last executing test programs: 9m59.865750486s ago: executing program 0 (id=131): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0xf0b, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}}, 0x4000000) (async) r0 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r2, @ANYBLOB="1000018004000480080001"], 0x28}}, 0x0) (async) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000040)=0x16) (async, rerun: 32) ioctl$TCSETSW2(r3, 0x402c542c, &(0x7f00000000c0)={0xffdfffd8, 0x13ffffff, 0x4, 0xe26a, 0xff, "f539ffff0f000000000000000000000dda00", 0x8, 0x81}) (rerun: 32) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0x48) 9m59.707633441s ago: executing program 0 (id=132): io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000006040), 0x803) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8001) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24040832}, 0xc094) socket$inet_udplite(0x2, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x38, &(0x7f0000000040)=0x5) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r5 = dup2(r4, r4) ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x1, 0x40000000, 0x10}) ioctl$BLKTRACESTART(r4, 0x1274, 0x0) ioctl$BLKTRACETEARDOWN(r5, 0x1276, 0x0) r6 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r6, 0x0, 0xb8) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x0, 0x0) r7 = syz_io_uring_setup(0x2a1c, &(0x7f0000000440)={0x0, 0x3e13, 0x0, 0x0, 0xf6}, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_register$IORING_UNREGISTER_RING_FDS(r7, 0x15, &(0x7f0000001c00)=[{0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0}], 0x2) 9m57.962328227s ago: executing program 0 (id=135): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11000000040000000400000022"], 0x48) r6 = socket(0x2c, 0x3, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="110000000400000004000000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000014000000"], 0x50) socket$nl_route(0x10, 0x3, 0x0) futex_waitv(&(0x7f0000001b00)=[{0x3, 0x0, 0x6}], 0x1, 0x0, 0x0, 0x1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r7, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r6}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r5, &(0x7f0000000140), &(0x7f0000000080)=@udp=r6}, 0x20) close_range(r4, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_getscheduler(r0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r8}, 0xe) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r9, &(0x7f0000000040)=0x1c8, 0x12) r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TCSETSF(r10, 0x5457, &(0x7f0000000000)={0x0, 0x629, 0xffffffff, 0x0, 0x7, "7a58bea88a00"}) 9m56.71585878s ago: executing program 0 (id=137): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x64, 0x30, 0x1, 0x8, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x1, 0x30000001}, 0x3}}]}, {0x4, 0x4}, {0xc, 0x7, {0xffffffe4}}, {0xc}}}]}]}, 0x64}}, 0x0) 9m56.45128349s ago: executing program 0 (id=141): ioctl$MON_IOCH_MFLUSH(0xffffffffffffffff, 0x9208, 0x8) (async) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@multicast, @remote, @val={@val={0x88a8, 0x1, 0x1, 0x1}, {0x8100, 0x1}}, {@canfd={0xd, {{0x1, 0x1, 0x0, 0x1}, 0x18, 0x1, 0x0, 0x0, "29f75cb5cea38293309e586c26854f976e2db5d2a1255c778c726cca97a291e2ce8ec88a9dd50fdb63ac07a2d4a57fb3e5dae68f6e6ca21728c4a92c6c5eb5f1"}}}}, &(0x7f0000000080)={0x1, 0x1, [0x8c3, 0xc84, 0xd5b, 0xbb]}) read$FUSE(0xffffffffffffffff, &(0x7f00000000c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r1 = syz_open_procfs$pagemap(r0, &(0x7f0000002100)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000002180)={0x60, 0x1, &(0x7f00003ff000/0xc00000)=nil, &(0x7f0000a72000/0x4000)=nil, 0x3f4e, &(0x7f0000002140)=[{0x6, 0x2b7, 0x3}, {0x5, 0x1, 0x14b2}], 0x2, 0x0, 0x16, 0xc, 0x0, 0x6}) (async) r2 = syz_open_dev$usbfs(&(0x7f0000002200), 0x9, 0x8082) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000002300)=@urb_type_bulk={0x3, {0x5, 0x1}, 0x8, 0x45, &(0x7f0000002240)="4a54b99907cd81a63076ad202e4f09eb61ba0e5a79516efca7c9", 0x1a, 0x200, 0x6, 0x8, 0x2, 0x4, &(0x7f0000002280)="9def7f5188a98395f34b0d3edf49038fc4808ff5ef8e4192609642c71ea6de1818721cc920fbdc5cb9e4b003fa56a31e1d5648e885c13380ae3ea7576b5e62ad63b5729109a6d23481c486df0d0b530877a41714a3f835119d6a"}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000002340)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000002540)={&(0x7f0000002380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002500)={&(0x7f00000023c0)={0x10c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x80000001}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1ff}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xd}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x84}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xe5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, '\x00', 0x3d}}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x101}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x4}}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x8cd) sched_setscheduler(r0, 0x0, &(0x7f0000002580)=0x100) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000002600), r3) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r3, &(0x7f00000026c0)={&(0x7f00000025c0), 0xc, &(0x7f0000002680)={&(0x7f0000002640)={0x24, r4, 0x300, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x24}}, 0x40810) (async, rerun: 64) r5 = socket(0x27, 0x3, 0x8e60) (async, rerun: 64) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002740), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000002800)={&(0x7f0000002700)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000027c0)={&(0x7f0000002780)={0x2c, r6, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1c, 0x18}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000800}, 0x240088c5) r7 = syz_io_uring_complete(0x0) recvmmsg$unix(r7, &(0x7f0000004b40)=[{{&(0x7f0000002840), 0x6e, &(0x7f0000004ac0)=[{&(0x7f00000028c0)=""/18, 0x12}, {&(0x7f0000002900)=""/70, 0x46}, {&(0x7f0000002980)=""/4096, 0x1000}, {&(0x7f0000003980)=""/55, 0x37}, {&(0x7f00000039c0)=""/102, 0x66}, {&(0x7f0000003a40)=""/42, 0x2a}, {&(0x7f0000003a80)=""/33, 0x21}, {&(0x7f0000003ac0)=""/4096, 0x1000}], 0x8}}], 0x1, 0x40000030, &(0x7f0000004b80)={0x0, 0x989680}) (async) r8 = socket$can_raw(0x1d, 0x3, 0x1) (async, rerun: 64) getsockname$packet(r5, &(0x7f0000004bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004c00)=0x14) (async, rerun: 64) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000004c80), r3) sendmsg$IPVS_CMD_DEL_DEST(r7, &(0x7f0000004e00)={&(0x7f0000004c40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000004dc0)={&(0x7f0000004cc0)={0xe0, r9, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x64, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xffc0}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x31}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x13}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4451}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x40}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xffffff0e}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0xe0}}, 0x0) (async, rerun: 32) mount$9p_rdma(&(0x7f0000004e40), &(0x7f0000004e80)='./file0\x00', 0xfffffffffffffffe, 0x2850020, &(0x7f0000004ec0)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x9}}, {@sq={'sq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x80000001}}, {@sq={'sq', 0x3d, 0x1c0000000000000}}], [{@appraise_type}, {@subj_type={'subj_type', 0x3d, '#^\'\''}}]}}) (async, rerun: 32) r10 = socket$igmp6(0xa, 0x3, 0x2) (async, rerun: 32) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000004f80)={0x0, 0x4, 0xeca}) (rerun: 32) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r10, 0xc400941d, &(0x7f0000005380)={r11, 0x2, 0x1}) (async) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000057c0), r7) sendmsg$IPVS_CMD_NEW_SERVICE(r7, &(0x7f0000005880)={&(0x7f0000005780)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000005840)={&(0x7f0000005800)={0x20, r12, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xa080}, 0x20000080) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) kcmp(r0, r0, 0x4, r7, r8) listen(r10, 0x6) 9m56.237100195s ago: executing program 0 (id=143): syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c00000001090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0xfffffffffffffffc, 0x121183) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000180)={&(0x7f00000000c0)=[{0xe, 0x1000, 0x0, 0x0}], 0x1}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x1, 0x4800100b, r1, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x1) sendfile(r1, r3, 0x0, 0x4) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_9p2000}]}}) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x40, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e092000000000000109022400010000000009040009010300010009210500000122050009058103"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) (async) syz_usb_control_io(r9, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) r10 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x12191, 0x8000, 0x400246}, &(0x7f0000000340), &(0x7f00000006c0)) 9m41.128833799s ago: executing program 32 (id=143): syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c00000001090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0xfffffffffffffffc, 0x121183) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000180)={&(0x7f00000000c0)=[{0xe, 0x1000, 0x0, 0x0}], 0x1}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x1, 0x4800100b, r1, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x1) sendfile(r1, r3, 0x0, 0x4) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_9p2000}]}}) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x40, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e092000000000000109022400010000000009040009010300010009210500000122050009058103"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) (async) syz_usb_control_io(r9, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) r10 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x12191, 0x8000, 0x400246}, &(0x7f0000000340), &(0x7f00000006c0)) 8.570486935s ago: executing program 3 (id=2405): socket$key(0xf, 0x3, 0x2) semop(0x0, &(0x7f00000000c0)=[{0x4, 0xb}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x854}, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x2, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x34, r6, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000006000000140008"], 0x28}}, 0x8000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r8 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r8) execveat(r8, 0x0, 0x0, 0x0, 0x400) r9 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b000100000000090400000101292000090509"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) r10 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r10, 0xc0d05640, &(0x7f0000000000)={0xa, @pix_mp={0x9, 0x3, 0x32315659, 0x4, 0x1, [{0x400, 0x10}, {0x5, 0xc}, {0x2}, {0x2, 0x3532}, {0x7fff, 0x7}, {0x9, 0xa}, {0x2, 0x1000}, {0x7, 0x401}], 0x0, 0x63, 0x1, 0x0, 0x7}}) shutdown(r0, 0x1) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) fsopen(&(0x7f0000000580)='sysv\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) 7.993297957s ago: executing program 2 (id=2412): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3, 0x88582) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x8c082) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000001280)={r0, 0x5, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7, 0x0, "fee8da64c60000007b120000000a00008f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac0000000000000000000000000000000300", "0000000000000008000000000000b60500874028161db2214e00", [0x20000000c00, 0x6]}}) 7.879362281s ago: executing program 2 (id=2413): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x7c}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000940)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/sctp\x00') getdents64(r4, &(0x7f0000000a80)=""/4085, 0xff5) getdents(r4, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000640)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f0000000380)={0x258, 0x2, 0x1, 0x201, 0x0, 0x0, {0xdef3f0647e2c8b2}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_TUPLE_ORIG={0x84, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xb4}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @local}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_TUPLE_MASTER={0x90, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_FILTER={0x1c, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x80}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x588}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x8}]}, @CTA_SEQ_ADJ_ORIG={0x2c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x87}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xfffffffe}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x3}]}, @CTA_TUPLE_MASTER={0x8c, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x36}}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_NAT_DST={0x4c, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}]}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @private=0xa010101}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x258}, 0x1, 0x0, 0x0, 0x4000018}, 0x81) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x81, 0x0, 'queue0\x00'}) write$sndseq(r5, &(0x7f0000000380)=[{0x84, 0x77, 0x0, 0x0, @time={0xe, 0x428}, {0xfd}, {0x7, 0x9}, @raw32={[0x2, 0x6, 0x8000000]}}, {0x6, 0x3, 0x9, 0x3, @tick=0x1, {0x9, 0x5}, {0xce, 0x2}, @connect={{0x10, 0x3}, {0x6, 0xb}}}, {0x3, 0x8, 0xe8, 0x2, @tick=0x80, {0x80, 0x10}, {0x2}, @quote={{0x6, 0x3}, 0xc}}], 0x54) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r6, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x8, {0x0, 0xdc}, {}, @result}], 0x1c) 6.753565592s ago: executing program 5 (id=2418): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x15e2c}]}}]}, 0x44}}, 0x20004094) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x1, 0x1000000) 6.548846619s ago: executing program 5 (id=2420): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b7403340861a22753635f10203010902120001000000000904"], 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000003c0)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r2}, 0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x18, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000200)={0x0, 0xe, 0x34, "9771390bae58311524d403236432d2c69df2237a58671a6f418430f37c60631d3727dbf635080dd565e6ee09f9d92829c8363f40"}, &(0x7f00000002c0)={0xa1, 0x1, 0x400, "ee4c91839fa8067952b90ff1a5b780bee9a0c0d21b628750aea00d1a92bc2c216fb18b741acb7468bb306b10ccd494898988b2539a5e90e02d49c5c55b32fab29a2df35f409118f4c6bf19e0713d8af9aebadf815da255b1bdc0ef7970a771146b472435712de1f36fb43e6c925f3fc314441d358f8296cad7ebc46d64346adf5b5894f09295b41c5d9db04de26b228409d9bf32f3b7089bbff4a8521cac1d8d1fdc36850176f2a33d214cc7ecff7470664ff4c11460d05b7b0ecee5a1d2f770d1c6ff376d867c2b29bb896d75a25d04bb0088c21baf2d03334aecaab44be5e055dc2be0fc457ab9bf1ddc29b5a5f0f49360f06db56bf5164a7c5f8e8df6dbbb74eb0ba6e7732730cdf993de9c5d2b1902356f61d9817f55ed61418681f154840923e56b15a2d0f8db02961857d3c6c117d83435673d6aa4307d5af742cce8c3502d3a7cb246876868a00ada2ad414cc40565e596c3a633f8ad44bdb26fa5cbb0d1210e4ece4dd1070ee91c5ff058a40d4889a22f7a6c038507dcad50e20dfd73ea0c63e9df3418ac21f04244ee5bf25ae8019cb08a3a96546fa1ebbac20e8cb78089c32aa4c4ec3900be1ff435d4c823d9ff90a3b89ff570daac9cb0de8aedf70789128deb93dc3740732d508f77988f1fffdf7a3d0394e68aec052940d14960f6958b9d840843126977dbf70513d085bae44454f3ecaaaad3c7e4046eccdcceac968fe431a52e320445588b7562c1afbb4884bef7fe2d4f7856c2c1004a47d4e34aa8ff3042aecaa823666b4310bd032576e6251a4dba4e63af4ca0a34bb332bc56a353fd724571bc85271a04d7b8730e66ea75538f3af9f0a114c8ad7870318d1d9fd0172b4b6f89ac5f193a7b8455bcde52b4774358cb07d0923812b27faf260fdb4ee6b0f7b69bb8d96a9a3a9695ff1f3609c2ed46ed487e45f5748975953a1df595d219870245fdb8ff8371a9685578afad500fd0b837f8552a6b572b7ca61d56b381d7c6e0c4b165c2a4cabc3238dae21ab748414ae3875970972d7d4e086f0908c57ed96ec18fca2beb6921e70ce9c4b71e0dc4325cfea9a6b8edf5ce4913345bb41e107ccf9036a3fbb5c331cde8b7c5e1475cdf2ee29f65aafc7fde1faecf5d26bab0b9081f3e2ce6d095f7dd7f7c63f21085d36972cebb29a1161ad5d376aa8cb5e9bc2c263a970fb284f931c321fa035ee6fd37a57e0677b08f0733c8c561a7c68c0a933e8aea9b6f08a388833b37f80c7a2183a2146e2e82bc2694139fbce186c118f479661f748ec3ed3279565f2590f3ff9c3b3cf629166fa969a6da6a724963c0ede610f336c14d8afb2fb4b93c0602344703b018955f227a9963c76dfb3106efa1445845731f546406484cc12f855ccebd621247c0a23ea63e9cb4b15ecfe4633b35dc47cc9988554fa51f83336bd34910ad3a8c3a6820a"}, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 6.426357101s ago: executing program 1 (id=2421): r0 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) recvmmsg(r1, &(0x7f0000002ec0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000000, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_emit_ethernet(0x66, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000001aaaaaaaaaa1686dd60f53a0400303afffe880000000000000000000000000001ff02000000000000000000000000000102008078000005026050835900000000fc010000000000000000000000000000fe80000000000000740ea01c89"], 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x101a02, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x80, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0xa100, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x4, &(0x7f0000ffd000/0x1000)=nil) r4 = syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) sched_setscheduler(r4, 0x5, &(0x7f0000000000)=0x7) close(0x3) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e20, @private=0xa010102}, {0x2, 0x4e21, @remote}, 0x56, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0x5, 0x7}) 6.196210141s ago: executing program 1 (id=2422): r0 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) recvmmsg(r1, &(0x7f0000002ec0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000000, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_emit_ethernet(0x66, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000001aaaaaaaaaa1686dd60f53a0400303afffe880000000000000000000000000001ff02000000000000000000000000000102008078000005026050835900000000fc010000000000000000000000000000fe80000000000000740ea01c89"], 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x101a02, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x80, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0xa100, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x4, &(0x7f0000ffd000/0x1000)=nil) r4 = syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) sched_setscheduler(r4, 0x5, &(0x7f0000000000)=0x7) close(0x3) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e20, @private=0xa010102}, {0x2, 0x4e21, @remote}, 0x56, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0x5, 0x7}) 6.134796421s ago: executing program 2 (id=2423): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$kvm(0xffffffffffffff9c, 0x0, 0x8082, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c000000190001093ebd700080000000021810000000fd010000000008000100ac141400080005000a0101021800168014000300fc0000000000000000000000000000000600150002000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000340)={0x0, 0x3}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c20000ec1604b45adbde08004500005c0000000000019078ac14aa05009085e00000e0400000000000000000070000e0000001ac14142583030007030044249f037f00008900000000ac1414bbfffffffd0000000000000000ac141400"/106], 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r5 = socket(0x1000000010, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x8, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x9a, 0xfffffffe}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff00000000a4040000000002000f030000000000003404000001ed0a0014040000170000801c400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc0700bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c398ab724577fd742bf44cdd8489086e61aa3cb1d3ab3dac8183102fe6fc8a038e3868a0592811446867969f0fb3f547e83c4ca35aac023f09f15bb0acb3cdc6efd9b0e9df56af7fda01280a3"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bind$inet6(r6, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r6, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r6, 0x2) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$VFAT_IOCTL_READDIR_BOTH(r7, 0x82307201, &(0x7f0000000640)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) unshare(0x42000000) 5.629102828s ago: executing program 1 (id=2425): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000200004801c0001800b00010072656a65637400"], 0x74}}, 0x3000000) 5.503675056s ago: executing program 1 (id=2426): r0 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f0000000340)=ANY=[@ANYRES32], 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)="7ce4", 0x2}], 0x1, 0x0, 0x0, 0x40811}, 0x20048080) accept4(r2, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x2}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0xf, &(0x7f0000000080)=0x3, 0x2) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000004c0)={0x0, @broadcast, @initdev}, &(0x7f0000000500)=0xc) sendmsg$inet(r4, &(0x7f00000005c0)={&(0x7f0000000080)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000180)="3cafb7f6c43fe2453e84bcce0c80d1672573134ce12d6e7c4f91add29323a3eded75c6629d5dd59fa07844c67aa7dc17a4bbc8752cf378fb90ed112cf8a1a64bda8aa12f1290d7b41d779717b955451218ee1cf3f768864c0312f0c46551f5fe8561fd90ed472e92419fc957703ae5a36bd7c2407cb4b45cbe029d39fa241907af", 0x81}, {&(0x7f00000002c0)="7b0379f13b3ddfaea4cbdc58aa9a311793ea002669a758958481acfaf26cda90faecd4baceedb932db7826446ac11d9ef444613bd43e458876e959a49ae86dc69757c6da539bcb2d032723f81e9ff79dcf03e6e223cddaafd9d98ecf8f15a81b068cfb739d24285e5815a7", 0x6b}, {&(0x7f0000000380)="e517772d88f265ebe6ba6791b7e4a2e6fc94592eb8b6bfef3d2fa42bb2b49f4f58e8edde47a996a735f8e2c8efc2dffe1c9b4ca349ed35652dc3716530e3dbca36570a00f1d0b5d7369d723dc37d35cf975a1535e86d4b48ad03c3e609013d1e54c61e9288346be32169361eb9556c962d6b9ba5e79fb96935c72ca4066cf4047751f33dcc6af3f059cf3779961c3576fe3fb7b9", 0x94}, {&(0x7f0000000440)="c09070162bf29f50e4b02b742241e354aaabb5bd17c894c70ef20b4b152861f264f6a9b81e77ba55a94109363e22b0e20061b6eba208505151f578c75e1e829c10803cb9852aafdecac299c950819b70", 0x50}], 0x4, &(0x7f0000000540)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @empty, @local}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfff}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}], 0x68}, 0x4801) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}) r6 = socket(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4c, &(0x7f0000000000)=0xfffffffe, 0x4) ioctl(r6, 0x8916, &(0x7f0000000000)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6}]}}}]}, 0x50}}, 0x0) ioctl(r6, 0x8936, &(0x7f0000000000)) socket$inet(0x2, 0x3, 0x8d) (async) setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f0000000340)=ANY=[@ANYRES32], 0x1) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) (async) accept$alg(r1, 0x0, 0x0) (async) sendmsg$alg(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)="7ce4", 0x2}], 0x1, 0x0, 0x0, 0x40811}, 0x20048080) (async) accept4(r2, 0x0, 0x0, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x2}, 0xe) (async) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0xf, &(0x7f0000000080)=0x3, 0x2) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000004c0)={0x0, @broadcast, @initdev}, &(0x7f0000000500)=0xc) (async) sendmsg$inet(r4, &(0x7f00000005c0)={&(0x7f0000000080)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000180)="3cafb7f6c43fe2453e84bcce0c80d1672573134ce12d6e7c4f91add29323a3eded75c6629d5dd59fa07844c67aa7dc17a4bbc8752cf378fb90ed112cf8a1a64bda8aa12f1290d7b41d779717b955451218ee1cf3f768864c0312f0c46551f5fe8561fd90ed472e92419fc957703ae5a36bd7c2407cb4b45cbe029d39fa241907af", 0x81}, {&(0x7f00000002c0)="7b0379f13b3ddfaea4cbdc58aa9a311793ea002669a758958481acfaf26cda90faecd4baceedb932db7826446ac11d9ef444613bd43e458876e959a49ae86dc69757c6da539bcb2d032723f81e9ff79dcf03e6e223cddaafd9d98ecf8f15a81b068cfb739d24285e5815a7", 0x6b}, {&(0x7f0000000380)="e517772d88f265ebe6ba6791b7e4a2e6fc94592eb8b6bfef3d2fa42bb2b49f4f58e8edde47a996a735f8e2c8efc2dffe1c9b4ca349ed35652dc3716530e3dbca36570a00f1d0b5d7369d723dc37d35cf975a1535e86d4b48ad03c3e609013d1e54c61e9288346be32169361eb9556c962d6b9ba5e79fb96935c72ca4066cf4047751f33dcc6af3f059cf3779961c3576fe3fb7b9", 0x94}, {&(0x7f0000000440)="c09070162bf29f50e4b02b742241e354aaabb5bd17c894c70ef20b4b152861f264f6a9b81e77ba55a94109363e22b0e20061b6eba208505151f578c75e1e829c10803cb9852aafdecac299c950819b70", 0x50}], 0x4, &(0x7f0000000540)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @empty, @local}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfff}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}], 0x68}, 0x4801) (async) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}) (async) socket(0xa, 0x1, 0x0) (async) setsockopt$inet6_int(r6, 0x29, 0x4c, &(0x7f0000000000)=0xfffffffe, 0x4) (async) ioctl(r6, 0x8916, &(0x7f0000000000)) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6}]}}}]}, 0x50}}, 0x0) (async) ioctl(r6, 0x8936, &(0x7f0000000000)) (async) 5.482198455s ago: executing program 1 (id=2427): openat$ttyS3(0xffffffffffffff9c, 0x0, 0x123e00, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendto$unix(r1, &(0x7f00000002c0)="2ce95cbe14e2bd672655d479275e124ddef54af744dde36d087613af9f176df37e1579cf0a68e3d90ae3c025f78af14dab78cfc4004edf6e1201b89b5471bb259a41e184615e8217cdbfe8a72d0cebb785522052e64fe1c4a5280df4fcf67428e358505ae352cdf97be22b0c48e2513ca32d7617a8cf966f7534b062ecb3afcbb935a772dd413709ff14", 0x8a, 0x8000, &(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x58, 0x5) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) fsopen(0x0, 0x1) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000180)={0xff, 0x0, 0x8, 0x5, 0xfd, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r5, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r5, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) 4.949471711s ago: executing program 2 (id=2428): r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f00000000c0)=@v={0x93, 0x5, 0x80, 0x2, @MIDI_NOTEON=@special, 0x10, 0x8}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x300}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffb}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="a00000002100010000000000fefffffffc020000000000000000000000000000fc020000000000000000a65d54eb0001fffc0000000000000adee080ff0000001517d1f9de9c501db8817a4ddce5810722333d55e84956232ba034c16d74da27c012cc2064ad08f6ddd3c2cedde100"/125, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020000000000000050001100ac1414aa000000000000000000000000fc000000000000000000000000000001fc020000000000000000000000000000fe8000000000000000000000000000aa33"], 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x42000) 4.939606125s ago: executing program 4 (id=2429): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0xdd, 0xa}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000208500000004"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x8, 0x400, 0x9, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x43}, [], {0x95, 0x0, 0x0, 0x90ffffff}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) 4.83583809s ago: executing program 4 (id=2430): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200001200000000000000060000008500000020000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000080)='GPL\x00', 0x3, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xec621d}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d00}, 0x50) 4.835576016s ago: executing program 4 (id=2431): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x76, 0x1c9e01) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x80045510, 0xffffffffffffffff) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188040f56ecdb4cb9cca7480ef434000000e3bd6efb440009000e000a0010000000ba80010000005a8c3774fa0af3dc59a933c1e7a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x0) 3.464731881s ago: executing program 4 (id=2432): r0 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) recvmmsg(r1, &(0x7f0000002ec0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000000, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_emit_ethernet(0x66, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000001aaaaaaaaaa1686dd60f53a0400303afffe880000000000000000000000000001ff02000000000000000000000000000102008078000005026050835900000000fc010000000000000000000000000000fe80000000000000740ea01c89"], 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x101a02, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, 0x0, 0xa100, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x4, &(0x7f0000ffd000/0x1000)=nil) r4 = syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) sched_setscheduler(r4, 0x5, &(0x7f0000000000)=0x7) close(0x3) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e20, @private=0xa010102}, {0x2, 0x4e21, @remote}, 0x56, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0x5, 0x7}) 3.363317736s ago: executing program 2 (id=2433): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="24000000cce11759f1e634373fdc6fdd3da0a91a0001000000400000000000810010000000000200000000080017004e2107ff"], 0x24}}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000080)="440f20c0663509000000440f22c0f3af0f0664f2a52e640f001066b8020000000f23d00f21f86635300000000f23f866b9800000c00f326635008000000f2a3030f2f4660f0966b80500000066b9c0e2095f0f01d9", 0x55}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0, 0xfffffffffffffeb7}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0xaaaaaaaaaaaaca7, 0x25, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xc, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x655c, 0x1, 0x40, 0x7fffffff, 0x7fffffff, 0x80, 0x10001, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x100}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x4a4b43, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000000)=0x7) ioctl$TIOCSTI(r8, 0x5412, &(0x7f00000000c0)=0xf9) 3.355340057s ago: executing program 3 (id=2434): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x88901, 0x0) socket(0x2b, 0x80801, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semget$private(0x0, 0x2, 0x2) r2 = landlock_create_ruleset(&(0x7f0000000200)={0x48, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x4) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000300)={0x1, 0x0, &(0x7f00000000c0)=[0x0]}) shmctl$SHM_STAT(0x0, 0xd, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r0, 0xc008aec1, &(0x7f0000000400)) 3.289969172s ago: executing program 4 (id=2435): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000580)={&(0x7f0000000180)=[0x0], 0x1, r3, r4, 0x3, 0xc, 0x2, 0x804, {0xac7c, 0x1, 0x3, 0x67, 0xf4b, 0x1, 0x2, 0x5, 0x4132, 0xe154, 0x1000, 0x7f, 0x3, 0xffffffff, "fe1d00003413000000f1ff000080004000000000000000000000000000000200"}}) 3.127754143s ago: executing program 4 (id=2436): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x1ff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0xc, 0x64, 0x8f, 0x10, 0x110a, 0x1250, 0x5ac6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x95, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0xb, 0x5, 0x0, 0xb0, 0x5c, 0xdc, 0x4, [@uac_control={{0xa, 0x24, 0x1, 0x2, 0x3}}]}}]}}]}}, 0x0) timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008091}, 0x4000000) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) sched_getattr(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000380)=@multiplanar_fd={0x0, 0xa, 0x4, 0x20, 0x3, {}, {0x4, 0x1, 0x40, 0x2, 0x43, 0x2, "352fc590"}, 0x4, 0x4, {&(0x7f0000000300)=[{0xffff, 0x1, {}, 0x7}, {0xc, 0x5, {}, 0x9}]}, 0x3ff}) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x40078, &(0x7f0000000000)) ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0) 2.983279577s ago: executing program 3 (id=2437): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0xdd, 0xa}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb60000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x18, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff9f}}, &(0x7f0000000100)='GPL\x00', 0x4}, 0x94) 2.90139736s ago: executing program 3 (id=2438): connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r2, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r3, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r3, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x10, &(0x7f0000000000)=0x8, 0x4) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) sendmmsg$inet6(r5, &(0x7f0000000ac0), 0x0, 0xff00) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, &(0x7f0000000240)={0x18, r2}) bind$alg(r0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='pstore\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000400)='rootcontext', &(0x7f0000000300)='5\xfd\x04\xc6\xc9]\v\xd6S9q\x0f#\x93\x9d\xeb\x00\xcf\xb2~9*\xa9\x1d:\x06u46N\xd93\xe1\xa2\x05\x83Z\xbc\xbeT\x16\xab\xfb=4\xa6\x10,\"\xee\xf8o+\x02\xd8\xaft_\r\x1d\"\xc8\\k\xcc4\x96\xdb\xb0\xadA\x02[\x16\xb4\xca\xa5n\x87\xdb\xb3\x1f\xbb\xc0\x9f\xc2\x9e\t[\xba\x9e\xfd\xc76#\x8f\xc6\xe7\x11\x8fL\xd970x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r3], 0x20}, 0x1, 0x0, 0x0, 0xffff0000}, 0x0) 2.254195008s ago: executing program 1 (id=2442): r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x22) write$RDMA_USER_CM_CMD_BIND_IP(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0xdcee729b7a9faec8) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x11, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="05002ebd7000000000000800000008000300", @ANYRES32=r5], 0x2c}, 0x1, 0x0, 0x0, 0x44840}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x3, 0x20, 0xa6, 0x2, 0x5, 0x9, 0x3}, {0xfffffff9, 0x1, 0x0, 0x0, 0x0, 0xf6, 0xce, 0x0, 0x4, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x8035, 0x0, 0x0, 0x4, 0x1, 0x7, 0xfe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0xcc78}) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) r10 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x40000000000, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r10, 0xc100565c, &(0x7f00000011c0)={0xffffffff, 0x1, 0x2, {0x1, @win={{0x6, 0x200, 0x200, 0xfffffffa}, 0x9, 0x62e82618, 0x0, 0x5, 0x0, 0x76}}, 0x2}) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r11], 0x1c}}, 0x0) r12 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_LLC_SET_PARAMS(r8, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r12, @ANYBLOB="00022cbd7000fddbdf251000000008000100", @ANYRES32=r13, @ANYBLOB="59cc21818dc87a1bb981358744cc771a3bca9ccb137de22cc0ddf2a33f29c73e7b52cccd545745889aad6bd741bef253f0497efe4406b82138d654d5fd82efcb42ee2635c8438a84"], 0x1c}}, 0x4840) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000002400)={[{0x3, 0xce, 0xba, 0x5, 0x8, 0x96, 0x9, 0x6, 0x75, 0x0, 0xff, 0x6, 0xfffffffe}, {0x15, 0x11, 0x6, 0x2, 0x81, 0x90, 0x2, 0x6, 0xb, 0x2, 0x4, 0x9, 0x1}, {0x4, 0x1000, 0x8, 0x52, 0x1, 0x2a, 0x9, 0x8, 0xb, 0x40, 0xf4, 0xff, 0x200}], 0x9}) 2.244255165s ago: executing program 5 (id=2443): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4, 0x0, @mcast1={0xff, 0x7}, 0x8a4}}, {{0xa, 0x4e20, 0x100, @remote}}}, 0x108) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x2b06, 0x0, 0x0, &(0x7f0000ffe000)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x40008) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r5 = add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r5, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x8002, 0x0) 2.229989333s ago: executing program 3 (id=2444): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r4}, 0x18) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x0, &(0x7f0000000380), &(0x7f0000000480)='GPL\x00', 0x7ff, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x9, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000005c0)=[r3, r3, r3], &(0x7f0000000600)=[{0x3, 0x2, 0xd}, {0x5, 0x2, 0x1, 0xa}, {0x5, 0x5, 0x4, 0x9}], 0x10, 0x5da}, 0x94) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r5, 0x5408, &(0x7f00000000c0)={0xcf47, 0x4cc, 0x59, 0x7f, 0x1, "8003e3ffff072000"}) write$binfmt_aout(r5, &(0x7f00000000c0)=ANY=[], 0xff2e) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="a00000000001010400000000000000000a00000a3c0001802c00018014000300fe8000fdffffffffffffff00000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000001010c000280050001000000000008000740000000000c001640000000"], 0xa0}}, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x403, 0x7fff, 0x16, "b0bfd0ff40000096004e149b78ef4100"}) r7 = syz_open_pts(r5, 0x0) r8 = dup3(r7, r5, 0x0) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000000)=0xff) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RWALK(r9, &(0x7f00000000c0)={0x64, 0x6f, 0x2, {0x7, [{0x10, 0x4, 0x7}, {0x8, 0x4}, {0x9c, 0x4, 0x2}, {0x0, 0x4, 0x8}, {0x4, 0x4, 0x4}, {0x2, 0x2, 0x4}, {0x2, 0x3, 0x4}]}}, 0x64) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x8000, &(0x7f0000000040)=ANY=[@ANYBLOB="6d706f6c3d6c6f6361370200006c61746976653a342c372c00d3fa987533568ffc7d854216be71ccc2c4589b3c7de017bbfd0dbb9bbff656fdb80cadf9dda5a78d363bfd5484af96f2ea42da4ef2ee52"]) 11.882413ms ago: executing program 5 (id=2445): pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x60002016}) fcntl$setpipe(r0, 0x407, 0x10005) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000008c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5}, 0x50) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f0000000040)={0x6d18}) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0x0, 0x0, 0x1000000}, {0x0, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0xfffffffd, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x800) 0s ago: executing program 3 (id=2446): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) read$hiddev(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): length: 11 > 4 [ 472.723532][T11327] bridge_slave_0 (unregistering): left allmulticast mode [ 472.742070][T11327] bridge_slave_0 (unregistering): left promiscuous mode [ 473.023888][ T5895] IPVS: starting estimator thread 0... [ 473.037462][T11327] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.128880][T11333] IPVS: using max 82 ests per chain, 196800 per kthread [ 473.207707][T11338] loop5: detected capacity change from 0 to 2663 [ 473.883976][ T5895] usb 4-1: USB disconnect, device number 32 [ 473.909612][T10975] Buffer I/O error on dev loop5, logical block 332, async page read [ 474.180696][T11346] tipc: Enabling of bearer rejected, failed to enable media [ 474.524649][T11351] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1535'. [ 474.559176][T11351] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1535'. [ 474.576892][T11265] Buffer I/O error on dev loop5, logical block 332, async page read [ 474.910986][ T5829] Bluetooth: hci1: command 0x0406 tx timeout [ 475.320613][ T57] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 475.422723][T11368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1542'. [ 475.737570][ T57] usb 4-1: Using ep0 maxpacket: 32 [ 475.761836][ T57] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 475.795563][ T57] usb 4-1: config 0 has no interfaces? [ 475.811965][ T57] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 475.835621][ T57] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.848157][ T57] usb 4-1: Product: syz [ 475.858037][ T57] usb 4-1: Manufacturer: syz [ 475.868483][T11379] netlink: 'syz.5.1544': attribute type 64 has an invalid length. [ 475.869529][ T57] usb 4-1: SerialNumber: syz [ 475.895288][T11379] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1544'. [ 475.905199][ T57] usb 4-1: config 0 descriptor?? [ 476.036680][ T5929] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 476.176871][ T5929] usb 3-1: device descriptor read/64, error -71 [ 476.529641][ T5929] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 476.679881][ T5929] usb 3-1: device descriptor read/64, error -71 [ 476.806827][ T5929] usb usb3-port1: attempt power cycle [ 477.252106][ T5929] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 477.287884][ T5929] usb 3-1: device descriptor read/8, error -71 [ 477.502169][T11401] xt_addrtype: ipv6 does not support BROADCAST matching [ 477.608197][ T5929] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 477.632066][ T5929] usb 3-1: device descriptor read/8, error -71 [ 477.748122][ T5929] usb usb3-port1: unable to enumerate USB device [ 477.921896][ T57] usb 4-1: USB disconnect, device number 33 [ 478.289563][T11405] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1552'. [ 478.301193][T11405] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 478.780243][T11412] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1555'. [ 478.839498][T11412] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 478.856846][T11412] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 478.866192][T11412] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 478.880704][T11412] kvm: requested 8380 ns i8254 timer period limited to 200000 ns [ 478.896975][T11412] kvm: requested 70400 ns i8254 timer period limited to 200000 ns [ 478.905475][T11412] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 478.916540][T11412] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 478.925355][T11412] kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 478.934317][T11412] kvm: requested 23466 ns i8254 timer period limited to 200000 ns [ 478.942532][T11412] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 479.233102][ T5866] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 479.492211][T11421] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1557'. [ 479.511386][T11421] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1557'. [ 479.534478][ T5866] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 479.639750][ T5866] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 479.659693][ T5866] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 479.678824][ T5866] usb 6-1: Product: syz [ 479.683590][ T5866] usb 6-1: Manufacturer: syz [ 479.688178][ T5866] usb 6-1: SerialNumber: syz [ 479.724547][ T5866] usb 6-1: config 0 descriptor?? [ 480.603723][ T5866] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 480.668306][T10975] udevd[10975]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 481.179154][ T5929] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 481.638493][ T5929] usb 4-1: Using ep0 maxpacket: 32 [ 481.658216][ T5929] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 481.690012][ T5929] usb 4-1: config 0 has no interfaces? [ 481.712313][ T5929] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 481.744200][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.765403][ T5929] usb 4-1: Product: syz [ 481.775594][ T5929] usb 4-1: Manufacturer: syz [ 481.787115][ T5929] usb 4-1: SerialNumber: syz [ 481.830414][ T5929] usb 4-1: config 0 descriptor?? [ 482.050340][ T5866] usb 6-1: USB disconnect, device number 34 [ 483.614220][ T5886] IPVS: starting estimator thread 0... [ 483.745778][T11463] IPVS: using max 44 ests per chain, 105600 per kthread [ 483.968064][T11474] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1570'. [ 483.999603][ T30] audit: type=1400 audit(1764831598.557:925): avc: denied { map } for pid=11466 comm="syz.4.1571" path="socket:[37288]" dev="sockfs" ino=37288 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 484.058607][ T5929] usb 4-1: USB disconnect, device number 34 [ 484.230785][T11483] FAULT_INJECTION: forcing a failure. [ 484.230785][T11483] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 484.244899][T11483] CPU: 1 UID: 0 PID: 11483 Comm: syz.2.1575 Not tainted syzkaller #0 PREEMPT(full) [ 484.244922][T11483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 484.244931][T11483] Call Trace: [ 484.244936][T11483] [ 484.244942][T11483] dump_stack_lvl+0x16c/0x1f0 [ 484.244966][T11483] should_fail_ex+0x512/0x640 [ 484.244986][T11483] should_fail_alloc_page+0xe7/0x130 [ 484.245009][T11483] prepare_alloc_pages+0x3c2/0x610 [ 484.245039][T11483] __alloc_frozen_pages_noprof+0x18b/0x2440 [ 484.245069][T11483] ? __lock_acquire+0x433/0x22f0 [ 484.245095][T11483] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 484.245132][T11483] ? find_held_lock+0x2b/0x80 [ 484.245150][T11483] ? is_bpf_text_address+0x8a/0x1a0 [ 484.245168][T11483] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 484.245188][T11483] ? policy_nodemask+0xea/0x4e0 [ 484.245211][T11483] alloc_pages_mpol+0x1fb/0x550 [ 484.245232][T11483] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 484.245256][T11483] ___kmalloc_large_node+0xed/0x160 [ 484.245275][T11483] __kmalloc_large_node_noprof+0x1c/0x70 [ 484.245294][T11483] __kmalloc_noprof.cold+0xc/0x62 [ 484.245313][T11483] ? iovec_from_user+0x108/0x140 [ 484.245329][T11483] ? iovec_from_user+0x108/0x140 [ 484.245340][T11483] iovec_from_user+0x108/0x140 [ 484.245354][T11483] __import_iovec+0x88/0x650 [ 484.245367][T11483] ? aio_prep_rw+0x6d1/0xbe0 [ 484.245388][T11483] aio_write+0x27a/0x910 [ 484.245415][T11483] ? __pfx_aio_write+0x10/0x10 [ 484.245456][T11483] ? __might_fault+0xe3/0x190 [ 484.245479][T11483] ? __might_fault+0x13b/0x190 [ 484.245508][T11483] ? io_submit_one+0x6c1/0x1df0 [ 484.245523][T11483] io_submit_one+0x6c1/0x1df0 [ 484.245543][T11483] ? __pfx_io_submit_one+0x10/0x10 [ 484.245562][T11483] ? __might_fault+0xe3/0x190 [ 484.245579][T11483] ? __might_fault+0x13b/0x190 [ 484.245602][T11483] ? __x64_sys_io_submit+0x1a9/0x350 [ 484.245615][T11483] __x64_sys_io_submit+0x1a9/0x350 [ 484.245630][T11483] ? __pfx___x64_sys_io_submit+0x10/0x10 [ 484.245642][T11483] ? fput+0x70/0xf0 [ 484.245669][T11483] do_syscall_64+0xcd/0xf80 [ 484.245686][T11483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.245698][T11483] RIP: 0033:0x7f069758f749 [ 484.245710][T11483] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 484.245723][T11483] RSP: 002b:00007f0698509038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 484.245737][T11483] RAX: ffffffffffffffda RBX: 00007f06977e5fa0 RCX: 00007f069758f749 [ 484.245746][T11483] RDX: 0000200000001d00 RSI: 0000000000000001 RDI: 00007f06984e6000 [ 484.245754][T11483] RBP: 00007f0698509090 R08: 0000000000000000 R09: 0000000000000000 [ 484.245761][T11483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.245769][T11483] R13: 00007f06977e6038 R14: 00007f06977e5fa0 R15: 00007ffe7ebb51d8 [ 484.245788][T11483] [ 485.086428][T11499] kvm: Disabled LAPIC found during irq injection [ 485.296428][T11507] create_pit_timer: 22 callbacks suppressed [ 485.297450][T11507] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 486.380330][T11501] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 486.388412][T11501] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 486.396344][T11501] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 486.404152][T11501] kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 486.412217][T11501] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 486.771812][T11524] veth0_to_bridge: entered promiscuous mode [ 486.810692][T11527] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1587'. [ 486.829911][T11524] veth0_to_bridge: left promiscuous mode [ 487.710584][T11542] Invalid logical block size (5) [ 487.950018][ T30] audit: type=1400 audit(1764831602.261:926): avc: denied { write } for pid=11548 comm="syz.4.1596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 488.256268][ T5866] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 488.801482][ T5866] usb 4-1: device descriptor read/64, error -71 [ 489.148941][ T5866] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 489.512556][ T5866] usb 4-1: device descriptor read/64, error -71 [ 490.050116][ T5866] usb usb4-port1: attempt power cycle [ 490.107874][ T30] audit: type=1400 audit(1764831604.282:927): avc: denied { read } for pid=11581 comm="syz.5.1605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 490.458718][ T5866] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 490.491084][ T5866] usb 4-1: device descriptor read/8, error -71 [ 491.174582][ T5866] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 491.206848][ T5866] usb 4-1: device descriptor read/8, error -71 [ 491.267373][ T30] audit: type=1400 audit(1764831605.358:928): avc: denied { bind } for pid=11610 comm="syz.4.1614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 491.345836][ T5866] usb usb4-port1: unable to enumerate USB device [ 491.363056][ T30] audit: type=1400 audit(1764831605.376:929): avc: denied { getopt } for pid=11610 comm="syz.4.1614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 491.522193][T11615] block nbd1: NBD_DISCONNECT [ 491.599464][T11615] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 491.675839][T11615] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 491.985110][T11622] tipc: Enabled bearer , priority 10 [ 491.992865][T11622] syzkaller0: entered promiscuous mode [ 491.998696][T11622] syzkaller0: entered allmulticast mode [ 492.918259][T11630] kthread_run failed with err -4 [ 493.104588][T11617] tipc: Resetting bearer [ 493.131597][T11617] tipc: Disabling bearer [ 493.157115][T11634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1621'. [ 493.166520][T11634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1621'. [ 493.612152][ T6340] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 493.804737][ T6340] usb 6-1: Using ep0 maxpacket: 16 [ 493.850990][ T6340] usb 6-1: config 8 has an invalid descriptor of length 1, skipping remainder of the config [ 493.885884][ T6340] usb 6-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 493.914620][ T6340] usb 6-1: New USB device found, idVendor=39c6, idProduct=8f68, bcdDevice=dd.44 [ 493.943502][ T6340] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.971478][ T6340] usb 6-1: Product: syz [ 493.987920][ T6340] usb 6-1: Manufacturer: syz [ 493.992548][ T6340] usb 6-1: SerialNumber: syz [ 494.007269][T11653] FAULT_INJECTION: forcing a failure. [ 494.007269][T11653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 494.027434][T11653] CPU: 0 UID: 0 PID: 11653 Comm: syz.1.1628 Not tainted syzkaller #0 PREEMPT(full) [ 494.027457][T11653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 494.027467][T11653] Call Trace: [ 494.027472][T11653] [ 494.027478][T11653] dump_stack_lvl+0x16c/0x1f0 [ 494.027501][T11653] should_fail_ex+0x512/0x640 [ 494.027521][T11653] _copy_from_user+0x2e/0xd0 [ 494.027546][T11653] copy_msghdr_from_user+0x98/0x160 [ 494.027562][T11653] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 494.027577][T11653] ? __lock_acquire+0x433/0x22f0 [ 494.027609][T11653] ___sys_sendmsg+0xfe/0x1d0 [ 494.027625][T11653] ? __pfx____sys_sendmsg+0x10/0x10 [ 494.027639][T11653] ? __lock_acquire+0x433/0x22f0 [ 494.027684][T11653] __sys_sendmsg+0x16d/0x220 [ 494.027700][T11653] ? __pfx___sys_sendmsg+0x10/0x10 [ 494.027729][T11653] do_syscall_64+0xcd/0xf80 [ 494.027742][T11653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.027753][T11653] RIP: 0033:0x7f72df78f749 [ 494.027762][T11653] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 494.027772][T11653] RSP: 002b:00007f72e062d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 494.027782][T11653] RAX: ffffffffffffffda RBX: 00007f72df9e5fa0 RCX: 00007f72df78f749 [ 494.027789][T11653] RDX: 0000000020000004 RSI: 00002000000007c0 RDI: 0000000000000003 [ 494.027798][T11653] RBP: 00007f72e062d090 R08: 0000000000000000 R09: 0000000000000000 [ 494.027807][T11653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.027816][T11653] R13: 00007f72df9e6038 R14: 00007f72df9e5fa0 R15: 00007fffb0b4dbe8 [ 494.027838][T11653] [ 494.231395][ T6340] usb 6-1: USB disconnect, device number 35 [ 495.931975][ T10] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 496.327657][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 497.305238][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 497.316881][ T10] usb 4-1: config 4 interface 0 has no altsetting 0 [ 497.354446][ T10] usb 4-1: string descriptor 0 read error: -22 [ 497.355300][ T6395] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 497.360684][ T10] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 497.584182][ T10] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 497.682641][ T6395] usb 2-1: Using ep0 maxpacket: 32 [ 497.688934][ T10] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 497.699473][ T6395] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 497.726959][ T6395] usb 2-1: config 0 has no interfaces? [ 498.196767][ T6395] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 498.206338][ T10] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 498.614975][ T10] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 498.625412][ T6395] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.647908][ T6395] usb 2-1: Product: syz [ 498.652099][ T6395] usb 2-1: Manufacturer: syz [ 498.659892][ T6395] usb 2-1: SerialNumber: syz [ 498.672308][ T10] usb 4-1: media controller created [ 498.692612][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.701676][ T6395] usb 2-1: config 0 descriptor?? [ 498.719244][ T10] zl10353_read_register: readreg error (reg=127, ret==0) [ 498.788359][ T10] usb 4-1: USB disconnect, device number 39 [ 499.009782][ T30] audit: type=1400 audit(1764831612.598:930): avc: denied { setattr } for pid=11722 comm="syz.2.1653" name="NETLINK" dev="sockfs" ino=38068 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 499.096340][ T6340] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 499.743869][T11730] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1655'. [ 499.753581][T11730] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1655'. [ 499.767017][T11730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1655'. [ 500.309998][ T6395] usb 2-1: USB disconnect, device number 29 [ 500.363900][ T6340] usb 6-1: Using ep0 maxpacket: 32 [ 500.398516][ T6340] usb 6-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 500.434757][ T6340] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.450689][T11727] 8021q: adding VLAN 0 to HW filter on device bond0 [ 500.458867][ T6340] usb 6-1: Product: syz [ 500.466505][T11727] 8021q: adding VLAN 0 to HW filter on device team0 [ 500.473157][ T6340] usb 6-1: Manufacturer: syz [ 500.481290][ T6340] usb 6-1: SerialNumber: syz [ 500.497300][T11727] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 500.519503][ T6340] usb 6-1: config 0 descriptor?? [ 500.533431][ T6340] ttusb_dec_send_command: command bulk message failed: error -22 [ 500.547338][ T37] ip6_vti0 speed is unknown, defaulting to 1000 [ 500.558282][ T37] syz2: Port: 1 Link ACTIVE [ 500.582470][ T6395] ip6_vti0 speed is unknown, defaulting to 1000 [ 500.588914][ T6340] ttusb-dec 6-1:0.0: probe with driver ttusb-dec failed with error -22 [ 501.074645][T11746] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 501.916358][T11751] Invalid source name [ 501.920779][T11751] UBIFS error (pid: 11751): cannot open "./file0", error -22 [ 502.195432][ T10] usb 6-1: USB disconnect, device number 36 [ 502.601152][T11767] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1665'. [ 502.677657][ T10] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 502.692384][T11766] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 503.212293][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 503.225634][ T10] usb 6-1: config 6 has an invalid interface number: 152 but max is 0 [ 503.243423][ T10] usb 6-1: config 6 has no interface number 0 [ 503.253689][T11770] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1668'. [ 503.263087][ T10] usb 6-1: config 6 interface 152 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 503.274851][ T10] usb 6-1: config 6 interface 152 altsetting 8 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 503.287326][ T10] usb 6-1: config 6 interface 152 altsetting 8 has a duplicate endpoint with address 0x8, skipping [ 503.298563][ T10] usb 6-1: config 6 interface 152 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 503.310311][ T10] usb 6-1: config 6 interface 152 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 503.324322][ T10] usb 6-1: config 6 interface 152 has no altsetting 0 [ 503.338366][ T10] usb 6-1: New USB device found, idVendor=04e8, idProduct=6619, bcdDevice=38.e5 [ 503.348826][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.357671][ T10] usb 6-1: Product: syz [ 503.366768][ T10] usb 6-1: Manufacturer: syz [ 503.371438][ T10] usb 6-1: SerialNumber: syz [ 503.764365][ T10] usb 6-1: USB disconnect, device number 37 [ 504.755796][T11783] netlink: 360 bytes leftover after parsing attributes in process `syz.4.1670'. [ 507.284643][T11807] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 507.610680][T11813] SELinux: Context system_u:object_r:systemd_passwd_var_run_t:s0 is not valid (left unmapped). [ 507.623653][ T30] audit: type=1400 audit(1764831620.661:931): avc: denied { relabelto } for pid=11812 comm="syz.5.1679" name="286" dev="tmpfs" ino=1518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 507.625026][T11813] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1679'. [ 507.744998][ T30] audit: type=1400 audit(1764831620.661:932): avc: denied { associate } for pid=11812 comm="syz.5.1679" name="286" dev="tmpfs" ino=1518 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 507.844942][ T30] audit: type=1400 audit(1764831620.745:933): avc: denied { remove_name } for pid=6689 comm="syz-executor" name="binderfs" dev="tmpfs" ino=1522 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 508.112478][ T30] audit: type=1400 audit(1764831620.745:934): avc: denied { rmdir } for pid=6689 comm="syz-executor" name="286" dev="tmpfs" ino=1518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_passwd_var_run_t:s0" [ 509.293685][T11839] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1687'. [ 509.311574][ T30] audit: type=1804 audit(1764831622.242:935): pid=11830 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.1685" name="/newroot/339/file0" dev="tmpfs" ino=1790 res=1 errno=0 [ 509.325784][T11839] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1687'. [ 509.701113][T11853] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 510.171888][ T5866] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 510.345959][ T5866] usb 2-1: config 1 interface 1 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 510.391467][ T5866] usb 2-1: config 1 interface 1 has no altsetting 0 [ 510.431605][ T5866] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 510.460729][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.487519][ T5866] usb 2-1: Product: syz [ 510.497252][ T5866] usb 2-1: Manufacturer: syz [ 510.507379][ T5866] usb 2-1: SerialNumber: syz [ 510.792394][T11870] tipc: Enabled bearer , priority 0 [ 510.802290][T11870] syzkaller0: entered promiscuous mode [ 510.808124][T11870] syzkaller0: entered allmulticast mode [ 511.398740][T11877] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1696'. [ 511.413769][T11864] tipc: Resetting bearer [ 511.426334][T11864] tipc: Disabling bearer [ 511.448034][ T30] audit: type=1400 audit(1764831624.187:936): avc: denied { bind } for pid=11858 comm="syz.1.1696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 511.593634][ T30] audit: type=1400 audit(1764831624.187:937): avc: denied { write } for pid=11858 comm="syz.1.1696" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 511.620215][T11879] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1700'. [ 511.640759][ T30] audit: type=1400 audit(1764831624.402:938): avc: denied { nlmsg_read } for pid=11878 comm="syz.4.1700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 512.268665][T11886] binder: 11883:11886 unknown command 0 [ 512.274250][T11886] binder: 11883:11886 ioctl c0306201 200000000080 returned -22 [ 512.284699][T11886] binder: 11883:11886 ioctl c0306201 2000000003c0 returned -14 [ 512.326671][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 512.345496][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 512.791670][T11899] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 513.017822][ T6395] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 513.042162][T11902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1708'. [ 513.175903][ T6395] usb 3-1: device descriptor read/64, error -71 [ 513.222223][ T5866] usb 2-1: 2:1 : invalid UAC_AS_GENERAL desc [ 513.734022][T11906] IPVS: rr: FWM 3 0x00000003 - no destination available [ 513.796140][ T5866] usb 2-1: USB disconnect, device number 30 [ 513.955221][T10975] udevd[10975]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 514.020556][ T6340] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 514.672476][ T6340] usb 6-1: Using ep0 maxpacket: 32 [ 514.843640][T11926] overlayfs: failed to clone lowerpath [ 515.220871][ T6340] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.261563][ T6340] usb 6-1: config 0 has no interfaces? [ 515.296171][ T6340] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 515.333983][ T6340] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.371168][ T6340] usb 6-1: Product: syz [ 515.395738][ T6340] usb 6-1: Manufacturer: syz [ 515.422103][ T6340] usb 6-1: SerialNumber: syz [ 515.542732][ T6340] usb 6-1: config 0 descriptor?? [ 515.602317][T11936] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1720'. [ 515.838407][ T5866] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 516.008779][ T5866] usb 4-1: Using ep0 maxpacket: 8 [ 516.025598][ T5866] usb 4-1: unable to get BOS descriptor or descriptor too short [ 516.053759][ T5866] usb 4-1: config 4 interface 0 has no altsetting 0 [ 516.077389][ T5866] usb 4-1: string descriptor 0 read error: -22 [ 516.096979][ T5866] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 516.131441][ T5866] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 516.182454][ T5866] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 516.224868][ T5866] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 516.261749][ T5866] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 516.288499][ T5866] usb 4-1: media controller created [ 516.358739][ T5866] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 516.390312][ T30] audit: type=1400 audit(1764831628.855:939): avc: denied { read write } for pid=11933 comm="syz.3.1719" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 516.620303][ T30] audit: type=1400 audit(1764831628.892:940): avc: denied { ioctl open } for pid=11933 comm="syz.3.1719" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 517.059523][ T6340] usb 6-1: USB disconnect, device number 38 [ 517.127509][T11962] 9pnet_fd: Insufficient options for proto=fd [ 517.345347][T11963] IPVS: Error connecting to the multicast addr [ 517.660721][T11969] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1729'. [ 517.785488][ T5866] zl10353_read_register: readreg error (reg=127, ret==0) [ 517.856075][ T5866] usb 4-1: USB disconnect, device number 40 [ 517.913304][T11972] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1731'. [ 517.959585][T11973] SELinux: Context system_u:object_r:sendmail_exec_t:s0 is not valid (left unmapped). [ 517.993005][ T30] audit: type=1400 audit(1764831630.361:941): avc: denied { relabelto } for pid=11971 comm="syz.5.1730" name="cgroup.procs" dev="cgroup" ino=352 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:sendmail_exec_t:s0" [ 518.050986][ T30] audit: type=1400 audit(1764831630.380:942): avc: denied { associate } for pid=11971 comm="syz.5.1730" name="cgroup.procs" dev="cgroup" ino=352 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 srawcon="system_u:object_r:sendmail_exec_t:s0" [ 518.508376][T11980] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1733'. [ 518.528800][T11980] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11980 comm=syz.2.1733 [ 519.323105][ T5928] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 519.385118][ T30] audit: type=1401 audit(1764831631.661:943): op=fscreate invalid_context=DC [ 519.463483][ T30] audit: type=1400 audit(1764831631.736:944): avc: denied { ioctl } for pid=12002 comm="syz.3.1742" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x125d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 519.504871][ T5928] usb 2-1: Using ep0 maxpacket: 8 [ 519.518331][ T5928] usb 2-1: unable to get BOS descriptor or descriptor too short [ 519.529027][ T5928] usb 2-1: config 4 interface 0 has no altsetting 0 [ 519.538518][ T5928] usb 2-1: string descriptor 0 read error: -22 [ 519.544891][ T5928] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 519.554102][ T5928] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 519.568848][ T5928] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 519.579181][ T5928] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 519.590419][ T5928] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 519.597628][ T5928] usb 2-1: media controller created [ 519.619493][T12007] Trying to write to read-only block-device nullb0 [ 519.627968][ T5928] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 520.085719][T12011] Invalid logical block size (5) [ 520.559997][ T30] audit: type=1400 audit(1764831632.746:945): avc: denied { name_connect } for pid=12018 comm="syz.3.1746" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 520.850436][ T5928] zl10353_read_register: readreg error (reg=127, ret==0) [ 521.406631][ T5866] usb 2-1: USB disconnect, device number 31 [ 521.477715][T12035] overlayfs: conflicting lowerdir path [ 524.043486][T12076] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1759'. [ 524.061287][T12073] syzkaller1: entered promiscuous mode [ 524.069545][T12073] syzkaller1: entered allmulticast mode [ 527.456412][T12109] netlink: 165 bytes leftover after parsing attributes in process `syz.5.1769'. [ 529.720446][T12120] binder: BINDER_SET_CONTEXT_MGR already set [ 529.727953][T12120] binder: 12117:12120 ioctl 4018620d 200000000040 returned -16 [ 531.360826][ T6340] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 531.544632][T12144] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1778'. [ 532.655484][ T6340] usb 4-1: device descriptor read/all, error -71 [ 534.666137][T12173] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1784'. [ 534.676174][T12173] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1784'. [ 534.685169][T12173] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1784'. [ 534.948988][ T30] audit: type=1400 audit(1764831645.823:946): avc: denied { mount } for pid=12168 comm="syz.1.1784" name="/" dev="configfs" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 535.084050][ T30] audit: type=1400 audit(1764831645.823:947): avc: denied { search } for pid=12168 comm="syz.1.1784" name="/" dev="configfs" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 535.166237][T12170] macvtap1: entered promiscuous mode [ 535.171751][T12170] bond0: entered promiscuous mode [ 535.176965][T12170] bond_slave_0: entered promiscuous mode [ 535.220643][T12170] bond_slave_1: entered promiscuous mode [ 535.253205][T12170] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 535.290927][T12170] bond0: left promiscuous mode [ 535.315376][T12170] bond_slave_0: left promiscuous mode [ 535.344746][T12170] bond_slave_1: left promiscuous mode [ 535.367299][T12178] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 536.783652][ T6340] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 536.981489][T12204] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 539.412475][T12231] tipc: Enabling of bearer rejected, failed to enable media [ 539.835984][T12245] lo speed is unknown, defaulting to 1000 [ 539.842084][T12245] lo speed is unknown, defaulting to 1000 [ 539.853873][T12245] lo speed is unknown, defaulting to 1000 [ 539.880812][T12245] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 539.935234][T12245] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 540.103535][T12245] lo speed is unknown, defaulting to 1000 [ 540.120605][T12245] lo speed is unknown, defaulting to 1000 [ 540.136124][T12245] lo speed is unknown, defaulting to 1000 [ 540.150970][T12245] lo speed is unknown, defaulting to 1000 [ 540.157993][T12245] lo speed is unknown, defaulting to 1000 [ 540.165074][T12245] lo speed is unknown, defaulting to 1000 [ 540.417291][T12243] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 541.012280][T12258] Invalid logical block size (5) [ 543.369078][ T5928] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 543.888208][T12287] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1819'. [ 544.565672][ T5928] usb 3-1: Using ep0 maxpacket: 16 [ 544.594567][ T5928] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 544.606750][T12291] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1822'. [ 544.641159][ T5928] usb 3-1: config 0 has no interface number 0 [ 544.734676][ T5928] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 544.782299][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.822872][ T5928] usb 3-1: Product: syz [ 544.833993][ T5928] usb 3-1: Manufacturer: syz [ 544.846839][ T5928] usb 3-1: SerialNumber: syz [ 544.872721][ T5928] usb 3-1: config 0 descriptor?? [ 544.888790][ T5928] hub 3-1:0.132: bad descriptor, ignoring hub [ 544.909791][ T5928] hub 3-1:0.132: probe with driver hub failed with error -5 [ 545.320400][ T5928] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input22 [ 545.718448][T12310] tmpfs: Bad value for 'mpol' [ 546.650031][T12311] nvme_fabrics: missing parameter 'transport=%s' [ 546.723503][T12311] nvme_fabrics: missing parameter 'nqn=%s' [ 547.657170][T12337] IPVS: rr: FWM 3 0x00000003 - no destination available [ 548.117347][T12340] Device name cannot be null; rc = [-22] [ 548.143058][T12341] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 549.039855][T12353] tipc: Enabling of bearer rejected, failed to enable media [ 550.455074][ T30] audit: type=1400 audit(1764831660.733:948): avc: denied { read } for pid=12372 comm="syz.3.1844" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 551.764627][T12400] IPVS: sh: FWM 3 0x00000003 - no destination available [ 551.774003][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 552.111023][ T5928] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 552.271359][ T10] usb 3-1: USB disconnect, device number 63 [ 552.389421][ T5928] usb 2-1: Using ep0 maxpacket: 32 [ 552.828853][ T5928] usb 2-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 552.845429][ T5928] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.854903][ T5928] usb 2-1: Product: syz [ 552.859649][ T5928] usb 2-1: Manufacturer: syz [ 552.864249][ T5928] usb 2-1: SerialNumber: syz [ 552.878804][ T5928] usb 2-1: config 0 descriptor?? [ 552.893120][ T5928] ttusb_dec_send_command: command bulk message failed: error -22 [ 552.901873][ T5928] ttusb-dec 2-1:0.0: probe with driver ttusb-dec failed with error -22 [ 554.173857][T12425] 9pnet_fd: Insufficient options for proto=fd [ 554.344469][T12432] input: syz1 as /devices/virtual/input/input23 [ 554.442858][T12436] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1865'. [ 554.489129][T12432] netlink: 'syz.2.1862': attribute type 1 has an invalid length. [ 554.856688][ T9] usb 2-1: USB disconnect, device number 32 [ 554.997612][ T30] audit: type=1400 audit(1764831664.849:949): avc: denied { write } for pid=12430 comm="syz.2.1862" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 555.359423][T12452] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1868'. [ 555.515325][T12454] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=12454 comm=syz.3.1868 [ 555.582076][ T30] audit: type=1400 audit(1764831665.335:950): avc: denied { getopt } for pid=12447 comm="syz.1.1867" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 556.344367][T12459] smc: adding net device bond0 with user defined pnetid SYZ2 [ 556.359678][T12459] bond0: Unable to set down delay as MII monitoring is disabled [ 556.369593][T12459] smc: removing net device bond0 with user defined pnetid SYZ2 [ 556.377467][T12459] bond0 (unregistering): Released all slaves [ 556.428506][T12466] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1872'. [ 557.493069][T12487] FAULT_INJECTION: forcing a failure. [ 557.493069][T12487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.533338][T12487] CPU: 1 UID: 0 PID: 12487 Comm: syz.2.1881 Not tainted syzkaller #0 PREEMPT(full) [ 557.533364][T12487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 557.533373][T12487] Call Trace: [ 557.533379][T12487] [ 557.533386][T12487] dump_stack_lvl+0x16c/0x1f0 [ 557.533410][T12487] should_fail_ex+0x512/0x640 [ 557.533431][T12487] _copy_from_user+0x2e/0xd0 [ 557.533457][T12487] copy_msghdr_from_user+0x98/0x160 [ 557.533475][T12487] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 557.533489][T12487] ? __lock_acquire+0x433/0x22f0 [ 557.533522][T12487] ___sys_sendmsg+0xfe/0x1d0 [ 557.533540][T12487] ? __pfx____sys_sendmsg+0x10/0x10 [ 557.533555][T12487] ? __lock_acquire+0x433/0x22f0 [ 557.533604][T12487] __sys_sendmsg+0x16d/0x220 [ 557.533622][T12487] ? __pfx___sys_sendmsg+0x10/0x10 [ 557.533655][T12487] do_syscall_64+0xcd/0xf80 [ 557.533675][T12487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.533692][T12487] RIP: 0033:0x7f069758f749 [ 557.533706][T12487] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 557.533722][T12487] RSP: 002b:00007f0698509038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 557.533739][T12487] RAX: ffffffffffffffda RBX: 00007f06977e5fa0 RCX: 00007f069758f749 [ 557.533749][T12487] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 557.533759][T12487] RBP: 00007f0698509090 R08: 0000000000000000 R09: 0000000000000000 [ 557.533774][T12487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 557.533784][T12487] R13: 00007f06977e6038 R14: 00007f06977e5fa0 R15: 00007ffe7ebb51d8 [ 557.533808][T12487] [ 557.698787][ C1] vkms_vblank_simulate: vblank timer overrun [ 557.951931][ T30] audit: type=1400 audit(1764831667.739:951): avc: denied { watch_mount } for pid=12488 comm="syz.5.1882" path="/" dev="mqueue" ino=12070 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 558.357829][T12494] ip6_vti0 speed is unknown, defaulting to 1000 [ 558.616562][T12498] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 558.828329][T12494] lo speed is unknown, defaulting to 1000 [ 558.902361][ T30] audit: type=1400 audit(1764831668.628:952): avc: denied { nlmsg_read } for pid=12508 comm="syz.4.1886" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 560.909230][T12531] fuse: Unknown parameter '56'ʰ{' [ 561.690306][T12545] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 562.522357][T12560] tmpfs: Bad value for 'mpol' [ 564.524555][T12577] gfs2: error -5 reading superblock [ 566.531779][T12596] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 566.806188][T12612] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 566.829017][T12612] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 566.838327][T12612] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 566.849500][T12612] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 566.859461][T12612] kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 566.868001][T12612] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 567.093110][T12623] kvm: kvm [12616]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0xf800 [ 567.204476][T12623] kvm: kvm [12616]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0xf800 [ 567.339127][ T30] audit: type=1400 audit(1764831676.523:953): avc: denied { connect } for pid=12616 comm="syz.5.1914" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 569.172423][T12648] tipc: Enabled bearer , priority 31 [ 569.182635][T12648] syzkaller0: entered promiscuous mode [ 569.188315][T12648] syzkaller0: entered allmulticast mode [ 569.723342][T12636] tipc: Resetting bearer [ 569.737368][T12636] tipc: Disabling bearer [ 570.277539][ T30] audit: type=1400 audit(1764831679.273:954): avc: denied { create } for pid=12658 comm="syz.4.1922" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 570.356949][ T30] audit: type=1400 audit(1764831679.329:955): avc: denied { ioctl } for pid=12658 comm="syz.4.1922" path="socket:[40912]" dev="sockfs" ino=40912 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 570.741229][T12663] binder: 12662:12663 unknown command 0 [ 570.746847][T12663] binder: 12662:12663 ioctl c0306201 200000000080 returned -22 [ 570.759245][T12663] binder: 12662:12663 ioctl c0306201 2000000003c0 returned -14 [ 571.086964][ T5873] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 571.259876][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 571.289512][ T5873] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 571.319415][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 571.353772][ T5873] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 571.380389][ T5873] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 571.821277][ T5873] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.831770][ T5873] usb 3-1: config 0 descriptor?? [ 572.088017][ T5873] hdpvr 3-1:0.0: unexpected answer of status request, len 0 [ 572.113114][ T5873] hdpvr 3-1:0.0: device init failed [ 572.118847][ T5873] hdpvr 3-1:0.0: probe with driver hdpvr failed with error -12 [ 572.203554][T12694] netlink: 'syz.4.1933': attribute type 22 has an invalid length. [ 572.203554][T12696] netlink: 'syz.4.1933': attribute type 22 has an invalid length. [ 572.203574][T12696] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 572.221470][T12694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 572.285443][ T3428] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.285538][T12694] netlink: 'syz.4.1933': attribute type 22 has an invalid length. [ 572.299125][T12696] netlink: 'syz.4.1933': attribute type 22 has an invalid length. [ 572.313146][ T3428] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.314837][T12694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 572.359529][T12696] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 572.368607][ T3428] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 572.387554][ T3428] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.395000][ T6395] usb 3-1: USB disconnect, device number 64 [ 575.043839][ T9] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 575.491530][ T9] usb 2-1: device descriptor read/64, error -71 [ 575.508661][T12747] input: syz0 as /devices/virtual/input/input24 [ 575.607187][ T30] audit: type=1326 audit(1764831684.249:956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 575.645859][ T30] audit: type=1326 audit(1764831684.277:957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 575.683348][ T30] audit: type=1326 audit(1764831684.287:958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 575.780240][ T9] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 575.808556][ T30] audit: type=1326 audit(1764831684.287:959): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 575.958308][ T30] audit: type=1326 audit(1764831684.287:960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.395211][ T9] usb 2-1: device descriptor read/64, error -71 [ 576.448321][ T30] audit: type=1326 audit(1764831684.287:961): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=446 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.530526][ T9] usb usb2-port1: attempt power cycle [ 576.568734][ T30] audit: type=1326 audit(1764831684.287:962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.630139][ T30] audit: type=1326 audit(1764831684.287:963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.796594][ T5873] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 576.928339][ T30] audit: type=1326 audit(1764831684.287:964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=17 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.955467][ T30] audit: type=1326 audit(1764831684.287:965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12748 comm="syz.3.1947" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3daf8f749 code=0x7ffc0000 [ 576.982232][ T9] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 577.086861][ T5873] usb 6-1: Using ep0 maxpacket: 16 [ 577.132906][ T5873] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 577.401477][ T5873] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 577.525700][ T5873] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.551167][ T5873] usb 6-1: Product: syz [ 577.561951][ T5873] usb 6-1: Manufacturer: syz [ 577.590581][ T5873] usb 6-1: SerialNumber: syz [ 577.613135][ T5873] usb 6-1: config 0 descriptor?? [ 577.638939][ T5873] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 577.671906][ T5873] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 577.722569][ T9] usb 2-1: device descriptor read/8, error -71 [ 578.072914][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 578.104396][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 578.297704][ T5873] em28xx 6-1:0.0: chip ID is em28174 [ 578.527743][T12758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 578.540550][T12758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.748131][T12793] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1960'. [ 579.607239][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 580.322856][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 580.335395][ T5873] em28xx 6-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 580.346660][ T5873] em28xx 6-1:0.0: board has no eeprom [ 580.353415][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.364563][ T9] usb 2-1: config 0 has no interfaces? [ 580.374407][T12782] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 580.386383][ T9] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 580.402847][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.415310][ T9] usb 2-1: Product: syz [ 580.419840][ T9] usb 2-1: Manufacturer: syz [ 580.424508][ T9] usb 2-1: SerialNumber: syz [ 580.430481][ T5873] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 580.446749][ T5873] em28xx 6-1:0.0: dvb set to bulk mode. [ 580.453395][ T9] usb 2-1: config 0 descriptor?? [ 580.460707][ T5866] em28xx 6-1:0.0: Binding DVB extension [ 580.484214][ T5873] usb 6-1: USB disconnect, device number 40 [ 580.517558][ T5873] em28xx 6-1:0.0: Disconnecting em28xx [ 580.604723][T12803] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1962'. [ 580.661691][ T5866] em28xx 6-1:0.0: Registering input extension [ 580.740518][ T5866] rc_core: IR keymap rc-pinnacle-pctv-hd not found [ 580.750567][ T5866] Registered IR keymap rc-empty [ 580.772199][ T5866] rc rc0: PCTV tripleStick (292e) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 580.791631][ T5866] input: PCTV tripleStick (292e) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input26 [ 580.811485][ T5866] em28xx 6-1:0.0: Input extension successfully initialized [ 580.819273][ T5873] em28xx 6-1:0.0: Closing input extension [ 580.999789][ T5873] em28xx 6-1:0.0: Freeing device [ 581.211374][T12813] ip6_vti0 speed is unknown, defaulting to 1000 [ 581.620727][T12813] lo speed is unknown, defaulting to 1000 [ 581.736890][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 581.736905][ T30] audit: type=1326 audit(1764831689.993:980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 581.785460][ T9] usb 2-1: USB disconnect, device number 36 [ 581.911682][ T30] audit: type=1326 audit(1764831690.142:981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 581.968036][ T5873] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 582.214668][ T30] audit: type=1326 audit(1764831690.395:982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.344255][ T5873] usb 6-1: Using ep0 maxpacket: 16 [ 582.457715][ T30] audit: type=1326 audit(1764831690.395:983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.483646][ T5873] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 582.500891][ T30] audit: type=1326 audit(1764831690.395:984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.534959][ T5873] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 582.613957][ T5873] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.623486][ T30] audit: type=1326 audit(1764831690.498:985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.764191][ T5873] usb 6-1: config 0 descriptor?? [ 582.917150][ T30] audit: type=1326 audit(1764831690.657:986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.945236][ T30] audit: type=1326 audit(1764831690.657:987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 582.970430][ T30] audit: type=1326 audit(1764831690.685:988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 583.000273][ T30] audit: type=1326 audit(1764831690.685:989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12809 comm="syz.5.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbdbbb8f34b code=0x7ffc0000 [ 583.475623][ T5873] mcp2221 0003:04D8:00DD.0008: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 583.790558][T12846] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1973'. [ 583.830751][ T5873] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 583.855482][T12847] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=12847 comm=syz.1.1973 [ 583.923534][ T9] usb 6-1: USB disconnect, device number 41 [ 583.954098][T12849] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=12849 comm=syz.4.1974 [ 584.010112][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 584.033948][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 584.046883][ T5873] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 584.059795][ T5873] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.076155][ T5873] usb 3-1: config 0 descriptor?? [ 584.279887][ T9] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 584.580454][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 584.628167][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 584.643839][ T9] usb 2-1: config 4 interface 0 has no altsetting 0 [ 584.677125][ T9] usb 2-1: string descriptor 0 read error: -22 [ 584.683408][ T9] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 584.703607][ T9] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 584.717169][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.727764][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.737895][ T9] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 584.749916][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.756883][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.770005][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 584.803229][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.811127][ T9] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 584.825371][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.832763][ T9] usb 2-1: media controller created [ 584.841402][ T5873] cp2112 0003:10C4:EA90.0009: unknown main item tag 0x0 [ 584.885502][ T5873] cp2112 0003:10C4:EA90.0009: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 584.899243][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 584.920930][ T6395] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 584.932596][T12876] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1980'. [ 585.070329][ T5873] cp2112 0003:10C4:EA90.0009: error requesting version [ 585.078682][ T5873] cp2112 0003:10C4:EA90.0009: probe with driver cp2112 failed with error -5 [ 585.134593][ T6395] usb 6-1: Using ep0 maxpacket: 32 [ 585.142002][ T6395] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 585.646858][ T6395] usb 6-1: config 0 has no interfaces? [ 585.667564][ T6395] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 585.694242][ T6395] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.714365][ T6395] usb 6-1: Product: syz [ 585.719682][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 585.723876][ T6395] usb 6-1: Manufacturer: syz [ 585.745411][ T6395] usb 6-1: SerialNumber: syz [ 585.763158][ T6395] usb 6-1: config 0 descriptor?? [ 585.792891][ T9] usb 2-1: USB disconnect, device number 37 [ 586.119939][T12893] netlink: 'syz.3.1984': attribute type 1 has an invalid length. [ 586.758933][ T6395] usb 6-1: USB disconnect, device number 42 [ 586.867435][ T37] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 587.336550][T12908] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 587.689671][ T37] usb 4-1: Using ep0 maxpacket: 8 [ 587.695157][ T6395] usb 3-1: USB disconnect, device number 65 [ 587.722631][ T37] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 587.744901][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.771127][ T37] usb 4-1: Product: syz [ 587.782136][ T37] usb 4-1: Manufacturer: syz [ 587.804537][ T37] usb 4-1: SerialNumber: syz [ 587.817352][ T37] usb 4-1: config 0 descriptor?? [ 588.866845][ T37] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 589.025861][ T5886] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 589.189712][ T5886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 589.220733][T12919] kvm: Disabled LAPIC found during irq injection [ 589.245824][ T5886] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 589.255681][ T5886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 589.268336][ T5886] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 589.278175][ T5886] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 589.287653][ T5886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 589.297412][ T5886] usb 2-1: config 0 descriptor?? [ 589.311945][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 589.311956][ T30] audit: type=1400 audit(1764831697.064:1026): avc: denied { relabelfrom } for pid=12897 comm="syz.3.1985" name="NETLINK" dev="sockfs" ino=43390 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 589.315022][T12921] SELinux: Context system_u:object_r:fuse_device_t:s0 is not valid (left unmapped). [ 589.354303][ T30] audit: type=1400 audit(1764831697.111:1027): avc: denied { relabelto } for pid=12897 comm="syz.3.1985" name="NETLINK" dev="sockfs" ino=43390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netlink_route_socket permissive=1 trawcon="system_u:object_r:fuse_device_t:s0" [ 589.385568][ T37] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 589.497623][ T37] usb 4-1: USB disconnect, device number 44 [ 589.517714][ T9] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 589.521712][ T5886] hdpvr 2-1:0.0: firmware version 0xd dated jl;S11!vOp [ 589.521712][ T5886] 4(r [ 589.521712][ T5886] d2}d~٭^r [ 589.734166][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 589.745300][ T9] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 589.756452][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 589.774169][ T9] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 589.819828][ T9] usb 6-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 589.836410][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.310020][ T9] usb 6-1: config 0 descriptor?? [ 590.553838][ T9] hdpvr 6-1:0.0: unexpected answer of status request, len 0 [ 590.561605][ T9] hdpvr 6-1:0.0: device init failed [ 590.571805][ T9] hdpvr 6-1:0.0: probe with driver hdpvr failed with error -12 [ 591.780297][T12962] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2001'. [ 593.138458][ T5886] hdpvr 2-1:0.0: Could not setup controls [ 593.409965][ T5886] hdpvr 2-1:0.0: registering videodev failed [ 593.423879][ T5886] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -71 [ 593.437391][ T5886] usb 2-1: USB disconnect, device number 38 [ 593.467239][ T10] usb 6-1: USB disconnect, device number 43 [ 594.955199][ T30] audit: type=1326 audit(1764831701.685:1028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12983 comm="syz.5.2009" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbdbbb8f749 code=0x0 [ 597.786712][ T30] audit: type=1400 audit(1764831704.996:1029): avc: denied { write } for pid=13033 comm="syz.2.2020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 597.879079][ T6395] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 598.202422][T13045] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2024'. [ 598.210212][ T6395] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 598.236213][ T6395] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 598.262675][ T6395] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 598.272425][ T6395] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 598.307785][ T6395] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 598.317394][ T6395] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.329275][ T6395] usb 4-1: config 0 descriptor?? [ 598.337576][ T30] audit: type=1800 audit(1764831705.511:1030): pid=13051 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2026" name="nullb0" dev="tmpfs" ino=1291 res=0 errno=0 [ 598.851706][ T6395] hdpvr 4-1:0.0: unexpected answer of status request, len 0 [ 598.859158][ T6395] hdpvr 4-1:0.0: device init failed [ 598.868259][ T6395] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 599.429888][ T30] audit: type=1400 audit(1764831706.540:1031): avc: denied { remount } for pid=13070 comm="syz.5.2034" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 599.559939][T13072] netlink: 'syz.5.2034': attribute type 2 has an invalid length. [ 600.587854][ T6395] usb 4-1: USB disconnect, device number 45 [ 600.671969][T13088] binder: 13086:13088 unknown command 0 [ 600.677692][T13088] binder: 13086:13088 ioctl c0306201 200000000080 returned -22 [ 600.709003][T13088] binder: BINDER_SET_CONTEXT_MGR already set [ 600.715230][T13088] binder: 13086:13088 ioctl 4018620d 200000000040 returned -16 [ 600.731374][T13088] binder: 13086:13088 ioctl c0306201 2000000003c0 returned -14 [ 601.176414][T13098] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2042'. [ 601.265563][T13097] vlan2: entered allmulticast mode [ 601.277363][T13097] veth0_to_bond: entered allmulticast mode [ 602.673911][T13102] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2043'. [ 602.788387][ T9] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 602.796957][T13102] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2043'. [ 602.966348][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 602.972922][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 603.006746][ T9] usb 6-1: config 0 has no interfaces? [ 603.025364][ T9] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 603.037246][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.047178][ T9] usb 6-1: Product: syz [ 603.051541][ T9] usb 6-1: Manufacturer: syz [ 603.140549][ T9] usb 6-1: SerialNumber: syz [ 604.573039][T13125] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2048'. [ 604.880948][ T9] usb 6-1: config 0 descriptor?? [ 605.674331][ T9] usb 6-1: USB disconnect, device number 44 [ 606.377409][ T9] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 607.107068][ T9] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 607.124845][ T9] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.134741][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 607.134776][ T9] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 607.134795][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.148316][ T9] usb 2-1: config 0 descriptor?? [ 608.989876][T13177] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13177 comm=syz.1.2055 [ 609.006446][T13177] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 609.517146][ T30] audit: type=1400 audit(1764831715.969:1032): avc: denied { map } for pid=13174 comm="syz.3.2062" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 609.689592][ T30] audit: type=1400 audit(1764831716.025:1033): avc: denied { execute } for pid=13174 comm="syz.3.2062" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 610.761460][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 610.767457][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 610.790882][ T9] usb 2-1: USB disconnect, device number 39 [ 611.900045][T12922] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 612.107147][T12922] usb 4-1: Using ep0 maxpacket: 32 [ 612.118108][T12922] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 612.130711][T12922] usb 4-1: config 0 has no interfaces? [ 612.236665][T12922] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 612.678749][T12922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.689215][T12922] usb 4-1: Product: syz [ 612.694226][T12922] usb 4-1: Manufacturer: syz [ 612.699720][T12922] usb 4-1: SerialNumber: syz [ 612.815992][T12922] usb 4-1: config 0 descriptor?? [ 613.092600][T13214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2072'. [ 613.623560][T12922] usb 4-1: USB disconnect, device number 46 [ 614.250672][T13234] Cannot find del_set index 1 as target [ 614.285763][T13236] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13236 comm=syz.2.2077 [ 614.367734][ T30] audit: type=1400 audit(1764831720.505:1034): avc: denied { read } for pid=13225 comm="syz.5.2075" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 614.427548][T13238] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 614.463776][T13238] block device autoloading is deprecated and will be removed. [ 614.493116][ T30] audit: type=1400 audit(1764831720.543:1035): avc: denied { open } for pid=13225 comm="syz.5.2075" path="/370/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 614.524390][ T57] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 614.868296][ T57] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 615.181931][ T57] usb 2-1: config 0 has no interface number 0 [ 615.228017][ T57] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 615.244273][ T57] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.258336][ T57] usb 2-1: Product: syz [ 615.269386][ T57] usb 2-1: Manufacturer: syz [ 615.277695][ T57] usb 2-1: SerialNumber: syz [ 615.371866][ T57] usb 2-1: config 0 descriptor?? [ 615.966703][ T57] usb 2-1: Firmware: major: 0, minor: 107, hardware type: HULUSB (4) [ 616.015828][ T9] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 616.210296][T13231] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2076'. [ 616.229707][ T57] usb 2-1: failed to fetch extended address, random address set [ 616.324760][T13257] tipc: Enabled bearer , priority 0 [ 616.703652][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 616.705256][T13257] syzkaller0: entered promiscuous mode [ 616.714235][T13257] syzkaller0: entered allmulticast mode [ 616.727795][ T9] usb 3-1: config 1 interface 0 altsetting 7 bulk endpoint 0x1 has invalid maxpacket 32 [ 616.738155][ T9] usb 3-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 616.753621][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 616.779776][ T30] audit: type=1400 audit(1764831722.769:1036): avc: denied { read } for pid=5486 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 616.810446][ T57] usb 2-1: USB disconnect, device number 40 [ 616.825840][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 616.864385][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.895541][ T9] usb 3-1: Product: 嗚瞮™!žﰋ巂㚰縬栒u蠭鰲쿔﨟썦矜⩞춓兀艄▅ﶧ砹消猽㭑騥䟓쐷둇ꂹ鷡⨴࿮ứ✉ี囼్嗍㴫 [ 616.914991][ T9] usb 3-1: Manufacturer: ࡃ [ 616.923164][ T9] usb 3-1: SerialNumber: 栿퍢逝倛屄鬨閐爒镼璡簘氝⎴ᬂ㟵襪㢲ᮎ蒁堃颮ꀗ䅦᯾쯈揍ḱ幧눷꒱팧瀈埿ፅ䞮痀⎜vꟉ姡ⳮ㖽㏄≧ﵧ줅漨ዚ䷺唭ᵬ䑁⬧䱴᭒휱㮂㪞橵ₙ鿘콫馋ﾷෲ [ 616.923290][T13253] tipc: Resetting bearer [ 616.962220][T13247] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 616.969635][T13247] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 616.990496][T13253] tipc: Disabling bearer [ 617.235079][ T10] usb 3-1: USB disconnect, device number 66 [ 617.853310][T13279] input: syz0 as /devices/virtual/input/input27 [ 617.946358][ T30] audit: type=1400 audit(1764831723.854:1037): avc: denied { listen } for pid=13246 comm="syz.2.2081" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 617.965914][ C0] vkms_vblank_simulate: vblank timer overrun [ 618.841554][T13285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2092'. [ 618.852740][T13285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2092'. [ 618.861737][T13285] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2092'. [ 620.834614][ T30] audit: type=1400 audit(1764831726.557:1038): avc: denied { ioctl } for pid=13299 comm="syz.2.2095" path="socket:[45057]" dev="sockfs" ino=45057 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 621.993447][T13321] netlink: zone id is out of range [ 621.999772][T13321] netlink: zone id is out of range [ 622.005433][T13321] netlink: zone id is out of range [ 622.010785][T13321] netlink: zone id is out of range [ 622.016032][T13321] netlink: zone id is out of range [ 622.024569][T13321] netlink: zone id is out of range [ 622.032483][T13321] netlink: zone id is out of range [ 622.037825][T13321] netlink: zone id is out of range [ 622.047475][T13321] netlink: zone id is out of range [ 622.052705][T13321] netlink: zone id is out of range [ 622.168790][ T5886] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 622.586223][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 622.608429][ T5886] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 622.643251][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 622.667036][ T5886] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 622.682398][ T5886] usb 6-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 622.772591][ T5886] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.792691][ T5886] usb 6-1: config 0 descriptor?? [ 622.872257][ T9] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 623.287458][ T5886] hdpvr 6-1:0.0: unexpected answer of status request, len 0 [ 623.301403][ T5886] hdpvr 6-1:0.0: device init failed [ 623.317303][ T5886] hdpvr 6-1:0.0: probe with driver hdpvr failed with error -12 [ 623.378226][T13343] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2109'. [ 623.462474][ T9] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 623.472440][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.484632][ T9] usb 3-1: config 0 descriptor?? [ 623.506110][ T9] cp210x 3-1:0.0: cp210x converter detected [ 623.736408][ T30] audit: type=1400 audit(1764831729.270:1039): avc: denied { read } for pid=13330 comm="syz.2.2105" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 623.809626][ T5142] Bluetooth: hci4: unexpected event for opcode 0x203d [ 623.842819][ T5886] kernel read not supported for file /input/event1 (pid: 5886 comm: kworker/1:3) [ 624.127097][ T9] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 624.269583][T13368] Invalid logical block size (5) [ 624.362715][ T9] usb 3-1: cp210x converter now attached to ttyUSB0 [ 624.410657][T13373] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2122'. [ 624.597064][T13331] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2105'. [ 624.653094][ T9] usb 3-1: USB disconnect, device number 67 [ 624.683350][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 624.708015][ T9] cp210x 3-1:0.0: device disconnected [ 625.523028][ T9] usb 6-1: USB disconnect, device number 45 [ 626.199890][ T30] audit: type=1400 audit(1764831731.580:1040): avc: denied { map } for pid=13393 comm="syz.5.2128" path="socket:[45303]" dev="sockfs" ino=45303 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 626.223866][ C1] vkms_vblank_simulate: vblank timer overrun [ 626.244712][T13401] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2128'. [ 626.304425][ T10] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 626.601769][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 627.343001][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 627.513019][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 627.695835][ T10] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 628.238575][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.272544][ T10] usb 3-1: config 0 descriptor?? [ 628.765495][T13429] FAULT_INJECTION: forcing a failure. [ 628.765495][T13429] name failslab, interval 1, probability 0, space 0, times 0 [ 628.802352][T13429] CPU: 1 UID: 0 PID: 13429 Comm: syz.1.2138 Not tainted syzkaller #0 PREEMPT(full) [ 628.802376][T13429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 628.802386][T13429] Call Trace: [ 628.802391][T13429] [ 628.802397][T13429] dump_stack_lvl+0x16c/0x1f0 [ 628.802418][T13429] should_fail_ex+0x512/0x640 [ 628.802434][T13429] ? kmem_cache_alloc_noprof+0x62/0x720 [ 628.802460][T13429] should_failslab+0xc2/0x120 [ 628.802482][T13429] kmem_cache_alloc_noprof+0x75/0x720 [ 628.802505][T13429] ? skb_clone+0x190/0x3f0 [ 628.802526][T13429] ? skb_clone+0x190/0x3f0 [ 628.802540][T13429] skb_clone+0x190/0x3f0 [ 628.802557][T13429] pfkey_process+0xc6/0x840 [ 628.802575][T13429] ? trace_contention_end+0xdd/0x110 [ 628.802597][T13429] ? __mutex_lock+0x27b/0x1b10 [ 628.802615][T13429] ? __pfx_pfkey_process+0x10/0x10 [ 628.802659][T13429] pfkey_sendmsg+0x42c/0x850 [ 628.802682][T13429] ____sys_sendmsg+0xa5d/0xc30 [ 628.802702][T13429] ? copy_msghdr_from_user+0x10a/0x160 [ 628.802717][T13429] ? __pfx_____sys_sendmsg+0x10/0x10 [ 628.802741][T13429] ? __pfx__kstrtoull+0x10/0x10 [ 628.802766][T13429] ___sys_sendmsg+0x134/0x1d0 [ 628.802785][T13429] ? __pfx____sys_sendmsg+0x10/0x10 [ 628.802814][T13429] ? find_held_lock+0x2b/0x80 [ 628.802845][T13429] __sys_sendmmsg+0x200/0x420 [ 628.802863][T13429] ? __pfx___sys_sendmmsg+0x10/0x10 [ 628.802888][T13429] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 628.802917][T13429] ? fput+0x70/0xf0 [ 628.802940][T13429] ? ksys_write+0x1ac/0x250 [ 628.802960][T13429] ? __pfx_ksys_write+0x10/0x10 [ 628.802983][T13429] __x64_sys_sendmmsg+0x9c/0x100 [ 628.802997][T13429] ? lockdep_hardirqs_on+0x7c/0x110 [ 628.803014][T13429] do_syscall_64+0xcd/0xf80 [ 628.803033][T13429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.803049][T13429] RIP: 0033:0x7f72df78f749 [ 628.803063][T13429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 628.803079][T13429] RSP: 002b:00007f72e062d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 628.803095][T13429] RAX: ffffffffffffffda RBX: 00007f72df9e5fa0 RCX: 00007f72df78f749 [ 628.803106][T13429] RDX: 000000000400008a RSI: 0000200000000180 RDI: 0000000000000003 [ 628.803117][T13429] RBP: 00007f72e062d090 R08: 0000000000000000 R09: 0000000000000000 [ 628.803127][T13429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 628.803137][T13429] R13: 00007f72df9e6038 R14: 00007f72df9e5fa0 R15: 00007fffb0b4dbe8 [ 628.803159][T13429] [ 629.051736][ C1] vkms_vblank_simulate: vblank timer overrun [ 629.296067][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 629.337343][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 629.417358][ T10] usb 3-1: USB disconnect, device number 68 [ 629.613002][T13456] netlink: 'syz.4.2147': attribute type 64 has an invalid length. [ 629.625840][T13456] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2147'. [ 629.637210][T13456] gretap0: entered allmulticast mode [ 629.644704][T13456] net_ratelimit: 12 callbacks suppressed [ 629.644734][T13456] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 630.794691][T13466] netlink: 'syz.2.2151': attribute type 1 has an invalid length. [ 631.385100][T13479] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 631.814296][T13477] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2152'. [ 631.860987][T13466] bond2: entered promiscuous mode [ 631.906287][T13466] 8021q: adding VLAN 0 to HW filter on device bond2 [ 631.916860][T13477] gretap0: entered promiscuous mode [ 631.967176][T13483] 8021q: adding VLAN 0 to HW filter on device bond2 [ 631.975700][T13483] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 631.991640][T12922] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 632.020886][T13483] bond2: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 632.061731][T13483] bond2: (slave vcan1): making interface the new active one [ 632.094396][T13483] vcan1: entered promiscuous mode [ 632.109892][T13483] bond2: (slave vcan1): Enslaving as an active interface with an up link [ 632.184362][T12922] usb 2-1: Using ep0 maxpacket: 8 [ 632.216292][T12922] usb 2-1: config 1 has an invalid interface number: 133 but max is 0 [ 632.224463][T12922] usb 2-1: config 1 has no interface number 0 [ 632.361174][T12922] usb 2-1: config 1 interface 133 altsetting 4 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 632.395701][T12922] usb 2-1: config 1 interface 133 has no altsetting 0 [ 632.424697][T12922] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=40.f3 [ 632.471354][T12922] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.855908][T13478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 632.898251][T13478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.922370][T12922] usb 2-1: string descriptor 0 read error: -71 [ 632.960073][T12922] usb 2-1: USB disconnect, device number 41 [ 633.300629][ T5886] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 633.937006][ T5886] usb 3-1: Using ep0 maxpacket: 32 [ 633.974279][ T5886] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 634.000307][ T5886] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.018057][ T5886] usb 3-1: Product: syz [ 634.073334][ T5886] usb 3-1: Manufacturer: syz [ 634.227428][ T5886] usb 3-1: SerialNumber: syz [ 634.391518][ T5886] usb 3-1: config 0 descriptor?? [ 634.414523][ T5886] ttusb_dec_send_command: command bulk message failed: error -22 [ 634.433697][ T5886] ttusb-dec 3-1:0.0: probe with driver ttusb-dec failed with error -22 [ 634.564198][T13514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.940142][T13519] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2157'. [ 634.983362][ T5886] usb 3-1: USB disconnect, device number 69 [ 634.994650][ T30] audit: type=1400 audit(1764831739.672:1041): avc: denied { mount } for pid=13511 comm="syz.5.2157" name="/" dev="autofs" ino=45619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 635.019560][T13514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 635.048739][ T9] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 635.229698][ T30] audit: type=1400 audit(1764831740.018:1042): avc: denied { getattr } for pid=13527 comm="syz.4.2166" name="/" dev="pidfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 635.285462][ T9] usb 2-1: config index 0 descriptor too short (expected 41, got 33) [ 635.293660][ T9] usb 2-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 635.305461][ T9] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 635.316623][ T9] usb 2-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 635.553714][ T30] audit: type=1400 audit(1764831740.326:1043): avc: denied { unmount } for pid=6689 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 635.631211][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 635.669408][T13537] Cannot find del_set index 1 as target [ 635.710081][ T9] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 635.719596][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.730018][ T9] usb 2-1: Product: syz [ 635.734231][ T9] usb 2-1: Manufacturer: syz [ 635.738816][ T9] usb 2-1: SerialNumber: syz [ 635.749320][T13516] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 635.782367][T13542] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2171'. [ 635.933813][T13546] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 635.934057][T13545] IPVS: sh: FWM 3 0x00000003 - no destination available [ 635.951556][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 636.151406][ T9] rtl8150 2-1:1.0: couldn't find required endpoints [ 636.158453][ T9] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 636.212156][ T9] usb 2-1: USB disconnect, device number 42 [ 637.716616][T13558] IPVS: rr: FWM 3 0x00000003 - no destination available [ 637.723960][ C1] IPVS: rr: FWM 3 0x00000003 - no destination available [ 637.808393][T13560] FAULT_INJECTION: forcing a failure. [ 637.808393][T13560] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 637.822040][T13560] CPU: 1 UID: 0 PID: 13560 Comm: syz.3.2173 Not tainted syzkaller #0 PREEMPT(full) [ 637.822062][T13560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 637.822073][T13560] Call Trace: [ 637.822079][T13560] [ 637.822085][T13560] dump_stack_lvl+0x16c/0x1f0 [ 637.822109][T13560] should_fail_ex+0x512/0x640 [ 637.822130][T13560] _copy_from_user+0x2e/0xd0 [ 637.822157][T13560] user_termios_to_kernel_termios_1+0x21/0x30 [ 637.822176][T13560] tty_mode_ioctl+0x400/0xd30 [ 637.822194][T13560] ? __pfx_tty_mode_ioctl+0x10/0x10 [ 637.822214][T13560] ? finish_task_switch.isra.0+0x207/0xbc0 [ 637.822237][T13560] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 637.822267][T13560] ? __pfx_n_tty_ioctl+0x10/0x10 [ 637.822288][T13560] n_tty_ioctl_helper+0x4b/0x2b0 [ 637.822306][T13560] n_tty_ioctl+0x7f/0x370 [ 637.822331][T13560] ? __pfx_n_tty_ioctl+0x10/0x10 [ 637.822351][T13560] tty_ioctl+0x700/0x1650 [ 637.822371][T13560] ? __pfx_tty_ioctl+0x10/0x10 [ 637.822392][T13560] ? rcu_is_watching+0x12/0xc0 [ 637.822409][T13560] ? irqentry_exit+0x1dd/0x8c0 [ 637.822426][T13560] ? lockdep_hardirqs_on+0x7c/0x110 [ 637.822444][T13560] ? irqentry_exit+0x1dd/0x8c0 [ 637.822461][T13560] ? rcu_is_watching+0x12/0xc0 [ 637.822488][T13560] ? do_vfs_ioctl+0xdf6/0x14f0 [ 637.822506][T13560] ? do_vfs_ioctl+0x128/0x14f0 [ 637.822523][T13560] ? do_vfs_ioctl+0x181/0x14f0 [ 637.822540][T13560] ? __pfx_tty_ioctl+0x10/0x10 [ 637.822560][T13560] __x64_sys_ioctl+0x18e/0x210 [ 637.822580][T13560] do_syscall_64+0xcd/0xf80 [ 637.822600][T13560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.822623][T13560] RIP: 0033:0x7fb3daf8f749 [ 637.822637][T13560] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 637.822653][T13560] RSP: 002b:00007fb3dbd7a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 637.822669][T13560] RAX: ffffffffffffffda RBX: 00007fb3db1e6180 RCX: 00007fb3daf8f749 [ 637.822680][T13560] RDX: 0000200000000000 RSI: 0000000000005457 RDI: 0000000000000008 [ 637.822690][T13560] RBP: 00007fb3dbd7a090 R08: 0000000000000000 R09: 0000000000000000 [ 637.822700][T13560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 637.822709][T13560] R13: 00007fb3db1e6218 R14: 00007fb3db1e6180 R15: 00007ffe5244e458 [ 637.822735][T13560] [ 638.424385][T13573] tipc: Enabled bearer , priority 0 [ 638.434384][T13573] syzkaller0: entered promiscuous mode [ 638.439926][T13573] syzkaller0: entered allmulticast mode [ 638.452619][ T9] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 638.972662][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 639.010438][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 639.026363][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 639.124801][T13564] tipc: Resetting bearer [ 639.137328][T13564] tipc: Disabling bearer [ 639.154020][ T9] usb 2-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.00 [ 639.167634][T13576] fuse: Unknown parameter 'grup_id' [ 639.549664][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.573845][ T9] usb 2-1: config 0 descriptor?? [ 639.640226][T13587] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2184'. [ 639.675347][T13587] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2184'. [ 640.385273][T13591] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2186'. [ 640.737483][ T9] topre 0003:0853:0313.000A: item fetching failed at offset 5/7 [ 640.756501][ T9] topre 0003:0853:0313.000A: probe with driver topre failed with error -22 [ 641.121040][ T6340] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 641.231157][T13604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 641.240384][T13604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 641.462144][ T6340] usb 3-1: Using ep0 maxpacket: 8 [ 641.475780][ T6340] usb 3-1: config 1 interface 0 altsetting 7 bulk endpoint 0x1 has invalid maxpacket 32 [ 641.507695][ T6340] usb 3-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 641.530754][ T9] usb 2-1: USB disconnect, device number 43 [ 641.549164][ T6340] usb 3-1: config 1 interface 0 has no altsetting 0 [ 641.661440][ T6340] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 641.677255][ T6340] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.698333][ T6340] usb 3-1: Product: 嗚瞮™!žﰋ巂㚰縬栒u蠭鰲쿔﨟썦矜⩞춓兀艄▅ﶧ砹消猽㭑騥䟓쐷둇ꂹ鷡⨴࿮ứ✉ี囼్嗍㴫 [ 641.731207][ T6340] usb 3-1: Manufacturer: ࡃ [ 641.741661][ T6340] usb 3-1: SerialNumber: 栿퍢逝倛屄鬨閐爒镼璡簘氝⎴ᬂ㟵襪㢲ᮎ蒁堃颮ꀗ䅦᯾쯈揍ḱ幧눷꒱팧瀈埿ፅ䞮痀⎜vꟉ姡ⳮ㖽㏄≧ﵧ줅漨ዚ䷺唭ᵬ䑁⬧䱴᭒휱㮂㪞橵ₙ鿘콫馋ﾷෲ [ 641.796663][T13596] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 641.817740][T13596] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 642.327279][ T9] IPVS: starting estimator thread 0... [ 642.340030][ T6340] usb 3-1: USB disconnect, device number 70 [ 642.469840][T13624] IPVS: using max 82 ests per chain, 196800 per kthread [ 643.634900][T13637] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2200'. [ 643.682745][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 643.689896][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 643.698855][T13639] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=13639 comm=syz.1.2200 [ 643.741359][T13596] input: syz0 as /devices/virtual/input/input29 [ 644.189507][ T5928] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 644.339289][ T5928] usb 2-1: device descriptor read/64, error -71 [ 644.595844][ T5928] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 644.622762][T13663] macvtap1: entered promiscuous mode [ 644.629111][T13663] bond0: entered promiscuous mode [ 644.634210][T13663] bond_slave_0: entered promiscuous mode [ 644.641378][T13663] bond_slave_1: entered promiscuous mode [ 644.651305][T13663] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 644.661698][T13663] bond0: left promiscuous mode [ 644.666469][T13663] bond_slave_0: left promiscuous mode [ 644.673897][T13663] bond_slave_1: left promiscuous mode [ 644.745124][ T5928] usb 2-1: device descriptor read/64, error -71 [ 644.873795][ T5928] usb usb2-port1: attempt power cycle [ 645.042364][T13681] netlink: 'syz.3.2207': attribute type 7 has an invalid length. [ 645.408058][ T5928] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 645.568894][ T5928] usb 2-1: device descriptor read/8, error -71 [ 646.282637][T13687] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2215'. [ 646.299005][T13685] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=13685 comm=syz.2.2215 [ 646.413368][ T5928] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 646.445348][ T5928] usb 2-1: device descriptor read/8, error -71 [ 646.654360][ T5928] usb usb2-port1: unable to enumerate USB device [ 646.839750][T13696] input: syz0 as /devices/virtual/input/input30 [ 647.169085][T13703] syzkaller0: entered promiscuous mode [ 647.174616][T13703] syzkaller0: entered allmulticast mode [ 648.873922][ T5895] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 648.938976][T13735] input: syz0 as /devices/virtual/input/input32 [ 649.064780][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 649.077985][ T5895] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 649.109614][ T5895] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 649.148931][ T5895] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 649.188779][ T5895] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.218137][ T5895] usb 4-1: config 0 descriptor?? [ 649.902873][ T5895] konepure 0003:1E7D:2DB4.000B: unknown main item tag 0x0 [ 649.927797][ T5895] konepure 0003:1E7D:2DB4.000B: unknown main item tag 0x0 [ 649.954078][ T5895] konepure 0003:1E7D:2DB4.000B: item fetching failed at offset 2/4 [ 649.982426][ T5895] konepure 0003:1E7D:2DB4.000B: parse failed [ 650.010010][ T5895] konepure 0003:1E7D:2DB4.000B: probe with driver konepure failed with error -22 [ 650.177192][ T5928] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 650.251064][ T5886] usb 4-1: USB disconnect, device number 47 [ 650.394087][ T5928] usb 2-1: config 0 has an invalid interface number: 2 but max is 0 [ 650.432009][ T5928] usb 2-1: config 0 has no interface number 0 [ 650.464644][ T5928] usb 2-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 650.509017][ T5928] usb 2-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 650.540135][ T5928] usb 2-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 192, setting to 64 [ 650.567904][ T5928] usb 2-1: config 0 interface 2 has no altsetting 0 [ 650.593793][ T5928] usb 2-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f7.3f [ 650.613954][ T5928] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.628952][ T5928] usb 2-1: Product: syz [ 650.633118][ T5928] usb 2-1: Manufacturer: syz [ 650.638754][ T5928] usb 2-1: SerialNumber: syz [ 650.775280][ T5928] usb 2-1: config 0 descriptor?? [ 650.782029][T13743] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 650.957360][ T37] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 650.988857][T13743] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 651.185091][ T37] usb 6-1: device descriptor read/64, error -71 [ 651.373357][ T5928] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 651.535884][ T37] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 651.705013][ T37] usb 6-1: device descriptor read/64, error -71 [ 651.760388][ T5928] usb 2-1: USB disconnect, device number 48 [ 651.914253][ T37] usb usb6-port1: attempt power cycle [ 653.192787][ T37] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 653.234323][ T37] usb 6-1: device descriptor read/8, error -71 [ 653.390588][T13785] delete_channel: no stack [ 653.988116][ T37] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 654.087284][ T37] usb 6-1: device descriptor read/8, error -71 [ 654.381622][ T37] usb usb6-port1: unable to enumerate USB device [ 656.238211][ T37] usb 3-1: new low-speed USB device number 71 using dummy_hcd [ 656.428775][ T37] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 656.680351][ T37] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 656.703878][ T37] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 656.717816][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.745433][ T37] usb 3-1: config 0 descriptor?? [ 656.922304][ T37] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 657.017727][T13840] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 657.324142][T13843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2258'. [ 657.435088][ T37] usb 6-1: Using ep0 maxpacket: 32 [ 657.466663][ T37] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 657.513862][ T37] usb 6-1: config 0 has no interfaces? [ 657.528384][ T37] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 657.550120][ T37] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.566983][ T37] usb 6-1: Product: syz [ 657.577255][ T37] usb 6-1: Manufacturer: syz [ 657.586071][ T37] usb 6-1: SerialNumber: syz [ 657.607458][ T37] usb 6-1: config 0 descriptor?? [ 657.916319][ T6395] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 658.108479][ T6395] usb 4-1: Using ep0 maxpacket: 32 [ 658.118235][ T6395] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 658.127591][ T6395] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.135699][ T6395] usb 4-1: Product: syz [ 658.139964][ T6395] usb 4-1: Manufacturer: syz [ 658.144705][ T6395] usb 4-1: SerialNumber: syz [ 658.151653][ T6395] usb 4-1: config 0 descriptor?? [ 658.159058][ T6395] ttusb_dec_send_command: command bulk message failed: error -22 [ 658.167095][ T6395] ttusb-dec 4-1:0.0: probe with driver ttusb-dec failed with error -22 [ 658.382386][ T6395] usb 3-1: USB disconnect, device number 71 [ 658.466803][ T37] usb 6-1: USB disconnect, device number 50 [ 658.517196][T13856] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2262'. [ 658.546690][T13856] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2262'. [ 659.366426][T13869] IPVS: sh: FWM 3 0x00000003 - no destination available [ 659.374426][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 661.411442][T13888] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=13888 comm=syz.2.2269 [ 661.985546][T13824] usb 4-1: USB disconnect, device number 48 [ 662.289829][T13898] IPVS: sh: FWM 3 0x00000003 - no destination available [ 662.297388][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 662.919184][T13824] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 663.068897][ T9] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 663.092694][T13824] usb 3-1: Using ep0 maxpacket: 32 [ 663.178841][T13824] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 663.241074][T13824] usb 3-1: config 0 has no interfaces? [ 663.297578][T13824] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 663.315521][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 663.325475][T13824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.339799][ T9] usb 6-1: config 0 has an invalid interface number: 196 but max is 2 [ 663.352477][ T9] usb 6-1: config 0 has an invalid interface number: 4 but max is 2 [ 663.362257][T13824] usb 3-1: Product: syz [ 663.366393][T13824] usb 3-1: Manufacturer: syz [ 663.378322][ T9] usb 6-1: config 0 has an invalid interface number: 69 but max is 2 [ 663.388506][T13824] usb 3-1: SerialNumber: syz [ 663.400226][ T9] usb 6-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 663.409942][T13824] usb 3-1: config 0 descriptor?? [ 663.427266][ T9] usb 6-1: config 0 has no interface number 0 [ 663.442239][ T9] usb 6-1: config 0 has no interface number 1 [ 663.458791][ T9] usb 6-1: config 0 has no interface number 2 [ 663.472710][ T9] usb 6-1: config 0 interface 196 altsetting 249 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 663.497767][ T9] usb 6-1: config 0 interface 196 altsetting 249 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 663.527559][ T9] usb 6-1: config 0 interface 196 altsetting 249 endpoint 0x5 has invalid wMaxPacketSize 0 [ 663.619222][T13913] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 663.860624][ T9] usb 6-1: config 0 interface 196 altsetting 249 has a duplicate endpoint with address 0x3, skipping [ 663.898069][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0x3, skipping [ 663.936808][ T9] usb 6-1: config 0 interface 4 altsetting 8 endpoint 0xF has invalid wMaxPacketSize 0 [ 663.978328][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0xF, skipping [ 664.025632][ T9] usb 6-1: config 0 interface 4 altsetting 8 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 664.053684][ T9] usb 6-1: config 0 interface 4 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 664.273792][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0x5, skipping [ 664.359419][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0xC, skipping [ 664.390119][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0xC, skipping [ 664.418837][ T9] usb 6-1: config 0 interface 4 altsetting 8 has a duplicate endpoint with address 0xF, skipping [ 664.448739][ T9] usb 6-1: config 0 interface 69 altsetting 1 has a duplicate endpoint with address 0xD, skipping [ 664.481002][T13915] binder: 13914:13915 unknown command 0 [ 664.486582][T13915] binder: 13914:13915 ioctl c0306201 200000000080 returned -22 [ 664.497612][T13915] binder: 13914:13915 ioctl c0306201 2000000003c0 returned -14 [ 664.520668][ T9] usb 6-1: config 0 interface 69 altsetting 1 has a duplicate endpoint with address 0x5, skipping [ 664.534129][T13824] usb 3-1: USB disconnect, device number 72 [ 664.595903][ T9] usb 6-1: config 0 interface 69 altsetting 1 has a duplicate endpoint with address 0xD, skipping [ 664.628222][ T9] usb 6-1: config 0 interface 69 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 664.673251][ T9] usb 6-1: config 0 interface 69 altsetting 1 has an endpoint descriptor with address 0x69, changing to 0x9 [ 664.689327][ T9] usb 6-1: config 0 interface 69 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 664.710846][ T9] usb 6-1: config 0 interface 69 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 664.739919][ T9] usb 6-1: config 0 interface 69 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 664.765457][ T9] usb 6-1: config 0 interface 69 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 8 [ 664.796153][ T9] usb 6-1: config 0 interface 196 has no altsetting 0 [ 664.815145][ T9] usb 6-1: config 0 interface 4 has no altsetting 0 [ 664.830710][ T9] usb 6-1: config 0 interface 69 has no altsetting 0 [ 664.883550][ T9] usb 6-1: New USB device found, idVendor=1965, idProduct=0018, bcdDevice=62.c1 [ 664.916809][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.933813][ T9] usb 6-1: Product: syz [ 664.948969][ T9] usb 6-1: Manufacturer: syz [ 664.961773][ T9] usb 6-1: SerialNumber: syz [ 664.975489][ T9] usb 6-1: config 0 descriptor?? [ 666.348356][ T9] usb 6-1: USB disconnect, device number 51 [ 666.363940][ T30] audit: type=1400 audit(1764831769.146:1044): avc: denied { append } for pid=13939 comm="syz.5.2288" name="001" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 666.500776][ T6395] usb 2-1: new low-speed USB device number 49 using dummy_hcd [ 666.522171][ T5886] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 666.714377][ T5886] usb 4-1: Using ep0 maxpacket: 32 [ 666.722260][ T6395] usb 2-1: No LPM exit latency info found, disabling LPM. [ 666.735485][ T6395] usb 2-1: config 1 interface 0 altsetting 60 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 666.761001][ T6395] usb 2-1: config 1 interface 0 has no altsetting 0 [ 666.768418][ T5886] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 666.778363][ T5886] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.787050][ T5886] usb 4-1: Product: syz [ 666.791801][ T5886] usb 4-1: Manufacturer: syz [ 666.797166][ T5886] usb 4-1: SerialNumber: syz [ 666.802379][ T6395] usb 2-1: string descriptor 0 read error: -22 [ 666.808914][ T30] audit: type=1400 audit(1764831769.558:1045): avc: denied { open } for pid=13948 comm="syz.2.2290" path="/dev/ptyq8" dev="devtmpfs" ino=127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 666.810001][ T6395] usb 2-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.40 [ 666.846434][ T5886] usb 4-1: config 0 descriptor?? [ 666.851664][ T30] audit: type=1400 audit(1764831769.595:1046): avc: denied { ioctl } for pid=13948 comm="syz.2.2290" path="/dev/ptyq8" dev="devtmpfs" ino=127 ioctlcmd=0x5416 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 666.851957][ T6395] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.888765][ T5886] ttusb_dec_send_command: command bulk message failed: error -22 [ 666.898271][ T5886] ttusb-dec 4-1:0.0: probe with driver ttusb-dec failed with error -22 [ 666.907910][ T30] audit: type=1400 audit(1764831769.661:1047): avc: denied { ioctl } for pid=13948 comm="syz.2.2290" path="socket:[46546]" dev="sockfs" ino=46546 ioctlcmd=0x943f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 667.155163][T13954] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2292'. [ 667.238205][ T5886] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 668.225004][ T5886] usb 3-1: Using ep0 maxpacket: 32 [ 668.234043][ T5886] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.239648][ T30] audit: type=1400 audit(1764831770.895:1048): avc: denied { create } for pid=13965 comm="syz.5.2295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 668.244430][ T5886] usb 3-1: config 0 has no interfaces? [ 668.273234][ T5886] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 668.282609][ T5886] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.291115][ T5886] usb 3-1: Product: syz [ 668.295752][ T5886] usb 3-1: Manufacturer: syz [ 668.301448][ T5886] usb 3-1: SerialNumber: syz [ 668.314470][ T5886] usb 3-1: config 0 descriptor?? [ 669.151381][ T5886] usb 3-1: USB disconnect, device number 73 [ 669.703440][ T6340] usb 4-1: USB disconnect, device number 49 [ 669.800277][ T6395] usbhid 2-1:1.0: can't add hid device: -71 [ 669.844980][ T6395] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 669.892440][ T6395] usb 2-1: USB disconnect, device number 49 [ 670.070666][T13982] IPVS: rr: FWM 3 0x00000003 - no destination available [ 670.080336][ C0] IPVS: rr: FWM 3 0x00000003 - no destination available [ 670.188694][T13981] IPVS: set_ctl: invalid protocol: 256 0.32.0.0:13568 [ 670.204685][T13984] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=13984 comm=syz.4.2300 [ 670.489008][T13992] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13992 comm=syz.5.2301 [ 672.352888][ T10] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 672.380342][T14016] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2304'. [ 672.596263][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 672.628651][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 673.060085][ T10] usb 4-1: config 0 has no interfaces? [ 673.077984][ T10] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 673.096908][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.116514][ T10] usb 4-1: Product: syz [ 673.127345][ T10] usb 4-1: Manufacturer: syz [ 673.150757][ T10] usb 4-1: SerialNumber: syz [ 673.180903][ T10] usb 4-1: config 0 descriptor?? [ 673.900009][T14034] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14034 comm=syz.4.2311 [ 674.114122][ T10] usb 4-1: USB disconnect, device number 50 [ 674.551919][ T37] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 675.168391][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 675.190898][ T37] usb 3-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 675.225209][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.233216][ T37] usb 3-1: Product: syz [ 675.304090][ T37] usb 3-1: Manufacturer: syz [ 675.308698][ T37] usb 3-1: SerialNumber: syz [ 675.357441][ T37] usb 3-1: config 0 descriptor?? [ 675.407173][ T37] ttusb_dec_send_command: command bulk message failed: error -22 [ 675.467563][ T37] ttusb-dec 3-1:0.0: probe with driver ttusb-dec failed with error -22 [ 675.899720][T14053] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2317'. [ 676.857882][T14068] evm: overlay not supported [ 676.868788][T14068] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2321'. [ 677.054757][T14075] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2325'. [ 677.207453][ T37] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 677.309365][T14081] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2327'. [ 677.413843][T14083] IPVS: rr: FWM 3 0x00000003 - no destination available [ 677.421772][ C0] IPVS: rr: FWM 3 0x00000003 - no destination available [ 677.511882][ T37] usb 4-1: Using ep0 maxpacket: 32 [ 677.638508][ T37] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 677.642635][ T10] usb 3-1: USB disconnect, device number 74 [ 677.661559][ T37] usb 4-1: config 0 has no interfaces? [ 677.672842][ T37] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 677.693245][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.707604][ T37] usb 4-1: Product: syz [ 677.713959][ T37] usb 4-1: Manufacturer: syz [ 677.805458][ T37] usb 4-1: SerialNumber: syz [ 677.819410][ T37] usb 4-1: config 0 descriptor?? [ 678.614069][ T10] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 678.775186][T13824] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 678.907765][ T10] usb 2-1: config 0 has an invalid interface number: 46 but max is 0 [ 678.921536][ T10] usb 2-1: config 0 has no interface number 0 [ 679.069374][ T10] usb 2-1: New USB device found, idVendor=04e2, idProduct=1420, bcdDevice=9e.b9 [ 679.079580][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.089554][ T10] usb 2-1: Product: syz [ 679.097061][ T10] usb 2-1: Manufacturer: syz [ 679.098523][ T37] usb 4-1: USB disconnect, device number 51 [ 679.101757][ T10] usb 2-1: SerialNumber: syz [ 679.122682][ T10] usb 2-1: config 0 descriptor?? [ 679.137222][T13824] usb 3-1: Using ep0 maxpacket: 8 [ 679.154074][T13824] usb 3-1: config 1 has an invalid interface number: 96 but max is 0 [ 679.165979][ T10] xr_serial 2-1:0.46: More than one union descriptor, skipping ... [ 679.180894][T13824] usb 3-1: config 1 has no interface number 0 [ 679.187018][T13824] usb 3-1: config 1 interface 96 has no altsetting 0 [ 679.216284][T13824] usb 3-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=77.d3 [ 679.236959][T13824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.256285][T13824] usb 3-1: Product: syz [ 679.264341][T13824] usb 3-1: Manufacturer: syz [ 679.271857][T13824] usb 3-1: SerialNumber: syz [ 681.184440][ T37] usb 2-1: USB disconnect, device number 50 [ 681.233164][T13824] mdc800 3-1:1.96: probe fails -> wrong Interface [ 681.258013][T13824] usb 3-1: USB disconnect, device number 75 [ 681.285653][ T30] audit: type=1400 audit(1764831783.102:1049): avc: denied { bind } for pid=14125 comm="syz.5.2341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 681.366140][ T30] audit: type=1400 audit(1764831783.149:1050): avc: denied { setopt } for pid=14125 comm="syz.5.2341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 681.396006][ T30] audit: type=1400 audit(1764831783.205:1051): avc: denied { getopt } for pid=14125 comm="syz.5.2341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 681.612926][T14131] Invalid logical block size (5) [ 682.366445][T14140] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2345'. [ 682.407500][T14143] overlay: filesystem on ./bus is read-only [ 683.225768][T14148] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2347'. [ 683.288409][T14146] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2344'. [ 683.439705][T14151] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14151 comm=syz.2.2345 [ 684.544775][T14166] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=14166 comm=syz.5.2352 [ 684.941405][T14176] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2353'. [ 684.955901][T14176] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14176 comm=syz.3.2353 [ 685.265100][T14181] input: syz0 as /devices/virtual/input/input34 [ 685.275981][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 685.306982][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 685.319515][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 685.340689][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 685.356888][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2355'. [ 685.442901][T14191] xt_TPROXY: Can be used only with -p tcp or -p udp [ 685.903970][ T9] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 687.328687][T14215] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=14215 comm=syz.3.2367 [ 687.427647][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 687.437973][ T9] usb 2-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 687.459924][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.482178][ T9] usb 2-1: Product: syz [ 687.495822][ T9] usb 2-1: Manufacturer: syz [ 687.521207][ T9] usb 2-1: SerialNumber: syz [ 687.545245][ T9] usb 2-1: config 0 descriptor?? [ 687.574872][ T9] ttusb_dec_send_command: command bulk message failed: error -22 [ 687.620059][ T9] ttusb-dec 2-1:0.0: probe with driver ttusb-dec failed with error -22 [ 688.492504][T14224] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2371'. [ 689.393113][T14237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 689.420230][T14237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 689.624852][ T9] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 690.173400][ T9] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 690.193365][ T9] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 24623, setting to 1024 [ 690.206948][ T9] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 690.219272][ T9] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 690.229368][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.250551][T14236] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 690.398275][ T9] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 690.613525][T12922] usb 4-1: USB disconnect, device number 52 [ 691.649773][T13824] usb 2-1: USB disconnect, device number 51 [ 692.767232][T14285] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=14285 comm=syz.2.2384 [ 694.345011][T14306] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 695.173850][T14308] gfs2: error -5 reading superblock [ 695.359520][ T37] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 695.675269][ T37] usb 6-1: Using ep0 maxpacket: 32 [ 695.687379][ T37] usb 6-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 695.708183][ T37] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.716194][ T37] usb 6-1: Product: syz [ 695.720630][ T37] usb 6-1: Manufacturer: syz [ 695.725222][ T37] usb 6-1: SerialNumber: syz [ 695.732270][ T37] usb 6-1: config 0 descriptor?? [ 695.739194][ T37] ttusb_dec_send_command: command bulk message failed: error -22 [ 695.748158][ T37] ttusb-dec 6-1:0.0: probe with driver ttusb-dec failed with error -22 [ 695.836026][ T9] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 695.974666][ T9] usb 3-1: device descriptor read/64, error -71 [ 696.252745][ T9] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 696.434583][ T9] usb 3-1: device descriptor read/64, error -71 [ 696.584519][ T9] usb usb3-port1: attempt power cycle [ 696.715427][T14331] netlink: 'syz.4.2400': attribute type 10 has an invalid length. [ 696.845110][ T30] audit: type=1400 audit(1764831797.657:1052): avc: denied { setopt } for pid=14328 comm="syz.4.2400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 696.990160][ T9] usb 3-1: new full-speed USB device number 78 using dummy_hcd [ 697.258321][T14331] 8021q: adding VLAN 0 to HW filter on device team0 [ 697.279813][ T9] usb 3-1: device descriptor read/8, error -71 [ 697.535340][ T9] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 697.555721][ T37] usb 6-1: USB disconnect, device number 52 [ 697.591230][T14331] bond0: (slave team0): Enslaving as an active interface with an up link [ 697.627728][ T9] usb 3-1: device descriptor read/8, error -71 [ 697.752965][ T9] usb usb3-port1: unable to enumerate USB device [ 697.917022][T14328] delete_channel: no stack [ 698.429169][T14340] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 698.463809][ T30] audit: type=1400 audit(1764831799.172:1053): avc: denied { read } for pid=14346 comm="syz.5.2404" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 698.496832][ T30] audit: type=1400 audit(1764831799.172:1054): avc: denied { open } for pid=14346 comm="syz.5.2404" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 698.764828][T13824] usb 6-1: new low-speed USB device number 53 using dummy_hcd [ 698.950678][T13824] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 698.978415][T13824] usb 6-1: config 0 has no interface number 0 [ 698.990793][T13824] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 699.027236][T13824] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 699.063851][T13824] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 699.074793][ T5895] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 699.113451][T13824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.129483][T13824] usb 6-1: config 0 descriptor?? [ 699.179709][T14371] Invalid logical block size (5) [ 699.190471][T14347] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 699.236347][T13824] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 699.511996][ T9] usb 6-1: USB disconnect, device number 53 [ 700.283792][ T5895] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 700.351888][ T5895] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 700.377475][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.400360][ T5895] usb 4-1: Product: syz [ 700.424240][ T5895] usb 4-1: Manufacturer: syz [ 700.441094][ T5895] usb 4-1: SerialNumber: syz [ 700.466185][ T5895] usb 4-1: config 0 descriptor?? [ 700.913876][T13824] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 701.035604][T14404] netlink: 'syz.2.2423': attribute type 3 has an invalid length. [ 701.093620][T13824] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 701.103534][T13824] usb 6-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 701.115592][T13824] usb 6-1: Product: syz [ 701.172709][T13824] usb 6-1: Manufacturer: syz [ 701.190513][T13824] usb 6-1: SerialNumber: syz [ 701.210078][T13824] usb 6-1: config 0 descriptor?? [ 701.223238][T13824] ch341 6-1:0.0: ch341-uart converter detected [ 701.282154][T14407] ip6_vti0 speed is unknown, defaulting to 1000 [ 701.553797][T14413] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2425'. [ 701.565633][T14413] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2425'. [ 701.657828][T14407] lo speed is unknown, defaulting to 1000 [ 702.321742][T14436] netlink: 'syz.4.2431': attribute type 10 has an invalid length. [ 702.330004][T14436] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2431'. [ 702.503859][T13824] usb 6-1: failed to send control message: -71 [ 702.918278][T14438] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2428'. [ 703.505602][T13824] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 703.537303][T13824] usb 6-1: USB disconnect, device number 54 [ 703.552400][T13824] ch341 6-1:0.0: device disconnected [ 703.693367][ T9] usb 4-1: USB disconnect, device number 53 [ 703.928480][T14445] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57804 sclass=netlink_route_socket pid=14445 comm=syz.2.2433 [ 704.406656][T14462] input: syz0 as /devices/virtual/input/input35 [ 704.613458][ T9] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 704.623987][T14464] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 704.794290][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 704.802189][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 704.812525][ T9] usb 3-1: config 0 has no interfaces? [ 704.820082][ T9] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 704.829516][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.837664][ T9] usb 3-1: Product: syz [ 704.841869][ T9] usb 3-1: Manufacturer: syz [ 704.846451][ T9] usb 3-1: SerialNumber: syz [ 704.852939][ T9] usb 3-1: config 0 descriptor?? [ 704.968961][T14468] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2442'. [ 705.043244][T14474] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 705.405574][T14480] tmpfs: Bad value for 'mpol' [ 706.211519][T14478] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 706.229853][T14468] bond0: (slave wlan1): Releasing backup interface [ 706.238321][T14478] kvm: requested 60342 ns i8254 timer period limited to 200000 ns [ 707.149846][T14478] kvm: requested 92190 ns i8254 timer period limited to 200000 ns [ 707.165189][T14468] ------------[ cut here ]------------ [ 707.170765][T14468] wlan1: Failed check-sdata-in-driver check, flags: 0x0 [ 707.177721][T14468] WARNING: net/mac80211/driver-ops.c:366 at 0x0, CPU#0: syz.1.2442/14468 [ 707.186202][T14468] Modules linked in: [ 707.190715][T14468] CPU: 0 UID: 0 PID: 14468 Comm: syz.1.2442 Not tainted syzkaller #0 PREEMPT(full) [ 707.200172][T14468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 707.210264][T14468] RIP: 0010:drv_unassign_vif_chanctx+0x204/0x7f0 [ 707.216854][T14468] Code: 92 f0 f1 f6 48 8b 74 24 10 48 81 c6 20 01 00 00 48 89 74 24 10 e8 7c f0 f1 f6 48 8d 3d 15 1f c9 05 8b 54 24 04 48 8b 74 24 10 <67> 48 0f b9 3a e8 62 f0 f1 f6 4c 89 f2 48 b8 00 00 00 00 00 fc ff [ 707.236843][T14468] RSP: 0018:ffffc9000e54f180 EFLAGS: 00010283 [ 707.242958][T14468] RAX: 000000000003d58a RBX: ffff888056c34d80 RCX: ffffc90004d02000 [ 707.250940][T14468] RDX: 0000000000000000 RSI: ffff888056c34120 RDI: ffffffff90950de0 [ 707.258959][T14468] RBP: ffff888030640e80 R08: 0000000000000005 R09: 0000000000000000 [ 707.267602][T14468] R10: 0000000000000000 R11: 00000000fcb63048 R12: ffff888056c36ad8 [ 707.275693][T14468] R13: 0000000000000000 R14: ffff888056c357b8 R15: ffff888056c36a80 [ 707.283684][T14468] FS: 00007f72e062d6c0(0000) GS:ffff88812499c000(0000) knlGS:0000000000000000 [ 707.292655][T14468] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 707.299572][T14468] CR2: 0000555583bc7808 CR3: 000000002fc41000 CR4: 00000000003526f0 [ 707.308473][T14468] Call Trace: [ 707.311773][T14468] [ 707.314722][T14468] ieee80211_assign_link_chanctx+0x3f1/0xf00 [ 707.320775][T14468] __ieee80211_link_release_channel+0x273/0x4b0 [ 707.327045][T14468] ieee80211_link_release_channel+0x128/0x200 [ 707.333416][T14468] ? __pfx_ieee80211_uninit+0x10/0x10 [ 707.338839][T14468] unregister_netdevice_many_notify+0x13f8/0x2570 [ 707.345264][T14468] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 707.352079][T14468] ? __call_rcu_common.constprop.0+0x3f0/0xa10 [ 707.358252][T14468] ? find_held_lock+0x2b/0x80 [ 707.363155][T14468] unregister_netdevice_queue+0x305/0x3c0 [ 707.368868][T14468] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 707.375213][T14468] _cfg80211_unregister_wdev+0x64b/0x800 [ 707.380870][T14468] ieee80211_if_remove+0x250/0x3d0 [ 707.386041][T14468] ieee80211_del_iface+0x16/0x20 [ 707.391005][T14468] cfg80211_remove_virtual_intf+0xdd/0x270 [ 707.397131][T14468] nl80211_del_interface+0x106/0x190 [ 707.402420][T14468] genl_family_rcv_msg_doit+0x209/0x2f0 [ 707.408007][T14468] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 707.414099][T14468] ? bpf_lsm_capable+0x9/0x10 [ 707.418780][T14468] ? security_capable+0x7e/0x260 [ 707.423715][T14468] ? ns_capable+0xd7/0x110 [ 707.428418][T14468] genl_rcv_msg+0x55c/0x800 [ 707.432935][T14468] ? __pfx_genl_rcv_msg+0x10/0x10 [ 707.437972][T14468] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 707.443350][T14468] ? __pfx_nl80211_del_interface+0x10/0x10 [ 707.449196][T14468] ? __pfx_nl80211_post_doit+0x10/0x10 [ 707.454678][T14468] netlink_rcv_skb+0x158/0x420 [ 707.459698][T14468] ? __pfx_genl_rcv_msg+0x10/0x10 [ 707.464727][T14468] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 707.470049][T14468] ? netlink_deliver_tap+0x1ae/0xd30 [ 707.475350][T14468] genl_rcv+0x28/0x40 [ 707.479380][T14468] netlink_unicast+0x5aa/0x870 [ 707.484171][T14468] ? __pfx_netlink_unicast+0x10/0x10 [ 707.489765][T14468] netlink_sendmsg+0x8c8/0xdd0 [ 707.494552][T14468] ? __pfx_netlink_sendmsg+0x10/0x10 [ 707.499903][T14468] ____sys_sendmsg+0xa5d/0xc30 [ 707.504692][T14468] ? copy_msghdr_from_user+0x10a/0x160 [ 707.510207][T14468] ? __pfx_____sys_sendmsg+0x10/0x10 [ 707.515513][T14468] ? __pfx_futex_wake_mark+0x10/0x10 [ 707.521101][T14468] ___sys_sendmsg+0x134/0x1d0 [ 707.525803][T14468] ? __pfx____sys_sendmsg+0x10/0x10 [ 707.531042][T14468] ? __lock_acquire+0x433/0x22f0 [ 707.536046][T14468] __sys_sendmsg+0x16d/0x220 [ 707.540658][T14468] ? __pfx___sys_sendmsg+0x10/0x10 [ 707.545787][T14468] ? __x64_sys_futex+0x1e0/0x4c0 [ 707.550739][T14468] do_syscall_64+0xcd/0xf80 [ 707.555424][T14468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.561307][T14468] RIP: 0033:0x7f72df78f749 [ 707.565719][T14468] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 707.585669][T14468] RSP: 002b:00007f72e062d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 707.594110][T14468] RAX: ffffffffffffffda RBX: 00007f72df9e5fa0 RCX: 00007f72df78f749 [ 707.602123][T14468] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 707.610158][T14468] RBP: 00007f72df813f91 R08: 0000000000000000 R09: 0000000000000000 [ 707.618478][T14468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 707.626471][T14468] R13: 00007f72df9e6038 R14: 00007f72df9e5fa0 R15: 00007fffb0b4dbe8 [ 707.634492][T14468] [ 707.637501][T14468] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 707.644761][T14468] CPU: 0 UID: 0 PID: 14468 Comm: syz.1.2442 Not tainted syzkaller #0 PREEMPT(full) [ 707.654121][T14468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 707.664160][T14468] Call Trace: [ 707.667418][T14468] [ 707.670330][T14468] dump_stack_lvl+0x3d/0x1f0 [ 707.674904][T14468] vpanic+0x640/0x6f0 [ 707.678869][T14468] panic+0xca/0xd0 [ 707.682569][T14468] ? __pfx_panic+0x10/0x10 [ 707.686973][T14468] check_panic_on_warn+0xab/0xb0 [ 707.691889][T14468] __warn+0x108/0x3c0 [ 707.695855][T14468] __report_bug+0x2a0/0x520 [ 707.700336][T14468] ? __pfx___report_bug+0x10/0x10 [ 707.705350][T14468] report_bug_entry+0xb2/0x220 [ 707.710089][T14468] ? drv_unassign_vif_chanctx+0x204/0x7f0 [ 707.715793][T14468] handle_bug+0x18a/0x260 [ 707.720105][T14468] exc_invalid_op+0x17/0x50 [ 707.724591][T14468] asm_exc_invalid_op+0x1a/0x20 [ 707.729418][T14468] RIP: 0010:drv_unassign_vif_chanctx+0x204/0x7f0 [ 707.735729][T14468] Code: 92 f0 f1 f6 48 8b 74 24 10 48 81 c6 20 01 00 00 48 89 74 24 10 e8 7c f0 f1 f6 48 8d 3d 15 1f c9 05 8b 54 24 04 48 8b 74 24 10 <67> 48 0f b9 3a e8 62 f0 f1 f6 4c 89 f2 48 b8 00 00 00 00 00 fc ff [ 707.755314][T14468] RSP: 0018:ffffc9000e54f180 EFLAGS: 00010283 [ 707.761357][T14468] RAX: 000000000003d58a RBX: ffff888056c34d80 RCX: ffffc90004d02000 [ 707.769307][T14468] RDX: 0000000000000000 RSI: ffff888056c34120 RDI: ffffffff90950de0 [ 707.777253][T14468] RBP: ffff888030640e80 R08: 0000000000000005 R09: 0000000000000000 [ 707.785203][T14468] R10: 0000000000000000 R11: 00000000fcb63048 R12: ffff888056c36ad8 [ 707.793152][T14468] R13: 0000000000000000 R14: ffff888056c357b8 R15: ffff888056c36a80 [ 707.801132][T14468] ieee80211_assign_link_chanctx+0x3f1/0xf00 [ 707.807103][T14468] __ieee80211_link_release_channel+0x273/0x4b0 [ 707.813327][T14468] ieee80211_link_release_channel+0x128/0x200 [ 707.819375][T14468] ? __pfx_ieee80211_uninit+0x10/0x10 [ 707.824731][T14468] unregister_netdevice_many_notify+0x13f8/0x2570 [ 707.831149][T14468] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 707.837895][T14468] ? __call_rcu_common.constprop.0+0x3f0/0xa10 [ 707.844033][T14468] ? find_held_lock+0x2b/0x80 [ 707.848690][T14468] unregister_netdevice_queue+0x305/0x3c0 [ 707.854389][T14468] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 707.860616][T14468] _cfg80211_unregister_wdev+0x64b/0x800 [ 707.866233][T14468] ieee80211_if_remove+0x250/0x3d0 [ 707.871326][T14468] ieee80211_del_iface+0x16/0x20 [ 707.876255][T14468] cfg80211_remove_virtual_intf+0xdd/0x270 [ 707.882046][T14468] nl80211_del_interface+0x106/0x190 [ 707.887315][T14468] genl_family_rcv_msg_doit+0x209/0x2f0 [ 707.892847][T14468] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 707.898903][T14468] ? bpf_lsm_capable+0x9/0x10 [ 707.903560][T14468] ? security_capable+0x7e/0x260 [ 707.908480][T14468] ? ns_capable+0xd7/0x110 [ 707.912882][T14468] genl_rcv_msg+0x55c/0x800 [ 707.917369][T14468] ? __pfx_genl_rcv_msg+0x10/0x10 [ 707.922375][T14468] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 707.927726][T14468] ? __pfx_nl80211_del_interface+0x10/0x10 [ 707.933511][T14468] ? __pfx_nl80211_post_doit+0x10/0x10 [ 707.938959][T14468] netlink_rcv_skb+0x158/0x420 [ 707.943707][T14468] ? __pfx_genl_rcv_msg+0x10/0x10 [ 707.948715][T14468] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 707.953990][T14468] ? netlink_deliver_tap+0x1ae/0xd30 [ 707.959259][T14468] genl_rcv+0x28/0x40 [ 707.963222][T14468] netlink_unicast+0x5aa/0x870 [ 707.967970][T14468] ? __pfx_netlink_unicast+0x10/0x10 [ 707.973242][T14468] netlink_sendmsg+0x8c8/0xdd0 [ 707.977992][T14468] ? __pfx_netlink_sendmsg+0x10/0x10 [ 707.983265][T14468] ____sys_sendmsg+0xa5d/0xc30 [ 707.988026][T14468] ? copy_msghdr_from_user+0x10a/0x160 [ 707.993461][T14468] ? __pfx_____sys_sendmsg+0x10/0x10 [ 707.998742][T14468] ? __pfx_futex_wake_mark+0x10/0x10 [ 708.004007][T14468] ___sys_sendmsg+0x134/0x1d0 [ 708.008667][T14468] ? __pfx____sys_sendmsg+0x10/0x10 [ 708.013841][T14468] ? __lock_acquire+0x433/0x22f0 [ 708.018783][T14468] __sys_sendmsg+0x16d/0x220 [ 708.023351][T14468] ? __pfx___sys_sendmsg+0x10/0x10 [ 708.028439][T14468] ? __x64_sys_futex+0x1e0/0x4c0 [ 708.033371][T14468] do_syscall_64+0xcd/0xf80 [ 708.037857][T14468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.043729][T14468] RIP: 0033:0x7f72df78f749 [ 708.048123][T14468] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 708.067710][T14468] RSP: 002b:00007f72e062d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 708.076098][T14468] RAX: ffffffffffffffda RBX: 00007f72df9e5fa0 RCX: 00007f72df78f749 [ 708.084049][T14468] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000005 [ 708.091996][T14468] RBP: 00007f72df813f91 R08: 0000000000000000 R09: 0000000000000000 [ 708.099959][T14468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 708.107909][T14468] R13: 00007f72df9e6038 R14: 00007f72df9e5fa0 R15: 00007fffb0b4dbe8 [ 708.115868][T14468] [ 708.119152][T14468] Kernel Offset: disabled [ 708.123447][T14468] Rebooting in 86400 seconds..