last executing test programs: 3m31.07407086s ago: executing program 3 (id=202): syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f00000003c0)="8c", 0x1}], 0x1) close(r0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = getuid() ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000000)={0xffff, 0x5, {r2}, {r3}, 0xd40, 0x734}) 3m27.965967865s ago: executing program 3 (id=210): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$swradio(0x0, 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000002c0)) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000380)={0xa, 0x4e21, 0xb744, @empty, 0xfffffffb}, 0x1c) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x101400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4138ae84, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x80, 0x0, '\x00', 0x5c8d}) execveat$binfmt(0xffffffffffffffff, 0x0, &(0x7f0000000580)={[&(0x7f0000000480)='/dev/adsp1\x00', &(0x7f00000004c0)='/dev/swradio#\x00', &(0x7f0000000500)='\x00', &(0x7f0000000540)='\x00']}, 0x0, 0x400) ioctl$KVM_RUN(r9, 0xae80, 0x0) landlock_create_ruleset(&(0x7f0000000000)={0x0, 0x1}, 0x18, 0x0) syz_usb_connect(0x4, 0x822, &(0x7f0000000e40)=ANY=[@ANYBLOB="12010002848946ff4d1d0c009711010203010902100803210010010904140f00b80fb7060a240109000902010209240305fb02040302112406020205030006000400060002000508240505fc489f310b24040260f5d74665a1f7052405058109047e0809c4e4130109050d10ff03190e1d09058001ff030600096323fb447ad422c6fb89b413bb7479684ba153f15f8f6f1c4781d0f238e000b0b244da55bd794ce1f85172e00e97050b67fda0e47fb00fe703e1bdc39f1bdae7c61f86eb160ac623d813a7ad1f4202ab454843b2e7ed2caf80fc8652d2bf7581a3f2d609050e044000070d0509050c1d0000011f087b0dc5c0bdc29492e54dbcf0e81f2202ddd6d466ff4059ccd0133121b7fe039dfac3793b7f523c55299a358991390c23b13fe78fbfcea8d0dba58099408cd289205a628f21010cb00697028a98116f7521b3c42fb596d1376c27ca1ad769d8f694c749314108b48afad637f59ac608bb7b97bc58ba099e51de8f69072501f6e0030009050c101000020e0d410c26f5046af0276a40f990be2b5c39e1a4b6abecbcd88363fc0f8b96224e6ac781fd22ae23eb6bdcf023c58f550c5a0dd23f04a2bee664295a991210d7458cc7072501808f060009050901ff038a070eb82358f56c744b9b29edc00cbca93ec2c3a9ccbf8c5b42722932f25ec3bf76abf8349e9a7e08fae1fd7b442fcac625b57eca929f0a53dddb51d036235a78d185e27e44c17d420a78485585946aa3878d2c3f1bfeba232621babdc0513be397d45eee60659ecaa5948a7332333e32803fb1b91842a6f5de870a88d7817176b819e96c203466a75bb6e12fb3c1ed3bbe0b2f95306c517ead5e5dbefb0fd2edc74ebfa9a0a52e3df7a444d286d383f8094e121a52bafa6111756b01d711f13ed609e160a4fe792461d93b458b91067321480acf39685cb92b63dbe867a80b1267f4d346e01de58cb15bbe11b1821cb4e8271c586f5fe2f755fbb3d71b4f7ed05d4fa45a1cf4a5e29061efdf0420dbddb1c59ff905e224c1e534e0cc2e27dee22b7754271f0905090110000d02fb0725010301050009050d00080006040809050c000002090200072501030403006f2162577cba293bba305869f08ab851fb587e2eed458fc5bee46fb025d3b967f9be90be8b40ef3017c99ab22f13b5397107174a572a16ea33ad9f9831c43dd24de095a4d57925d4674c489889f2ccdabe0f1557cd9c48a56a1fb0a9197b1d83cd6232ebd79caba58a2a6b22e45ebf0904068110fc5b82d70921faff800122470209050910400040080f09050100000207340607250183080010090507040800004b041407c3d9b8972f8536b56b1b8ed984d6edf464bd4d09d26cb3c2f7baadaa3bd87077a9a8f8612496be2550945fc67626adc5237aed5a823bb25bfdf6efbf4da53ba7e4637e19ca02a543eddd5c78a05eb618636ae8ef03a0cc3025495a9f76ec02090500082000090c04bd30adba40ad1ea8dc90ac1abc5ca3dda59c3ebce8a129bf6f032a360f20404e0a030a7d4e48eba9df4a9a953f5cf9bf995c43567488b4f501e2c8587a8c8265c9f6c498ce5050ef1a8c7160ac450c51ac98f80c53ee9bbe3d78eac1d1d1612d762951c300de140984119d0877b92131b45b05d316d00414199dd474583c53bb5470053e00a6531bc4eb7e2969e67993b54ba02c0514d2b10aa380e3a0266562e496a2d0ec36c56dd0355b06b92972b24a9afb3d77edc3afb2497e43050404692409050c032000080dca07250180073a0009050c007802050140072501030206000905070008008004ab0725010003eff7072501022a08000905020210006ff6a3696c4a85f115ba000403ce77fb79afa920ba41ea90d69bcf0f00d0c069e995c6fc91e8753cc06b8a66e557772ee323ef15e33cc03d488fba1b9458d147029835823da1d29bc5ad06cb1961a9073703a33e9a0aac26689563d7af64d967db9ba5f243f8b14f2ac885e0eb0fc8141a089e3edece84c8d0e3948e48fde590e4d5669331e884f338771c338a979a058314f00e35992c9d857fd47017ed60860916fe6284f955e25349d82db94dba21733cd8173264b8df4bc38f2b6a78794da97e944c08b55138b67532b3c79fd747bb0e4df3f4f68549ae438c4909acc599060dd6978666647661d9c3c2a5d009464203101ca72a7b678ab34cc10e6cab5f0a389ee827531407b6d324c77c700e8f78fc1b677d01e317d7fb0d16b720d9dc739eecdb6ee5e004e5da07bd0a1f39e4a3caadc5aa8a0c38733c1a624d59fc5ccf7589e9bbc0306631677df302090504004000023808072501000907004406bcf5c276eb7e6041ded0936f8e701ff524cc17c62017a427da4e43e4c15d518d62d88b36e4405d67b02f0ee5f956445091bfdf5c3301db9854f0af967d92ecb2444409050f0040008106080725010205030009050f1020004c01fe2d0f11d86072c3a4dc06475987707a7f57674d55c7cddeb72f51b8e6df285d3acdfd74fffcd909f0c125a5f7c25f0090880f27b7c612e6978ac0aa202e951a72326c81c179db4829e6b2c49e529d92919074d2ac85dcfd21775670929a6bda96a3013924c292af15bc6bc415b50df0ce63478c0b9b26d99e91ac795ec85d3b98852b5a407a9ba691135e902e0905080240000301810725018106040007250183810a000905030308008f04c1090502001000a9ef0609050d1000020807810725018003010009050e100800400307642254d79160e3bb2b979055366518a0402e0d7197feac1163166820e42a96d9892377f31677125d1a67551d627f8fa316782e390ff4d8399b71c69deb70ff938756404953b45c193bad68ff74b3f3fb0192880b5bb2913370fcf3e84d1890266b9374fb0a314b143e0f2ad0324875d1410ef864fe7cb1f420aa6e7cf7b100"/2098], &(0x7f0000000e00)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x10, 0x0, 0x15, 0x66, 0x40, 0x8b}, 0x19, &(0x7f0000000400)=ANY=[]}) openat$full(0xffffffffffffff9c, 0x0, 0x2fb71da98128d4bd, 0x0) readv(r1, &(0x7f0000000240)=[{&(0x7f0000000040)=""/84, 0x9000}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "58090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) 3m24.641956985s ago: executing program 3 (id=217): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0xfe49, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) bind$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet(0x2, 0x2, 0x1) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/notes', 0x0, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) sendfile(r6, r5, 0x0, 0x4102) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='macvlan0\x00', 0x10) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r7, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) 3m23.012160659s ago: executing program 3 (id=220): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x1805406, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x80000, 0x0) unshare(0x4000000) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) 3m22.87715295s ago: executing program 3 (id=221): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c230000) ioctl$TUNSETOFFLOAD(r0, 0x80047456, 0xf0ff1f0000001f) 3m20.389110111s ago: executing program 3 (id=226): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0x0, 0x2, 0x0, 0x25b}, 0x0, &(0x7f0000ffe000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x20000000) r2 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r2, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000200)={0x6, 0x2, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r6, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_IOAS_UNMAP$ALL(r5, 0x3b86, &(0x7f0000000240)={0x18}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000440)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) r7 = fsopen(&(0x7f0000000000)='f2fs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f00000000c0)='test_dummy_e{cryption', &(0x7f0000000040)='vto_da_allos\x00\xe9\x82\xdb ', 0x0) 3m19.692716503s ago: executing program 32 (id=226): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0x0, 0x2, 0x0, 0x25b}, 0x0, &(0x7f0000ffe000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x20000000) r2 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r2, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000200)={0x6, 0x2, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r6, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_IOAS_UNMAP$ALL(r5, 0x3b86, &(0x7f0000000240)={0x18}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000440)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) r7 = fsopen(&(0x7f0000000000)='f2fs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f00000000c0)='test_dummy_e{cryption', &(0x7f0000000040)='vto_da_allos\x00\xe9\x82\xdb ', 0x0) 2m31.141979516s ago: executing program 0 (id=371): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x20002, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r6, 0x301, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}}, 0x0) 2m30.132617043s ago: executing program 0 (id=373): syz_usb_connect(0x0, 0x24, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2}, 0x14) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000300)='5\xfd\x04\xc6\xc9]\v\xd6S9q\x0f#\x93\x9d\xeb\x00\xcf\xb2~9*\xa9\x1d:\x06u46N\xd93\xe1\xa2\x05\x83Z\xbc\xbeT\x16\xab\xfb=4\xa6\x10,\"\xee\xf8o+\x02\xd8\xaft_\r\x1d\"\xc8\\k\xcc4\x96\xdb\xb0\xadA\x02[\x16\xb4\xca\xa5n\x87\xdb\xb3\x1f\xbb\xc0\x9f\xc2\x9e\t[\xba\x9e\xfd\xc76#\x8f\xc6\xe7\x11\x8fL\xd970x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r2, 0x301, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}}, 0x0) 2m24.647876882s ago: executing program 0 (id=388): sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16, @ANYBLOB="050000000000000000", @ANYRES32, @ANYBLOB="3d000e0080000000ffffffffffff080211000000ffffffffffff0000feffffffffffffff070001000406f0027f0006a7000c006400000008000d000000000073f68ac399765b7ab289a21d254ebf1c30920188d7e0527bff31151da7c57628327841e9134f4b1b378bcbf5a202"], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac1414000a0101004414050300000000000000000a010101000000008903ce07020000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850", 0x4, 0xfffffffffffffffe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001000050400", @ANYBLOB="ebffffffffffffff"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2m22.075176637s ago: executing program 0 (id=399): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x10) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x36}}, 0x4004815) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/bus/input/devices\x00', 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/disk', 0x169a82, 0x18c) unshare(0x40400) pselect6(0x40, &(0x7f0000000180)={0x1f, 0x0, 0x3ff, 0x0, 0x9}, 0x0, 0x0, 0x0, 0x0) read$FUSE(r5, &(0x7f0000002480)={0x2020}, 0x2020) setsockopt$MRT_INIT(r5, 0x0, 0xc8, &(0x7f0000000580), 0x4) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/card1/oss_mixer\x00', 0x400000, 0x0) r7 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(r7, &(0x7f0000000440)='./file0\x00', 0x80) bind$802154_dgram(r6, &(0x7f00000001c0)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0202}}}, 0x14) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) eventfd(0xfffffff9) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000180)) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYRESDEC], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x401}, 0x8}, 0x94) mknod(&(0x7f0000000000)='./file0\x00', 0x8, 0x184) 2m20.512407594s ago: executing program 0 (id=401): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000180)={0x1, 0xffffffffffffffff, 0x2}) sendmsg$inet(r0, &(0x7f0000000580)={&(0x7f0000000200)={0x2, 0x4e20, @private=0xa010100}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000280)="2397b16c1c1e03450e6734e2eb67f1f8c0f7545307f32c1824f6f4e65ec6f9", 0x1f}, {&(0x7f00000003c0)="23fda0b57001002cce67050deeebcd7d32a4354f99f8dbaebc3e4e421f1c9cb9590522ad29358adbd46559d84729406034e807fd602e54b94f882168a0e4da1ed85fd01c38d1e2dd51c8d5d63a25a76f6a65398d5a59d30f17693d04f9cc", 0x5e}, {&(0x7f0000000480)="b6c72ce861e713a617310456abbfc331ac583356636257f706e5cfb16be17d4c309a4e3a4559d2cba067dd19af0a834bc83bcd2f75307520c74011f3314c997ebc92", 0x42}, {&(0x7f0000000500)="268af08677c31cffcb1cb9ea28fffdbc3b08fc549cc9e24be57e5ea627653189699761d6e0d24101b5ec40d22be41a910ac612fb237fcc8a1c6e57b6a348666a83db81db7660116e585b3448531a397c", 0x50}], 0x4}, 0x24044000) r1 = syz_io_uring_setup(0x832, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) r4 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r4, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0, 0x2020, 0x1}) io_uring_enter(r1, 0x27e2, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r5, 0xffffffff80000800, 0xee01, &(0x7f00000000c0)={0xffffffffffffffff, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1000000000000000, 0xfffffffffffffffc, 0xdf}) 2m5.417619746s ago: executing program 33 (id=401): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000180)={0x1, 0xffffffffffffffff, 0x2}) sendmsg$inet(r0, &(0x7f0000000580)={&(0x7f0000000200)={0x2, 0x4e20, @private=0xa010100}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000280)="2397b16c1c1e03450e6734e2eb67f1f8c0f7545307f32c1824f6f4e65ec6f9", 0x1f}, {&(0x7f00000003c0)="23fda0b57001002cce67050deeebcd7d32a4354f99f8dbaebc3e4e421f1c9cb9590522ad29358adbd46559d84729406034e807fd602e54b94f882168a0e4da1ed85fd01c38d1e2dd51c8d5d63a25a76f6a65398d5a59d30f17693d04f9cc", 0x5e}, {&(0x7f0000000480)="b6c72ce861e713a617310456abbfc331ac583356636257f706e5cfb16be17d4c309a4e3a4559d2cba067dd19af0a834bc83bcd2f75307520c74011f3314c997ebc92", 0x42}, {&(0x7f0000000500)="268af08677c31cffcb1cb9ea28fffdbc3b08fc549cc9e24be57e5ea627653189699761d6e0d24101b5ec40d22be41a910ac612fb237fcc8a1c6e57b6a348666a83db81db7660116e585b3448531a397c", 0x50}], 0x4}, 0x24044000) r1 = syz_io_uring_setup(0x832, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) r4 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r4, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0, 0x2020, 0x1}) io_uring_enter(r1, 0x27e2, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r5, 0xffffffff80000800, 0xee01, &(0x7f00000000c0)={0xffffffffffffffff, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1000000000000000, 0xfffffffffffffffc, 0xdf}) 10.021784546s ago: executing program 1 (id=915): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x40000000000010d, 0x20044001) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r3, 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async, rerun: 32) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) (async, rerun: 32) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async, rerun: 32) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000203030100000000000000000400000a0800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) (async) sendmsg$NFQNL_MSG_VERDICT(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000000103030000000000000000000000000a0c0002000000bed30af6e9a1fca8be9c522b24b4a4f8000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x10) sendfile(r3, r2, 0x0, 0x40008) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x80002, 0x0) (async, rerun: 64) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x2b}) (rerun: 64) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="02080000010000000000000100"], 0x18}}, 0x0) 8.170731487s ago: executing program 5 (id=916): r0 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r0, &(0x7f0000000340)={&(0x7f00000002c0)=@in6={0xfd, 0x4e23, 0x0, @loopback, 0x2}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000740)="8b0a751c7aead06880515a5d", 0xc}, {0x0, 0x62}, {&(0x7f00000005c0)="15e1baf1349f8d540d311f161a740d1b86cf345bc603db7d283c2802fc53de3f309bd862b47a6f3fb15399f9e1789ecfad08895b956296436ac2e416bd0b57b6328af5cae6c6e1e60d4f015f270cd7c7e58aee6bac71301c50119e268eda0badb58929596e1028bf29eef608d31ba4324f23ff82f0fae451416905842991adfec5dbbd0dde15ba01d705b90663da02445957ca0768539b297e7531f8afe28ffca55563ee0a6b23c31b87dda1eb90551be1ccba2e9a4e19d0297af6", 0xbb}], 0x3}, 0x200ce0c0) 8.105875338s ago: executing program 4 (id=917): syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000006c0)={0x84, r3, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x73, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_ALLOWEDIPS={0x20, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0xff}}]}]}]}]}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}]}, 0x84}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r1, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="feb14bd3d8ab3bf1aeee7a3ceb000000100100000c000000000000"], 0x10}, 0x0) r6 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f00000001c0), 0x4) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendfile(r1, r1, 0x0, 0x40008) 7.48975466s ago: executing program 5 (id=918): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) setresgid(0xee00, 0xee01, 0x0) setgroups(0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f00000013c0)=""/4096, 0x1000}], 0x1, 0xffffffff, 0x800) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) r4 = syz_io_uring_setup(0x9ee, &(0x7f0000000180)={0x0, 0xa5e9, 0x100, 0x3, 0xfffffffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0x7ffa, 0xba1c, 0x40, 0x0, 0x39) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = syz_io_uring_setup(0x234, &(0x7f0000000380)={0x0, 0x82fd, 0x10, 0x4, 0x2c7}, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) io_uring_enter(r8, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time\x00') 7.339349977s ago: executing program 1 (id=919): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000001c0)={0x0, 0x5d, "84ac1777992f431fc9c971114f70ffc4ab4c3d8489772ebf06b779240d8e2eea2e63f0ec7f1cf3cf24e526402a676b8ba5e72c2b7df39c5f1a4d6a1cad74b8949666c0fd79f26818e16e00bc2fd8ee3b51ff7fd87a93b290d9c418713e"}, &(0x7f0000000040)=0x65) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, 0x0, &(0x7f0000000300)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x9) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg(r5, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r7, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002002000000006000100020000000800060003000000080003"], 0x84}}, 0x20000000) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYRES32=r8], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1) lsetxattr$security_selinux(&(0x7f0000000180)='.\x00', &(0x7f00000001c0), 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x8f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100187805b085705082008a70102030109027d0002a200000009048e040349a6df5b0a24010a00060201020c240805060050d0070d0a329ce2090586100004f40804072501832f08000905000040008103ff0905091b08000c07800904700104a78c6703090509000000030004090502020002f78106090557c3910a6629df66610944bfbc0303ff030840040705a6"], 0x0) 5.286122994s ago: executing program 6 (id=922): mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000647000/0x1000)=nil, 0x1000) r0 = creat(&(0x7f0000000040)='./bus\x00', 0xa8) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x20) r1 = socket$qrtr(0x2a, 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x53033, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000fde000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 5.244016241s ago: executing program 5 (id=923): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x1f, 0x14, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000009000000000000008200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000004c5c008500000086000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x1a, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000c7aeab151b083c0b3b3209684d3c"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_emit_ethernet(0x52, &(0x7f0000000000)={@local, @random="e38f6cc55385", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x1c, 0x6, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@generic={0xfe, 0x6, "e6673fcf"}]}}}}}}}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x3a) io_setup(0x2, &(0x7f0000000200)=0x0) r6 = io_uring_setup(0x1fc4, &(0x7f0000000bc0)={0x0, 0x0, 0x12, 0x0, 0x320}) io_getevents(r5, 0x1007, 0x800000000000019, &(0x7f0000000280), 0x0) close_range(r6, 0xffffffffffffffff, 0x0) r7 = dup(r4) bind$unix(r7, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080c48000000e8fe55a1180015000600142603600e120900210000000401a80016000a0001", 0x37}], 0x1}, 0x0) r8 = socket$kcm(0x10, 0x6b98f5f3114b39dc, 0x0) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[], 0xfe33) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, &(0x7f0000000300)={0xef0, {{0xa, 0x4e24, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}}, {{0xa, 0x4e22, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}}}, 0x108) 5.177021116s ago: executing program 6 (id=924): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000040)={0x2, @raw_data="c57c442e2140283a617244d27d4833b49597e2a6b651ce290628ba9a43a2e8874055895d90afe1eb9f0b5e1a29e34eee8303c3c401df84d1dece510206b1347512df6324bbb1ebef51ca5ba689c01986af7868cb00f00ebdf66918d86d0f94709209cdace79ad786253bdfb0e942b72faa182fedec277f7d23cddb70a921238b2325449b8d6339ec7264ef62874fde1e8804242dbbb72437aaf2a8d22acad80c202dc43b951322dbc11d68979405241549cefa0c07bf38396b9a0490569a9269a38bdc14ba8fae98"}) write$vga_arbiter(r1, &(0x7f0000000240)=@other={'trylock', ' ', 'mem'}, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 4.877866835s ago: executing program 2 (id=926): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) shmdt(0x0) r0 = socket(0x10, 0x3, 0x0) connect$netlink(r0, &(0x7f0000000280)=@proc={0x10, 0x0, 0x1}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f00000002c0)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x11, &(0x7f0000000140), 0x4) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="8400000010000305000000040000000000000000", @ANYRES32=0x0, @ANYBLOB="1546010000000000540012800c0001006d6163766c616e0044000280060002000100000008000100010000000800030003000000080007000500000008000100100000000600020001000000100005800a0004"], 0x84}}, 0x20008040) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x20, 0x10, 0x509, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x380}}, 0x20}, 0x1, 0xd, 0x0, 0x14}, 0x0) 4.877576383s ago: executing program 6 (id=927): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0xc, 0x2, {0x3, 0x4, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r4, &(0x7f0000000480)=""/74, 0x4a) 4.828856686s ago: executing program 4 (id=928): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400b500000000040000000000", @ANYRES32=0x0, @ANYBLOB="00000000001400001c00128009000100626f6e64000000000c0002800800"], 0x3c}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x18) (async) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000480)=@fd={0x9, 0x5, 0x4, 0x20, 0xfff, {0x0, 0xea60}, {0x3, 0x8, 0x2, 0x8, 0x8, 0x8, "fbeeb8fe"}, 0x8001, 0x4, {}, 0x1, 0x0, r1}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r3 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x3, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) (async) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000200"/38], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r6, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) (rerun: 64) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x28, r9, 0xc79c59394d69f4e3, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x400c010) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x9, 0x1, &(0x7f0000000400)=@raw=[@generic={0x9, 0x1, 0xf, 0x40, 0x10001}], 0x0, 0x8, 0x0, 0x0, 0x41100, 0x35, '\x00', 0x0, @cgroup_sock=0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r7, r5, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) ioctl$USBDEVFS_REAPURBNDELAY(r4, 0x4004550d, &(0x7f0000000500)) (async) r10 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x3, r10, 0x1, &(0x7f00000003c0)) 4.769944595s ago: executing program 5 (id=929): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) ioctl$HIDIOCSREPORT(r2, 0x4018480c, &(0x7f0000000000)={0x2, 0x200, 0x10000}) 4.728835106s ago: executing program 2 (id=930): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)={0x30, 0x3e, 0x107, 0xbffffffc, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@nested={0x8, 0x14, 0x0, 0x1, [@nested={0x4, 0x80}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (fail_nth: 1) 4.565819696s ago: executing program 2 (id=931): socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r3}}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000a7ec0937eb8c5ca3cdfb854df117def9275aa4d8337b6d131d51443d6839a381436407481261f29ce0ebb15f0b8492adf98205623a2bd95f223666644f3fa5b15fe83084e2ef9080467aff316f6ce09b4cc5c7e190fc64bc5c2faa02ff300e5f29f1abc578d924630a8b3fd241a1663431ac23d62c5ded807096554fcab6dcbdfa952acdce8dac6a495c5a1839cecad925ea37aa1b083dd2d68518ab52379051597498dc5bdd90bfe8e70a569d0b75c87573293f4df5f58aa1610988bb7d", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_emit_ethernet(0x62, &(0x7f0000000080)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xfe, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @local, @rand_addr=0x64010102, {[@cipso={0x86, 0x22, 0xffffffffffffffff, [{0x0, 0x8, "e256b28c5988"}, {0x0, 0x8, "020007651442"}, {0x0, 0x2}, {0x0, 0xa, "6580a5e97612fe86"}]}]}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'netdevsim0\x00'}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x4000010) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_ax25_SIOCADDRT(r6, 0x890b, &(0x7f00000000c0)={@default, @default, 0x0, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) syz_init_net_socket$ax25(0x3, 0x3, 0xc4) syz_usb_connect(0x3, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058da203002a000009050502000000000009058b"], 0x0) 3.854725804s ago: executing program 4 (id=932): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201000000000010030430600000000000010902240001000050780904000001030000000921fdff000122a00009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="0000d2000000d200a7ea311df0"], 0x0, 0x0, 0x0, 0x0}, 0x0) 3.389568128s ago: executing program 1 (id=933): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) setresgid(0xee00, 0xee01, 0x0) setuid(0xee00) preadv(r3, &(0x7f0000000240)=[{&(0x7f00000013c0)=""/4096, 0x1000}], 0x1, 0xffffffff, 0x800) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) r4 = syz_io_uring_setup(0x9ee, &(0x7f0000000180)={0x0, 0xa5e9, 0x100, 0x3, 0xfffffffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0x7ffa, 0xba1c, 0x40, 0x0, 0x39) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = syz_io_uring_setup(0x234, &(0x7f0000000380)={0x0, 0x82fd, 0x10, 0x4, 0x2c7}, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) io_uring_enter(r8, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time\x00') 3.093865429s ago: executing program 6 (id=934): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000008000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r1}, 0x10) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x861e, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000600), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_NESTED_STATE(r5, 0xc080aebe, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000140)='dctcp\x00', 0x6) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f0000000180)) umount2(&(0x7f00000000c0)='./file0\x00', 0x2) 2.930295832s ago: executing program 5 (id=935): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x20002, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r4, 0x301, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) 2.782619941s ago: executing program 1 (id=936): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x22, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 2.004758188s ago: executing program 1 (id=937): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_HANDLE(r0, 0x113, 0x3, 0x0, 0x0) connect$phonet_pipe(r0, &(0x7f0000000000), 0x10) r1 = socket$packet(0x11, 0x2, 0x300) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00') memfd_create(0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000180)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x5) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f00000005c0)=[{{&(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee3c0cb001829a8681ed391da1a71d8d", 0x15}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000440)="dd8c6daffbbd42f0518becca5f9455156c24947f238046e2e3c07dad94fcf7ee9fda3c14cc2afe3cbb8166346c636b3282b4bfa77e65d3f27dd4f2565e701ea4ab9fe676bea39376c7a771e20572fdf142dbf06b3267bb27b8ca4b46c859bc6ffc4fcd7cc37b02948e4d17f002c010d3d0a2992a8a7d4eba1759e973e5cf568e38402fd13b26fd4b1a08c458675520344aa4ab3d30f9e766ec5eda8d3e6525eca87ca7159d052a", 0xa7}], 0x1, &(0x7f0000000580)=[@ip_ttl={{0x14, 0x0, 0x2, 0x80000000}}, @ip_ttl={{0x14, 0x0, 0x2, 0xfa7}}], 0x30}}], 0x2, 0x20008000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x0, 0x100, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ptrace$getsig(0x4202, 0x0, 0x9, &(0x7f0000000200)) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "f1a0f9fff9e440b4", "881aae83544dfa6412f91b9057e3f415", "9dca43b6", "9ecb592c6ee49fbd"}, 0x28) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x7}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x48, 0x83, 0x0, 0x80000001}, {0x6, 0x5, 0x0, 0xfffffc}]}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000018c0)={&(0x7f0000001900)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000010200000000000000000000600a8168000000"], 0x0, 0x26, 0x0, 0x1, 0xfffffa16}, 0x28) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) write$binfmt_aout(r4, &(0x7f00000001c0)=ANY=[], 0xff2e) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x40) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="7573fd816653f41136bad3247205a308931ae86284e01ca499dd5b314eb0d0e828608fc40577510f76e5714f35c4453440cb506778d1fbd9c0d39ecb5adb7c43a6ed8e3d1e977d12ca", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 1.982050978s ago: executing program 4 (id=938): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x10}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x5) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r7, 0x541b, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 1.976602969s ago: executing program 6 (id=939): syz_open_procfs(0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aabbbbbbbbbb8a0a63cdec5908060001080006040001aaaaaaaaaa0aabfe14bbaaaaaaaaaa00ac"], 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000240)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xeaNg\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) write$binfmt_misc(r1, &(0x7f0000000740), 0xff67) sendfile(r0, r1, &(0x7f0000000000), 0xfffb) fcntl$addseals(r1, 0x409, 0x8) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@mss={0x2, 0x8}, @sack_perm, @window={0x3, 0x8000, 0xfffc}, @sack_perm, @sack_perm, @window={0x3, 0xfff, 0x4}, @window={0x3, 0x5}], 0x7) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r4, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) sendto$packet(r2, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0xc, 0xc8, 0xfa}}}, 0x7) 1.274514949s ago: executing program 1 (id=940): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000100)="441dc4cccf61bbe670c9a162ee3f4131f7ac93e15ff13e5e3266848f4ac39db1d922e8e19d1b0caf9b88b18d9c81f0af935f3fcd6e0a16373e04b463f98d1aeafc3a6ac932c774e6e0611525b8562297592bbc2ffae0c996a6a6e4e9fc86eaf126c239c24ddcb16a04449dcb3115b95e9cac1d35320e1f866472e4f38cdd2b018beccb380d7fc746839f90af4b119b2167ac65109ae202edc80dbb609f86e6141a2be5fa0c0272193ff985952ec06a2ec1e0410448e3d09d842c6cdccf8e59b465aab77390a79c4b81d91d43a1e1bf5861a2f04fbd636f309a91f5a9c33d25f7b03c589dab2f4d4849c2146bbc1c24e4998baefbdbdefc809a8d1550c4695d7c082ec2931863500f279624f7e6da93a78308daf5d34fe0735607e50a9fbaa1c8c5ce53936ab9cfc7cb1ff318f8050c0a669d7c46cd481148740b913d20dcc2fe3efbe4e040f9464b40c399449267ab6a4dd15fa1edc9da962771958a7ca1d56f6a40a28acded95c4c385bbb0cf25d7975e993ef164f1218e335424cacf51f5829d7acaf77f8f4b20ce4bd7e2d9f7650f8f5bdf53bee073543fd7bbdddff61fccfe0bef7f98973239ab8ca31ce6d9a7f7b68cc8061719ddb57ae2eb36b3b4847a4ff38f80118b17185a8551fbf4848bad9798626cd35d5cebd64c5c602a72b99f7862d3e7a48222b8d2604f8c7eb2f9d54908fec591b1565442dbb6066cc69baef5c4df83c421cfd744b95ce864b99cd4de0e62a1242fe2fd01652a7f7fbe9e0ffe66c782e0c5c75a7c722ffcb91f55ddc05409c265bddb7dd5e2bf6bb67aef46ad2710195b9d7941ef7850c028cfb9debd302f59e2d4d8fe7fdc32b433a1f7f087119e2f03a8b04b5fc9d384cabed3cd1cfe21027c0b4cc72b471506736cd6b0b9477adb0c71a1bd17e5e1c04bbf0088e1dd47380195c7892483aed16ff4e1614af924111a32c753b654fc7434028d78f7ba3ae95f622dd8e090769fa2d1cacdbaef4e16e2c984e2f918ad1d4c6c1320266c29c28f31117c8a3f78ddd82086169963d170eb9aa3e08a67fba771c693204cde736ecaa670eac58dc1ee1264c614002f020ac804ca964dc871e4c7d6f45d8f36c9286694bf5404b0962c77bd6e017f9581f349c07a64d71ea8cb603e17ffb1eeb685e64ff661eb711cf239df16061a18f1b5f2b205253fe94e7b88da5f89d25c23ecf7581d13ce04c9142a854bc10d80c448bd32e4ff95a4d4198ec6497af86207717fe41b075245d3733f6b86989b6f928cbb4bd217e71f5f0d0b7f773d4e358d48241db916c8a823029d0dbd3f84c5bd883248e1074cbec741381b5e2f33aa9b11dbf5c8efc44cde79160971f8b99a4508d7f526f05e9b4045c479682867f8e0b3080457b7361ee27d6e41eeb19af163a851db51dfc7622251d43d2f157178b78f505eefe2b74544db9e9192912c3c5e0c05fce01b7769a9a8c7b95c7ca0c9351a24a5b9457839fe24994b5044501eb7dbb37eac1ada55ab8ab1026b0599e2015550a6ac51b0347ed33d1ade8f6284d65b070808c8c23bfe9aa433b4600e18de836649074801f5f0ba422489544eb1dfe70ec72f61cc2bed2dcec65a2acf6f22e8779f30e565bf2353d82dd647e1bfe4e737463e987981418c93944947eca531f74997c9a8faa78a1688fbc525645f4ee9e59d5fa98e19684bd156ec7b70b31f9f5d0a4760e47f72fae3300be641d1d99eb98b4028b898d0a937e9d68df6da9dc11423bc513873a2b3b29b2a226fe1d4ed24a9c16e9c17df2d3c6fc9d08ee229653e1864766376339245b69f7a0f958ad2c218b1a536b4b979dd2b09894b6726bd6e33d5c1abee084c7a9287166befdf18e3a887b35d26564a91ac6c76b07ae0470cc4fa3759523284aa371905696b52edeff38636b8acdbf099d13a2b6ed6f3a10278f3cd56842911ff6b47b58f1123a68831df551072dab8903781188b17da457bcd1c3412625864eb3cc7d9bf51626ba9f20407030d8b8492ef2c87369745ca372ea82a0996737b6ca99a6460de5a24aa4fbc0991482213f0e7849781884c464203b12eae572d92d11d17f9fb34fbdcd24109dc05b89901c12caa034848435982d592936e8c0b0f15be8172fd8967580de63aa4719880ad332ad87957fd29f80bdec08a17bf1a7d3bf9ae4e954c6a5cad1f1fb1342ab76cada4e5d324aaa765c78b0776f2152ed0824f24c2249170fdb29524335ceb34cdc6e2bbee0e4ca2e81c3b5fbdd23fa3c58c7f5d0667142232225da4c19a7ca407c2da4c8a7d20fba24bdfd53e7cfd877a812b626767cce2f99ee2936a37002df1cb5be7e77fc42b474c4276588e0f967303e17bd23743f28dc328e8f689beed0967574261bbc1a6b3115543b43b82e1c99e717e8f0c0df34cd23ff66b65083118af200aa87c3e61c06db197beff820264377a3cd249606f5a0d72647e5a9b85fc582c47e6691e1c737c02266f9c290c712e97738bc32c307ba0c16d0c15af199fa45e056e172e80b0f0d68f344bfbae09a9f94f3dd8a6e70f966a874ea3800bebd327751e01b5ebc766f4800431a7259a9cb88a27a4fe4860f008b4c00ec2be65b959dd1b9dc15384216fe75da6ff9fe769f0042bd0e339c791deaafcd5b26de034554fece99179614a87d40738cd0ee9bd62555c2008f2bdbbfd850cf3367665a58bb5aecf8d89512d73a33e58404ca784537153d75edc0fefd4f5d47fe55a271f70572c4c188afe52bd604248bc429840805caccc0dae96a6988bfc6117727a9ad99ded65ffaef5c5c50d4def8f193083f6d699b9a0e5eaf24d07a730d93a939cb993c8ea23a6ea282aa676e1b200713920050738cc89c5658009297c27ad9f605b1fa92308f768a948eb77a2892b85483ec3664c72532a00ade0207d6e0f9ff12d90d0c525ed2912489836a6d112dd09eb217152fd91bd0870d185bccaa9e7c646bbd36fe857cb36829b224c1ad2d3243bcbdaa4051a606b5c1458f627add211416a5c28fadb44a65169c1bcef2fa8dae2a3e53853ed27816a380832ef3abc8ea3357906c76dba49c27377222106f9b5ca4ed9403f8b3ce751a7002a8c0e12893f4180a07946f94a4f91c81423aae6a77d77bf406f4aac5cf77ffabeedc305738d0bdaccc7b0f9757cd608f9e891f3a6fd4105b948f84cd75830454d1c81e58c6bde555de5e7322c68a696b6c74c3e74178bca0bdcb1691311202f35cebb67c87c81c1c9de7f9b1aa93544ac5df04c11dfeb2bb71655caa89fb4517fd3a1daa553e740a4ae33c0dc976bdfa380d347192dffda313480fb9b77c6f2d12cce6b0951d28a8f6f710dc02edf6dafc93cd87f3ad27f00a063f78ca38fb0d265b976322aa9e30924b60a37fa906054a53056cb607f4303100972af2ea00c41c8db02d04f01a59a241b541c016e69b0578ad67418cada774f285ec2fd83823ae087c05292e5eb9b93c4acacceaf4effc97377038e6a1263d941d8d8f54b677a8103df3bf76a6051bad0953330ffb8c8cdd68167c8e92ce2bf856cf6fa89ca3e6f4e377e5bac1093439a25c07b9789859ac40538fdbfb5b43af4d606223c257b10ef6caecc44d8e396db0327735369eb7767fbe824284ecf77742534a6a5965c1ed88b25afcd512b650b1a90b5eda3e0990425d17ceca1e08a98250de33e9cb8dd146f00acf5e9fed71fa92542eea7a5d29e078b0f590a561934d68ec9585b955c699d339ee4f587f7080c40781b323afeea02b5f690f6555c4fb6b8171b0ece634421835c314468f0391cba486447de54a5e5edf1c154a32ce223c4ed872b34593f501d30eb3ac2cf1b5ee15e20cf9c0cb4acfb1e6d89f1b5f32f08c126a576ac9c85b86eeb930c3f1ee72a41b70856a92addc2dfdda2b33fe252006c3931a7028964259c42eff45079cf2e6a72abeb44690301cc35ec501e808177687bc11693ad4e45797e5f2ffb343f2597ea504926f696e9258c85472e4238faa76d1156af7cda89f3fef5158071e9a20bae9f7fed127e8966b4869a24b2e372c0fa3ac0627e9091afd14a86c7bcc48db479f563051b89878c7701c6af4032ba45712376603966840dd022e8d5b54f80c30e05b986a87a7d1fc99b0cdcc1b0acf4c99a05dbd990559c3635a5881d2c4d23f7be8ea1ab5e4f83376279e8ecd593803a3674acc0ae36c07b50c3143aa252a35b36f57131be8aefafebdb25c6a702700ff2355682e7d6a50177ada7c02b2999217b4aa60268e638b1efa316b2cd15cb4ef9d031acfa2dc38577c6cf93fe536fd6e98931d9fd7df076b93f1cae3bccb2ecac8c7304bb96e6b8d17f14cb2c5026b67b8b8a0ab0dcb08ce13970d30c3571ff64d24c06328d5385de3f18c37669f95f35de2d30e3a3721fe0b49bec68e42bd5ed0fcd2490da357747c93449725f0a4a80d48567b68e516585847b9dc3e6cad9f5065271ca56cb645b97a2b368a60daf5d9add5c218bac5ba0995cfbe9f6255a6a239111ce294a70f50018f651669998a9340a01aa0c423e16c03dad2b0f8cc0af9ba210ab0b456d353a989111178128e00812b34cbe90cad16af7ebc86cabfff0935e0e655c6fe536e2e432071f1da249f11f5937dd679b56d3fd5e784345a7efde8fc886c4177c19e0dd326c1579132c4e75169aebee1728a4a9f258ecdb9a0b43c882f62e682b39895a7b8f9aed8188b8401f00d9046fa9867344d4ee76cc2c28280fc31fc84398215758fe4eec79550efc2ac8126af6391d216ac4e3a22b063868925680e56213302d6a1bd256d6c13178d1255d1022c8664ab6c1dbdacc601381d3ad300cb19480b9bbc35bd11b231bfde95befe250ab89d9daae0f131f050c17b8e51589a171210b469df4a4c5d95736109a35ded00a19b3fb691261d4590cb29a935ade8cc4dd7d023bdf898123b5b72b9838834634e57acb4c5789a49e40427837598fb2b3a71f466b8c7ab0b9773cd98c84260af113a494dffce9b8a825cab0aed4149c40def029ab9c3a03369189ee180afc7af502ccb3c6ed50af87d80e244d5a663edb3dde4b45fc4812907c74860de5dd54065f4f017e00a9e0b6df3b28f6a5da7b1d51469f6e6d0ff116d32a90f5fbd0b7e7afd3256ec99ce54987baf6578c97e2bd08b120be33b98cb43811650f46f69ea130df6937cdbe0262343633680b16e1a2dc317706e8915657ea1e32b05dbceeea0554c6f0345a36ed6f212f77af75c090c44d5043a76e49fd323dfb5b58346a550c0d732ac8c991d4a77cc7ead0ac259a3f63255a735ce1a8de746929e4bf6311407b40e905b97e8876268281639cdeddd698e3715906e63f7c9d6403e4b42f4c0fa2083d91e6e5d44b880a03d6f41b0b0909f6fb789493ecb32774bdf0122a5c7e8c1c38385cea9fd9a235f95d7731b48e94deca481630b8998c5ae3dd2438a9d228a7b7f1fb38a6ef8bd9e37ccb1437ea9157219ba3f2d1d63872065d40314f1aafbee2b315ffd0a69cb1550d78e997c4e2403ae8dcc833bf9e54e145a4c08766fb090c99cec5cf7dba079478713027fbab6f03244f47baa354360d6d7ac067162106657db4be7e80fae25178a0550f425d5214dcadaf44ea99ea41e2a5afdeb22e1133e6d3748265c4947c40ba479b83772945819e8bc34d78a124faf3748ce5f524003540bdf529b22199369654e4cafb3e9bbb20dc9a855f817164b44867b7b146f285780cf3573483798d85265157563ffde156c03d0b5b233fe1a7fe34be0573085d4cee9f9e4ebacf9b7dd708d981c7fbc2ba7f9f57053a6d7da3ab162f5ae03554edb471fa12c4b37290d7dfc819943332a2b5afe2c8185d0986bc27dc7f70530a544b189b87e7471af9811040435b5a1db64c905a94b5bb51876eeb6378a82d8a9864a142e4ebaf48847ffd65b2410554ac5e414404c8ed72cc788f77fd296fad040626f5cc4adbe8e89711aeb58f73746ecb92a910f0de212f8804e368cc1cb1c2f737ffe0f076d9c563b88fd2ec44ed7287ad93cbd4da73de5c787aedaef7038301bffa81e1ac3adc9551be5cfb0c928c98a8145c627e562481593890eb73f6f10e4bbcb4d731e725450cb507f5ee60cf763f31538fdbaef8db325fca8108c7732b67b9d246f4ec07423e98e460e7653ef5cd1307779f8eff8e17831a6bccb54142f6c5d9869e0a5b8182af12cc3a3c3b2d300e5e16a868a2dce782d156261a17770038edcbef522592c631d27ae9e89d40fe3f1044d8594556ff9c5c7c93b607552532908e1232833cfd804142f143bb50fd2d9cc7c9d4812d51260c6932018d524dcd1de744b886046220cf1fc512a0d6dc5f68d2a71c1938b2c16d984289743f712e5a66fd560bc64de623a2b4f879f6b6d554c2361a994ccab499df8612b24204689b604c4ca3065823eaf0d3464b3ea414308e4e27fb44ab72c4c178c0500a18a2f6adda1eab34c3b78ba4c820a536f8e5a7f6b9d79703f73bc63bdbc1d551dc03c6cfcf96f6935fa9881002a6523778e05af641e761932733bce5962722341f7f34a1ad35e3e35813c2b626ed91dbc756474aeb5253c33833f50452b2492e846591d8a42e8ef3333ec1ce387cda54825c5c2dad96515a50cca5dad736d73cdf4cf9dfe055314d308163583e4d36a6ac2a6dfd0bb6de9a6c57607797def82c4a10f2503959ac61f56bba409bd5b63d3416e57bf1cb75aee0e191222a195eb8716346b0eda19d2a78f51cc8b5f8d5059a06e315b885c5f72ac58f502d4c5c1b399bc1030bba9a97b17cf59f333271f486083089d219c4327e564d599ed74c7234715e0c7737bf0cf261013736e78be3b32992d4cf0aa7b0172b83a7558b18dd35d9d61dd07e3a4f93c9280a294e4982e5a7d8a142aef26e0e4c587f1485a81231fac207311d7db351842ec97722bfca487be1b2f7d2b63c1ce9fe35ac17fcdd987c2d7832109860784028e46521298860d7f46d869c0ac152febfca95aca8420d54a25019b4d98ff2342c8c3f162ba450e6c4996edfe348d14aec300d808f2d6c85b10b08673761497e249ab4d20b293ba9279bb9db3593e3c7c2e05ab34cb77621e2d4ce175d3ce0b25c7a0bc85a5df782a81e0a32f89dc6d472b07fbc4efb382a94f6483bc2c2776c088094e89c5a49d5628ad78ce7ecbdbee528a0c184bfc2a4f07442591e27524d75136c3eae29d19c430628916f71ce5ff944c1ab27fd110d8f902bdad1f4973bce379fcf82ceb2899b0c3869ca04042da8ae1ddc904eea800724ede5b54b92f83d2bc65fc34d266188112f2c6128261545a789c82cd76d3f29bcd1a2067af3a78ec756524ef5c33f73e750c9148f9b3e7b04a53a73058c26a7c4047c30696bda0ec170e8e32122684be3387b4701c2af19c3b3624b4b23848871ce51c33c5b9401131e9f5b5783b4d09c5e5b2a6f943f83764dfe01908ecd82cbc948cf69d2a595fb5d3507ce13d24f8f6b1f71ae08858d34b1e20539aaf16288743b80281f2a2db1fdb663fb26a528a0ac27d52e1ad7e49f5e8c15e76b3b269ce383eedd5778fe81fd57feb9d5a71fe140b707fe09e4709f2dcaf61f8d184d31a7c6bbe767ea27af3c97b0c103f5234815f0d1fbb9268bfc84fcebbb6a738da7c7d2007c81f9ccdce18ed017571b0ada3eb21733a1df52db0313d1f7be846e0048ef39538a284d7c8f15abe0010013f8c678531ea6774ee4536e2f84ce995d43658a19a859c349a552efbd58ad64c7e973f7eb3fb5c35a224719fa141be5707c01b52f9885f17891e5722c93c605377f44858ee0255acaad2a1a7cf4d4b12d03adf6bba3afbd23e99776866268833a0867d40a2167916f2ba706781522b623694345af64e23511cd4add8755206e8bd168578452730b5a3a318de3d081d7b13007e3881fad3e7299716ab6509192d6df781917d1a41a595934490e75dbb77ceef99df4e8b1655f7c678728eea2353657649f6482bcd99aa76c8b92e8eb98ec6c84d7b34968c1a720e420573491ccfd6534aebebe3b67226c9d664d92bb478f4c335cda6a8116f3be19b13ca294018a9691b86007b3846c0e27b613bded91903fd3976cea5975afeeb4d53de10e6aa595ad308f1dd502726781e33da8d9b589b5cf28427d38f3ee20820a662076a4f6a0a962de55adcb99025a124a9ad2f0c108224aff8287b42221ff790f3f3347987dcdc28557e12bc1c9230b7b12880f473f85983d75fb7652e0138a289a7e6d995be48b477114fcf8c52f9528abd9a8e059232b94e0e6741e79d98de5678452740f8c32531d5e31b5bf9773fa441d135da0284783e9773a15b78f3c1721472a47e80d6b4bfc6d3e99105e6cc1d2e004beab92e4c883ace98b985dcf87b88d143998945a06cd204c6106adfa08c26fb769e1e8228c163639e820c39c20233adb29d0043b5be34ef2b6218910d1c9bae133325d4ca0c8f2db33a9a5d77716b311d9a630a5932611e57133eb9f90a7549b116d67aead1017a1de54f551fa94c3e38fc768e65ce35d8acef134530224a5e5a43e8fe3b6687dfb48281805f24b9ae6e888817569a6f9d698758f2efdddd9908bfe08e66adf1b2bd014b8e064297750f8ba3670d7f338569999f90d9f437fefea9b101323cd638c8ede385c29efb0102824dfb10bba3bb02149935681b918b155210648d503db811a4c361ed562c8581bc5753268ea7ae665bcbd075139d86b938a2ebccf2e327e0be4ede5c1e1416bd5260217363c8e0724bc2640a008903e44407c1d79b30c93e6d370634a99544697e1fb00f3313090931d69d211fbdbb7c9226ef8230c49ad6e1ea9b2fe73fff13997d2c1cf5da28d829f3438c063af9f7e5d7ee3eefce8b805565442d321745200451c266ce8783a0e7cbb43e4b6dc5230c3244250defa5049e8a370f697262f7c35f7efeb6aecea096fde2bc3e0dc2b26bc20ee5fc21ba8c54c4bcd0f0b487f26382e98043fe18e9252f7f5883ede0006c8e378ee10e627771ba4602e16e8768f94fdee69d198fc8fe8f082f6fcdf72194a6fdf33936e5dd121c3a395b400b12f23e38b9fb72f9d4a3e58b2315e710f97a15eb3a76461cdc77947e5a2d0a771c67815752ee42b2b433a7a16909b8a21c5f85297f71db0ad81fd490ba7245b044ed173d03bd7e4c1527d466ba868acb2e7bf297ee96b6b4547235981f4592622a0d78db9f5904ae2becd8a6a85df77be9ccc7c9a447c472d25df6fbcf14e77e83712b784b10f4949bfb3505c0543d9de34e968a83ca322605ad219db671f91052334fe7f259fd0b072d3f8743ab1795962d98297b8de451f93af47554276f1b6d15661b31470a88cdcb0ebdb7564a659ec8de6dba91be1bfe288a4f2894c216ec86eae3f5b4b9ab519ab6fa784d3fb8cb41e77b457e6cce024a7ede2ce90e3c7fb9abfd8852d6a07d3614fc0806e458baf370a4e6bbae200b1021ebcdba8ae6acace1235a6e0bbfa67c087e72922bf910cd78c39429270b9097c97a30541acb246a4aa5e5133cdd2f71453cbc4c0d6b026541949d31659fe0e899c1bcd70c1c8775cf192696451d102052aabbbccc4b9adce945de8270f56c7abb34c4cc64a4de49fe3b2d6d3846bea4c200fc4818cbc29b42f3137bda22f1c30179bf65a8970c02fe95cda6c33b57dc4a42bd642d75a28912c218c6e4c3fce1b85f7e73aa3b2f1349a52f55a6bc8bfc8e707b9f215701350394faffc29aee230f3befdeab7a79f08b453c42155f03c9dcc88a8659f5231ecb1ff1d569ce49dbc1c653eab0377c2ac0e631e43d0d65002d3b1c2abbb09831b881f9ba0d62f531e2f5fcbc9ee6bc4decf0e8e4c487552a9f8a7fab9a9b532ad4600458d0732160c21b5fd12984e250ac6f50bdb8e00a1f9fe8d9fe4b4c5fcb583def1c0909ff3bab7e980c57105d40ae0b80002b3a43c663bcd793f80596ad50f99f7ca32194a49ebcd7b623e8b31c344c2411352539141c144e8d6e80f463737dbd0878005693457c7341f86db8d9d846a091c7ff5ad639bbf03a20c7130e9aed2c745b27bd9d7459984fc647732b64b21b2d6510a0c59850ad65ff8407e6dcedece3c8791a72e84d85530da4d82cbd4eb5ef846e861328df902d7c8eb9008b1f0f7e681b0c3557833a83a6bc2862f6cd69fee060eb796305617b80465514544c6416463648598581527b4618d5fe5cf9d90432db2e03efaa4c37223daf9abba782a6f0c2bfdf69c81f41c277123e1eca24ce04320de85b4a589f99e4d6c9dbe1ddbd8bcb2a78fdbcd1e83acaf5fbc8e080b5cc76401437a3858c551203cde584b73e30265a75b23167628aa4a277c0bb67ab2c59adad13015ef3bf44b62bdfc8754b2cc5bcf28e5c78594882eb3f095880e9d5a7719bdff1c870ad0ac30a6e65881621b8e7e497e6930c56b84ce227c17371916b4800382016549b61246c6143349c22d19b6bfa6d1d120addcdf6120a5b252a772ddc73d495ae2ec0401b2fc0ca90128631878ce83538b48881b79648b5d2b9cff7467804f757f949453b251f845ec2dd5293d8d1890ba6af69aeb973920ad2c222c6d9f11073c2475dd99347f9ab9f110e3d4fdf88f7b19c3e2adfe7e99806048c9c97f44e7936e585ed4e10af8e8c5e1ddfaebf2508c7161f97a01dd61acae0db57b409d78d98c30cbe8db2aa9e18b1a8230a24601463115fe0cece698bc58550f9f031dd01fddddf76e7d514481e5dba6fb872e2787891a5529b30863e3b36d55ceb585ab3a5a85e436ce86499f3d4d32d1a67fe1f910a4b7105fe65b350758f5b916f8a9b01ed55addbc73e2693261fe6bd0fe64a3d4e8d58b8956479b15be5b78038fa7b930f313173df02c325710a6358f7268e0be7aa1861c062928f6d5c6b438d22660fd7872ca4c2bd010a675d7b901054cdaf7c74a9ed303cf97f7392faf48647888fbe86368ca6675a83ed451b046f542e289a641b2849377e0a1534371cdffcf5767a9cb939ef5641b30239e42fd277e5355f488caab80f8fff77c770d5102aa55f2c2a73d404241c51034a50e916751da67ec159a856b6dd7946c597cd566b824202ac0b8841656a4e7564cac21f73af79001bfe411c93288a2c3615aa11028c6d5f6b814468ee01f965bfd309bd30857e9ba41733fdae310033e91ac09ff4532194c830f5cd2ca5e9baeb318cf8c2053fb465166943625a7040c332f80c03a58ee37a6d112de0913f7e5e6403f892430e8e3e4a9a04c8e86aa71cda551177c398dee2187de9d6944b7741e451d699791e4cb9beee18344e7c427785abb664e02ec3d8d5fd21dc5fcb0adf9d58019852565da4a830e7cb81c1a1c9c8ffaa0d82fe78b583ebe2d94a043bacc11f5218b18df82232f1efc20001aa48b1e9172a713e7a8a7d9c3f16c26d420ba0526e1bd154c8cae3f7661ef6de83da1441f99a4754f448549191f255fe77840577564e1d2e803d8bf371e97b7edb020cbf1098aa950eed5a0ef0ab1f76980be4c4df29c9927ce71b9f1a83b8e2c4bd63dce14ad9487b5a31d9de8bc6f2b856f33f20b457648185970f6f48e22b3aa4eb736a0acfe31f2b5ceb7d9b80a83aa07ba5ea748c372446059da75c1bc81", 0x2000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001c80)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05022dbd7000fedbdb2501000000000000000241000000100013"], 0x2c}, 0x1, 0x0, 0x0, 0x20008000}, 0x8840) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r3, {0x0, 0xffff}, {0xffff, 0xffff}, {0xfff1, 0xb}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x2, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}]}}]}, 0xa4}}, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000005c80)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x4, {0x0, 0x0, 0x12, r6, {0x0, 0xfff3}, {0xe, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8}}]}, 0x40}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="44000000160001"], 0x44}}, 0x0) r10 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) r11 = fsmount(r10, 0x0, 0x1) fchdir(r11) r12 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) lseek(r12, 0x2, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$FBIOPUTCMAP(r9, 0x4605, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.26422412s ago: executing program 2 (id=941): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000100)=""/141, 0x1a, 0x8d, 0x1, 0x7}, 0x28) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r2}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, {}, 0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) io_uring_enter(r3, 0x2ded, 0xef92, 0x0, 0x0, 0x0) r6 = msgget$private(0x0, 0x0) msgsnd(r6, &(0x7f0000000340)={0x3}, 0x2000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180800ec0c00000000000000000000001801000020"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r7 = socket$igmp6(0xa, 0x3, 0x2) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r7, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 1.15012562s ago: executing program 6 (id=942): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) sendmmsg$inet(r0, &(0x7f0000002240)=[{{&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32, @ANYBLOB="ac1414aa7f0000010000000010000000000000000000ff"], 0x30}}], 0x1, 0x20000000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socket$inet6(0xa, 0x3, 0x87) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x1}], 0x1, 0x40800) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_PIT(r7, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xb3, 0x0, 0x5, 0xff, 0x1f}, {0x5, 0xfff9, 0x8, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfd, 0x0, 0x6}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x10004, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x2) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) 1.085137986s ago: executing program 4 (id=943): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x20002, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r5, 0x301, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x0) 986.426314ms ago: executing program 5 (id=944): syz_usb_connect(0x0, 0x4a, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0xbde, &(0x7f0000000500)={0x0, 0xfc47, 0x40, 0xffffffff, 0xd6}, &(0x7f00000006c0), &(0x7f0000000240)) r4 = syz_open_procfs$pagemap(0x0, &(0x7f00000001c0)) ioctl$PAGEMAP_SCAN(r4, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f000075c000/0x3000)=nil, 0x9, 0x0, 0x0, 0x8000e5, 0x0, 0x0, 0x14, 0xe4}) 170.044546ms ago: executing program 2 (id=945): openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/card3/oss_mixer\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f00000000c0)="0f01d10f01c926660f3880ab00808073014c67640f97b100680000ba2000ec66b9340200000f32f30fc7b751ff66b80500000066b90e0000000f01c10f017cca"}], 0x1, 0x74, 0x0, 0x38) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000140)={[0x20000000007, 0x80, 0x2, 0x1, 0x4, 0x7, 0x8000000000000001, 0x0, 0x7f, 0x0, 0x5, 0x7f, 0x3, 0x1000000000400081, 0x10000000020001, 0x1000001], 0x3000, 0xc4b06}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0xa, 0x0, 0x8, 0x0, 0x2, 0xf8, 0x3b, 0x40, 0x5, 0x1, 0xa, 0x4c, 0x0, 0x92b0, 0x3, 0x80, 0x4, 0xff, 0x3, '\x00', 0x9, 0x6bb}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000380)=0x20000, 0x4) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/5, 0x204000, 0x1000, 0x7}, 0x20) pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/200, 0xc8, 0x0) lseek(r3, 0x7fffffff, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) umount2(0x0, 0x3) openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$FBIOGETCMAP(r4, 0x4604, &(0x7f0000000200)={0xcd, 0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0x0, &(0x7f0000000400)={0x8, 0xea}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(0xffffffffffffffff, 0x40045402, &(0x7f0000000340)) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$evdev(0x0, 0x0, 0x60000) bind$inet(0xffffffffffffffff, 0x0, 0x0) 97.385904ms ago: executing program 4 (id=946): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0}, 0x18) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x2, 0x778, &(0x7f0000000a80)=ANY=[@ANYBLOB="1201000014347710f0031d5880500102030109026607020904e0010904580906ff01070009210800050122d30209058002100000db0e072501020803001402dc06d26f73c49ae3689cf5b150d70e623eb009050802100052021008236dbdb498797609058000ff0303da040725010380050009050602080007a70207250180020010072501410804000905a4011000023703072501010a070093221f7ee797335292a4582c83c5eb8d957e801682b01aeae0f778aa496f8c8a35305a8825397fe5fbbcfd99681b665ee120df0260f06b07e7801ff2d6200f15c8964825e9d711fcd215554c94fb4cd5a43d56b4c494cfbc3803b814ba0b5ef782853a54705c4b198d0e6540060f496446f53a8d7fdcad70ed1b70fbe6ffe389da690e4ee177f761f920c9d94693e61dbd52dc09050501200001000b07250180000300072501800700000904"], 0x0) iopl(0xac) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000140)={'gre0\x00', &(0x7f0000000540)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x7fffffff, 0xffffff10, {{0x3d, 0x4, 0x3, 0x6, 0xf4, 0x68, 0x0, 0x7d, 0x2f, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0xb}, {[@timestamp_addr={0x44, 0x34, 0x96, 0x1, 0x0, [{@broadcast, 0x20}, {@dev={0xac, 0x14, 0x14, 0x16}, 0x3}, {@rand_addr=0x64010102, 0x2}, {@loopback, 0x200}, {@multicast1, 0x3}, {@loopback, 0xffff}]}, @timestamp_prespec={0x44, 0x34, 0x36, 0x3, 0x8, [{@broadcast, 0x1ff}, {@multicast2, 0x7}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x1}, {@local}, {@broadcast, 0xf}]}, @cipso={0x86, 0x74, 0x2, [{0x7, 0xb, "16c5f514c368fb11cf"}, {0x7, 0x11, "57d2e4c85fcba5c4f7a8f23e484cd1"}, {0x7, 0x10, "a8c02ff00eedfcf69023cb2b2605"}, {0x6, 0x4, 'pG'}, {0x1, 0x11, "944688c905b56caf50426ef7b6fb95"}, {0x2, 0xc, "19e271318d29870fd44b"}, {0x0, 0xb, "0be5c80f12cbf99e56"}, {0x6, 0x4, "0e13"}, {0x2, 0x12, "6d98a8a6c897f7deed70253eca2268c2"}]}, @generic={0x88, 0x2}]}}}}}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/4\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'wg2\x00', &(0x7f0000000000)=@ethtool_cmd={0x8, 0x3, 0x3, 0x0, 0x4, 0xf5, 0x5, 0x0, 0x5, 0x4, 0x8, 0x6, 0x8, 0x57, 0x9, 0x1, [0x10000]}}) read$FUSE(r3, &(0x7f0000004780)={0x2020}, 0x448) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004094}, 0x240000c0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, 0x0) close(0xffffffffffffffff) r5 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0}, 0x40040d4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x64, &(0x7f0000000000)=r8, 0x10) sendmsg$inet(r5, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) poll(0x0, 0x0, 0xfffffffe) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@fallback=r2, 0x35, 0x1, 0xc, &(0x7f0000000000)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="1200000200000000", @ANYRES32=r3, @ANYBLOB, @ANYRES32=r3, @ANYBLOB, @ANYRES64=r9], 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r0, r1, 0x25, 0x3, @val=@tcx={@void, @value=r0, @void, @void, r9}}, 0x1c) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4\n\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f\xff\xff\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 0s ago: executing program 2 (id=947): r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60ee, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x20, 0x4, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x3, 0x4, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)={0x0, 0x24, 0x8, {0x8, 0x8, "926bf9af007e"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r3, 0x0, 0x0) connect$rose(r3, &(0x7f0000000000)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000780)={&(0x7f0000000280)={0x20, 0x140a, 0x400, 0x70bd2a, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) writev(r5, &(0x7f0000000800)=[{&(0x7f0000000700)="ebfa0e81ceb3dc4c43c215dc4dade38ff8c84ace9d15af003afa41ae5fbebe5b175c12cf29c48c2d4b61ce76443645c1dc73113beeb9b5a73cd0415b0437839aa6c68111a4582c3a6a3bb8f9e0c37b9b3f386c", 0x53}], 0x1) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r0, 0x0, 0x0, 0x0) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x200) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r7, 0xc0145401, &(0x7f0000000180)={0x2, 0x2, 0x9, 0x0, 0x6}) sendmmsg(r6, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="1073eeda8705da74bc83496ee251e51e6d155c558a4f6dbf7076341df55b7aecaad952f364f05d5e0f", 0x29}, {&(0x7f0000000580)="02a2f97a177137003d9b418698b97c81bf1bde789b66365fd7b1bbae5f5e00cb9b4432ed011564c758321c92aff549a18b82016d730fcdb5445c31a7d34e0b20bd90f8032e6aabfeac73e8c3c526528c0f25bd2cbe7523", 0x57}], 0x2}}], 0x1, 0x8810) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000840)=0xc3) recvmsg$unix(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000680)=""/67, 0x43}, {&(0x7f0000000140)=""/64, 0x40}, {&(0x7f00000001c0)=""/107, 0x6b}, {&(0x7f00000002c0)=""/229, 0xe5}, {&(0x7f00000003c0)=""/114, 0x72}, {&(0x7f0000000440)=""/234, 0xea}], 0x6}, 0x12060) kernel console output (not intermixed with test programs): from the interface descriptor's value: 2 [ 182.561364][ T5902] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 182.570481][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.601364][ T5902] usb 2-1: config 0 descriptor?? [ 182.613312][ T5902] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 182.715147][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 182.722015][ T24] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 182.731046][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.743106][ T24] usb 6-1: config 0 descriptor?? [ 182.750587][ T24] hso 6-1:0.0: Can't find BULK IN endpoint [ 182.757184][ T5961] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 183.078851][ T5961] usb 1-1: Using ep0 maxpacket: 8 [ 183.110252][ T5961] usb 1-1: unable to get BOS descriptor or descriptor too short [ 183.245031][ T5961] usb 1-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 183.277828][ T5961] usb 1-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=fa.be [ 183.309107][ T5961] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.331047][ T5961] usb 1-1: Product: syz [ 183.336697][ T5961] usb 1-1: Manufacturer: syz [ 183.375804][ T5961] usb 1-1: SerialNumber: syz [ 184.011466][ T5863] Bluetooth: hci5: command 0x1003 tx timeout [ 184.018842][ T5854] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 185.040527][ T5903] usb 2-1: USB disconnect, device number 11 [ 185.123884][ T5903] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 185.681351][ T5854] Bluetooth: hci3: command 0x0406 tx timeout [ 185.681473][ T5863] Bluetooth: hci2: command 0x0406 tx timeout [ 185.687959][ T5854] Bluetooth: hci1: command 0x0406 tx timeout [ 186.024810][ T30] audit: type=1400 audit(1754672432.251:563): avc: denied { relabelfrom } for pid=7566 comm="syz.1.354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 186.075516][ T5961] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 186.107572][ T5961] sonixb 1-1:129.0: Error reading register 00: -71 [ 186.118499][ T30] audit: type=1400 audit(1754672432.271:564): avc: denied { relabelto } for pid=7566 comm="syz.1.354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 186.154951][ T5961] usb 1-1: USB disconnect, device number 16 [ 186.371203][ T5964] usb 6-1: USB disconnect, device number 3 [ 186.534558][ T7582] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 186.840449][ T30] audit: type=1400 audit(1754672433.061:565): avc: denied { bind } for pid=7566 comm="syz.1.354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 186.990829][ T7593] netlink: 4 bytes leftover after parsing attributes in process `syz.5.358'. [ 187.094486][ T30] audit: type=1400 audit(1754672433.211:566): avc: denied { ioctl } for pid=7585 comm="syz.5.358" path="socket:[15473]" dev="sockfs" ino=15473 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 187.411893][ T5903] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 187.905361][ T5903] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 187.913791][ T5903] usb 5-1: config 0 has no interface number 0 [ 187.937883][ T5903] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 187.948003][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.969758][ T5903] usb 5-1: Product: syz [ 188.011763][ T5903] usb 5-1: Manufacturer: syz [ 188.219334][ T5903] usb 5-1: SerialNumber: syz [ 188.806517][ T5903] usb 5-1: config 0 descriptor?? [ 188.823591][ T5903] yurex 5-1:0.50: Could not find endpoints [ 188.950986][ T30] audit: type=1400 audit(1754672435.171:567): avc: denied { bind } for pid=7617 comm="syz.1.364" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 189.094767][ T5903] usb 5-1: USB disconnect, device number 4 [ 189.133428][ T30] audit: type=1400 audit(1754672435.171:568): avc: denied { name_bind } for pid=7617 comm="syz.1.364" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 189.253630][ T30] audit: type=1400 audit(1754672435.171:569): avc: denied { node_bind } for pid=7617 comm="syz.1.364" saddr=172.20.20.170 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 189.275958][ C1] vkms_vblank_simulate: vblank timer overrun [ 189.298014][ T30] audit: type=1400 audit(1754672435.461:570): avc: denied { create } for pid=7624 comm="syz.0.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 189.329323][ T30] audit: type=1400 audit(1754672435.471:571): avc: denied { write } for pid=7624 comm="syz.0.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 189.389391][ T30] audit: type=1400 audit(1754672435.471:572): avc: denied { ioctl } for pid=7624 comm="syz.0.366" path="socket:[14960]" dev="sockfs" ino=14960 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 189.541222][ T5964] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 189.672633][ T7634] netlink: 132 bytes leftover after parsing attributes in process `syz.0.368'. [ 189.731256][ T5964] usb 2-1: Using ep0 maxpacket: 8 [ 189.759822][ T5964] usb 2-1: unable to get BOS descriptor or descriptor too short [ 189.792173][ T5964] usb 2-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 190.582433][ T5964] usb 2-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=fa.be [ 190.591620][ T5964] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.599609][ T5964] usb 2-1: Product: syz [ 190.612344][ T5964] usb 2-1: Manufacturer: syz [ 190.625120][ T5964] usb 2-1: SerialNumber: syz [ 190.987950][ T7644] netlink: 8 bytes leftover after parsing attributes in process `syz.4.370'. [ 191.161318][ T5902] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 191.581321][ T5902] usb 3-1: Using ep0 maxpacket: 8 [ 191.708639][ T5902] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 191.747622][ T5902] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 191.866703][ T5902] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 192.261320][ T5902] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 192.274794][ T5902] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 192.292090][ T5902] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.511494][ T5903] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 192.580360][ T5902] usb 3-1: GET_CAPABILITIES returned 0 [ 192.588158][ T5902] usbtmc 3-1:16.0: can't read capabilities [ 192.662089][ T5961] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 192.671300][ T5903] usb 1-1: Using ep0 maxpacket: 8 [ 192.679153][ T5903] usb 1-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 192.688881][ T5903] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.703680][ T5903] usb 1-1: config 0 descriptor?? [ 192.734691][ T5903] hso 1-1:0.0: Can't find BULK IN endpoint [ 192.796193][ T5902] usb 3-1: USB disconnect, device number 13 [ 192.923600][ T5964] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 192.934401][ T5961] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 192.947790][ T5964] sonixb 2-1:129.0: Error reading register 00: -71 [ 192.954888][ T5961] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 192.971779][ T5964] usb 2-1: USB disconnect, device number 12 [ 192.987444][ T5961] usb 6-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 193.007045][ T5961] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.022252][ T5903] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 193.034540][ T5961] usb 6-1: config 0 descriptor?? [ 193.234443][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.393741][ T5903] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 193.403782][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.414926][ T5903] usb 5-1: config 0 descriptor?? [ 193.450575][ T5961] bigben 0003:146B:0902.000B: unexpected rdesc, please submit for review [ 193.944587][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.953788][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.960191][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 193.960204][ T30] audit: type=1400 audit(1754672439.741:576): avc: denied { block_suspend } for pid=7693 comm="syz.1.378" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 193.971565][ T5903] usbhid 5-1:0.0: can't add hid device: -71 [ 194.056065][ T5961] bigben 0003:146B:0902.000B: hidraw0: USB HID v0.01 Device [HID 146b:0902] on usb-dummy_hcd.5-1/input0 [ 194.167539][ T5961] bigben 0003:146B:0902.000B: not enough fields in HID_OUTPUT_REPORT 0 [ 194.181990][ T5903] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 194.187610][ T5961] bigben 0003:146B:0902.000B: no output report found [ 194.250023][ T5903] usb 5-1: USB disconnect, device number 5 [ 194.255683][ T5961] usb 6-1: USB disconnect, device number 4 [ 194.824814][ T7704] fido_id[7704]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 194.906973][ T7714] netlink: 4 bytes leftover after parsing attributes in process `syz.2.379'. [ 195.042346][ T5903] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 195.061221][ T24] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 195.225390][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 195.264506][ T5903] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 195.277568][ T30] audit: type=1400 audit(1754672441.501:577): avc: denied { write } for pid=7721 comm="syz.5.382" name="snmp" dev="proc" ino=4026533986 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 195.301453][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.314776][ T5903] usb 5-1: config 0 descriptor?? [ 195.318208][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 195.339506][ T24] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 195.493565][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.065304][ T5903] usbhid 5-1:0.0: can't add hid device: -71 [ 196.071640][ T5903] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 196.706804][ T5903] usb 5-1: USB disconnect, device number 6 [ 196.735733][ T7732] FAULT_INJECTION: forcing a failure. [ 196.735733][ T7732] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 196.850193][ T5961] usb 1-1: USB disconnect, device number 17 [ 196.850517][ T7732] CPU: 0 UID: 0 PID: 7732 Comm: syz.5.384 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 196.850538][ T7732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 196.850547][ T7732] Call Trace: [ 196.850552][ T7732] [ 196.850558][ T7732] dump_stack_lvl+0x16c/0x1f0 [ 196.850587][ T7732] should_fail_ex+0x512/0x640 [ 196.850605][ T7732] _copy_to_user+0x32/0xd0 [ 196.850624][ T7732] simple_read_from_buffer+0xcb/0x170 [ 196.850643][ T7732] proc_fail_nth_read+0x197/0x240 [ 196.850661][ T7732] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.850680][ T7732] ? rw_verify_area+0xcf/0x6c0 [ 196.850702][ T7732] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.850720][ T7732] vfs_read+0x1e1/0xc60 [ 196.850737][ T7732] ? __pfx___mutex_lock+0x10/0x10 [ 196.850752][ T7732] ? __pfx_vfs_read+0x10/0x10 [ 196.850773][ T7732] ? __fget_files+0x20e/0x3c0 [ 196.850796][ T7732] ksys_read+0x12a/0x250 [ 196.850812][ T7732] ? __pfx_ksys_read+0x10/0x10 [ 196.850833][ T7732] do_syscall_64+0xcd/0x4c0 [ 196.850848][ T7732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.850863][ T7732] RIP: 0033:0x7f459bd8d5fc [ 196.850876][ T7732] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 196.850890][ T7732] RSP: 002b:00007f459cba3030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 196.850905][ T7732] RAX: ffffffffffffffda RBX: 00007f459bfb5fa0 RCX: 00007f459bd8d5fc [ 196.850914][ T7732] RDX: 000000000000000f RSI: 00007f459cba30a0 RDI: 0000000000000004 [ 196.850923][ T7732] RBP: 00007f459cba3090 R08: 0000000000000000 R09: 0000000000000000 [ 196.850932][ T7732] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.850941][ T7732] R13: 00007f459bfb6038 R14: 00007f459bfb5fa0 R15: 00007ffcfc7aa368 [ 196.850961][ T7732] [ 197.131640][ T24] usb 2-1: config 0 descriptor?? [ 197.218387][ T24] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 197.224718][ C1] raw-gadget.1 gadget.1: ignoring, device is not running [ 197.232155][ T24] gspca_nw80x: reg_w err -32 [ 197.236761][ T24] nw80x 2-1:0.0: probe with driver nw80x failed with error -32 [ 197.261805][ T24] usb 2-1: USB disconnect, device number 13 [ 197.627069][ T7748] lo speed is unknown, defaulting to 1000 [ 198.875712][ T30] audit: type=1400 audit(1754672445.011:578): avc: denied { setopt } for pid=7762 comm="syz.4.395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 199.763029][ T7780] netlink: 16 bytes leftover after parsing attributes in process `syz.4.397'. [ 200.147738][ T30] audit: type=1400 audit(1754672446.361:579): avc: denied { bind } for pid=7783 comm="syz.0.399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 200.435293][ T7784] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.398'. [ 200.932249][ T7795] netlink: 4 bytes leftover after parsing attributes in process `syz.4.397'. [ 201.417508][ T30] audit: type=1400 audit(1754672447.641:580): avc: denied { setattr } for pid=5842 comm="syz-executor" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 202.984525][ T30] audit: type=1400 audit(1754672449.211:581): avc: denied { ioctl } for pid=7819 comm="syz.4.405" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=15218 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 203.118044][ T30] audit: type=1400 audit(1754672449.341:582): avc: denied { sqpoll } for pid=7823 comm="syz.1.407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 203.415396][ T7830] netlink: 12 bytes leftover after parsing attributes in process `syz.4.408'. [ 203.454654][ T7830] vlan0: entered promiscuous mode [ 203.459752][ T7830] gretap0: entered promiscuous mode [ 203.985855][ T7834] lo speed is unknown, defaulting to 1000 [ 204.963931][ T5958] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 205.311184][ T5964] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 206.181282][ T5958] usb 6-1: Using ep0 maxpacket: 8 [ 206.188027][ T5958] usb 6-1: New USB device found, idVendor=0abf, idProduct=3370, bcdDevice= 3.0e [ 206.242907][ T5958] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.256965][ T5958] usb 6-1: config 0 descriptor?? [ 206.359781][ T30] audit: type=1400 audit(1754672452.541:583): avc: denied { create } for pid=7842 comm="syz.4.411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 206.699731][ T30] audit: type=1400 audit(1754672452.551:584): avc: denied { bind } for pid=7842 comm="syz.4.411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 206.933575][ T5964] usb 2-1: device not accepting address 14, error -71 [ 207.070162][ T7855] netlink: 20 bytes leftover after parsing attributes in process `syz.2.412'. [ 207.844706][ T30] audit: type=1400 audit(1754672454.071:585): avc: denied { nlmsg_write } for pid=7861 comm="syz.1.415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 207.921274][ T30] audit: type=1400 audit(1754672454.071:586): avc: denied { bind } for pid=7863 comm="syz.2.416" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 207.961860][ T7864] FAULT_INJECTION: forcing a failure. [ 207.961860][ T7864] name failslab, interval 1, probability 0, space 0, times 0 [ 207.999331][ T7864] CPU: 1 UID: 0 PID: 7864 Comm: syz.2.416 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 207.999358][ T7864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 207.999374][ T7864] Call Trace: [ 207.999379][ T7864] [ 207.999386][ T7864] dump_stack_lvl+0x16c/0x1f0 [ 207.999417][ T7864] should_fail_ex+0x512/0x640 [ 207.999432][ T7864] ? __kmalloc_noprof+0xbf/0x510 [ 207.999451][ T7864] ? io_cache_alloc_new+0x45/0xf0 [ 207.999464][ T7864] should_failslab+0xc2/0x120 [ 207.999484][ T7864] __kmalloc_noprof+0xd2/0x510 [ 207.999507][ T7864] io_cache_alloc_new+0x45/0xf0 [ 207.999522][ T7864] __io_prep_rw+0x21d/0x1000 [ 207.999544][ T7864] ? __pfx___io_prep_rw+0x10/0x10 [ 207.999562][ T7864] ? mark_held_locks+0x49/0x80 [ 207.999585][ T7864] ? __pfx___io_alloc_req_refill+0x10/0x10 [ 207.999612][ T7864] io_prep_rw+0x24/0x220 [ 207.999634][ T7864] io_prep_writev+0x23/0xa0 [ 207.999656][ T7864] io_submit_sqes+0x835/0x2590 [ 207.999695][ T7864] __do_sys_io_uring_enter+0xd6a/0x1630 [ 207.999724][ T7864] ? __fget_files+0x20e/0x3c0 [ 207.999742][ T7864] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 207.999768][ T7864] ? fput+0x9b/0xd0 [ 207.999790][ T7864] ? ksys_write+0x1ac/0x250 [ 207.999806][ T7864] ? __pfx_ksys_write+0x10/0x10 [ 207.999830][ T7864] do_syscall_64+0xcd/0x4c0 [ 207.999849][ T7864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.999867][ T7864] RIP: 0033:0x7f63dfd8ebe9 [ 207.999899][ T7864] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 207.999916][ T7864] RSP: 002b:00007f63e0c21038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 207.999933][ T7864] RAX: ffffffffffffffda RBX: 00007f63dffb5fa0 RCX: 00007f63dfd8ebe9 [ 207.999944][ T7864] RDX: 0000000000000000 RSI: 0000000000003516 RDI: 0000000000000003 [ 207.999954][ T7864] RBP: 00007f63e0c21090 R08: 0000000000000000 R09: 0000000000000000 [ 207.999970][ T7864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 207.999980][ T7864] R13: 00007f63dffb6038 R14: 00007f63dffb5fa0 R15: 00007ffd493dbc38 [ 208.000004][ T7864] [ 209.292971][ T30] audit: type=1400 audit(1754672455.501:587): avc: denied { bind } for pid=7873 comm="syz.4.419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 209.350084][ T5853] usb 6-1: USB disconnect, device number 5 [ 209.394699][ T30] audit: type=1400 audit(1754672455.501:588): avc: denied { name_bind } for pid=7873 comm="syz.4.419" src=65534 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 209.471238][ T30] audit: type=1400 audit(1754672455.501:589): avc: denied { node_bind } for pid=7873 comm="syz.4.419" saddr=224.0.0.2 src=65534 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 209.672954][ T30] audit: type=1400 audit(1754672455.901:590): avc: denied { connect } for pid=7883 comm="syz.4.425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 209.744287][ T7886] 9pnet_fd: Insufficient options for proto=fd [ 210.521015][ T30] audit: type=1400 audit(1754672455.971:591): avc: denied { open } for pid=7881 comm="syz.1.424" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=16024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 210.665711][ T30] audit: type=1400 audit(1754672456.871:592): avc: denied { create } for pid=7890 comm="syz.2.426" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 211.471293][ T5958] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 211.624061][ T5958] usb 6-1: Using ep0 maxpacket: 8 [ 211.641439][ T5853] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 211.664960][ T5958] usb 6-1: unable to get BOS descriptor or descriptor too short [ 211.676717][ T5958] usb 6-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 211.702383][ T5958] usb 6-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=fa.be [ 211.720751][ T5958] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.729922][ T5958] usb 6-1: Product: syz [ 211.736105][ T5958] usb 6-1: Manufacturer: syz [ 211.740818][ T5958] usb 6-1: SerialNumber: syz [ 211.804585][ T5853] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 211.842485][ T5853] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 211.885866][ T5853] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 211.904489][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.924209][ T5853] usb 5-1: Product: syz [ 211.931649][ T5853] usb 5-1: Manufacturer: syz [ 211.946519][ T5853] usb 5-1: SerialNumber: syz [ 211.966333][ T5853] cdc_mbim 5-1:1.0: skipping garbage [ 212.105161][ T7909] FAULT_INJECTION: forcing a failure. [ 212.105161][ T7909] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.206775][ T7909] CPU: 1 UID: 0 PID: 7909 Comm: syz.1.430 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 212.206802][ T7909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 212.206812][ T7909] Call Trace: [ 212.206819][ T7909] [ 212.206825][ T7909] dump_stack_lvl+0x16c/0x1f0 [ 212.206856][ T7909] should_fail_ex+0x512/0x640 [ 212.206874][ T7909] _copy_from_user+0x2e/0xd0 [ 212.206894][ T7909] kstrtouint_from_user+0xd6/0x1d0 [ 212.206916][ T7909] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 212.206937][ T7909] ? __lock_acquire+0xb97/0x1ce0 [ 212.206974][ T7909] proc_fail_nth_write+0x83/0x220 [ 212.206995][ T7909] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 212.207020][ T7909] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 212.207038][ T7909] vfs_write+0x2a0/0x1150 [ 212.207059][ T7909] ? __pfx___mutex_lock+0x10/0x10 [ 212.207075][ T7909] ? __pfx_vfs_write+0x10/0x10 [ 212.207099][ T7909] ? __fget_files+0x20e/0x3c0 [ 212.207124][ T7909] ksys_write+0x12a/0x250 [ 212.207143][ T7909] ? __pfx_ksys_write+0x10/0x10 [ 212.207167][ T7909] ? fdget+0x187/0x210 [ 212.207187][ T7909] do_syscall_64+0xcd/0x4c0 [ 212.207205][ T7909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.207222][ T7909] RIP: 0033:0x7fb42418d69f [ 212.207235][ T7909] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 212.207253][ T7909] RSP: 002b:00007fb425025030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 212.207278][ T7909] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb42418d69f [ 212.207289][ T7909] RDX: 0000000000000001 RSI: 00007fb4250250a0 RDI: 0000000000000005 [ 212.207299][ T7909] RBP: 00007fb425025090 R08: 0000000000000000 R09: 0000000000000000 [ 212.207309][ T7909] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 212.207318][ T7909] R13: 00007fb4243b6128 R14: 00007fb4243b6090 R15: 00007fff48650068 [ 212.207342][ T7909] [ 212.227556][ T5853] cdc_mbim 5-1:1.0: bind() failure [ 212.457970][ T5853] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 212.465708][ T5853] cdc_ncm 5-1:1.1: bind() failure [ 212.480106][ T5853] usb 5-1: USB disconnect, device number 7 [ 213.358107][ T7918] netlink: 'syz.4.433': attribute type 1 has an invalid length. [ 213.371226][ T7918] netlink: 224 bytes leftover after parsing attributes in process `syz.4.433'. [ 213.448026][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 213.448042][ T30] audit: type=1400 audit(1754672459.671:594): avc: denied { read } for pid=7917 comm="syz.4.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 213.482729][ T30] audit: type=1400 audit(1754672459.701:595): avc: denied { write } for pid=7917 comm="syz.4.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 213.789213][ T30] audit: type=1400 audit(1754672460.011:596): avc: denied { write } for pid=7927 comm="syz.1.437" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 213.860904][ T30] audit: type=1400 audit(1754672460.041:597): avc: denied { ioctl } for pid=7927 comm="syz.1.437" path="socket:[16173]" dev="sockfs" ino=16173 ioctlcmd=0x5532 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 213.968834][ T30] audit: type=1400 audit(1754672460.041:598): avc: denied { read } for pid=7927 comm="syz.1.437" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 214.041806][ T5958] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 214.061222][ T5958] sonixb 6-1:129.0: Error reading register 00: -71 [ 214.074552][ T5958] usb 6-1: USB disconnect, device number 6 [ 215.761357][ T30] audit: type=1400 audit(1754672461.971:599): avc: denied { map } for pid=7954 comm="syz.5.446" path="/dev/video8" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 216.843120][ T7965] Invalid source name [ 217.462826][ T30] audit: type=1400 audit(1754672463.691:600): avc: denied { listen } for pid=7972 comm="syz.4.453" laddr=172.20.20.170 lport=52768 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 217.493381][ T7983] sctp: failed to load transform for md5: -2 [ 217.499415][ T7981] sctp: failed to load transform for md5: -2 [ 217.513510][ T5861] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 217.523529][ T5861] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 217.537952][ T5852] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 217.547820][ T5852] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 217.556000][ T5852] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 217.687457][ T7984] lo speed is unknown, defaulting to 1000 [ 217.732827][ T7999] : entered promiscuous mode [ 218.202280][ T30] audit: type=1326 audit(1754672464.421:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.426888][ T30] audit: type=1326 audit(1754672464.421:602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.500269][ T30] audit: type=1326 audit(1754672464.431:603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.554035][ T30] audit: type=1326 audit(1754672464.431:604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.626049][ T30] audit: type=1326 audit(1754672464.431:605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.791205][ T30] audit: type=1326 audit(1754672464.431:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 218.991422][ T30] audit: type=1326 audit(1754672464.431:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.024922][ T5961] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 219.029040][ T30] audit: type=1326 audit(1754672464.431:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.370055][ T8028] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 219.491074][ T30] audit: type=1326 audit(1754672464.431:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.514986][ T30] audit: type=1326 audit(1754672464.431:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.538717][ T30] audit: type=1326 audit(1754672464.431:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.572260][ T30] audit: type=1326 audit(1754672464.431:612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8000 comm="syz.4.461" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 219.676368][ T5859] Bluetooth: hci1: command tx timeout [ 219.894180][ T5961] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 219.916418][ T5961] usb 5-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 219.953535][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.991679][ T5961] usb 5-1: config 0 descriptor?? [ 220.025191][ T7984] chnl_net:caif_netlink_parms(): no params data found [ 220.222569][ T5961] usb 5-1: USB disconnect, device number 8 [ 220.284315][ T7984] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.294400][ T7984] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.306859][ T7984] bridge_slave_0: entered allmulticast mode [ 220.318441][ T7984] bridge_slave_0: entered promiscuous mode [ 220.331235][ T7984] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.338464][ T7984] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.345765][ T7984] bridge_slave_1: entered allmulticast mode [ 220.353138][ T7984] bridge_slave_1: entered promiscuous mode [ 220.405484][ T7984] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 220.436335][ T7984] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 220.655040][ T7984] team0: Port device team_slave_0 added [ 220.674108][ T7984] team0: Port device team_slave_1 added [ 220.710853][ T7984] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 221.138274][ T7984] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 221.176686][ T7984] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 221.215362][ T7984] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 221.231159][ T7984] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 221.275111][ T7984] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 221.625268][ T7984] hsr_slave_0: entered promiscuous mode [ 221.748982][ T7984] hsr_slave_1: entered promiscuous mode [ 221.764336][ T5859] Bluetooth: hci1: command tx timeout [ 221.829932][ T7984] debugfs: 'hsr0' already exists in 'hsr' [ 221.957737][ T7984] Cannot create hsr debugfs directory [ 222.385965][ T5859] Bluetooth: hci2: unexpected event for opcode 0x080e [ 222.624357][ T7984] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 222.758519][ T7984] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 222.887186][ T7984] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 222.903808][ T7984] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 223.762596][ T7984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 223.841449][ T5859] Bluetooth: hci1: command tx timeout [ 224.006334][ T8115] comedi comedi0: dt2815: I/O port conflict (0x9,2) [ 224.014288][ T8115] netlink: 20 bytes leftover after parsing attributes in process `syz.4.492'. [ 224.034209][ T7984] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.109877][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.117056][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.143244][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.150324][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.359869][ T8126] netlink: 4 bytes leftover after parsing attributes in process `syz.2.494'. [ 224.461173][ T5958] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 224.898790][ T7984] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 224.995205][ T5958] usb 6-1: Using ep0 maxpacket: 8 [ 225.009720][ T5958] usb 6-1: unable to get BOS descriptor or descriptor too short [ 225.019632][ T5958] usb 6-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 225.034747][ T5958] usb 6-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=fa.be [ 225.045977][ T5958] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.058040][ T5958] usb 6-1: Product: syz [ 225.064863][ T5958] usb 6-1: Manufacturer: syz [ 225.079773][ T5958] usb 6-1: SerialNumber: syz [ 225.144454][ T8144] netlink: 40 bytes leftover after parsing attributes in process `syz.4.498'. [ 225.317221][ T8143] lo speed is unknown, defaulting to 1000 [ 225.931197][ T5859] Bluetooth: hci1: command tx timeout [ 226.772865][ T7984] veth0_vlan: entered promiscuous mode [ 226.821528][ T7984] veth1_vlan: entered promiscuous mode [ 227.106097][ T7984] veth0_macvtap: entered promiscuous mode [ 227.184853][ T7984] veth1_macvtap: entered promiscuous mode [ 227.218925][ T7984] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 227.240694][ T7984] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 227.285612][ T7474] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.381297][ T7474] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.422122][ T7474] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.495667][ T7474] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.523525][ T5958] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 227.572675][ T5958] sonixb 6-1:129.0: Error reading register 00: -71 [ 227.612180][ T8164] tipc: Started in network mode [ 227.617786][ T8164] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 227.641797][ T8164] tipc: Enabling of bearer rejected, failed to enable media [ 227.668100][ T5958] usb 6-1: USB disconnect, device number 7 [ 227.678985][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 227.678999][ T30] audit: type=1400 audit(1754672473.901:644): avc: denied { setattr } for pid=8161 comm="syz.5.502" name="ALG" dev="sockfs" ino=17123 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 227.830239][ T7493] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 227.889900][ T7493] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.030213][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.048620][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.174065][ T30] audit: type=1326 audit(1754672474.401:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.292308][ T30] audit: type=1326 audit(1754672474.401:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.331210][ T30] audit: type=1326 audit(1754672474.431:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.416694][ T30] audit: type=1326 audit(1754672474.431:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.422894][ T8180] netlink: 10 bytes leftover after parsing attributes in process `syz.2.508'. [ 228.522211][ T30] audit: type=1326 audit(1754672474.431:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.573182][ T30] audit: type=1326 audit(1754672474.431:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.711201][ T5964] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 228.737582][ T30] audit: type=1326 audit(1754672474.431:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.761717][ T30] audit: type=1326 audit(1754672474.431:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 228.785969][ T30] audit: type=1326 audit(1754672474.431:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8179 comm="syz.2.508" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f63dfd8ebe9 code=0x7ffc0000 [ 229.302755][ T5964] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 229.318904][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 229.334521][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 229.349757][ T5964] usb 5-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 229.383474][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.408044][ T5964] usb 5-1: Product: syz [ 229.543652][ T5964] usb 5-1: Manufacturer: syz [ 229.567853][ T5964] usb 5-1: SerialNumber: syz [ 229.591772][ T5964] usb 5-1: config 0 descriptor?? [ 229.621417][ T8191] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 229.837489][ T5964] powermate: unknown product id 0240 [ 229.846742][ T5964] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 229.858075][ T5964] input: Griffin SoundKnob as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input12 [ 230.485064][ T8233] fuse: Bad value for 'fd' [ 230.501525][ T5964] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 230.661151][ T8240] netlink: 16 bytes leftover after parsing attributes in process `syz.5.526'. [ 230.682709][ T5964] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 230.734001][ T5964] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 230.750832][ T8242] netlink: 4 bytes leftover after parsing attributes in process `syz.5.526'. [ 230.768541][ T5964] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 230.777939][ T5964] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.790487][ T5964] usb 7-1: Product: syz [ 230.794801][ T5964] usb 7-1: Manufacturer: syz [ 230.809436][ T5964] usb 7-1: SerialNumber: syz [ 230.826130][ T5964] cdc_mbim 7-1:1.0: skipping garbage [ 231.504329][ C1] powermate: config urb returned -71 [ 231.511077][ C1] powermate: config urb returned -71 [ 231.512274][ T5958] usb 5-1: USB disconnect, device number 9 [ 231.516370][ C1] powermate: usb_submit_urb(config) failed [ 231.522490][ C1] powermate 5-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 231.627844][ T5964] cdc_mbim 7-1:1.0: bind() failure [ 231.666067][ T5964] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 231.791449][ T5964] cdc_ncm 7-1:1.1: bind() failure [ 231.826666][ T5964] usb 7-1: USB disconnect, device number 2 [ 232.737203][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 232.743428][ T30] audit: type=1326 audit(1754672478.961:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.323557][ T30] audit: type=1326 audit(1754672478.961:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.348247][ T30] audit: type=1326 audit(1754672478.961:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.372490][ T30] audit: type=1326 audit(1754672478.961:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.395971][ T30] audit: type=1326 audit(1754672478.961:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.419544][ T30] audit: type=1326 audit(1754672478.961:692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.443412][ T30] audit: type=1326 audit(1754672478.961:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.466909][ T30] audit: type=1326 audit(1754672478.961:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.545084][ T30] audit: type=1326 audit(1754672478.961:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.575672][ T30] audit: type=1326 audit(1754672478.961:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8270 comm="syz.6.536" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 233.599703][ T24] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 233.747003][ T8282] mmap: syz.2.538 (8282) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 233.801145][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 233.810391][ T24] usb 5-1: config 250 has an invalid interface number: 250 but max is 0 [ 233.839286][ T24] usb 5-1: config 250 has no interface number 0 [ 233.863257][ T24] usb 5-1: config 250 interface 250 has no altsetting 0 [ 233.911398][ T24] usb 5-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=1d.4a [ 233.931190][ T5930] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 233.949899][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.992171][ T24] usb 5-1: Product: syz [ 234.011943][ T24] usb 5-1: Manufacturer: syz [ 234.038961][ T24] usb 5-1: SerialNumber: syz [ 234.105127][ T5930] usb 7-1: Using ep0 maxpacket: 16 [ 234.120754][ T5930] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.490503][ T5930] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 234.524290][ T5930] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 234.578131][ T5930] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 234.633164][ T24] mvusb_mdio 5-1:250.250: probe with driver mvusb_mdio failed with error -5 [ 234.642160][ T5930] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.644369][ T5930] usb 7-1: config 0 descriptor?? [ 234.718265][ T24] usb 5-1: USB disconnect, device number 10 [ 235.044258][ T8305] netlink: 16 bytes leftover after parsing attributes in process `syz.2.545'. [ 235.276806][ T8312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.545'. [ 236.834475][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 236.851213][ T5930] microsoft 0003:045E:07DA.000C: ignoring exceeding usage max [ 236.870441][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 236.921691][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 237.002583][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 237.009843][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 237.353057][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 237.360267][ T5930] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 237.455748][ T5930] microsoft 0003:045E:07DA.000C: item fetching failed at offset 32/34 [ 237.470417][ T5930] microsoft 0003:045E:07DA.000C: parse failed [ 237.473170][ T24] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 237.479854][ T5930] microsoft 0003:045E:07DA.000C: probe with driver microsoft failed with error -22 [ 237.663102][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 237.699152][ T24] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 237.722554][ T24] usb 6-1: config 0 has no interface number 0 [ 237.756115][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 237.847350][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 237.885289][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 237.930217][ T24] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 237.977235][ T5930] usb 7-1: USB disconnect, device number 3 [ 237.991975][ T24] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 238.013915][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 238.029742][ T24] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 238.041961][ T24] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 238.266745][ T24] usb 6-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 238.719352][ T24] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 238.728800][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.737043][ T24] usb 6-1: Product: syz [ 239.077900][ T24] usb 6-1: Manufacturer: syz [ 239.144756][ T24] usb 6-1: SerialNumber: syz [ 239.261531][ T24] usb 6-1: config 0 descriptor?? [ 239.267612][ T8335] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 239.291922][ T24] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 1 is not bulk. [ 239.308919][ T24] microtek usb (rev 0.4.3): couldn't find an output bulk endpoint. Bailing out. [ 239.620179][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 239.620198][ T30] audit: type=1400 audit(1754672485.841:704): avc: denied { ioctl } for pid=8333 comm="syz.5.552" path="socket:[18488]" dev="sockfs" ino=18488 ioctlcmd=0x89f2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 239.777156][ T8376] netlink: 12 bytes leftover after parsing attributes in process `syz.5.552'. [ 240.176588][ T30] audit: type=1400 audit(1754672485.881:705): avc: denied { getopt } for pid=8333 comm="syz.5.552" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 240.207145][ T8335] 8021q: adding VLAN 0 to HW filter on device bond1 [ 240.937833][ T5930] usb 6-1: USB disconnect, device number 8 [ 241.403807][ T8401] netlink: 8 bytes leftover after parsing attributes in process `syz.6.569'. [ 241.423542][ T30] audit: type=1326 audit(1754672487.651:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.6.569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 241.452736][ T30] audit: type=1326 audit(1754672487.681:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8399 comm="syz.6.569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7f154258ebe9 code=0x7ffc0000 [ 243.190321][ T8425] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 243.198908][ T8425] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 243.218884][ T8425] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 243.227568][ T8425] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 243.300118][ T8431] FAULT_INJECTION: forcing a failure. [ 243.300118][ T8431] name failslab, interval 1, probability 0, space 0, times 0 [ 243.382362][ T8431] CPU: 0 UID: 0 PID: 8431 Comm: syz.4.575 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 243.382390][ T8431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 243.382401][ T8431] Call Trace: [ 243.382408][ T8431] [ 243.382415][ T8431] dump_stack_lvl+0x16c/0x1f0 [ 243.382447][ T8431] should_fail_ex+0x512/0x640 [ 243.382464][ T8431] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 243.382486][ T8431] should_failslab+0xc2/0x120 [ 243.382507][ T8431] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 243.382523][ T8431] ? __io_alloc_req_refill+0x27d/0x500 [ 243.382546][ T8431] ? getname_flags.part.0+0x4c/0x550 [ 243.382576][ T8431] getname_flags.part.0+0x4c/0x550 [ 243.382604][ T8431] getname_flags+0x93/0xf0 [ 243.382622][ T8431] __io_openat_prep+0x16d/0x420 [ 243.382640][ T8431] io_submit_sqes+0x835/0x2590 [ 243.382670][ T8431] __do_sys_io_uring_enter+0xd6a/0x1630 [ 243.382692][ T8431] ? __fget_files+0x20e/0x3c0 [ 243.382706][ T8431] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 243.382727][ T8431] ? fput+0x9b/0xd0 [ 243.382745][ T8431] ? ksys_write+0x1ac/0x250 [ 243.382758][ T8431] ? __pfx_ksys_write+0x10/0x10 [ 243.382777][ T8431] do_syscall_64+0xcd/0x4c0 [ 243.382791][ T8431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.382804][ T8431] RIP: 0033:0x7f346b78ebe9 [ 243.382821][ T8431] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.382835][ T8431] RSP: 002b:00007f34699ac038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 243.382848][ T8431] RAX: ffffffffffffffda RBX: 00007f346b9b6180 RCX: 00007f346b78ebe9 [ 243.382857][ T8431] RDX: 0000000000000000 RSI: 00000000000047f4 RDI: 0000000000000005 [ 243.382865][ T8431] RBP: 00007f34699ac090 R08: 0000000000000000 R09: 0000000000000000 [ 243.382873][ T8431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 243.382881][ T8431] R13: 00007f346b9b6218 R14: 00007f346b9b6180 R15: 00007ffe6fec1c18 [ 243.382900][ T8431] [ 243.588139][ C0] vkms_vblank_simulate: vblank timer overrun [ 244.381297][ T5964] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 244.536159][ T5964] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.581188][ T5964] usb 6-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 244.620621][ T5964] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.661749][ T5964] usb 6-1: config 0 descriptor?? [ 244.924815][ T8448] netlink: 32 bytes leftover after parsing attributes in process `syz.6.581'. [ 245.128103][ T5964] lenovo 0003:17EF:6047.000D: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.5-1/input0 [ 245.893991][ T8456] bond0: (slave macvlan0): Error -98 calling set_mac_address [ 245.921424][ T8464] 9pnet: p9_errstr2errno: server reported unknown error 6Ûz9’f00000000000000000004 [ 246.194409][ T8467] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 246.806267][ T8467] audit: out of memory in audit_log_start [ 247.605939][ T5902] usb 6-1: USB disconnect, device number 9 [ 247.712249][ T30] audit: type=1326 audit(1754672493.941:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 247.738872][ T30] audit: type=1326 audit(1754672493.941:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 247.781197][ T30] audit: type=1326 audit(1754672493.961:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 247.871142][ T30] audit: type=1326 audit(1754672493.961:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 248.313062][ T30] audit: type=1326 audit(1754672493.961:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f346b78ebe9 code=0x7ffc0000 [ 248.795848][ T30] audit: type=1326 audit(1754672493.961:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f346b790b07 code=0x7ffc0000 [ 248.801443][ T8485] netlink: 1624 bytes leftover after parsing attributes in process `syz.4.594'. [ 248.854939][ T30] audit: type=1326 audit(1754672493.961:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f346b790a7c code=0x7ffc0000 [ 248.982730][ T30] audit: type=1326 audit(1754672493.961:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8472 comm="syz.4.590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f346b7909b4 code=0x7ffc0000 [ 249.015488][ T8489] netlink: 16 bytes leftover after parsing attributes in process `syz.4.596'. [ 249.917038][ T8489] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.596'. [ 249.980359][ T8499] evm: overlay not supported [ 250.046996][ T8506] Invalid ELF header magic: != ELF [ 250.123267][ T5859] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 250.133351][ T5859] CPU: 1 UID: 0 PID: 5859 Comm: kworker/u9:6 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 250.133380][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 250.133393][ T5859] Workqueue: hci0 hci_rx_work [ 250.133424][ T5859] Call Trace: [ 250.133429][ T5859] [ 250.133436][ T5859] dump_stack_lvl+0x16c/0x1f0 [ 250.133463][ T5859] sysfs_warn_dup+0x7f/0xa0 [ 250.133487][ T5859] sysfs_create_dir_ns+0x24b/0x2b0 [ 250.133511][ T5859] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 250.133531][ T5859] ? find_held_lock+0x2b/0x80 [ 250.133556][ T5859] ? do_raw_spin_unlock+0x172/0x230 [ 250.133575][ T5859] kobject_add_internal+0x2c4/0x9b0 [ 250.133596][ T5859] kobject_add+0x16e/0x240 [ 250.133615][ T5859] ? __pfx_kobject_add+0x10/0x10 [ 250.133632][ T5859] ? do_raw_spin_unlock+0x172/0x230 [ 250.133649][ T5859] ? kobject_put+0xab/0x5a0 [ 250.133669][ T5859] device_add+0x288/0x1aa0 [ 250.133688][ T5859] ? __pfx_dev_set_name+0x10/0x10 [ 250.133707][ T5859] ? __pfx_device_add+0x10/0x10 [ 250.133740][ T5859] ? mgmt_send_event_skb+0x2fb/0x460 [ 250.133771][ T5859] hci_conn_add_sysfs+0x17e/0x230 [ 250.133797][ T5859] le_conn_complete_evt+0x1075/0x1d70 [ 250.133824][ T5859] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 250.133844][ T5859] ? hci_event_packet+0x459/0x11c0 [ 250.133872][ T5859] hci_le_enh_conn_complete_evt+0x23d/0x380 [ 250.133897][ T5859] ? skb_pull_data+0x166/0x210 [ 250.133921][ T5859] hci_le_meta_evt+0x357/0x5e0 [ 250.133942][ T5859] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 250.133965][ T5859] hci_event_packet+0x685/0x11c0 [ 250.133984][ T5859] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 250.134006][ T5859] ? __pfx_hci_event_packet+0x10/0x10 [ 250.134029][ T5859] ? kcov_remote_start+0x3c9/0x6d0 [ 250.134049][ T5859] ? lockdep_hardirqs_on+0x7c/0x110 [ 250.134079][ T5859] hci_rx_work+0x2c5/0x16b0 [ 250.134103][ T5859] ? rcu_is_watching+0x12/0xc0 [ 250.134128][ T5859] process_one_work+0x9cc/0x1b70 [ 250.134155][ T5859] ? __pfx_process_one_work+0x10/0x10 [ 250.134176][ T5859] ? assign_work+0x1a0/0x250 [ 250.134193][ T5859] worker_thread+0x6c8/0xf10 [ 250.134219][ T5859] ? __pfx_worker_thread+0x10/0x10 [ 250.134238][ T5859] kthread+0x3c5/0x780 [ 250.134256][ T5859] ? __pfx_kthread+0x10/0x10 [ 250.134274][ T5859] ? rcu_is_watching+0x12/0xc0 [ 250.134296][ T5859] ? __pfx_kthread+0x10/0x10 [ 250.134315][ T5859] ret_from_fork+0x5d4/0x6f0 [ 250.134331][ T5859] ? __pfx_kthread+0x10/0x10 [ 250.134348][ T5859] ret_from_fork_asm+0x1a/0x30 [ 250.134380][ T5859] [ 250.134414][ T5859] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 250.371232][ T5958] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 250.374739][ T5859] Bluetooth: hci0: failed to register connection device [ 250.902864][ T5958] usb 5-1: config 0 has an invalid descriptor of length 120, skipping remainder of the config [ 250.924758][ T5958] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 250.946593][ T5958] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 250.965350][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.988688][ T5958] usb 5-1: config 0 descriptor?? [ 251.503035][ T5902] usb 5-1: USB disconnect, device number 11 [ 251.648980][ T8534] netlink: 28 bytes leftover after parsing attributes in process `syz.2.608'. [ 252.140836][ T8532] syzkaller0: entered promiscuous mode [ 252.158833][ T8532] syzkaller0: entered allmulticast mode [ 252.287481][ T8547] netlink: 16 bytes leftover after parsing attributes in process `syz.4.610'. [ 252.344858][ T8552] netlink: 16 bytes leftover after parsing attributes in process `syz.1.611'. [ 252.370571][ T8553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.610'. [ 253.098343][ T8559] netlink: 4 bytes leftover after parsing attributes in process `syz.1.611'. [ 253.533839][ T5961] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 253.671278][ T5961] usb 7-1: device descriptor read/64, error -71 [ 253.915463][ T5961] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 254.061150][ T5961] usb 7-1: device descriptor read/64, error -71 [ 254.174471][ T5961] usb usb7-port1: attempt power cycle [ 254.541280][ T5961] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 254.574034][ T5961] usb 7-1: device descriptor read/8, error -71 [ 254.832498][ T5961] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 254.863432][ T5961] usb 7-1: device descriptor read/8, error -71 [ 254.974153][ T5961] usb usb7-port1: unable to enumerate USB device [ 255.189720][ T8565] netlink: 'syz.2.616': attribute type 29 has an invalid length. [ 255.197747][ T8565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.616'. [ 255.284859][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.310008][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 255.310025][ T30] audit: type=1400 audit(1754672501.531:735): avc: denied { name_connect } for pid=8569 comm="syz.5.618" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 255.338611][ T8570] mmap: syz.2.619 (8570): VmData 37728256 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 255.454461][ T30] audit: type=1400 audit(1754672501.681:736): avc: denied { accept } for pid=8569 comm="syz.5.618" lport=60707 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 256.263723][ T30] audit: type=1400 audit(1754672502.481:737): avc: denied { append } for pid=8597 comm="syz.4.624" name="file0" dev="tmpfs" ino=718 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 256.348135][ T30] audit: type=1400 audit(1754672502.481:738): avc: denied { open } for pid=8597 comm="syz.4.624" path="/133/file0" dev="tmpfs" ino=718 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 256.779995][ T5958] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 256.798627][ T30] audit: type=1400 audit(1754672503.001:739): avc: denied { setattr } for pid=8613 comm="syz.1.630" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 256.917642][ T8611] 9pnet_fd: Insufficient options for proto=fd [ 257.031370][ T30] audit: type=1400 audit(1754672503.061:740): avc: denied { create } for pid=8607 comm="syz.4.628" name="#9" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 257.122523][ T5958] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 257.137607][ T5958] usb 7-1: config 0 interface 0 has no altsetting 0 [ 257.145453][ T30] audit: type=1400 audit(1754672503.071:741): avc: denied { link } for pid=8607 comm="syz.4.628" name="#9" dev="tmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 257.227293][ T5958] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 257.413604][ T5958] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 257.512770][ T5958] usb 7-1: Product: syz [ 257.531156][ T30] audit: type=1400 audit(1754672503.081:742): avc: denied { rename } for pid=8607 comm="syz.4.628" name="#a" dev="tmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 257.556077][ T5958] usb 7-1: Manufacturer: syz [ 257.605712][ T5958] usb 7-1: SerialNumber: syz [ 257.839500][ T5958] usb 7-1: config 0 descriptor?? [ 257.875410][ T5958] usb 7-1: selecting invalid altsetting 0 [ 258.030989][ T30] audit: type=1400 audit(1754672504.251:743): avc: denied { setopt } for pid=8633 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 258.073217][ T30] audit: type=1400 audit(1754672504.281:744): avc: denied { connect } for pid=8633 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 258.202754][ T5958] usb 7-1: USB disconnect, device number 8 [ 258.581180][ T5902] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 258.788290][ T5902] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 258.828291][ T5902] usb 5-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 258.857231][ T5902] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.217536][ T5902] usb 5-1: config 0 descriptor?? [ 259.346515][ T8654] cgroup: Need name or subsystem set [ 259.393882][ T8657] ptrace attach of "./syz-executor exec"[6891] was attempted by "ß–é·´)Qoƒ ¬¶ ÿ\x0dvé”Ò¢Ï9T{¨-9È2\x0ap_3j ¥í…nòÐÞ­O³a“)b¡¿†k´ü¿—Òߟ.µ¸\x0aKæ~òœ›±¿´Øª¾³þKOkF^ªƒ3Üý¶òB3»ç)Ðùè«åç¦Æ{\x5cüäõrHBd¿,µÛX¨\x09\x0bì3îc›÷\x22¬&WÜ\x22Ð\x1b·T¾L'Á‡\x09êÁ!_†NÍhÙ¹=ún>ÒaÚõûð £(G6¨¶èŒ·…A+&ϋЈU©›ß¡a¾{@{ø\x0bî[ɸýÛYaºócßξA¯™ò¥ÁÈÌ„‰‡zœàÂGl:d<]ýu~v•!Â9÷,Ú?Å´‘>\x22ar\x1bªl¦KÚ¬ôYêüå*VÌßSŽ”8›…È6]àk‡½KÌ.¨=°’ÚÛ`#æòðåž\x07Ÿ„x!œ—‹g·MDôŒÉÿÿRå*áOLK\x0cÛ}oKáb¼A>{Ã@aÞM¨dÇnQj›ãÌ–—„óÂÀ5)üö]Ú;r¦­,L± \x0cÃ=\x0d«ûïW¢’¡ÓAE½ ¤nË`>åÆŸçòs-Ä3…ì`y«feH‹»¦½^/$¨L1&·¡™N‹P\x0d1ß‘D<­\x07c§Pd(ß·E¤ÓdžÛt¦¦çaÀE’!úÒ­ Ã\x09@¤ÝžHG—~è·H<ÜÒD$¥\x0crXŒ´œ`Ç-ͪ/‡IF¾þÈÑÚEÛàtIáìâˆ;{¬ÿ„Æ«—ë—*W\x0c÷¢\x0a¶:ßÒE­–Ì€«V'ˆ\x0cº†È8sÍejkþ¡ÅÓe~É«ÉÿRò ÊãîÜLìÒêôB*´\x0b-¡ræÈ@\x07ËÒV˜MÅ¡ývà¿ù%OymÇ‚WGüÜ•‹ó|òÈʤ=¨týƒ¦®»U§Þñ?‡£h£ØKÉ0uÓ£Ùœþ½0ÒG Ì'Ãb,‚þè\x22ߊåÿõ;2£Õˆ±'G/Þ³7ò´Wd\x5c!ów%°èñxgŸ\x22âÍx•± ì[4!Nl’˜òQ(\x0a@é[Å+ ÌØÝǬ[[zN¨þ úîs¡B&ãµâÿ™XïƒÅ>%©ö3Š‘{¦- —^ÀÇQÇš4e3\x0b>ÊsFÌ—ÝH]+\x [ 259.669405][ T5902] smartjoyplus 0003:6666:8804.000E: unknown main item tag 0x6 [ 260.264992][ T5902] smartjoyplus 0003:6666:8804.000E: hidraw0: USB HID v0.00 Device [HID 6666:8804] on usb-dummy_hcd.4-1/input0 [ 260.334026][ T5902] smartjoyplus 0003:6666:8804.000E: no output reports found [ 260.445193][ T57] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 260.466051][ T5902] usb 5-1: USB disconnect, device number 12 [ 260.632427][ T57] usb 2-1: New USB device found, idVendor=0af7, idProduct=0101, bcdDevice=2d.62 [ 260.642839][ T57] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.005040][ T57] usb 2-1: config 0 descriptor?? [ 261.019946][ T8670] fido_id[8670]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 261.038339][ T57] usb 2-1: selecting invalid altsetting 1 [ 261.046391][ T57] flexcop_usb: set interface failed. [ 261.058448][ T57] b2c2_flexcop_usb 2-1:0.0: probe with driver b2c2_flexcop_usb failed with error -22 [ 261.382725][ T8689] befs: (nbd6): No write support. Marking filesystem read-only [ 261.391034][ T8689] syz.6.648: attempt to access beyond end of device [ 261.391034][ T8689] nbd6: rw=0, sector=0, nr_sectors = 2 limit=0 [ 261.404126][ T8689] befs: (nbd6): unable to read superblock [ 261.501266][ T57] usb 2-1: USB disconnect, device number 16 [ 261.646362][ T8684] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 261.777979][ T8684] CIFS: Unable to determine destination address [ 262.036691][ T8693] netlink: 12 bytes leftover after parsing attributes in process `syz.4.654'. [ 262.513232][ T8708] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 262.865415][ T8713] 9pnet_fd: Insufficient options for proto=fd [ 264.881748][ T5903] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 265.387148][ T5930] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 265.492745][ T5903] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 265.502977][ T5903] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 265.522743][ T5903] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 265.565452][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.602776][ T5903] usb 7-1: config 0 descriptor?? [ 265.607951][ T5930] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.629454][ T5930] usb 2-1: New USB device found, idVendor=1532, idProduct=010e, bcdDevice= 0.00 [ 265.655257][ T5903] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 265.673831][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.707375][ T5930] usb 2-1: config 0 descriptor?? [ 266.801493][ T5961] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 266.843248][ T8737] netlink: 'syz.1.668': attribute type 1 has an invalid length. [ 266.868441][ T8737] 8021q: adding VLAN 0 to HW filter on device bond1 [ 266.897961][ T8737] vlan0: entered allmulticast mode [ 266.903698][ T8737] veth1: entered allmulticast mode [ 266.914283][ T8737] bond1: (slave vlan0): making interface the new active one [ 266.923193][ T8737] bond1: (slave vlan0): Enslaving as an active interface with an up link [ 266.946114][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 266.946131][ T30] audit: type=1400 audit(1754672513.171:760): avc: denied { read } for pid=8736 comm="syz.1.668" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 266.948745][ T8737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.952324][ T30] audit: type=1400 audit(1754672513.171:761): avc: denied { open } for pid=8736 comm="syz.1.668" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 266.984498][ T8737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.986068][ T30] audit: type=1400 audit(1754672513.171:762): avc: denied { map } for pid=8736 comm="syz.1.668" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 267.043918][ T30] audit: type=1400 audit(1754672513.171:763): avc: denied { execute } for pid=8736 comm="syz.1.668" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 267.048677][ T5902] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 267.074182][ T5930] usbhid 2-1:0.0: can't add hid device: -71 [ 267.086616][ T5961] usb 5-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 267.088167][ T5930] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 267.097315][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=64, SerialNumber=0 [ 267.112815][ T5961] usb 5-1: Product: syz [ 267.118430][ T5930] usb 2-1: USB disconnect, device number 17 [ 267.119878][ T5961] usb 5-1: config 0 descriptor?? [ 267.140642][ T5961] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 267.156219][ T5961] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 267.233449][ T5902] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 267.244538][ T5902] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 267.254388][ T5902] usb 6-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 267.264253][ T5902] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.277711][ T5902] usb 6-1: config 0 descriptor?? [ 267.318064][ T30] audit: type=1400 audit(1754672513.541:764): avc: denied { getopt } for pid=8768 comm="syz.2.678" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 267.722227][ T5852] Bluetooth: hci0: command 0x0406 tx timeout [ 268.023443][ T8764] openvswitch: netlink: Flow key attr not present in new flow. [ 268.500015][ T5902] logitech 0003:046D:C29C.000F: unexpected long global item [ 268.509501][ T5930] usb 7-1: USB disconnect, device number 9 [ 268.513395][ T5902] logitech 0003:046D:C29C.000F: parse failed [ 268.521869][ T5902] logitech 0003:046D:C29C.000F: probe with driver logitech failed with error -22 [ 268.539653][ T5902] usb 6-1: USB disconnect, device number 10 [ 269.281033][ T30] audit: type=1400 audit(1754672515.501:765): avc: denied { bind } for pid=8774 comm="syz.2.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 269.599455][ T8779] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.680'. [ 269.622238][ T8783] netlink: 16 bytes leftover after parsing attributes in process `syz.1.679'. [ 269.690801][ T8787] netlink: 4 bytes leftover after parsing attributes in process `syz.1.679'. [ 269.893816][ T8799] 9pnet_fd: Insufficient options for proto=fd [ 270.143747][ T30] audit: type=1400 audit(1754672516.371:766): avc: denied { connect } for pid=8801 comm="syz.5.684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 270.408376][ T30] audit: type=1400 audit(1754672516.491:767): avc: denied { getopt } for pid=8801 comm="syz.5.684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 270.428263][ T30] audit: type=1400 audit(1754672516.611:768): avc: denied { connect } for pid=8801 comm="syz.5.684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 270.782022][ T5961] usb 5-1: USB disconnect, device number 13 [ 270.797833][ T5961] ftdi_sio 5-1:0.0: device disconnected [ 271.403772][ T5930] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 271.571169][ T5930] usb 6-1: Using ep0 maxpacket: 8 [ 271.581206][ T5930] usb 6-1: config 6 has an invalid interface number: 171 but max is 0 [ 271.596597][ T5930] usb 6-1: config 6 has an invalid descriptor of length 254, skipping remainder of the config [ 271.621267][ T5930] usb 6-1: config 6 has no interface number 0 [ 271.631255][ T5961] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 271.638847][ T5930] usb 6-1: config 6 interface 171 altsetting 8 endpoint 0x6 has invalid maxpacket 576, setting to 64 [ 271.662642][ T5930] usb 6-1: config 6 interface 171 altsetting 8 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 271.720054][ T5930] usb 6-1: config 6 interface 171 altsetting 8 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 271.769913][ T5930] usb 6-1: config 6 interface 171 has no altsetting 0 [ 271.788696][ T5930] usb 6-1: Dual-Role OTG device on HNP port [ 271.794978][ T5930] usb 6-1: New USB device found, idVendor=1a0a, idProduct=0101, bcdDevice=e4.1e [ 271.813586][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.833745][ T5961] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.847096][ T5961] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 271.860875][ T5961] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 271.873063][ T5961] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.890132][ T5961] usb 2-1: config 0 descriptor?? [ 272.017174][ T5930] usb 6-1: Product: syz [ 272.020335][ T5961] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 272.026843][ T5930] usb 6-1: Manufacturer: syz [ 272.057951][ T5930] usb 6-1: SerialNumber: syz [ 272.149364][ T30] audit: type=1400 audit(1754672518.371:769): avc: denied { listen } for pid=8833 comm="syz.4.695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 272.351908][ T8839] netlink: 'syz.4.695': attribute type 10 has an invalid length. [ 272.374924][ T8840] netlink: 'syz.2.696': attribute type 2 has an invalid length. [ 272.479827][ T8839] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 272.582797][ T8838] netlink: 4 bytes leftover after parsing attributes in process `syz.2.696'. [ 272.806227][ T8838] hsr_slave_1 (unregistering): left promiscuous mode [ 272.847674][ T8813] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 272.854356][ T8813] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 272.914718][ T8813] vhci_hcd vhci_hcd.0: Device attached [ 272.964396][ T8846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.996223][ T8846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.071831][ T5961] vhci_hcd: vhci_device speed not set [ 273.321234][ T8844] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 273.333611][ T7498] vhci_hcd: stop threads [ 273.337892][ T7498] vhci_hcd: release socket [ 273.346950][ T5930] usb_ehset_test 6-1:6.171: probe with driver usb_ehset_test failed with error -32 [ 273.366918][ T7498] vhci_hcd: disconnect device [ 273.411200][ T5961] usb 43-1: new full-speed USB device number 2 using vhci_hcd [ 273.469564][ T5961] usb 43-1: enqueue for inactive port 0 [ 273.552202][ T5961] vhci_hcd: vhci_device speed not set [ 273.781858][ T8860] netlink: 16 bytes leftover after parsing attributes in process `syz.2.701'. [ 273.834306][ T8865] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 274.082539][ T5958] usb 6-1: USB disconnect, device number 11 [ 274.324436][ T30] audit: type=1800 audit(1754672520.541:770): pid=8870 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.702" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 274.728790][ T5964] usb 2-1: USB disconnect, device number 18 [ 275.769954][ T8893] netlink: 'syz.4.704': attribute type 2 has an invalid length. [ 275.806612][ T8894] netlink: 20 bytes leftover after parsing attributes in process `syz.6.707'. [ 276.405966][ T8893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.704'. [ 277.151205][ T5930] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 277.312213][ T5930] usb 7-1: Using ep0 maxpacket: 8 [ 277.330490][ T5930] usb 7-1: unable to get BOS descriptor or descriptor too short [ 277.359914][ T5930] usb 7-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 277.550303][ T5930] usb 7-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice=fa.be [ 277.566924][ T5930] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.588203][ T5930] usb 7-1: Product: syz [ 277.594232][ T5930] usb 7-1: Manufacturer: syz [ 277.920863][ T5930] usb 7-1: SerialNumber: syz [ 277.990306][ T8937] FAULT_INJECTION: forcing a failure. [ 277.990306][ T8937] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.010652][ T8937] CPU: 0 UID: 0 PID: 8937 Comm: syz.1.715 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 278.010682][ T8937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 278.010692][ T8937] Call Trace: [ 278.010699][ T8937] [ 278.010705][ T8937] dump_stack_lvl+0x16c/0x1f0 [ 278.010741][ T8937] should_fail_ex+0x512/0x640 [ 278.010762][ T8937] _copy_to_user+0x32/0xd0 [ 278.010784][ T8937] simple_read_from_buffer+0xcb/0x170 [ 278.010805][ T8937] proc_fail_nth_read+0x197/0x240 [ 278.010827][ T8937] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 278.010854][ T8937] ? rw_verify_area+0xcf/0x6c0 [ 278.010880][ T8937] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 278.010901][ T8937] vfs_read+0x1e1/0xc60 [ 278.010921][ T8937] ? __pfx___mutex_lock+0x10/0x10 [ 278.010938][ T8937] ? __pfx_vfs_read+0x10/0x10 [ 278.010963][ T8937] ? __fget_files+0x20e/0x3c0 [ 278.010990][ T8937] ksys_read+0x12a/0x250 [ 278.011008][ T8937] ? __pfx_ksys_read+0x10/0x10 [ 278.011025][ T8937] ? fput+0x9b/0xd0 [ 278.011052][ T8937] do_syscall_64+0xcd/0x4c0 [ 278.011069][ T8937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.011084][ T8937] RIP: 0033:0x7fb42418d5fc [ 278.011099][ T8937] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 278.011114][ T8937] RSP: 002b:00007fb425046030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 278.011129][ T8937] RAX: ffffffffffffffda RBX: 00007fb4243b5fa0 RCX: 00007fb42418d5fc [ 278.011140][ T8937] RDX: 000000000000000f RSI: 00007fb4250460a0 RDI: 0000000000000004 [ 278.011149][ T8937] RBP: 00007fb425046090 R08: 0000000000000000 R09: 0000000000000000 [ 278.011158][ T8937] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 278.011167][ T8937] R13: 00007fb4243b6038 R14: 00007fb4243b5fa0 R15: 00007fff48650068 [ 278.011191][ T8937] [ 278.376513][ T5958] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 279.001354][ T5958] usb 6-1: Using ep0 maxpacket: 16 [ 279.017119][ T5958] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 279.042145][ T5852] Bluetooth: hci1: command 0x0405 tx timeout [ 279.056808][ T5958] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 279.081392][ T5958] usb 6-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 279.101202][ T5958] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.113622][ T5958] usb 6-1: config 0 descriptor?? [ 279.546976][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.608676][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.691497][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.736814][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.770046][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.781380][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.792280][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 279.799702][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 280.007134][ T5930] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 280.018999][ T5930] sonixb 7-1:129.0: Error reading register 00: -71 [ 280.031897][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 280.371266][ T5958] hid-picolcd 0003:04D8:F002.0010: unknown main item tag 0x0 [ 280.401330][ T5930] usb 7-1: USB disconnect, device number 10 [ 280.464105][ T8988] netlink: 'syz.6.722': attribute type 2 has an invalid length. [ 280.517604][ T5958] hid-picolcd 0003:04D8:F002.0010: No report with id 0xf4 found [ 280.550901][ T8988] netlink: 4 bytes leftover after parsing attributes in process `syz.6.722'. [ 280.619975][ T5958] hid-picolcd 0003:04D8:F002.0010: No report with id 0xf3 found [ 280.771773][ T5958] usb 6-1: USB disconnect, device number 12 [ 281.159640][ T8988] hsr_slave_1 (unregistering): left promiscuous mode [ 281.177469][ T9017] netlink: 4 bytes leftover after parsing attributes in process `syz.1.727'. [ 281.300811][ T9011] netlink: 16 bytes leftover after parsing attributes in process `syz.1.727'. [ 282.664094][ T5958] IPVS: starting estimator thread 0... [ 282.831436][ T9034] IPVS: using max 53 ests per chain, 127200 per kthread [ 282.984334][ T30] audit: type=1400 audit(1754672529.211:771): avc: denied { setattr } for pid=9041 comm="syz.6.732" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 283.119506][ T30] audit: type=1400 audit(1754672529.241:772): avc: denied { write } for pid=9041 comm="syz.6.732" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 283.194531][ T30] audit: type=1400 audit(1754672529.241:773): avc: denied { open } for pid=9041 comm="syz.6.732" path="/42/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 283.481375][ T5930] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 283.653840][ T5930] usb 6-1: Using ep0 maxpacket: 32 [ 283.678779][ T5930] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 283.716583][ T5930] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 283.751154][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 283.825928][ T5930] usb 6-1: Product: syz [ 283.838267][ T5930] usb 6-1: Manufacturer: syz [ 283.858112][ T5930] usb 6-1: SerialNumber: syz [ 283.904112][ T5930] usb 6-1: config 0 descriptor?? [ 283.928726][ T9051] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 284.096882][ T9084] SELinux: Context system_u:object_r:systemd_passwd_var_run_t:s0 is not valid (left unmapped). [ 284.108496][ T30] audit: type=1400 audit(1754672530.321:774): avc: denied { setopt } for pid=9076 comm="syz.4.743" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 284.169297][ T30] audit: type=1400 audit(1754672530.321:775): avc: denied { relabelfrom } for pid=9076 comm="syz.4.743" name="NETLINK" dev="sockfs" ino=21988 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 284.213181][ T9051] fuse: Bad value for 'user_id' [ 284.222126][ T9051] fuse: Bad value for 'user_id' [ 284.261482][ T5902] usb 6-1: USB disconnect, device number 13 [ 284.337224][ T30] audit: type=1400 audit(1754672530.381:776): avc: denied { relabelto } for pid=9076 comm="syz.4.743" name="NETLINK" dev="sockfs" ino=21988 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netlink_netfilter_socket permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 284.482916][ T30] audit: type=1400 audit(1754672530.461:777): avc: denied { remount } for pid=9050 comm="syz.5.734" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 284.665965][ T30] audit: type=1400 audit(1754672530.881:778): avc: denied { ioctl } for pid=9100 comm="syz.2.747" path="socket:[22014]" dev="sockfs" ino=22014 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 285.034759][ T9111] Invalid source name [ 285.038815][ T9111] UBIFS error (pid: 9111): cannot open "./file0", error -22 [ 285.049625][ T9111] binder: 9107:9111 ioctl 40046210 0 returned -14 [ 285.067070][ T30] audit: type=1400 audit(1754672531.261:779): avc: denied { mounton } for pid=9107 comm="syz.5.749" path="/88/file0" dev="tmpfs" ino=482 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 286.485843][ T9137] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 287.015251][ T30] audit: type=1400 audit(1754672532.701:780): avc: denied { read write } for pid=9128 comm="syz.5.755" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 290.677494][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 290.677510][ T30] audit: type=1400 audit(1754672536.901:784): avc: denied { setopt } for pid=9181 comm="syz.4.769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 290.925794][ T9183] usb usb8: usbfs: process 9183 (syz.4.769) did not claim interface 0 before use [ 292.085758][ T9207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.775'. [ 292.129720][ T30] audit: type=1400 audit(1754672538.351:785): avc: denied { accept } for pid=9203 comm="syz.6.778" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 292.149944][ T9209] netlink: 16 bytes leftover after parsing attributes in process `syz.5.777'. [ 292.200746][ T9212] netlink: 4 bytes leftover after parsing attributes in process `syz.4.775'. [ 292.257402][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.5.777'. [ 292.421322][ T5958] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 292.631264][ T5958] usb 7-1: device descriptor read/64, error -71 [ 292.911320][ T5958] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 293.132113][ T5958] usb 7-1: device descriptor read/64, error -71 [ 293.242328][ T5958] usb usb7-port1: attempt power cycle [ 293.951176][ T5958] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 293.971724][ T5958] usb 7-1: device descriptor read/8, error -71 [ 294.659318][ T5958] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 294.696135][ T5958] usb 7-1: device descriptor read/8, error -71 [ 294.811589][ T5958] usb usb7-port1: unable to enumerate USB device [ 295.643914][ T9268] netlink: 16 bytes leftover after parsing attributes in process `syz.2.795'. [ 295.758184][ T9271] netlink: 4 bytes leftover after parsing attributes in process `syz.2.795'. [ 297.082189][ T30] audit: type=1400 audit(1754672543.301:786): avc: denied { load_policy } for pid=9283 comm="syz.1.800" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 297.106922][ T9284] SELinux: failed to load policy [ 297.235909][ T9290] bridge_slave_0: left allmulticast mode [ 297.241775][ T9290] bridge_slave_0: left promiscuous mode [ 297.248057][ T9290] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.258535][ T9290] bridge_slave_1: left allmulticast mode [ 298.267352][ T9290] bridge_slave_1: left promiscuous mode [ 298.273801][ T9290] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.407819][ T9290] bond0: (slave bond_slave_0): Releasing backup interface [ 298.425336][ T9290] bond0: (slave bond_slave_1): Releasing backup interface [ 298.771394][ T9290] team0: Port device team_slave_0 removed [ 298.789080][ T9290] team0: Port device team_slave_1 removed [ 298.810398][ T9290] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 298.818093][ T9290] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 298.827026][ T9290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 298.837992][ T9290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 298.860665][ T9290] bond0: (slave netdevsim0): Releasing backup interface [ 298.905366][ T9291] team0: Mode changed to "loadbalance" [ 298.981518][ T5958] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 299.043127][ T9305] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 299.111285][ T5958] usb 2-1: device descriptor read/64, error -71 [ 299.413074][ T5958] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 299.453995][ T9309] netlink: 16 bytes leftover after parsing attributes in process `syz.2.806'. [ 299.565889][ T9314] netlink: 4 bytes leftover after parsing attributes in process `syz.2.806'. [ 299.596348][ T9315] netlink: 16 bytes leftover after parsing attributes in process `syz.6.807'. [ 299.610313][ T9315] netlink: 4 bytes leftover after parsing attributes in process `syz.6.807'. [ 299.757769][ T5958] usb 2-1: device descriptor read/64, error -71 [ 299.881503][ T5958] usb usb2-port1: attempt power cycle [ 299.966927][ T30] audit: type=1400 audit(1754672546.181:787): avc: denied { getopt } for pid=9321 comm="syz.5.809" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 300.537792][ T9324] bridge1: entered promiscuous mode [ 300.551195][ T5958] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 300.599438][ T5958] usb 2-1: device descriptor read/8, error -71 [ 300.961253][ T5961] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 301.059350][ T5958] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 301.087708][ T5958] usb 2-1: device descriptor read/8, error -71 [ 301.162788][ T5961] usb 7-1: Using ep0 maxpacket: 16 [ 301.169262][ T5961] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 301.180328][ T5961] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 301.198357][ T5961] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 301.215346][ T5961] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 301.225556][ T5961] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.225687][ T5958] usb usb2-port1: unable to enumerate USB device [ 301.259616][ T5961] usb 7-1: config 0 descriptor?? [ 301.708479][ T5961] hid_parser_main: 1 callbacks suppressed [ 301.708499][ T5961] shield 0003:0955:7214.0011: unknown main item tag 0x0 [ 301.735558][ T5961] shield 0003:0955:7214.0011: unknown main item tag 0x0 [ 301.787237][ T5961] shield 0003:0955:7214.0011: unknown main item tag 0x0 [ 301.794530][ T5961] shield 0003:0955:7214.0011: unknown main item tag 0x0 [ 301.814723][ T5961] shield 0003:0955:7214.0011: unknown main item tag 0x0 [ 301.855543][ T5961] input: HID 0955:7214 Haptics as /devices/virtual/input/input17 [ 301.892542][ T9328] netlink: 212340 bytes leftover after parsing attributes in process `syz.6.811'. [ 301.902057][ T9328] openvswitch: netlink: Message has 64 unknown bytes. [ 302.174930][ T9341] Driver unsupported XDP return value 0 on prog (id 169) dev N/A, expect packet loss! [ 302.617815][ T5961] shield 0003:0955:7214.0011: Registered Thunderstrike controller [ 302.636169][ T5961] shield 0003:0955:7214.0011: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.6-1/input0 [ 302.856496][ T9346] FAULT_INJECTION: forcing a failure. [ 302.856496][ T9346] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 302.968063][ T9349] netlink: 20 bytes leftover after parsing attributes in process `syz.1.816'. [ 303.290249][ T9346] CPU: 1 UID: 0 PID: 9346 Comm: syz.4.817 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 303.290271][ T9346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 303.290277][ T9346] Call Trace: [ 303.290281][ T9346] [ 303.290285][ T9346] dump_stack_lvl+0x16c/0x1f0 [ 303.290308][ T9346] should_fail_ex+0x512/0x640 [ 303.290322][ T9346] _copy_from_user+0x2e/0xd0 [ 303.290334][ T9346] move_addr_to_kernel+0x65/0x170 [ 303.290348][ T9346] __copy_msghdr+0x386/0x470 [ 303.290364][ T9346] copy_msghdr_from_user+0xc1/0x160 [ 303.290380][ T9346] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 303.290403][ T9346] ___sys_sendmsg+0xfe/0x1d0 [ 303.290419][ T9346] ? __pfx____sys_sendmsg+0x10/0x10 [ 303.290453][ T9346] ? __mutex_unlock_slowpath+0x100/0x800 [ 303.290474][ T9346] __sys_sendmsg+0x16d/0x220 [ 303.290491][ T9346] ? __pfx___sys_sendmsg+0x10/0x10 [ 303.290515][ T9346] do_syscall_64+0xcd/0x4c0 [ 303.290527][ T9346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.290538][ T9346] RIP: 0033:0x7f346b78ebe9 [ 303.290547][ T9346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 303.290557][ T9346] RSP: 002b:00007f34699ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 303.290567][ T9346] RAX: ffffffffffffffda RBX: 00007f346b9b5fa0 RCX: 00007f346b78ebe9 [ 303.290574][ T9346] RDX: 0000000000000800 RSI: 0000200000000080 RDI: 0000000000000003 [ 303.290580][ T9346] RBP: 00007f34699ee090 R08: 0000000000000000 R09: 0000000000000000 [ 303.290586][ T9346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.290592][ T9346] R13: 00007f346b9b6038 R14: 00007f346b9b5fa0 R15: 00007ffe6fec1c18 [ 303.290605][ T9346] [ 303.702705][ T5964] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 303.716994][ T5964] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 303.797799][ T5964] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 303.824665][ T5964] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 303.840057][ T5902] usb 7-1: reset high-speed USB device number 15 using dummy_hcd [ 304.251436][ T9367] Invalid source name [ 304.255421][ T9367] UBIFS error (pid: 9367): cannot open "usrquota", error -22 [ 304.392738][ T9373] syz_tun: entered promiscuous mode [ 304.407582][ T9373] syz_tun: left promiscuous mode [ 304.415750][ T30] audit: type=1400 audit(1754672550.641:788): avc: denied { append } for pid=9366 comm="syz.5.822" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 304.535784][ T30] audit: type=1400 audit(1754672550.641:789): avc: denied { map } for pid=9366 comm="syz.5.822" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 304.614506][ T30] audit: type=1400 audit(1754672550.641:790): avc: denied { write execute } for pid=9366 comm="syz.5.822" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 304.640474][ T5961] usb 7-1: USB disconnect, device number 15 [ 304.647107][ T24] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 304.673899][ T9379] netlink: 'syz.2.823': attribute type 2 has an invalid length. [ 304.722947][ T5964] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 304.786968][ T9379] netlink: 4 bytes leftover after parsing attributes in process `syz.2.823'. [ 304.831380][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 304.850840][ T24] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 304.861000][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 304.903012][ T5964] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 304.927570][ T5964] usb 6-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 304.939382][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 304.956437][ T5964] usb 6-1: New USB device strings: Mfr=32, Product=0, SerialNumber=9 [ 305.007178][ T5964] usb 6-1: Manufacturer: syz [ 305.016412][ T24] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 305.035290][ T5964] usb 6-1: SerialNumber: syz [ 305.081225][ T5961] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 305.139531][ T24] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 305.149513][ T5964] usb 6-1: config 0 descriptor?? [ 305.155216][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.169100][ T5964] usb 6-1: Found UVC 0.00 device (046d:08c1) [ 305.182806][ T5964] usb 6-1: No valid video chain found. [ 305.261328][ T5961] usb 7-1: device descriptor read/64, error -71 [ 305.426722][ T5853] usb 6-1: USB disconnect, device number 14 [ 305.453416][ T24] usb 2-1: GET_CAPABILITIES returned 0 [ 305.458933][ T24] usbtmc 2-1:16.0: can't read capabilities [ 305.930475][ T5961] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 306.150255][ T5961] usb 7-1: device descriptor read/64, error -71 [ 306.261371][ T5961] usb usb7-port1: attempt power cycle [ 306.403967][ T30] audit: type=1400 audit(1754672552.611:791): avc: denied { bind } for pid=9405 comm="syz.4.830" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 306.604708][ T30] audit: type=1400 audit(1754672552.621:792): avc: denied { listen } for pid=9405 comm="syz.4.830" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 306.651278][ T5961] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 306.909415][ T9422] lo speed is unknown, defaulting to 1000 [ 307.442569][ T5930] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 307.473891][ T5961] usb 7-1: device descriptor read/8, error -71 [ 307.623970][ T5930] usb 6-1: New USB device found, idVendor=057c, idProduct=2200, bcdDevice= 3.90 [ 307.635768][ T5930] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.656714][ T5930] usb 6-1: config 0 descriptor?? [ 307.790712][ T5930] bfusb 6-1:0.0: probe with driver bfusb failed with error -5 [ 307.862667][ T5961] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 308.006834][ T30] audit: type=1400 audit(1754672554.221:793): avc: denied { execute } for pid=9419 comm="syz.5.832" path=2F6D656D66643A01FDAE2E2BA68CB63F32193994532C7C783F55655BBDE1210333BC2723FF179B25F35B642006202864656C6574656429 dev="hugetlbfs" ino=22489 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 308.104982][ T5961] usb 7-1: device not accepting address 19, error -71 [ 308.113452][ T9419] ALSA: mixer_oss: invalid OSS volume '' [ 308.149891][ T5930] usb 6-1: USB disconnect, device number 15 [ 308.152013][ T5961] usb usb7-port1: unable to enumerate USB device [ 308.236915][ T5958] usb 2-1: USB disconnect, device number 23 [ 309.088321][ T9453] netlink: 'syz.4.839': attribute type 72 has an invalid length. [ 309.247466][ T9457] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 309.803066][ T9458] bridge_slave_0: left allmulticast mode [ 309.815398][ T9458] bridge_slave_0: left promiscuous mode [ 309.835818][ T9458] bridge0: port 1(bridge_slave_0) entered disabled state [ 309.879575][ T30] audit: type=1400 audit(1754672556.101:794): avc: denied { unmount } for pid=7984 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 310.541375][ T9458] bridge_slave_1: left allmulticast mode [ 310.569093][ T9458] bridge_slave_1: left promiscuous mode [ 310.576009][ T9458] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.626533][ T9458] bond0: (slave bond_slave_0): Releasing backup interface [ 310.771300][ T5964] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 310.801600][ T9458] bond0: (slave bond_slave_1): Releasing backup interface [ 311.136777][ T5964] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 311.166334][ T5964] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 311.212560][ T9458] team0: Port device team_slave_0 removed [ 311.223550][ T5964] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.248466][ T9458] team0: Port device team_slave_1 removed [ 311.258149][ T5964] usb 7-1: config 0 descriptor?? [ 311.272457][ T9458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 311.279977][ T9458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 311.291645][ T5964] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 311.306818][ T9458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 311.314784][ T9458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 311.342965][ T9468] bond0: (slave bridge0): Releasing backup interface [ 311.385355][ T9468] bridge_slave_0: left allmulticast mode [ 311.392495][ T9468] bridge_slave_0: left promiscuous mode [ 311.401462][ T9468] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.418333][ T9468] bridge_slave_1: left allmulticast mode [ 311.424180][ T9468] bridge_slave_1: left promiscuous mode [ 311.430909][ T9468] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.544779][ T9468] bond0: (slave bond_slave_0): Releasing backup interface [ 311.557177][ T9468] bond0: (slave bond_slave_1): Releasing backup interface [ 311.568650][ T9468] team0: Port device team_slave_0 removed [ 311.579508][ T9468] team0: Port device team_slave_1 removed [ 311.586130][ T9468] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 312.088757][ T9468] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.098039][ T9468] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 312.107340][ T9468] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 312.120759][ T9468] bond1: (slave vlan0): Releasing active interface [ 312.139226][ T9469] team0: Mode changed to "loadbalance" [ 312.155094][ T9455] team0: Mode changed to "loadbalance" [ 312.214501][ T57] lo speed is unknown, defaulting to 1000 [ 312.700224][ T9486] netlink: 28 bytes leftover after parsing attributes in process `syz.4.847'. [ 313.371270][ T5964] usb 7-1: USB disconnect, device number 20 [ 313.459113][ T9492] lo speed is unknown, defaulting to 1000 [ 313.656378][ T9495] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.851'. [ 313.698638][ T9502] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.849'. [ 313.742345][ T9499] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.849'. [ 313.875064][ T9498] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(8) [ 313.881605][ T9498] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 314.044724][ T9498] vhci_hcd vhci_hcd.0: Device attached [ 314.124959][ T9510] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(11) [ 314.131591][ T9510] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 314.235241][ T57] vhci_hcd: vhci_device speed not set [ 314.303515][ T9510] vhci_hcd vhci_hcd.0: Device attached [ 314.309099][ T57] usb 43-1: new full-speed USB device number 3 using vhci_hcd [ 315.757680][ T9511] vhci_hcd: connection closed [ 315.763473][ T7489] vhci_hcd: stop threads [ 315.770662][ T9505] vhci_hcd: connection reset by peer [ 316.036281][ T7489] vhci_hcd: release socket [ 316.055666][ T7489] vhci_hcd: disconnect device [ 316.061577][ T7489] vhci_hcd: stop threads [ 316.065825][ T7489] vhci_hcd: release socket [ 316.137038][ T7489] vhci_hcd: disconnect device [ 316.421722][ T9535] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 316.428262][ T9535] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 316.473357][ T9535] vhci_hcd vhci_hcd.0: Device attached [ 316.601844][ T9546] FAULT_INJECTION: forcing a failure. [ 316.601844][ T9546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 316.715544][ T9546] CPU: 1 UID: 0 PID: 9546 Comm: syz.1.860 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 316.715574][ T9546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 316.715585][ T9546] Call Trace: [ 316.715590][ T9546] [ 316.715598][ T9546] dump_stack_lvl+0x16c/0x1f0 [ 316.715628][ T9546] should_fail_ex+0x512/0x640 [ 316.715648][ T9546] _copy_from_user+0x2e/0xd0 [ 316.715669][ T9546] move_addr_to_kernel+0x65/0x170 [ 316.715692][ T9546] __sys_connect+0xb1/0x160 [ 316.715713][ T9546] ? __pfx___sys_connect+0x10/0x10 [ 316.715744][ T9546] ? __pfx_ksys_write+0x10/0x10 [ 316.715768][ T9546] __x64_sys_connect+0x72/0xb0 [ 316.715789][ T9546] ? lockdep_hardirqs_on+0x7c/0x110 [ 316.715815][ T9546] do_syscall_64+0xcd/0x4c0 [ 316.715833][ T9546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.715851][ T9546] RIP: 0033:0x7fb42418ebe9 [ 316.715864][ T9546] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 316.715881][ T9546] RSP: 002b:00007fb425004038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 316.715898][ T9546] RAX: ffffffffffffffda RBX: 00007fb4243b6180 RCX: 00007fb42418ebe9 [ 316.715909][ T9546] RDX: 0000000000000010 RSI: 0000200000000180 RDI: 0000000000000007 [ 316.715919][ T9546] RBP: 00007fb425004090 R08: 0000000000000000 R09: 0000000000000000 [ 316.715929][ T9546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.715938][ T9546] R13: 00007fb4243b6218 R14: 00007fb4243b6180 R15: 00007fff48650068 [ 316.715962][ T9546] [ 316.741156][ T5930] usb 41-1: new high-speed USB device number 2 using vhci_hcd [ 316.748134][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.750604][ T9536] vhci_hcd: connection reset by peer [ 316.826921][ T5961] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 316.929956][ T7489] vhci_hcd: stop threads [ 316.945290][ T7489] vhci_hcd: release socket [ 316.961299][ T7489] vhci_hcd: disconnect device [ 317.041788][ T5958] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 317.074078][ T5961] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 317.084438][ T5961] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 317.111898][ T5961] usb 5-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 317.132878][ T5961] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 317.154138][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.164315][ T5961] usb 5-1: Product: syz [ 317.170597][ T5961] usb 5-1: Manufacturer: syz [ 317.175314][ T5961] usb 5-1: SerialNumber: syz [ 317.201155][ T5958] usb 7-1: Using ep0 maxpacket: 8 [ 317.212792][ T5958] usb 7-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 317.222036][ T5958] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.241715][ T5958] usb 7-1: config 0 descriptor?? [ 317.262669][ T5958] hso 7-1:0.0: Can't find BULK IN endpoint [ 317.761312][ T30] audit: type=1400 audit(1754672563.811:795): avc: denied { map } for pid=9552 comm="syz.1.863" path="socket:[22697]" dev="sockfs" ino=22697 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 317.803318][ T5961] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 317.815120][ T24] usb 7-1: USB disconnect, device number 21 [ 317.825455][ T5961] cdc_ncm 5-1:1.0: bind() failure [ 317.860669][ T5961] usb 5-1: USB disconnect, device number 14 [ 317.864729][ T9558] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.864'. [ 318.663320][ T30] audit: type=1400 audit(1754672564.881:796): avc: denied { create } for pid=9566 comm="syz.5.866" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 319.864573][ T9575] netlink: 40 bytes leftover after parsing attributes in process `syz.6.870'. [ 319.941720][ T57] vhci_hcd: vhci_device speed not set [ 320.041225][ T24] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 320.121156][ T5964] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 320.249603][ T24] usb 6-1: device descriptor read/64, error -71 [ 320.341529][ T5964] usb 7-1: Using ep0 maxpacket: 8 [ 320.354743][ T5964] usb 7-1: unable to get BOS descriptor or descriptor too short [ 320.363727][ T5964] usb 7-1: config 7 has an invalid interface number: 59 but max is 0 [ 320.374647][ T5964] usb 7-1: config 7 has no interface number 0 [ 320.382913][ T5964] usb 7-1: config 7 interface 59 has no altsetting 0 [ 320.438512][ T5964] usb 7-1: New USB device found, idVendor=0d46, idProduct=0078, bcdDevice=cc.70 [ 320.470559][ T5964] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.478812][ T5964] usb 7-1: Product: syz [ 320.486379][ T5964] usb 7-1: Manufacturer: syz [ 320.491923][ T5964] usb 7-1: SerialNumber: syz [ 320.521380][ T24] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 320.683591][ T24] usb 6-1: device descriptor read/64, error -71 [ 320.755713][ T9596] netlink: 8 bytes leftover after parsing attributes in process `syz.2.876'. [ 320.783074][ T9596] netlink: 12 bytes leftover after parsing attributes in process `syz.2.876'. [ 320.794183][ T24] usb usb6-port1: attempt power cycle [ 320.800489][ T5964] kobil_sct 7-1:7.59: KOBIL USB smart card terminal converter detected [ 320.858865][ T5964] usb 7-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 320.928115][ T9580] syz.1.871 (9580): drop_caches: 2 [ 320.948316][ T5964] usb 7-1: USB disconnect, device number 22 [ 320.998044][ T5964] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 321.071030][ T5964] kobil_sct 7-1:7.59: device disconnected [ 321.082725][ T9599] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.877'. [ 321.100181][ T30] audit: type=1400 audit(1754672567.321:797): avc: denied { setopt } for pid=9600 comm="syz.4.878" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 321.151803][ T24] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 321.192306][ T24] usb 6-1: device descriptor read/8, error -71 [ 321.269311][ T9609] syz.1.882 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 321.270538][ T9610] 9pnet_fd: Insufficient options for proto=fd [ 321.441586][ T24] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 321.482744][ T24] usb 6-1: device descriptor read/8, error -71 [ 321.592839][ T24] usb usb6-port1: unable to enumerate USB device [ 322.231225][ T5930] vhci_hcd: vhci_device speed not set [ 323.133399][ T9631] netlink: 124 bytes leftover after parsing attributes in process `syz.5.888'. [ 323.881940][ T9641] block nbd0: server does not support multiple connections per device. [ 323.920747][ T9641] block nbd0: shutting down sockets [ 324.929668][ T9655] befs: (nbd5): No write support. Marking filesystem read-only [ 324.938360][ T9655] syz.5.896: attempt to access beyond end of device [ 324.938360][ T9655] nbd5: rw=0, sector=0, nr_sectors = 2 limit=0 [ 324.951460][ T9655] befs: (nbd5): unable to read superblock [ 325.392464][ T5964] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 325.682739][ T5964] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 325.694510][ T5964] usb 2-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 325.714265][ T5964] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.727598][ T5964] usb 2-1: config 0 descriptor?? [ 326.160331][ T5964] lenovo 0003:17EF:6047.0012: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.1-1/input0 [ 327.289223][ T30] audit: type=1400 audit(1754672573.511:798): avc: denied { watch } for pid=9682 comm="syz.6.904" path="/67/file1" dev="tmpfs" ino=388 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 327.336128][ T30] audit: type=1400 audit(1754672573.511:799): avc: denied { watch_sb watch_reads } for pid=9682 comm="syz.6.904" path="/67/file1" dev="tmpfs" ino=388 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 327.365887][ T9689] netlink: 24 bytes leftover after parsing attributes in process `syz.6.904'. [ 330.557470][ T976] usb 2-1: USB disconnect, device number 24 [ 330.569970][ T9703] team0: Mode changed to "activebackup" [ 331.091233][ T5903] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 331.361992][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.374924][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.384766][ T5903] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 331.530817][ T9714] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 331.578137][ T9713] process 'syz.5.913' launched '/dev/fd/9' with NULL argv: empty string added [ 331.736649][ T30] audit: type=1400 audit(1754672577.811:800): avc: denied { execute_no_trans } for pid=9710 comm="syz.5.913" path=2F6D656D66643A5B0BDB58AE5B1AA9202864656C6574656429 dev="hugetlbfs" ino=22977 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 331.764177][ T5903] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 331.775946][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.792514][ T5903] usb 5-1: config 0 descriptor?? [ 333.797790][ T5903] usbhid 5-1:0.0: can't add hid device: -71 [ 333.817316][ T5903] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 333.879038][ T9719] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(8) [ 333.885575][ T9719] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 333.893610][ T9719] vhci_hcd vhci_hcd.0: Device attached [ 334.420866][ T30] audit: type=1400 audit(1754672580.171:801): avc: denied { listen } for pid=9715 comm="syz.6.914" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 334.480354][ T5903] usb 5-1: USB disconnect, device number 15 [ 334.627433][ T9721] vhci_hcd: connection closed [ 334.644229][ T7474] vhci_hcd: stop threads [ 334.659947][ T7474] vhci_hcd: release socket [ 334.748588][ T7474] vhci_hcd: disconnect device [ 334.764177][ T30] audit: type=1400 audit(1754672580.991:802): avc: denied { write } for pid=9729 comm="syz.4.917" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 335.558952][ T9748] netlink: 36 bytes leftover after parsing attributes in process `syz.1.919'. [ 335.567881][ T9748] netlink: 16 bytes leftover after parsing attributes in process `syz.1.919'. [ 335.576777][ T9748] netlink: 36 bytes leftover after parsing attributes in process `syz.1.919'. [ 335.585661][ T9748] netlink: 36 bytes leftover after parsing attributes in process `syz.1.919'. [ 336.664798][ T976] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 336.841138][ T976] usb 2-1: Using ep0 maxpacket: 8 [ 336.847749][ T976] usb 2-1: config 162 has an invalid interface number: 142 but max is 1 [ 336.923624][ T976] usb 2-1: config 162 has an invalid descriptor of length 102, skipping remainder of the config [ 336.937497][ T976] usb 2-1: config 162 has 1 interface, different from the descriptor's value: 2 [ 336.947353][ T976] usb 2-1: config 162 has no interface number 0 [ 336.972308][ T976] usb 2-1: config 162 interface 142 altsetting 4 endpoint 0x9 has invalid wMaxPacketSize 0 [ 336.987247][ T976] usb 2-1: config 162 interface 142 altsetting 4 has an endpoint descriptor with address 0x57, changing to 0x7 [ 337.037793][ T976] usb 2-1: config 162 interface 142 altsetting 4 endpoint 0x7 has an invalid bInterval 102, changing to 10 [ 337.079911][ T976] usb 2-1: config 162 interface 142 has no altsetting 0 [ 337.127616][ T976] usb 2-1: Dual-Role OTG device on HNP port [ 337.142995][ T9764] netlink: 16 bytes leftover after parsing attributes in process `syz.2.926'. [ 337.158175][ T976] usb 2-1: New USB device found, idVendor=0557, idProduct=2008, bcdDevice=a7.08 [ 337.176348][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.191587][ T976] usb 2-1: Product: syz [ 337.200725][ T976] usb 2-1: Manufacturer: syz [ 337.200933][ T9769] netlink: 12 bytes leftover after parsing attributes in process `syz.4.928'. [ 337.210951][ T976] usb 2-1: SerialNumber: syz [ 337.247591][ T9769] netlink: 'syz.4.928': attribute type 14 has an invalid length. [ 337.249033][ T30] audit: type=1400 audit(1754672583.471:803): avc: denied { append } for pid=9767 comm="syz.4.928" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 337.285759][ T7474] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 337.295231][ T9769] netlink: 12 bytes leftover after parsing attributes in process `syz.4.928'. [ 337.309600][ T7474] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 337.320287][ T9769] netlink: 'syz.4.928': attribute type 14 has an invalid length. [ 337.326183][ T7474] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 337.340147][ T7474] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 337.421874][ T5903] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 337.561261][ T5930] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 337.581173][ T5903] usb 7-1: Using ep0 maxpacket: 8 [ 337.598976][ T5903] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 337.614081][ T5903] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 337.623268][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.638000][ T5903] usb 7-1: config 0 descriptor?? [ 337.713064][ T5930] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 337.724793][ T5930] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 337.736172][ T5930] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 337.748189][ T5930] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 337.761389][ T5930] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 337.770579][ T5930] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.782332][ T5930] usb 6-1: config 0 descriptor?? [ 337.788187][ T9772] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 338.059406][ T5903] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 338.210450][ T5930] plantronics 0003:047F:FFFF.0013: reserved main item tag 0xd [ 338.225918][ T5930] plantronics 0003:047F:FFFF.0013: hiddev1,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 338.286673][ T24] usb 7-1: USB disconnect, device number 23 [ 338.351188][ T5964] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 338.430559][ T5961] usb 6-1: USB disconnect, device number 20 [ 338.541696][ T976] pl2303 2-1:162.142: required endpoints missing [ 338.555733][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 338.569472][ T976] usb 2-1: USB disconnect, device number 25 [ 338.595529][ T5964] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.618009][ T5964] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 338.628210][ T5964] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.646900][ T5964] usb 5-1: config 0 descriptor?? [ 339.081440][ T5964] ft260 0003:0403:6030.0014: reserved main item tag 0xd [ 339.088433][ T5964] ft260 0003:0403:6030.0014: unexpected long global item [ 339.208465][ T5964] ft260 0003:0403:6030.0014: failed to parse HID [ 339.215064][ T5964] ft260 0003:0403:6030.0014: probe with driver ft260 failed with error -22 [ 339.280736][ T5961] usb 5-1: USB disconnect, device number 16 [ 340.981326][ T5964] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 341.666941][ T5964] usb 2-1: Using ep0 maxpacket: 8 [ 341.699164][ T5964] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 341.706799][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 341.737815][ T5964] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 341.801949][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 341.813050][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 341.825316][ T5964] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 341.834356][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 341.847080][ T5964] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 341.862115][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 341.883440][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 341.967813][ T5964] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 341.983496][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 341.999165][ T5964] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 342.018014][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 342.035670][ T5964] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 342.053855][ T5964] usb 2-1: string descriptor 0 read error: -22 [ 342.066877][ T5964] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 342.085307][ T5964] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.119958][ T5964] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 342.141181][ T5903] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 342.293956][ T5903] usb 5-1: config 9 has an invalid interface number: 88 but max is 1 [ 342.309354][ T5903] usb 5-1: config 9 contains an unexpected descriptor of type 0x2, skipping [ 342.319696][ T5903] usb 5-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 342.332766][ T5859] ------------[ cut here ]------------ [ 342.338568][ T5859] WARNING: CPU: 0 PID: 5859 at net/bluetooth/hci_conn.c:568 hci_conn_timeout+0x11a/0x210 [ 342.348474][ T5859] Modules linked in: [ 342.352754][ T5859] CPU: 0 UID: 0 PID: 5859 Comm: kworker/u9:6 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 342.364568][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 342.374635][ T5859] Workqueue: hci1 hci_conn_timeout [ 342.379724][ T5859] RIP: 0010:hci_conn_timeout+0x11a/0x210 [ 342.385346][ T5859] Code: 00 e8 fa d3 2f f7 4c 89 f1 4c 89 e2 48 c7 c6 c0 1d fd 8c 48 c7 c7 88 95 a6 90 e8 71 0c 89 fa e9 4d ff ff ff e8 d7 d3 2f f7 90 <0f> 0b 90 e8 ce d3 2f f7 48 8d bb f5 f6 ff ff 48 b8 00 00 00 00 00 [ 342.405043][ T5859] RSP: 0018:ffffc900041efc30 EFLAGS: 00010293 [ 342.411152][ T5859] RAX: 0000000000000000 RBX: ffff88807cfe4948 RCX: ffffffff8a8bbe9f [ 342.419107][ T5859] RDX: ffff88802c808000 RSI: ffffffff8a8bbf49 RDI: 0000000000000005 [ 342.427141][ T5859] RBP: 00000000ffffffff R08: 0000000000000005 R09: 0000000000000000 [ 342.435111][ T5859] R10: 00000000ffffffff R11: 0000000000000000 R12: ffff88807cfe4000 [ 342.443144][ T5859] R13: 0000000000000000 R14: ffffffff90ab3264 R15: ffffc900041efd10 [ 342.451129][ T5859] FS: 0000000000000000(0000) GS:ffff8881246c4000(0000) knlGS:0000000000000000 [ 342.460045][ T5859] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 342.466641][ T5859] CR2: 00002000000011f0 CR3: 000000004bd06000 CR4: 00000000003526f0 [ 342.474610][ T5859] Call Trace: [ 342.477863][ T5859] [ 342.480782][ T5859] process_one_work+0x9cc/0x1b70 [ 342.485752][ T5859] ? __pfx_process_one_work+0x10/0x10 [ 342.491114][ T5859] ? assign_work+0x1a0/0x250 [ 342.495676][ T5859] worker_thread+0x6c8/0xf10 [ 342.500245][ T5859] ? __pfx_worker_thread+0x10/0x10 [ 342.505350][ T5859] kthread+0x3c5/0x780 [ 342.509391][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.513973][ T5859] ? rcu_is_watching+0x12/0xc0 [ 342.518711][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.523295][ T5859] ret_from_fork+0x5d4/0x6f0 [ 342.527869][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.532449][ T5859] ret_from_fork_asm+0x1a/0x30 [ 342.537194][ T5859] [ 342.540188][ T5859] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 342.547449][ T5859] CPU: 0 UID: 0 PID: 5859 Comm: kworker/u9:6 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) [ 342.559216][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 342.569252][ T5859] Workqueue: hci1 hci_conn_timeout [ 342.574349][ T5859] Call Trace: [ 342.577601][ T5859] [ 342.580502][ T5859] dump_stack_lvl+0x3d/0x1f0 [ 342.585074][ T5859] vpanic+0x6e8/0x7a0 [ 342.589031][ T5859] ? __pfx_vpanic+0x10/0x10 [ 342.593521][ T5859] ? hci_conn_timeout+0x11a/0x210 [ 342.598520][ T5859] panic+0xca/0xd0 [ 342.602235][ T5859] ? __pfx_panic+0x10/0x10 [ 342.606633][ T5859] ? check_panic_on_warn+0x1f/0xb0 [ 342.611715][ T5859] check_panic_on_warn+0xab/0xb0 [ 342.616621][ T5859] __warn+0xf6/0x3c0 [ 342.620484][ T5859] ? hci_conn_timeout+0x11a/0x210 [ 342.625503][ T5859] report_bug+0x3c3/0x580 [ 342.629831][ T5859] ? hci_conn_timeout+0x11a/0x210 [ 342.634825][ T5859] handle_bug+0x184/0x210 [ 342.639138][ T5859] exc_invalid_op+0x17/0x50 [ 342.643613][ T5859] asm_exc_invalid_op+0x1a/0x20 [ 342.648436][ T5859] RIP: 0010:hci_conn_timeout+0x11a/0x210 [ 342.654040][ T5859] Code: 00 e8 fa d3 2f f7 4c 89 f1 4c 89 e2 48 c7 c6 c0 1d fd 8c 48 c7 c7 88 95 a6 90 e8 71 0c 89 fa e9 4d ff ff ff e8 d7 d3 2f f7 90 <0f> 0b 90 e8 ce d3 2f f7 48 8d bb f5 f6 ff ff 48 b8 00 00 00 00 00 [ 342.673622][ T5859] RSP: 0018:ffffc900041efc30 EFLAGS: 00010293 [ 342.679673][ T5859] RAX: 0000000000000000 RBX: ffff88807cfe4948 RCX: ffffffff8a8bbe9f [ 342.687630][ T5859] RDX: ffff88802c808000 RSI: ffffffff8a8bbf49 RDI: 0000000000000005 [ 342.695573][ T5859] RBP: 00000000ffffffff R08: 0000000000000005 R09: 0000000000000000 [ 342.703550][ T5859] R10: 00000000ffffffff R11: 0000000000000000 R12: ffff88807cfe4000 [ 342.711500][ T5859] R13: 0000000000000000 R14: ffffffff90ab3264 R15: ffffc900041efd10 [ 342.719477][ T5859] ? hci_conn_timeout+0x6f/0x210 [ 342.724406][ T5859] ? hci_conn_timeout+0x119/0x210 [ 342.729410][ T5859] process_one_work+0x9cc/0x1b70 [ 342.734330][ T5859] ? __pfx_process_one_work+0x10/0x10 [ 342.739678][ T5859] ? assign_work+0x1a0/0x250 [ 342.744247][ T5859] worker_thread+0x6c8/0xf10 [ 342.748817][ T5859] ? __pfx_worker_thread+0x10/0x10 [ 342.753902][ T5859] kthread+0x3c5/0x780 [ 342.757941][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.762501][ T5859] ? rcu_is_watching+0x12/0xc0 [ 342.767239][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.771805][ T5859] ret_from_fork+0x5d4/0x6f0 [ 342.776367][ T5859] ? __pfx_kthread+0x10/0x10 [ 342.780934][ T5859] ret_from_fork_asm+0x1a/0x30 [ 342.785699][ T5859] [ 342.788909][ T5859] Kernel Offset: disabled [ 342.793212][ T5859] Rebooting in 86400 seconds..