last executing test programs: 31.449793131s ago: executing program 4 (id=592): syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x22, 0x71, 0x50, 0x20, 0x66b, 0x2202, 0x1934, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfd, 0x20, 0x0, [{{0x9, 0x4, 0x77, 0x1, 0x0, 0x6, 0xaf, 0x1d, 0x2}}]}}]}}, 0x0) lsetxattr$security_selinux(0x0, 0x0, &(0x7f0000000100)='system_u:object_r:systemd_logger_exec_t:s0\x00', 0x2b, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x2, 0x4}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292", 0xc) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035", 0x47}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000015000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(0x3) recvmsg$unix(r3, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x100) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_newrule={0x30, 0x20, 0x2d2c6d60ea1da725, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000"], 0x5c}}, 0x0) 29.274465021s ago: executing program 4 (id=603): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) bpf$MAP_CREATE(0x0, 0x0, 0x50) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000380)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)="a122be6ca2fd68b89a1a88eef009af6424de76e49024f83d2402fa54e90e5c8cab4dd67b55017a59ad0fa40972ca1535c36722885787b011", 0x38) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x110, &(0x7f0000000200)={0x0, 0xfec9, 0x8, 0x5, 0x3d4}, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) mount$9p_rdma(0x0, &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x800, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4404c) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x62000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000083c0)={{0x0, 0x2, 0x80000001, 0x0, 0xfffefffc}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2}, 0x5}) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001800), 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r8, 0x0, 0x39000, 0x0) splice(r7, 0x0, r4, 0x0, 0xeac1, 0x4) write$binfmt_elf64(r6, &(0x7f0000000100)=ANY=[], 0xfffffe3e) ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000340)=@ethtool_regs={0x7}}) 28.089632568s ago: executing program 4 (id=610): r0 = timerfd_create(0x7, 0x80000) timerfd_settime(r0, 0x3, &(0x7f0000000100)={{0x77359400}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x242580, 0x0) r2 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r1, 0xa, 0x0, r2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0xe2, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000080) socket(0x10, 0x803, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffe, 0x0, 0x2, 0x0) syz_open_dev$usbfs(0x0, 0x72, 0x100) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) accept4(r6, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) 25.634716106s ago: executing program 4 (id=616): r0 = socket$nl_generic(0x10, 0x3, 0x10) mount$afs(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x4, &(0x7f0000000200)={[{@dyn}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) mount$9p_unix(&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x12c5c18, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x2a05004, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x4c, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfe, {0x0, 0x0, 0x0, r3, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x20, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x9, 0x6, 0x10da, 0xa75d, 0x0, 0x10, 0x100}}]}}]}, 0x4c}}, 0x24048084) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_TX_TS(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fbdbdf256a00000008000300", @ANYRES32=r5, @ANYBLOB="0a000600ffffffffff662d96"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40) 25.580334809s ago: executing program 4 (id=617): creat(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) syz_emit_ethernet(0x46, &(0x7f0000000080)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "b33883", 0x10, 0x3a, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[], @ndisc_ra={0xc0}}}}}}, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_io_uring_setup(0xa0, &(0x7f0000000100)={0x0, 0x200089bb, 0x1, 0x5, 0x1c3}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000940)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0xa, 0xc000000, &(0x7f0000000b00)=[{0x0}, {0x0}], 0x2, 0x1e}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 25.222425709s ago: executing program 4 (id=619): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x140, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018000100feffffff0001000000000000000000000000ffffe0000002fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14142500000000000000000000000000000000000000009201000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffafffffffcffffff00000000800000000035000002"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@empty, @empty, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@generic={0xfbfb, "9c6082d1ea320c096405492db068ea9f2ba4727a677d232804b39a4f13de248862fc30eb6fa68bb411cd9185fa80f642b175f6dbd1de382562da42e3f1363ea49cf4fdae3085a6536e232346f757f3868fad72538f7092ede9434e80fc9214de51b92b73b10ed81d"}}}, &(0x7f0000000140)={0x1, 0x3, [0xaec, 0xcb1, 0xc76, 0x9]}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f00000013c0)=0xc7f) recvmmsg(r4, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/88, 0x58}], 0x1}, 0x7}], 0x1, 0x40000021, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000280)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x2400c884}, 0x40000) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') preadv(r6, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x0, 0x0) r7 = syz_usb_connect(0x1, 0x8d6, &(0x7f0000001400)={{0x12, 0x1, 0x300, 0x19, 0xaa, 0x4f, 0x0, 0x1435, 0x826, 0x6fb6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c4, 0x4, 0x9, 0x6, 0xf0, 0x3, [{{0x9, 0x4, 0x37, 0x7, 0x3, 0xb3, 0x26, 0xe8, 0x4, [@hid_hid={0x9, 0x21, 0x9, 0x6}, @uac_as={[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x3, 0x14, 0x5, "6d8e"}, @as_header={0x7, 0x24, 0x1, 0x12, 0xa2, 0x2}]}], [{{0x9, 0x5, 0xa, 0x3, 0x40, 0x1, 0x3, 0x0, [@generic={0xe4, 0x24, "17693c2dfc941fed0d85f58cc31fe615b876d22403553db8adc8b03715c6068813bd425218484391f34a2ee116aad08340b407189e51fa07a236a6b0a9e0ff4d0041a3b44fc3a2ba221d0af9cd63a86b84b9ee13d990d130dda921a59a9f38b7e3dbff2f6e77721ccf3acabd3b30d4b7f7544ee3021a18ce944cb8db086585cd7c05c04be6e2c93185fe38de497920d298cd14482ce23fd6f8bb2e260e7046eeb4f556c423c5f49d86221237b33624f35421bda9fead85275a813a5f6020acde5d82e16e3b1623822e2dbf55ad28d4b0faa7f9b6bb151023c7cebaa9fe5ce952f7e2"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x10, 0x8, 0x8c, 0x7, [@generic={0x5, 0x11, "aae3a6"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x1, 0x0, 0xd, [@generic={0xc2, 0x31, "54a2a71ee201c6fc1646e1dee2c11dd34bb2e74a5916b74c303a7826c41c8271aded44f9b3dbf8d12024da59d0d4686cb55fa94a5d3534f913add012d493cc36c678b6fe99b39242cc94b001a63efef78cb8ee052df903ac02817236e2f25a3b14a741d1d464cf21ec22687fabd0c000066589d1a125062e18a51fd75479ce1d1d606d3e397d3aa45d25c4c7262e20f5f23101fea51f6e00974844fe2785c2e32ba66579e38adac474c3da2490ea4a3a08f77e9cd6caa93a3194fdf2fa520c0c"}]}}]}}, {{0x9, 0x4, 0x8, 0xf9, 0x1, 0x82, 0x14, 0x84, 0x4e, [@hid_hid={0x9, 0x21, 0xad5, 0x98, 0x1, {0x22, 0x95d}}, @generic={0xb2, 0xd, "f71dfb943902141b25111df0c9c4a46b6a4be5a7ba671f6d779798f43bf2687301801740a1690de7824baf78e5435ef58d2a2d01fdef9d179cd50888172a71f547fbe5dfa61a661defbb7e242c31ce4eb273eda6db5e08279b9a554a84bb0917e1f6243516c39217500e823740bf07a47ff30a4f382723e0c3f1a83c564bf62098068a44092c614d0f792b84bf539cab31f7360cc2c7c472f3b18500f85f9cadb0ef577498ef82035602d8ec477fe400"}], [{{0x9, 0x5, 0x2, 0x2, 0x8, 0xe, 0xd0, 0x6, [@generic={0x50, 0x23, "016b98fbc19b340c6d5abf213a0fbf5129359aa804b4a7898a29d78a6cdda62fb89ea7d6e956273401c5554e8c64e5c91304eab41e88cc4aa8e70741c363f3ac12780f6414d30d1a00d4f874689f"}]}}]}}, {{0x9, 0x4, 0x8, 0x6, 0x2, 0xfa, 0x71, 0xa8, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0xfeff, 0x7}, [@extension_unit={0xa, 0x24, 0x8, 0x2, 0x5, 0xf0, "646d18"}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x100, 0x3, 0x4, 0x9}, @mixer_unit={0x8, 0x24, 0x4, 0x1, 0x4, "50fed2"}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x100, 0x3, 0x9, 0x80e8, 0xf, 0x6}, @mixer_unit={0x7, 0x24, 0x4, 0x1, 0x9, "61c8"}, @extension_unit={0xa, 0x24, 0x8, 0x6, 0x9, 0xa, "aeeccf"}]}, @uac_as={[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x0, 0x3, 0x6, 0x0, "2a8d", "4ca8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0xc3, 0x1}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x3, 0x1, 0x0, 0x81, "", "a3"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xe, 0x4, 0x40, 0x4, 'O', "b052"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0xe7, 0x3, 0xff, 0x8, "1184eaf096"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x538, 0x10, 0x3, "9fe49c3f787d81a7"}]}], [{{0x9, 0x5, 0x80, 0x10, 0x20, 0x7f, 0x7, 0x2, [@generic={0xd9, 0x22, "fc37f29475fdbac10fda456428d3afb7b2e7ce8485cf50e2f02dd10ebb73e52afba8040a0576839824d51cba2c495b143eb7035a8ed0d6f953dfe306f3e5ec17370b4e5589afbbca861e79ff73b53681da3c812217d459eab30ce035be52d4d1e35bbf0ce204e5002fd112e8d43c0d1ff77fbf7b11c9b862ed5b1ed2542699e35659971a464f76688bfda5a6c3f4e0d34092e42b6974c3517dfdc419c40b2231733a197038a6a833b118477c5e1ee04f208c49547ee182fe140c793b4244a2e9319b5438576101441258e264fe6355f528647a17b08682"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x8, 0x9}]}}, {{0x9, 0x5, 0x8, 0x0, 0x8, 0x1, 0x4, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7, 0x7}]}}]}}, {{0x9, 0x4, 0xb0, 0x6, 0x5, 0xd2, 0x3a, 0x31, 0x7, [@hid_hid={0x9, 0x21, 0x7, 0x0, 0x1, {0x22, 0xdb}}, @uac_control={{0xa, 0x24, 0x1, 0x7beb, 0x85}, [@processing_unit={0xc, 0x24, 0x7, 0x4, 0x3, 0x75, "f22007c8b7"}]}], [{{0x9, 0x5, 0x4, 0x2b45f8e491ba0929, 0x218, 0x7, 0x8, 0x81, [@generic={0x5c, 0x9, "f234fdc2ecc2cbc5528abc71056e2710fa752733ec76e8f1e6eebdecee8876b3f18ea2118ec5a756037ecb3d001a062513662eb311039991e85020087ab47fa52a97e1c785807ab23faac83a327779557315b3a016293c66bd60"}]}}, {{0x9, 0x5, 0x0, 0x10, 0x10, 0x2, 0x86, 0x67, [@generic={0xa8, 0x30, "26929e4379a866d96619f5810c75c1b6f957e3d800a564a57daacca8693221dc1248d5c61588e9485980c99a5b62790cc8383b891131cf2c443c28d48ea2b932ea1100dcd52db6b6bf620aabc30d02b68f5f2b3a099a4f02b3116110df04d5113499c5348dd9f06860e94f2a55c81d2bf63319e69d729b6d6bac8018a1d368c54632c23626e4bd23bbce7b6cfc323eaf026b3370782244a602d3acd3455f59db1cdaabe685c1"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x10, 0x5, 0x0, 0x6, [@generic={0xe9, 0xd, "f0eb7f6b6658f01c0aa3cf3da4bb6553ba4524d531aff6c9f653372e78ac395bb0a0d6d0269b044ee84d738b2704f96fa3e126f49039323fbc3926058db89561a393835440791105325008f69da7ce9e8e3de030a5078efb47126bf10a5acbf02a442185ea2e4c6b02d13d656f3be206e9fb587956d6649d49d75b7c75dde61b17d2ce58c0e302de5b3b6a9487e8fe45e9e3214496116366cea348b0fb7ad2ef5beabf3a1bb43a6ed55d2d8e19b85faa5bc63d8df1b11b4b87683677823049cbe5619fde65d67c5a34f85021ad07df6d2d9af195ceada3e6587614a11f09c8ee86838de460c666"}, @generic={0xc8, 0x1, "7a2c1172843f24f9f5a0053e588dfe7c508ec46094f74c781fcdb1c4723129c65a6716cdcde1da81d40e3fa0912967872ba6440196daa0d706c36c7a6a1bee942a419e5dc3bfaf11b84076ef8519ecac507222ac63f5ab4057532367d91690522649f4b48ccff5f9b72fca32d07c1e2181de39061b631d81e46e5dc50c07349731ad8a3216e106658196109a237d8fbd37e3890db129977e914a1421cf6eec4fdf4933bbe6688203fa05eddaae0d304fd7ab02d8a3510bd31a5f258721b1a0df776c05b767a3"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x0, 0xf8, 0x9f, [@generic={0x32, 0x31, "f6dabd962d8fa59d59dcaf5a76b7a24faab959cba297e49dc3649b789bbb58cb82789d5bdb15619cda074124ecd41e24"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x7, 0xc, 0xd, [@generic={0xf2, 0xb, "7af1d5dc39f9b3239d1761f0dc366177e799fdb59338b73d45ed67d3b4d14b26361c8969ad2834d8845ceab3c1774312c95f1ae4bf11045aff07d68ce272dbc6030f38cb59e67737a58b3db8408f47d2845b58b2e5544ecf099bc12876fe6119097e9dea5bd73aca7019ae88044df373cc87fc607a88364b0de47755dccfde158c337eaae0061a2ccb16917b7c9009bb8e8aa296efb9d8e8be83a22f87a98ba35c55e7ae4ef075ff6f3c199c70cf1749de7a4b566fe7ebeaafda8015f420a7794fd33bafbd427dfebe689dca7ca9b4b661d10052fdd371d5c9497183e222f82218a3524df653c98d224ba1553eca7f4b"}]}}]}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x7, 0xa, 0x6, 0x20, 0x3}, 0x42, &(0x7f0000000240)={0x5, 0xf, 0x42, 0x5, [@wireless={0xb, 0x10, 0x1, 0x0, 0x4, 0x3, 0x2, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x9, 0x5, 0x8}, @ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x6, 0xe10f, 0xf, [0xff00, 0x3f0f, 0xffc030]}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x81, 0x1, 0x81, 0xf000, 0xee, [0xc000]}]}, 0x1, [{0xfc, &(0x7f0000000340)=@string={0xfc, 0x3, "ecd9c45de8b065cccba951f2254782d7a2a285e0193ea9f415ba6dc9754d2814538f08bdee14258a26d4b2f18da6781e668932e2d55555b5daa0d5ce86b2df626b2e30e317fcc00eb0a329a5243d97c871294a3bc54c749dddc8945922b538bb3bd69e84142faa3f3178d48646e064d274addba0927aff3ac09b540101df8a2032f55a978fa3fa633215ec1a60550e976b9ab60c9a7de9403b92119d7523d2568247fc13018462aee3b87f2efcad417bdbdbb22662697f20eda7a050d621715f8bafba1cfdf2b61e3d6047423d16035e8cb708546a43085224b0265473f083a3fc1a032f905f565b80c2ef475751fc4a405984430a76304dd895"}}]}) syz_usb_control_io$uac1(r7, &(0x7f00000004c0)={0x14, &(0x7f0000000440)=ANY=[@ANYBLOB="40316f00bce03725c2164814b4fabd3cb3c47f43e258ddd09d054d9c046cb9175b95ceb3b0a445105f650700fc1212aaec75bdb02d83299a9fdb97ed1ed5c64c7f45246cf0b93b75377971b800499db0f90c1c6787ff776554e17f14c62f91e8ff2b48710642f529533e9a94ab2089a99105201008"], &(0x7f0000000680)={0x0, 0x3, 0x67, @string={0x67, 0x3, "332d6097f97cf5d1447e861bb4ff51b4067257e8177b9a07260fe73be14d01ce4f803f57b648266cb81af1f7f1633ab8c4ee9d3bd9b221e5dac521cc245750aa361a3856792c8bb36edf307571b425b8ee674528a64830760e96781df68837a3aa24a18747"}}}, &(0x7f0000000ac0)={0x44, &(0x7f00000008c0)={0x40, 0x2a, 0xc5, "920f00e939f1df3da1d19e010697238d82c5dcf5d30ea2daeac7ea3e28f3808f0d9032d81ed22a222d5bfd00736dc9c9c214f645d8dd6f430d479e49b0b85bd657e97ff312dcd93449c5de91a819cbbad2763f1471526b953db7037efeee7e5f85a31178f1615ed8e811d9f19cacd6b922b74b10ab26af370be3c10810e2d334dc3999c20e242d807878143ba8cc4c5b99b7937aced24a871f1f5bea3bb1311671a187cb2e775b16d6b311e0068a9896c1a989937b949b0995e386501319727400c53bc0ed"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x6a}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0xf5}, &(0x7f0000000740)={0x20, 0x81, 0x2, "7294"}, &(0x7f00000009c0)={0x20, 0x82, 0x2, "9fc0"}, &(0x7f0000000a00)=ANY=[@ANYBLOB="01000000000000"], &(0x7f0000000a40)={0x20, 0x84, 0x4, "dd453a16"}, &(0x7f0000000a80)={0x20, 0x85, 0x3, "b77bbe"}}) 24.869927863s ago: executing program 32 (id=619): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x140, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018000100feffffff0001000000000000000000000000ffffe0000002fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14142500000000000000000000000000000000000000009201000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffafffffffcffffff00000000800000000035000002"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@empty, @empty, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@generic={0xfbfb, "9c6082d1ea320c096405492db068ea9f2ba4727a677d232804b39a4f13de248862fc30eb6fa68bb411cd9185fa80f642b175f6dbd1de382562da42e3f1363ea49cf4fdae3085a6536e232346f757f3868fad72538f7092ede9434e80fc9214de51b92b73b10ed81d"}}}, &(0x7f0000000140)={0x1, 0x3, [0xaec, 0xcb1, 0xc76, 0x9]}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f00000013c0)=0xc7f) recvmmsg(r4, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/88, 0x58}], 0x1}, 0x7}], 0x1, 0x40000021, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000280)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x2400c884}, 0x40000) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') preadv(r6, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x0, 0x0) r7 = syz_usb_connect(0x1, 0x8d6, &(0x7f0000001400)={{0x12, 0x1, 0x300, 0x19, 0xaa, 0x4f, 0x0, 0x1435, 0x826, 0x6fb6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c4, 0x4, 0x9, 0x6, 0xf0, 0x3, [{{0x9, 0x4, 0x37, 0x7, 0x3, 0xb3, 0x26, 0xe8, 0x4, [@hid_hid={0x9, 0x21, 0x9, 0x6}, @uac_as={[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x3, 0x14, 0x5, "6d8e"}, @as_header={0x7, 0x24, 0x1, 0x12, 0xa2, 0x2}]}], [{{0x9, 0x5, 0xa, 0x3, 0x40, 0x1, 0x3, 0x0, [@generic={0xe4, 0x24, "17693c2dfc941fed0d85f58cc31fe615b876d22403553db8adc8b03715c6068813bd425218484391f34a2ee116aad08340b407189e51fa07a236a6b0a9e0ff4d0041a3b44fc3a2ba221d0af9cd63a86b84b9ee13d990d130dda921a59a9f38b7e3dbff2f6e77721ccf3acabd3b30d4b7f7544ee3021a18ce944cb8db086585cd7c05c04be6e2c93185fe38de497920d298cd14482ce23fd6f8bb2e260e7046eeb4f556c423c5f49d86221237b33624f35421bda9fead85275a813a5f6020acde5d82e16e3b1623822e2dbf55ad28d4b0faa7f9b6bb151023c7cebaa9fe5ce952f7e2"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x10, 0x8, 0x8c, 0x7, [@generic={0x5, 0x11, "aae3a6"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x1, 0x0, 0xd, [@generic={0xc2, 0x31, "54a2a71ee201c6fc1646e1dee2c11dd34bb2e74a5916b74c303a7826c41c8271aded44f9b3dbf8d12024da59d0d4686cb55fa94a5d3534f913add012d493cc36c678b6fe99b39242cc94b001a63efef78cb8ee052df903ac02817236e2f25a3b14a741d1d464cf21ec22687fabd0c000066589d1a125062e18a51fd75479ce1d1d606d3e397d3aa45d25c4c7262e20f5f23101fea51f6e00974844fe2785c2e32ba66579e38adac474c3da2490ea4a3a08f77e9cd6caa93a3194fdf2fa520c0c"}]}}]}}, {{0x9, 0x4, 0x8, 0xf9, 0x1, 0x82, 0x14, 0x84, 0x4e, [@hid_hid={0x9, 0x21, 0xad5, 0x98, 0x1, {0x22, 0x95d}}, @generic={0xb2, 0xd, "f71dfb943902141b25111df0c9c4a46b6a4be5a7ba671f6d779798f43bf2687301801740a1690de7824baf78e5435ef58d2a2d01fdef9d179cd50888172a71f547fbe5dfa61a661defbb7e242c31ce4eb273eda6db5e08279b9a554a84bb0917e1f6243516c39217500e823740bf07a47ff30a4f382723e0c3f1a83c564bf62098068a44092c614d0f792b84bf539cab31f7360cc2c7c472f3b18500f85f9cadb0ef577498ef82035602d8ec477fe400"}], [{{0x9, 0x5, 0x2, 0x2, 0x8, 0xe, 0xd0, 0x6, [@generic={0x50, 0x23, "016b98fbc19b340c6d5abf213a0fbf5129359aa804b4a7898a29d78a6cdda62fb89ea7d6e956273401c5554e8c64e5c91304eab41e88cc4aa8e70741c363f3ac12780f6414d30d1a00d4f874689f"}]}}]}}, {{0x9, 0x4, 0x8, 0x6, 0x2, 0xfa, 0x71, 0xa8, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0xfeff, 0x7}, [@extension_unit={0xa, 0x24, 0x8, 0x2, 0x5, 0xf0, "646d18"}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x100, 0x3, 0x4, 0x9}, @mixer_unit={0x8, 0x24, 0x4, 0x1, 0x4, "50fed2"}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x100, 0x3, 0x9, 0x80e8, 0xf, 0x6}, @mixer_unit={0x7, 0x24, 0x4, 0x1, 0x9, "61c8"}, @extension_unit={0xa, 0x24, 0x8, 0x6, 0x9, 0xa, "aeeccf"}]}, @uac_as={[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x0, 0x3, 0x6, 0x0, "2a8d", "4ca8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0xc3, 0x1}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x3, 0x1, 0x0, 0x81, "", "a3"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xe, 0x4, 0x40, 0x4, 'O', "b052"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0xe7, 0x3, 0xff, 0x8, "1184eaf096"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x538, 0x10, 0x3, "9fe49c3f787d81a7"}]}], [{{0x9, 0x5, 0x80, 0x10, 0x20, 0x7f, 0x7, 0x2, [@generic={0xd9, 0x22, "fc37f29475fdbac10fda456428d3afb7b2e7ce8485cf50e2f02dd10ebb73e52afba8040a0576839824d51cba2c495b143eb7035a8ed0d6f953dfe306f3e5ec17370b4e5589afbbca861e79ff73b53681da3c812217d459eab30ce035be52d4d1e35bbf0ce204e5002fd112e8d43c0d1ff77fbf7b11c9b862ed5b1ed2542699e35659971a464f76688bfda5a6c3f4e0d34092e42b6974c3517dfdc419c40b2231733a197038a6a833b118477c5e1ee04f208c49547ee182fe140c793b4244a2e9319b5438576101441258e264fe6355f528647a17b08682"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x8, 0x9}]}}, {{0x9, 0x5, 0x8, 0x0, 0x8, 0x1, 0x4, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7, 0x7}]}}]}}, {{0x9, 0x4, 0xb0, 0x6, 0x5, 0xd2, 0x3a, 0x31, 0x7, [@hid_hid={0x9, 0x21, 0x7, 0x0, 0x1, {0x22, 0xdb}}, @uac_control={{0xa, 0x24, 0x1, 0x7beb, 0x85}, [@processing_unit={0xc, 0x24, 0x7, 0x4, 0x3, 0x75, "f22007c8b7"}]}], [{{0x9, 0x5, 0x4, 0x2b45f8e491ba0929, 0x218, 0x7, 0x8, 0x81, [@generic={0x5c, 0x9, "f234fdc2ecc2cbc5528abc71056e2710fa752733ec76e8f1e6eebdecee8876b3f18ea2118ec5a756037ecb3d001a062513662eb311039991e85020087ab47fa52a97e1c785807ab23faac83a327779557315b3a016293c66bd60"}]}}, {{0x9, 0x5, 0x0, 0x10, 0x10, 0x2, 0x86, 0x67, [@generic={0xa8, 0x30, "26929e4379a866d96619f5810c75c1b6f957e3d800a564a57daacca8693221dc1248d5c61588e9485980c99a5b62790cc8383b891131cf2c443c28d48ea2b932ea1100dcd52db6b6bf620aabc30d02b68f5f2b3a099a4f02b3116110df04d5113499c5348dd9f06860e94f2a55c81d2bf63319e69d729b6d6bac8018a1d368c54632c23626e4bd23bbce7b6cfc323eaf026b3370782244a602d3acd3455f59db1cdaabe685c1"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x10, 0x5, 0x0, 0x6, [@generic={0xe9, 0xd, "f0eb7f6b6658f01c0aa3cf3da4bb6553ba4524d531aff6c9f653372e78ac395bb0a0d6d0269b044ee84d738b2704f96fa3e126f49039323fbc3926058db89561a393835440791105325008f69da7ce9e8e3de030a5078efb47126bf10a5acbf02a442185ea2e4c6b02d13d656f3be206e9fb587956d6649d49d75b7c75dde61b17d2ce58c0e302de5b3b6a9487e8fe45e9e3214496116366cea348b0fb7ad2ef5beabf3a1bb43a6ed55d2d8e19b85faa5bc63d8df1b11b4b87683677823049cbe5619fde65d67c5a34f85021ad07df6d2d9af195ceada3e6587614a11f09c8ee86838de460c666"}, @generic={0xc8, 0x1, "7a2c1172843f24f9f5a0053e588dfe7c508ec46094f74c781fcdb1c4723129c65a6716cdcde1da81d40e3fa0912967872ba6440196daa0d706c36c7a6a1bee942a419e5dc3bfaf11b84076ef8519ecac507222ac63f5ab4057532367d91690522649f4b48ccff5f9b72fca32d07c1e2181de39061b631d81e46e5dc50c07349731ad8a3216e106658196109a237d8fbd37e3890db129977e914a1421cf6eec4fdf4933bbe6688203fa05eddaae0d304fd7ab02d8a3510bd31a5f258721b1a0df776c05b767a3"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x0, 0xf8, 0x9f, [@generic={0x32, 0x31, "f6dabd962d8fa59d59dcaf5a76b7a24faab959cba297e49dc3649b789bbb58cb82789d5bdb15619cda074124ecd41e24"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x7, 0xc, 0xd, [@generic={0xf2, 0xb, "7af1d5dc39f9b3239d1761f0dc366177e799fdb59338b73d45ed67d3b4d14b26361c8969ad2834d8845ceab3c1774312c95f1ae4bf11045aff07d68ce272dbc6030f38cb59e67737a58b3db8408f47d2845b58b2e5544ecf099bc12876fe6119097e9dea5bd73aca7019ae88044df373cc87fc607a88364b0de47755dccfde158c337eaae0061a2ccb16917b7c9009bb8e8aa296efb9d8e8be83a22f87a98ba35c55e7ae4ef075ff6f3c199c70cf1749de7a4b566fe7ebeaafda8015f420a7794fd33bafbd427dfebe689dca7ca9b4b661d10052fdd371d5c9497183e222f82218a3524df653c98d224ba1553eca7f4b"}]}}]}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x7, 0xa, 0x6, 0x20, 0x3}, 0x42, &(0x7f0000000240)={0x5, 0xf, 0x42, 0x5, [@wireless={0xb, 0x10, 0x1, 0x0, 0x4, 0x3, 0x2, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x9, 0x5, 0x8}, @ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x6, 0xe10f, 0xf, [0xff00, 0x3f0f, 0xffc030]}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x81, 0x1, 0x81, 0xf000, 0xee, [0xc000]}]}, 0x1, [{0xfc, &(0x7f0000000340)=@string={0xfc, 0x3, "ecd9c45de8b065cccba951f2254782d7a2a285e0193ea9f415ba6dc9754d2814538f08bdee14258a26d4b2f18da6781e668932e2d55555b5daa0d5ce86b2df626b2e30e317fcc00eb0a329a5243d97c871294a3bc54c749dddc8945922b538bb3bd69e84142faa3f3178d48646e064d274addba0927aff3ac09b540101df8a2032f55a978fa3fa633215ec1a60550e976b9ab60c9a7de9403b92119d7523d2568247fc13018462aee3b87f2efcad417bdbdbb22662697f20eda7a050d621715f8bafba1cfdf2b61e3d6047423d16035e8cb708546a43085224b0265473f083a3fc1a032f905f565b80c2ef475751fc4a405984430a76304dd895"}}]}) syz_usb_control_io$uac1(r7, &(0x7f00000004c0)={0x14, &(0x7f0000000440)=ANY=[@ANYBLOB="40316f00bce03725c2164814b4fabd3cb3c47f43e258ddd09d054d9c046cb9175b95ceb3b0a445105f650700fc1212aaec75bdb02d83299a9fdb97ed1ed5c64c7f45246cf0b93b75377971b800499db0f90c1c6787ff776554e17f14c62f91e8ff2b48710642f529533e9a94ab2089a99105201008"], &(0x7f0000000680)={0x0, 0x3, 0x67, @string={0x67, 0x3, "332d6097f97cf5d1447e861bb4ff51b4067257e8177b9a07260fe73be14d01ce4f803f57b648266cb81af1f7f1633ab8c4ee9d3bd9b221e5dac521cc245750aa361a3856792c8bb36edf307571b425b8ee674528a64830760e96781df68837a3aa24a18747"}}}, &(0x7f0000000ac0)={0x44, &(0x7f00000008c0)={0x40, 0x2a, 0xc5, "920f00e939f1df3da1d19e010697238d82c5dcf5d30ea2daeac7ea3e28f3808f0d9032d81ed22a222d5bfd00736dc9c9c214f645d8dd6f430d479e49b0b85bd657e97ff312dcd93449c5de91a819cbbad2763f1471526b953db7037efeee7e5f85a31178f1615ed8e811d9f19cacd6b922b74b10ab26af370be3c10810e2d334dc3999c20e242d807878143ba8cc4c5b99b7937aced24a871f1f5bea3bb1311671a187cb2e775b16d6b311e0068a9896c1a989937b949b0995e386501319727400c53bc0ed"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x6a}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0xf5}, &(0x7f0000000740)={0x20, 0x81, 0x2, "7294"}, &(0x7f00000009c0)={0x20, 0x82, 0x2, "9fc0"}, &(0x7f0000000a00)=ANY=[@ANYBLOB="01000000000000"], &(0x7f0000000a40)={0x20, 0x84, 0x4, "dd453a16"}, &(0x7f0000000a80)={0x20, 0x85, 0x3, "b77bbe"}}) 11.677784613s ago: executing program 3 (id=658): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(0x0, r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB='D\x00', @ANYRES16=r4, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000101000008000a000100000008001800ac1414aa080019"], 0x44}}, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448ca, 0x0) sched_getscheduler(r0) socket$packet(0x11, 0x3, 0x300) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000340)={0x1d, r6, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001d0001000000000004086aa42d"], 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)=ANY=[@ANYRES64=r1, @ANYRES16=r0], 0x6c}, 0x1, 0x0, 0x0, 0x4042841}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r7, &(0x7f0000000140), 0x4924b68, 0x700000000000000) socket$nl_route(0x10, 0x3, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffffe) 10.490432141s ago: executing program 3 (id=660): syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x22, 0x71, 0x50, 0x20, 0x66b, 0x2202, 0x1934, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfd, 0x20, 0x0, [{{0x9, 0x4, 0x77, 0x1, 0x0, 0x6, 0xaf, 0x1d, 0x2}}]}}]}}, 0x0) lsetxattr$security_selinux(0x0, 0x0, &(0x7f0000000100)='system_u:object_r:systemd_logger_exec_t:s0\x00', 0x2b, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x2, 0x4}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292", 0xc) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be521634", 0xc}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035", 0x47}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000015000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(0x3) recvmsg$unix(r3, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x100) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_newrule={0x30, 0x20, 0x2d2c6d60ea1da725, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000"], 0x5c}}, 0x0) 8.437964945s ago: executing program 1 (id=671): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x140, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018000100feffffff0001000000000000000000000000ffffe0000002fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14142500000000000000000000000000000000000000009201000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffafffffffcffffff00000000800000000035000002"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@empty, @empty, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@generic={0xfbfb, "9c6082d1ea320c096405492db068ea9f2ba4727a677d232804b39a4f13de248862fc30eb6fa68bb411cd9185fa80f642b175f6dbd1de382562da42e3f1363ea49cf4fdae3085a6536e232346f757f3868fad72538f7092ede9434e80fc9214de51b92b73b10ed81d"}}}, &(0x7f0000000140)={0x1, 0x3, [0xaec, 0xcb1, 0xc76, 0x9]}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f00000013c0)=0xc7f) recvmmsg(r4, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/88, 0x58}], 0x1}, 0x7}], 0x1, 0x40000021, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000280)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x2400c884}, 0x40000) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r5, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') r6 = syz_usb_connect(0x1, 0x8d6, &(0x7f0000001400)={{0x12, 0x1, 0x300, 0x19, 0xaa, 0x4f, 0x0, 0x1435, 0x826, 0x6fb6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c4, 0x4, 0x9, 0x6, 0xf0, 0x3, [{{0x9, 0x4, 0x37, 0x7, 0x3, 0xb3, 0x26, 0xe8, 0x4, [@hid_hid={0x9, 0x21, 0x9, 0x6}, @uac_as={[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x3, 0x14, 0x5, "6d8e"}, @as_header={0x7, 0x24, 0x1, 0x12, 0xa2, 0x2}]}], [{{0x9, 0x5, 0xa, 0x3, 0x40, 0x1, 0x3, 0x0, [@generic={0xe4, 0x24, "17693c2dfc941fed0d85f58cc31fe615b876d22403553db8adc8b03715c6068813bd425218484391f34a2ee116aad08340b407189e51fa07a236a6b0a9e0ff4d0041a3b44fc3a2ba221d0af9cd63a86b84b9ee13d990d130dda921a59a9f38b7e3dbff2f6e77721ccf3acabd3b30d4b7f7544ee3021a18ce944cb8db086585cd7c05c04be6e2c93185fe38de497920d298cd14482ce23fd6f8bb2e260e7046eeb4f556c423c5f49d86221237b33624f35421bda9fead85275a813a5f6020acde5d82e16e3b1623822e2dbf55ad28d4b0faa7f9b6bb151023c7cebaa9fe5ce952f7e2"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x10, 0x8, 0x8c, 0x7, [@generic={0x5, 0x11, "aae3a6"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x1, 0x0, 0xd, [@generic={0xc2, 0x31, "54a2a71ee201c6fc1646e1dee2c11dd34bb2e74a5916b74c303a7826c41c8271aded44f9b3dbf8d12024da59d0d4686cb55fa94a5d3534f913add012d493cc36c678b6fe99b39242cc94b001a63efef78cb8ee052df903ac02817236e2f25a3b14a741d1d464cf21ec22687fabd0c000066589d1a125062e18a51fd75479ce1d1d606d3e397d3aa45d25c4c7262e20f5f23101fea51f6e00974844fe2785c2e32ba66579e38adac474c3da2490ea4a3a08f77e9cd6caa93a3194fdf2fa520c0c"}]}}]}}, {{0x9, 0x4, 0x8, 0xf9, 0x1, 0x82, 0x14, 0x84, 0x4e, [@hid_hid={0x9, 0x21, 0xad5, 0x98, 0x1, {0x22, 0x95d}}, @generic={0xb2, 0xd, "f71dfb943902141b25111df0c9c4a46b6a4be5a7ba671f6d779798f43bf2687301801740a1690de7824baf78e5435ef58d2a2d01fdef9d179cd50888172a71f547fbe5dfa61a661defbb7e242c31ce4eb273eda6db5e08279b9a554a84bb0917e1f6243516c39217500e823740bf07a47ff30a4f382723e0c3f1a83c564bf62098068a44092c614d0f792b84bf539cab31f7360cc2c7c472f3b18500f85f9cadb0ef577498ef82035602d8ec477fe400"}], [{{0x9, 0x5, 0x2, 0x2, 0x8, 0xe, 0xd0, 0x6, [@generic={0x50, 0x23, "016b98fbc19b340c6d5abf213a0fbf5129359aa804b4a7898a29d78a6cdda62fb89ea7d6e956273401c5554e8c64e5c91304eab41e88cc4aa8e70741c363f3ac12780f6414d30d1a00d4f874689f"}]}}]}}, {{0x9, 0x4, 0x8, 0x6, 0x2, 0xfa, 0x71, 0xa8, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0xfeff, 0x7}, [@extension_unit={0xa, 0x24, 0x8, 0x2, 0x5, 0xf0, "646d18"}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x100, 0x3, 0x4, 0x9}, @mixer_unit={0x8, 0x24, 0x4, 0x1, 0x4, "50fed2"}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x100, 0x3, 0x9, 0x80e8, 0xf, 0x6}, @mixer_unit={0x7, 0x24, 0x4, 0x1, 0x9, "61c8"}, @extension_unit={0xa, 0x24, 0x8, 0x6, 0x9, 0xa, "aeeccf"}]}, @uac_as={[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x0, 0x3, 0x6, 0x0, "2a8d", "4ca8"}, @as_header={0x7, 0x24, 0x1, 0x0, 0xc3, 0x1}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x3, 0x1, 0x0, 0x81, "", "a3"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xe, 0x4, 0x40, 0x4, 'O', "b052"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0xe7, 0x3, 0xff, 0x8, "1184eaf096"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x538, 0x10, 0x3, "9fe49c3f787d81a7"}]}], [{{0x9, 0x5, 0x80, 0x10, 0x20, 0x7f, 0x7, 0x2, [@generic={0xd9, 0x22, "fc37f29475fdbac10fda456428d3afb7b2e7ce8485cf50e2f02dd10ebb73e52afba8040a0576839824d51cba2c495b143eb7035a8ed0d6f953dfe306f3e5ec17370b4e5589afbbca861e79ff73b53681da3c812217d459eab30ce035be52d4d1e35bbf0ce204e5002fd112e8d43c0d1ff77fbf7b11c9b862ed5b1ed2542699e35659971a464f76688bfda5a6c3f4e0d34092e42b6974c3517dfdc419c40b2231733a197038a6a833b118477c5e1ee04f208c49547ee182fe140c793b4244a2e9319b5438576101441258e264fe6355f528647a17b08682"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x8, 0x9}]}}, {{0x9, 0x5, 0x8, 0x0, 0x8, 0x1, 0x4, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7, 0x7}]}}]}}, {{0x9, 0x4, 0xb0, 0x6, 0x5, 0xd2, 0x3a, 0x31, 0x7, [@hid_hid={0x9, 0x21, 0x7, 0x0, 0x1, {0x22, 0xdb}}, @uac_control={{0xa, 0x24, 0x1, 0x7beb, 0x85}, [@processing_unit={0xc, 0x24, 0x7, 0x4, 0x3, 0x75, "f22007c8b7"}]}], [{{0x9, 0x5, 0x4, 0x2b45f8e491ba0929, 0x218, 0x7, 0x8, 0x81, [@generic={0x5c, 0x9, "f234fdc2ecc2cbc5528abc71056e2710fa752733ec76e8f1e6eebdecee8876b3f18ea2118ec5a756037ecb3d001a062513662eb311039991e85020087ab47fa52a97e1c785807ab23faac83a327779557315b3a016293c66bd60"}]}}, {{0x9, 0x5, 0x0, 0x10, 0x10, 0x2, 0x86, 0x67, [@generic={0xa8, 0x30, "26929e4379a866d96619f5810c75c1b6f957e3d800a564a57daacca8693221dc1248d5c61588e9485980c99a5b62790cc8383b891131cf2c443c28d48ea2b932ea1100dcd52db6b6bf620aabc30d02b68f5f2b3a099a4f02b3116110df04d5113499c5348dd9f06860e94f2a55c81d2bf63319e69d729b6d6bac8018a1d368c54632c23626e4bd23bbce7b6cfc323eaf026b3370782244a602d3acd3455f59db1cdaabe685c1"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x10, 0x5, 0x0, 0x6, [@generic={0xe9, 0xd, "f0eb7f6b6658f01c0aa3cf3da4bb6553ba4524d531aff6c9f653372e78ac395bb0a0d6d0269b044ee84d738b2704f96fa3e126f49039323fbc3926058db89561a393835440791105325008f69da7ce9e8e3de030a5078efb47126bf10a5acbf02a442185ea2e4c6b02d13d656f3be206e9fb587956d6649d49d75b7c75dde61b17d2ce58c0e302de5b3b6a9487e8fe45e9e3214496116366cea348b0fb7ad2ef5beabf3a1bb43a6ed55d2d8e19b85faa5bc63d8df1b11b4b87683677823049cbe5619fde65d67c5a34f85021ad07df6d2d9af195ceada3e6587614a11f09c8ee86838de460c666"}, @generic={0xc8, 0x1, "7a2c1172843f24f9f5a0053e588dfe7c508ec46094f74c781fcdb1c4723129c65a6716cdcde1da81d40e3fa0912967872ba6440196daa0d706c36c7a6a1bee942a419e5dc3bfaf11b84076ef8519ecac507222ac63f5ab4057532367d91690522649f4b48ccff5f9b72fca32d07c1e2181de39061b631d81e46e5dc50c07349731ad8a3216e106658196109a237d8fbd37e3890db129977e914a1421cf6eec4fdf4933bbe6688203fa05eddaae0d304fd7ab02d8a3510bd31a5f258721b1a0df776c05b767a3"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x0, 0xf8, 0x9f, [@generic={0x32, 0x31, "f6dabd962d8fa59d59dcaf5a76b7a24faab959cba297e49dc3649b789bbb58cb82789d5bdb15619cda074124ecd41e24"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x7, 0xc, 0xd, [@generic={0xf2, 0xb, "7af1d5dc39f9b3239d1761f0dc366177e799fdb59338b73d45ed67d3b4d14b26361c8969ad2834d8845ceab3c1774312c95f1ae4bf11045aff07d68ce272dbc6030f38cb59e67737a58b3db8408f47d2845b58b2e5544ecf099bc12876fe6119097e9dea5bd73aca7019ae88044df373cc87fc607a88364b0de47755dccfde158c337eaae0061a2ccb16917b7c9009bb8e8aa296efb9d8e8be83a22f87a98ba35c55e7ae4ef075ff6f3c199c70cf1749de7a4b566fe7ebeaafda8015f420a7794fd33bafbd427dfebe689dca7ca9b4b661d10052fdd371d5c9497183e222f82218a3524df653c98d224ba1553eca7f4b"}]}}]}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x7, 0xa, 0x6, 0x20, 0x3}, 0x42, &(0x7f0000000240)={0x5, 0xf, 0x42, 0x5, [@wireless={0xb, 0x10, 0x1, 0x0, 0x4, 0x3, 0x2, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x9, 0x5, 0x8}, @ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x6, 0xe10f, 0xf, [0xff00, 0x3f0f, 0xffc030]}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x81, 0x1, 0x81, 0xf000, 0xee, [0xc000]}]}, 0x1, [{0xfc, &(0x7f0000000340)=@string={0xfc, 0x3, "ecd9c45de8b065cccba951f2254782d7a2a285e0193ea9f415ba6dc9754d2814538f08bdee14258a26d4b2f18da6781e668932e2d55555b5daa0d5ce86b2df626b2e30e317fcc00eb0a329a5243d97c871294a3bc54c749dddc8945922b538bb3bd69e84142faa3f3178d48646e064d274addba0927aff3ac09b540101df8a2032f55a978fa3fa633215ec1a60550e976b9ab60c9a7de9403b92119d7523d2568247fc13018462aee3b87f2efcad417bdbdbb22662697f20eda7a050d621715f8bafba1cfdf2b61e3d6047423d16035e8cb708546a43085224b0265473f083a3fc1a032f905f565b80c2ef475751fc4a405984430a76304dd895"}}]}) syz_usb_control_io$uac1(r6, &(0x7f00000004c0)={0x14, &(0x7f0000000440)=ANY=[@ANYBLOB="40316f00bce03725c2164814b4fabd3cb3c47f43e258ddd09d054d9c046cb9175b95ceb3b0a445105f650700fc1212aaec75bdb02d83299a9fdb97ed1ed5c64c7f45246cf0b93b75377971b800499db0f90c1c6787ff776554e17f14c62f91e8ff2b48710642f529533e9a94ab2089a99105201008"], &(0x7f0000000680)={0x0, 0x3, 0x67, @string={0x67, 0x3, "332d6097f97cf5d1447e861bb4ff51b4067257e8177b9a07260fe73be14d01ce4f803f57b648266cb81af1f7f1633ab8c4ee9d3bd9b221e5dac521cc245750aa361a3856792c8bb36edf307571b425b8ee674528a64830760e96781df68837a3aa24a18747"}}}, &(0x7f0000000ac0)={0x44, &(0x7f00000008c0)={0x40, 0x2a, 0xc5, "920f00e939f1df3da1d19e010697238d82c5dcf5d30ea2daeac7ea3e28f3808f0d9032d81ed22a222d5bfd00736dc9c9c214f645d8dd6f430d479e49b0b85bd657e97ff312dcd93449c5de91a819cbbad2763f1471526b953db7037efeee7e5f85a31178f1615ed8e811d9f19cacd6b922b74b10ab26af370be3c10810e2d334dc3999c20e242d807878143ba8cc4c5b99b7937aced24a871f1f5bea3bb1311671a187cb2e775b16d6b311e0068a9896c1a989937b949b0995e386501319727400c53bc0ed"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x6a}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0xf5}, &(0x7f0000000740)={0x20, 0x81, 0x2, "7294"}, &(0x7f00000009c0)={0x20, 0x82, 0x2, "9fc0"}, &(0x7f0000000a00)=ANY=[@ANYBLOB="01000000000000"], &(0x7f0000000a40)={0x20, 0x84, 0x4, "dd453a16"}, &(0x7f0000000a80)={0x20, 0x85, 0x3, "b77bbe"}}) 8.365278145s ago: executing program 3 (id=672): ioprio_set$uid(0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe2000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r2 = socket(0x1d, 0x2, 0x6) r3 = socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(r3, 0x89a0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) bind$can_j1939(r2, 0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) fchdir(r4) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000000)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'macvtap0\x00'}}, 0x1e) sendmmsg(r5, &(0x7f00000008c0)=[{{0x0, 0x6000, 0x0}}], 0x34000, 0x0) 8.363878854s ago: executing program 2 (id=673): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000f0", @ANYRES16=r1, @ANYBLOB="0503000000000000f6ff0700000008000300", @ANYRES32=r2], 0x1c}}, 0x24044080) 7.702630985s ago: executing program 2 (id=674): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) bind$unix(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) close(r3) (async) execveat$binfmt(0xffffffffffffff9c, r2, 0x0, 0x0, 0x0) (async) execveat$binfmt(0xffffffffffffff9c, r2, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000080)={@local, @loopback}, 0xc) execveat$binfmt(0xffffffffffffff9c, r2, &(0x7f00000004c0)={[0x0, &(0x7f00000003c0)=')!}\x00']}, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xc) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) (async) r5 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_RESET(r5, 0x80044dff, 0x1000000000000) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) (async) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d00", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 7.314853163s ago: executing program 1 (id=676): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x1, @remote, 0x7}, 0x1c) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x1, 0x4, @remote}, 0x1c) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x40002, 0x0) socket$key(0xf, 0x3, 0x2) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="24000000210001000000000000000000020000000000000000000000050019"], 0x24}}, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) statx(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x2000, 0xffff4a9c0080ffff, &(0x7f0000000240)) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r7 = geteuid() r8 = getgid() setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000140)={0x0, r7, r8}, 0xc) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000001580)={{{@in6=@private1, @in=@local, 0x0, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x10, 0x9}, {}, 0x6, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d2, 0x33}, 0x0, @in=@private=0xa010100, 0x3506, 0x0, 0x2, 0xb7, 0x2, 0xfffffff9}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) r9 = socket$unix(0x1, 0x1, 0x0) bind$unix(r9, &(0x7f0000001780)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) mount$tmpfs(0x0, &(0x7f0000007680)='./file0\x00', &(0x7f00000076c0), 0x10, &(0x7f0000007700)={[{@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37, 0x36, 0x65]}}]}) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5202) 6.906516985s ago: executing program 3 (id=678): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6823, 0x8b}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xa005, 0x10100}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) timerfd_create(0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7fffffff, 0x2, 0x7, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5a, 0xfffffffd, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x4, 0x89d2, 0x8, 0x4c74, 0x167, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x3, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5c1, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x7f, 0x80000000, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x2000c, 0x8, 0x9, 0x9, 0x4a, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x8, 0x5, 0x7fff, 0x0, 0x5, 0x977, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000bf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0xffffff49, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x4, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x2, 0xe7, 0x7, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x1, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d694, 0x5, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2) syz_open_dev$vim2m(&(0x7f0000000240), 0x80000200, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) io_uring_enter(r3, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x30) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r6, 0x0, 0x4ffe6, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r10}, &(0x7f00000006c0), &(0x7f0000000700)=r0}, 0x20) 6.470647634s ago: executing program 2 (id=679): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0xa}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) setresgid(0xee00, 0xee01, 0x0) setfsgid(0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x9002}, 0x4) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x2, 0x4}, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x74, &(0x7f00000009c0)=ANY=[@ANYBLOB, @ANYRESHEX], 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$TCSETA(0xffffffffffffffff, 0x8924, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "4feda26323b172e0"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) r3 = fsopen(&(0x7f0000000040)='pvfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f00000007c0)='\\\\\xe9\x838\x9d<\f\x91\a\xd4$\xae$\x91&6n @\xf4M\xba\xf2<\xd6A\xdb\xd7\xbeY@g\xcc\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa7\x15R\x11\xad\x89\xd1\xb8\xe0h\\.\xa3`fv\xdc\x8b\x18r\x8e\x9ac\x182q\xb8\xca\xb09Blk\x8e\xb1\xc3j\x03\xb7\x00\x00\x00\x00\x00\x00\xfc\xe3\xb8\xc7\x0f\xaaQ\x98F*T\xd5\xcd4g+\xbd\b\xe0R\x9d\x18\x19a:\xa2\xa1\xcb\xd7jx\x94\v1\xb7\xb5\xdb\x9a\b\xf9\xb4\x8c\xab{\x1dU \r\xc1\x19!\x86~\xa9\x01\xda\x020\xe7\xc0\x9b\xf8NtV\xf5\xe7\xb2\xc6\x16A\xa9\xe8\xea\x95?I\xf9}\a\xc66}a)\xb4\xa9C\xc4\xfa\xf9L\x8d}\xf2>\xc5p4\x16\x91G\xe3\x9ef\xe7\xdc9;\x1c|\x1b.q\xb2\xc7\xed\xa8{\xac\x0e\xe5\xb7\x9d\xa4\xa6\xdd\xe4\x16\a\x13+\'\x05i\x7f\xd2\xc0\xd0f&\xbc\xd0M\xe9\x0e\x819\x02\x9b\xe6\xef\xe0\x1fD=A\xdf\x10\xd5]\xcbL|-\xe8\xf4Q\xd1\x0e\x81v]\xb9\xfc\xf0\x89\"\xc2]{\xa7\xe6:\x87\r\xf2-\xd1Z\xbd\xef\xe04\xa2\'\xca\x92\xe1\x91uy\xe1\x1d\xa7\x00\x00\x00\x00\x00\x00\xbeE\a\xd2\x96\xb3_)*\x1c\xf8Z\xbd\xfaI\xe4\x9c\xc93f\xe5\xd8\xdeXh\x9a\xd5\xd9n\x80\x00\x02\xc0 =W\xbcq\x19\x90\xd9\xdb\x87!\xees\xcajZ^\x94\"k\xaeqg\x92\x90\xa3!Z\xb5\xac\x8f\x9e\x8c8\x83 DI\x8c5\x9cwX\xb1_\xb0S\x15\x0f{\x1fa\x92 \xfa\xfa\x16izQ\xeaw\x967V\'\x11=\xac\xd1V*\xfeUt\xf9`\xb1+\xcc\x7f&j\x15T\xe5r\x8a{#\xf3\x8f\x8c/:\xb8\xf7\xad\xdc1\xd1U)\x9e\xa1\xad|\xf3\x83\xe3%\xc0\xbc\x91\xeaZox \xac\xfa}A\xb5\"B\xe6\x7f\xe9\xf0\xfc\xf2\\S\x1c\xc8\xe1\xa5\x8c\x84p]\xa9C\x13D\x1fa\xb8\xb7&(\xe9\xfcqx\xf4\xfe\xec\xd7\x99Fa\xf8\xee\xb1\xc3\xbb\x04PO\x91)G\xa0\x9a\x8e\x89h\xd3lE\x03\x1eJ\xc2\xa8N\xcd\x1a\\o\xb6\xef\xa2q$\xbdu\xa9\xd2', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001aa40)=""/102400, 0x19000) r5 = syz_open_dev$sndctrl(&(0x7f0000000180), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r5, 0xc1105511, &(0x7f0000000280)={{0x8, 0x6, 0x0, 0xfffffffc, 'syz1\x00'}, 0x0, [0x0, 0xb5a, 0x0, 0x0, 0x0, 0x0, 0x226d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x78d9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x400, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x31, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) ioctl$SG_IO(r2, 0x2285, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x40400, 0x0) ioctl$SNDCTL_TMR_SOURCE(r6, 0xc0045406) 4.548538172s ago: executing program 0 (id=681): ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x1000006, 0x4}, 0x0) fanotify_init(0xa00, 0x0) io_uring_enter(0xffffffffffffffff, 0x47f9, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r2, 0x0, 0x7, 0x1}) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000300)='0\x00', 0x2) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f00000003c0), 0x40202, 0x0) sendfile(r4, r4, 0x0, 0x4800000009) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 3.409992384s ago: executing program 3 (id=682): syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x22, 0x71, 0x50, 0x20, 0x66b, 0x2202, 0x1934, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfd, 0x20, 0x0, [{{0x9, 0x4, 0x77, 0x1, 0x0, 0x6, 0xaf, 0x1d, 0x2}}]}}]}}, 0x0) lsetxattr$security_selinux(0x0, 0x0, &(0x7f0000000100)='system_u:object_r:systemd_logger_exec_t:s0\x00', 0x2b, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x2, 0x4}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292", 0xc) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035", 0x47}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000015000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(0x3) recvmsg$unix(r3, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x100) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_newrule={0x30, 0x20, 0x2d2c6d60ea1da725, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000"], 0x5c}}, 0x0) 3.163497022s ago: executing program 0 (id=683): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0x34, 0xd, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008004}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000080)=0x13) 3.159470292s ago: executing program 1 (id=684): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$inet6(0xa, 0x4, 0x100) socket(0x15, 0x5, 0x5) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x4, 0x5f8d, 0x400005}, 0xfffffffc, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r5 = socket$key(0xf, 0x3, 0x2) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xbe) sendmsg$key(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="02090000020000000000000000006ed50d169fd1259a4008814b921f312bdff9490675285f56e698679723b433298a597a017f02c5d6ebed91840ceb992d34"], 0x10}}, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r7, 0x8904, &(0x7f00000000c0)) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCSETSW2(r0, 0x402c542c, 0x0) write(r0, 0x0, 0x0) 3.090264923s ago: executing program 2 (id=685): ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x1000006, 0x4}, 0x0) fanotify_init(0xa00, 0x0) io_uring_enter(0xffffffffffffffff, 0x47f9, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r2, 0x0, 0x7, 0x1}) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000300)='0\x00', 0x2) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f00000003c0), 0x40202, 0x0) sendfile(r4, r4, 0x0, 0x4800000009) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x7f}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 3.024708423s ago: executing program 5 (id=620): ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x1000006, 0x4}, 0x0) fanotify_init(0xa00, 0x0) io_uring_enter(0xffffffffffffffff, 0x47f9, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r2, 0x0, 0x7, 0x1}) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000300)='0\x00', 0x2) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f00000003c0), 0x40202, 0x0) sendfile(r4, r4, 0x0, 0x4800000009) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x7f}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 2.818734817s ago: executing program 0 (id=686): r0 = syz_open_dev$I2C(&(0x7f0000000480), 0x0, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000180)={&(0x7f0000000400)=[{0x0, 0xfff5, 0x1, &(0x7f0000000880)="d4"}], 0x1}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x1}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x58}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) 2.786486613s ago: executing program 0 (id=687): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f0000000440)=ANY=[@ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r0}, 0x18) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000002600)={0x2, {0x2, 0x3f98, 0x0, 0x0, 0x5, 0x2}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000024c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYRES16=r1], 0x48) r6 = socket(0x25, 0x3, 0x25655752) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtclass={0x24, 0x28, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xd}, {0xfff3, 0x1}, {0xe, 0xa}}}, 0x24}}, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000280)=0xc) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000003c0)="057e30aae10df4f97559054b9a301ecfe91b645115e1421774006df60cb393573839b0078ce169ec2fde0afea66b5bbefa9d4f3cd8c2458336ceb1f0efe647d6d7b1cdbd12c9b8e3a822cbd51494bf79a1dbe5c22338ce37ed467a1d3d616564cbb81faa2e935b2697c12efb0ed141fa2eaad4747725c4bf20f8975e402b03eb77d1aa3f10f512397b5037b1b4cd4b7c08c03dc5e52a066e5982969fa044125ae251f46c26e2536cc8b77e8edb251378be4beedfb8dca0d449123f57677ca3da5bdebf91b195f1a5d49d7c292f20f58d490de36d8ee0e8a86bd04c3165549465cbee7891fc747d7def370ce644db894b56bd53af0d0e261bcfa6bf72a684dafc5bcafe07ece74cbd1d5fa32716dd03f7acd4f32d935438c91e033beaf49e3963e13d05e7a8334a858639636799f04a9033193e7d18a2a4b20bcc96811bb5efe476db70a76b7456ac4e71f3e89c00da0c7761c188570c7902bf2fee1be273be8a9f7a2d7508ef2188d3ba1db4fa9d1533d2f2a288cdfe3b0c50908d56ba69e81386e7e979e9d7ff78685ffb8de6baea2451762736a2bbafa11d541790b0564aef9b0b80fa24832090b84341a9fdf712d3296f911020f8021eda8130befaaab01cbe91dfc5768e6ff31ec50dd88596832a9f5fd4f558d367f40e454d3c97ad16a7f30b93629ee2def77b99f8a17c157529b0782fd847a4c75a2302ca96bbdcff660c2cca753e1a8c60dbcfb319a1594565a2e15bb6124316e196e3cafaf1a29eef84a0908d1dc80af7e333c65736699f1254addf2ab582f5c87c4f6ca234d7ca9673dc29444044b95abdaea958274e39aeb163ee2d05bc2ade5c33a0466e14fbdf8aa70ca2964c06ee5bc57b894b0143a7a503cc43574a07958940b029678df44d6c82fa2e6937ea6aeb5b8f33c21628e3b0d623c23c2e5a3546194fea742d90c1d61f343a005b9e58c3e8292b256fd0ecca81cda433f3bb0ed633607f0b635cdd8b4919bfa37c1e99df087d3f8f3ba5dec7930657eb3a4d8febb5234e048881fbfc499fe5eb6a0ce34546f7010ae2291e6731d0798ca451387a123998e68f6f577ba4e556bb9a119011a191a6bbcf55beb1fb0b8252deeed5721b271b964534a04462720c4c03e8ea7f120cfa1be630e7fc680d1f6e067075c72f642babcacf6b00cd3fdb9f3200e4ff8935b17ebe222053c78c3752666088017c2150dd014b9578af6adb15527a483eff5bb623710ca7b37ed49ff7cf1525f296af6f27846524e4aaea7476a2d08dceeca84a1ab11e2767abff12d10deaf63681dcabe9b1fb9ebe207d8e37bcdba9a73a02ebea4e3a072397a88c47795d5e88b2040c9fe3f96f66f8f7d593547c8fc8f4e75a1c20962ecf2dd1e7bddf896f2a6c5f37a8784e2bc5b10cef2feab3b6eee7430908eeadd372248041a09b0c29385cd7a75754d2c429e72bf5fdac34097bbbbb3790f86399c60cb5054fbeb8eb1241608b506beb135091c18110c1d10d9a80f4adb11a6fd3001957cae0b4f8f730cc4fa4a7328e23f390caab014cfeec0ebfd0e14021f47fe330a68680678d23e7ca1ff18e7e242f4c1e3cca51dec73c58b596c2a92267ee76d3657c1e2b34102b09fa4c59c2619148440bf26802c6f858b8eee6d8c697bad2c4d5a0f76c6a4cdd3b8fdc21e447920491ef40578b68a7a5dfda04fa235fac01ad4e824b627137dc48807100e52ec5ae2f3a3fd84d68b824033b4f0ee28a9e72333b4e209ae905d0781e4fe8116e03b1ca5c3b1ea84974cabaa0214ed15bfe01e974491e8a20f9d03ed1b73799b083f3a65e809c3ff3cf126288fc1627409d46f78b5fe8b8ba0b3ddc3ac79aecd6eee2e0cc59826e5798f48f80f0c7f549b3a656e9acbc5e51bdc3becef93533166c1d9ffe4335ec973d3d27ce5987d150f554c4095650528578fe4858b670b0786f23c886612191f89ec57970dbc0e33cd62b57a08fa940b339577fd12d07dec2ac50e9e0b27f0716b3233803153389a95df956637af8d9778e27bce49ab0a832978712a074d3f7516ad512ed0d9b43049b5990c841a7b7146a24c62fb70645b8d85b6c8863d5c6aab03638ffa4e30c8de24383cf320eee735a4fd37262d473076f495da8b2f0f028b8f178c238010738d6afb1dc2e48089e80f6a7658ad3496f1a1f7f78abdcf934c733d22abb0671a0d41b9b33a5faf99d7b82166e27df0f97a7953dcc1fb364478200253757e8311ba61cb4c78a380cdd820553c7296816210f64b34619966f1540a407c8d6e8e30788909de19ede4116d09a14ce26ad59957add80b90602855c0134ba7fe8afd4493f7cd9ced61fda7d0ae02505c046acf68d68ecd9b1507a4d4eba4c2c834777b2c3c5a8b3c06677fe468072dcab48c1ac9deec30265c7f6c5864df89e25bba52715c82e9921db601b3935f5047b8cc07351b9965b1a1f6ef36c1fba89d9d96e332eacc1e8a78e09d7d6ba30845866449ed5264f763735d4e7cc133dba4b296b2dd9331efea01e5b3d05f38055e41c49993d679ef133b9b1af435fd0ac5fad33f571c76d02c40d4e301110b4442aa134364f0456da0cf362b2c27ebd667c0969ae09dad18becba9d6918fb1e741f685735cc7078f0e6328181a83da67516fac31522f9d9fc64a4b769e57e76bfff6f9867fa2fee1e7dddd11128322210e44eeef6db7269dfa1bfbd9099dd6f8219d585c22c20483251447772719a6115ccb690609de352989610a138110c884562b65de3cf63c3ebe9adfeb53c6e4ecc637c98b60161f71952b84c6fc4cea6af0ed533144bde4f8fbab2d3ffe0b2a5d0c55ec9979ea85a25045ad3a84becf0e891b89c1a83178d7368aea4bdfa0ebd46b8e110a2972c8ac96e10ac630e89f8d76bf35b03b5ecd393d1986fc61318e08ef02721e5f2cd2fe098ebcd1bd30a8f87b2a5650b51dd50d0d78ab7fe66490f5827372f1779d3d389e9fa66bd0296f0203af010d8f76783837cdde2555a90be577626a12de47d4da638efd0017750a230485f6ade34a27284d85dd87f9db8a832c571106d8296629418777b4d933fa049f0f4e5958c193e889305074091be14c66a4bf02cdfe1e8d26a5d21fa78c5628a7ee3d7a0c550296b2f0625e2dd18d45f2d45bee6746d4462c92bc3cf50503c7479bd121393821afe1cd7144ea37f4e8e5ee21f739024ad25af9430dee006b76617725556ff8a820b767fa821629819732f086a5fdf2ccb4edae0aceb3d6dea698e798ead905a2eef9065d633b007271e93101a71cbe385f56e32b3a8fb081c5c1ab09b729f89294a0007f13a3b8e93686020d993b812c6f85fe1618db897cd67be6cd5053dc8490bbebee133d140503c4aa51eea0c156523a1d81ae849dbe5a273bfc0de94836f8160ea9f146147fc02dd7b55dca6a2a43692268ee98f51fcd2d3faa76071d9716e877b2a3dcb51a51d5359a2ee705da52b43306f1f3caf33342fc281bc9c58d1ce05ecdeca371e3a788542f8fa999e4d8e10e66f0b6053d7d4cfc6acb815628bc2409b3dec01726121c267b3ee85fd61bbbdda68ae2c13026863e4a54b93d956fe692707a179411c841ca7d2f33a5223181b18b7ba2eebdd7c2a8dec3ac2a317b5fbd996e8598c394ee627308f0e887480a8dcd59b0256b636f4c62566501a733fa74232945ba1d9e2bae347391bf9ae2da4d3af2b262b772421fd3a5cab46862ea6049f5c9c76dd8549ce0e6c31c792b81b6b21f0bcca18bb2fa6a9d4d6e0a837bb119e2e002a69d6ca95a4b2acc463076c2e05731ef0cfaea84387a6baf6737cc14a25f5329ea924090311213344625a69ee382dd4bc72e00e63329956f3e021092585c9affa06a95bd0ef653ae9ff0abed5ee561ada4f83d8ef202d9c0b2225ebe8660cc408859d45e0332f4f78f6a339bce9d12ca2bc5116a8fd4007c485f5c1c41af96c41d96db35411842d7babc05c8b228066dccb9b67f348974363be521e41fa94d2034a0bc1e87360a80606e1e1bfa8e6399601b30bf93ac41129869158bc2b791b50e51519133ab58afd4023d4d721129b1307f054103a47c49e0524ac4df511c3409fa62d8b5c1a897794600f53efdcc987e06bffd77c9fc75fb7221ef29ed2f7e3e8abcb4a1875b85bd5176a6fba9a361d8684876508443bd50e630f4c684002b15930cf81d740b880eed25d22d8de8c00066790df084fea7c5021184a210a6d24f9bc862c4e3eafbb1782fa240ecfa5959d7a681bae84e8a96a5ff45dea4f9e16dd2cff2dccc6cf4042b44b7ad1f55dc1db5998ed40a409c0e67e1e64fab423d2c00fabb8976d9dacf0c82530e356a99f75082f3411adddfe4ab1ad3b55599fa15450dd5feee23591f1ce398e4c5ae8aad71ad26ea189c333c8467d1eaba9589bb8c41bbfe8c0c173e5446bc06b578c1db849fabe5fcd8fe0fca94bdc799b53b897249826037499e8b6213d640724fda1bcc9341ac61fbea02c8f39a53c496902d5c7922f678a273cdf5ffff38ea028ae19dc72f0b0688f2b9b7d5a9c04153c10ff4168cf9f243dea03b336be778f6c79d67a2d0ade82863eaf95d6fc7f745569864f369f4b39177c356c8c393bded485df28622f01251e58f3d39498520ff90e6c670f0dce5b494cb1d78dfad108406dc5857086d386bd42bd03fe716f049407e5e55caa0e73e96c1a4f6d5791ce7195b2ce72de52ed617ecefaeeabfa9350af49d1d91f9a4b97dc0808869b916f34ee242c40fe8c8aee57b6ddb69f9a10636e481dfa059ef001bad7020266f0d74b14edce6c18ffef854768a60885bad798658a6b9d0b438c483ba159346d5ce0771f53ff1ae0bd47d8583bd56237f8da2747ac7eb2a87b6e26c4820d4fe18b76e06bb6e0c0cdf478b4aecd381c2a6ca9f10ec433f0aca63a66d04f70557baf9f2844005351a21664c2430fb0002cd03bcf0b2004068a2567f91a9fbee8c6d948fb35d48527b23e1398ce9f535e2b0b33c2bc31ab737ba4b980f46f5d424e33892c8093f3cd18510a3157afc023f63ad3ba999e950747c78c06ab141a26d74ffc049a6f76c465f9f9f03a8d339a8e61fef26a5239fbc11c01a87800c81efd7b9f28ee2ab2ed88a383f5013bfd6671ea3086121b235a0cc45ccb300c02588895f8d13ec7e00a3aaaa8b0e739f666fd1b13a90b23998704859c9c76108ed7ecdc63770e6ebaa0aeb9208b92ec4e948ac7fc81cc6f305f06c2f2d8c9267463af92e185ff627eed54313fa2ee0bff2cfa8be411982fd19fa88db5ec99f238f88782f8c7a957bef14f79351b63799a4cce160357c068987a5516b04c79644c140850cddc8bd5541fcca9e30826aad864240f434bd1fc67b58e3d664f782e9e46edcb34e2db98a39c23e334e51c71c9fa466470992cc1fbc36c3c8ff4340be67f9b85a74c9114cb9fe5ca4dcbb641ea17a54ba4658aeaa515109e117625a6196dd66d3584d293b468fce63b5a9c4b9461700c74ae955539bfbbe3eccfa7d9c9f737792a9d4b978baa2e92819e88340b73c88c2900b723248b18ae9414cb37a64ef8cb8ca85cda9677d9f1e71a6b70fe3ad17f2d13c1df48d93bfa50fd939a72ea26f9fbeaa6f8af2eec91b04a8fa7dc14fec0f54fcd1c5c848b4432f979f10e661cd2d7f8ff669ce99f9813fc5440fbbeb35f1a5e5115f5ca35dcc270bdbcae07a9ae8e22aabf8178379dee08874ec7840de27815890a88fc9a3bcfa88a33f9baef9af0ae01b2bd34a907f1151cb14bc8b396bc43a60f884f425e4a04348cc645aae68db49980139ddad0fed303e40b124fd654b36c961a56c44cc3686a7529b1f1ee47da3a0f1158542337df15780444790a2ff1b57e062f0db66730c9f98de395f939f44188225211c514447f67fcbf320a34c43ce09ed272bb992db3a35ae2c3c491c36f2de88984129fcea1ffd235aff7bef7fa95d65894db9a5f1b348efcb571a81b3d73ccd07cbef052389001e4d456800e05ca53bcf3485ce05791ff65a9f7913416ae26972f34f51a3270580b81307ce31c98eda06f3b35890ce317e79a16d728cd0bb6a3835667555c0c5138cfa5305a91db1f873b2a75b82ffcb27616ee67777708f7dc2ed9ddbeb38a60f446d3ac88ded25265c25ef38b0755a9d34bab5e669b6501d8c9787aae7eced9945cad3d4d1c32fa68b48a1d773750f814631db3e088c1b5e7ffa854ea1343d94ec1343918d7a1c5a095bb72b00eb3bff210aeec0b8a581a2a13429b83a193f4d447059265b63c4b8f8ea1b9494f65e79844d956c5d80780849dc086506e9eba002e682a1bae1543f8289588c574bb6ca9a2e57b908aaffed23ecf3536abaf96fe08291f3d70773288b4698e972b0187385dfff4cba59175814e75e7e5146205c7f2d2f749583b393f46c448c152d8be50d60ed8d8bdb30fc7925656a0f90b1de967c729980815e5f19ed453fbefcff67832cb90d753410a0b18eb7504600b11b0360c3d3594d48d832160d357afc1f17dc71dccabef7bbcf1fdd55b48cb02135c32650ab07b902f36b48be9376b2dd68343eacfe80d9dab3205a393a4c6ffd405f6db323dea11be4f22ce50df1e0cfec9e9b1e23acb94d66ea787d08f615a7c7288cdf1921a13a85d885e47cf1067d89ebad5b92ce5c9da255f8d74bd2d5b78366f998cc35bf35e45d06128f1c5984fabee7542642bbf6d981b60759d3e7900e5b3d1d7310f90df0c88a600ff2f39932bf7411e61c692c9444dc9ae0dff28c0b94292c430ac4464e83ce8a29b886f45c98b8396667740c5be51e592eac0250d6e479505d36e930ca3a32cb671d58707d25b10e2660cd5e661b08e268c8bf1b3cbceb2d995a2a6fdfe5475cccc965f71baa7c84054e3bb6cbcb7167b06c708cd72ad4301e943dd1b2b2c325f682be3eaae730a8ed8bc3134b28d1ce04543bc66a529744561c42d25e65c7b5cc2a17875ebf35e53aa46e1edec29ff8d046a7e01459d9639c10d1df998cd9a12d7e50b2dc71ee7338cf71beb72d5020dc69eeafc354bf822d65ee0328eb07d04ac0d266fdb53227a158411da5ded254b3c359ee710e0278e1a06f06002538e108450fd6b11949fdc618a29baf34f232aa192230ddb318aa6d59d122257e50713fe73e6c0059399589c382dc901a8c3381139436f7331b69f457bbb38ed54daaa07a52cceb053c32690836c664b73d86261216b8610fc7b4d53dd3e5d9bcb3e25528e132911cac37e7f2618274c733b5ae02f9c27638d9e11988f1dfbb281ffd8cddf8558a481861cbe9d53a4ad8282d3587449cd51759ca397eda122d286e117d01539359870b94c98a3ce383ed1d280bcceb228acf73193e87fd3650e4dfd563cc55bfbc8626a41293cc90ef76e28e2dedaf968602d2997ae1c2752a0febe3a78f3756d40201ae13074091238324422caabe22c66b7866065264261fc2c3e0569493468d1c1c36259aedd5f078a231e72decd70f4de8532f6753287435296f33a096bc1c8b0ebb68c9f783881e45ac54159ec1c2f9e1f5cb48f96729a62d1b4fdaa89ef5de8741bca04e953534dc977e881a61281812af435206378eff173d7929ab4967e511bdc14e6a783ab647a4c257a4fcd6ba38ef32bc48a0064341697e34f7465b3e6240589d854db4d9714e998f2edf3a03986598a52aaf647d938f4a8e07c1c29615803af6cd403d261ad6da3c1c804034b4a4eef3ea1cc8db39d9e171b3f6dd074388577a4eb901c25c8031e4592cea80b6354850657f53b2acd910ec2c5a7db6abb0153e051dadfbcdf047e35591b96b5657ca55d99ef6fb48e07c34321cd20c40b30a646132f8afcb9426fe84a790567fb847076a8762ca29cfb037e0c948edc12122a1160a55d465f5c912406a10dc0d3c1156cd207e9ffe906d267c9c870521934e1c56af460c0ad0dea9c929acf85768e22bb65eca6e25e4ec8e6edb7a6215e8c7e5fdb56c7131b156ab6a78fc808f8f17a2708ff68b37778c00b3b546004fb2b2c588d8ca8276d281026bfe896698569814410422f27421b8fc5c09d47635f17ddf6b9f56a202a991514678c18a4afabe1eeca6fce1187fffcb6ebdacfc6cac9750766ed40c80e7eceb342a3fa6f86d014949f9d111bfd96e2a39d364f2e2722f2d9ab0577befe26055890161d780e52eff4022461c1d3b019b86af28c4f02fd1f7496d8c141344ad5756bcdc45158f3af7aac227c8853f607cae412db6fa924c039859fe455857bd5fde66cc1b773c12f516401a31c80d750079247c128a103361e7f0a392d21b4b1b594307ff6b37e5a242666209ec517561e04645b92e7cf3cff1a6c76c900d12d9556e2962c535401b1e61fa85e06551ed678703fb3bf8590f2608ae3c278b8d1ac286af38061afbbc3cb27ee7adc6ad299151cd00a84506e6a97648ff99f2a9d35d8421e71589437406fa8e6def8ce34c9abe5de3481c492887176d4485dac794b84567d5ebaf68d0007cb2256a0f1ce4318f6891f750fa9696fed3525059688cf973e70d688b1759cd0f3dfb0b2a7078174b978767cbdbfc3f7d5850e2f7772e2bd6e3ed69ef13cc141238b5ee04b6615e33c42fcd6cf979a0ac848458b713b9a988c1e3fc32f2a182fc0cab2e6933e9aa5c2d77db8c6a1802b43bd8220ff0ca92229fc26a44761d00eeebec834e5f7d382b4f58a2759c56e53b163dae034ffa1970acc57165746e575470e13c4044f392ae4bea93e7d666256436507bb987a247785301274d4f262f94989cdc94b209b7499bd0cb4437525b72be79c87c6076533e4a14799a60bd3563d46ee4767108bed7e637cfed6f3139637bb01f36385dc5873eed726fbec9a87da294cc11db8b49fe45b798ae74e1a8cb0f2907eb0178d2baf5f0f88f654baab9f147741945c496ddea1cfed65a82e913a131c4ac7bb6f0d8d5d28225dab8a33c6e60c0d2b2d5dbd8c35089f13f9a2ae81ec9addaefea9b8ddabc8cdeb6437381ce346db6e14d9d1e8bb4662b508d61da77fc8d9ebebceb1c23be5d0a7bba4a48c0591333ab7779bae78ff23c4bbf8a8cf30f3120a5b63a047064d7ed7d37191cf39b6d1e8ffe3b47379767bd691cb855a9c938e9a0235a5ec9c316a6dceca63fa5fe6df0b9f0d6b38add216aaf2726d3377ab827b00b4cbf490708a0f679b8cd7caadb3dee40cc98f778917d6a6263fcc0747bf75fd676d84abb7d10087da323f95c2571139fd4c9826ad5db6ee4c246b9da20592cae11f9264bd2945aa1a427b2acefb514a2daafbbae35ff761eb1e3b98b4a1dfca348b8c4ff96325a618d677180ceb7e916654ecc2deecb4e61d01080f44b98776b1b43aebeffe2c14006dd1d78c8babf1179f42fd20d87654d3246d41e9dc633eac1741be44f8d751d8c9fd57316fe06d60872939b7a2906bb27a299a3408a51d74e5d98417f05f85fc1b332e103e79203e9fe344dc1d1572de39d914c5270c839870d2b33da5a6efc08c4f0c8227cc35a7f77c6a55f80ceef90e217c80e5ecb4c236685f5219787b01612cfbac90794e8269c07fb7ca4f7dba4defb2aae2b37f7b1696e78de15dbb1b6d4ee0cc4c0fae274b2c2de9343862de1d9847515ad235b1837daa9b814f19e895ae3966ed262e3e7add9f19009e6b61462917b29502b67e124c43538a6bcab7296529e01bb26ab8b3ef094ed057383c4f92790b6f705ae9d943c4e8dad84f6ef82b54d062713c16960fb475d74d46a1b16062563da3391cc6ff5185162c31ff7339e4837e38adab8ab911abaaa006e313dd19a1f92b4f7bede4525b154e1b9f796136a85f3602da011ae2232be902347e08ce0bbf3d23d91c4aac11c8824caafa1d1ff0343ce655802c1915f3ae7c0c670b18e56e139be66a33613afcb3b1928613b3afba9d635070af678216d57023d1911f0eb7ebddefc96f0efd8e9dc10e8a87a68393e19733ef900c6264722940750ae16f664e445414e85e98570303c6d87d7f265cfae0a1e9314fc14674c2871c0d59bbe2eddaf9330a4e2a28673af73910d6cb90790f800e89d55a2930910a8430ade9551819d83d5ea6da4e58326b7ce555d01da86ea78200f0219ec92473da95cd5a632c525ca9fbcddebb8168881cdb2f5da787d0e31881e2b17d78184f3a0bed8662486d3937dab275d050b9dd5a2ce904208a91a467afc33e10fb6c1ca788a5ef30d6e8b615ec0ae1503fea7006569559b7b155c31b196b85881c5671173c06fc5373e9fd973e7111ed45874609bf3c88c6db732210a3ea04cb68662bbc2048bb55d811482af5c658e29bd18c57ffa25e88d7297cd20d4c2b13007cfae89f4dcd90177a0806a2ceb2095333b58f828c093b9bf63cd07e3d56a446fd12e755fd651211bc160948836939c17623b317b9e935307044bab2c11879a62288e7ecbbb97f10f52516f517b7b8e44cff5964fdfaf8044065056b48db13b1365004c336afa3535af1242c9b7271b8b1ba2213fcbb80926bcd394815cd7c27e3aeb2348dc45f5e06e32f5bd56d1c472f41b564ec0939cd012028412883cc098d086fd43858747b746be72b979d175f6a6447fc5908616dec7fc6c962e12e96e09bd068acd2fcf0ce1cc26d9f82b2b91bc9aafcbf8435011f73b6a8ea1bb2f3289b23236136b31656600762feff53e607df8cf3c9a7f257b212630c19f142e4cf5094250b629cabb145c77f1f14ad60ab7617078f810a766cfa341fb7c16086609bc0a768fb1cd782606f32b83a0a55d883269a05b80275612dc571cb993ea9e447b4d32570d412203ab4c8b050b63bb5ac0f8d6f4e9a1644e4b622587b2ae125c2093bd363493d58544d6303a0de17780fcd83e993aa83f4432274eee1e6333fcdc77bcfdea95b8b9ed787723e35b71f1dbe89ff1e3e6fde146c05b6fe9eae52b472624e412253a63e7fcf1b77dbff7509eec5a55501e222f66bd84d36663cd244fa1556bd34b4c9957a93a71e63961ffc7700c5545acdd3e79da41e1cfaca0956d4978222cda23a574d691dbb6c6bd083c70c2782c045bbbe0fcaa10efbc002af6832e3fa7dda0ec8ff6ded69302d55d5a62a7ec213f16ecc5e3304a83103d1c2b21e04e3f5f3730339a630a407e8cc6a5afd2f2ed78ff992035a3783a2708195a46e565a9113be8c228ccaae3510363b475732ad48fe8ff34801f4c35132359d4c5c5bff65141f4a8684d462cf5d97b44496440fff3f7a28d28bbaa8e6db2a6064cbe9fca4679afe8ca6dd27a25c56f3e58165040f19a0455199a0ece4583f060979427f2f3495f40a83bc6ee3eaadab18705d464662b8aba9c7aa2f29114f7acc247548a85bd44723064abeee18f7f558f6d0d74fa08103dd906124454745d23005c425b260b0034372123b642a0cbebbc1a0bcf0cfc3639876eceac5f9734057ff659cfd35b1a3eaa768b86d66244aabc23a45676a59d492614f1c0011c9253e53fc7bb3e20d303afdb5b6614dcc7bbf72a339e414672aac23c2e2983083f08dbc34e3452def00f402598b6aaa4f0d896d1648b1442621993b7d0c930560cb6152b9ce59f94356726816a224fca84da5dbde6675d20f546a3e4635e82ff9575cac9160e6819f", 0x2000, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002540)="ae6c99d9eb0ac3b0f78eb0a91d3c8ca135c0c30bbc6933c31348a80eb094e8220bc072e34ac14d86e97878a7b6c0fbc5a0ea05894a899e97247dcc105cebeb751c7743fb27239a86544d63c8fb670f2a7c9886292569c54853553cb8ffd88f40e3491f6bc0dec7e639d76172bcef16ba86707f99f95a74f80047e714292c0300a983", &(0x7f0000002480), 0xce4, r5}, 0x38) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002400)="91dca6c9e742da0c454b03007bcf8a23398bd8566e49797b2d456743ae000000000000000000009000000000000000dc5e3db38be0c13aaf7fdf2c79168ebba771bfc83a3e59890d654eb004327145e6c63db7734ccb53e7d8d7ca9bc41c2b32071433fb639dc87894b4edebf7d39428aa5dbaf9c52545cf0d707275502634f8bce834bc624bbb9fd40d14a63fe97c30bcf8b4a922ae3a2265dba3b87759a4cb8c124cd71452d1174549bf21f5e988", 0x0, 0xdd, r5, 0x0, 0x100000000000000}, 0xffffffffffffff72) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000023c0)=ANY=[@ANYRESHEX=r6], 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x0) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000aeb000/0x1000)=nil, 0x1000, 0xb635773f06ebbee7, 0x30, r3, 0x45117000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) 1.558485916s ago: executing program 0 (id=688): r0 = gettid() r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000280)={0xc, 0x3, 0xfa00, {0x0}}, 0x10) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) syz_open_procfs(0x0, 0x0) 1.258157073s ago: executing program 1 (id=689): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@private0, 0x0, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000380)={@private0, 0x40000800, 0x0, 0x3, 0x1, 0x200, 0x100}, 0x20) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4000005, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbc0, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x8, 0x4007f, 0xffffffff, 0x6, 0x6], [0x10000, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0xf, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x5, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x7d, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000001140)={0x0, 0x0, @pic={0x5, 0xc0, 0xb, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7c}}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x814, &(0x7f0000000180)={0xa, 0x4e21, 0x1, @mcast1, 0x9}, 0x1c) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1.182390799s ago: executing program 2 (id=690): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) syz_open_dev$swradio(0x0, 0x1, 0x2) syz_open_dev$media(0x0, 0x1, 0x0) (async) close(0x3) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffe5b}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) (async) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x34, r4, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8001}, @BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x38000000}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) syz_usb_connect(0x0, 0x51, &(0x7f0000001c80)={{0x12, 0x1, 0x201, 0x97, 0xa8, 0x38, 0x10, 0x1199, 0x27, 0xf6bc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3f, 0x1, 0x8, 0x1, 0x80, 0x1, [{{0x9, 0x4, 0x5d, 0x3, 0x5, 0x45, 0x14, 0x56, 0x3, [], [{{0x9, 0x5, 0xd, 0x2, 0x40, 0x6, 0x2a}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x40, 0x9, 0x1}}, {{0x9, 0x5, 0x7, 0x0, 0x20, 0xb, 0x5, 0x3}}, {{0x9, 0x5, 0xa, 0x10, 0x435a9cf35a47c8ad, 0xf7, 0x0, 0x3}}, {{0x9, 0x5, 0x9, 0x8, 0x40, 0xc, 0x2, 0x4}}]}}]}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x8, &(0x7f00000002c0)=@framed={{}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x5, 0x1, 0x25}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) (async) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) 946.728439ms ago: executing program 1 (id=691): socket$nl_generic(0x10, 0x3, 0x10) close(0x3) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() socket$can_bcm(0x1d, 0x2, 0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'gre0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x8000, 0x0, 0x5, 0x97, {{0x11, 0x4, 0x1, 0x5, 0x44, 0x65, 0x0, 0x3, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, {[@ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x2c, 0xed, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@broadcast, 0x9}, {@loopback, 0x3}, {@multicast2, 0x17bc388a}, {@remote, 0x7a8e}]}]}}}}}) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x3a, r6, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2, 0x4}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0xa1b, 0x4}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0xffe0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r7, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000440)={r8, 0x0, 0x0, 0x0, 0x0, [], [], [0x0, 0x0, 0x0, 0xffffffff]}) socket(0x10, 0x3, 0x0) 337.775441ms ago: executing program 2 (id=692): ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x1000006, 0x4}, 0x0) fanotify_init(0xa00, 0x0) io_uring_enter(0xffffffffffffffff, 0x47f9, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000, 0x2, &(0x7f0000ffc000/0x3000)=nil) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r2, 0x0, 0x7, 0x1}) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000300)='0\x00', 0x2) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f00000003c0), 0x40202, 0x0) sendfile(r4, r4, 0x0, 0x4800000009) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 274.527695ms ago: executing program 0 (id=693): connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="cf0400000000000000dd13000000080003080000000000000015710faac87bc77f9103fde1cfbebbd503f0293b4e08e1d71e4853fa0bee313bb0409aa2d8", @ANYRES32=r2, @ANYBLOB="040013000a000600ffffffffffff00000600120000000000"], 0x34}}, 0x0) syz_pidfd_open(0x0, 0x0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'pcl726\x00', [0x4, 0x0, 0xc139, 0x4, 0x5, 0xafa0, 0x0, 0x4, 0x4, 0xfd, 0x5, 0x1, 0x1, 0x9, 0x10, 0x101, 0x5, 0xffff, 0x3, 0x40000003, 0x85, 0x40caa3, 0x1000, 0x20001e5b, 0x8000047, 0xe69, 0x3, 0x8, 0x4086, 0x0, 0xfffffff8]}) prlimit64(0x0, 0x8, &(0x7f0000000140)={0xfffffffffffffffe, 0x84}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r4, 0x0) setpgid(0x0, r4) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x10000, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) recvmsg$can_j1939(r5, &(0x7f0000000180)={&(0x7f0000000240)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/73, 0x49}], 0x1, &(0x7f0000000440)=""/216, 0xd8}, 0x0) recvmmsg$unix(r5, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route(r5, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) 46.199923ms ago: executing program 1 (id=694): socket(0x15, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000240)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x5}, 0xa) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000000)) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000540), 0x6700, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000180)=0x7a, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendto$inet(r3, &(0x7f0000000300)="0906c422e0243219ff7b440e76a1b51b82ba23599f81b52c9d4db4486cec105e4b9f0f859f8a43eef6352f1e46e3145089b6a22f618ca14e288029b613a329c422481c6b7aff6806bce699cea461ecf591d9018b2a1d84e389a8d3127fd35913fe69754435c2", 0xffffffffffffffbb, 0x40040011, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x22d00, 0x0) 21.253913ms ago: executing program 3 (id=695): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x16, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000ffffffff0000000000000000180300002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000070000000850000001100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89b, 0xc000, 0x7, 0x20002f3}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) syz_emit_ethernet(0x6a, &(0x7f00000000c0)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x4, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0xb, 0x0, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102]}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x1c, 0x0, 0x3, 0x0, [{@private=0xa010101}, {@private}, {@dev={0xac, 0x14, 0x14, 0x2}}]}]}}}}}}}, 0x0) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ff5000/0x3000)=nil) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r1, 0x0, 0xe, 0x0, &(0x7f0000000640)="0cffffdf71c8afefeba000dee560", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r1, 0xf50f, 0x0) unshare(0x20040600) preadv(r0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 5 (id=696): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket$inet_icmp_raw(0x2, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x101}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x3f, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0004000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41c", 0x25}], 0x2) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r5 = socket(0x2a, 0x2, 0x0) sendto$isdn(r5, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x22, 0xff, 0x4, 0xd, 0x81}, 0x6) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) sendmsg$AUDIT_SET(r5, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x3e9, 0x10, 0x70bd2a, 0x25dfdbfb, {0x36, 0x1, 0x0, r6, 0xffffff16, 0x4, 0x9, 0x10001, 0x0, 0x10, 0x2ee}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80408c0}, 0x20000040) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x1, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 10 [ 161.340163][ T8223] ? __hrtimer_setup+0x66/0x280 [ 161.340184][ T8223] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 161.340206][ T8223] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 161.340227][ T8223] ? __hrtimer_setup+0x176/0x280 [ 161.340249][ T8223] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 161.340291][ T8223] ? trace_kmalloc+0x2b/0xd0 [ 161.340313][ T8223] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 161.340335][ T8223] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 161.340362][ T8223] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 161.340391][ T8223] ? __asan_memcpy+0x3c/0x60 [ 161.340423][ T8223] hwsim_new_radio_nl+0xb51/0x12c0 [ 161.340455][ T8223] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 161.340491][ T8223] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 161.340520][ T8223] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 161.340554][ T8223] genl_family_rcv_msg_doit+0x209/0x2f0 [ 161.340584][ T8223] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 161.340621][ T8223] ? bpf_lsm_capable+0x9/0x10 [ 161.340646][ T8223] ? security_capable+0x7e/0x260 [ 161.340669][ T8223] ? ns_capable+0xd7/0x110 [ 161.340694][ T8223] genl_rcv_msg+0x55c/0x800 [ 161.340724][ T8223] ? __pfx_genl_rcv_msg+0x10/0x10 [ 161.340753][ T8223] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 161.340791][ T8223] netlink_rcv_skb+0x158/0x420 [ 161.340816][ T8223] ? __pfx_genl_rcv_msg+0x10/0x10 [ 161.340852][ T8223] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 161.340896][ T8223] genl_rcv+0x28/0x40 [ 161.340922][ T8223] netlink_unicast+0x5a7/0x870 [ 161.340953][ T8223] ? __pfx_netlink_unicast+0x10/0x10 [ 161.340979][ T8223] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 161.341014][ T8223] netlink_sendmsg+0x8d1/0xdd0 [ 161.341045][ T8223] ? __pfx_netlink_sendmsg+0x10/0x10 [ 161.341080][ T8223] ____sys_sendmsg+0xa95/0xc70 [ 161.341108][ T8223] ? copy_msghdr_from_user+0x10a/0x160 [ 161.341132][ T8223] ? __pfx_____sys_sendmsg+0x10/0x10 [ 161.341173][ T8223] ___sys_sendmsg+0x134/0x1d0 [ 161.341196][ T8223] ? __pfx____sys_sendmsg+0x10/0x10 [ 161.341253][ T8223] __sys_sendmsg+0x16d/0x220 [ 161.341275][ T8223] ? __pfx___sys_sendmsg+0x10/0x10 [ 161.341306][ T8223] ? __secure_computing+0x28e/0x3b0 [ 161.341334][ T8223] do_syscall_64+0xcd/0x4e0 [ 161.341358][ T8223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.341374][ T8223] RIP: 0033:0x7f68d7b8ec29 [ 161.341388][ T8223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.341402][ T8223] RSP: 002b:00007f68d8a04038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 161.341419][ T8223] RAX: ffffffffffffffda RBX: 00007f68d7dd6180 RCX: 00007f68d7b8ec29 [ 161.341431][ T8223] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 161.341439][ T8223] RBP: 00007f68d7c11e41 R08: 0000000000000000 R09: 0000000000000000 [ 161.341449][ T8223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.341459][ T8223] R13: 00007f68d7dd6218 R14: 00007f68d7dd6180 R15: 00007ffc76485068 [ 161.341483][ T8223] [ 161.735905][ T30] audit: type=1400 audit(1758487181.848:527): avc: denied { ioctl } for pid=8220 comm="syz.2.319" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 161.761468][ T30] audit: type=1326 audit(1758487181.878:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.785111][ T30] audit: type=1326 audit(1758487181.878:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.808609][ T30] audit: type=1326 audit(1758487181.878:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.832141][ T30] audit: type=1326 audit(1758487181.878:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.856356][ T30] audit: type=1326 audit(1758487181.878:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.879608][ T30] audit: type=1326 audit(1758487181.888:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.902779][ T30] audit: type=1326 audit(1758487181.888:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 161.926047][ T30] audit: type=1326 audit(1758487181.888:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8205 comm="syz.0.318" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f68d7b8ec29 code=0x7ffc0000 [ 162.536130][ T8240] IPVS: sh: FWM 3 0x00000003 - no destination available [ 164.118007][ T8223] loop6: detected capacity change from 0 to 63 [ 164.341782][ T8264] fuse: Unknown parameter '000000000000000000040xffffffffffffffff' [ 164.740392][ T5845] Buffer I/O error on dev loop6, logical block 0, async page read [ 164.752989][ T5845] Buffer I/O error on dev loop6, logical block 0, async page read [ 164.842546][ T5845] Buffer I/O error on dev loop6, logical block 0, async page read [ 164.852555][ T5845] Buffer I/O error on dev loop6, logical block 0, async page read [ 164.865424][ T5845] Buffer I/O error on dev loop6, logical block 0, async page read [ 164.872037][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 165.043616][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 165.089710][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 165.178796][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 165.198206][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.221872][ T9] usb 4-1: Product: syz [ 165.256571][ T9] usb 4-1: Manufacturer: syz [ 165.286256][ T9] usb 4-1: SerialNumber: syz [ 165.552668][ T8256] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.595720][ T8256] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.643379][ T9] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 165.691315][ T9] usb 4-1: USB disconnect, device number 11 [ 165.720483][ T8289] netlink: 348 bytes leftover after parsing attributes in process `syz.1.331'. [ 166.202033][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 166.430598][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 166.440895][ T9] usb 4-1: config index 0 descriptor too short (expected 301, got 72) [ 166.449562][ T9] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 166.478682][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 166.510968][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 166.540393][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 166.577124][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.602094][ T9] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 166.621289][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.904508][ T9] usb 4-1: usb_control_msg returned -71 [ 166.924630][ T8228] Set syz1 is full, maxelem 65536 reached [ 166.961755][ T9] usbtmc 4-1:16.0: can't read capabilities [ 167.020341][ T9] usb 4-1: USB disconnect, device number 12 [ 167.698746][ T24] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 167.779886][ T5909] IPVS: starting estimator thread 0... [ 167.863698][ T24] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 167.872173][ T8347] IPVS: using max 52 ests per chain, 124800 per kthread [ 167.872234][ T24] usb 4-1: config 0 has no interface number 0 [ 167.872265][ T24] usb 4-1: config 0 interface 119 has no altsetting 0 [ 167.966134][ T24] usb 4-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 167.977028][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.991614][ T24] usb 4-1: Product: syz [ 168.000712][ T24] usb 4-1: Manufacturer: syz [ 168.006283][ T24] usb 4-1: SerialNumber: syz [ 168.031888][ T24] usb 4-1: config 0 descriptor?? [ 168.301756][ T8352] ISOFS: Unable to identify CD-ROM format. [ 168.734533][ T24] kaweth 4-1:0.119: Firmware present in device. [ 168.743509][ T24] kaweth 4-1:0.119: Error reading configuration (-71), no net device created [ 168.753451][ T24] kaweth 4-1:0.119: probe with driver kaweth failed with error -5 [ 168.793621][ T24] pegasus 4-1:0.119: probe with driver pegasus failed with error -71 [ 168.922495][ T24] usb 4-1: USB disconnect, device number 13 [ 170.075074][ T8390] evm: overlay not supported [ 170.092743][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 170.092762][ T30] audit: type=1400 audit(1758487190.658:558): avc: denied { create } for pid=8389 comm="syz.0.350" name="#6" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 170.130644][ T30] audit: type=1400 audit(1758487190.698:559): avc: denied { link } for pid=8389 comm="syz.0.350" name="#6" dev="tmpfs" ino=351 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 170.160971][ T30] audit: type=1400 audit(1758487190.698:560): avc: denied { rename } for pid=8389 comm="syz.0.350" name="#7" dev="tmpfs" ino=351 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 172.892049][ T43] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 172.999370][ T8431] vxcan1 speed is unknown, defaulting to 1000 [ 173.073989][ T43] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 173.082939][ T43] usb 3-1: config 0 has no interface number 0 [ 173.111847][ T43] usb 3-1: config 0 interface 119 has no altsetting 0 [ 173.188881][ T43] usb 3-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 173.211739][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.251984][ T43] usb 3-1: Product: syz [ 173.331866][ T43] usb 3-1: Manufacturer: syz [ 173.395142][ T43] usb 3-1: SerialNumber: syz [ 173.451284][ T43] usb 3-1: config 0 descriptor?? [ 173.964926][ T43] kaweth 3-1:0.119: Firmware present in device. [ 174.056098][ T43] kaweth 3-1:0.119: Error reading configuration (-71), no net device created [ 174.092343][ T43] kaweth 3-1:0.119: probe with driver kaweth failed with error -5 [ 174.106017][ T43] pegasus 3-1:0.119: probe with driver pegasus failed with error -71 [ 174.142050][ T43] usb 3-1: USB disconnect, device number 10 [ 174.603783][ T43] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 174.657922][ T43] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 177.695783][ T8545] vxcan1 speed is unknown, defaulting to 1000 [ 177.707906][ T30] audit: type=1400 audit(1758487198.278:561): avc: denied { append } for pid=8533 comm="syz.4.372" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 177.745669][ T43] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 177.756844][ T43] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 178.919947][ T30] audit: type=1400 audit(1758487199.488:562): avc: denied { setopt } for pid=8580 comm="syz.0.377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 178.939430][ C1] vkms_vblank_simulate: vblank timer overrun [ 178.949518][ T8581] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 180.638352][ T8606] netlink: 'syz.1.383': attribute type 1 has an invalid length. [ 181.000184][ T8606] 8021q: adding VLAN 0 to HW filter on device bond1 [ 181.038517][ T8616] bond1: (slave geneve2): making interface the new active one [ 181.054035][ T8616] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 181.330131][ T8655] fuse: Unknown parameter '000000000000000000060xffffffffffffffff' [ 182.003351][ T8661] IPv6: NLM_F_CREATE should be specified when creating new route [ 182.185765][ T8616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.383'. [ 183.304759][ T8680] netlink: 64 bytes leftover after parsing attributes in process `syz.2.391'. [ 183.333620][ T30] audit: type=1400 audit(1758487203.878:563): avc: denied { create } for pid=8674 comm="syz.4.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 183.717034][ T43] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 183.734067][ T43] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 183.821637][ T8681] SELinux: Context system_u:object_r:userio_device_t:s0 is not valid (left unmapped). [ 183.856181][ T30] audit: type=1400 audit(1758487204.418:564): avc: denied { relabelto } for pid=8670 comm="syz.1.390" name="file1" dev="tmpfs" ino=439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:userio_device_t:s0" [ 183.882621][ C1] vkms_vblank_simulate: vblank timer overrun [ 183.940792][ T30] audit: type=1400 audit(1758487204.468:565): avc: denied { associate } for pid=8670 comm="syz.1.390" name="file1" dev="tmpfs" ino=439 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:userio_device_t:s0" [ 183.968156][ C1] vkms_vblank_simulate: vblank timer overrun [ 184.447056][ T30] audit: type=1400 audit(1758487205.008:566): avc: denied { ioctl } for pid=8693 comm="syz.2.393" path="/dev/binderfs/binder0" dev="binder" ino=10 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 184.501606][ T8697] netlink: 4 bytes leftover after parsing attributes in process `syz.2.393'. [ 184.539575][ T8694] vxcan1 speed is unknown, defaulting to 1000 [ 184.660469][ T8700] binder: BINDER_SET_CONTEXT_MGR already set [ 184.667042][ T8700] binder: 8693:8700 ioctl 4018620d 200000000040 returned -16 [ 184.730260][ T30] audit: type=1400 audit(1758487205.008:567): avc: denied { set_context_mgr } for pid=8693 comm="syz.2.393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 184.942506][ T30] audit: type=1400 audit(1758487205.058:568): avc: denied { write } for pid=8693 comm="syz.2.393" name="usbmon8" dev="devtmpfs" ino=740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 184.965728][ C1] vkms_vblank_simulate: vblank timer overrun [ 185.143767][ T30] audit: type=1400 audit(1758487205.098:569): avc: denied { bind } for pid=8674 comm="syz.4.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 185.224496][ T30] audit: type=1400 audit(1758487205.298:570): avc: denied { ioctl } for pid=8693 comm="syz.2.393" path="/dev/usbmon8" dev="devtmpfs" ino=740 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 185.249551][ C1] vkms_vblank_simulate: vblank timer overrun [ 185.415374][ T8707] netlink: 64 bytes leftover after parsing attributes in process `syz.3.394'. [ 185.626656][ T8713] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 185.967526][ T9] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 185.996657][ T9] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 186.220178][ T8748] fido_id[8748]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 186.498614][ T30] audit: type=1400 audit(1758487207.068:571): avc: denied { rmdir } for pid=5843 comm="syz-executor" name="file1" dev="tmpfs" ino=439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:userio_device_t:s0" [ 186.691890][ T8768] Driver unsupported XDP return value 0 on prog (id 78) dev N/A, expect packet loss! [ 187.174196][ T5930] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 187.537776][ T5930] usb 3-1: Using ep0 maxpacket: 16 [ 188.005726][ T5930] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 188.416579][ T5930] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 188.447581][ T5930] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 188.684842][ T5930] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 188.731561][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.739761][ T5930] usb 3-1: Product: syz [ 188.757852][ T5930] usb 3-1: Manufacturer: syz [ 188.764398][ T5930] usb 3-1: SerialNumber: syz [ 188.765988][ T24] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 188.837337][ T24] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 188.995210][ T8762] netlink: 24 bytes leftover after parsing attributes in process `syz.2.399'. [ 189.013801][ T8762] netlink: 'syz.2.399': attribute type 1 has an invalid length. [ 189.033759][ T8762] netlink: 'syz.2.399': attribute type 2 has an invalid length. [ 189.041425][ T8762] netlink: 16 bytes leftover after parsing attributes in process `syz.2.399'. [ 189.098658][ T5930] usb 3-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 189.220508][ T5930] usb 3-1: USB disconnect, device number 11 [ 189.254949][ T5895] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 189.321306][ T5895] hid-generic 0000:0000:0000.000D: hidraw1: HID v0.00 Device [syz1] on syz0 [ 189.789484][ T8858] netlink: 80 bytes leftover after parsing attributes in process `syz.2.412'. [ 190.215909][ T30] audit: type=1326 audit(1758487210.758:572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.341003][ T30] audit: type=1326 audit(1758487210.758:573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.365074][ T30] audit: type=1326 audit(1758487210.758:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.839474][ T30] audit: type=1326 audit(1758487210.758:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.841522][ T5851] Bluetooth: hci2: command 0x0406 tx timeout [ 190.862719][ C1] vkms_vblank_simulate: vblank timer overrun [ 190.862875][ T30] audit: type=1326 audit(1758487210.758:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.862915][ T30] audit: type=1326 audit(1758487210.758:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.862951][ T30] audit: type=1326 audit(1758487210.758:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.862987][ T30] audit: type=1326 audit(1758487210.758:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.863023][ T30] audit: type=1326 audit(1758487210.758:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.863055][ T30] audit: type=1326 audit(1758487210.758:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8860 comm="syz.4.414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f383178ec29 code=0x7ffc0000 [ 190.869135][ T5859] Bluetooth: hci3: command 0x0406 tx timeout [ 190.898325][ C1] vkms_vblank_simulate: vblank timer overrun [ 190.945258][ C1] vkms_vblank_simulate: vblank timer overrun [ 191.015542][ C1] vkms_vblank_simulate: vblank timer overrun [ 191.091324][ T5170] Bluetooth: hci1: command 0x0406 tx timeout [ 191.097427][ T5849] Bluetooth: hci0: command 0x0406 tx timeout [ 191.135537][ T8876] netlink: 'syz.2.417': attribute type 2 has an invalid length. [ 191.165233][ T8876] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.417'. [ 191.177171][ T8876] nbd: must specify an index to disconnect [ 191.367235][ T8888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.419'. [ 191.384708][ T8892] netlink: 64 bytes leftover after parsing attributes in process `syz.1.421'. [ 191.456101][ T8894] binder: BINDER_SET_CONTEXT_MGR already set [ 191.462311][ T8894] binder: 8885:8894 ioctl 4018620d 200000000040 returned -16 [ 192.044950][ T24] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 192.095172][ T24] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 192.912574][ T24] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 193.101985][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 193.125897][ T24] usb 3-1: config 0 has an invalid interface number: 247 but max is 0 [ 193.136294][ T24] usb 3-1: config 0 has no interface number 0 [ 193.151051][ T24] usb 3-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 193.192004][ T24] usb 3-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 193.279467][ T24] usb 3-1: Product: syz [ 193.312000][ T24] usb 3-1: Manufacturer: syz [ 193.357415][ T24] usb 3-1: config 0 descriptor?? [ 193.901566][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.913951][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.600358][ T8960] netlink: 20 bytes leftover after parsing attributes in process `syz.1.432'. [ 194.609783][ T8960] netlink: 20 bytes leftover after parsing attributes in process `syz.1.432'. [ 194.610057][ T8958] netlink: 80 bytes leftover after parsing attributes in process `syz.4.431'. [ 194.927749][ T8970] netlink: 64 bytes leftover after parsing attributes in process `syz.4.434'. [ 195.376732][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 195.376754][ T30] audit: type=1400 audit(1758487215.948:586): avc: denied { create } for pid=8966 comm="syz.3.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 195.422996][ T8977] netlink: 'syz.3.433': attribute type 2 has an invalid length. [ 195.430914][ T8977] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.433'. [ 195.440257][ T8977] nbd: must specify an index to disconnect [ 195.700560][ T30] audit: type=1400 audit(1758487215.978:587): avc: denied { write } for pid=8966 comm="syz.3.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 195.756214][ T30] audit: type=1400 audit(1758487216.298:588): avc: denied { module_load } for pid=8915 comm="syz.2.426" path="/sys/power/wakeup_count" dev="sysfs" ino=1413 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 195.772091][ T43] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 195.992257][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 196.054804][ T8997] netlink: 'syz.0.439': attribute type 83 has an invalid length. [ 196.273051][ T8993] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 196.286166][ T30] audit: type=1326 audit(1758487216.838:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.309765][ T8993] CPU: 0 UID: 0 PID: 8993 Comm: syz.3.438 Not tainted syzkaller #0 PREEMPT(full) [ 196.309790][ T8993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 196.309802][ T8993] Call Trace: [ 196.309809][ T8993] [ 196.309822][ T8993] dump_stack_lvl+0x16c/0x1f0 [ 196.309854][ T8993] sysfs_warn_dup+0x7f/0xa0 [ 196.309881][ T8993] sysfs_do_create_link_sd+0x124/0x140 [ 196.309910][ T8993] sysfs_create_link+0x61/0xc0 [ 196.309936][ T8993] device_add+0x62c/0x1aa0 [ 196.309964][ T8993] ? __pfx_device_add+0x10/0x10 [ 196.309987][ T8993] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 196.310008][ T8993] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 196.310032][ T8993] wiphy_register+0x1df4/0x29f0 [ 196.310050][ T8993] ? netdev_run_todo+0x864/0x1320 [ 196.310069][ T8993] ? __dev_printk+0x1d0/0x270 [ 196.310089][ T8993] ? __pfx_wiphy_register+0x10/0x10 [ 196.310114][ T8993] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 196.310136][ T8993] ieee80211_register_hw+0x2546/0x4120 [ 196.310163][ T8993] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 196.310188][ T8993] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 196.310204][ T8993] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 196.310221][ T8993] ? __hrtimer_setup+0x176/0x280 [ 196.310238][ T8993] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 196.310270][ T8993] ? trace_kmalloc+0x2b/0xd0 [ 196.310287][ T8993] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 196.310304][ T8993] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 196.310324][ T8993] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 196.310346][ T8993] ? __asan_memcpy+0x3c/0x60 [ 196.310370][ T8993] hwsim_new_radio_nl+0xb51/0x12c0 [ 196.310393][ T8993] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 196.310421][ T8993] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 196.310443][ T8993] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 196.310469][ T8993] genl_family_rcv_msg_doit+0x209/0x2f0 [ 196.310491][ T8993] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 196.310519][ T8993] ? bpf_lsm_capable+0x9/0x10 [ 196.310538][ T8993] ? security_capable+0x7e/0x260 [ 196.310557][ T8993] ? ns_capable+0xd7/0x110 [ 196.310577][ T8993] genl_rcv_msg+0x55c/0x800 [ 196.310601][ T8993] ? __pfx_genl_rcv_msg+0x10/0x10 [ 196.310622][ T8993] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 196.310651][ T8993] netlink_rcv_skb+0x158/0x420 [ 196.310670][ T8993] ? __pfx_genl_rcv_msg+0x10/0x10 [ 196.310691][ T8993] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 196.310719][ T8993] ? netlink_deliver_tap+0x1ae/0xd30 [ 196.310739][ T8993] genl_rcv+0x28/0x40 [ 196.310757][ T8993] netlink_unicast+0x5a7/0x870 [ 196.310779][ T8993] ? __pfx_netlink_unicast+0x10/0x10 [ 196.310798][ T8993] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 196.310828][ T8993] netlink_sendmsg+0x8d1/0xdd0 [ 196.310851][ T8993] ? __pfx_netlink_sendmsg+0x10/0x10 [ 196.310878][ T8993] ____sys_sendmsg+0xa95/0xc70 [ 196.310901][ T8993] ? copy_msghdr_from_user+0x10a/0x160 [ 196.310920][ T8993] ? __pfx_____sys_sendmsg+0x10/0x10 [ 196.310953][ T8993] ___sys_sendmsg+0x134/0x1d0 [ 196.310974][ T8993] ? __pfx____sys_sendmsg+0x10/0x10 [ 196.311020][ T8993] __sys_sendmsg+0x16d/0x220 [ 196.311038][ T8993] ? __pfx___sys_sendmsg+0x10/0x10 [ 196.311064][ T8993] ? __secure_computing+0x28e/0x3b0 [ 196.311088][ T8993] do_syscall_64+0xcd/0x4e0 [ 196.311108][ T8993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.311122][ T8993] RIP: 0033:0x7fae74d8ec29 [ 196.311135][ T8993] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 196.311149][ T8993] RSP: 002b:00007fae75c41038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 196.311163][ T8993] RAX: ffffffffffffffda RBX: 00007fae74fd6090 RCX: 00007fae74d8ec29 [ 196.311172][ T8993] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 196.311181][ T8993] RBP: 00007fae74e11e41 R08: 0000000000000000 R09: 0000000000000000 [ 196.311189][ T8993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 196.311197][ T8993] R13: 00007fae74fd6128 R14: 00007fae74fd6090 R15: 00007fff81f19398 [ 196.311216][ T8993] [ 196.572191][ T30] audit: type=1326 audit(1758487216.838:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.729262][ C1] vkms_vblank_simulate: vblank timer overrun [ 196.774217][ T30] audit: type=1326 audit(1758487216.838:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.797535][ T30] audit: type=1326 audit(1758487216.838:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.820789][ T30] audit: type=1326 audit(1758487216.838:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.857448][ T30] audit: type=1326 audit(1758487216.838:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.892871][ T30] audit: type=1326 audit(1758487216.838:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8990 comm="syz.3.438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 196.931475][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.045570][ T9001] loop6: detected capacity change from 0 to 63 [ 197.171573][ T5895] usb 3-1: USB disconnect, device number 12 [ 197.246708][ T43] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 197.293355][ T43] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 197.346856][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.647040][ T9025] netlink: 64 bytes leftover after parsing attributes in process `syz.0.441'. [ 197.647333][ T43] usb 5-1: config 0 descriptor?? [ 197.841122][ T43] usbhid 5-1:0.0: can't add hid device: -71 [ 197.859045][ T43] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 197.914337][ T43] usb 5-1: USB disconnect, device number 10 [ 198.029755][ T9048] tmpfs: Bad value for 'mpol' [ 198.052208][ T24] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 199.071978][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 199.080036][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.133263][ T5895] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 199.155831][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 199.179958][ T5895] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 199.200651][ T24] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 199.319592][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.346890][ T24] usb 1-1: config 0 descriptor?? [ 199.776399][ T24] HID 045e:07da: Invalid code 65791 type 1 [ 199.824789][ T24] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0010/input/input13 [ 199.886705][ T24] microsoft 0003:045E:07DA.0010: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 200.776967][ T9022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.785811][ T9022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.801101][ T5909] usb 1-1: USB disconnect, device number 9 [ 201.082023][ T5930] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 201.898083][ T5930] usb 3-1: Using ep0 maxpacket: 16 [ 202.796822][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.849486][ T9165] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 202.874526][ T5930] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 202.935108][ T5930] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 202.972553][ T5930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.012538][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 203.012555][ T30] audit: type=1400 audit(1758487223.588:608): avc: denied { connect } for pid=9176 comm="syz.1.467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 203.052784][ T5930] usb 3-1: config 0 descriptor?? [ 203.165245][ T9174] vxcan1 speed is unknown, defaulting to 1000 [ 203.209214][ T9178] gretap1: entered promiscuous mode [ 203.220466][ T9192] netlink: 'syz.1.468': attribute type 83 has an invalid length. [ 203.413544][ T5909] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 204.034028][ T5858] Bluetooth: hci4: link tx timeout [ 204.039183][ T5858] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 204.048870][ T5858] Bluetooth: hci4: link tx timeout [ 204.056140][ T5909] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 204.090701][ T5909] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 204.096655][ T5930] usbhid 3-1:0.0: can't add hid device: -71 [ 204.100964][ T5909] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 204.122321][ T5909] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.184101][ T5909] usb 1-1: config 0 descriptor?? [ 204.294005][ T5930] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 204.375730][ T5930] usb 3-1: USB disconnect, device number 13 [ 204.634943][ T5909] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 204.650833][ T5909] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 204.711243][ T5909] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0011/input/input14 [ 204.797498][ T5909] cm6533_jd 0003:0D8C:0022.0011: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 205.388209][ T5909] usb 1-1: USB disconnect, device number 10 [ 205.563658][ T9257] fido_id[9257]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 205.900234][ T9281] vxcan1 speed is unknown, defaulting to 1000 [ 206.102071][ T5858] Bluetooth: hci4: command 0x0406 tx timeout [ 206.189895][ T5909] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 206.302894][ T5909] hid-generic 0000:0000:0000.0012: hidraw0: HID v0.00 Device [syz1] on syz0 [ 206.336217][ T9298] FAULT_INJECTION: forcing a failure. [ 206.336217][ T9298] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 206.349818][ T9298] CPU: 0 UID: 0 PID: 9298 Comm: syz.4.478 Not tainted syzkaller #0 PREEMPT(full) [ 206.349833][ T9298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 206.349839][ T9298] Call Trace: [ 206.349843][ T9298] [ 206.349847][ T9298] dump_stack_lvl+0x16c/0x1f0 [ 206.349866][ T9298] should_fail_ex+0x512/0x640 [ 206.349884][ T9298] should_fail_alloc_page+0xe7/0x130 [ 206.349899][ T9298] prepare_alloc_pages+0x3c2/0x610 [ 206.349916][ T9298] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 206.349933][ T9298] ? rcu_is_watching+0x12/0xc0 [ 206.349947][ T9298] ? kasan_quarantine_put+0x10a/0x240 [ 206.349957][ T9298] ? lockdep_hardirqs_on+0x7c/0x110 [ 206.349971][ T9298] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 206.349984][ T9298] ? kmem_cache_free+0x2d1/0x4d0 [ 206.349994][ T9298] ? lockdep_hardirqs_on+0x7c/0x110 [ 206.350006][ T9298] ? audit_log_end+0x14a/0x2b0 [ 206.350024][ T9298] ? look_up_lock_class+0x6b/0x150 [ 206.350039][ T9298] ? audit_log_end+0x14a/0x2b0 [ 206.350058][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 206.350072][ T9298] ? policy_nodemask+0xea/0x4e0 [ 206.350086][ T9298] alloc_pages_mpol+0x1fb/0x550 [ 206.350099][ T9298] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 206.350113][ T9298] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 206.350127][ T9298] folio_alloc_mpol_noprof+0x36/0x2f0 [ 206.350143][ T9298] vma_alloc_folio_noprof+0xed/0x1e0 [ 206.350158][ T9298] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 206.350173][ T9298] ? rcu_read_unlock+0x2d/0xb0 [ 206.350186][ T9298] do_wp_page+0x1136/0x4f00 [ 206.350205][ T9298] ? __pfx_do_wp_page+0x10/0x10 [ 206.350221][ T9298] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 206.350233][ T9298] ? ___pte_offset_map+0x2ad/0x4f0 [ 206.350248][ T9298] __handle_mm_fault+0x1b2d/0x2a50 [ 206.350267][ T9298] ? mt_find+0x3ef/0xa30 [ 206.350283][ T9298] ? __pfx___handle_mm_fault+0x10/0x10 [ 206.350299][ T9298] ? __pfx_mt_find+0x10/0x10 [ 206.350322][ T9298] ? find_vma+0xbf/0x140 [ 206.350334][ T9298] ? __pfx_find_vma+0x10/0x10 [ 206.350348][ T9298] handle_mm_fault+0x589/0xd10 [ 206.350365][ T9298] ? trace_raw_output_exceptions+0x131/0x150 [ 206.350385][ T9298] do_user_addr_fault+0x7a6/0x1370 [ 206.350398][ T9298] ? rcu_is_watching+0x12/0xc0 [ 206.350413][ T9298] exc_page_fault+0x5c/0xb0 [ 206.350426][ T9298] asm_exc_page_fault+0x26/0x30 [ 206.350436][ T9298] RIP: 0010:__put_user_4+0xd/0x20 [ 206.350451][ T9298] Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca e9 87 68 03 00 0f 1f 80 00 00 00 00 90 90 90 [ 206.350462][ T9298] RSP: 0018:ffffc9001c38fcf0 EFLAGS: 00050202 [ 206.350472][ T9298] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000004438 [ 206.350479][ T9298] RDX: ffff88807c3b0000 RSI: ffffffff89648729 RDI: ffffffff8c163400 [ 206.350485][ T9298] RBP: 0000000000000000 R08: a23edf14cf8df726 R09: 0000000000000001 [ 206.350492][ T9298] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000040000 [ 206.350498][ T9298] R13: 0000200000004400 R14: 0000000000000202 R15: 0000000000000203 [ 206.350509][ T9298] ? __sys_sendmmsg+0x229/0x420 [ 206.350525][ T9298] __sys_sendmmsg+0x234/0x420 [ 206.350540][ T9298] ? __pfx___sys_sendmmsg+0x10/0x10 [ 206.350559][ T9298] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 206.350579][ T9298] ? fput+0x9b/0xd0 [ 206.350594][ T9298] ? ksys_write+0x1ac/0x250 [ 206.350605][ T9298] ? __pfx_ksys_write+0x10/0x10 [ 206.350618][ T9298] __x64_sys_sendmmsg+0x9c/0x100 [ 206.350632][ T9298] ? lockdep_hardirqs_on+0x7c/0x110 [ 206.350645][ T9298] do_syscall_64+0xcd/0x4e0 [ 206.350660][ T9298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.350670][ T9298] RIP: 0033:0x7f383178ec29 [ 206.350679][ T9298] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.350689][ T9298] RSP: 002b:00007f382f9ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 206.350699][ T9298] RAX: ffffffffffffffda RBX: 00007f38319d5fa0 RCX: 00007f383178ec29 [ 206.350705][ T9298] RDX: 0400000000000203 RSI: 0000200000004400 RDI: 0000000000000005 [ 206.350712][ T9298] RBP: 00007f382f9ee090 R08: 0000000000000000 R09: 0000000000000000 [ 206.350718][ T9298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.350725][ T9298] R13: 00007f38319d6038 R14: 00007f38319d5fa0 R15: 00007ffd7521ced8 [ 206.350738][ T9298] [ 206.374270][ T30] audit: type=1400 audit(1758487226.908:609): avc: denied { create } for pid=9296 comm="syz.4.478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 207.722745][ T30] audit: type=1400 audit(1758487226.908:610): avc: denied { write } for pid=9296 comm="syz.4.478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 207.722797][ T30] audit: type=1400 audit(1758487227.788:611): avc: denied { setopt } for pid=9301 comm="syz.2.479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 207.983189][ T9302] tty tty24: ldisc open failed (-12), clearing slot 23 [ 208.919211][ T30] audit: type=1400 audit(1758487229.468:612): avc: denied { write } for pid=9359 comm="syz.3.482" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 211.214623][ T30] audit: type=1326 audit(1758487231.578:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9426 comm="syz.3.488" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fae74d8ec29 code=0x0 [ 213.226692][ T9474] vxcan1 speed is unknown, defaulting to 1000 [ 214.134219][ T9502] netlink: 'syz.4.493': attribute type 4 has an invalid length. [ 214.141894][ T9502] netlink: 17 bytes leftover after parsing attributes in process `syz.4.493'. [ 214.170383][ T9502] fuse: Bad value for 'fd' [ 214.728124][ T30] audit: type=1400 audit(1758487235.298:614): avc: denied { connect } for pid=9504 comm="syz.1.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 214.779182][ T30] audit: type=1400 audit(1758487235.328:615): avc: denied { write } for pid=9504 comm="syz.1.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 214.871708][ T30] audit: type=1400 audit(1758487235.328:616): avc: denied { ioctl } for pid=9504 comm="syz.1.499" path="socket:[15975]" dev="sockfs" ino=15975 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 214.931138][ T9512] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 215.005346][ T9517] IPVS: set_ctl: invalid protocol: 50 172.20.20.170:20001 [ 215.096401][ T9512] netlink: 'syz.1.499': attribute type 1 has an invalid length. [ 218.452203][ T9560] netlink: 'syz.3.505': attribute type 3 has an invalid length. [ 218.470617][ T9560] netlink: 8 bytes leftover after parsing attributes in process `syz.3.505'. [ 218.824101][ T9575] netlink: 20 bytes leftover after parsing attributes in process `syz.0.509'. [ 218.852258][ T5930] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 218.856557][ T9577] netlink: 4 bytes leftover after parsing attributes in process `syz.4.510'. [ 219.045996][ T5930] usb 4-1: config 0 has an invalid interface number: 235 but max is 0 [ 219.076526][ T5930] usb 4-1: config 0 has no interface number 0 [ 219.091359][ T5930] usb 4-1: config 0 interface 235 altsetting 16 endpoint 0x5 has invalid maxpacket 26432, setting to 64 [ 219.132260][ T9583] netlink: 'syz.0.511': attribute type 83 has an invalid length. [ 219.151305][ T5930] usb 4-1: config 0 interface 235 has no altsetting 0 [ 219.183103][ T5930] usb 4-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=3e.18 [ 219.192932][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.212390][ T5930] usb 4-1: Product: syz [ 219.216734][ T5930] usb 4-1: Manufacturer: syz [ 219.225942][ T5930] usb 4-1: SerialNumber: syz [ 219.238595][ T5930] usb 4-1: config 0 descriptor?? [ 219.251830][ T9560] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 219.276003][ T5930] keyspan 4-1:0.235: Keyspan 1 port adapter converter detected [ 219.347225][ T5930] keyspan 4-1:0.235: found no endpoint descriptor for endpoint 87 [ 219.365105][ T5930] keyspan 4-1:0.235: found no endpoint descriptor for endpoint 7 [ 219.407310][ T5930] keyspan 4-1:0.235: found no endpoint descriptor for endpoint 81 [ 219.427968][ T5930] keyspan 4-1:0.235: found no endpoint descriptor for endpoint 1 [ 219.458227][ T5930] keyspan 4-1:0.235: found no endpoint descriptor for endpoint 85 [ 219.503364][ T30] audit: type=1400 audit(1758487240.078:617): avc: denied { write } for pid=9558 comm="syz.3.505" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 219.516686][ T5930] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 219.628846][ T5930] usb 4-1: USB disconnect, device number 14 [ 219.667676][ T5930] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 219.701636][ T30] audit: type=1400 audit(1758487240.078:618): avc: denied { ioctl } for pid=9558 comm="syz.3.505" path="socket:[16040]" dev="sockfs" ino=16040 ioctlcmd=0x8919 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 219.747399][ T9607] netlink: 24 bytes leftover after parsing attributes in process `syz.2.512'. [ 219.805273][ T5930] keyspan 4-1:0.235: device disconnected [ 221.185886][ T30] audit: type=1400 audit(1758487241.668:619): avc: denied { name_bind } for pid=9645 comm="syz.2.517" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 221.826633][ T93] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 222.046063][ T93] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 222.095495][ T93] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 62976, setting to 1024 [ 222.187081][ T93] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 223.227604][ T93] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 223.272158][ T93] usb 3-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 223.305696][ T93] usb 3-1: Product: syz [ 223.309906][ T93] usb 3-1: Manufacturer: syz [ 223.346606][ T9690] /dev/nullb0: Can't lookup blockdev [ 223.362863][ T93] usb 3-1: SerialNumber: syz [ 223.507931][ T93] cdc_mbim 3-1:1.0: skipping garbage [ 223.978328][ T9646] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 224.371442][ T9708] netlink: 64 bytes leftover after parsing attributes in process `syz.3.527'. [ 224.593988][ T9646] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 224.702804][ T5930] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 224.785972][ T9727] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 224.793726][ T9727] CPU: 0 UID: 0 PID: 9727 Comm: syz.1.529 Not tainted syzkaller #0 PREEMPT(full) [ 224.793756][ T9727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 224.793768][ T9727] Call Trace: [ 224.793778][ T9727] [ 224.793788][ T9727] dump_stack_lvl+0x16c/0x1f0 [ 224.793820][ T9727] sysfs_warn_dup+0x7f/0xa0 [ 224.793847][ T9727] sysfs_do_create_link_sd+0x124/0x140 [ 224.793876][ T9727] sysfs_create_link+0x61/0xc0 [ 224.793902][ T9727] device_add+0x62c/0x1aa0 [ 224.793933][ T9727] ? __pfx_device_add+0x10/0x10 [ 224.793959][ T9727] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 224.793984][ T9727] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 224.794012][ T9727] wiphy_register+0x1df4/0x29f0 [ 224.794037][ T9727] ? netdev_run_todo+0x864/0x1320 [ 224.794062][ T9727] ? __dev_printk+0x1d0/0x270 [ 224.794089][ T9727] ? __pfx_wiphy_register+0x10/0x10 [ 224.794122][ T9727] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 224.794151][ T9727] ieee80211_register_hw+0x2546/0x4120 [ 224.794187][ T9727] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 224.794217][ T9727] ? trace_hrtimer_setup+0x6e/0x220 [ 224.794238][ T9727] ? trace_hrtimer_setup+0x184/0x220 [ 224.794260][ T9727] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 224.794284][ T9727] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 224.794306][ T9727] ? __hrtimer_setup+0x176/0x280 [ 224.794328][ T9727] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 224.794384][ T9727] ? trace_kmalloc+0x2b/0xd0 [ 224.794409][ T9727] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 224.794433][ T9727] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 224.794461][ T9727] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 224.794492][ T9727] ? __asan_memcpy+0x3c/0x60 [ 224.794527][ T9727] hwsim_new_radio_nl+0xb51/0x12c0 [ 224.794560][ T9727] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 224.794598][ T9727] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 224.794627][ T9727] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 224.794662][ T9727] genl_family_rcv_msg_doit+0x209/0x2f0 [ 224.794693][ T9727] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 224.794729][ T9727] ? bpf_lsm_capable+0x9/0x10 [ 224.794756][ T9727] ? security_capable+0x7e/0x260 [ 224.794779][ T9727] ? ns_capable+0xd7/0x110 [ 224.794805][ T9727] genl_rcv_msg+0x55c/0x800 [ 224.794835][ T9727] ? __pfx_genl_rcv_msg+0x10/0x10 [ 224.794863][ T9727] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 224.794902][ T9727] netlink_rcv_skb+0x158/0x420 [ 224.794927][ T9727] ? __pfx_genl_rcv_msg+0x10/0x10 [ 224.794956][ T9727] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 224.794999][ T9727] genl_rcv+0x28/0x40 [ 224.795024][ T9727] netlink_unicast+0x5a7/0x870 [ 224.795053][ T9727] ? __pfx_netlink_unicast+0x10/0x10 [ 224.795078][ T9727] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 224.795111][ T9727] netlink_sendmsg+0x8d1/0xdd0 [ 224.795140][ T9727] ? __pfx_netlink_sendmsg+0x10/0x10 [ 224.795176][ T9727] ____sys_sendmsg+0xa95/0xc70 [ 224.795206][ T9727] ? copy_msghdr_from_user+0x10a/0x160 [ 224.795230][ T9727] ? __pfx_____sys_sendmsg+0x10/0x10 [ 224.795271][ T9727] ___sys_sendmsg+0x134/0x1d0 [ 224.795297][ T9727] ? __pfx____sys_sendmsg+0x10/0x10 [ 224.795355][ T9727] __sys_sendmsg+0x16d/0x220 [ 224.795388][ T9727] ? __pfx___sys_sendmsg+0x10/0x10 [ 224.795423][ T9727] ? __secure_computing+0x28e/0x3b0 [ 224.795458][ T9727] do_syscall_64+0xcd/0x4e0 [ 224.795487][ T9727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.795508][ T9727] RIP: 0033:0x7f81ded8ec29 [ 224.795525][ T9727] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 224.795543][ T9727] RSP: 002b:00007f81dfbab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 224.795561][ T9727] RAX: ffffffffffffffda RBX: 00007f81defd6180 RCX: 00007f81ded8ec29 [ 224.795571][ T9727] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 224.795582][ T9727] RBP: 00007f81dee11e41 R08: 0000000000000000 R09: 0000000000000000 [ 224.795592][ T9727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 224.795602][ T9727] R13: 00007f81defd6218 R14: 00007f81defd6180 R15: 00007ffecbaf05a8 [ 224.795624][ T9727] [ 225.200230][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.215869][ T30] audit: type=1326 audit(1758487245.348:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.239213][ T30] audit: type=1326 audit(1758487245.348:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.262382][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.268884][ T30] audit: type=1326 audit(1758487245.348:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.292167][ T30] audit: type=1326 audit(1758487245.348:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.315320][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.321371][ T30] audit: type=1326 audit(1758487245.348:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.344529][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.350996][ T30] audit: type=1326 audit(1758487245.348:625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.374210][ T30] audit: type=1326 audit(1758487245.348:626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.397382][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.403473][ T30] audit: type=1326 audit(1758487245.348:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.426533][ C0] vkms_vblank_simulate: vblank timer overrun [ 225.432617][ T93] cdc_mbim 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 225.439102][ T93] cdc_mbim 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 225.447324][ T93] cdc_mbim 3-1:1.0: setting rx_max = 2048 [ 225.531232][ T93] cdc_mbim 3-1:1.0: setting tx_max = 184 [ 225.540908][ T5930] usb 4-1: Using ep0 maxpacket: 16 [ 225.549035][ T5930] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.559940][ T5930] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 225.572833][ T5930] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 225.581875][ T5930] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.591262][ T5930] usb 4-1: config 0 descriptor?? [ 225.599253][ T93] cdc_ncm 3-1:1.1: probe with driver cdc_ncm failed with error -71 [ 225.607601][ T93] cdc_mbim 3-1:1.1: probe with driver cdc_mbim failed with error -71 [ 225.616342][ T93] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 225.626631][ T93] usb 3-1: USB disconnect, device number 14 [ 225.672465][ T9730] netlink: 'syz.0.530': attribute type 83 has an invalid length. [ 225.804698][ T30] audit: type=1326 audit(1758487246.378:628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9720 comm="syz.1.529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 225.827910][ C0] vkms_vblank_simulate: vblank timer overrun [ 226.003508][ T5930] HID 045e:07da: Invalid code 65791 type 1 [ 226.030766][ T5930] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0013/input/input15 [ 226.115059][ T5930] microsoft 0003:045E:07DA.0013: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 227.329974][ T24] usb 4-1: USB disconnect, device number 15 [ 227.564916][ T9778] vxcan1 speed is unknown, defaulting to 1000 [ 228.079699][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 228.079717][ T30] audit: type=1400 audit(1758487248.648:638): avc: denied { mount } for pid=9772 comm="syz.2.534" name="/" dev="ramfs" ino=16706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 228.322066][ T30] audit: type=1400 audit(1758487248.888:639): avc: denied { watch_mount watch_reads } for pid=9772 comm="syz.2.534" path="/" dev="ramfs" ino=16706 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 228.344823][ C0] vkms_vblank_simulate: vblank timer overrun [ 228.880363][ T9848] netlink: 4 bytes leftover after parsing attributes in process `syz.3.543'. [ 228.996774][ T5930] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 229.655651][ T9856] binder: BINDER_SET_CONTEXT_MGR already set [ 229.662864][ T9856] binder: 9845:9856 ioctl 4018620d 200000000040 returned -16 [ 229.967109][ T5930] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 230.047587][ T5930] usb 3-1: config 0 has no interface number 0 [ 230.082109][ T5930] usb 3-1: config 0 interface 119 has no altsetting 0 [ 230.109617][ T5930] usb 3-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 230.134274][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.547956][ T5930] usb 3-1: Product: syz [ 230.552609][ T5930] usb 3-1: Manufacturer: syz [ 230.557302][ T5930] usb 3-1: SerialNumber: syz [ 230.591116][ T5930] usb 3-1: config 0 descriptor?? [ 230.599573][ T9868] sp0: Synchronizing with TNC [ 231.139206][ T5930] kaweth 3-1:0.119: Firmware present in device. [ 231.157508][ T5930] kaweth 3-1:0.119: Error reading configuration (-71), no net device created [ 231.256583][ T5930] kaweth 3-1:0.119: probe with driver kaweth failed with error -5 [ 231.324156][ T5930] pegasus 3-1:0.119: probe with driver pegasus failed with error -71 [ 231.419589][ T5930] usb 3-1: USB disconnect, device number 15 [ 232.110254][ T30] audit: type=1400 audit(1758487252.678:640): avc: denied { append } for pid=9910 comm="syz.2.548" name="event3" dev="devtmpfs" ino=1000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 233.142117][ T30] audit: type=1400 audit(1758487253.698:641): avc: denied { mounton } for pid=9910 comm="syz.2.548" path="/file0" dev="ramfs" ino=17446 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 235.522390][ T9958] netlink: 'syz.3.555': attribute type 83 has an invalid length. [ 235.863431][ T9967] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 236.194594][ T5895] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 236.205607][ T5895] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 236.522095][ T5895] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 236.703548][ T5895] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 236.715906][ T5895] usb 3-1: config 0 has no interface number 0 [ 236.744805][ T5895] usb 3-1: config 0 interface 119 has no altsetting 0 [ 236.776506][ T5895] usb 3-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 236.790979][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.826761][ T5895] usb 3-1: Product: syz [ 236.831274][ T5895] usb 3-1: Manufacturer: syz [ 236.841544][ T5895] usb 3-1: SerialNumber: syz [ 236.859650][ T5895] usb 3-1: config 0 descriptor?? [ 236.942837][ T30] audit: type=1400 audit(1758487257.508:642): avc: denied { firmware_load } for pid=10002 comm="syz.3.562" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 237.088672][T10004] syz.3.562 (10004) used greatest stack depth: 19112 bytes left [ 237.321415][ T5895] kaweth 3-1:0.119: Firmware present in device. [ 237.329324][ T5895] kaweth 3-1:0.119: Error reading configuration (-71), no net device created [ 237.348729][ T5895] kaweth 3-1:0.119: probe with driver kaweth failed with error -5 [ 237.365616][ T5895] pegasus 3-1:0.119: probe with driver pegasus failed with error -71 [ 237.389072][ T5895] usb 3-1: USB disconnect, device number 16 [ 237.422162][ T30] audit: type=1400 audit(1758487257.978:643): avc: denied { read } for pid=10019 comm="syz.3.563" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 237.527591][ T30] audit: type=1400 audit(1758487257.978:644): avc: denied { open } for pid=10019 comm="syz.3.563" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 237.757557][T10032] SELinux: Context system_u:object_r:fixed_disk_device_t:s0 is not valid (left unmapped). [ 237.770829][ T30] audit: type=1400 audit(1758487258.338:645): avc: denied { relabelto } for pid=10029 comm="syz.3.565" name="file0" dev="tmpfs" ino=594 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:fixed_disk_device_t:s0" [ 237.810916][T10033] netlink: 'syz.0.564': attribute type 83 has an invalid length. [ 237.822434][ T30] audit: type=1400 audit(1758487258.338:646): avc: denied { associate } for pid=10029 comm="syz.3.565" name="file0" dev="tmpfs" ino=594 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fixed_disk_device_t:s0" [ 238.202974][T10045] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 238.210851][T10045] CPU: 1 UID: 0 PID: 10045 Comm: syz.2.568 Not tainted syzkaller #0 PREEMPT(full) [ 238.210878][T10045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 238.210890][T10045] Call Trace: [ 238.210896][T10045] [ 238.210904][T10045] dump_stack_lvl+0x16c/0x1f0 [ 238.210933][T10045] sysfs_warn_dup+0x7f/0xa0 [ 238.210959][T10045] sysfs_do_create_link_sd+0x124/0x140 [ 238.210986][T10045] sysfs_create_link+0x61/0xc0 [ 238.211012][T10045] device_add+0x62c/0x1aa0 [ 238.211042][T10045] ? __pfx_device_add+0x10/0x10 [ 238.211066][T10045] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 238.211091][T10045] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 238.211119][T10045] wiphy_register+0x1df4/0x29f0 [ 238.211143][T10045] ? netdev_run_todo+0x864/0x1320 [ 238.211167][T10045] ? __dev_printk+0x1d0/0x270 [ 238.211194][T10045] ? __pfx_wiphy_register+0x10/0x10 [ 238.211228][T10045] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 238.211257][T10045] ieee80211_register_hw+0x2546/0x4120 [ 238.211299][T10045] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 238.211329][T10045] ? find_held_lock+0x2b/0x80 [ 238.211353][T10045] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 238.211376][T10045] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 238.211399][T10045] ? __hrtimer_setup+0x176/0x280 [ 238.211424][T10045] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 238.211470][T10045] ? trace_kmalloc+0x2b/0xd0 [ 238.211493][T10045] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 238.211515][T10045] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 238.211541][T10045] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 238.211569][T10045] ? __asan_memcpy+0x3c/0x60 [ 238.211600][T10045] hwsim_new_radio_nl+0xb51/0x12c0 [ 238.211628][T10045] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 238.211669][T10045] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 238.211698][T10045] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 238.211732][T10045] genl_family_rcv_msg_doit+0x209/0x2f0 [ 238.211762][T10045] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 238.211798][T10045] ? bpf_lsm_capable+0x9/0x10 [ 238.211823][T10045] ? security_capable+0x7e/0x260 [ 238.211844][T10045] ? ns_capable+0xd7/0x110 [ 238.211868][T10045] genl_rcv_msg+0x55c/0x800 [ 238.211895][T10045] ? __pfx_genl_rcv_msg+0x10/0x10 [ 238.211918][T10045] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 238.211951][T10045] netlink_rcv_skb+0x158/0x420 [ 238.211972][T10045] ? __pfx_genl_rcv_msg+0x10/0x10 [ 238.211993][T10045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 238.212020][T10045] ? netlink_deliver_tap+0x1ae/0xd30 [ 238.212042][T10045] genl_rcv+0x28/0x40 [ 238.212060][T10045] netlink_unicast+0x5a7/0x870 [ 238.212081][T10045] ? __pfx_netlink_unicast+0x10/0x10 [ 238.212099][T10045] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 238.212123][T10045] netlink_sendmsg+0x8d1/0xdd0 [ 238.212145][T10045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 238.212172][T10045] ____sys_sendmsg+0xa95/0xc70 [ 238.212198][T10045] ? copy_msghdr_from_user+0x10a/0x160 [ 238.212216][T10045] ? __pfx_____sys_sendmsg+0x10/0x10 [ 238.212247][T10045] ___sys_sendmsg+0x134/0x1d0 [ 238.212265][T10045] ? __pfx____sys_sendmsg+0x10/0x10 [ 238.212314][T10045] __sys_sendmsg+0x16d/0x220 [ 238.212332][T10045] ? __pfx___sys_sendmsg+0x10/0x10 [ 238.212357][T10045] ? __secure_computing+0x28e/0x3b0 [ 238.212383][T10045] do_syscall_64+0xcd/0x4e0 [ 238.212405][T10045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.212422][T10045] RIP: 0033:0x7f606bf8ec29 [ 238.212435][T10045] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 238.212449][T10045] RSP: 002b:00007f606cd93038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 238.212463][T10045] RAX: ffffffffffffffda RBX: 00007f606c1d6180 RCX: 00007f606bf8ec29 [ 238.212472][T10045] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 238.212480][T10045] RBP: 00007f606c011e41 R08: 0000000000000000 R09: 0000000000000000 [ 238.212489][T10045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 238.212498][T10045] R13: 00007f606c1d6218 R14: 00007f606c1d6180 R15: 00007ffc2cf2a518 [ 238.212520][T10045] [ 238.610107][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.698317][ T30] audit: type=1326 audit(1758487258.768:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.721788][ T30] audit: type=1326 audit(1758487258.768:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.745093][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.756782][ T30] audit: type=1326 audit(1758487258.768:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.783114][ T30] audit: type=1326 audit(1758487258.768:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.806377][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.813009][ T30] audit: type=1326 audit(1758487258.768:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.836508][ T30] audit: type=1326 audit(1758487258.768:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.859708][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.875827][ T30] audit: type=1326 audit(1758487258.768:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.899698][ T30] audit: type=1326 audit(1758487258.768:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 238.922883][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.929708][ T30] audit: type=1400 audit(1758487259.268:655): avc: denied { unlink } for pid=5850 comm="syz-executor" name="file0" dev="tmpfs" ino=594 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:fixed_disk_device_t:s0" [ 238.956956][ C1] vkms_vblank_simulate: vblank timer overrun [ 239.162039][ T30] audit: type=1326 audit(1758487259.588:656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10036 comm="syz.2.568" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 239.254908][T10053] input: syz1 as /devices/virtual/input/input16 [ 239.762252][T10049] loop6: detected capacity change from 0 to 63 [ 239.769518][ T93] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 239.907178][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 239.917388][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 240.254080][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 240.274154][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 240.274191][T10062] netlink: 4 bytes leftover after parsing attributes in process `syz.4.571'. [ 240.436608][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 240.527117][ T93] usb 5-1: unable to get BOS descriptor or descriptor too short [ 240.557998][ T93] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 240.592032][ T93] usb 5-1: can't read configurations, error -71 [ 240.753938][T10090] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 240.772190][T10090] CPU: 0 UID: 0 PID: 10090 Comm: syz.0.573 Not tainted syzkaller #0 PREEMPT(full) [ 240.772219][T10090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 240.772230][T10090] Call Trace: [ 240.772237][T10090] [ 240.772245][T10090] dump_stack_lvl+0x16c/0x1f0 [ 240.772275][T10090] sysfs_warn_dup+0x7f/0xa0 [ 240.772300][T10090] sysfs_do_create_link_sd+0x124/0x140 [ 240.772322][T10090] sysfs_create_link+0x61/0xc0 [ 240.772344][T10090] device_add+0x62c/0x1aa0 [ 240.772371][T10090] ? __pfx_device_add+0x10/0x10 [ 240.772395][T10090] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 240.772419][T10090] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 240.772448][T10090] wiphy_register+0x1df4/0x29f0 [ 240.772472][T10090] ? netdev_run_todo+0x864/0x1320 [ 240.772498][T10090] ? __dev_printk+0x1d0/0x270 [ 240.772525][T10090] ? __pfx_wiphy_register+0x10/0x10 [ 240.772565][T10090] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 240.772591][T10090] ieee80211_register_hw+0x2546/0x4120 [ 240.772627][T10090] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 240.772654][T10090] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 240.772671][T10090] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 240.772688][T10090] ? __hrtimer_setup+0x176/0x280 [ 240.772706][T10090] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 240.772738][T10090] ? trace_kmalloc+0x2b/0xd0 [ 240.772755][T10090] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 240.772771][T10090] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 240.772791][T10090] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 240.772813][T10090] ? __asan_memcpy+0x3c/0x60 [ 240.772837][T10090] hwsim_new_radio_nl+0xb51/0x12c0 [ 240.772860][T10090] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 240.772888][T10090] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 240.772910][T10090] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 240.772937][T10090] genl_family_rcv_msg_doit+0x209/0x2f0 [ 240.772959][T10090] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 240.772987][T10090] ? bpf_lsm_capable+0x9/0x10 [ 240.773007][T10090] ? security_capable+0x7e/0x260 [ 240.773024][T10090] ? ns_capable+0xd7/0x110 [ 240.773043][T10090] genl_rcv_msg+0x55c/0x800 [ 240.773066][T10090] ? __pfx_genl_rcv_msg+0x10/0x10 [ 240.773087][T10090] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 240.773115][T10090] netlink_rcv_skb+0x158/0x420 [ 240.773137][T10090] ? __pfx_genl_rcv_msg+0x10/0x10 [ 240.773160][T10090] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 240.773193][T10090] genl_rcv+0x28/0x40 [ 240.773211][T10090] netlink_unicast+0x5a7/0x870 [ 240.773232][T10090] ? __pfx_netlink_unicast+0x10/0x10 [ 240.773258][T10090] netlink_sendmsg+0x8d1/0xdd0 [ 240.773280][T10090] ? __pfx_netlink_sendmsg+0x10/0x10 [ 240.773307][T10090] ____sys_sendmsg+0xa95/0xc70 [ 240.773329][T10090] ? copy_msghdr_from_user+0x10a/0x160 [ 240.773347][T10090] ? __pfx_____sys_sendmsg+0x10/0x10 [ 240.773366][T10090] ? trace_sched_exit_tp+0xd1/0x120 [ 240.773391][T10090] ___sys_sendmsg+0x134/0x1d0 [ 240.773410][T10090] ? __pfx____sys_sendmsg+0x10/0x10 [ 240.773454][T10090] __sys_sendmsg+0x16d/0x220 [ 240.773471][T10090] ? __pfx___sys_sendmsg+0x10/0x10 [ 240.773498][T10090] ? __secure_computing+0x28e/0x3b0 [ 240.773522][T10090] do_syscall_64+0xcd/0x4e0 [ 240.773543][T10090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.773564][T10090] RIP: 0033:0x7f68d7b8ec29 [ 240.773577][T10090] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 240.773592][T10090] RSP: 002b:00007f68d8a04038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 240.773608][T10090] RAX: ffffffffffffffda RBX: 00007f68d7dd6180 RCX: 00007f68d7b8ec29 [ 240.773619][T10090] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 240.773628][T10090] RBP: 00007f68d7c11e41 R08: 0000000000000000 R09: 0000000000000000 [ 240.773638][T10090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.773647][T10090] R13: 00007f68d7dd6218 R14: 00007f68d7dd6180 R15: 00007ffc76485068 [ 240.773669][T10090] [ 241.430249][T10095] loop6: detected capacity change from 0 to 63 [ 241.644012][T10094] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 241.651588][T10094] CPU: 0 UID: 0 PID: 10094 Comm: syz.3.574 Not tainted syzkaller #0 PREEMPT(full) [ 241.651613][T10094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 241.651621][T10094] Call Trace: [ 241.651626][T10094] [ 241.651631][T10094] dump_stack_lvl+0x16c/0x1f0 [ 241.651650][T10094] sysfs_warn_dup+0x7f/0xa0 [ 241.651666][T10094] sysfs_do_create_link_sd+0x124/0x140 [ 241.651683][T10094] sysfs_create_link+0x61/0xc0 [ 241.651699][T10094] device_add+0x62c/0x1aa0 [ 241.651718][T10094] ? __pfx_device_add+0x10/0x10 [ 241.651734][T10094] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 241.651748][T10094] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 241.651766][T10094] wiphy_register+0x1df4/0x29f0 [ 241.651780][T10094] ? netdev_run_todo+0x864/0x1320 [ 241.651795][T10094] ? __dev_printk+0x1d0/0x270 [ 241.651811][T10094] ? __pfx_wiphy_register+0x10/0x10 [ 241.651830][T10094] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 241.651847][T10094] ieee80211_register_hw+0x2546/0x4120 [ 241.651867][T10094] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 241.651884][T10094] ? find_held_lock+0x2b/0x80 [ 241.651898][T10094] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 241.651919][T10094] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 241.651939][T10094] ? __hrtimer_setup+0x176/0x280 [ 241.651959][T10094] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 241.651994][T10094] ? trace_kmalloc+0x2b/0xd0 [ 241.652008][T10094] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 241.652020][T10094] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 241.652036][T10094] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 241.652053][T10094] ? __asan_memcpy+0x3c/0x60 [ 241.652072][T10094] hwsim_new_radio_nl+0xb51/0x12c0 [ 241.652090][T10094] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 241.652112][T10094] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 241.652130][T10094] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 241.652150][T10094] genl_family_rcv_msg_doit+0x209/0x2f0 [ 241.652167][T10094] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 241.652190][T10094] ? bpf_lsm_capable+0x9/0x10 [ 241.652206][T10094] ? security_capable+0x7e/0x260 [ 241.652220][T10094] ? ns_capable+0xd7/0x110 [ 241.652234][T10094] genl_rcv_msg+0x55c/0x800 [ 241.652253][T10094] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.652269][T10094] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 241.652291][T10094] netlink_rcv_skb+0x158/0x420 [ 241.652306][T10094] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.652322][T10094] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 241.652347][T10094] genl_rcv+0x28/0x40 [ 241.652362][T10094] netlink_unicast+0x5a7/0x870 [ 241.652378][T10094] ? __pfx_netlink_unicast+0x10/0x10 [ 241.652392][T10094] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 241.652411][T10094] netlink_sendmsg+0x8d1/0xdd0 [ 241.652427][T10094] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.652448][T10094] ____sys_sendmsg+0xa95/0xc70 [ 241.652465][T10094] ? copy_msghdr_from_user+0x10a/0x160 [ 241.652478][T10094] ? __pfx_____sys_sendmsg+0x10/0x10 [ 241.652507][T10094] ___sys_sendmsg+0x134/0x1d0 [ 241.652521][T10094] ? __pfx____sys_sendmsg+0x10/0x10 [ 241.652553][T10094] __sys_sendmsg+0x16d/0x220 [ 241.652568][T10094] ? __pfx___sys_sendmsg+0x10/0x10 [ 241.652589][T10094] ? __secure_computing+0x28e/0x3b0 [ 241.652609][T10094] do_syscall_64+0xcd/0x4e0 [ 241.652626][T10094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.652638][T10094] RIP: 0033:0x7fae74d8ec29 [ 241.652648][T10094] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.652659][T10094] RSP: 002b:00007fae75c20038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.652669][T10094] RAX: ffffffffffffffda RBX: 00007fae74fd6180 RCX: 00007fae74d8ec29 [ 241.652676][T10094] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 241.652682][T10094] RBP: 00007fae74e11e41 R08: 0000000000000000 R09: 0000000000000000 [ 241.652689][T10094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 241.652695][T10094] R13: 00007fae74fd6218 R14: 00007fae74fd6180 R15: 00007fff81f19398 [ 241.652709][T10094] [ 242.108111][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.403153][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.411578][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.421088][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 242.429518][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 243.435833][T10099] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 243.598326][T10099] CPU: 0 UID: 0 PID: 10099 Comm: syz.1.575 Not tainted syzkaller #0 PREEMPT(full) [ 243.598349][T10099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 243.598357][T10099] Call Trace: [ 243.598361][T10099] [ 243.598366][T10099] dump_stack_lvl+0x16c/0x1f0 [ 243.598385][T10099] sysfs_warn_dup+0x7f/0xa0 [ 243.598401][T10099] sysfs_do_create_link_sd+0x124/0x140 [ 243.598419][T10099] sysfs_create_link+0x61/0xc0 [ 243.598438][T10099] device_add+0x62c/0x1aa0 [ 243.598466][T10099] ? __pfx_device_add+0x10/0x10 [ 243.598485][T10099] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 243.598499][T10099] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 243.598515][T10099] wiphy_register+0x1df4/0x29f0 [ 243.598534][T10099] ? netdev_run_todo+0x864/0x1320 [ 243.598549][T10099] ? __dev_printk+0x1d0/0x270 [ 243.598564][T10099] ? __pfx_wiphy_register+0x10/0x10 [ 243.598583][T10099] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 243.598600][T10099] ieee80211_register_hw+0x2546/0x4120 [ 243.598621][T10099] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 243.598638][T10099] ? find_held_lock+0x2b/0x80 [ 243.598653][T10099] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 243.598666][T10099] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 243.598679][T10099] ? __hrtimer_setup+0x176/0x280 [ 243.598692][T10099] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 243.598717][T10099] ? trace_kmalloc+0x2b/0xd0 [ 243.598730][T10099] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 243.598742][T10099] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 243.598758][T10099] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 243.598775][T10099] ? __asan_memcpy+0x3c/0x60 [ 243.598794][T10099] hwsim_new_radio_nl+0xb51/0x12c0 [ 243.598813][T10099] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 243.598834][T10099] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 243.598852][T10099] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 243.598872][T10099] genl_family_rcv_msg_doit+0x209/0x2f0 [ 243.598890][T10099] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 243.598911][T10099] ? bpf_lsm_capable+0x9/0x10 [ 243.598926][T10099] ? security_capable+0x7e/0x260 [ 243.598940][T10099] ? ns_capable+0xd7/0x110 [ 243.598955][T10099] genl_rcv_msg+0x55c/0x800 [ 243.598972][T10099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 243.598988][T10099] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 243.599010][T10099] netlink_rcv_skb+0x158/0x420 [ 243.599024][T10099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 243.599041][T10099] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 243.599061][T10099] ? netlink_deliver_tap+0x1ae/0xd30 [ 243.599076][T10099] genl_rcv+0x28/0x40 [ 243.599091][T10099] netlink_unicast+0x5a7/0x870 [ 243.599108][T10099] ? __pfx_netlink_unicast+0x10/0x10 [ 243.599123][T10099] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 243.599141][T10099] netlink_sendmsg+0x8d1/0xdd0 [ 243.599158][T10099] ? __pfx_netlink_sendmsg+0x10/0x10 [ 243.599178][T10099] ____sys_sendmsg+0xa95/0xc70 [ 243.599196][T10099] ? copy_msghdr_from_user+0x10a/0x160 [ 243.599209][T10099] ? __pfx_____sys_sendmsg+0x10/0x10 [ 243.599232][T10099] ___sys_sendmsg+0x134/0x1d0 [ 243.599246][T10099] ? __pfx____sys_sendmsg+0x10/0x10 [ 243.599280][T10099] __sys_sendmsg+0x16d/0x220 [ 243.599294][T10099] ? __pfx___sys_sendmsg+0x10/0x10 [ 243.599313][T10099] ? __secure_computing+0x28e/0x3b0 [ 243.599331][T10099] do_syscall_64+0xcd/0x4e0 [ 243.599347][T10099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.599358][T10099] RIP: 0033:0x7f81ded8ec29 [ 243.599369][T10099] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.599379][T10099] RSP: 002b:00007f81dfbcc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 243.599391][T10099] RAX: ffffffffffffffda RBX: 00007f81defd6090 RCX: 00007f81ded8ec29 [ 243.599398][T10099] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 243.599404][T10099] RBP: 00007f81dee11e41 R08: 0000000000000000 R09: 0000000000000000 [ 243.599410][T10099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 243.599417][T10099] R13: 00007f81defd6128 R14: 00007f81defd6090 R15: 00007ffecbaf05a8 [ 243.599434][T10099] [ 244.081028][T10094] loop6: detected capacity change from 0 to 63 [ 244.098899][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 244.098915][ T30] audit: type=1326 audit(1758487264.618:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10086 comm="syz.1.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 244.129236][ T30] audit: type=1326 audit(1758487264.618:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10086 comm="syz.1.575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 244.155343][ T30] audit: type=1326 audit(1758487264.638:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.178588][ T30] audit: type=1326 audit(1758487264.638:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.202332][ T30] audit: type=1326 audit(1758487264.638:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.225886][ T30] audit: type=1326 audit(1758487264.638:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.249144][ T30] audit: type=1326 audit(1758487264.638:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.272446][ T30] audit: type=1326 audit(1758487264.638:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.296259][ T30] audit: type=1326 audit(1758487264.638:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 244.319545][ T30] audit: type=1326 audit(1758487264.638:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10087 comm="syz.3.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fae74d8ec29 code=0x7ffc0000 [ 246.434622][T10161] netlink: 'syz.1.584': attribute type 83 has an invalid length. [ 247.750235][T10177] tipc: Started in network mode [ 247.755219][T10177] tipc: Node identity 568c311bd104, cluster identity 4711 [ 247.818415][T10177] tipc: Enabled bearer , priority 0 [ 247.831500][T10182] netlink: 4 bytes leftover after parsing attributes in process `syz.4.590'. [ 248.174898][T10191] binder: BINDER_SET_CONTEXT_MGR already set [ 248.183418][T10191] binder: 10181:10191 ioctl 4018620d 200000000040 returned -16 [ 248.189453][T10184] tipc: Disabling bearer [ 249.212059][ T93] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 249.375874][ T93] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 249.390511][ T93] usb 5-1: config 0 has no interface number 0 [ 249.410440][ T93] usb 5-1: config 0 interface 119 has no altsetting 0 [ 249.427860][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 249.427877][ T30] audit: type=1400 audit(1758487269.998:719): avc: denied { getopt } for pid=10209 comm="syz.3.595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 249.427992][T10210] netlink: 'syz.3.595': attribute type 1 has an invalid length. [ 249.467121][ T93] usb 5-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 249.476562][ T93] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.486267][ T93] usb 5-1: Product: syz [ 249.495945][ T93] usb 5-1: Manufacturer: syz [ 249.518077][ T93] usb 5-1: SerialNumber: syz [ 249.539571][ T93] usb 5-1: config 0 descriptor?? [ 249.791442][ T93] kaweth 5-1:0.119: Firmware present in device. [ 249.843946][ T93] kaweth 5-1:0.119: Error reading configuration (-71), no net device created [ 249.925616][ T93] kaweth 5-1:0.119: probe with driver kaweth failed with error -5 [ 249.944676][ T93] pegasus 5-1:0.119: probe with driver pegasus failed with error -71 [ 250.014880][ T93] usb 5-1: USB disconnect, device number 13 [ 250.437180][T10253] FAULT_INJECTION: forcing a failure. [ 250.437180][T10253] name failslab, interval 1, probability 0, space 0, times 0 [ 250.458117][T10253] CPU: 1 UID: 0 PID: 10253 Comm: syz.3.600 Not tainted syzkaller #0 PREEMPT(full) [ 250.458142][T10253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 250.458153][T10253] Call Trace: [ 250.458159][T10253] [ 250.458171][T10253] dump_stack_lvl+0x16c/0x1f0 [ 250.458199][T10253] should_fail_ex+0x512/0x640 [ 250.458221][T10253] ? fs_reclaim_acquire+0xae/0x150 [ 250.458246][T10253] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 250.458271][T10253] should_failslab+0xc2/0x120 [ 250.458292][T10253] __kmalloc_noprof+0xd2/0x510 [ 250.458316][T10253] tomoyo_realpath_from_path+0xc2/0x6e0 [ 250.458344][T10253] ? tomoyo_profile+0x47/0x60 [ 250.458364][T10253] tomoyo_path_number_perm+0x245/0x580 [ 250.458385][T10253] ? tomoyo_path_number_perm+0x237/0x580 [ 250.458408][T10253] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 250.458431][T10253] ? find_held_lock+0x2b/0x80 [ 250.458473][T10253] ? find_held_lock+0x2b/0x80 [ 250.458494][T10253] ? hook_file_ioctl_common+0x145/0x410 [ 250.458518][T10253] ? __fget_files+0x20e/0x3c0 [ 250.458543][T10253] security_file_ioctl+0x9b/0x240 [ 250.458569][T10253] __x64_sys_ioctl+0xb7/0x210 [ 250.458598][T10253] do_syscall_64+0xcd/0x4e0 [ 250.458623][T10253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.458639][T10253] RIP: 0033:0x7fae74d8ec29 [ 250.458653][T10253] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 250.458669][T10253] RSP: 002b:00007fae75c41038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 250.458686][T10253] RAX: ffffffffffffffda RBX: 00007fae74fd6090 RCX: 00007fae74d8ec29 [ 250.458696][T10253] RDX: 0000000000000000 RSI: 000000000000540a RDI: 0000000000000007 [ 250.458706][T10253] RBP: 00007fae75c41090 R08: 0000000000000000 R09: 0000000000000000 [ 250.458716][T10253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.458726][T10253] R13: 00007fae74fd6128 R14: 00007fae74fd6090 R15: 00007fff81f19398 [ 250.458750][T10253] [ 250.458787][T10253] ERROR: Out of memory at tomoyo_realpath_from_path. [ 251.183221][T10267] 9pnet_fd: Insufficient options for proto=fd [ 251.276497][T10272] netlink: 'syz.1.605': attribute type 1 has an invalid length. [ 251.838434][T10283] netlink: 64 bytes leftover after parsing attributes in process `syz.3.607'. [ 252.611989][ T93] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 252.847683][ T93] usb 4-1: Using ep0 maxpacket: 16 [ 253.071627][ T93] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.086430][ T93] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 253.139687][ T93] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 253.282159][ T93] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.828286][ T93] usb 4-1: config 0 descriptor?? [ 253.984987][ T30] audit: type=1400 audit(1758487274.428:720): avc: denied { write } for pid=10303 comm="syz.2.611" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 254.027000][T10318] SELinux: policydb magic number 0x7665642f does not match expected magic number 0xf97cff8c [ 254.052272][T10318] SELinux: failed to load policy [ 254.196883][ T30] audit: type=1400 audit(1758487274.748:721): avc: denied { ioctl } for pid=10303 comm="syz.2.611" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 254.221847][ C0] vkms_vblank_simulate: vblank timer overrun [ 254.468845][ T30] audit: type=1400 audit(1758487275.038:722): avc: denied { mount } for pid=10326 comm="syz.4.616" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 254.501465][ T30] audit: type=1400 audit(1758487275.068:723): avc: denied { unmount } for pid=5844 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 254.546149][ T93] HID 045e:07da: Invalid code 65791 type 1 [ 254.608455][ T93] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0015/input/input17 [ 254.652616][ T93] microsoft 0003:045E:07DA.0015: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 254.958951][ T1106] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.155676][ T1106] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.565265][T10351] netlink: 80 bytes leftover after parsing attributes in process `syz.1.621'. [ 255.950425][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.950556][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.965864][ T30] audit: type=1326 audit(1758487276.528:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.965912][ T30] audit: type=1326 audit(1758487276.528:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.996742][ T30] audit: type=1326 audit(1758487276.558:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.996798][ T30] audit: type=1326 audit(1758487276.558:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.998508][ T30] audit: type=1326 audit(1758487276.568:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.999405][ T30] audit: type=1326 audit(1758487276.568:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.999455][ T30] audit: type=1326 audit(1758487276.568:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 255.999537][ T30] audit: type=1326 audit(1758487276.568:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10349 comm="syz.2.622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=238 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 256.027091][ T1106] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.226926][ T5916] usb 4-1: USB disconnect, device number 16 [ 256.422743][ T5858] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 256.459325][ T1106] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.472085][ T5858] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 256.540120][ T5858] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 256.599269][ T5858] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 256.615630][ T5858] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 257.298787][T10375] vxcan1 speed is unknown, defaulting to 1000 [ 257.802101][ T9] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 258.004311][ T9] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 258.019627][T10431] netlink: 24 bytes leftover after parsing attributes in process `syz.2.631'. [ 258.344684][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.394838][ T9] usb 4-1: config 0 descriptor?? [ 258.462747][ T9] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 258.642274][ T9] gp8psk: usb in 128 operation failed. [ 258.648828][ T9] gp8psk: usb in 137 operation failed. [ 258.654467][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 258.665814][ T9] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 258.742811][ T5858] Bluetooth: hci1: command tx timeout [ 258.778785][T10408] netlink: 4 bytes leftover after parsing attributes in process `syz.3.627'. [ 259.535550][ T1106] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 259.582425][ T1106] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 259.593805][ T1106] bond0 (unregistering): Released all slaves [ 259.963059][ T5909] usb 4-1: USB disconnect, device number 17 [ 261.044704][ T5858] Bluetooth: hci1: command tx timeout [ 261.501815][T10511] netlink: 'syz.0.639': attribute type 83 has an invalid length. [ 261.682483][ T5895] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 261.781353][T10530] autofs: Unknown parameter '' [ 262.009014][ T5895] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 262.064529][ T5895] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.079569][T10375] chnl_net:caif_netlink_parms(): no params data found [ 262.117928][ T5895] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 262.127451][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=247 [ 262.151640][ T5895] usb 3-1: Product: syz [ 262.166218][ T5895] usb 3-1: Manufacturer: syz [ 262.262685][ T5895] usb 3-1: SerialNumber: syz [ 262.327175][ T5895] usb 3-1: selecting invalid altsetting 1 [ 262.403883][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 262.403899][ T30] audit: type=1400 audit(1758487282.978:739): avc: denied { write } for pid=10614 comm="syz.3.644" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 262.794306][ T1106] hsr_slave_0: left promiscuous mode [ 262.870756][ T1106] hsr_slave_1: left promiscuous mode [ 262.878554][ T1106] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 262.886393][ T1106] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 262.895104][ T1106] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 262.905362][ T1106] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 262.916444][ T1106] batman_adv: batadv0: Removing interface: team0 [ 262.970306][ T1106] veth1_macvtap: left promiscuous mode [ 263.004450][ T1106] veth1_vlan: left promiscuous mode [ 263.019008][ T1106] veth0_vlan: left promiscuous mode [ 263.035446][ T5895] usb 3-1: selecting invalid altsetting 1 [ 263.045148][ T5895] cdc_ncm 3-1:1.0: bind() failure [ 263.063652][ T5858] Bluetooth: hci1: command tx timeout [ 263.226085][ T5895] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 263.252049][ T5895] cdc_ncm 3-1:1.1: bind() failure [ 263.532628][ T5916] usb 3-1: USB disconnect, device number 17 [ 263.847335][ T1106] team0 (unregistering): Port device team_slave_1 removed [ 263.854730][ T5909] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 263.881762][ T1106] team0 (unregistering): Port device team_slave_0 removed [ 264.012052][ T5909] usb 4-1: Using ep0 maxpacket: 8 [ 264.024139][ T5909] usb 4-1: unable to get BOS descriptor or descriptor too short [ 264.038968][ T5909] usb 4-1: config index 0 descriptor too short (expected 16420, got 36) [ 264.048630][ T5909] usb 4-1: config 7 has an invalid interface number: 6 but max is 0 [ 264.053180][ T7244] smc: removing ib device syz2 [ 264.057673][ T5909] usb 4-1: config 7 has no interface number 0 [ 264.069151][ T5909] usb 4-1: No eUSB2 isoc ep 15 companion for config 7 interface 6 altsetting 254 [ 264.081354][ T5909] usb 4-1: config 7 interface 6 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 264.097935][ T5909] usb 4-1: config 7 interface 6 has no altsetting 0 [ 264.108346][ T5909] usb 4-1: New USB device found, idVendor=1a8d, idProduct=100d, bcdDevice=10.9e [ 264.137750][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.151255][ T5909] usb 4-1: Product: syz [ 264.171632][ T5909] usb 4-1: Manufacturer: syz [ 264.178082][ T5909] usb 4-1: SerialNumber: syz [ 264.516854][T10665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.590450][T10665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.844399][ T43] libceph: connect (1)[c::]:6789 error -101 [ 264.850908][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 264.867528][ T43] libceph: connect (1)[c::]:6789 error -101 [ 264.887808][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 265.022018][ T30] audit: type=1326 audit(1758487285.548:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.099226][ T30] audit: type=1326 audit(1758487285.548:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.143988][ T5858] Bluetooth: hci1: command tx timeout [ 265.158167][ T30] audit: type=1326 audit(1758487285.548:742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.164426][ T43] libceph: connect (1)[c::]:6789 error -101 [ 265.189202][ T30] audit: type=1326 audit(1758487285.548:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.201937][ T5908] vxcan1 speed is unknown, defaulting to 1000 [ 265.213200][ T30] audit: type=1326 audit(1758487285.548:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.241955][ C0] vkms_vblank_simulate: vblank timer overrun [ 265.271212][ T5908] syz2: Port: 1 Link DOWN [ 265.306117][ T30] audit: type=1326 audit(1758487285.548:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.323667][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 265.512971][ T30] audit: type=1326 audit(1758487285.548:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.580320][ T30] audit: type=1326 audit(1758487285.558:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10685 comm="syz.2.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f606bf8ec29 code=0x7ffc0000 [ 265.605495][ T30] audit: type=1400 audit(1758487285.728:748): avc: denied { getopt } for pid=10693 comm="syz.1.649" lport=42044 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 265.639374][T10699] loop6: detected capacity change from 0 to 63 [ 265.677393][ T6027] buffer_io_error: 10 callbacks suppressed [ 265.677417][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 265.711152][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 265.939784][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 266.233962][ T5908] libceph: connect (1)[c::]:6789 error -101 [ 266.241085][ T5908] libceph: mon0 (1)[c::]:6789 connect error [ 266.251118][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 266.271085][ T6027] Buffer I/O error on dev loop6, logical block 0, async page read [ 266.341547][T10734] netlink: 64 bytes leftover after parsing attributes in process `syz.1.651'. [ 266.452456][T10695] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 266.464314][T10695] CPU: 1 UID: 0 PID: 10695 Comm: syz.2.648 Not tainted syzkaller #0 PREEMPT(full) [ 266.464345][T10695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 266.464352][T10695] Call Trace: [ 266.464356][T10695] [ 266.464362][T10695] dump_stack_lvl+0x16c/0x1f0 [ 266.464381][T10695] sysfs_warn_dup+0x7f/0xa0 [ 266.464402][T10695] sysfs_do_create_link_sd+0x124/0x140 [ 266.464419][T10695] sysfs_create_link+0x61/0xc0 [ 266.464434][T10695] device_add+0x62c/0x1aa0 [ 266.464453][T10695] ? __pfx_device_add+0x10/0x10 [ 266.464468][T10695] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 266.464483][T10695] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 266.464499][T10695] wiphy_register+0x1df4/0x29f0 [ 266.464514][T10695] ? netdev_run_todo+0x864/0x1320 [ 266.464529][T10695] ? __dev_printk+0x1d0/0x270 [ 266.464544][T10695] ? __pfx_wiphy_register+0x10/0x10 [ 266.464562][T10695] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 266.464579][T10695] ieee80211_register_hw+0x2546/0x4120 [ 266.464600][T10695] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 266.464619][T10695] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 266.464631][T10695] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 266.464646][T10695] ? __hrtimer_setup+0x176/0x280 [ 266.464660][T10695] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 266.464686][T10695] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 266.464704][T10695] ? hwsim_new_radio_nl+0xa1f/0x12c0 [ 266.464722][T10695] hwsim_new_radio_nl+0xb51/0x12c0 [ 266.464740][T10695] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 266.464761][T10695] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 266.464779][T10695] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 266.464805][T10695] genl_family_rcv_msg_doit+0x209/0x2f0 [ 266.464831][T10695] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 266.464859][T10695] ? bpf_lsm_capable+0x9/0x10 [ 266.464875][T10695] ? security_capable+0x7e/0x260 [ 266.464889][T10695] ? ns_capable+0xd7/0x110 [ 266.464904][T10695] genl_rcv_msg+0x55c/0x800 [ 266.464922][T10695] ? __pfx_genl_rcv_msg+0x10/0x10 [ 266.464938][T10695] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 266.464960][T10695] netlink_rcv_skb+0x158/0x420 [ 266.464974][T10695] ? __pfx_genl_rcv_msg+0x10/0x10 [ 266.464991][T10695] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 266.465015][T10695] genl_rcv+0x28/0x40 [ 266.465030][T10695] netlink_unicast+0x5a7/0x870 [ 266.465046][T10695] ? __pfx_netlink_unicast+0x10/0x10 [ 266.465066][T10695] netlink_sendmsg+0x8d1/0xdd0 [ 266.465085][T10695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 266.465105][T10695] ____sys_sendmsg+0xa95/0xc70 [ 266.465122][T10695] ? copy_msghdr_from_user+0x10a/0x160 [ 266.465136][T10695] ? __pfx_____sys_sendmsg+0x10/0x10 [ 266.465156][T10695] ? __pfx___schedule+0x10/0x10 [ 266.465171][T10695] ___sys_sendmsg+0x134/0x1d0 [ 266.465186][T10695] ? __pfx____sys_sendmsg+0x10/0x10 [ 266.465218][T10695] __sys_sendmsg+0x16d/0x220 [ 266.465231][T10695] ? __pfx___sys_sendmsg+0x10/0x10 [ 266.465250][T10695] ? __secure_computing+0x28e/0x3b0 [ 266.465270][T10695] do_syscall_64+0xcd/0x4e0 [ 266.465285][T10695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.465297][T10695] RIP: 0033:0x7f606bf8ec29 [ 266.465307][T10695] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 266.465325][T10695] RSP: 002b:00007f606cd93038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 266.465336][T10695] RAX: ffffffffffffffda RBX: 00007f606c1d6180 RCX: 00007f606bf8ec29 [ 266.465343][T10695] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 266.465350][T10695] RBP: 00007f606c011e41 R08: 0000000000000000 R09: 0000000000000000 [ 266.465356][T10695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 266.465362][T10695] R13: 00007f606c1d6218 R14: 00007f606c1d6180 R15: 00007ffc2cf2a518 [ 266.465377][T10695] [ 266.855402][T10665] ceph: No mds server is up or the cluster is laggy [ 266.908046][T10375] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.915563][T10375] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.924158][T10375] bridge_slave_0: entered allmulticast mode [ 266.931757][T10375] bridge_slave_0: entered promiscuous mode [ 267.022337][T10375] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.029454][T10375] bridge0: port 2(bridge_slave_1) entered disabled state [ 267.149793][T10375] bridge_slave_1: entered allmulticast mode [ 267.156599][T10375] bridge_slave_1: entered promiscuous mode [ 267.335964][ T5909] option 4-1:7.6: GSM modem (1-port) converter detected [ 267.353762][T10375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 267.423135][ T5909] usb 4-1: USB disconnect, device number 18 [ 267.490126][ T5909] option 4-1:7.6: device disconnected [ 267.560890][T10375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 267.612578][ T5930] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 267.659859][ T30] audit: type=1326 audit(1758487288.228:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 267.716873][T10821] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 267.733218][T10823] vivid-004: ================= START STATUS ================= [ 267.737407][ T30] audit: type=1326 audit(1758487288.228:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 267.764579][T10823] vivid-004: Radio HW Seek Mode: Bounded [ 267.764629][T10823] vivid-004: Radio Programmable HW Seek: false [ 267.764650][T10823] vivid-004: RDS Rx I/O Mode: Block I/O [ 267.764670][T10823] vivid-004: Generate RBDS Instead of RDS: false [ 267.764690][T10823] vivid-004: RDS Reception: true [ 267.764708][T10823] vivid-004: RDS Program Type: 0 inactive [ 267.764732][T10823] vivid-004: RDS PS Name: inactive [ 267.764755][T10823] vivid-004: RDS Radio Text: inactive [ 267.764776][T10823] vivid-004: RDS Traffic Announcement: false inactive [ 267.764798][T10823] vivid-004: RDS Traffic Program: false inactive [ 267.764822][T10823] vivid-004: RDS Music: false inactive [ 267.764845][T10823] vivid-004: ================== END STATUS ================== [ 267.772241][T10821] CPU: 1 UID: 0 PID: 10821 Comm: syz.1.656 Not tainted syzkaller #0 PREEMPT(full) [ 267.772266][T10821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 267.772275][T10821] Call Trace: [ 267.772281][T10821] [ 267.772288][T10821] dump_stack_lvl+0x16c/0x1f0 [ 267.772315][T10821] sysfs_warn_dup+0x7f/0xa0 [ 267.772339][T10821] sysfs_do_create_link_sd+0x124/0x140 [ 267.772363][T10821] sysfs_create_link+0x61/0xc0 [ 267.772385][T10821] device_add+0x62c/0x1aa0 [ 267.772413][T10821] ? __pfx_device_add+0x10/0x10 [ 267.772433][T10821] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 267.772454][T10821] ? ieee80211_set_bitrate_flags+0x243/0x6b0 [ 267.772478][T10821] wiphy_register+0x1df4/0x29f0 [ 267.772498][T10821] ? netdev_run_todo+0x864/0x1320 [ 267.772518][T10821] ? __dev_printk+0x1d0/0x270 [ 267.772540][T10821] ? __pfx_wiphy_register+0x10/0x10 [ 267.772568][T10821] ? ieee80211_init_rate_ctrl_alg+0x125/0x6b0 [ 267.772591][T10821] ieee80211_register_hw+0x2546/0x4120 [ 267.772621][T10821] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 267.772649][T10821] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 267.772667][T10821] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 267.772685][T10821] ? __hrtimer_setup+0x176/0x280 [ 267.772705][T10821] mac80211_hwsim_new_radio+0x3034/0x54d0 [ 267.772740][T10821] ? trace_kmalloc+0x2b/0xd0 [ 267.772758][T10821] ? __kmalloc_node_track_caller_noprof+0x23e/0x510 [ 267.772776][T10821] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 267.772799][T10821] ? hwsim_new_radio_nl+0xa0e/0x12c0 [ 267.772823][T10821] ? __asan_memcpy+0x3c/0x60 [ 267.772849][T10821] hwsim_new_radio_nl+0xb51/0x12c0 [ 267.772874][T10821] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 267.772905][T10821] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 267.772929][T10821] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b4/0x290 [ 267.772957][T10821] genl_family_rcv_msg_doit+0x209/0x2f0 [ 267.772982][T10821] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 267.773012][T10821] ? bpf_lsm_capable+0x9/0x10 [ 267.773033][T10821] ? security_capable+0x7e/0x260 [ 267.773053][T10821] ? ns_capable+0xd7/0x110 [ 267.773079][T10821] genl_rcv_msg+0x55c/0x800 [ 267.773104][T10821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 267.773127][T10821] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 267.773158][T10821] netlink_rcv_skb+0x158/0x420 [ 267.773180][T10821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 267.773205][T10821] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 267.773244][T10821] genl_rcv+0x28/0x40 [ 267.773265][T10821] netlink_unicast+0x5a7/0x870 [ 267.773288][T10821] ? __pfx_netlink_unicast+0x10/0x10 [ 267.773308][T10821] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 267.773335][T10821] netlink_sendmsg+0x8d1/0xdd0 [ 267.773359][T10821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 267.773381][T10821] ? tomoyo_socket_sendmsg_permission+0x14c/0x3c0 [ 267.773411][T10821] ____sys_sendmsg+0xa95/0xc70 [ 267.773435][T10821] ? copy_msghdr_from_user+0x10a/0x160 [ 267.773453][T10821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 267.773488][T10821] ___sys_sendmsg+0x134/0x1d0 [ 267.773509][T10821] ? __pfx____sys_sendmsg+0x10/0x10 [ 267.773557][T10821] __sys_sendmsg+0x16d/0x220 [ 267.773576][T10821] ? __pfx___sys_sendmsg+0x10/0x10 [ 267.773605][T10821] ? __secure_computing+0x28e/0x3b0 [ 267.773631][T10821] do_syscall_64+0xcd/0x4e0 [ 267.773654][T10821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.773669][T10821] RIP: 0033:0x7f81ded8ec29 [ 267.773683][T10821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 267.773698][T10821] RSP: 002b:00007f81dfbab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 267.773714][T10821] RAX: ffffffffffffffda RBX: 00007f81defd6180 RCX: 00007f81ded8ec29 [ 267.773724][T10821] RDX: 0000000000000310 RSI: 0000200000000040 RDI: 0000000000000006 [ 267.773734][T10821] RBP: 00007f81dee11e41 R08: 0000000000000000 R09: 0000000000000000 [ 267.773743][T10821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.773753][T10821] R13: 00007f81defd6218 R14: 00007f81defd6180 R15: 00007ffecbaf05a8 [ 267.773774][T10821] [ 267.775493][T10375] team0: Port device team_slave_0 added [ 267.813377][ T5930] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 268.269120][T10375] team0: Port device team_slave_1 added [ 268.287526][ T30] audit: type=1326 audit(1758487288.228:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.340562][ T30] audit: type=1326 audit(1758487288.228:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.411979][ T30] audit: type=1326 audit(1758487288.228:753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.436774][ T30] audit: type=1326 audit(1758487288.228:754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.464779][ T30] audit: type=1326 audit(1758487288.228:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.488191][ T30] audit: type=1400 audit(1758487288.268:756): avc: denied { connect } for pid=10822 comm="syz.2.657" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 268.493293][ T5908] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 268.508014][ T30] audit: type=1400 audit(1758487288.278:757): avc: denied { write } for pid=10822 comm="syz.2.657" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 268.534951][ T30] audit: type=1326 audit(1758487289.098:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10797 comm="syz.1.656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f81ded8ec29 code=0x7ffc0000 [ 268.574881][ T5930] usb 1-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 268.592032][ T5930] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 268.624760][ T5930] usb 1-1: config 0 descriptor?? [ 268.629760][T10375] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.648977][T10375] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.792035][T10375] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.833803][T10375] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 269.135701][ T5930] cherry 0003:046A:0023.0016: bogus close delimiter [ 269.261335][T10375] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 269.294420][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 269.301327][T10375] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 269.314898][ T5908] usb 3-1: config 0 has an invalid interface number: 192 but max is 0 [ 269.323207][ T5908] usb 3-1: config 0 has no interface number 0 [ 269.329318][ T5908] usb 3-1: config 0 interface 192 has no altsetting 0 [ 269.345663][ T5930] cherry 0003:046A:0023.0016: item 0 1 2 10 parsing failed [ 269.352392][ T5908] usb 3-1: New USB device found, idVendor=0bfd, idProduct=0022, bcdDevice=f4.c6 [ 269.361630][ T5930] cherry 0003:046A:0023.0016: probe with driver cherry failed with error -22 [ 269.383520][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.401848][ T5908] usb 3-1: Product: syz [ 269.410712][ T5908] usb 3-1: Manufacturer: syz [ 269.416155][ T5930] usb 1-1: USB disconnect, device number 11 [ 269.416966][ T5908] usb 3-1: SerialNumber: syz [ 269.442831][ T5908] usb 3-1: config 0 descriptor?? [ 269.478957][T10375] hsr_slave_0: entered promiscuous mode [ 269.564026][T10375] hsr_slave_1: entered promiscuous mode [ 269.586163][T10375] debugfs: 'hsr0' already exists in 'hsr' [ 269.604751][T10375] Cannot create hsr debugfs directory [ 269.661848][ T5908] kvaser_usb 3-1:0.192: error -EPROTO: Cannot get software info [ 269.677472][ T5908] kvaser_usb 3-1:0.192: probe with driver kvaser_usb failed with error -71 [ 269.710940][ T5908] usb 3-1: USB disconnect, device number 18 [ 269.852214][ T9] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 269.928914][T10375] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 269.951518][T10375] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 269.985919][T10375] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 270.006340][T10375] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 270.028989][ T9] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 270.092766][ T9] usb 4-1: config 0 has no interface number 0 [ 270.290545][ T9] usb 4-1: config 0 interface 119 has no altsetting 0 [ 270.410576][ T9] usb 4-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 270.410776][T11018] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=11018 comm=syz.1.661 [ 270.425825][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.479649][ T9] usb 4-1: Product: syz [ 270.491200][ T9] usb 4-1: Manufacturer: syz [ 270.506779][ T9] usb 4-1: SerialNumber: syz [ 270.535769][ T9] usb 4-1: config 0 descriptor?? [ 270.576669][T10375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 270.769780][T10375] 8021q: adding VLAN 0 to HW filter on device team0 [ 270.800537][ T9] kaweth 4-1:0.119: Firmware present in device. [ 270.815500][ T1106] bridge0: port 1(bridge_slave_0) entered blocking state [ 270.822713][ T1106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 270.834219][ T9] kaweth 4-1:0.119: Error reading configuration (-71), no net device created [ 270.849346][ T9] kaweth 4-1:0.119: probe with driver kaweth failed with error -5 [ 270.881946][ T3535] bridge0: port 2(bridge_slave_1) entered blocking state [ 270.889146][ T3535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 270.903206][ T9] pegasus 4-1:0.119: probe with driver pegasus failed with error -71 [ 270.927468][ T9] usb 4-1: USB disconnect, device number 19 [ 271.742692][T11086] netlink: 64 bytes leftover after parsing attributes in process `syz.1.671'. [ 272.363241][ T5853] Bluetooth: hci1: command 0x0405 tx timeout [ 272.496263][T10375] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 272.694283][ T5930] IPVS: starting estimator thread 0... [ 272.782134][T11114] IPVS: using max 37 ests per chain, 88800 per kthread [ 273.020150][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 273.020164][ T30] audit: type=1400 audit(1758487293.588:763): avc: denied { write } for pid=11117 comm="syz.1.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 273.145587][ T30] audit: type=1400 audit(1758487293.708:764): avc: denied { unmount } for pid=5850 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 273.225189][T11129] tmpfs: User quota inode hardlimit too large. [ 273.352115][ T30] audit: type=1400 audit(1758487293.798:765): avc: denied { mounton } for pid=11117 comm="syz.1.676" path="/166/file0" dev="tmpfs" ino=873 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 273.417386][T11130] netlink: 1 bytes leftover after parsing attributes in process `syz.0.677'. [ 273.987586][T10375] veth0_vlan: entered promiscuous mode [ 274.055643][T10375] veth1_vlan: entered promiscuous mode [ 274.265361][T10375] veth0_macvtap: entered promiscuous mode [ 274.330024][T10375] veth1_macvtap: entered promiscuous mode [ 275.067216][T11142] orangefs_mount: mount request failed with -4 [ 275.093613][T10375] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 275.371688][T10375] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 275.468516][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.493719][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.515706][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.554954][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.547478][ T9659] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.717280][ T9659] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 276.729795][ T9657] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.780723][ T9657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 276.948457][ T30] audit: type=1400 audit(1758487297.518:766): avc: denied { mounton } for pid=10375 comm="syz-executor" path="/root/syzkaller.tWKuk6/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 277.062438][ T1208] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 277.409397][ T1208] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 277.422080][ T1208] usb 4-1: config 0 has no interface number 0 [ 277.557841][ T1208] usb 4-1: config 0 interface 119 has no altsetting 0 [ 278.264859][ T1208] usb 4-1: New USB device found, idVendor=066b, idProduct=2202, bcdDevice=19.34 [ 278.289814][ T1208] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.299046][ T1208] usb 4-1: Product: syz [ 278.310525][ T1208] usb 4-1: Manufacturer: syz [ 278.422240][ T1208] usb 4-1: SerialNumber: syz [ 278.429631][ T1208] usb 4-1: config 0 descriptor?? [ 278.903986][ T1208] kaweth 4-1:0.119: Firmware present in device. [ 278.921204][ T1208] kaweth 4-1:0.119: Error reading configuration (-71), no net device created [ 279.198461][ T1208] kaweth 4-1:0.119: probe with driver kaweth failed with error -5 [ 279.373055][ T1208] pegasus 4-1:0.119: probe with driver pegasus failed with error -71 [ 279.741512][ T1208] usb 4-1: USB disconnect, device number 20 [ 280.039043][T11269] netlink: 24 bytes leftover after parsing attributes in process `syz.0.693'. [ 280.096707][T11268] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000031: 0000 [#1] SMP KASAN NOPTI [ 280.108783][T11268] KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f] [ 280.117203][T11268] CPU: 1 UID: 0 PID: 11268 Comm: syz.0.693 Not tainted syzkaller #0 PREEMPT(full) [ 280.126495][T11268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 280.136550][T11268] RIP: 0010:kasan_byte_accessible+0x15/0x30 [ 280.142447][T11268] Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 8e c0 75 09 66 66 2e 0f 1f 84 00 00 00 [ 280.162054][T11268] RSP: 0018:ffffc9001c29f8a0 EFLAGS: 00010282 [ 280.168107][T11268] RAX: dffffc0000000000 RBX: 0000000000000188 RCX: 0000000000000000 [ 280.176059][T11268] RDX: 0000000000000000 RSI: ffffffff8b968c22 RDI: dffffc0000000031 [ 280.184011][T11268] RBP: 0000000000000188 R08: 0000000000000001 R09: 0000000000000000 [ 280.191964][T11268] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8b968c22 [ 280.199917][T11268] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 280.207866][T11268] FS: 00007f68d8a466c0(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000 [ 280.216776][T11268] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 280.223340][T11268] CR2: 0000001b32015ff8 CR3: 0000000078c2d000 CR4: 00000000003526f0 [ 280.231296][T11268] Call Trace: [ 280.234572][T11268] [ 280.237482][T11268] __kasan_check_byte+0x13/0x50 [ 280.242318][T11268] lock_acquire+0xfc/0x350 [ 280.246715][T11268] ? __pfx___might_resched+0x10/0x10 [ 280.251989][T11268] down_write+0x92/0x200 [ 280.256220][T11268] ? kernfs_remove_by_name_ns+0x3d/0x110 [ 280.261831][T11268] ? __pfx_down_write+0x10/0x10 [ 280.266669][T11268] kernfs_remove_by_name_ns+0x3d/0x110 [ 280.272107][T11268] driver_remove_file+0x4a/0x60 [ 280.276947][T11268] bus_remove_driver+0x224/0x2c0 [ 280.281871][T11268] driver_unregister+0x76/0xb0 [ 280.286620][T11268] comedi_device_detach_locked+0x12f/0xa50 [ 280.292426][T11268] do_devconfig_ioctl+0x555/0x710 [ 280.297440][T11268] ? __mutex_lock+0x1c5/0x1060 [ 280.302190][T11268] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 280.307729][T11268] ? find_held_lock+0x2b/0x80 [ 280.312397][T11268] comedi_unlocked_ioctl+0x165d/0x2f00 [ 280.317852][T11268] ? futex_wake+0x1ad/0x530 [ 280.322351][T11268] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 280.328140][T11268] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 280.334016][T11268] ? do_vfs_ioctl+0x128/0x14f0 [ 280.338779][T11268] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 280.343787][T11268] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 280.350624][T11268] ? hook_file_ioctl_common+0x145/0x410 [ 280.356148][T11268] ? selinux_file_ioctl+0x180/0x270 [ 280.361328][T11268] ? selinux_file_ioctl+0xb4/0x270 [ 280.366422][T11268] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 280.372208][T11268] __x64_sys_ioctl+0x18e/0x210 [ 280.376955][T11268] do_syscall_64+0xcd/0x4e0 [ 280.381444][T11268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.387312][T11268] RIP: 0033:0x7f68d7b8ec29 [ 280.391705][T11268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 280.411291][T11268] RSP: 002b:00007f68d8a46038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 280.419679][T11268] RAX: ffffffffffffffda RBX: 00007f68d7dd5fa0 RCX: 00007f68d7b8ec29 [ 280.427627][T11268] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000005 [ 280.435572][T11268] RBP: 00007f68d7c11e41 R08: 0000000000000000 R09: 0000000000000000 [ 280.443518][T11268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.451464][T11268] R13: 00007f68d7dd6038 R14: 00007f68d7dd5fa0 R15: 00007ffc76485068 [ 280.459419][T11268] [ 280.462414][T11268] Modules linked in: [ 280.467792][T11268] ---[ end trace 0000000000000000 ]--- [ 280.644526][ T30] audit: type=1400 audit(1758487301.198:767): avc: denied { mount } for pid=11266 comm="syz.0.693" name="/" dev="autofs" ino=19309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 280.657602][T11268] RIP: 0010:kasan_byte_accessible+0x15/0x30 [ 280.819209][T11268] Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 8e c0 75 09 66 66 2e 0f 1f 84 00 00 00 [ 280.851615][T11268] RSP: 0018:ffffc9001c29f8a0 EFLAGS: 00010282 [ 280.858512][T11268] RAX: dffffc0000000000 RBX: 0000000000000188 RCX: 0000000000000000 [ 280.866989][T11268] RDX: 0000000000000000 RSI: ffffffff8b968c22 RDI: dffffc0000000031 [ 280.875557][ T30] audit: type=1400 audit(1758487301.248:768): avc: denied { read } for pid=5202 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 280.899508][T11268] RBP: 0000000000000188 R08: 0000000000000001 R09: 0000000000000000 [ 280.908479][T11268] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8b968c22 [ 280.941104][T11268] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 280.951199][ T30] audit: type=1400 audit(1758487301.248:769): avc: denied { search } for pid=5202 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 281.002783][T11268] FS: 00007f68d8a466c0(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000 [ 281.012135][T11268] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 281.018739][T11268] CR2: 0000000000000008 CR3: 0000000078c2d000 CR4: 00000000003526f0 [ 281.026817][ T30] audit: type=1400 audit(1758487301.248:770): avc: denied { search } for pid=5202 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 281.048981][T11268] Kernel panic - not syncing: Fatal exception [ 281.055282][T11268] Kernel Offset: disabled [ 281.059586][T11268] Rebooting in 86400 seconds..