117f1edbe9fddf7baaf3e633daf07c85739f94223ddf65cf9670a2c3ec54fd80ba425455d442a07383f58944f7888945127339fd1c003d1ce3ee1d25c28bf20fbaffd83b3f59b9e8fce10bb88be45d4660f74d0f9491431334758227551ea33b8b3e061de8e310e7a1d0b91abe606a78d500adb09f284bf74fba6704c01a2771736a6b580008afab0ccba83b3c40d800015837bcec5b0e4b0f67aff052da6306b6b87f6e1b10ef3b4c2eee2318e39f39970f30d2b5f6949abeb637d88396f3ff4c1eb207fb041c7fa1fc5a912de2d2a7a1e322df43559e1270b7610d37cc341853d10c5761ecc500c4fe20abcf9ce0f329dcc7f9f0c829397524dd555dbae70d14d48682a0c43fd564de57af5b69fec828f1239b321cd6e646bed41666ea2acd4841b2c775f0196e77e2922f45a933e31ea15737237b26aecb239281b264af816e7bdc8d3f36af") prlimit64(r1, 0x9, 0x0, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$pppl2tp(r2, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x1, 0x1}}, 0x26) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000005c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x2, r1, 0x3, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0xffffffdc) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200, 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000001240)=ANY=[@ANYRES64=r1, @ANYRES32=r0, @ANYRES32=r4, @ANYRES64=r2, @ANYBLOB="6fc67ec79d038cbf042019883b1ac2fac9f14ec014585bdb09a75fc07c69a41a55312939ce7477630246953fe6a42c334169d0c042c6813b9392813311328990d6551f4c60fab6095c46b269e961089a1d1c527f4c5955837d6334f9c8030af0b2055cab29205f1c49923f92e5fd18f762b26b0941aba1372b92e6431ba319c33d1b8fd0c87c55270a3216566c5c3f84a925ed56c3a84fd82b8d97210966780178a75d56db7252a183834ed33df9550bd9e34f07bfcf37abc28aa18dad0969678034018c2890e032605d9978a982f8adadfff11b118f7a438d1542eb6eaa3033f1720005be89df1d8ca555deb98bca9967cdbea4ee3bdaeea7bf2d88fd", @ANYRES8=r0, @ANYRES16=r1], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB="200d01226f0000"], 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67606f75705f69643d116de20ab279706780fa03001c95a30e9431522e7fdfceb9f32af915e82c2392c58cef5393dca0f30ba46d84e90cd393597eb6d2c9963526", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r4, &(0x7f00000021c0)={0x2020}, 0x2020) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r7 = creat(&(0x7f0000000580)='./file1\x00', 0x0) r8 = fanotify_init(0xf00, 0x1) fanotify_mark(r8, 0x105, 0x40009975, r7, 0x0) fallocate(r6, 0x0, 0x1000000, 0x3) 1m40.950590221s ago: executing program 33 (id=5697): mkdir(0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000200)=""/56, 0x38, 0x100000000) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x101000) r1 = syz_clone(0x100100, &(0x7f0000000100)="eeac2b85824933939adc5106013bb82db18d", 0x12, &(0x7f00000003c0), &(0x7f0000000480), &(0x7f0000000640)="e19eabe879e2ac1737bddf96f15c2c09f61402796487e3f856248c2c2dff17bde821500926780ec7416b580a57e7ae5e47b0423981a6820eea95a23393b7bb4862dd2f3e259c45f1fec863463d4e1b89a33619215b74bd43cb3550f6bea47449c84d756aa5df4bbbe8c06f0d770ce18d27c1282ae2a8a6753f5e2f8de624722a26c17782690ae8a436b564a9714249e45140c23e22784d47e298e1bad797b08dafcfc87a929f3c52d2193a2b76dd06a41811f0a0d73722635a5dbc7c2fac2df26938b9aa8f229966e9d9e6754d03fe4d37a321126e5f4d162587c2000b8b0d22c41a02349097c2c272788f34abfe75bac5a3bd7732d3b3e75d1e3e3235eb9e8dcdce888380d2d58331641c20c6e83a7d8729b9a171c6e3a31bc76dd3984905ce5174d0c998a62b1bb637b5608e6f3902fe964dd974cd884e312ede7b0403d2762e0d3e84b3fc23e6935f05e0b630e7c33e31a3b2a904e8b6d2c642402994dbf9d94e61dc6e29e11f7148e0346766d1506bd0c51969821ea1667dd37ba331f210c707519173d4b1d1b8976b1807eddf456a03f717cc776a7b90f3ea8c02fce67d049d5d3691977b6571a828ead86d153e8b5bad3ebb048e59417d0dfa9ea788f447e2ece667fe5b3e279eff1c868e5016f59eb2a56f53eb1a72c953dcc7ace7fe377892f043184e86fae3692e6834f69a82e3b4fbd0fea5c933bce4e6028a8479b57f79d08864c1d434c74604e4b68b8e8bfc0df47ec68c862b3a5579427cca2817a8dab2a340507d0e3801c5c7c737b1f9d7f61afc2c41076cbc39f018bb20c7e10100531e54001da90dbb12f945d100749e61b1653e2a57db26cf01b1ac18c862ea1a1d95561b1f74b15c349c559dd10ddbc8c66451213843fe740d337e23ba71bcd9ec91784a600dbf872a62518f39c10a40d337f5e39c675acbfecfc235422399421cb312696844f43928db1e868ab41ebfb9ab4fda479bc19fe78f4cb6de8c01c5521e06bf7719b08b85078034b0b6700dce8e0d739a9c572ce640f8b877d86d211baf58f721d0d673c41f1190383ff9b7b468905f311edc9e40c518c2a5694a5d469b0d5077e26ee85bc4082f9c8aa51f5008aac71c31f14476b112a9f5c744a69c17182c766012afa27c41ca01cc39ba4911f1577605d1390c50d5eafbccfb0b87b1bfefb380fcf1e5ef8e75e66a9f793226d13c5d3be83ff1fd97d29fcefc21e1833bc15bbbf84796e9eb299ff11b8b8be478fa37e7e184f57da224ef45dea5616c906dd870f85e027d6c802151bf954db91ac77b8eec3a8c2e35c8be47ff8ef3cf5bdb77fc6d3a822fb6867474c64ceb219cc93b2f873463bcb6185fd915fa2de28d6e4c8f7cf5064d619c21ae511b2fd53da826f4ed2c2eb6f990fcb8080181a340de2b32076f34d3203d227acf85ed931ad38814ba6375c0068e95d69d30484ce3f6d1da47c776aeda574e011789184b2a6692f5f06987024dfd767f778b864e63e9efbb310eca0401289f9479e916f002339e40b3ee774f6440027a5e29fe616077515a6effa241476f6dde80f7dc865688227065e3f37073072b65e36f0196e8a6702582ed24a889265d9bdbf1a0a710c2ed9510718912b4144148ccce2ecb34f6096fe8a64cbdb4531dc63cf8a28dad97da94a9e977be9d3362235112b4a2ba38718949fe33d1ff353c5ca8b0f431fab2b79ecb6eec2e477fe85e8ee3e1423cbc3dec8bbbd0b85a87263aa2db5f7f04c5b24a038a2985711b0ede883dada81f9db6e57b178e8046335206f8db397786dd4586fe063ff7086260bcbceb3900fc83187c4ee33f94469142b39656dc97272b9292792f56c264b9e350c769a71f0ba17f438175700737feb3e78c461a94c2fe8546e7174ec2bd78010cb595996fe8240475b3770e88df9d7ffc3113918fc092962df8afc4ba04edd9b73bc792e9d7ce6b9159c1a8fc9f0f92d0853478ac5e05d76269f89f36517eeda2427809b9d38622ff45b3eecbddb6e17a0315df2023abfbdaa9f5f722a7b02019d2c4a9617c6118d6868fd80533849e019d833986de187459c93bfccba49e03397e8a342ff3556eafe56157d857e77004ea19c75a3d74a41f71803872dd49cd04df0348efecdc35aba906079605936ccd73d5f7c86f9b2ca21f0745c349047a5295ecab9452fed9b2c18035f57d7dd72709a80dd6ca38b29fb0b19ff5aca66b58adc338690673ba0e887f7db75f8667356bf63ee4c831956c6fb02c6a9834b6bbe80eea5b72ee318db61ceb6f00e0f3d092a328b3437039bfd92938141774741c2c7a607585916cddf56f5d9f1252eff0415413bc4f69c45bfae0c4f5f9168f0a5c0c83dc954dc0097034fda05ff012678b59690ced72c7d5eebd02520bdf313fa301764097740569da4b363f91158fa010ae4a00ea9fd27eba79ff4b0d5ee981719e1a222c4f3df647ede386f2023ade2a1e3244f1e1eb7f216f740ced982f3dd219e5fc5047e38cc5bd3eedc6fa100afd8190f687c671df9421c4a5ca68b7bee02877b201e02476a153d945f885602302891ea5460a9ca520aeae7d7466dc650bebeb4a9207243e5a816af97dd3e00d340d423c2eb8bebe98b205eed26e64f073199e5e827e171184fe31729dea3bae9721857039b8742f93f513f4d2619cafbccba325365bec87a218be7fa55a280a72081287a01724e50d4b32c258f6a2b65ae8741e5ecfac45d16be7fbf3adfd1c5077a045db1b94a820bff6ba1960fdc7fc24c85130f1e87b4dfc46e2f08bdb6253359037d22da2fe199f063b2d6bcccb68a39721ce56302b3f62769f5ba02f6fb6ea4b782703b2a7efe7233404dfa47c5733d806cb14e030320f3a51c3ce133252b23908a74c228d81bddfe59de614e3cea6e30d579f9df76e6c26f829686954421aae56ca753aedb19d1f7de4fcbedead36b912fab4b9810778860664e56bc67fd34529be362696bf92f447434bd7c0107dfc2f18646367c49f480a813f3bd8c56ae20ef9ae213719c9c17a77183cd09b42b6d76f136b36afc9eb9171a988a558c9a16d5de9fa9d39410e6b2510b3d5cdab7218fb5b26ad658a029148c02b0eac99cd3c50f33b1cf6fed58030aa69e62a3ad313330ca84ac40b2ff79b0c308f6a25d80bc269b0c1a486115d5764a807ddb4ab16c93e0b976d773e198d1c5b0e207b60e78a92b22b0b045870b5ebaa8c7b39c6e1c5e80c22dbec878324174730d5c040c67892eacfee35624630f40eb734c9f2d07dadb6fcd9b8fc71fb2d87259118a7ceac291e57716eb8345613eadaf35c3cdaa5086b82db9423117f1edbe9fddf7baaf3e633daf07c85739f94223ddf65cf9670a2c3ec54fd80ba425455d442a07383f58944f7888945127339fd1c003d1ce3ee1d25c28bf20fbaffd83b3f59b9e8fce10bb88be45d4660f74d0f9491431334758227551ea33b8b3e061de8e310e7a1d0b91abe606a78d500adb09f284bf74fba6704c01a2771736a6b580008afab0ccba83b3c40d800015837bcec5b0e4b0f67aff052da6306b6b87f6e1b10ef3b4c2eee2318e39f39970f30d2b5f6949abeb637d88396f3ff4c1eb207fb041c7fa1fc5a912de2d2a7a1e322df43559e1270b7610d37cc341853d10c5761ecc500c4fe20abcf9ce0f329dcc7f9f0c829397524dd555dbae70d14d48682a0c43fd564de57af5b69fec828f1239b321cd6e646bed41666ea2acd4841b2c775f0196e77e2922f45a933e31ea15737237b26aecb239281b264af816e7bdc8d3f36af") prlimit64(r1, 0x9, 0x0, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$pppl2tp(r2, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x1, 0x1}}, 0x26) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000005c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x2, r1, 0x3, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0xffffffdc) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200, 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000001240)=ANY=[@ANYRES64=r1, @ANYRES32=r0, @ANYRES32=r4, @ANYRES64=r2, @ANYBLOB="6fc67ec79d038cbf042019883b1ac2fac9f14ec014585bdb09a75fc07c69a41a55312939ce7477630246953fe6a42c334169d0c042c6813b9392813311328990d6551f4c60fab6095c46b269e961089a1d1c527f4c5955837d6334f9c8030af0b2055cab29205f1c49923f92e5fd18f762b26b0941aba1372b92e6431ba319c33d1b8fd0c87c55270a3216566c5c3f84a925ed56c3a84fd82b8d97210966780178a75d56db7252a183834ed33df9550bd9e34f07bfcf37abc28aa18dad0969678034018c2890e032605d9978a982f8adadfff11b118f7a438d1542eb6eaa3033f1720005be89df1d8ca555deb98bca9967cdbea4ee3bdaeea7bf2d88fd", @ANYRES8=r0, @ANYRES16=r1], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB="200d01226f0000"], 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x40, 0x7, 0x2, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67606f75705f69643d116de20ab279706780fa03001c95a30e9431522e7fdfceb9f32af915e82c2392c58cef5393dca0f30ba46d84e90cd393597eb6d2c9963526", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r4, &(0x7f00000021c0)={0x2020}, 0x2020) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r7 = creat(&(0x7f0000000580)='./file1\x00', 0x0) r8 = fanotify_init(0xf00, 0x1) fanotify_mark(r8, 0x105, 0x40009975, r7, 0x0) fallocate(r6, 0x0, 0x1000000, 0x3) 1m14.804763976s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 1m0.227734947s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 43.754131039s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 29.096610728s ago: executing program 0 (id=6001): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0, 0x0], 0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r5, 0xc01464a6, &(0x7f0000000180)={r6}) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xffff}, &(0x7f0000000040)=0x8) 27.531143618s ago: executing program 0 (id=6004): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000d647425ec357e7ee00bf0900000020000055090100000000009500000000000000bf91000000000000b7090000000004008500000085000000b70000003f00000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 27.344200832s ago: executing program 0 (id=6007): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x400c6314, {0x1, 0x0, 0x0, 0x1000000, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 27.192086659s ago: executing program 0 (id=6010): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r6, r5], 0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r7, 0xc01464a6, &(0x7f0000000180)={r8}) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r10, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xffff}, &(0x7f0000000040)=0x8) shutdown(r9, 0x1) 26.906715221s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 22.944351086s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 15.348307499s ago: executing program 6 (id=5752): ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, &(0x7f00000001c0)=[{0xff, 0xb, 0x0, 0xfd, @time={0x0, 0x7}, {0x0, 0x9}, {}, @result={0xffffffff, 0x3}}], 0x1c) 8.312859829s ago: executing program 0 (id=6012): syz_open_dev$MSR(0x0, 0x643, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) inotify_init1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket(0x1e, 0x4, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usbip_server_init(0x3) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r4 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r4, 0x7b1, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) 4.741676399s ago: executing program 0 (id=6012): syz_open_dev$MSR(0x0, 0x643, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) inotify_init1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket(0x1e, 0x4, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usbip_server_init(0x3) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r4 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r4, 0x7b1, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) 4.109168606s ago: executing program 4 (id=6086): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x9, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000110001002dbd7000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="012200c86a1fb2652d1f075a88c73f43a8fe67f86d184f898c85bfa9277a0000080000"], 0x20}}, 0x40040) 4.054962768s ago: executing program 5 (id=6087): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r3, 0x400, 0x1) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r0) r5 = open(&(0x7f0000000040)='./file1\x00', 0x80, 0x24) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pread64(r4, &(0x7f00000002c0)=""/124, 0x7c, 0x7) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="060000000000ad2cb66469278ef0b82c72554c353d3cbe08000000000000008abc6eda5a1e675ae2c90fd2f7c3944567f4edf1605d0685d9c683686f58adc082b385699555b1fc25713627632e34a2ce1f706d084882f2e6760c748d17362067bd620eb5ab2c4275f1eaa1a7aff6a4a2b0bc3edb766bd34a1d5ce14e8bcd5ae59a8dbd9be4c31609f4adb9cef9721157f5a5b5637ec1ad35f8c47c4f6c0cb1ec11c81b17f81649345e8d6a0d59be6035b0452b0b90fafe4aafdc958ad391573e93ee908180fbaed33cfe070d369c04c9d364cd66c605743d7feb25dbb9f7c5fa6f1880c2814dfe3227a354a382bf0865e434104a5e2f183c4665c685dd9c6181caa495", @ANYRES16=r1, @ANYBLOB="010000000000000000008100000008000300", @ANYRES32=r2, @ANYBLOB="0a000600080211000001000030003300203c0300080211000000ffffffffffff9fd958fab21e35000040050008021100000100060101010101010100"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES8=r3, @ANYRESDEC=r5], 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e00000000000000910100000800000000000000", @ANYRES32=r7, @ANYBLOB="000000000080000d00000065f1000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00010000000000000000000000000000000000140000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0xc, &(0x7f0000000840)=ANY=[@ANYRES8=r3, @ANYRES32=r8, @ANYRESDEC=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe77}, 0x94) r9 = syz_open_dev$loop(&(0x7f00000005c0), 0x3, 0x2000) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000000700)={r6, 0x219, {0x0, 0x0, 0x0, 0x1ff, 0xb28f, 0x0, 0x6, 0x8, 0xc, "7594401e555c3618e6406932c29f87a16850b92c93032bdd758c74c31c3d767dfc5909835d4849a5c1702c8c0898ee2f0b3219e3d57fd8fd2a6a412e6091f92c", "ac31ecf7d59280027388045a237664f344824b65913298769ba356ee68f42403c496e0c165e8eec1e63e97f3f5fa5132eb5db75ee20c799e7ba35f91f218a31c", "5f1d22843713bff78171acf3ca3c9ad75c97dbce2f052a336fe784851a5678b7", [0x80000000, 0x1]}}) close(0x3) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x81, 0x4, 0x82) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000000500)={&(0x7f0000000000), 0xc, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB="db5d4a6a", @ANYRES16=r1, @ANYBLOB="02002abd7000ffdbdf255a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000900000060000000"], 0x28}}, 0x80095) getsockopt$inet6_mreq(r7, 0x29, 0x15, &(0x7f00000004c0)={@loopback}, &(0x7f0000000580)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='mm_migrate_pages\x00', r10, 0x0, 0x5}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x4, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4008085}, 0x20040000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000600), 0x4) 3.987943434s ago: executing program 3 (id=6088): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x20010, 0xffffffffffffffff, 0xffffd000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r1}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mlockall(0x7) remap_file_pages(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x100) 3.825997544s ago: executing program 4 (id=6089): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x24, 0x4, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r2}, &(0x7f0000000700), &(0x7f0000000740)=r1}, 0x20) (async) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) (async) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x6c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x58, 0x1, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xffffffff, 0x10001, 0xffffffffffffffff, 0x7, 0x3}, 0xa}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, 0x0, 0x0) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@func_proto={0x2}]}, {0x0, [0x0]}}, 0x0, 0x27, 0x0, 0x1}, 0x28) syz_emit_ethernet(0x56, &(0x7f0000000640)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x20, 0x2c, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[@hopopts={0x3a}], @ndisc_na={0x88, 0x0, 0x0, 0x6, '\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}}, 0x0) (async) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 3.703661906s ago: executing program 4 (id=6090): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0, 0x0], 0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r4, 0xc01464a6, &(0x7f0000000180)={r5}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xffff}, &(0x7f0000000040)=0x8) shutdown(0xffffffffffffffff, 0x1) 2.988562743s ago: executing program 3 (id=6091): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x88, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x58, 0x2, {{0x6, 0x9, 0x80, 0x0, 0xffffffff, 0x91b1}, [@TCA_NETEM_DELAY_DIST={0x8, 0x2, "5948ecd4"}, @TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x4, 0x5, 0x6, 0x895, 0x9}}]}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffff7, 0x4}}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0xef6e190000000000}]}}}]}, 0x88}}, 0x0) ioctl$BTRFS_IOC_ADD_DEV(0xffffffffffffffff, 0x5000940a, 0x0) r3 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000065c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x500, 0x0, 0x8, 0x7f02ae, 0x328, 0x200, 0x430, 0x2e8, 0x2e8, 0x430, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x300, 0x328, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@CLASSIFY={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @private}, @private2, [], [], 'veth0_to_team\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1100000004000000040000000c00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000400"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000080000085000000820000009500000000000000b72c8f7ef2b469934e54849af4d9156e604f47c4a11fd5a8b7c2bfa7c0c441c3a1ced10535238f95d98e3574cbebafb2b51790456521e41b1bd1896ffc6c468b5d3c74161f016e2a63da6124ab1630f150897aec72fdef6f225bc896"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r5, 0x6, 0x9, &(0x7f0000000200)=0x2, 0x4) creat(&(0x7f00000002c0)='./file0\x00', 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$SNDCTL_SYNTH_MEMAVL(r6, 0x80045105, 0xffffffffffffffff) r7 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$binfmt_elf32(r7, &(0x7f0000000980)=ANY=[@ANYRESHEX], 0x58) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r7, 0xc0a85352, &(0x7f0000000000)={{0xfe, 0x9}, 'port1\x00', 0x0, 0x420, 0x802000, 0x10001, 0x3, 0x0, 0x6, 0x0, 0x1, 0x9}) r8 = openat$cgroup(r7, &(0x7f00000001c0)='syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r7, r8, 0x6faa88312435857f, 0x0, @void}, 0x10) 2.741152496s ago: executing program 5 (id=6092): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000880)={0x704, 0x33, 0x100, 0x70bd26, 0x25dfdbfd, "", [@nested={0x23d, 0x10a, 0x0, 0x1, [@nested={0x4, 0x66}, @generic="e49e44b5a1660b6b905902f2104b7b0910ce7c7d3356b965248d719b5fad2600293f6acd3b0fb18e8dc1b2c435db823c720bbde09c949d663fa619022d46f0c56aeeeb3b3c58a449dfd82aabd3ec04e586c466411174c2abbde2081f2d3de3", @generic="4c8ade9f7e63b35126a43630a25613e1224082de236f598e08010b39492c5e48af602c294e106e641666dcafe4a87d169bb2ac21368d19038b560fbc0c57dafd045fab7ecabbb88a1aa9d0dcfdf273c198220e480e8d84694356022a", @typed={0x3e, 0x27, 0x0, 0x0, @binary="cd407984edf3f50a7990208988740ab7a09df30a68f5aedf2520149be2ed67018d1ba2efabeec464e0b5a5fbbd65675f0c8ad3dac42d2b2d50ff"}, @generic="e81eab14f00844d2e44bf858cb36f8b7db50df0e82b8853e14ba571d4e888d2c61cfda651a3d7a108e4c073cb30467e948a14f32714b8d1e0887b6997b0c21c4875ff5772f66e45bd02a6e4520579134f287c95f45e6ad9d57f9cdf76e6ecfe838593dc2868106bcccad2bfa24101a9c5db61dab7453c014d03f9cdae860630319a70ee898ebf7e3b20356c9fd252fceb4daa554ff027148011a19ff797c9b76", @generic="872c16291aa4a849e591875ee64e33efef9a333859bc11c355165c7bc1a062933bcd6b9de12c39c956336dc360c5cefaa4e82ce545feeb32d824b98304a2f77c0f4f9f43cb570488cfea58a80bd9ba7a47f6a509015dd46c063e9e5a28968bdb7a626e4ef96cf0c2c41a184c405487a3b1221b2f877a17ef9355472f7322ae3913974a5d116b380ae9abb2d6f1ac61a2d942a144a8c22bc3b87e"]}, @generic="7e4e9529e61b7c02dbf1bf083c005b839af63d5dc23ab9c0296860b16fba2018ab0b3a0ef3597b1d6f970e5305954d73140fc76f90e3077d608225593d52b149da92672ed36ce2cbadca52ef55e3678de2cbcf0d5dd643cee3abf335f6eb1a17abbf5350214856e25feff7c2e0713c068fc97b4049de7a88e89b40098eb5ce130a8dc662bd1dfd9f42bac470008fbd8addda01f89216793adceadafb777a1bdb7546e9d055fbeee47c938009", @generic="d90a58cde601d565cdddcc6aa3fcc8c25583297245b4d7973d0df9b022c59bb26343d8fac6abbe023d9e0640355e0034d2aca4a49132b88c8660af242102d45a28332c4b796cc5268b9a5ec5b61042577e3e5ea90f21384e8c5852110520bfd976705ca7e25e8a5ac6dd7bdadeb451f164c86cdb89561b05f0b9e143b1917e3dd99ee920f46511a803ab9cf9dd2d6aaf8aee259d1476cd960ce44acbc6a970c4fdd6f99aeee46de8efec7151b1e4cc13cd723e9cfa7ba2f69b60189d7aff553101c449174d1e18b6c5b148275100a3f8bd0c4c96296c43028aa284f8f626392a21d31e5e06fe98065e0246d46b7fe927a881c18c044e5c139e69", @typed={0x14, 0xbe, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0xa}}, @typed={0x8, 0x63, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x18, 0x0, 0x0, @u32=0x4}, @nested={0x1f1, 0xee, 0x0, 0x1, [@typed={0x8, 0x39, 0x0, 0x0, @fd}, @typed={0x8, 0xc0, 0x0, 0x0, @ipv4=@empty}, @generic="48f2adbc26fa866f55146583e697a3ae3793fe641fbf2f7456a75f437954532e62b73821b138e01aab0570d1fd444d06c744cc49b4", @nested={0x4, 0x4f}, @generic="af78a6080126bba47600c35ef978d18d9ff34e800b64274c3ebc8a2edfa4a5181a9f39f27a3a251b0146725a8b72f90dc52cf3bd1c4f9de1c3569dc99796d705316ae932f4a37fa5acd78d88a70dd65afe4e29309f5ad150267a061af562b4e948114b4a8bd12d8b0fe6d7dfead1bda76df5ed2c810206e91c81c9b56d7d9f9dac71a7d38a573311d38162f3e37d82d28be25b3e3ca865ac7682e8bf85ca1b0d0784066bf35ea6a678fa8f9c0f026a2b1ceea4ac4cff1c704bc39e14de8fa8ee544eaf146d8c533450673ddb20abe93c9a0c7e907943071e5281aa59afa0b2ff8924f4bf7748186042456283", @generic="f01254c8a325874b7a364f60eb18eb3e374838d32bfdcf", @typed={0x8, 0x9e, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}, @generic="a5fa1bc096f7698bf3a3b0d73b6a0d1e0d9454b139670292b1dceb88454804395cfea2f930bd1a85f30dd9aa777f0bb11dd045e7a69c1833c16240c76f64ea112de3c45021c621d034910e1db3fca008b95a45107899e470807feef1304cd8f30cff59aecaa6c50194c6b72963a9b8aeb003858a6c716898b4474bb940d9b2b8accb6683360dd814cd20a05d8d01acab38a6fcd4905ed66ee2"]}, @nested={0xf1, 0x7d, 0x0, 0x1, [@nested={0x4, 0x3f}, @typed={0x8, 0x6a, 0x0, 0x0, @uid}, @generic="f7a0892a0f44ae21cef9bccdc148b946ddef45529a62c9e1934ed61f2ddf4fdbe9bb7c15cb11095e580d4d866f2d5b708e455bf1f43dde72df495711a095ce0940bf134854b7c70a45393aba65021b51892210c9adf6fc0b74be5275c5a5bfc70b89ce65a251c6dc9e451e17372dac7db685f334aede8004e23e65a6262763fdd5a03e445d8e6fe3057005af3edfe62bae75c6c7b84565ad0887bb7b6cc85ad5b78e19554efc5370000dc738b7bc8df535998f5912", @generic="b0d94b1b2a6779e9a76eb43ca92ffd31a2a9c31a68eaeafa14010f440b97745e800ff95395526f2efe0147d9"]}]}, 0x704}], 0x1, &(0x7f0000002640)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0, 0x10004800}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.73922436s ago: executing program 4 (id=6093): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(0x0, r4, &(0x7f00000002c0)=@IORING_OP_WRITE={0x17, 0x0, 0x4007, @fd=r2, 0x6, 0x0, 0x0, 0xa}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c00000010003958aeeffffffcdbdf250000ef6d", @ANYRES32=r6, @ANYBLOB="216100000000000014001400726f7365300000000000000000000000280016802400018014000b"], 0x5c}}, 0x4000000) io_uring_enter(r3, 0x627, 0xc1040000, 0x43, 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000020000"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0x0, 0xffffffff, 0x10}, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) syz_emit_ethernet(0x86, &(0x7f0000000500)=ANY=[@ANYBLOB="ffffffffffff0180c200000086dd6012000800503a00fe8000000000000000000000000000bbfe8000000000000000000000000000aa03029078000000006002081000001100fc0100000000000000000000000000000000000000000000004e0000000000000000000000000000052f000100000000fb807f04442be993894b35a336eeca6f0feb58c03708bed2d66a33d98fd942965ccecb9f0d6bca090ce0dcd6112a9e7ed20ce189b196689a4751ea30e453884556ae91be84355bb92e3300559bb68c1762b8b01ca289a32a18326c5428ab0e7918874d87e7212716052bb5c3ac8e34c21f9ef8f0a9d18ae005a04dee437f877c24db08ce7d173a3e48c2aa4556a33da1042762954bff95e1c01423ea1e349660fc62387a1794d8ac593c49f5ff2af0fe34c49c5d8f28428a93ee199752a68d45a504a7781f6a2c8e3f0e0992f286892f2de88db4ae"], 0x0) socket$key(0xf, 0x3, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x30dd3000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x101040, 0x0) r9 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141082) writev(r9, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 2.580688005s ago: executing program 3 (id=6094): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x52, 0x4007, @fd=r4, 0x6, 0x0, 0x0, 0x2, 0x1}) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000040)={0x5, 0x432, 0xa00, 0x8, 0xd, "a4c42ba02a0b3b4335931f2d038553da933b3a"}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4000, 0x0, 0x0) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, {0x0, 0x4e22, [0xfffffffc, 0x0, 0xcd7e], [], 0x0, [0x1]}, 0x0, 0x2000}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "06010000"}]}, 0x54}}, 0x20000080) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="2400000076001f03000000000000000008000000ffffffff0c000d8008000300", @ANYRES32], 0x24}], 0x1}, 0x0) r10 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r10, 0x4000000000000, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x41, 0x3, 0x380, 0x0, 0x19, 0x0, 0x0, 0x0, 0x2e8, 0x1f0, 0x1f0, 0x2e8, 0x1f0, 0x3, 0x0, {[{{@ip={@private, @dev, 0x0, 0x0, 'wlan1\x00', 'wg1\x00'}, 0x0, 0x1f8, 0x218, 0x0, {0x0, 0xffffffffa0028000}, [@common=@unspec=@quota={{0x38}}, @common=@inet=@hashlimit2={{0x150}, {'veth1\x00', {0x0, 0x8, 0x0, 0x0, 0x0, 0x687c, 0x1}}}]}, @unspec=@TRACE={0x20}}, {{@ip={@empty, @empty, 0x0, 0x0, 'veth0_vlan\x00', 'netpci0\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3e0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@none}) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000006000/0x4000)=nil) 2.505930616s ago: executing program 5 (id=6095): openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/fs/binfmt_misc/syz2\x00', 0x2, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f00000006c0)={{}, {0x0, 0x9}}, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0x0, &(0x7f00000000c0)={0x9, 0x6}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000040)={0x92}, &(0x7f0000000080)) r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000b4bffc)=0xb, 0x4) write(r0, &(0x7f0000000000)='\"', 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket(0x10, 0x2, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', r5, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x80, 0xfffffffc, 0xdc64}}) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r2, 0x40049366, &(0x7f0000000280)=0x2) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000580)) pselect6(0x40, &(0x7f0000000480)={0x8, 0x1, 0x100000000000006, 0x1, 0x5, 0x4, 0xfffffffffffffffa, 0x2977}, 0x0, 0x0, 0x0, 0x0) 2.198237388s ago: executing program 3 (id=6096): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) (async, rerun: 64) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000900)={0x0, 0x0, 0x2, 0x7, 0x3, 0x3}, 0x14) (async, rerun: 64) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0x9, @local, 0x5}}, [0x6, 0x6, 0x4, 0xf, 0x4, 0x6, 0xe8, 0x2, 0x1, 0x9036, 0x3, 0x0, 0x5, 0x1, 0x7]}, &(0x7f0000000000)=0x100) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000040)={r1, 0x2, 0x30}, 0xc) (async, rerun: 64) listen(r0, 0x1ff) (rerun: 64) r2 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r2, &(0x7f0000000340)="00546f93a8bce46dfdff446fcf9f1e00000000000000000000000000f3a6c98eb5de04e6637edd0c049e71d22c737fb3e06f191c5a1bf095c7b1bf0d237d61dd2de9e8ce52e9f773490014da630cb7242c5b621378c06ff6b3af9926caf52e4e0e91d03b00"/113, 0x71, 0x50, &(0x7f0000000200)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10) (async, rerun: 32) sendto$inet(r2, &(0x7f00000000c0)="ab", 0xffe0, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) (async, rerun: 32) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000240)) (async) getsockname$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @initdev}, &(0x7f0000000300)=0x10) 2.049179011s ago: executing program 3 (id=6097): syz_emit_ethernet(0x66, &(0x7f0000000b80)=ANY=[@ANYBLOB="ffffffffffff6487a2bed3d608004500001403000000006c907800000000000000000420880b0000000000000800000086dd080088be0000000010000000010000009baf77435f616500000000080022eb000000002000800002000000000000000000000008"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x0, &(0x7f0000000000)) syz_emit_ethernet(0x2a, &(0x7f0000000500)=ANY=[@ANYBLOB="aa0180aa5ea8aaaaffffffffffff080045ffffffffff"], 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x388, 0xffffffff, 0x0, 0x1e8, 0xd0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @empty, [], [], 'macsec0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x1, 0x46}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@private0, @empty, [], [], 'sit0\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f65318776d8001e770b667f173dfa40b58c10327e3121114449fd20ba2be6e45cae72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) socket$qrtr(0x2a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) accept4(r1, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./bus/file0\x00', 0x400, 0x0) mknodat(r3, 0x0, 0x0, 0x0) open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x0) bind$alg(r0, &(0x7f0000000a00)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) eventfd2(0xffffffdc, 0x0) 1.441428201s ago: executing program 5 (id=6098): r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x800) r3 = syz_io_uring_setup(0x40eeb, &(0x7f0000000380)={0x0, 0xf4b9, 0x4000, 0x0, 0x3c8}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x0, @fd=r2, 0x73b, &(0x7f0000000500)=[{&(0x7f0000000240)=""/157, 0x9d}], 0x1, 0x0, 0x1}) io_uring_enter(r3, 0x567, 0xa9ea, 0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000008c0)=r6, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1.369950015s ago: executing program 3 (id=6099): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x5, &(0x7f0000006680)) fanotify_init(0x4, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000066c0)=@newchain={0x60d0, 0x64, 0x400, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x6, 0x2}, {0xffff, 0x9}, {0x7, 0x5}}, [@filter_kind_options=@f_flow={{0x9}, {0x8f8, 0x2, [@TCA_FLOW_ACT={0x2cc, 0x9, 0x0, 0x1, [@m_ctinfo={0xb0, 0x13, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x4}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x7}]}, {0x74, 0x6, "dc07d14e681ca7529bd4408e8034d04de8e06b371f191273af4de9871f960fff152704abe7b65c4a18da5d677686962c1d3ebc7afec3abf158da91fd0cfe2bed9ca9f7cb8b7712b5043ee57e730b4d2f02d43d3d77061f06a0e44fd850bbb1ff7a0043204dc538afa8b4e12138080c60"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_mirred={0x108, 0x12, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x9, 0x1, 0xfffffffc, 0x2}, 0x4}}]}, {0xb9, 0x6, "91e95201e3d904c8ea608eb4e3ce6c72cd89ee3743d69df40e334d3f4bef3f5e4a7f0ba96e27e914ca2d95e9dcf515aa26116b660b0b4d465327490e4e70d6e1db63e3e0fc024ec6bdae2db9c0f0f249d8fbb07fffe79c10c7447bed81eaac5811c85036e2384bae54df3cfb0b10847f46df0691a579a385333771f682041f58ed7fcefdb9dd0f391219c7298b2b4078f5cd4edd2268eb6f0c4f1ca5e217b39fd1d1d6bb41202795599582de5b4cf2df4206bd4c13"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_sample={0x110, 0x6, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8}]}, {0xdb, 0x6, "e264066181761316cf761a62b91e6854072591ab84296e7625433d36133c672a61b0aaef3a8f6d286ed683ecc3e022c7836c04223e9d5fe9fe19ef5c09a7a08a58cdd3d45c748f40b4072012e49b19b1b7d3f8c30bbb08ad7ceb341b10543e2cf578baad8e04ad0eaf7420c4ebf13a9abcc13292e00a74094fcebb500b2498084b476081d0f841699912ef8a4b734cabcf28c826f1cacdef8bdcf8ba69745dcc914bff7d95b08f35f4511c66d58562d5e75a55aac0fc8d60d63986fd3b7a5f1f5938a3c47827b3b5f9d582a3f87d72ae34f3ea54e2e31f"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_FLOW_EMATCHES={0x610, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x40, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x1800, 0x8, 0x7}, {0x2, 0x5, 0x1}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x2, 0x7, 0x3}, {{0x1, 0x1}, {0x3, 0x0, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x5, 0x1, 0x9}, {0x357bc908, 0x6, 0x0, 0x6, 0x7, 0x2}}}]}, @TCA_EMATCH_TREE_LIST={0x120, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0x7, 0x8, 0x3}, {0xffffffffffffffff, 0x6}}}, @TCF_EM_IPT={0x10c, 0x3, 0x0, 0x0, {{0xffff, 0x9, 0xe4af}, [@TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_DATA={0xd9, 0x5, "4d1251dddc119e0f291d479eba5697d38b0bc49eca575b47fc5066ec2c6f2c4e6b20d23148d0dd172cdcd9745c44338a782b5bf239cdba244f6b5b92190e3d1a43814c811f408a5659b160d29d7ad96e606c2748cdd098b2bf33871123161eed6b7d5f2e6d61aae456db42c9c5515596415df26cb15bf12508cd512366a277dad1697ea8ec6c046de59d1bd9ea7b5f072c92e29e5e3dd517e6e21b398f898b99295fefc34f6ff8c8955565b18d11f54d397c107843486dca8f0df85846dcbefdd04d277401863b673899390fef36fed23533fc5011"}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x5}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x1}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0xf8}]}}]}, @TCA_EMATCH_TREE_LIST={0xb8, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xd7, 0x7, 0x5}, {{0x4, 0x0, 0x1, 0x1}, {0x1, 0x1}}}}, @TCF_EM_CONTAINER={0xa0, 0x2, 0x0, 0x0, {{0x2, 0x0, 0x9}, "56ac2731c440e0e56753e08c84350bfbab1a5460021b4b96add23e11a7f884ca9da8efa2e273aae6ed05c641733f4236e0b0a1420346488728b7cacaab9836dc7bc0d9bca058b1cb4876a18a72a2772494d984425c5aea6a716ceb8437c10fe25a7519eea777e1b9399fbeaa715141b363fffec2a6bb7cc0f54526140408760b706d70033841e9cd6b0a98e7edbf3261edeb8a5f"}}]}, @TCA_EMATCH_TREE_LIST={0x2fc, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x14, 0x2, 0x0, 0x0, {{0x2, 0x2, 0x7}, {0xac5, 0x2, 0x3, '0xffffffffffffffff}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0089061327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x12, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000005000000000000000200000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000850000006d000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r8}, 0x10) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000800000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x31) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000100000027bf00000005"], 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x0, 0x13, r10, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42032, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000000)='tlb_flush\x00', r9}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.294888329s ago: executing program 4 (id=6100): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r0}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x8}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sched_switch\x00'}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x6) sendmsg$nl_route_sched(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=@delqdisc={0x24, 0x25, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0xe}, {0xb, 0xa}, {0x5, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20044800}, 0x4000010) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r5, 0x8, 0x1) getdents64(r5, 0x0, 0x0) 1.041097206s ago: executing program 5 (id=6101): syz_emit_ethernet(0x66, &(0x7f0000000b80)=ANY=[@ANYBLOB="ffffffffffff6487a2bed3d608004500001403000000006c907800000000000000000420880b0000000000000800000086dd080088be0000000010000000010000009baf77435f616500000000"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x0, &(0x7f0000000000)) syz_emit_ethernet(0x2a, &(0x7f0000000500)=ANY=[@ANYBLOB="aa0180aa5ea8aaaaffffffffffff080045ffffffffffffff4f5e907ce0000002e000000110009078056c0001"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x388, 0xffffffff, 0x0, 0x1e8, 0xd0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @empty, [], [], 'macsec0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x1, 0x46}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@private0, @empty, [], [], 'sit0\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f65318776d8001e770b667f173dfa40b58c10327e3121114449fd20ba2be6e45cae72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) socket$qrtr(0x2a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./bus/file0\x00', 0x400, 0x0) mknodat(r2, 0x0, 0x0, 0x0) open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000a00)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) eventfd2(0xffffffdc, 0x0) 294.220258ms ago: executing program 4 (id=6102): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc71f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x6, 0x40, 0x49, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x3, {0x9, 0x21, 0x3, 0x4, 0x1, {0x22, 0x1}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x95, 0x2, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000305"], 0x0, 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 5 (id=6103): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0, 0x0], 0x2, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r4, 0xc01464a6, &(0x7f0000000180)={r5}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xffff}, &(0x7f0000000040)=0x8) shutdown(0xffffffffffffffff, 0x1) kernel console output (not intermixed with test programs): b3d8e929 [ 1544.724018][T26436] RDX: 0000200000000180 RSI: 0000000000004b4a RDI: 0000000000000003 [ 1544.724028][T26436] RBP: 00007feab4b8b090 R08: 0000000000000000 R09: 0000000000000000 [ 1544.724036][T26436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1544.724045][T26436] R13: 0000000000000000 R14: 00007feab3fb5fa0 R15: 00007fff88e2fca8 [ 1544.724065][T26436] [ 1544.733493][ T6134] udevd[6134]: setting owner of /dev/vcsa4 to uid=0, gid=5 failed: Read-only file system [ 1544.736452][ T5993] udevd[5993]: setting owner of /dev/vcs4 to uid=0, gid=5 failed: Read-only file system [ 1544.798309][ T6637] udevd[6637]: setting owner of /dev/vcsu4 to uid=0, gid=5 failed: Read-only file system [ 1545.601209][T26454] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input228 [ 1545.690208][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.707314][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.850339][ T974] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1546.482059][T26458] Cannot find add_set index 0 as target [ 1546.883923][T26463] bio_check_eod: 4 callbacks suppressed [ 1546.883939][T26463] syz.5.5389: attempt to access beyond end of device [ 1546.883939][T26463] nbd5: rw=0, sector=64, nr_sectors = 1 limit=0 [ 1546.904811][T26463] syz.5.5389: attempt to access beyond end of device [ 1546.904811][T26463] nbd5: rw=0, sector=256, nr_sectors = 1 limit=0 [ 1546.919073][ T974] usb 5-1: no configurations [ 1546.919961][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1546.940377][T26463] syz.5.5389: attempt to access beyond end of device [ 1546.940377][T26463] nbd5: rw=0, sector=512, nr_sectors = 1 limit=0 [ 1546.944495][ T974] usb 5-1: can't read configurations, error -22 [ 1546.963501][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1546.974884][T26463] syz.5.5389: attempt to access beyond end of device [ 1546.974884][T26463] nbd5: rw=0, sector=64, nr_sectors = 2 limit=0 [ 1546.988618][T26463] syz.5.5389: attempt to access beyond end of device [ 1546.988618][T26463] nbd5: rw=0, sector=512, nr_sectors = 2 limit=0 [ 1547.015106][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1547.024817][T26463] syz.5.5389: attempt to access beyond end of device [ 1547.024817][T26463] nbd5: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 1547.045938][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1547.059062][T26463] syz.5.5389: attempt to access beyond end of device [ 1547.059062][T26463] nbd5: rw=0, sector=64, nr_sectors = 4 limit=0 [ 1547.073282][T26463] syz.5.5389: attempt to access beyond end of device [ 1547.073282][T26463] nbd5: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 1547.092210][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1547.103513][T26463] syz.5.5389: attempt to access beyond end of device [ 1547.103513][T26463] nbd5: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 1547.118005][ T5908] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1547.129631][ T974] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1547.155954][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1547.175466][T26473] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1547.188883][T26463] syz.5.5389: attempt to access beyond end of device [ 1547.188883][T26463] nbd5: rw=0, sector=64, nr_sectors = 8 limit=0 [ 1547.204813][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1547.219123][T26463] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1547.235375][T26463] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 1547.292326][ T5908] usb 4-1: Using ep0 maxpacket: 32 [ 1547.293191][ T974] usb 5-1: no configurations [ 1547.305519][ T974] usb 5-1: can't read configurations, error -22 [ 1547.315293][ T5908] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1547.325757][ T5908] usb 4-1: config 8 has an invalid interface number: 1 but max is 0 [ 1547.336384][ T5908] usb 4-1: config 8 has no interface number 0 [ 1547.424857][ T974] usb usb5-port1: attempt power cycle [ 1547.430303][ T5908] usb 4-1: config 8 interface 1 has no altsetting 0 [ 1547.440965][ T5908] usb 4-1: string descriptor 0 read error: -22 [ 1547.447220][ T5908] usb 4-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 1547.456509][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.474434][ T5908] gspca_main: spca505-2.14.0 probing 0733:0430 [ 1547.551247][ T5881] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1547.579154][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 1547.579168][ T30] audit: type=1400 audit(1752794422.846:3146): avc: denied { create } for pid=26485 comm="syz.5.5398" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1547.606071][ C0] vkms_vblank_simulate: vblank timer overrun [ 1547.618911][ T30] audit: type=1400 audit(1752794422.886:3147): avc: denied { read } for pid=26485 comm="syz.5.5398" name="file0" dev="tmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1547.641252][ C0] vkms_vblank_simulate: vblank timer overrun [ 1547.702019][ T8082] udevd[8082]: setting mode of /dev/vcsa2 to 020660 failed: Read-only file system [ 1547.703501][ T30] audit: type=1400 audit(1752794422.886:3148): avc: denied { open } for pid=26485 comm="syz.5.5398" path="/93/file0" dev="tmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1547.711641][ T8082] udevd[8082]: setting owner of /dev/vcsa2 to uid=0, gid=5 failed: Read-only file system [ 1547.748470][ T6134] udevd[6134]: setting mode of /dev/vcsu2 to 020660 failed: Read-only file system [ 1547.795728][ T6637] udevd[6637]: setting mode of /dev/vcs2 to 020660 failed: Read-only file system [ 1547.802380][ T974] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1547.812649][ T5881] usb 3-1: Using ep0 maxpacket: 32 [ 1547.822305][ T5881] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1547.831595][ T5881] usb 3-1: config 8 has an invalid interface number: 1 but max is 0 [ 1547.840538][ T974] usb 5-1: no configurations [ 1547.845200][ T974] usb 5-1: can't read configurations, error -22 [ 1547.868387][ T5881] usb 3-1: config 8 has no interface number 0 [ 1547.875845][ T5881] usb 3-1: config 8 interface 1 has no altsetting 0 [ 1548.287037][T26492] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.295913][T26492] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.304796][T26492] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.313684][T26492] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1548.373335][ T5908] gspca_spca505: reg write: error -110 [ 1548.382359][ T5908] spca505 4-1:8.1: probe with driver spca505 failed with error -5 [ 1548.412528][ T5881] usb 3-1: string descriptor 0 read error: -22 [ 1548.419821][ T5881] usb 3-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 1548.429624][ T974] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1548.439163][ T5881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1548.463828][ T5881] gspca_main: spca505-2.14.0 probing 0733:0430 [ 1548.665729][ T974] usb 5-1: device not accepting address 52, error -71 [ 1548.676627][ T974] usb usb5-port1: unable to enumerate USB device [ 1549.110389][ T5881] gspca_spca505: reg write: error -110 [ 1549.190210][ T915] usb 4-1: USB disconnect, device number 77 [ 1549.458083][ T5881] spca505 3-1:8.1: probe with driver spca505 failed with error -5 [ 1550.281392][ T915] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1550.946011][ T915] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1550.958717][ T915] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1550.968787][ T915] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1550.978285][ T915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1550.989319][ T915] usb 6-1: config 0 descriptor?? [ 1551.008121][T13737] usb 3-1: USB disconnect, device number 58 [ 1551.275678][T26541] netlink: 176 bytes leftover after parsing attributes in process `syz.0.5411'. [ 1551.760042][T26541] netlink: 176 bytes leftover after parsing attributes in process `syz.0.5411'. [ 1551.761974][ T915] cp2112 0003:10C4:EA90.0031: unknown main item tag 0x0 [ 1551.782921][ T974] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1551.940289][ T974] usb 5-1: no configurations [ 1551.957372][T26547] lo: entered allmulticast mode [ 1552.451256][ T974] usb 5-1: can't read configurations, error -22 [ 1552.814422][ T915] cp2112 0003:10C4:EA90.0031: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 1552.871682][ T974] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1552.880058][T26551] FAULT_INJECTION: forcing a failure. [ 1552.880058][T26551] name failslab, interval 1, probability 0, space 0, times 0 [ 1552.890147][ T915] cp2112 0003:10C4:EA90.0031: Part Number: 0x82 Device Version: 0xFE [ 1552.947215][T26551] CPU: 0 UID: 0 PID: 26551 Comm: syz.2.5414 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1552.947231][T26551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1552.947237][T26551] Call Trace: [ 1552.947243][T26551] [ 1552.947249][T26551] dump_stack_lvl+0x16c/0x1f0 [ 1552.947279][T26551] should_fail_ex+0x512/0x640 [ 1552.947303][T26551] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1552.947328][T26551] should_failslab+0xc2/0x120 [ 1552.947339][T26551] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1552.947357][T26551] ? __alloc_skb+0x2b2/0x380 [ 1552.947375][T26551] __alloc_skb+0x2b2/0x380 [ 1552.947394][T26551] ? __pfx___alloc_skb+0x10/0x10 [ 1552.947419][T26551] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1552.947441][T26551] netlink_alloc_large_skb+0x69/0x130 [ 1552.947460][T26551] netlink_sendmsg+0x6a1/0xdd0 [ 1552.947477][T26551] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1552.947494][T26551] ____sys_sendmsg+0xa95/0xc70 [ 1552.947506][T26551] ? copy_msghdr_from_user+0x10a/0x160 [ 1552.947523][T26551] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1552.947551][T26551] ___sys_sendmsg+0x134/0x1d0 [ 1552.947577][T26551] ? __pfx____sys_sendmsg+0x10/0x10 [ 1552.947605][T26551] ? __lock_acquire+0x622/0x1c90 [ 1552.947633][T26551] __sys_sendmsg+0x16d/0x220 [ 1552.947650][T26551] ? __pfx___sys_sendmsg+0x10/0x10 [ 1552.947680][T26551] do_syscall_64+0xcd/0x4c0 [ 1552.947699][T26551] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1552.947716][T26551] RIP: 0033:0x7fe49d78e929 [ 1552.947729][T26551] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1552.947744][T26551] RSP: 002b:00007fe49b5f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1552.947759][T26551] RAX: ffffffffffffffda RBX: 00007fe49d9b5fa0 RCX: 00007fe49d78e929 [ 1552.947767][T26551] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000007 [ 1552.947773][T26551] RBP: 00007fe49b5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1552.947779][T26551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1552.947785][T26551] R13: 0000000000000000 R14: 00007fe49d9b5fa0 R15: 00007ffcc1591048 [ 1552.947798][T26551] [ 1553.182452][ T915] cp2112 0003:10C4:EA90.0031: error setting SMBus config [ 1553.191022][ T915] cp2112 0003:10C4:EA90.0031: probe with driver cp2112 failed with error -71 [ 1553.232117][ T915] usb 6-1: USB disconnect, device number 111 [ 1553.527366][ T974] usb 5-1: no configurations [ 1553.540464][ T974] usb 5-1: can't read configurations, error -22 [ 1553.547180][ T974] usb usb5-port1: attempt power cycle [ 1553.567269][T26549] fido_id[26549]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1554.029710][ T974] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1554.300190][ T974] usb 5-1: device descriptor read/8, error -71 [ 1554.389627][ T915] usb 3-1: new full-speed USB device number 59 using dummy_hcd [ 1554.587046][T26577] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5422'. [ 1554.654919][ T915] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1554.680084][ T915] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 1554.728917][ T915] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 65327, setting to 64 [ 1555.040784][ T915] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1555.051417][ T915] usb 3-1: New USB device strings: Mfr=0, Product=3, SerialNumber=0 [ 1555.062726][ T915] usb 3-1: Product: syz [ 1555.081406][T26564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1555.088917][T26564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1555.106648][ T915] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1555.239863][T13737] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1555.379647][ T5908] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1555.439682][T13737] usb 4-1: Using ep0 maxpacket: 8 [ 1555.477280][T26590] netlink: 'syz.4.5428': attribute type 4 has an invalid length. [ 1555.485118][T26590] netlink: 17 bytes leftover after parsing attributes in process `syz.4.5428'. [ 1555.597057][T13737] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1555.632792][T13737] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.651654][T13737] usb 4-1: Product: syz [ 1555.655914][T13737] usb 4-1: Manufacturer: syz [ 1555.672114][T13737] usb 4-1: SerialNumber: syz [ 1555.776797][T13737] usb 4-1: config 0 descriptor?? [ 1555.849836][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 1555.856132][ T5908] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 1555.864288][ T5908] usb 6-1: config 0 has no interface number 0 [ 1555.870423][ T5908] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1555.880392][ T5908] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1555.890547][ T5908] usb 6-1: config 0 interface 41 has no altsetting 0 [ 1555.899076][ T5908] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 1555.908472][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.916502][ T5908] usb 6-1: Product: syz [ 1555.920702][ T5908] usb 6-1: Manufacturer: syz [ 1555.925295][ T5908] usb 6-1: SerialNumber: syz [ 1555.932953][ T5908] usb 6-1: config 0 descriptor?? [ 1555.938414][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1555.945885][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1556.011818][ T974] usb 3-1: USB disconnect, device number 59 [ 1556.031289][T13737] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 1556.047317][T13737] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1556.082323][T13737] usb 4-1: USB disconnect, device number 78 [ 1556.176258][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1556.184152][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1556.210571][T26596] binder: 26594:26596 ioctl 4018620d 0 returned -22 [ 1556.219199][T26596] binder: 26594:26596 ioctl c0306201 2000000001c0 returned -22 [ 1556.264183][T26598] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5432'. [ 1556.274764][ T30] audit: type=1400 audit(1752794431.546:3149): avc: denied { listen } for pid=26597 comm="syz.2.5432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1556.449704][ T8152] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1556.623921][ T5908] Error reading MAC address [ 1556.633122][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1556.649069][T26584] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1556.697553][ T8152] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1557.656746][ T8152] usb 5-1: config 0 has no interfaces? [ 1557.663062][ T8152] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1557.672338][ T8152] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1557.688725][ T8152] usb 5-1: config 0 descriptor?? [ 1558.004682][ T8152] usb 5-1: USB disconnect, device number 57 [ 1558.186503][T26612] FAULT_INJECTION: forcing a failure. [ 1558.186503][T26612] name failslab, interval 1, probability 0, space 0, times 0 [ 1558.209579][T26612] CPU: 0 UID: 0 PID: 26612 Comm: syz.0.5435 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1558.209604][T26612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1558.209615][T26612] Call Trace: [ 1558.209621][T26612] [ 1558.209627][T26612] dump_stack_lvl+0x16c/0x1f0 [ 1558.209658][T26612] should_fail_ex+0x512/0x640 [ 1558.209683][T26612] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1558.209713][T26612] should_failslab+0xc2/0x120 [ 1558.209730][T26612] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1558.209757][T26612] ? __alloc_skb+0x2b2/0x380 [ 1558.209787][T26612] __alloc_skb+0x2b2/0x380 [ 1558.209812][T26612] ? __pfx___alloc_skb+0x10/0x10 [ 1558.209840][T26612] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1558.209864][T26612] netlink_alloc_large_skb+0x69/0x130 [ 1558.209885][T26612] netlink_sendmsg+0x6a1/0xdd0 [ 1558.209909][T26612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1558.209938][T26612] ____sys_sendmsg+0xa95/0xc70 [ 1558.209959][T26612] ? copy_msghdr_from_user+0x10a/0x160 [ 1558.209985][T26612] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1558.210017][T26612] ___sys_sendmsg+0x134/0x1d0 [ 1558.210044][T26612] ? __pfx____sys_sendmsg+0x10/0x10 [ 1558.210069][T26612] ? __lock_acquire+0x622/0x1c90 [ 1558.210115][T26612] __sys_sendmsg+0x16d/0x220 [ 1558.210143][T26612] ? __pfx___sys_sendmsg+0x10/0x10 [ 1558.210185][T26612] do_syscall_64+0xcd/0x4c0 [ 1558.210203][T26612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1558.210221][T26612] RIP: 0033:0x7fe412d8e929 [ 1558.210235][T26612] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1558.210252][T26612] RSP: 002b:00007fe413bd3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1558.210268][T26612] RAX: ffffffffffffffda RBX: 00007fe412fb6080 RCX: 00007fe412d8e929 [ 1558.210280][T26612] RDX: 0000000004000010 RSI: 0000200000000480 RDI: 0000000000000006 [ 1558.210290][T26612] RBP: 00007fe413bd3090 R08: 0000000000000000 R09: 0000000000000000 [ 1558.210300][T26612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1558.210310][T26612] R13: 0000000000000000 R14: 00007fe412fb6080 R15: 00007ffd23b72eb8 [ 1558.210334][T26612] [ 1558.598735][ T5908] sr9700 6-1:0.41 eth5: register 'sr9700' at usb-dummy_hcd.5-1, CoreChip SR9700 USB Ethernet, d6:2e:d9:6f:2e:b1 [ 1558.611981][ T5908] usb 6-1: USB disconnect, device number 112 [ 1558.618721][ T5908] sr9700 6-1:0.41 eth5: unregister 'sr9700' usb-dummy_hcd.5-1, CoreChip SR9700 USB Ethernet [ 1559.335282][T26621] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5437'. [ 1559.737730][ T30] audit: type=1400 audit(1752794434.986:3150): avc: denied { recv } for pid=0 comm="swapper/0" saddr=10.128.0.169 src=45344 daddr=10.128.1.245 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1559.966926][T26624] block device autoloading is deprecated and will be removed. [ 1559.977398][T26635] binder: 26634:26635 ioctl 4018620d 0 returned -22 [ 1559.986125][T26635] binder: 26634:26635 ioctl c0306201 2000000001c0 returned -22 [ 1559.991870][T26624] bio_check_eod: 2 callbacks suppressed [ 1559.991882][T26624] syz.0.5438: attempt to access beyond end of device [ 1559.991882][T26624] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1560.146844][T26640] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5443'. [ 1560.176141][T26640] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5443'. [ 1560.210014][ T915] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1560.377580][T26641] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5444'. [ 1560.426156][T26641] fuse: Unknown parameter 'Fe' [ 1560.502503][ T915] usb 4-1: config 8 has an invalid interface number: 80 but max is 0 [ 1560.523651][ T915] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1560.585552][ T915] usb 4-1: config 8 has no interface number 0 [ 1560.693653][ T915] usb 4-1: config 8 interface 80 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 14 [ 1560.823087][ T915] usb 4-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=c1.6f [ 1560.849259][ T915] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.875813][ T915] usb 4-1: NFC: intf ffff88803620d000 id ffffffff8f5610e0 [ 1560.941597][ T30] audit: type=1400 audit(1752794436.216:3151): avc: denied { listen } for pid=26649 comm="syz.2.5446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1561.171734][ T8152] usb 4-1: USB disconnect, device number 79 [ 1561.305542][ T30] audit: type=1400 audit(1752794436.566:3152): avc: denied { bind } for pid=26649 comm="syz.2.5446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1561.332716][ T30] audit: type=1400 audit(1752794436.566:3153): avc: denied { accept } for pid=26649 comm="syz.2.5446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1561.871585][T26664] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5450'. [ 1563.435365][T26681] binder: 26680:26681 ioctl 4018620d 0 returned -22 [ 1563.510980][T26681] binder: 26680:26681 ioctl c0306201 2000000001c0 returned -22 [ 1563.782655][T26685] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5455'. [ 1565.595150][T26706] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input230 [ 1566.437805][T26721] binder: BINDER_SET_CONTEXT_MGR already set [ 1566.443959][T26721] binder: 26720:26721 ioctl 4018620d 200000000040 returned -16 [ 1566.464426][T26721] binder: 26720:26721 ioctl c0306201 2000000001c0 returned -22 [ 1566.481481][T26722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5465'. [ 1567.088933][T26729] overlayfs: failed to clone upperpath [ 1567.293224][T26735] FAULT_INJECTION: forcing a failure. [ 1567.293224][T26735] name failslab, interval 1, probability 0, space 0, times 0 [ 1567.307610][T26735] CPU: 0 UID: 0 PID: 26735 Comm: syz.5.5470 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1567.307634][T26735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1567.307645][T26735] Call Trace: [ 1567.307651][T26735] [ 1567.307658][T26735] dump_stack_lvl+0x16c/0x1f0 [ 1567.307691][T26735] should_fail_ex+0x512/0x640 [ 1567.307721][T26735] should_failslab+0xc2/0x120 [ 1567.307740][T26735] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1567.307766][T26735] ? skb_clone+0x190/0x3f0 [ 1567.307787][T26735] skb_clone+0x190/0x3f0 [ 1567.307804][T26735] netlink_deliver_tap+0xabd/0xd30 [ 1567.307829][T26735] netlink_unicast+0x62f/0x850 [ 1567.307853][T26735] ? __pfx_netlink_unicast+0x10/0x10 [ 1567.307880][T26735] netlink_sendmsg+0x8d1/0xdd0 [ 1567.307904][T26735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1567.307933][T26735] ____sys_sendmsg+0xa95/0xc70 [ 1567.307955][T26735] ? copy_msghdr_from_user+0x10a/0x160 [ 1567.307982][T26735] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1567.308016][T26735] ___sys_sendmsg+0x134/0x1d0 [ 1567.308044][T26735] ? __pfx____sys_sendmsg+0x10/0x10 [ 1567.308069][T26735] ? __lock_acquire+0x622/0x1c90 [ 1567.308119][T26735] __sys_sendmsg+0x16d/0x220 [ 1567.308146][T26735] ? __pfx___sys_sendmsg+0x10/0x10 [ 1567.308196][T26735] do_syscall_64+0xcd/0x4c0 [ 1567.308215][T26735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.308233][T26735] RIP: 0033:0x7effc458e929 [ 1567.308247][T26735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1567.308263][T26735] RSP: 002b:00007effc539e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1567.308280][T26735] RAX: ffffffffffffffda RBX: 00007effc47b5fa0 RCX: 00007effc458e929 [ 1567.308292][T26735] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000007 [ 1567.308303][T26735] RBP: 00007effc539e090 R08: 0000000000000000 R09: 0000000000000000 [ 1567.308313][T26735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1567.308323][T26735] R13: 0000000000000000 R14: 00007effc47b5fa0 R15: 00007ffef04c05e8 [ 1567.308348][T26735] [ 1567.519601][ T8152] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1567.587595][T26736] fuse: Bad value for 'fd' [ 1568.095032][ T8152] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1568.136546][ T8152] usb 4-1: config 0 has no interfaces? [ 1568.187345][ T8152] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1568.314562][ T8152] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1568.429241][ T8152] usb 4-1: config 0 descriptor?? [ 1568.526100][T26747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5475'. [ 1568.905879][ T8152] usb 4-1: USB disconnect, device number 80 [ 1568.912339][T26755] binder: 26746:26755 ioctl c05c6104 2000000004c0 returned -22 [ 1568.960497][T26755] binder_alloc: 26746: binder_alloc_buf, no vma [ 1569.398255][T26747] binder: 26746:26747 ioctl c01064c1 2000000001c0 returned -22 [ 1569.556704][T26764] binder: BINDER_SET_CONTEXT_MGR already set [ 1569.562729][T26764] binder: 26759:26764 ioctl 4018620d 200000000040 returned -16 [ 1569.574543][T26764] binder: 26759:26764 ioctl c0306201 2000000001c0 returned -22 [ 1570.397810][T26769] 9pnet_fd: p9_fd_create_unix (26769): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1570.403923][T26773] 9pnet_fd: p9_fd_create_unix (26773): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1570.495179][ C1] vkms_vblank_simulate: vblank timer overrun [ 1570.586824][ C1] vkms_vblank_simulate: vblank timer overrun [ 1570.848566][T26780] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5483'. [ 1570.886592][T26780] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5483'. [ 1571.342866][T26790] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5485'. [ 1571.352561][T26790] FAULT_INJECTION: forcing a failure. [ 1571.352561][T26790] name failslab, interval 1, probability 0, space 0, times 0 [ 1571.359572][ T8152] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 1571.368795][T26790] CPU: 0 UID: 0 PID: 26790 Comm: syz.3.5485 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1571.368817][T26790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1571.368826][T26790] Call Trace: [ 1571.368831][T26790] [ 1571.368838][T26790] dump_stack_lvl+0x16c/0x1f0 [ 1571.368866][T26790] should_fail_ex+0x512/0x640 [ 1571.368892][T26790] should_failslab+0xc2/0x120 [ 1571.368908][T26790] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1571.368931][T26790] ? __alloc_skb+0x2b2/0x380 [ 1571.368956][T26790] __alloc_skb+0x2b2/0x380 [ 1571.368977][T26790] ? __pfx___alloc_skb+0x10/0x10 [ 1571.368997][T26790] ? _printk+0xc7/0x100 [ 1571.369019][T26790] xfrm_get_spdinfo+0x157/0xa40 [ 1571.369039][T26790] ? rcu_is_watching+0x12/0xc0 [ 1571.369058][T26790] ? do_trace_netlink_extack+0x164/0x1e0 [ 1571.369084][T26790] ? __pfx_xfrm_get_spdinfo+0x10/0x10 [ 1571.369105][T26790] ? __pfx___nla_validate_parse+0x10/0x10 [ 1571.369125][T26790] ? cap_capable+0xb3/0x250 [ 1571.369154][T26790] ? __nla_parse+0x40/0x60 [ 1571.369171][T26790] ? __pfx_xfrm_get_spdinfo+0x10/0x10 [ 1571.369192][T26790] xfrm_user_rcv_msg+0x58b/0xc00 [ 1571.369216][T26790] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1571.369233][T26790] ? finish_task_switch.isra.0+0x21c/0xc10 [ 1571.369254][T26790] ? rcu_is_watching+0x12/0xc0 [ 1571.369272][T26790] ? finish_task_switch.isra.0+0x221/0xc10 [ 1571.369291][T26790] ? lockdep_hardirqs_on+0x7c/0x110 [ 1571.369314][T26790] ? finish_task_switch.isra.0+0x221/0xc10 [ 1571.369361][T26790] ? __pfx___might_resched+0x10/0x10 [ 1571.369383][T26790] ? rcu_is_watching+0x12/0xc0 [ 1571.369406][T26790] netlink_rcv_skb+0x158/0x420 [ 1571.369422][T26790] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1571.369442][T26790] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1571.369458][T26790] ? __pfx___mutex_lock+0x10/0x10 [ 1571.369490][T26790] xfrm_netlink_rcv+0x71/0x90 [ 1571.369507][T26790] netlink_unicast+0x58a/0x850 [ 1571.369531][T26790] ? __pfx_netlink_unicast+0x10/0x10 [ 1571.369555][T26790] netlink_sendmsg+0x8d1/0xdd0 [ 1571.369575][T26790] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1571.369600][T26790] ____sys_sendmsg+0xa95/0xc70 [ 1571.369619][T26790] ? copy_msghdr_from_user+0x10a/0x160 [ 1571.369640][T26790] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1571.369668][T26790] ___sys_sendmsg+0x134/0x1d0 [ 1571.369692][T26790] ? __pfx____sys_sendmsg+0x10/0x10 [ 1571.369712][T26790] ? __lock_acquire+0x622/0x1c90 [ 1571.369754][T26790] __sys_sendmsg+0x16d/0x220 [ 1571.369776][T26790] ? __pfx___sys_sendmsg+0x10/0x10 [ 1571.369796][T26790] ? __pfx___schedule+0x10/0x10 [ 1571.369831][T26790] do_syscall_64+0xcd/0x4c0 [ 1571.369846][T26790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1571.369861][T26790] RIP: 0033:0x7f893978e929 [ 1571.369874][T26790] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1571.369888][T26790] RSP: 002b:00007f893a5fb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1571.369904][T26790] RAX: ffffffffffffffda RBX: 00007f89399b6080 RCX: 00007f893978e929 [ 1571.369913][T26790] RDX: 0000000004000010 RSI: 0000200000000480 RDI: 0000000000000006 [ 1571.369923][T26790] RBP: 00007f893a5fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1571.369932][T26790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1571.369940][T26790] R13: 0000000000000000 R14: 00007f89399b6080 R15: 00007fff9f229448 [ 1571.369961][T26790] [ 1572.080211][ T30] audit: type=1400 audit(1752794447.316:3154): avc: denied { setopt } for pid=26797 comm="syz.3.5489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1572.125073][ T8152] usb 3-1: config 0 has an invalid interface number: 120 but max is 0 [ 1572.126138][ T30] audit: type=1400 audit(1752794447.316:3155): avc: denied { accept } for pid=26797 comm="syz.3.5489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1572.141159][ T8152] usb 3-1: config 0 has no interface number 0 [ 1572.337383][ T30] audit: type=1400 audit(1752794447.326:3156): avc: denied { shutdown } for pid=26797 comm="syz.3.5489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1572.361995][ T8152] usb 3-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1572.435345][T26805] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5490'. [ 1572.898154][ T8152] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid maxpacket 12336, setting to 64 [ 1572.910701][ T8152] usb 3-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 1572.919885][ T8152] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.941010][ T8152] usb 3-1: config 0 descriptor?? [ 1573.091832][T26807] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5491'. [ 1573.135426][ T8152] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.120/input/input231 [ 1573.702212][ T974] usb 3-1: USB disconnect, device number 60 [ 1573.991401][T26823] overlayfs: failed to clone upperpath [ 1574.625440][ T10] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1574.666972][T26828] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5497'. [ 1574.757461][T26828] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5497'. [ 1575.051197][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 1575.071097][ T30] audit: type=1400 audit(1752794450.336:3157): avc: denied { associate } for pid=26834 comm="syz.4.5499" name="file0" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 1575.139181][ T10] usb 6-1: too many configurations: 211, using maximum allowed: 8 [ 1575.148178][ T30] audit: type=1400 audit(1752794450.366:3158): avc: denied { mounton } for pid=26834 comm="syz.4.5499" path="/file0" dev="rootfs" ino=103492 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 1575.171594][ T30] audit: type=1400 audit(1752794450.366:3159): avc: denied { setattr } for pid=26834 comm="syz.4.5499" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1575.183585][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1575.195946][ T30] audit: type=1400 audit(1752794450.366:3160): avc: denied { write } for pid=26834 comm="syz.4.5499" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1575.282165][ T10] usb 6-1: can't read configurations, error -61 [ 1575.307626][ T30] audit: type=1400 audit(1752794450.366:3161): avc: denied { open } for pid=26834 comm="syz.4.5499" path="/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1575.329511][ C0] vkms_vblank_simulate: vblank timer overrun [ 1575.353287][T26848] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5504'. [ 1575.364888][T26848] overlayfs: failed to clone upperpath [ 1575.377868][T26848] overlayfs: failed to clone upperpath [ 1575.407672][T26850] mac80211_hwsim hwsim21 wlan1: entered allmulticast mode [ 1575.420898][ T10] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1575.511137][T22794] Bluetooth: hci5: ACL packet for unknown connection handle 200 [ 1576.097353][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 1576.183049][ T10] usb 6-1: too many configurations: 211, using maximum allowed: 8 [ 1576.360906][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1576.368497][ T10] usb 6-1: can't read configurations, error -61 [ 1576.387548][ T10] usb usb6-port1: attempt power cycle [ 1576.569452][ T5881] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1576.705589][ T5908] usb 3-1: new full-speed USB device number 61 using dummy_hcd [ 1576.769630][ T10] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1577.028432][ T5881] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1577.045376][ T5881] usb 4-1: can't read configurations, error -61 [ 1577.061516][ T10] usb 6-1: device descriptor read/8, error -71 [ 1577.172416][ T5908] usb 3-1: config 0 has an invalid interface number: 120 but max is 0 [ 1577.180701][ T5908] usb 3-1: config 0 has no interface number 0 [ 1577.187087][ T5908] usb 3-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1577.198869][ T5881] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1577.206660][ T5908] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid maxpacket 12336, setting to 64 [ 1577.218053][ T5908] usb 3-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 1577.227204][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1577.237033][ T5908] usb 3-1: config 0 descriptor?? [ 1577.255706][ T5908] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.120/input/input232 [ 1577.345623][ T30] audit: type=1400 audit(1752794452.536:3162): avc: denied { accept } for pid=26875 comm="syz.4.5516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1577.472943][ T5881] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1577.497388][ T5881] usb 4-1: can't read configurations, error -61 [ 1577.504072][ T5881] usb usb4-port1: attempt power cycle [ 1577.509708][ T10] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1577.530009][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 1577.536432][ T10] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 1577.546831][ T10] usb 6-1: config 0 has no interface number 0 [ 1577.555673][ T10] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1577.567599][ T8152] usb 3-1: USB disconnect, device number 61 [ 1577.571887][ T10] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1577.585443][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.602785][ T10] usb 6-1: Product: syz [ 1577.608863][ T10] usb 6-1: Manufacturer: syz [ 1577.614091][ T10] usb 6-1: SerialNumber: syz [ 1577.639331][ T10] usb 6-1: config 0 descriptor?? [ 1577.655584][ T10] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1577.680382][ T10] em28xx 6-1:0.132: Video interface 132 found: [ 1577.892699][ T5881] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1577.925605][ T5881] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1577.938352][ T5881] usb 4-1: can't read configurations, error -61 [ 1578.069642][ T5881] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1578.093729][ T5881] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1578.101674][ T5881] usb 4-1: can't read configurations, error -61 [ 1578.108731][ T10] em28xx 6-1:0.132: chip ID is em28178 [ 1578.116976][ T5881] usb usb4-port1: unable to enumerate USB device [ 1578.229200][T26889] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5518'. [ 1578.239079][T26889] FAULT_INJECTION: forcing a failure. [ 1578.239079][T26889] name failslab, interval 1, probability 0, space 0, times 0 [ 1578.252250][T26889] CPU: 0 UID: 0 PID: 26889 Comm: syz.2.5518 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1578.252273][T26889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1578.252280][T26889] Call Trace: [ 1578.252284][T26889] [ 1578.252288][T26889] dump_stack_lvl+0x16c/0x1f0 [ 1578.252312][T26889] should_fail_ex+0x512/0x640 [ 1578.252335][T26889] should_failslab+0xc2/0x120 [ 1578.252346][T26889] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1578.252363][T26889] ? skb_clone+0x190/0x3f0 [ 1578.252376][T26889] skb_clone+0x190/0x3f0 [ 1578.252386][T26889] netlink_deliver_tap+0xabd/0xd30 [ 1578.252401][T26889] netlink_unicast+0x702/0x850 [ 1578.252415][T26889] ? __pfx_netlink_unicast+0x10/0x10 [ 1578.252427][T26889] ? __asan_memcpy+0x3c/0x60 [ 1578.252444][T26889] xfrm_get_spdinfo+0x67a/0xa40 [ 1578.252463][T26889] ? __pfx_xfrm_get_spdinfo+0x10/0x10 [ 1578.252479][T26889] ? irqentry_exit+0x3b/0x90 [ 1578.252500][T26889] ? xfrm_user_rcv_msg+0x4f8/0xc00 [ 1578.252513][T26889] ? xfrm_user_rcv_msg+0x52c/0xc00 [ 1578.252525][T26889] ? __pfx_xfrm_get_spdinfo+0x10/0x10 [ 1578.252541][T26889] xfrm_user_rcv_msg+0x58b/0xc00 [ 1578.252557][T26889] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1578.252569][T26889] ? preempt_schedule_thunk+0x16/0x30 [ 1578.252584][T26889] ? preempt_schedule_common+0x44/0xc0 [ 1578.252601][T26889] ? preempt_schedule_thunk+0x16/0x30 [ 1578.252630][T26889] ? __pfx___might_resched+0x10/0x10 [ 1578.252645][T26889] ? rcu_is_watching+0x12/0xc0 [ 1578.252662][T26889] netlink_rcv_skb+0x158/0x420 [ 1578.252674][T26889] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1578.252688][T26889] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1578.252699][T26889] ? __pfx___mutex_lock+0x10/0x10 [ 1578.252718][T26889] xfrm_netlink_rcv+0x71/0x90 [ 1578.252729][T26889] netlink_unicast+0x58a/0x850 [ 1578.252743][T26889] ? __pfx_netlink_unicast+0x10/0x10 [ 1578.252759][T26889] netlink_sendmsg+0x8d1/0xdd0 [ 1578.252773][T26889] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1578.252790][T26889] ____sys_sendmsg+0xa95/0xc70 [ 1578.252803][T26889] ? copy_msghdr_from_user+0x10a/0x160 [ 1578.252820][T26889] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1578.252839][T26889] ___sys_sendmsg+0x134/0x1d0 [ 1578.252856][T26889] ? __pfx____sys_sendmsg+0x10/0x10 [ 1578.252872][T26889] ? __lock_acquire+0x622/0x1c90 [ 1578.252899][T26889] __sys_sendmsg+0x16d/0x220 [ 1578.252916][T26889] ? __pfx___sys_sendmsg+0x10/0x10 [ 1578.252942][T26889] do_syscall_64+0xcd/0x4c0 [ 1578.252953][T26889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1578.252963][T26889] RIP: 0033:0x7fe49d78e929 [ 1578.252972][T26889] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1578.252983][T26889] RSP: 002b:00007fe49b5d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1578.252993][T26889] RAX: ffffffffffffffda RBX: 00007fe49d9b6080 RCX: 00007fe49d78e929 [ 1578.253000][T26889] RDX: 0000000004000010 RSI: 0000200000000480 RDI: 0000000000000006 [ 1578.253006][T26889] RBP: 00007fe49b5d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1578.253012][T26889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1578.253018][T26889] R13: 0000000000000000 R14: 00007fe49d9b6080 R15: 00007ffcc1591048 [ 1578.253032][T26889] [ 1579.073062][ T10] em28xx 6-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 1579.085759][ T10] em28xx 6-1:0.132: board has no eeprom [ 1579.244204][ T5881] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1579.332030][T26897] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input233 [ 1579.761344][ T5881] usb 3-1: device descriptor read/64, error -71 [ 1579.769637][ T10] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1579.777704][ T10] em28xx 6-1:0.132: analog set to bulk mode. [ 1579.783968][T26230] em28xx 6-1:0.132: Registering V4L2 extension [ 1579.799812][ T10] usb 6-1: USB disconnect, device number 116 [ 1579.856862][ T10] em28xx 6-1:0.132: Disconnecting em28xx [ 1580.040723][T26907] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5521'. [ 1580.075373][T26907] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5521'. [ 1580.259956][ T5881] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1580.304860][T26230] usb 6-1: Decoder not found [ 1580.327534][T26230] em28xx 6-1:0.132: failed to create media graph [ 1580.345858][T26230] em28xx 6-1:0.132: V4L2 device video103 deregistered [ 1580.366794][T26230] em28xx 6-1:0.132: Remote control support is not available for this card. [ 1580.387500][ T10] em28xx 6-1:0.132: Closing input extension [ 1580.408801][ T10] em28xx 6-1:0.132: Freeing device [ 1580.414011][ T5881] usb 3-1: device descriptor read/64, error -71 [ 1580.835988][ T5881] usb usb3-port1: attempt power cycle [ 1581.573012][T26922] Cannot find add_set index 0 as target [ 1581.949046][ T5881] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1582.259717][ T5881] usb 3-1: device not accepting address 64, error -71 [ 1582.594942][T26944] netlink: 'syz.2.5531': attribute type 4 has an invalid length. [ 1582.602884][T26944] netlink: 17 bytes leftover after parsing attributes in process `syz.2.5531'. [ 1584.186633][T26958] vivid-007: ================= START STATUS ================= [ 1584.194605][T26958] vivid-007: Enable Output Cropping: true [ 1584.201460][T26958] vivid-007: Enable Output Composing: true [ 1584.207471][T26958] vivid-007: Enable Output Scaler: true [ 1584.213251][T26958] vivid-007: Tx RGB Quantization Range: Automatic [ 1584.219992][T26958] vivid-007: Transmit Mode: HDMI [ 1584.225107][T26958] vivid-007: Hotplug Present: 0x00000000 [ 1584.230813][T26958] vivid-007: RxSense Present: 0x00000000 [ 1584.239912][T26958] vivid-007: EDID Present: 0x00000000 [ 1584.245583][T26958] vivid-007: ================== END STATUS ================== [ 1585.830580][T26969] sctp: [Deprecated]: syz.2.5539 (pid 26969) Use of int in max_burst socket option deprecated. [ 1585.830580][T26969] Use struct sctp_assoc_value instead [ 1585.945866][T26975] hub 8-0:1.0: USB hub found [ 1585.956135][T26975] hub 8-0:1.0: 1 port detected [ 1585.961428][T26963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5538'. [ 1586.612573][T26979] Cannot find add_set index 0 as target [ 1587.479687][ T30] audit: type=1400 audit(1752794462.746:3163): avc: denied { read write } for pid=26994 comm="syz.0.5544" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1587.659925][ T30] audit: type=1400 audit(1752794462.746:3164): avc: denied { open } for pid=26994 comm="syz.0.5544" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1588.565857][T27004] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5545'. [ 1592.229589][ T30] audit: type=1400 audit(1752794467.486:3165): avc: denied { ioctl } for pid=27048 comm="syz.4.5558" path="socket:[103782]" dev="sockfs" ino=103782 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1592.556104][T27058] ./file0: Can't open blockdev [ 1593.178563][T27061] 9pnet_fd: Insufficient options for proto=fd [ 1594.904341][T27084] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5567'. [ 1594.936741][T27084] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5567'. [ 1596.091802][T27099] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5571'. [ 1596.328514][ T30] audit: type=1400 audit(1752794471.586:3166): avc: denied { watch watch_reads } for pid=27100 comm="syz.2.5572" path="pipe:[56402]" dev="pipefs" ino=56402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1596.569722][T27087] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5569'. [ 1597.083218][T27108] netlink: 'syz.5.5574': attribute type 10 has an invalid length. [ 1597.107205][T27108] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1597.716006][T27125] overlay: Unknown parameter 'dont_hash' [ 1597.735044][ T30] audit: type=1400 audit(1752794472.986:3167): avc: denied { mount } for pid=27121 comm="syz.2.5578" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1598.445103][ T30] audit: type=1400 audit(1752794473.716:3168): avc: denied { unmount } for pid=16887 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1600.754074][T27162] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5588'. [ 1601.735570][T27182] misc userio: The device must be registered before sending interrupts [ 1601.801914][ T30] audit: type=1400 audit(1752794477.066:3169): avc: denied { accept } for pid=27184 comm="syz.4.5595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1601.900129][T25760] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1602.119719][T25760] usb 4-1: Using ep0 maxpacket: 8 [ 1602.133672][T25760] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1602.265367][T27185] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27185 comm=syz.4.5595 [ 1602.285786][T25760] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1602.337224][T25760] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1602.374553][T25760] pvrusb2: ********** [ 1602.386482][T25760] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1602.812366][T25760] pvrusb2: Important functionality might not be entirely working. [ 1602.864053][T25760] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1603.347685][T27194] ceph: No mds server is up or the cluster is laggy [ 1603.371643][T25760] pvrusb2: ********** [ 1603.376742][ T2334] pvrusb2: Invalid write control endpoint [ 1603.504118][ T2334] pvrusb2: Invalid write control endpoint [ 1603.541001][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1603.550562][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1603.558094][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1603.573126][ T2334] pvrusb2: Device being rendered inoperable [ 1603.598757][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1603.644972][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1603.668488][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1603.676339][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1603.695811][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1604.051481][T27224] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5606'. [ 1604.115582][ T30] audit: type=1400 audit(1752794479.386:3170): avc: denied { ioctl } for pid=27225 comm="syz.5.5607" path="socket:[105659]" dev="sockfs" ino=105659 ioctlcmd=0x560a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1604.466424][T27237] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5610'. [ 1604.508801][T27237] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5610'. [ 1604.732455][ T5881] usb 4-1: USB disconnect, device number 85 [ 1606.079612][ T5881] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1606.719573][ T5881] usb 4-1: Using ep0 maxpacket: 16 [ 1606.793398][ T5881] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 1607.309665][T27265] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5617'. [ 1607.472864][T27260] overlayfs: failed to resolve './file1': -2 [ 1607.479399][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.485714][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.496618][ T5881] usb 4-1: config 0 has no interface number 0 [ 1607.515437][ T5881] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1607.551979][ T5881] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1607.570644][ T5881] usb 4-1: config 0 interface 41 has no altsetting 0 [ 1607.579771][ T5881] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 1607.598964][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1607.615349][ T5881] usb 4-1: Product: syz [ 1607.758225][ T5881] usb 4-1: Manufacturer: syz [ 1607.852972][ T5881] usb 4-1: SerialNumber: syz [ 1607.865025][ T5881] usb 4-1: config 0 descriptor?? [ 1607.901960][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1607.918401][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1608.244830][T27284] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5623'. [ 1608.283075][T27284] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5623'. [ 1608.379690][ T915] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1608.440063][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1608.447413][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1608.609614][ T915] usb 6-1: Using ep0 maxpacket: 8 [ 1608.618004][ T915] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1608.702421][ T915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1608.723459][ T915] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1608.901199][ T5881] Error reading MAC address [ 1608.906747][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1608.907553][ T915] pvrusb2: ********** [ 1608.928110][T27249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1608.941509][ T915] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1608.952657][ T915] pvrusb2: Important functionality might not be entirely working. [ 1608.962249][ T915] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1608.993910][ T915] pvrusb2: ********** [ 1609.030234][ T2334] pvrusb2: Invalid write control endpoint [ 1609.105649][ T2334] pvrusb2: Invalid write control endpoint [ 1609.111825][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1609.124837][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1609.133589][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1609.167092][ T2334] pvrusb2: Device being rendered inoperable [ 1609.222843][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1609.775393][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1609.813854][T27301] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5628'. [ 1610.004914][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1610.289063][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1610.301570][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1610.315655][ T5881] sr9700 4-1:0.41 eth5: register 'sr9700' at usb-dummy_hcd.3-1, CoreChip SR9700 USB Ethernet, d6:2e:d9:6f:2e:b1 [ 1610.331086][ T5881] usb 4-1: USB disconnect, device number 86 [ 1610.366052][ T5881] sr9700 4-1:0.41 eth5: unregister 'sr9700' usb-dummy_hcd.3-1, CoreChip SR9700 USB Ethernet [ 1611.035029][T25760] usb 6-1: USB disconnect, device number 117 [ 1611.230670][ T5881] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1611.471180][ T5881] usb 4-1: Using ep0 maxpacket: 32 [ 1611.497556][ T5881] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1611.520894][ T5881] usb 4-1: config 8 has an invalid interface number: 1 but max is 0 [ 1611.544977][ T5881] usb 4-1: config 8 has no interface number 0 [ 1611.579095][ T5881] usb 4-1: config 8 interface 1 has no altsetting 0 [ 1611.605241][ T5881] usb 4-1: string descriptor 0 read error: -22 [ 1611.634633][ T5881] usb 4-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 1611.670062][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1611.709329][ T5881] gspca_main: spca505-2.14.0 probing 0733:0430 [ 1611.730594][ T974] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1611.892316][ T974] usb 6-1: config 0 has an invalid interface number: 69 but max is 0 [ 1611.917553][ T974] usb 6-1: config 0 has no interface number 0 [ 1612.265510][ T5881] gspca_spca505: reg write: error -110 [ 1612.279770][ T5881] spca505 4-1:8.1: probe with driver spca505 failed with error -5 [ 1612.289656][ T974] usb 6-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 1612.346470][ T974] usb 6-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1612.394234][ T974] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 1612.423970][ T974] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.460180][ T974] usb 6-1: Product: syz [ 1612.480951][ T974] usb 6-1: Manufacturer: syz [ 1612.494288][ T974] usb 6-1: SerialNumber: syz [ 1612.522691][ T974] usb 6-1: config 0 descriptor?? [ 1612.543072][T27326] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1612.572035][ T974] cyberjack 6-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 1612.646290][ T974] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1613.076900][T27367] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5640'. [ 1613.088447][T27367] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5640'. [ 1613.228882][T26230] usb 4-1: USB disconnect, device number 87 [ 1613.638212][T25760] usb 6-1: USB disconnect, device number 118 [ 1613.647893][T25760] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1613.684365][T25760] cyberjack 6-1:0.69: device disconnected [ 1614.002910][T27383] netlink: 'syz.3.5643': attribute type 4 has an invalid length. [ 1614.010911][T27383] netlink: 17 bytes leftover after parsing attributes in process `syz.3.5643'. [ 1616.041740][ T30] audit: type=1400 audit(1752794490.616:3171): avc: denied { nlmsg_tty_audit } for pid=27393 comm="syz.2.5647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 1616.149708][T25760] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1616.485400][T27406] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5649'. [ 1616.969568][T25760] usb 6-1: Using ep0 maxpacket: 8 [ 1617.084051][T25760] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1617.095474][T25760] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1617.341085][T27417] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input235 [ 1617.644252][T25760] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1617.659365][T27409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5650'. [ 1617.669726][T25760] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1617.846314][T25760] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1617.866532][T25760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1617.876407][T25760] usb 6-1: Product: syz [ 1617.882201][T25760] usb 6-1: Manufacturer: syz [ 1617.887389][T25760] usb 6-1: SerialNumber: syz [ 1617.929592][T26230] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1618.601653][T25760] usb 6-1: can't set config #1, error -71 [ 1618.608993][T25760] usb 6-1: USB disconnect, device number 119 [ 1618.679852][T26230] usb 4-1: Using ep0 maxpacket: 16 [ 1618.760918][T26230] usb 4-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1618.843098][T27436] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5655'. [ 1618.873725][T27436] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5655'. [ 1619.070218][T26230] usb 4-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1619.110073][T26230] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1619.128989][T26230] usb 4-1: New USB device found, idVendor=ffff, idProduct=ffff, bcdDevice= 0.40 [ 1619.138661][T26230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.150474][T27439] fuse: Bad value for 'fd' [ 1619.182238][T26230] usb 4-1: Product: Ы [ 1619.186614][T26230] usb 4-1: Manufacturer: 照䴡㭬놇韢뮱⊥ꚼ孬狼य़䮄෧痩﩯ੌᦘ㯧㇎⛆鷄孵忻速ű묉싳剣挔缔㜎巏⵳뻀⍹젚⾌蟷槤慝Е襤鬯ꡧ㽐녷쇰⒖橡喩竽륧 [ 1619.207807][T26230] usb 4-1: SerialNumber: syz [ 1619.343196][ T6637] udevd[6637]: setting mode of /dev/vcs21 to 020660 failed: Read-only file system [ 1619.353341][ T8082] udevd[8082]: setting mode of /dev/vcsa21 to 020660 failed: Read-only file system [ 1619.353360][ T6134] udevd[6134]: setting mode of /dev/vcsu21 to 020660 failed: Read-only file system [ 1619.365409][ T6637] udevd[6637]: setting owner of /dev/vcs21 to uid=0, gid=5 failed: Read-only file system [ 1619.372493][ T8082] udevd[8082]: setting owner of /dev/vcsa21 to uid=0, gid=5 failed: Read-only file system [ 1619.914241][ T6134] udevd[6134]: setting owner of /dev/vcsu21 to uid=0, gid=5 failed: Read-only file system [ 1620.246429][T27414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1620.256647][T27414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1620.473167][T26230] usbhid 4-1:1.0: can't add hid device: -71 [ 1620.578767][T26230] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 1620.599477][T26230] usb 4-1: USB disconnect, device number 88 [ 1620.859582][ T915] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 1621.519607][ T915] usb 6-1: Using ep0 maxpacket: 8 [ 1621.550420][ T915] usb 6-1: config index 0 descriptor too short (expected 28277, got 36) [ 1621.585959][ T915] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1621.650323][ T915] usb 6-1: config 0 has no interfaces? [ 1621.756912][ T915] usb 6-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1621.868680][ T915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1621.904025][ T915] usb 6-1: config 0 descriptor?? [ 1622.659315][T27508] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input236 [ 1623.429866][T27513] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1624.115304][ T915] usb 6-1: string descriptor 0 read error: -71 [ 1624.142142][ T915] usb 6-1: USB disconnect, device number 120 [ 1625.134354][T27551] Failed to initialize the IGMP autojoin socket (err -2) [ 1625.184290][ T30] audit: type=1400 audit(1752794500.456:3172): avc: denied { create } for pid=27545 comm="syz.3.5690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 1625.388677][T27560] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input238 [ 1625.809571][ T974] usb 6-1: new low-speed USB device number 121 using dummy_hcd [ 1626.439766][ T974] usb 6-1: Invalid ep0 maxpacket: 32 [ 1626.989822][ T974] usb 6-1: new low-speed USB device number 122 using dummy_hcd [ 1627.149737][ T974] usb 6-1: Invalid ep0 maxpacket: 32 [ 1627.162420][ T974] usb usb6-port1: attempt power cycle [ 1627.409564][ T10] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1627.639733][ T974] usb 6-1: new low-speed USB device number 123 using dummy_hcd [ 1627.679848][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 1627.689009][ T974] usb 6-1: Invalid ep0 maxpacket: 32 [ 1627.697658][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1627.718100][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 1627.739623][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1628.149850][ T30] audit: type=1400 audit(1752794503.366:3173): avc: denied { map } for pid=27587 comm="syz.0.5700" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1628.170177][ T10] usb 3-1: config 0 descriptor?? [ 1628.179694][ T974] usb 6-1: new low-speed USB device number 124 using dummy_hcd [ 1628.200387][ T10] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 1628.223798][ T974] usb 6-1: device descriptor read/8, error -71 [ 1628.233709][ T30] audit: type=1400 audit(1752794503.396:3174): avc: denied { execute } for pid=27587 comm="syz.0.5700" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1628.257676][ C0] vkms_vblank_simulate: vblank timer overrun [ 1628.397040][ T974] usb usb6-port1: unable to enumerate USB device [ 1628.571857][T26230] libceph: connect (1)[c::]:6789 error -101 [ 1628.577849][T26230] libceph: mon0 (1)[c::]:6789 connect error [ 1628.810004][T27588] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5700'. [ 1628.846727][ T974] libceph: connect (1)[c::]:6789 error -101 [ 1628.869722][ T974] libceph: mon0 (1)[c::]:6789 connect error [ 1628.986058][T27602] kvm: pic: non byte write [ 1629.105547][T27593] ceph: No mds server is up or the cluster is laggy [ 1629.602942][T27581] fuse: Unknown parameter 'g`oup_id' [ 1630.159635][ T30] audit: type=1400 audit(1752794505.216:3175): avc: denied { watch } for pid=27576 comm="syz.2.5697" path="/562/file1" dev="tmpfs" ino=3100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1630.192428][ T30] audit: type=1400 audit(1752794505.216:3176): avc: denied { watch_sb } for pid=27576 comm="syz.2.5697" path="/562/file1" dev="tmpfs" ino=3100 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1631.487701][T27622] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5706'. [ 1632.845009][T27643] binder: 27642:27643 ioctl c0306201 0 returned -14 [ 1633.029251][T27648] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5715'. [ 1633.061176][T27648] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5715'. [ 1633.094340][T27643] binder: 27642:27643 ioctl c0306201 2000000001c0 returned -22 [ 1634.495298][T27678] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5720'. [ 1635.434733][T27691] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input240 [ 1636.489194][T27702] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input241 [ 1636.865811][T27707] binder: 27701:27707 ioctl c0306201 0 returned -14 [ 1637.013202][T27711] binder: 27701:27711 ioctl c0306201 2000000001c0 returned -22 [ 1637.820965][ T30] audit: type=1400 audit(1752794513.096:3177): avc: denied { bind } for pid=27722 comm="syz.0.5735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1637.983658][ T915] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1638.090806][T27730] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5736'. [ 1638.539937][ T915] usb 4-1: Using ep0 maxpacket: 8 [ 1638.563704][ T915] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1638.573030][ T915] usb 4-1: config 179 has no interface number 0 [ 1638.579360][ T915] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1638.593061][ T915] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1638.604928][ T915] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 1638.661365][ T915] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 1638.674900][ T915] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1638.688896][ T915] usb 4-1: config 179 interface 65 has no altsetting 0 [ 1638.695914][ T915] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1638.705054][ T915] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1638.770407][ T915] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input242 [ 1639.161723][T22794] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 1639.809009][T26230] usb 4-1: USB disconnect, device number 89 [ 1639.809144][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1640.042233][T27762] ieee802154 phy0 wpan0: encryption failed: -22 [ 1641.129864][T27774] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5750'. [ 1642.059235][T27491] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1642.071859][T27491] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1642.082141][T27491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1642.093149][T27491] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1642.101210][T27491] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1642.149217][T27796] Failed to initialize the IGMP autojoin socket (err -2) [ 1642.289932][T25760] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1642.436036][T27796] chnl_net:caif_netlink_parms(): no params data found [ 1642.479636][T25760] usb 4-1: Using ep0 maxpacket: 8 [ 1642.501487][T27808] IPv6: addrconf: prefix option has invalid lifetime [ 1642.529652][T25760] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1642.596369][T25760] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1642.692486][T25760] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1642.725593][ T5836] printk: udevd: 2 output lines suppressed due to ratelimiting [ 1642.739397][T25760] pvrusb2: ********** [ 1642.749571][T25760] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1642.762172][T25760] pvrusb2: Important functionality might not be entirely working. [ 1642.770090][T25760] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1642.781619][T25760] pvrusb2: ********** [ 1642.795438][T27796] bridge0: port 1(bridge_slave_0) entered blocking state [ 1642.979702][ T2334] pvrusb2: Invalid write control endpoint [ 1643.549349][T27796] bridge0: port 1(bridge_slave_0) entered disabled state [ 1643.561496][T27796] bridge_slave_0: entered allmulticast mode [ 1643.628724][T27796] bridge_slave_0: entered promiscuous mode [ 1643.728490][ T2334] pvrusb2: Invalid write control endpoint [ 1643.775270][T27796] bridge0: port 2(bridge_slave_1) entered blocking state [ 1643.789585][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1643.801449][T27796] bridge0: port 2(bridge_slave_1) entered disabled state [ 1643.842070][T27796] bridge_slave_1: entered allmulticast mode [ 1643.849140][T27796] bridge_slave_1: entered promiscuous mode [ 1643.894315][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1643.934005][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1643.964744][T27796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1643.985919][ T2334] pvrusb2: Device being rendered inoperable [ 1644.007000][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1644.017654][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1644.047659][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1644.053305][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1644.064644][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1644.180172][T27491] Bluetooth: hci3: command tx timeout [ 1644.225792][T27796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1644.263677][T27796] team0: Port device team_slave_0 added [ 1644.275134][T27796] team0: Port device team_slave_1 added [ 1644.299294][T27796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1644.307332][T27796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1644.333642][T27796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1644.350342][T27796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1644.357623][T27796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1644.403875][T27796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1644.469339][T27796] hsr_slave_0: entered promiscuous mode [ 1644.516374][T27796] hsr_slave_1: entered promiscuous mode [ 1645.218261][ T8152] usb 4-1: USB disconnect, device number 90 [ 1646.213046][T27796] netdevsim netdevsim6 netdevsim0: renamed from eth5 [ 1646.265881][T27491] Bluetooth: hci3: command tx timeout [ 1646.329159][T27796] netdevsim netdevsim6 netdevsim1: renamed from eth6 [ 1646.376870][T27796] netdevsim netdevsim6 netdevsim2: renamed from eth7 [ 1646.404586][T27796] netdevsim netdevsim6 netdevsim3: renamed from eth8 [ 1646.652429][T27860] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5772'. [ 1646.714981][T27864] x_tables: unsorted underflow at hook 2 [ 1646.903164][T27796] 8021q: adding VLAN 0 to HW filter on device team0 [ 1646.966830][T14291] bridge0: port 1(bridge_slave_0) entered blocking state [ 1646.973991][T14291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1647.061131][T14291] bridge0: port 2(bridge_slave_1) entered blocking state [ 1647.068262][T14291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1647.881893][ T30] audit: type=1400 audit(1752794522.786:3178): avc: denied { mount } for pid=27877 comm="syz.0.5779" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1647.928351][ T30] audit: type=1400 audit(1752794522.786:3179): avc: denied { search } for pid=27877 comm="syz.0.5779" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1647.957412][ T30] audit: type=1400 audit(1752794522.786:3180): avc: denied { unmount } for pid=27877 comm="syz.0.5779" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 1648.341540][T27491] Bluetooth: hci3: command tx timeout [ 1649.013546][T27903] binder: 27902:27903 ioctl c0306201 2000000001c0 returned -22 [ 1649.721454][T27796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1650.419565][T27491] Bluetooth: hci3: command tx timeout [ 1651.037747][T27937] netlink: 'syz.0.5794': attribute type 1 has an invalid length. [ 1651.856351][T27952] binder: 27951:27952 ioctl c0306201 2000000001c0 returned -22 [ 1652.582193][T27796] veth0_vlan: entered promiscuous mode [ 1653.187925][T27796] veth1_vlan: entered promiscuous mode [ 1653.571339][T27796] veth0_macvtap: entered promiscuous mode [ 1653.647884][T27796] veth1_macvtap: entered promiscuous mode [ 1653.824925][T27796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1653.848066][T27796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1653.859101][T27796] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1653.883694][T27796] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.917653][T27796] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.057620][ T30] audit: type=1400 audit(1752794529.326:3181): avc: denied { getopt } for pid=27968 comm="syz.0.5802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1654.085515][T27796] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.114304][T27796] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.146105][T27796] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.182650][T27796] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.212179][T27796] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.292525][T27796] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1654.608777][T27796] wireguard: wg0: Could not create IPv4 socket [ 1654.620113][T27796] wireguard: wg1: Could not create IPv4 socket [ 1654.638822][T27796] wireguard: wg2: Could not create IPv4 socket [ 1655.994655][T27995] binder: 27994:27995 ioctl c0306201 2000000001c0 returned -22 [ 1656.683561][T28011] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5811'. [ 1657.827200][ T30] audit: type=1400 audit(1752794533.046:3182): avc: denied { setopt } for pid=28019 comm="syz.4.5815" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1658.792903][T22794] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1658.803333][T22794] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1658.812335][T22794] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1658.822903][T22794] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1658.830475][T22794] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1658.844301][T28030] Failed to initialize the IGMP autojoin socket (err -2) [ 1659.630852][T28030] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1659.926030][T28030] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1660.302262][T28030] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1660.561244][T28030] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1660.852211][T28048] binder: 28045:28048 ioctl c0306201 0 returned -14 [ 1660.876613][T28030] netdevsim netdevsim6 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1660.899651][T27491] Bluetooth: hci3: command tx timeout [ 1660.936914][T28030] netdevsim netdevsim6 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1660.951170][T28030] netdevsim netdevsim6 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1660.964752][T28030] netdevsim netdevsim6 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1660.982306][T28030] netdevsim netdevsim6 netdevsim0: renamed from eth5 [ 1661.082910][T28030] netdevsim netdevsim6 netdevsim1: renamed from eth6 [ 1661.116017][T28030] netdevsim netdevsim6 netdevsim2: renamed from eth7 [ 1661.215835][T28030] netdevsim netdevsim6 netdevsim3: renamed from eth8 [ 1662.219623][ T5908] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 1662.338182][T28078] netlink: 'syz.4.5829': attribute type 1 has an invalid length. [ 1662.451824][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 1662.493623][ T5908] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1662.507473][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1662.600938][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1662.759579][ T5908] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1662.769242][ T5908] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1662.912424][ T5908] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1662.923422][ T5908] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1662.967391][ T5908] usb 6-1: Manufacturer: syz [ 1662.980087][T27491] Bluetooth: hci3: command tx timeout [ 1662.994069][ T5908] usb 6-1: config 0 descriptor?? [ 1663.100498][T28092] binder: 28091:28092 ioctl c0306201 0 returned -14 [ 1663.288086][T28098] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5833'. [ 1663.354537][ T5908] rc_core: IR keymap rc-hauppauge not found [ 1663.369573][ T5908] Registered IR keymap rc-empty [ 1663.385906][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.450069][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.491492][ T5908] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1663.512282][T28030] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1663.538877][ T5908] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input243 [ 1663.568981][T28030] wireguard: wg0: Could not create IPv4 socket [ 1663.578189][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.588123][T28030] wireguard: wg1: Could not create IPv4 socket [ 1663.596454][T28030] wireguard: wg2: Could not create IPv4 socket [ 1663.609621][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.643827][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.680476][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.719643][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.752845][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.779727][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.809626][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.839568][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.879546][ T5908] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1663.920268][ T5908] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1663.939623][ T5908] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1663.961181][ T5908] usb 6-1: USB disconnect, device number 125 [ 1664.263799][T28106] input: syz0 as /devices/virtual/input/input244 [ 1664.294087][T28106] netlink: 64535 bytes leftover after parsing attributes in process `syz.3.5835'. [ 1664.612526][T28117] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input245 [ 1664.843108][T27491] Bluetooth: hci1: link tx timeout [ 1664.849359][T27491] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 1664.864829][T27491] Bluetooth: hci1: link tx timeout [ 1664.870495][T27491] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 1665.188864][T28116] netlink: 'syz.3.5838': attribute type 4 has an invalid length. [ 1665.196642][T28116] netlink: 17 bytes leftover after parsing attributes in process `syz.3.5838'. [ 1665.373198][T28131] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5841'. [ 1665.382214][T28131] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5841'. [ 1665.391432][T28131] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5841'. [ 1665.845530][T28139] netlink: 'syz.5.5845': attribute type 5 has an invalid length. [ 1666.099529][ T974] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 1666.169627][ T5908] usb 4-1: new full-speed USB device number 91 using dummy_hcd [ 1666.542117][ T974] usb 6-1: config 1 has an invalid interface number: 160 but max is 0 [ 1666.551091][ T974] usb 6-1: config 1 has no interface number 0 [ 1666.557302][ T974] usb 6-1: config 1 interface 160 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1666.567585][ T974] usb 6-1: config 1 interface 160 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1666.578458][ T5908] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1666.679119][ T5908] usb 4-1: config 0 has no interface number 0 [ 1666.687535][ T5908] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 1666.699302][ T974] usb 6-1: New USB device found, idVendor=1385, idProduct=5f01, bcdDevice=1f.70 [ 1666.710649][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1666.718796][ T974] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1666.729117][ T974] usb 6-1: Product: syz [ 1666.734774][ T5908] usb 4-1: config 0 descriptor?? [ 1666.741260][ T974] usb 6-1: Manufacturer: syz [ 1666.756383][ T5908] usb 4-1: selecting invalid altsetting 1 [ 1666.768916][ T974] usb 6-1: SerialNumber: syz [ 1666.804646][ T5908] dvb_ttusb_budget: ttusb_init_controller: error [ 1666.832976][ T974] usb 6-1: Could not find all expected endpoints [ 1666.841302][ T5908] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1666.903537][T27491] Bluetooth: hci1: command 0x0405 tx timeout [ 1666.948442][ T5908] DVB: Unable to find symbol cx22700_attach() [ 1667.017235][ T5908] DVB: Unable to find symbol tda10046_attach() [ 1667.026334][ T5908] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 1667.032464][ T8152] usb 6-1: USB disconnect, device number 126 [ 1667.036293][ T5908] usb 4-1: USB disconnect, device number 91 [ 1668.537830][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.545982][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.979717][T27491] Bluetooth: hci1: command 0x0405 tx timeout [ 1669.335811][T27491] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1669.347368][T27491] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1669.356478][T27491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1669.367165][T27491] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1669.379759][T27491] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1669.427156][T28183] Failed to initialize the IGMP autojoin socket (err -2) [ 1669.429501][ T915] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 1669.609633][ T915] usb 6-1: Using ep0 maxpacket: 8 [ 1669.625466][ T915] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1669.667284][ T915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1669.716694][ T915] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1669.726209][T28183] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.729520][ T915] pvrusb2: ********** [ 1669.782140][ T915] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1669.793524][ T915] pvrusb2: Important functionality might not be entirely working. [ 1669.847944][ T915] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1669.881842][ T915] pvrusb2: ********** [ 1669.915033][ T2334] pvrusb2: Invalid write control endpoint [ 1669.915786][T28183] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1670.061980][ T2334] pvrusb2: Invalid write control endpoint [ 1670.067891][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1670.089913][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1670.097696][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1670.112432][ T2334] pvrusb2: Device being rendered inoperable [ 1670.118577][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1670.126119][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1670.137194][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1670.143022][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1670.626246][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1670.633603][T28192] netlink: 'syz.0.5858': attribute type 4 has an invalid length. [ 1670.684945][T28196] netlink: 'syz.0.5858': attribute type 4 has an invalid length. [ 1670.696131][T28183] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1670.829259][T28183] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1671.418374][T28183] netdevsim netdevsim6 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.458231][T28204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5862'. [ 1671.476597][T27491] Bluetooth: hci3: command tx timeout [ 1671.478897][T28183] netdevsim netdevsim6 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.681935][T28204] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5862'. [ 1671.718603][T28183] netdevsim netdevsim6 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.763952][T28183] netdevsim netdevsim6 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.800912][T28183] netdevsim netdevsim6 netdevsim0: renamed from eth5 [ 1671.956826][T28183] netdevsim netdevsim6 netdevsim1: renamed from eth6 [ 1672.514320][T13737] usb 6-1: USB disconnect, device number 127 [ 1672.528087][T28183] netdevsim netdevsim6 netdevsim2: renamed from eth7 [ 1672.630792][T28183] netdevsim netdevsim6 netdevsim3: renamed from eth8 [ 1672.776467][T28223] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5869'. [ 1673.539911][T27491] Bluetooth: hci3: command tx timeout [ 1675.220951][T28259] batman_adv: batadv0: Adding interface: dummy0 [ 1675.227385][T28259] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1675.268450][T28259] batman_adv: batadv0: Interface activated: dummy0 [ 1675.632998][T27491] Bluetooth: hci3: command tx timeout [ 1676.229892][T28271] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5883'. [ 1676.482219][T28271] overlayfs: missing 'lowerdir' [ 1676.984636][T28266] overlayfs: failed to clone upperpath [ 1677.050545][T28275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5885'. [ 1677.084535][T28275] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5885'. [ 1678.166058][T27491] Bluetooth: hci3: command tx timeout [ 1680.119620][T28307] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5894'. [ 1680.284731][T28306] overlayfs: missing 'lowerdir' [ 1680.396000][T28310] overlayfs: failed to resolve './file1': -2 [ 1681.033980][T28183] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1681.092429][T28183] wireguard: wg0: Could not create IPv4 socket [ 1681.124048][T28183] wireguard: wg1: Could not create IPv4 socket [ 1681.155554][T28183] wireguard: wg2: Could not create IPv4 socket [ 1681.189620][T25760] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1681.359648][T25760] usb 6-1: Using ep0 maxpacket: 32 [ 1681.396009][T28334] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1681.650292][T25760] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 1681.658472][T25760] usb 6-1: config 0 has no interface number 0 [ 1681.696951][T25760] usb 6-1: config 0 interface 184 has no altsetting 0 [ 1681.824416][T25760] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1681.857594][T25760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1681.873493][T25760] usb 6-1: Product: syz [ 1681.877839][T25760] usb 6-1: Manufacturer: syz [ 1681.882529][T25760] usb 6-1: SerialNumber: syz [ 1681.920513][T25760] usb 6-1: config 0 descriptor?? [ 1682.184329][T25760] smsc75xx v1.0.0 [ 1682.187994][T25760] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1682.200725][T25760] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 1682.633789][T28320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1682.789761][T28320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1683.145129][T25760] usb 6-1: USB disconnect, device number 2 [ 1683.466855][T28368] loop9: detected capacity change from 0 to 7 [ 1683.543073][T28369] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5910'. [ 1684.369469][ C1] blk_print_req_error: 8 callbacks suppressed [ 1684.369486][ C1] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.385752][ C1] buffer_io_error: 7 callbacks suppressed [ 1684.385765][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.426425][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.436663][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.467495][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.477766][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.513033][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.523264][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.531013][T22794] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1684.542626][T22794] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1684.550349][T22794] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1684.558375][T22794] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1684.565614][T22794] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1684.573812][ C1] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.583989][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.608387][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.618959][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.627037][T28368] ldm_validate_partition_table(): Disk read failed. [ 1684.633899][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.644107][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.658424][T28370] Failed to initialize the IGMP autojoin socket (err -2) [ 1684.790268][ C0] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.800507][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.828189][ C1] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.838364][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.847857][ C1] critical medium error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1684.858055][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 1684.868344][T28368] Dev loop9: unable to read RDB block 0 [ 1684.877114][T28368] loop9: unable to read partition table [ 1685.387803][T28368] loop9: partition table beyond EOD, truncated [ 1685.422631][T28368] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 1685.422631][T28368] ) failed (rc=-5) [ 1685.959966][T28370] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1686.623052][T28370] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1686.672631][T27491] Bluetooth: hci3: command tx timeout [ 1686.873652][T28414] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5924'. [ 1686.908606][T28414] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5924'. [ 1687.300789][T28417] comedi comedi0: dt2815: I/O port conflict (0xef,2) [ 1687.361068][T28417] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 1687.798597][T28370] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1688.632649][T28370] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1688.692398][T28435] hugetlbfs: syz.4.5931 (28435): Using mlock ulimits for SHM_HUGETLB is obsolete [ 1688.739536][T27491] Bluetooth: hci3: command tx timeout [ 1689.144635][T28443] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5933'. [ 1689.161177][T28443] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1689.170076][T28443] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1689.594979][T28370] netdevsim netdevsim6 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.628065][T28370] netdevsim netdevsim6 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.655808][T28370] netdevsim netdevsim6 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.800687][T28370] netdevsim netdevsim6 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.050633][T28370] netdevsim netdevsim6 netdevsim0: renamed from eth5 [ 1690.145085][T28370] netdevsim netdevsim6 netdevsim1: renamed from eth6 [ 1690.238753][T28370] netdevsim netdevsim6 netdevsim2: renamed from eth7 [ 1690.321659][T28370] netdevsim netdevsim6 netdevsim3: renamed from eth8 [ 1690.395591][T28462] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5939'. [ 1690.447576][T28468] kvm: MWAIT instruction emulated as NOP! [ 1690.980964][T22794] Bluetooth: hci3: command 0x0419 tx timeout [ 1692.919505][ T974] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1692.958741][ T30] audit: type=1400 audit(1752794568.226:3183): avc: denied { mounton } for pid=28504 comm="syz.5.5948" path="/syzcgroup/net/syz5/devices.allow" dev="cgroup" ino=450 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 1692.988418][T25760] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65380 sclass=netlink_route_socket pid=25760 comm=kworker/1:5 [ 1693.060071][T22794] Bluetooth: hci3: command 0x0419 tx timeout [ 1693.099711][ T974] usb 4-1: Using ep0 maxpacket: 16 [ 1693.117647][ T974] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1693.135412][ T974] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1693.166324][ T974] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1693.179536][ T974] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1693.200863][ T974] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1693.202312][T28370] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1693.224857][ T974] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1693.254417][ T974] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1693.283359][ T974] usb 4-1: Manufacturer: syz [ 1693.308978][ T974] usb 4-1: config 0 descriptor?? [ 1693.323150][T28370] wireguard: wg0: Could not create IPv4 socket [ 1693.362624][T28517] overlayfs: failed to clone upperpath [ 1693.391666][T28370] wireguard: wg1: Could not create IPv4 socket [ 1693.408604][T28370] wireguard: wg2: Could not create IPv4 socket [ 1693.491279][ T30] audit: type=1800 audit(1752794568.756:3184): pid=28474 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.5941" name="/" dev="fuse" ino=1 res=0 errno=0 [ 1693.604866][T28520] netlink: 'syz.4.5953': attribute type 4 has an invalid length. [ 1693.613088][T28520] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5953'. [ 1693.624431][T28520] : renamed from bond0 (while UP) [ 1693.709511][ T974] rc_core: IR keymap rc-hauppauge not found [ 1693.715424][ T974] Registered IR keymap rc-empty [ 1693.760162][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1693.793041][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1693.993003][ T974] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 1694.016320][ T974] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input246 [ 1694.847197][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.127482][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.161348][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.221743][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.253506][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.313458][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.462841][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.505913][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.630045][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.659724][ T974] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1695.725001][ T974] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1695.738686][ T974] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1696.374342][T13737] usb 4-1: USB disconnect, device number 92 [ 1697.982002][T28553] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5960'. [ 1698.540971][T28562] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5962'. [ 1698.557767][T28562] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5962'. [ 1699.114919][T28568] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5964'. [ 1699.140932][T28568] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1699.149808][T28568] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1699.929711][ T974] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1700.099847][ T974] usb 4-1: Using ep0 maxpacket: 8 [ 1700.125363][ T974] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 1700.133999][ T974] usb 4-1: config 0 has no interface number 0 [ 1700.148792][ T974] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1700.158739][ T974] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1700.173229][ T974] usb 4-1: Product: syz [ 1700.177397][ T974] usb 4-1: Manufacturer: syz [ 1700.182859][ T974] usb 4-1: SerialNumber: syz [ 1700.192641][ T974] usb 4-1: config 0 descriptor?? [ 1700.409527][ T974] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 1700.495875][ T974] usb 4-1: No valid video chain found. [ 1701.423403][T28579] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 1701.429923][T28579] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1701.437869][T28579] vhci_hcd vhci_hcd.0: Device attached [ 1701.632928][ T974] usb 4-1: USB disconnect, device number 93 [ 1701.691836][T25760] usb 33-1: new high-speed USB device number 4 using vhci_hcd [ 1702.855143][T28583] vhci_hcd: connection reset by peer [ 1703.811214][T27491] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1703.839676][T14291] vhci_hcd: stop threads [ 1703.845335][T14291] vhci_hcd: release socket [ 1703.853768][T14291] vhci_hcd: disconnect device [ 1704.099009][T27491] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1704.101034][T28612] Failed to initialize the IGMP autojoin socket (err -2) [ 1704.126090][T27491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1704.141994][T27491] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1704.152735][T27491] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1704.214607][T28599] Failed to initialize the IGMP autojoin socket (err -2) [ 1704.261246][T28617] overlayfs: failed to clone upperpath [ 1705.723099][T28599] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1706.181398][T22794] Bluetooth: hci3: command tx timeout [ 1706.223435][T28599] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1706.403756][T28599] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1706.492413][ T30] audit: type=1400 audit(1752794581.766:3185): avc: denied { audit_write } for pid=28643 comm="syz.5.5983" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 1706.589258][T28645] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input247 [ 1706.820034][T25760] vhci_hcd: vhci_device speed not set [ 1706.900751][T28599] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.213618][T28599] netdevsim netdevsim6 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1707.253062][T28599] netdevsim netdevsim6 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1707.296947][T28599] netdevsim netdevsim6 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1707.368399][T28599] netdevsim netdevsim6 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1707.408440][T28599] netdevsim netdevsim6 netdevsim0: renamed from eth5 [ 1707.448329][T28599] netdevsim netdevsim6 netdevsim1: renamed from eth6 [ 1707.518220][T28599] netdevsim netdevsim6 netdevsim2: renamed from eth7 [ 1707.564116][T28599] netdevsim netdevsim6 netdevsim3: renamed from eth8 [ 1708.158705][T28659] overlayfs: failed to clone upperpath [ 1708.272742][T22794] Bluetooth: hci3: command tx timeout [ 1708.398838][ T30] audit: type=1400 audit(1752794583.656:3186): avc: denied { create } for pid=28664 comm="syz.3.5988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1710.394520][T22794] Bluetooth: hci3: command tx timeout [ 1711.168213][T28599] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1711.235706][T28599] wireguard: wg0: Could not create IPv4 socket [ 1711.270246][T28599] wireguard: wg1: Could not create IPv4 socket [ 1711.293989][T28599] wireguard: wg2: Could not create IPv4 socket [ 1711.621397][T28701] netlink: 'syz.5.5996': attribute type 11 has an invalid length. [ 1712.079748][T25760] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1712.117732][T28703] Failed to initialize the IGMP autojoin socket (err -2) [ 1712.125792][ T30] audit: type=1400 audit(1752794587.384:3187): avc: denied { create } for pid=28702 comm="syz.5.5997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 1712.155657][ T30] audit: type=1400 audit(1752794587.384:3188): avc: denied { sys_admin } for pid=28702 comm="syz.5.5997" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 1712.249581][T25760] usb 4-1: Using ep0 maxpacket: 8 [ 1712.256619][T25760] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1712.265946][T25760] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1712.308393][T25760] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1712.324920][T25760] pvrusb2: ********** [ 1712.328952][T25760] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1712.339104][T25760] pvrusb2: Important functionality might not be entirely working. [ 1712.349010][T25760] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1712.389735][T25760] pvrusb2: ********** [ 1712.512452][ T2334] pvrusb2: Invalid write control endpoint [ 1712.563071][ T2334] pvrusb2: Invalid write control endpoint [ 1712.568931][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1712.581579][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1712.591789][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1712.602059][ T2334] pvrusb2: Device being rendered inoperable [ 1712.608047][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1712.615574][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1712.624274][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1712.629990][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1712.640398][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1713.089655][T13737] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1713.444772][T28723] netlink: 'syz.4.6002': attribute type 1 has an invalid length. [ 1713.499762][T13737] usb 6-1: Using ep0 maxpacket: 8 [ 1713.513709][T13737] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1713.541433][T13737] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1713.599663][T13737] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1713.621377][T13737] pvrusb2: ********** [ 1713.638018][T13737] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1713.641862][T28726] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6003'. [ 1713.652831][T13737] pvrusb2: Important functionality might not be entirely working. [ 1713.665584][T13737] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1713.679114][T13737] pvrusb2: ********** [ 1714.099631][ T2334] pvrusb2: Invalid write control endpoint [ 1714.945472][T26230] usb 4-1: USB disconnect, device number 94 [ 1714.953495][ T2334] pvrusb2: Invalid write control endpoint [ 1714.959239][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1714.972540][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1715.020749][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1715.030801][ T2334] pvrusb2: Device being rendered inoperable [ 1715.039838][ T2334] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1715.046921][ T2334] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 1715.076163][ T2334] pvrusb2: Attached sub-driver cx25840 [ 1715.089507][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1715.112938][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1715.165430][T28740] binder: 28738:28740 ioctl c0306201 2000000001c0 returned -22 [ 1716.374233][ T974] usb 6-1: USB disconnect, device number 3 [ 1717.039576][ T974] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 1717.212178][ T974] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 1717.229592][ T974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1717.267634][ T974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1717.302144][ T974] usb 6-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 1717.316049][ T974] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1717.327169][ T974] usb 6-1: Product: syz [ 1717.330033][T27491] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1717.331564][ T974] usb 6-1: Manufacturer: syz [ 1717.343877][ T974] usb 6-1: SerialNumber: syz [ 1717.345143][T27491] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1717.350343][ T974] usb 6-1: config 0 descriptor?? [ 1717.363010][T27491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1717.363390][ T974] port100 6-1:0.0: NFC: Could not get supported command types [ 1717.372803][T27491] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1717.385867][T27491] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1717.442422][T28755] Failed to initialize the IGMP autojoin socket (err -2) [ 1717.477476][T14279] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1717.488105][T14279] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.592218][T14279] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1717.603069][T14279] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.684475][T13737] usb 6-1: USB disconnect, device number 4 [ 1717.693773][T28762] netlink: 'syz.3.6013': attribute type 1 has an invalid length. [ 1717.716961][T28761] fuse: Bad value for 'user_id' [ 1717.721882][T28761] fuse: Bad value for 'user_id' [ 1717.790917][T14279] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1717.813448][T14279] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1718.592117][T14279] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1718.603839][T14279] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1718.651785][T27491] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1718.671975][T28771] sctp: [Deprecated]: syz.4.6016 (pid 28771) Use of int in max_burst socket option deprecated. [ 1718.671975][T28771] Use struct sctp_assoc_value instead [ 1718.736924][T27491] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1718.745727][T27491] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1718.761525][T27491] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1718.773621][T27491] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1718.931127][T28772] Failed to initialize the IGMP autojoin socket (err -2) [ 1718.987727][T14279] netdevsim netdevsim0 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.298792][T14279] netdevsim netdevsim0 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.324017][T14279] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.349049][T14279] netdevsim netdevsim0 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.459671][T22794] Bluetooth: hci3: command tx timeout [ 1720.204253][T28755] netdevsim netdevsim0 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1720.245005][T14279] bridge_slave_1: left allmulticast mode [ 1720.253060][T14279] bridge_slave_1: left promiscuous mode [ 1720.268664][T14279] bridge0: port 2(bridge_slave_1) entered disabled state [ 1720.302773][T14279] bridge_slave_0: left allmulticast mode [ 1720.308489][T14279] bridge_slave_0: left promiscuous mode [ 1720.416576][T14279] bridge0: port 1(bridge_slave_0) entered disabled state [ 1721.550168][T27491] Bluetooth: hci3: command tx timeout [ 1721.690225][T14279] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1721.701595][T14279] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1721.714091][T14279] bond0 (unregistering): (slave team0): Releasing backup interface [ 1721.723557][T14279] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1721.734631][T14279] bond0 (unregistering): Released all slaves [ 1721.835850][T14279] bond1 (unregistering): Released all slaves [ 1721.858544][T28755] netdevsim netdevsim0 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1721.935942][T28755] netdevsim netdevsim0 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1722.730102][T28814] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6026'. [ 1723.130009][T28814] overlayfs: missing 'lowerdir' [ 1723.249487][T14279] tipc: Disabling bearer [ 1723.257036][T14279] tipc: Disabling bearer [ 1723.413608][T14279] tipc: Disabling bearer [ 1723.428128][T14279] tipc: Left network mode [ 1723.436133][T28755] netdevsim netdevsim0 eth5 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1723.630411][T27491] Bluetooth: hci3: command tx timeout [ 1723.675280][T22794] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1723.715227][T22794] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1723.723315][T22794] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1723.805988][T22794] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1723.809697][T28817] bridge1: entered promiscuous mode [ 1723.816277][T22794] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1723.940119][ T5908] usb 4-1: new low-speed USB device number 95 using dummy_hcd [ 1724.101855][T22794] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 1724.142860][T28824] Failed to initialize the IGMP autojoin socket (err -2) [ 1724.256153][ T5908] usb 4-1: device descriptor read/64, error -71 [ 1724.938771][T14279] hsr_slave_0: left promiscuous mode [ 1725.155099][T14279] hsr_slave_1: left promiscuous mode [ 1725.172892][T14279] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1725.182453][T28837] overlayfs: failed to clone upperpath [ 1725.199531][ T5908] usb 4-1: new low-speed USB device number 96 using dummy_hcd [ 1725.200154][T14279] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1725.268861][T14279] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1725.279321][T14279] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1725.327663][T14279] veth1_vlan: left promiscuous mode [ 1725.336451][T14279] veth0_vlan: left promiscuous mode [ 1725.349832][ T5908] usb 4-1: device descriptor read/64, error -71 [ 1725.479639][T28846] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6038'. [ 1725.551038][ T30] audit: type=1400 audit(1752794600.734:3189): avc: denied { create } for pid=28843 comm="syz.5.6038" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1725.551169][ T5908] usb usb4-port1: attempt power cycle [ 1725.725100][T22794] Bluetooth: hci3: command tx timeout [ 1726.074125][ T5908] usb 4-1: new low-speed USB device number 97 using dummy_hcd [ 1726.099537][T22794] Bluetooth: hci0: command tx timeout [ 1726.110632][ T5908] usb 4-1: device descriptor read/8, error -71 [ 1726.268657][T14279] team0 (unregistering): Port device team_slave_1 removed [ 1726.327038][T14279] team0 (unregistering): Port device team_slave_0 removed [ 1726.369561][ T5908] usb 4-1: new low-speed USB device number 98 using dummy_hcd [ 1726.400319][ T5908] usb 4-1: device descriptor read/8, error -71 [ 1726.510027][ T5908] usb usb4-port1: unable to enumerate USB device [ 1726.865221][T22794] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 1726.923730][T14279] lo (unregistering): left allmulticast mode [ 1726.935907][T28861] overlayfs: failed to clone upperpath [ 1727.697809][T28755] netdevsim netdevsim0 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.755258][T28755] netdevsim netdevsim0 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.793305][T28755] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.845154][T28755] netdevsim netdevsim0 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1728.336079][T28755] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1728.402652][T28755] wireguard: wg0: Could not create IPv4 socket [ 1728.436625][T28755] wireguard: wg1: Could not create IPv4 socket [ 1728.465814][T28755] wireguard: wg2: Could not create IPv4 socket [ 1729.024321][T27491] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1729.033473][T27491] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1729.041611][T27491] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1729.059045][T27491] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1729.066510][T27491] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1729.427540][T28893] Failed to initialize the IGMP autojoin socket (err -2) [ 1729.877116][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1729.884204][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.272547][T28893] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.722232][T28925] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6059'. [ 1730.746751][T28925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6059'. [ 1731.140808][T22794] Bluetooth: hci0: command tx timeout [ 1732.173389][T28941] overlayfs: failed to clone upperpath [ 1733.229687][T22794] Bluetooth: hci0: command tx timeout [ 1733.509853][T28957] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6069'. [ 1733.534361][T28957] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6069'. [ 1734.389230][T28893] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.541428][T28893] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.752827][T28893] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1735.329688][T22794] Bluetooth: hci0: command tx timeout [ 1735.620797][T28984] binder: BINDER_SET_CONTEXT_MGR already set [ 1736.109887][T28984] binder: 28982:28984 ioctl 4018620d 200000000040 returned -16 [ 1736.521942][T28893] netdevsim netdevsim6 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1736.570877][T28893] netdevsim netdevsim6 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 1736.593878][T27491] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1736.632009][T28893] netdevsim netdevsim6 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 1736.672829][T28893] netdevsim netdevsim6 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 1736.697638][T28893] netdevsim netdevsim6 netdevsim0: renamed from eth9 [ 1736.719680][T27491] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1736.730851][T27491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1736.750221][T27491] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1736.758288][T27491] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1736.764778][T28893] netdevsim netdevsim6 netdevsim1: renamed from eth10 [ 1736.847890][T28996] syz.5.6081: attempt to access beyond end of device [ 1736.847890][T28996] nbd5: rw=0, sector=16, nr_sectors = 1 limit=0 [ 1736.860995][T28996] qnx6: unable to read the first superblock [ 1736.867606][T28996] syz.5.6081: attempt to access beyond end of device [ 1736.867606][T28996] nbd5: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1736.880580][T28996] qnx6: unable to read the first superblock [ 1736.886532][T28996] qnx6: unable to read the first superblock [ 1737.068424][T28893] netdevsim netdevsim6 netdevsim2: renamed from eth11 [ 1737.251606][T28893] netdevsim netdevsim6 netdevsim3: renamed from eth12 [ 1737.259842][T28993] Failed to initialize the IGMP autojoin socket (err -2) [ 1737.379956][T27491] Bluetooth: hci0: command tx timeout [ 1738.378397][T29022] netlink: 'syz.4.6086': attribute type 1 has an invalid length. [ 1738.488157][T28893] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1738.546740][T28893] wireguard: wg0: Could not create IPv4 socket [ 1738.570391][T28893] wireguard: wg1: Could not create IPv4 socket [ 1738.588044][T28893] wireguard: wg2: Could not create IPv4 socket [ 1738.610087][T22794] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1738.624486][T22794] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1738.636219][T22794] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1738.647576][T22794] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1738.657302][T22794] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1738.701724][T29029] Failed to initialize the IGMP autojoin socket (err -2) [ 1739.727862][T29029] netdevsim netdevsim0 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1739.812847][T29048] lo: entered promiscuous mode [ 1739.818061][T29048] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6093'. [ 1739.834599][T29048] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1739.899145][T29029] netdevsim netdevsim0 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1740.063794][T29029] netdevsim netdevsim0 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1740.153885][T29053] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input248 [ 1740.252098][T29029] netdevsim netdevsim0 eth5 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1740.470912][T29029] netdevsim netdevsim0 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.485477][T29029] netdevsim netdevsim0 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.568529][T29066] overlayfs: failed to resolve './file1': -2 [ 1740.699071][T29029] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.760591][T27491] Bluetooth: hci3: command tx timeout [ 1740.912946][ T30] audit: type=1326 audit(1752794616.184:3190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=29054 comm="syz.5.6095" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc458e929 code=0x7fc00000 [ 1740.943210][T29029] netdevsim netdevsim0 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1741.569625][T29082] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6100'. [ 1741.595069][T29082] overlayfs: failed to clone upperpath [ 1742.493505][T29029] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1742.540083][T29029] wireguard: wg0: Could not create IPv4 socket [ 1742.562532][T29029] wireguard: wg1: Could not create IPv4 socket [ 1742.580731][T29029] wireguard: wg2: Could not create IPv4 socket [ 1742.763046][T29029] [ 1742.765384][T29029] ====================================================== [ 1742.772392][T29029] WARNING: possible circular locking dependency detected [ 1742.779400][T29029] 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 Not tainted [ 1742.786496][T29029] ------------------------------------------------------ [ 1742.793507][T29029] syz-executor/29029 is trying to acquire lock: [ 1742.799735][T29029] ffff888078a43840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0x4d0/0xcc0 [ 1742.811290][T29029] [ 1742.811290][T29029] but task is already holding lock: [ 1742.818635][T29029] ffff888078a43b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 [ 1742.827494][T29029] [ 1742.827494][T29029] which lock already depends on the new lock. [ 1742.827494][T29029] [ 1742.837872][T29029] [ 1742.837872][T29029] the existing dependency chain (in reverse order) is: [ 1742.846862][T29029] [ 1742.846862][T29029] -> #1 (&conn->lock#2){+.+.}-{4:4}: [ 1742.854317][T29029] __mutex_lock+0x199/0xb90 [ 1742.859320][T29029] l2cap_info_timeout+0x79/0xa0 [ 1742.864680][T29029] process_one_work+0x9cf/0x1b70 [ 1742.870555][T29029] worker_thread+0x6c8/0xf10 [ 1742.875648][T29029] kthread+0x3c5/0x780 [ 1742.880216][T29029] ret_from_fork+0x5d7/0x6f0 [ 1742.885313][T29029] ret_from_fork_asm+0x1a/0x30 [ 1742.890578][T29029] [ 1742.890578][T29029] -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}: [ 1742.900807][T29029] __lock_acquire+0x126f/0x1c90 [ 1742.906156][T29029] lock_acquire+0x179/0x350 [ 1742.911158][T29029] __flush_work+0x4e4/0xcc0 [ 1742.916162][T29029] __cancel_work_sync+0x10c/0x130 [ 1742.921688][T29029] l2cap_conn_del+0x5af/0x730 [ 1742.926869][T29029] l2cap_disconn_cfm+0x96/0xd0 [ 1742.932137][T29029] hci_conn_hash_flush+0x10b/0x260 [ 1742.937751][T29029] hci_dev_close_sync+0x602/0x11d0 [ 1742.943364][T29029] hci_dev_do_close+0x2e/0x90 [ 1742.948540][T29029] hci_unregister_dev+0x227/0x640 [ 1742.954067][T29029] vhci_release+0x79/0xf0 [ 1742.958902][T29029] __fput+0x402/0xb70 [ 1742.963389][T29029] task_work_run+0x14d/0x240 [ 1742.968480][T29029] do_exit+0x86c/0x2bd0 [ 1742.973578][T29029] do_group_exit+0xd3/0x2a0 [ 1742.978588][T29029] __x64_sys_exit_group+0x3e/0x50 [ 1742.984120][T29029] x64_sys_call+0x1530/0x1730 [ 1742.989302][T29029] do_syscall_64+0xcd/0x4c0 [ 1742.994308][T29029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1743.000702][T29029] [ 1743.000702][T29029] other info that might help us debug this: [ 1743.000702][T29029] [ 1743.010908][T29029] Possible unsafe locking scenario: [ 1743.010908][T29029] [ 1743.018333][T29029] CPU0 CPU1 [ 1743.023677][T29029] ---- ---- [ 1743.029021][T29029] lock(&conn->lock#2); [ 1743.033250][T29029] lock((work_completion)(&(&conn->info_timer)->work)); [ 1743.042772][T29029] lock(&conn->lock#2); [ 1743.049518][T29029] lock((work_completion)(&(&conn->info_timer)->work)); [ 1743.056522][T29029] [ 1743.056522][T29029] *** DEADLOCK *** [ 1743.056522][T29029] [ 1743.064646][T29029] 5 locks held by syz-executor/29029: [ 1743.069994][T29029] #0: ffff888067640dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 1743.079539][T29029] #1: ffff8880676400b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 1743.089180][T29029] #2: ffffffff905cfb28 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 1743.099167][T29029] #3: ffff888078a43b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 [ 1743.108466][T29029] #4: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xfb/0xcc0 [ 1743.117580][T29029] [ 1743.117580][T29029] stack backtrace: [ 1743.123449][T29029] CPU: 1 UID: 0 PID: 29029 Comm: syz-executor Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 1743.123468][T29029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1743.123476][T29029] Call Trace: [ 1743.123480][T29029] [ 1743.123486][T29029] dump_stack_lvl+0x116/0x1f0 [ 1743.123507][T29029] print_circular_bug+0x275/0x350 [ 1743.123528][T29029] check_noncircular+0x14c/0x170 [ 1743.123549][T29029] __lock_acquire+0x126f/0x1c90 [ 1743.123562][T29029] ? irqentry_exit+0x3b/0x90 [ 1743.123582][T29029] lock_acquire+0x179/0x350 [ 1743.123594][T29029] ? __flush_work+0x4d0/0xcc0 [ 1743.123609][T29029] ? preempt_schedule_thunk+0x16/0x30 [ 1743.123626][T29029] ? __flush_work+0x4d0/0xcc0 [ 1743.123641][T29029] __flush_work+0x4e4/0xcc0 [ 1743.123655][T29029] ? __flush_work+0x4d0/0xcc0 [ 1743.123669][T29029] ? detach_if_pending+0x211/0x280 [ 1743.123688][T29029] ? __pfx___flush_work+0x10/0x10 [ 1743.123703][T29029] ? __pfx_wq_barrier_func+0x10/0x10 [ 1743.123725][T29029] ? __pfx___might_resched+0x10/0x10 [ 1743.123744][T29029] __cancel_work_sync+0x10c/0x130 [ 1743.123760][T29029] l2cap_conn_del+0x5af/0x730 [ 1743.123779][T29029] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 1743.123795][T29029] l2cap_disconn_cfm+0x96/0xd0 [ 1743.123811][T29029] hci_conn_hash_flush+0x10b/0x260 [ 1743.123826][T29029] hci_dev_close_sync+0x602/0x11d0 [ 1743.123841][T29029] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 1743.123856][T29029] ? up_write+0x1b2/0x520 [ 1743.123871][T29029] hci_dev_do_close+0x2e/0x90 [ 1743.123884][T29029] hci_unregister_dev+0x227/0x640 [ 1743.123898][T29029] ? __pfx_vhci_release+0x10/0x10 [ 1743.123917][T29029] vhci_release+0x79/0xf0 [ 1743.123936][T29029] __fput+0x402/0xb70 [ 1743.123952][T29029] task_work_run+0x14d/0x240 [ 1743.123965][T29029] ? __pfx_task_work_run+0x10/0x10 [ 1743.123978][T29029] ? switch_task_namespaces+0xeb/0x100 [ 1743.123998][T29029] do_exit+0x86c/0x2bd0 [ 1743.124017][T29029] ? do_raw_spin_lock+0x12c/0x2b0 [ 1743.124030][T29029] ? __pfx_do_exit+0x10/0x10 [ 1743.124049][T29029] ? rcu_is_watching+0x12/0xc0 [ 1743.124067][T29029] do_group_exit+0xd3/0x2a0 [ 1743.124086][T29029] __x64_sys_exit_group+0x3e/0x50 [ 1743.124105][T29029] x64_sys_call+0x1530/0x1730 [ 1743.124118][T29029] do_syscall_64+0xcd/0x4c0 [ 1743.124130][T29029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1743.124143][T29029] RIP: 0033:0x7f09e798e929 [ 1743.124153][T29029] Code: Unable to access opcode bytes at 0x7f09e798e8ff. [ 1743.124159][T29029] RSP: 002b:00007ffd093445c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 1743.124172][T29029] RAX: ffffffffffffffda RBX: 00007f09e7a11a80 RCX: 00007f09e798e929 [ 1743.124181][T29029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 [ 1743.124188][T29029] RBP: 00007f09e79ed658 R08: 00007ffd09342367 R09: 000000000000002d [ 1743.124196][T29029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1743.124204][T29029] R13: 000000000000002d R14: 00007ffd09344702 R15: 0000000000000024 [ 1743.124217][T29029] [ 1743.609543][T27491] Bluetooth: hci3: command tx timeout