last executing test programs: 9.918189805s ago: executing program 0 (id=360): r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c00000008000905810300020000000904010000020d00000904010102"], 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x6, 0x7f, 0x7, 0x4, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0xfffffffa, 0xffff2d33, 0x1dd2, 0x6, 0x7, 0x0, 0x80000000, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x3, 0x3, 0x107fff, 0x4c74, 0xfbf5, 0x0, 0xb, 0xa, 0x0, 0x71, 0x7, 0x2000007, 0x103, 0x0, 0x5, 0x3c, 0x91, 0x7, 0x6, 0x3, 0x4, 0x4, 0x8, 0x0, 0x7f, 0xffffffff, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0x200, 0x129432e6, 0xc8, 0xf9, 0xd, 0x2bf, 0x6c9, 0xfffff000, 0xfffffffe, 0x8, 0x4, 0x7, 0x3, 0x2f, 0x6, 0x312, 0x76, 0xea4, 0xa, 0x4, 0x0, 0x8000, 0x9, 0x400, 0x1, 0xe3ae, 0xfffffffd, 0xff, 0x1005, 0x801, 0x8, 0x4, 0x0, 0x106, 0x2, 0x8, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x2, 0xffff, 0x2, 0x83, 0x9, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xa, 0x9, 0x48c93690, 0x2, 0xff], [0x1007, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x387d, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x80002, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x20005, 0x6, 0x54fe12d2, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x1, 0x0, 0x6, 0xfffffffb, 0x120000, 0x3, 0x6, 0x9, 0x2000008, 0x2], [0x9, 0xbb31, 0x3, 0xb, 0x80, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce5, 0x1fd, 0x6, 0x5, 0x5, 0x40000003, 0x100, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x5, 0xffffffff, 0x60a7, 0x6, 0x5, 0xffffffff, 0x7ffffffb, 0x5, 0xb, 0xc8, 0x3, 0x3, 0x80ffff, 0x200003, 0x5, 0x80000000, 0x9602, 0xa, 0x2, 0x2, 0x6, 0x8, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x3, 0x8, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x918) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x2, 0x0, 0xe, 0x1, 0x1, 0x3, 0x7, 0x1040, 0x6, 0xffff, 0x0, 0x1000}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f00000009c0)={0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="000503090000006b", @ANYRES64=r2], 0x0, 0x0}) 8.44753511s ago: executing program 1 (id=366): r0 = openat$tun(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1400000032000100000000000000000011"], 0x14}, 0x1, 0x0, 0x0, 0x4044840}, 0x4000000) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x0, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x18010) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902120001000000000904"], 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x3, 0x4a, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x6d, 0xf5, 0x71, 0x8, 0x4e2, 0x1424, 0xc7eb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x38, 0x2, 0x96, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcc, 0x7, 0x0, 0x2, 0x59, 0x61, 0x5, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x890, 0x0, 0x7, 0x8}, {0x6, 0x24, 0x1a, 0x5, 0x11}}]}}, {{0x9, 0x4, 0x1, 0xff, 0x0, 0x6e, 0xb8, 0xc1}}]}}]}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='signal_generate\x00', r3}, 0x18) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x40) ioctl$USBDEVFS_CONNECTINFO(r4, 0x80045518, 0x0) r5 = gettid() tkill(r5, 0x12) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)=0x8) 7.803123428s ago: executing program 3 (id=367): r0 = syz_io_uring_setup(0x13dc, &(0x7f0000000180)={0x0, 0xcb43, 0x400, 0x1000, 0x5cd}, &(0x7f0000000500), 0x0) io_uring_register$IORING_REGISTER_PBUF_STATUS(r0, 0x1a, 0x0, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) fcntl$notify(r2, 0x402, 0x5) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000040)='.\x00', 0x8100024d) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x4924b68, 0x0) fstat(0xffffffffffffffff, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c00018006000600843b0000971b028054021780"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) setxattr$incfs_size(&(0x7f0000000300)='./file0\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) 6.187407175s ago: executing program 3 (id=372): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x800, 0x19) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'veth0\x00', 0x0}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x24, 0x1, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_MARK_MASK={0x8}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4040000) sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x1}, {0x8, 0x2, 0x4}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048841}, 0x4800) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x10) dup3(r2, r1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.722406544s ago: executing program 3 (id=375): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000240)={r1}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000400)='netfs_rreq_ref\x00', r2, 0x0, 0x9}, 0x18) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r6) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0x13}], 0x2) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) r9 = syz_io_uring_setup(0x5e9, &(0x7f0000000480)={0x0, 0x9e6e, 0x1000, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r8, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x20000044}) io_uring_enter(r9, 0x47ba, 0x3e80, 0xeaffffff, 0x0, 0x0) r12 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r12) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYRES32=r12], &(0x7f00000000c0)='syzkaller\x00', 0x800, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r12, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)}, 0x0) setsockopt$WPAN_WANTACK(r4, 0x0, 0x0, &(0x7f0000000140), 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e3, &(0x7f0000000180)={r0, r13}) 5.644512766s ago: executing program 1 (id=377): ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)=0xfffe) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x10940, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00'}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000040), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r2, &(0x7f0000000200)=ANY=[@ANYBLOB='gretap0 8'], 0xa) r3 = openat$cgroup_type(r0, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x36) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) write$cgroup_int(r6, &(0x7f00000000c0), 0x26) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000300)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r9, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x2000c800) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r7}, 0x18) readlink(0x0, 0x0, 0x0) 5.591061629s ago: executing program 0 (id=378): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x850}, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f00000009c0)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x864, 0x5e, 0x200000000000, 0x100000000000006}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r4) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r6, &(0x7f0000000080), 0x2000011a) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x20, r5, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x0) 4.695063755s ago: executing program 1 (id=380): r0 = syz_io_uring_setup(0x13dc, &(0x7f0000000180)={0x0, 0xcb43, 0x400, 0x1000, 0x5cd}, &(0x7f0000000500), 0x0) io_uring_register$IORING_REGISTER_PBUF_STATUS(r0, 0x1a, 0x0, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) fcntl$notify(r2, 0x402, 0x5) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000040)='.\x00', 0x8100024d) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x4924b68, 0x0) fstat(0xffffffffffffffff, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c00018006000600843b0000971b028054021780"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) setxattr$incfs_size(&(0x7f0000000300)='./file0\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) 4.577880346s ago: executing program 3 (id=381): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000c00)=0xc, 0x6, 0x2) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) setsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x6, &(0x7f0000000140)=0x3ff, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@deltaction={0xa4, 0x31, 0x0, 0x70bd25, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @TCA_ACT_TAB={0x44, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x24000014}, 0x200c4004) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000100)='sys_exit\x00', r4}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000300)={{0x33, 0xfb}, 'port1\x00', 0x1, 0x20, 0x9, 0x243, 0x16, 0xa, 0x7, 0x0, 0x5, 0x7f}) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) keyctl$clear(0x7, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x164, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x138, 0x2, [@TCA_RED_PARMS={0x14}, @TCA_RED_FLAGS={0xc, 0x4, {0x7, 0xb}}, @TCA_RED_STAB={0x104, 0x2, "54ed700c86d0b4e6bf9473392c5c4c7584cf4b133fa8afc474123134cdca1a75d660380aedf94f2fe9c19257b80de99a0e648f68091dea72d8a8122fae457315d9d2640909a759d86871af45fce1cf41b473015e5b62245e8cbf4c2188dc79785c7482265a25905ae3eb6127796c3f2e826f6fef8fe18e57dbaca57a640b0aa11cfb6b0065f1396a0e697b4532127dd5e0d1dac5c2b86f01483b7f804e83e196ce10601f7358c778ea3b04e80afd066ad575e3ba1eade06ebd932b0dd96ada733ac470f139ed94d28389ca3bed0b1f012d253404d24278cd4a067e6ca31592d4741b5348adb94ecd2bfad9a4586fcffce361d84274f90541d23c3bea541260d4"}, @TCA_RED_EARLY_DROP_BLOCK={0x8, 0x5, 0xa}, @TCA_RED_MAX_P={0x8, 0x3, 0x7fff}]}}]}, 0x164}}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') r9 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r9, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r9, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r9, 0x7a6, &(0x7f0000000040)={0x0, 0xd, 0xaa5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) pread64(r8, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) 4.199864264s ago: executing program 4 (id=382): r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0xfffffffd) socket$inet(0xa, 0x801, 0x84) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0xc0800) listen(r2, 0xd7d) syz_open_dev$sndmidi(&(0x7f00000001c0), 0x1, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x8080) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000500)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x7}, 0x3, 0x20, 0x5, 0x0, 0x2, 0x400, 'syz1\x00', &(0x7f0000000700)=[':#,\x00', '\\\x00'], 0x6}) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0x8) r5 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r5, 0x7) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=@can_newroute={0x34, 0x18, 0x1, 0x70bd27, 0x25dfdbfb, {0x1d, 0x1, 0x4}, [@CGW_CS_XOR={0x8, 0x5, {0x5, 0xfffffffffffffffe, 0xf5, 0x4}}, @CGW_MOD_XOR={0x15, 0x3, {{{0x3, 0x1}, 0x4, 0x3, 0x0, 0x0, "13f90700"}, 0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x805936d41ec618b7}, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r7, 0x100) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='kmem_cache_free\x00', r10}, 0x10) setsockopt$WPAN_WANTLQI(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000340), 0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r11, @ANYBLOB="53f793486c53ed03e195f178ee9cb36f7c8fafa23ae2307f59f43f17406f114dd7b6b7c29136edf2dc7c6fc7461123fef81d2c7eb3eb10c7a28bfe44f47dec02bcadc16f21d8e1974ed70179ba4de55353829436c8d431e01f86ca512f06faab45469fb61947b51549ce6522409f227932fcddb9109c72ae00000000", @ANYRESHEX=r14, @ANYBLOB=',\x00']) splice(r13, 0x0, r12, 0x0, 0xffffffffffff8000, 0x0) write$P9_RLERRORu(r12, &(0x7f0000000100)={0xe, 0x7, 0x1, {{0x1, '-'}, 0x207}}, 0xe) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r8) 3.714435071s ago: executing program 1 (id=384): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$cec(0x0, 0x0, 0x424a80) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000001480)) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004811) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000004c0)=ANY=[], 0x11c}}, 0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000019300), 0x4) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000002c0)={@multicast1, @multicast1}, 0x0) 3.6220242s ago: executing program 2 (id=385): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xb, 0x0, 0x1ff, 0x0, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x80, 0x80, 0xfffffffc, 0xdc67}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x2e0001, 0x0) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f00000000c0)) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000100)={'syztnl1\x00', 0x0}) socket(0x10, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xb, 0x0, 0x1ff, 0x0, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x80, 0x80, 0xfffffffc, 0xdc67}}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x2e0001, 0x0) (async) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f00000000c0)) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000100)={'syztnl1\x00', 0x0}) (async) 3.244400204s ago: executing program 2 (id=386): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, 0x0}, 0x94) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r3, 0x10f, 0x86) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) gettid() madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, 0x0, &(0x7f0000000280)) 3.237396704s ago: executing program 1 (id=387): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400000010000304000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="60bc010004a701002400128009000100626f6e64000000001400028008000700020000000800030008"], 0x44}, 0x1, 0x0, 0x0, 0x11}, 0x4040044) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000ac0)=@newtclass={0xd0c, 0x28, 0x2, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0x9, 0xb}, {0x2}}, [@tclass_kind_options=@c_mqprio={0xb}, @tclass_kind_options=@c_skbprio={0xc}, @tclass_kind_options=@c_htb={{0x8}, {0x50, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0xd6, 0x2, 0x8000, 0xc, 0x7, 0x38df2b06}, {0x6, 0x0, 0x7ff, 0x1, 0x441, 0x6}, 0x9, 0x10, 0x9, 0x15b6, 0x9}}, @TCA_HTB_CEIL64={0xc, 0x7, 0x1}, @TCA_HTB_RATE64={0xc, 0x6, 0x1}, @TCA_HTB_OFFLOAD={0x4}]}}, @tclass_kind_options=@c_htb={{0x8}, {0xc70, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x3, 0x1, 0x8, 0x1, 0x0, 0xc8}, {0x1, 0x0, 0x0, 0x7ff, 0xfffc, 0x9}, 0x3, 0xbb, 0x8, 0x3, 0x4}}, @TCA_HTB_RTAB={0x404, 0x4, [0x4, 0x6, 0xffff, 0x2, 0x1772, 0x80000001, 0x0, 0x5, 0x2, 0x80, 0x1, 0x9, 0x10001, 0x10000, 0x1, 0x1, 0x12, 0x34, 0x3, 0x1, 0x1, 0x10001, 0x7fffffff, 0x80000000, 0x26, 0xb, 0x6, 0xbf7, 0x2, 0xffffffff, 0x9, 0x7fff, 0x6, 0x5e, 0x5, 0x2, 0xca2, 0x200, 0x7, 0xffffffc0, 0x4, 0xc, 0x80, 0x40, 0x7ff, 0x3c66, 0xff, 0x9, 0x8, 0x5, 0x8, 0x2, 0x8b, 0x1d2, 0xc, 0x3, 0x5, 0x1, 0x6, 0xf, 0x434, 0x8, 0x8278, 0x142df240, 0x8, 0x101, 0xffff, 0x0, 0x9a, 0xb, 0x23, 0x4, 0x5, 0xf47b, 0x6, 0x7, 0x73, 0x6, 0x6, 0x4, 0x9, 0x519, 0x2, 0x2, 0x4a, 0x5, 0x2, 0x4, 0x8, 0xe, 0x1ff, 0x3ff, 0x3, 0x3ff, 0xa, 0xfffffffe, 0xb6, 0x0, 0x1000, 0x0, 0x1500, 0x1, 0x2400, 0x3, 0x9, 0x1b, 0x2, 0x2, 0x3ff, 0x3ff, 0xdff, 0xfffffffa, 0x5, 0xb, 0x28, 0x40000, 0x200, 0xfe, 0x5, 0x1, 0x5, 0x1, 0xa77, 0x2, 0xca, 0xffffc6c3, 0x9, 0x8, 0x101, 0x8001, 0x7, 0x101, 0x40, 0x8, 0x5, 0x3, 0x4, 0xc, 0x9, 0xf, 0x2, 0x6dc83f2f, 0x100, 0x9, 0xf400, 0x2, 0x2, 0xb, 0x400, 0x2, 0xf010, 0x4, 0x8e33, 0x8000, 0x4, 0x6, 0x9, 0x6, 0xd99, 0xe, 0x79, 0x6, 0x8, 0x80000001, 0x5, 0x1, 0x5, 0x9, 0x6, 0x7ff, 0x7, 0x80, 0x4, 0x5, 0xfffffff9, 0x665, 0x6, 0x8d, 0x7fff, 0x7e6f, 0x7, 0x4, 0x100, 0x7, 0xff, 0x7, 0xb, 0x8, 0x5e, 0x482, 0x7f80, 0x3, 0x9, 0x7, 0x2, 0x5, 0x8, 0x7f, 0xec36, 0xd, 0xabde, 0x58ab, 0x2, 0x4, 0x3, 0x400, 0x7f, 0x3, 0x3, 0x1fd86656, 0x7fffffff, 0x0, 0x9, 0x4, 0x53, 0x8, 0x8000, 0x3, 0x7ff, 0x10, 0x6, 0x2, 0x1, 0x6, 0x41c, 0x4fe, 0x0, 0xfffffffc, 0xa485, 0x9, 0x4, 0x1, 0xe1d8, 0x3, 0x3ff, 0x4, 0xf, 0xc, 0x1, 0x1, 0x0, 0x2, 0x5, 0x7f, 0xfffffffe, 0x4, 0x3, 0x8, 0x8ec, 0x7fffffff, 0xffffffff, 0x5, 0xffffffff, 0x5, 0x0, 0x4]}, @TCA_HTB_RTAB={0x404, 0x4, [0x7, 0x1, 0xffff, 0xffffffff, 0x1, 0x7, 0x1ff, 0x2, 0x8, 0x6, 0xc00, 0x3, 0x5, 0xfffffffc, 0x4, 0x5, 0x4, 0x4, 0x1, 0x100, 0x0, 0x7, 0x9, 0x81, 0x7, 0x760, 0x7, 0xf3b3, 0x0, 0x3, 0x268, 0xfff, 0x8, 0xd, 0x5, 0xffffff80, 0x6, 0x3, 0x4, 0xbf9c, 0xc889, 0x8001, 0x7, 0x5, 0x3, 0x2, 0xff6, 0x4, 0x8, 0xffff, 0x200, 0x5, 0x3, 0xd968, 0x3, 0x600, 0xff, 0xffff, 0xffff, 0x7fffffff, 0xd6, 0x1, 0x7, 0x5, 0x2, 0x1, 0xc23, 0x9, 0x3, 0x5, 0x4, 0xb, 0x7, 0x2, 0xffff7fff, 0x400, 0x3b, 0x6, 0x200, 0x7c7, 0x200, 0x3, 0x10000, 0x8, 0xf, 0x2, 0xc725, 0xdb, 0xff, 0x7, 0x6, 0xc95f, 0x7ff, 0x4, 0x7, 0x9, 0x8, 0x8, 0xd, 0x5, 0x20, 0xc, 0x3ff, 0x1, 0x2, 0x10001, 0xe, 0x80000001, 0x7, 0x1000, 0x1, 0x3, 0x7, 0xff, 0xc3f, 0xfffffffa, 0x86, 0x0, 0x5, 0x3, 0x7fffffff, 0x6, 0xe00, 0x8, 0x8, 0xffffffff, 0x9, 0x7f, 0x3, 0x800, 0x0, 0x4, 0x4, 0x200, 0x6, 0xe, 0x9, 0x3, 0x1ff, 0x9, 0x6, 0xffffffff, 0x1b, 0x4, 0x9, 0x2, 0xfffff2fd, 0x9, 0x7fff, 0x6, 0x10001, 0x7f, 0x0, 0x1, 0x10001, 0x0, 0x0, 0x3, 0x6, 0x5, 0x2, 0x7, 0xffec, 0x3, 0x9, 0x9, 0x6, 0x2e0, 0x2, 0x4, 0x9, 0x3ff, 0x0, 0x9, 0x7, 0x4f8, 0x9, 0x9, 0x6c07, 0x7, 0x6, 0x9, 0x9, 0x6887, 0x5, 0x68, 0x0, 0x2, 0x7, 0x7, 0x2, 0x1b, 0x4, 0x25000647, 0x5, 0x80, 0x5, 0x1, 0x401, 0x2, 0x8001, 0xbd5, 0x9, 0x8, 0x1, 0x7fff, 0x0, 0x5, 0x6, 0x2, 0x6, 0x2, 0x8, 0x9, 0x8000, 0x5, 0x7, 0x0, 0x3, 0x9, 0x2, 0xffffff01, 0x0, 0x6, 0x1ff, 0xccf6, 0x7, 0x8001, 0x13, 0xa20, 0x6, 0xffffffff, 0xfffff000, 0x3, 0xa4, 0x7, 0x7fff, 0x4, 0xa, 0x5, 0x9, 0x8000, 0x4321, 0xfffff9eb, 0xff, 0x100, 0x3, 0x1, 0x4, 0xb26, 0x5, 0x6, 0x0, 0x4, 0x940, 0x10000]}, @TCA_HTB_PARMS={0x30, 0x1, {{0x76, 0x0, 0x9, 0xfb, 0x1, 0x4}, {0x5, 0x1, 0x5, 0xeaa1, 0xb, 0x7}, 0x3, 0x10000, 0x7, 0x5, 0x8}}, @TCA_HTB_CTAB={0x404, 0x3, [0x2, 0x9, 0x2, 0x7, 0x324b, 0x800, 0x9, 0x5, 0x32c, 0x1000, 0x56, 0x6a, 0xcf, 0x8, 0x6, 0x8000, 0x2, 0x7ff, 0x1, 0x5, 0x9, 0x8, 0xffff, 0x6, 0x10, 0x9, 0x5, 0x40, 0x2, 0xb, 0x6, 0xfa56, 0x5, 0x9, 0x8, 0x3ff, 0x7, 0xfa85, 0x10, 0x1, 0xffffff00, 0x3, 0x1, 0x8001, 0x5, 0x800, 0x3, 0x2, 0x3, 0x5, 0x0, 0x2, 0x6, 0x3, 0x2, 0x7, 0x80, 0x596, 0xf, 0xd, 0x45de, 0x40, 0x6eed16c0, 0x0, 0xbc, 0x8, 0x7f, 0x6b8, 0x9, 0x4, 0xf, 0x8, 0x8000, 0xc, 0x5, 0x1ff, 0xc, 0xfffffff7, 0x40, 0x1, 0x7, 0x0, 0x8, 0x9, 0xff, 0x2, 0x6, 0x6, 0x9, 0x1b800000, 0x7, 0x707, 0x40, 0x6, 0x5, 0x80000001, 0xf0, 0xc97a, 0x0, 0xbc9, 0x4, 0x7, 0x7, 0x6, 0x79d, 0x4, 0x2, 0xc0000000, 0x0, 0x2000000, 0x9, 0x3, 0xfeb, 0xc33, 0xfffffffd, 0x5, 0x10, 0x401, 0x4, 0x100, 0x7, 0x168, 0x37f2, 0x2, 0x7, 0x4b09, 0x2, 0x7, 0x8, 0x8, 0x1, 0x1, 0x3b, 0x4, 0x5, 0xffff0001, 0xe, 0x5, 0x6, 0x4, 0x2, 0x5, 0x7, 0x3, 0x9, 0x1ff, 0x4, 0x5, 0x7, 0x6, 0x49b, 0x4, 0xfffffffc, 0x1, 0x8, 0x63, 0x9, 0x4, 0x3, 0x28, 0x4b, 0x100, 0x7, 0x4, 0x3ff, 0x7ff, 0x4f73, 0x4000, 0x238a, 0x8ad, 0x180b, 0x8, 0x7, 0x18a7, 0xa41c, 0x2, 0x6, 0x8, 0x401, 0xb85f, 0x5a, 0x7, 0x0, 0x10001, 0x9, 0x4, 0x8, 0x400, 0x9dbc, 0x2, 0x7, 0x5, 0x600637bf, 0x5, 0x100, 0x0, 0x1, 0x3ac2, 0x9, 0x4, 0x7, 0x0, 0x2, 0x3, 0xa000, 0x6e3, 0x9, 0x7, 0x7, 0xfffffffc, 0x8, 0x5, 0xfffffff7, 0x4, 0x7, 0x76a, 0x4, 0x8, 0x1, 0x2, 0x1, 0xffffffff, 0x6, 0x2, 0x80000000, 0x81, 0x2ad64f5f, 0xb, 0x1, 0xd68, 0x8, 0x4, 0x8, 0x7, 0x3, 0x2, 0x7, 0x8dc000, 0x6, 0x1c, 0x40, 0x4, 0xed, 0x9, 0x4, 0x9, 0x9, 0x7, 0x1, 0xfffffeff, 0x1, 0xfffffc00, 0x4, 0x9, 0x5, 0x4]}]}}]}, 0xd0c}, 0x1, 0x0, 0x0, 0x1}, 0x804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x24002de8) 3.145762583s ago: executing program 4 (id=388): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c00000015000103"], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) (async) r1 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) (async) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) r2 = syz_io_uring_setup(0x4aa, &(0x7f0000000380)={0x0, 0xfffffffc, 0x10100, 0x10000000, 0x13a}, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8126}}) io_uring_enter(r2, 0x38c5, 0x2000000, 0x0, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000880)=""/202, 0xca, 0x200000200009, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x5, &(0x7f0000000180)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0xf}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x2c, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x77359400}, 0x1, 0x40, 0x0, {0x0, r6}}) 2.947428881s ago: executing program 0 (id=389): creat(&(0x7f0000000080)='./file0\x00', 0xc7) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @private=0xa010102}]}, &(0x7f00000002c0)=0x10) getsockopt$bt_hci(r2, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) ioctl$SIOCSIFHWADDR(r1, 0x8b04, &(0x7f00000000c0)={'wlan1\x00', @random="c24f7b36aec9"}) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f0000003b80)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x7, 0x100010, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001540)=ANY=[@ANYBLOB], 0x5c}}, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = open$dir(&(0x7f0000000000)='./file0\x00', 0x280, 0x100) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) linkat(r4, &(0x7f0000000040)='./file1\x00', r5, &(0x7f0000000140)='./file1\x00', 0x1400) mount$9p_fd(0x0, 0x0, 0x0, 0x181018, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480), 0x129540, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r7 = openat$ptp0(0xffffff9c, 0x0, 0x1, 0x0) ioctl$PTP_PIN_SETFUNC2(r7, 0x40603d10, 0x0) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r8 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2a242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r8, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r8, 0x0, 0x0) 2.714981595s ago: executing program 4 (id=390): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="15fdffff0500000001", @ANYRES32=0x1, @ANYBLOB="350100"/19, @ANYRES32], 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) close(r5) 2.525718994s ago: executing program 1 (id=391): ioctl$INCFS_IOC_READ_FILE_SIGNATURE(0xffffffffffffffff, 0x8010671f, &(0x7f00000000c0)={&(0x7f0000002340)=""/74, 0x4a}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000002540)={&(0x7f0000002500)='svcrdma_sq_post_err\x00', r2, 0x0, 0xffff}, 0x18) prlimit64(0x0, 0x9, &(0x7f0000000180)={0x10000, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) read$FUSE(0xffffffffffffffff, &(0x7f0000000300)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x0) syz_usb_disconnect(0xffffffffffffffff) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0xe9cc) poll(&(0x7f0000000240)=[{r4, 0x10}], 0x1, 0x1) fcntl$setown(r2, 0x8, r3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000023c0), 0x9, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r5, &(0x7f0000032680)=""/102376, 0x18fe8) r6 = socket$inet_sctp(0x2, 0x1, 0x84) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e20, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x2000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x200000d, 0x100010, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000002400)={0x0, r6}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002440)={0x6, 0x3, &(0x7f0000002580)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) syz_open_dev$loop(&(0x7f0000000000), 0xd2f, 0x101000) 2.486178438s ago: executing program 3 (id=392): openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/mdstat\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee4, 0x0, 0x2, 0xbfdffffc}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8001}}) io_uring_enter(r0, 0x2b93, 0xf9d0, 0x22, 0x0, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fe, &(0x7f0000000000)) 1.855529471s ago: executing program 2 (id=393): unshare(0x6a040000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r1, 0x80047455, &(0x7f0000000300)=0x5) 1.753231302s ago: executing program 4 (id=394): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x108) mkdir(&(0x7f0000000100)='./file0\x00', 0x106) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@metacopy_off}, {@workdir={'workdir', 0x3d, './file1'}}]}) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x2001) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x8, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2}) io_submit(0x0, 0x1, &(0x7f0000004500)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x1, 0xffffffffffffffff, 0x0}]) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, 0x0) dup3(0xffffffffffffffff, r1, 0x0) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, &(0x7f0000000180)=0x6f) read$dsp(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x4000000, 0x0, 0x1, 0x10d}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x82202, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x5) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000600)=@arm64={0xcc, 0x8, 0x5}) ioctl$KVM_SET_GUEST_DEBUG_x86(r5, 0x4048ae9b, &(0x7f0000000180)={0x80000, 0x0, {[0x7, 0x5dfc, 0x100000000, 0x7fff, 0xd61, 0x5, 0x8, 0xdc]}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x47ba, 0x600, 0x0, 0x0, 0x0) 1.657926785s ago: executing program 0 (id=395): r0 = syz_io_uring_setup(0x13dc, &(0x7f0000000180)={0x0, 0xcb43, 0x400, 0x1000, 0x5cd}, &(0x7f0000000500), 0x0) io_uring_register$IORING_REGISTER_PBUF_STATUS(r0, 0x1a, 0x0, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) fcntl$notify(r2, 0x402, 0x5) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000040)='.\x00', 0x8100024d) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x4924b68, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c00018006000600843b0000971b028054021780"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) setxattr$incfs_size(&(0x7f0000000300)='./file0\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) 1.65758039s ago: executing program 3 (id=396): syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x9, 0x6, 0x0, 0x7}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a100efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb72b4b996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) open_tree(0xffffffffffffff9c, 0x0, 0x89901) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x5bbf91a1e7f99074, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xc) acct(&(0x7f0000000000)='./file0\x00') r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r4, 0x800442d2, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, &(0x7f00000000c0)='\x00') connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f00000004c0)=""/4096) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r5, 0x40045567, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f00000002c0)={0x3f}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) write$uinput_user_dev(r5, &(0x7f0000001740)={'syz0\x00', {0x8000}, 0x0, [0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0xfffffffa, 0xc0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x1000, 0x10], [0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x8001, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x400, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x806, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x9], [0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x681, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2, 0x0, 0x0, 0x5]}, 0x45c) 1.570622447s ago: executing program 4 (id=397): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120141010be6bc2005003410e00a00000301098456021200010028100700042796e0b60c0700000000"], 0x0) (async) syz_usb_connect$cdc_ecm(0x3, 0x59, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x47, 0x1, 0x1, 0xd1, 0x30, 0x9, [{{0x9, 0x4, 0x0, 0x8, 0x3, 0x2, 0x6, 0x0, 0x5, {{0x8, 0x24, 0x6, 0x0, 0x0, "ebcb3a"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0xc86, 0x8, 0x4, 0x4}}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x9, 0x8}}], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x2, 0x55}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x4, 0x1, 0x9}}}}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x81, 0x1, 0x1, 0xff}, 0x131, &(0x7f00000004c0)={0x5, 0xf, 0x131, 0x4, [@generic={0xf6, 0x10, 0x3, "9b2debe240d55fd0a1fff334c4d41d3c6865a260add6b1265e67eaa5a055a0a02e1b2f76dd052457ce0bbc4a52a3fbd47fd7fed52167ea1c80bd82c518383ecae222dd8aeeb028210af4f7e74212ad17532bd4c060ae185a8b1a4f383ad73f26e452ca799ee4c8b15d9f13cb7c94009d709fa9f1f0844b60c956ba6aa751e597beeafe9335a05acb6b0d5aefe6c4a1f44695867340f2ae710d1927493a816f48cab3166e5a5ee9147845756c9e7b9af40068da0fafb2961e322a19c93a4cc9967bb1343820b453bf54e40119d719a501ac38fb83b5d31e5d0af4d58d2dfe060031140423f2ea0fd31aab500f1f98648753ef37"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x74, 0xa, 0xf7, 0x6, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x2, 0x2, 0x3}, @ssp_cap={0x24, 0x10, 0xa, 0x3, 0x6, 0x5, 0x0, 0x7ff, [0xf0, 0x3fc0, 0xf, 0x0, 0xffc000, 0x30]}]}, 0x5, [{0x99, &(0x7f0000000840)=@string={0x99, 0x3, "7205e08f819eff4a8db3fae501c056e737c6b3b4cb9fde68e569c4d65ca70cd5dc146d0e5a5324434407da3d593cb2be5634601700e30378dfc6271cb71978c588a926703cd7bf6f429dba155ff9cb253af04b8ea1df69034aaf6871387619eefab15457d2fc9efe744eafbed045880cdb74bfa73e91fd3ef3e69b608f9fcf9bd6fef90c2d271cbcc3eee11825f3dbd177347bb268aa74"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x3009}}, {0x42, &(0x7f0000000700)=@string={0x42, 0x3, "2267af26df0d5453b797b0b20ba2c9f8854a6fce88b1873f781f53d886c80c4b82dc56759b0efa73bc00e89678301a65c3c6ec01df2385fdca1b7052ed9d0558"}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x425}}, {0x4a, &(0x7f00000007c0)=@string={0x4a, 0x3, "ec2fb36d32e27287349061ef31d293de66d120193c308a02492ca4748d18ea053bf7e25e57aa3f2c46bd89651e63c5a113e135eb0f43c3712996761794ccf67e6bd548afbf78c61c"}}]}) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f00000000c0)={&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000001940)=""/4096, 0xffffffffffffff57}) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="b80000005f0001010000000000000000a500af0064eefa6352afbe9b94349c4d88799b00010023a6d7b186ed83a0bddd2f080000000343f3804b1ac0d2120bc91469c08980ec46d8bcd5d946924d77e0f49a0c73260e3710c193cb3859c3d4e48752bba854f8393aaceda9f42f82dbe5fb916b01641d37faebd74775f47f9302290cca4a694ce2e360c6ca2c305fc6e804000000315faed1782b45a1dda2aa85a60bb6a3d328b7c2b77198b4699261ea79d568659b0f0da4fa5622442eaeb2d1f0047d27ad43000000"], 0xb8}], 0x1, 0x0, 0x0, 0x4008040}, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)) (async) prlimit64(0x0, 0x7, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) writev(0xffffffffffffffff, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x51, 0x0, 0x6, {0x0, 0x1}, {0x74, 0x2}, @const={0x0, {0x0, 0x3400}}}) (async) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000000)={0x0, 0x0, 0x0}) write$char_usb(r4, &(0x7f0000000040)="e2", 0xff0f) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) unlinkat(0xffffffffffffff9c, 0x0, 0x8c) (async) r5 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000001c0), 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) (async) r6 = syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r6, 0x40305652, &(0x7f0000000080)={0x2006, 0x1, 0x61, 0xffffff30, 0x0, 0x8000, 0x100}) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000a40)=ANY=[@ANYBLOB="caf7352ec3302540225a566e04d266eccda8f0b89d86f39a30a1a74b75b9388e00ba0810dc9a1042b6020496da477d344672f447471586ae186421fa014584007e222302144cb2f3969557d6b8f54d3f58788bf157", @ANYRESHEX, @ANYRESHEX=r3, @ANYBLOB="0670b1df635f2dbf37acf3fd81e7d1f0bfe95584eb2a855a561264badbb030f13a591ce94793ff2d09ab54d9b542e27c1401e0147f3d9779b376b845e8469130cb1da2f3cd79ed1ab084a7d6913f1da25db1dc7aa4a36d5ba3bf4b9d2a95c1da198197137a6320c05c09b627f03c593372cd10aaf73ae44013c1307258e545c1ccdbd071db56b5b35cec7542ab7be76a93d3acbd4286e4a696f212b9ce89baf6e0f321fd85ae131e4c"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.154696753s ago: executing program 2 (id=398): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000800)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5207cc9bb8d686982c2f158e0d8f5c7ec6cbfd500"/1453, 0x5ad, 0x0, &(0x7f0000000080)={0xa, 0x5e20, 0x3, @mcast2}, 0x1c) 927.307881ms ago: executing program 0 (id=399): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) socket(0x10, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0xf48, 0x4e23, 0x7, 0x2, 0xa0, 0xa0, 0x16}, {0x1, 0x2, 0x53a, 0x20007, 0x2, 0x1, 0x7ff, 0x6}, {0x953, 0x100000007, 0x7, 0xaa}, 0x6bfe, 0x6e6bbf, 0x2, 0x1, 0x2, 0x3}, {{@in=@rand_addr=0x64010120, 0x4d5, 0x3c}, 0x2, @in=@rand_addr=0x64010102, 0x3502, 0x0, 0x0, 0x0, 0x7fff, 0xb, 0xfffffffe}}, 0xe8) r5 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) fsetxattr$security_ima(r5, &(0x7f0000000040), &(0x7f0000000280)=ANY=[], 0xfe49, 0x0) ptrace$ARCH_GET_GS(0x1e, r1, &(0x7f00000001c0), 0x1004) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') ioctl$TCSETS(r6, 0x5402, &(0x7f00000000c0)={0x3, 0x5, 0x2, 0x6, 0x11, "cc4b3607a71aa44e0663ec52de35c6b2f9bde7"}) pread64(r6, &(0x7f0000001480)=""/4122, 0x101a, 0x99) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000300)=""/194) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3e, 0x88}, 0x0) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) 853.69628ms ago: executing program 4 (id=400): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x101843) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="07a77167ed5b38c6f957b2acc0b187a911ecd3c29204c2fff40ebb53375be19e83ec9de0730cd04dc38dc6eae9b5867718ce0f6d0dd02461d89ed0fe02e0e8578406ca81895a3fe13495e29fb986b6f90895a2c9479f063ca66adb0d597191f37f943d523000d86769390e71e768e389dcef9b62f5c1fc", @ANYRES16=r1, @ANYBLOB="000128bd7000fbdbdf2513000000200004801c00078008000300d1cfe75d0800040004000000080004000800000098000580080001006574680024000280080001000c000000080002001000000008000200b900000008000200025f000007000100696200005400028008000300060000000800030000180000080003000800000008000200050000000800020008000000080002000000000008000200b8b30000080004000500000008000400522e000008000100070000000c00028008000400030000000c00018008000300010100005c0005800c0002800800030000040000080001007564700008000100756470002c0002800800040000020000080002000700000008000200fe09000008000100000000000800030007000000070001006962000007000100696200003c0003800800020010000000080003000600000008000200b709000008000100010000000800030001000000080003000600000008000300090000000c0009800800020003000000"], 0x17c}, 0x1, 0x0, 0x0, 0x801}, 0x1) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r4, &(0x7f0000000d00)=[{{0x0, 0x1e, &(0x7f0000002c00)=[{&(0x7f0000001500)="b25b365c0254a7c6fc7ea6155a71b613b02d1645aab67271075189c3540c4dd19ebfb3c4acf87f2eeb258e62cc6ae96db360d874500cb86b4185ee533bf708", 0x3f}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0ac8fb1d99df61d7b518d0a62071e7ec69f658d5a52d7eb7ea31db43f8cf570f335a80860ac4cc240dc149d8468493db8aad089f590d62e0bcb9d1dcee636ee311ee51839b7201745baef82209b2ab741dc5ea481ae9dcebe39b1101a42a8c82de46107541c240ad0d9ee4a9340cffd72aaea692a60993637c81d23a0d0ebbae66f1eb2771df2482c043d8715ae788b56cc91eaa4d6bbdec82d8f91eb822d0b5f3ebd86", 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000002b40)='-', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce90bfdbcfb8a86a74f6799f98c36e23e210f053830ac8e978a0785884001a7099c4b9016f1a65a57390caf78c272cbf9711f94505dd525af1ff7d013438df5b844226f41b81e58eb73366", 0x4b}, {&(0x7f0000000540)="f2e659a0b00d26c2ee15", 0xa}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2964dd16e01d56b414499264923beda58d7da0313c1ccafe53965750f25bdaa6b56a87307ec23d48b6f35ce49a813a2bc3cb23fdf42826bdc16788ff466919594de5bf8a1fa5d825947271ade4a95efeb170c", 0xfffffd57}, {&(0x7f0000001340)="b8", 0x1}, {&(0x7f0000000500)="01", 0x1}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000140), 0x1}, {&(0x7f0000000340)="e4", 0xfffffec2}], 0x2, 0x0, 0xffffff84}}], 0x5f, 0x4000000) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000080)='source', &(0x7f0000000180)='b:::\x00\xef\xdfB\xfa=\xe3\xd1\x9d\xe1\xbfUlJ4]y-,\x8a\x03\x91xu\x9cP\xdc\xe5\x95\xa2@\x9c\x98\xa4\xd2\xd4}\xc8]7N\xf3\x0e\'\xa0x\xfbdt\xb4\x1fW\xe7\xbe\xaf\x01.zT\xab\x92I\x104\x8c\x18\x16\x1c\x8a\x8e\xfd\x8b{ZVHZ2\xd3\xd6-~\x96\x80#\xee)+L\xf1\x00\xd5p\xe7 \x8c\xd2\a\x1e\xae\xb4\xe8\xd1\xe1\xed\xb8\x94\xb2*\x1c\xaeG\x1e\xdb\xc0Q\xb9`K\xffG\xc0\xa2\xb41\xac\x98\x01\xde}:\b\xa0Oq\xec\xa8\xf0\x8f\xe3\xa17\xe3\xd7\x9c^\x90\xfal\xbe\x81\x9a\xa4\x00K', 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, &(0x7f0000000440)=ANY=[@ANYBLOB='filter\x00\x00\x00\x00\x00\x00\x00 \x00'/29], 0x68) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv6_newnexthop={0x30, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@mcast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r6, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r8 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) read(r8, &(0x7f00000019c0)=""/4097, 0x1001) 193.169891ms ago: executing program 2 (id=401): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x8000, 0x0, 0x0) mount(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x225d4e1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x10200, 0x4, 0x1000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000040)={0x0, 0x1, 0x6, @local}, 0x10) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaea2, 0xffffffff) sendmsg$nl_route_sched(r2, 0x0, 0x8008004) 49.058957ms ago: executing program 2 (id=402): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) eventfd2(0xff, 0x80801) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0x1, 0x60, {"3ef30fc735fc9a00003e0f01c8c4417df1a9b398000066b824008ec8460f79f2c4e1717db49c26000000b9800000c00f3235000400000f307b9666baa00066b8000066ef66bad1040f01c2260f78da"}}], 0x60}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(r1, 0xd, 0x0, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)={0x30, 0x3e, 0x200, 0x70bd27, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0x9, 0x2, 0x0, 0x1, [@generic="725eb862ce"]}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) mount$overlay(0x0, &(0x7f0000000040)='./file2\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)={[{@uuid_off}, {@redirect_dir_off}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}, {@volatile}, {@nfs_export_off}]}) r5 = getpid() sched_setscheduler(r5, 0x2, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) 0s ago: executing program 0 (id=403): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) syz_io_uring_submit(0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x4000851) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205649, 0x0) r4 = eventfd2(0xff, 0x80801) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r4}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) epoll_create1(0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x8, r4, 0xc}) kernel console output (not intermixed with test programs): 937284][ T5947] overlayfs: regular lower layers cannot follow data lower layers [ 66.986605][ T3568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.005724][ T3568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.023377][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.052418][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.080887][ T5834] Bluetooth: hci1: command tx timeout [ 67.161425][ T5834] Bluetooth: hci2: command tx timeout [ 67.166869][ T5834] Bluetooth: hci3: command tx timeout [ 67.172524][ T5823] Bluetooth: hci0: command tx timeout [ 67.177910][ T5823] Bluetooth: hci4: command tx timeout [ 67.769919][ T3568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.784605][ T3568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.794753][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.825289][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.100840][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 68.122656][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.211463][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 68.300485][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.308807][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.323709][ T5895] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 68.480529][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.500557][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.581582][ T24] usb 1-1: device descriptor read/64, error -71 [ 68.630465][ T5895] usb 2-1: Using ep0 maxpacket: 32 [ 68.646242][ T5895] usb 2-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 68.755322][ T5895] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 68.780524][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.789436][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 68.800274][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 68.815525][ T5895] usb 2-1: New USB device found, idVendor=413c, idProduct=819b, bcdDevice=a7.c0 [ 68.843240][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.851446][ T5895] usb 2-1: Product: syz [ 68.855619][ T5895] usb 2-1: Manufacturer: syz [ 68.860378][ T5895] usb 2-1: SerialNumber: syz [ 68.870295][ T24] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 68.889928][ T5895] usb 2-1: config 0 descriptor?? [ 69.110907][ T24] usb 1-1: device descriptor read/64, error -71 [ 69.170871][ T5827] Bluetooth: hci1: command tx timeout [ 69.215496][ T5978] tmpfs: Bad value for 'mpol' [ 69.250826][ T5827] Bluetooth: hci4: command tx timeout [ 69.256243][ T5827] Bluetooth: hci0: command tx timeout [ 69.261949][ T5834] Bluetooth: hci2: command tx timeout [ 69.267333][ T5823] Bluetooth: hci3: command tx timeout [ 69.279248][ T24] usb usb1-port1: attempt power cycle [ 69.318499][ T5895] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22 [ 69.381887][ T5895] usb 2-1: USB disconnect, device number 2 [ 69.724788][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 69.724798][ T30] audit: type=1400 audit(1764716346.027:157): avc: denied { write } for pid=6001 comm="syz.4.17" name="001" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 69.774743][ T24] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 69.953769][ T24] usb 1-1: device descriptor read/8, error -71 [ 70.008801][ T30] audit: type=1400 audit(1764716346.307:158): avc: denied { setopt } for pid=6001 comm="syz.4.17" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 70.107860][ T6011] IPv6: NLM_F_CREATE should be specified when creating new route [ 70.208131][ T24] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 70.250893][ T30] audit: type=1400 audit(1764716346.557:159): avc: denied { create } for pid=6013 comm="syz.0.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 70.291383][ T30] audit: type=1400 audit(1764716346.597:160): avc: denied { connect } for pid=6013 comm="syz.0.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 70.330615][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 70.383979][ T30] audit: type=1400 audit(1764716346.617:161): avc: denied { read write } for pid=6015 comm="syz.1.21" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 70.421246][ T30] audit: type=1400 audit(1764716346.617:162): avc: denied { open } for pid=6015 comm="syz.1.21" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 70.453385][ T24] usb 1-1: device not accepting address 5, error -71 [ 70.517324][ T6020] netlink: 21 bytes leftover after parsing attributes in process `syz.0.20'. [ 70.522615][ T24] usb usb1-port1: unable to enumerate USB device [ 70.752028][ T10] usb 5-1: config 0 has an invalid interface number: 84 but max is 0 [ 70.789224][ T10] usb 5-1: config 0 has an invalid interface number: 66 but max is 0 [ 70.809617][ T10] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 70.830088][ T30] audit: type=1400 audit(1764716346.617:163): avc: denied { ioctl } for pid=6013 comm="syz.0.20" path="socket:[8793]" dev="sockfs" ino=8793 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 70.860269][ T10] usb 5-1: config 0 has no interface number 0 [ 70.866467][ T10] usb 5-1: config 0 has no interface number 1 [ 70.886728][ T10] usb 5-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 17944, setting to 64 [ 70.898040][ T30] audit: type=1400 audit(1764716346.687:164): avc: denied { write } for pid=6010 comm="syz.2.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 70.918663][ T10] usb 5-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 70.936441][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.947032][ T10] usb 5-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 70.959312][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.100251][ T10] usb 5-1: config 0 interface 66 altsetting 153 bulk endpoint 0x5 has invalid maxpacket 32 [ 71.420277][ T848] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 71.555233][ T10] usb 5-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 71.568172][ T10] usb 5-1: config 0 interface 66 altsetting 153 endpoint 0x86 has invalid maxpacket 34869, setting to 1024 [ 71.579596][ T10] usb 5-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 1024 [ 71.590736][ T10] usb 5-1: config 0 interface 66 altsetting 153 has 2 endpoint descriptors, different from the interface descriptor's value: 216 [ 71.604096][ T10] usb 5-1: config 0 interface 66 has no altsetting 0 [ 71.635971][ T10] usb 5-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 71.654343][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.663635][ T10] usb 5-1: Product: syz [ 71.667804][ T10] usb 5-1: Manufacturer: syz [ 71.672996][ T10] usb 5-1: SerialNumber: syz [ 71.681469][ T10] usb 5-1: config 0 descriptor?? [ 71.691932][ T10] ljca 5-1:0.84: bulk endpoints not found [ 71.750225][ T848] usb 2-1: Using ep0 maxpacket: 8 [ 71.756808][ T848] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 88, changing to 10 [ 71.780232][ T848] usb 2-1: config 1 interface 0 has no altsetting 0 [ 71.790314][ T848] usb 2-1: language id specifier not provided by device, defaulting to English [ 71.822080][ T848] usb 2-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 71.838308][ T848] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.849843][ T848] usb 2-1: Product: syz [ 71.854104][ T848] usb 2-1: Manufacturer: ⯴ৼ閣ï‹á€›æ³î°¨ãšŒå­‡ã‚œâŸ£à¡ì“¿ÔŒâ´¶å˜é³¥ã´·ë¨‘埧尔澵ï†ì—빕ᄲ㳰㽫浞줎鈇ä€å¾ˆà¬­ç“¾ï£‡å¤æ†¸ê„œì†¦è–®ë›¾ [ 71.869771][ T848] usb 2-1: SerialNumber: syz [ 71.901077][ T5932] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 72.053337][ T5932] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 72.062513][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.070634][ T5932] usb 1-1: Product: syz [ 72.074870][ T5932] usb 1-1: Manufacturer: syz [ 72.079541][ T5932] usb 1-1: SerialNumber: syz [ 72.091784][ T30] audit: type=1400 audit(1764716348.397:165): avc: denied { create } for pid=6022 comm="syz.1.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 72.098233][ T5932] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 72.121043][ T30] audit: type=1400 audit(1764716348.427:166): avc: denied { bind } for pid=6022 comm="syz.1.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 72.169742][ T5936] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 73.182873][ T6036] netlink: 'syz.0.23': attribute type 4 has an invalid length. [ 73.937182][ T10] ljca 5-1:0.66: probe with driver ljca failed with error -71 [ 73.970358][ T848] usbhid 2-1:1.0: can't add hid device: -71 [ 73.989971][ T848] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 74.004214][ T848] usb 2-1: USB disconnect, device number 3 [ 74.115449][ T10] usb 5-1: USB disconnect, device number 2 [ 74.310475][ T6041] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 74.390932][ T5929] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 74.446808][ T5936] usb 1-1: Service connection timeout for: 256 [ 74.461151][ T5936] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 74.665373][ T6041] usb 3-1: config 0 has an invalid interface number: 17 but max is 0 [ 74.687829][ T5936] ath9k_htc: Failed to initialize the device [ 74.699071][ T5929] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 74.720273][ T6041] usb 3-1: config 0 has no interface number 0 [ 74.729577][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.737880][ T5929] usb 4-1: Product: syz [ 74.747555][ T5929] usb 4-1: Manufacturer: syz [ 74.749090][ T5936] usb 1-1: ath9k_htc: USB layer deinitialized [ 74.752576][ T6041] usb 3-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 74.805162][ T5929] usb 4-1: SerialNumber: syz [ 74.846670][ T40] usb 1-1: USB disconnect, device number 6 [ 74.870206][ T6041] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.878214][ T6041] usb 3-1: Product: syz [ 74.887008][ T5929] usb 4-1: config 0 descriptor?? [ 74.905862][ T5929] i2c-tiny-usb 4-1:0.0: version 6d.cc found at bus 004 address 002 [ 74.918154][ T6041] usb 3-1: Manufacturer: syz [ 74.924665][ T6041] usb 3-1: SerialNumber: syz [ 74.936446][ T6041] usb 3-1: config 0 descriptor?? [ 75.021398][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 75.021413][ T30] audit: type=1400 audit(1764716351.327:177): avc: denied { name_bind } for pid=6062 comm="syz.0.30" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 75.114287][ T30] audit: type=1400 audit(1764716351.347:178): avc: denied { node_bind } for pid=6062 comm="syz.0.30" saddr=fe80::aa src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 75.190093][ T6044] netlink: 12 bytes leftover after parsing attributes in process `syz.2.26'. [ 75.237562][ T30] audit: type=1400 audit(1764716351.357:179): avc: denied { setopt } for pid=6062 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.303449][ T30] audit: type=1400 audit(1764716351.487:180): avc: denied { read write } for pid=6043 comm="syz.2.26" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 75.458874][ T5929] (null): failure reading functionality [ 75.507773][ T30] audit: type=1400 audit(1764716351.487:181): avc: denied { open } for pid=6043 comm="syz.2.26" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 75.510414][ T40] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 75.531624][ T30] audit: type=1400 audit(1764716351.487:182): avc: denied { ioctl } for pid=6043 comm="syz.2.26" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d0c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 75.540788][ T5929] i2c i2c-1: connected i2c-tiny-usb device [ 75.753991][ T30] audit: type=1400 audit(1764716351.507:183): avc: denied { connect } for pid=6070 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 76.129150][ T30] audit: type=1400 audit(1764716351.807:184): avc: denied { write } for pid=6072 comm="syz.1.33" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.130268][ T40] usb 1-1: Using ep0 maxpacket: 16 [ 76.205381][ T30] audit: type=1400 audit(1764716351.807:185): avc: denied { open } for pid=6072 comm="syz.1.33" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.221811][ T40] usb 1-1: config 0 has an invalid interface number: 181 but max is 0 [ 76.268896][ T30] audit: type=1400 audit(1764716351.807:186): avc: denied { ioctl } for pid=6072 comm="syz.1.33" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 76.284595][ T40] usb 1-1: config 0 has no interface number 0 [ 76.362204][ T40] usb 1-1: config 0 interface 181 has no altsetting 0 [ 76.386802][ T40] usb 1-1: New USB device found, idVendor=1199, idProduct=9009, bcdDevice=dd.a5 [ 76.421349][ T40] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.429436][ T40] usb 1-1: Product: syz [ 76.433681][ T40] usb 1-1: Manufacturer: syz [ 76.438371][ T40] usb 1-1: SerialNumber: syz [ 76.483067][ T40] usb 1-1: config 0 descriptor?? [ 76.706577][ T40] usb 1-1: USB disconnect, device number 7 [ 76.721776][ T6079] SELinux: Context Ü is not valid (left unmapped). [ 76.842867][ T6080] netlink: 16 bytes leftover after parsing attributes in process `syz.1.34'. [ 76.856018][ T6080] ubi31: attaching mtd0 [ 76.866017][ T6080] ubi31: scanning is finished [ 76.870861][ T6080] ubi31: empty MTD device detected [ 76.912205][ T6081] usb usb8: usbfs: process 6081 (syz.1.34) did not claim interface 0 before use [ 77.314422][ T6041] snd_usb_podhd 3-1:0.17: Line 6 POD HD300 found [ 77.327173][ T40] usb 4-1: USB disconnect, device number 2 [ 77.355253][ T6041] usb 3-1: selecting invalid altsetting 5 [ 77.398186][ T6041] snd_usb_podhd 3-1:0.17: set_interface failed [ 77.398331][ T6080] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 77.416085][ T6080] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 77.505085][ T6080] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 77.506925][ T6041] snd_usb_podhd 3-1:0.17: Line 6 POD HD300 now disconnected [ 77.531049][ T6041] snd_usb_podhd 3-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 77.542644][ T6041] usb 3-1: USB disconnect, device number 2 [ 77.556783][ T6080] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 78.081579][ T6080] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 78.088443][ T6080] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 78.109505][ T6080] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3072792824 [ 78.124395][ T6080] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 78.176976][ T6084] ubi31: background thread "ubi_bgt31d" started, PID 6084 [ 78.350211][ T5819] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 78.505049][ T5819] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 78.522716][ T5819] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.536494][ T5819] usb 1-1: Product: syz [ 78.541384][ T5819] usb 1-1: Manufacturer: syz [ 78.542305][ T6102] Zero length message leads to an empty skb [ 78.546136][ T5819] usb 1-1: SerialNumber: syz [ 78.566957][ T5819] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 78.586080][ T5936] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 78.769519][ T6107] netlink: 104 bytes leftover after parsing attributes in process `syz.3.39'. [ 78.930391][ T6115] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 79.484000][ T6117] netlink: 'syz.0.38': attribute type 4 has an invalid length. [ 79.978093][ T6124] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.45'. [ 79.992158][ T6123] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.45'. [ 80.281012][ T5936] usb 1-1: Service connection timeout for: 256 [ 80.492728][ T5936] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 80.590323][ T5936] ath9k_htc: Failed to initialize the device [ 80.608990][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 80.609004][ T30] audit: type=1400 audit(1764716356.907:201): avc: denied { bind } for pid=6120 comm="syz.2.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 80.621390][ T5936] usb 1-1: ath9k_htc: USB layer deinitialized [ 80.650767][ T6121] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 80.658430][ T6121] audit: out of memory in audit_log_start [ 80.668507][ T6121] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 80.679685][ T6121] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 81.394392][ T9] cfg80211: failed to load regulatory.db [ 81.490093][ T6041] usb 1-1: USB disconnect, device number 8 [ 81.936123][ T6144] netlink: 24 bytes leftover after parsing attributes in process `syz.0.52'. [ 82.098622][ T6147] delete_channel: no stack [ 82.108985][ T30] audit: type=1400 audit(1764716358.417:202): avc: denied { getopt } for pid=6145 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 82.229754][ T6134] Invalid source name [ 82.240887][ T6134] UBIFS error (pid: 6134): cannot open "./file0", error -22 [ 82.267064][ T6142] netlink: 4 bytes leftover after parsing attributes in process `syz.0.52'. [ 82.283187][ T30] audit: type=1400 audit(1764716358.417:203): avc: denied { ioctl } for pid=6145 comm="syz.1.53" path="socket:[9393]" dev="sockfs" ino=9393 ioctlcmd=0x4b6b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 82.339798][ T30] audit: type=1400 audit(1764716358.567:204): avc: denied { unmount } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 82.373533][ T6142] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.406533][ T30] audit: type=1400 audit(1764716358.617:205): avc: denied { write } for pid=6145 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 82.426544][ T30] audit: type=1400 audit(1764716358.687:206): avc: denied { sys_module } for pid=6145 comm="syz.1.53" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 83.346267][ T6142] bridge_slave_0 (unregistering): left allmulticast mode [ 83.373035][ T6142] bridge_slave_0 (unregistering): left promiscuous mode [ 83.390923][ T6142] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.447164][ T6159] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -12 [ 83.456712][ T6159] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -12 [ 83.466903][ T6159] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 83.522636][ T30] audit: type=1800 audit(1764716359.747:207): pid=6159 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t op=collect_data cause=failed comm="syz.2.56" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 83.565853][ T6166] netlink: 24 bytes leftover after parsing attributes in process `syz.3.58'. [ 83.591288][ T30] audit: type=1400 audit(1764716359.767:208): avc: denied { firmware_load } for pid=6155 comm="syz.2.56" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 83.859315][ T6171] netlink: 132 bytes leftover after parsing attributes in process `syz.1.57'. [ 84.571668][ T6178] netlink: 20 bytes leftover after parsing attributes in process `syz.0.60'. [ 84.580772][ T6178] openvswitch: netlink: Flow actions attr not present in new flow. [ 85.471028][ T6185] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 85.768984][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 85.775206][ T30] audit: type=1400 audit(1764716362.047:230): avc: denied { setattr } for pid=6187 comm="syz.0.63" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 86.440404][ T5936] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 86.485087][ T30] audit: type=1400 audit(1764716362.767:231): avc: denied { setopt } for pid=6194 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 86.506981][ T5930] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 86.536623][ T5930] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 86.558465][ T30] audit: type=1400 audit(1764716362.767:232): avc: denied { lock } for pid=6194 comm="syz.4.64" path="socket:[9487]" dev="sockfs" ino=9487 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 86.610259][ T30] audit: type=1400 audit(1764716362.777:233): avc: denied { read write } for pid=6194 comm="syz.4.64" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 86.630278][ T5936] usb 3-1: Using ep0 maxpacket: 8 [ 86.654491][ T30] audit: type=1400 audit(1764716362.777:234): avc: denied { open } for pid=6194 comm="syz.4.64" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 86.655749][ T5936] usb 3-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 86.993617][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.019988][ T5936] usb 3-1: Product: syz [ 87.020012][ T30] audit: type=1400 audit(1764716363.317:235): avc: denied { mounton } for pid=6205 comm="syz.1.67" path="/18/file0" dev="tmpfs" ino=110 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 87.046654][ T6206] fuse: Unknown parameter 'fd0x0000000000000004' [ 87.110252][ T5936] usb 3-1: Manufacturer: syz [ 87.114920][ T5936] usb 3-1: SerialNumber: syz [ 87.153295][ T5936] usb 3-1: config 0 descriptor?? [ 87.232609][ T30] audit: type=1400 audit(1764716363.537:236): avc: denied { ioctl } for pid=6210 comm="syz.3.69" path="socket:[9510]" dev="sockfs" ino=9510 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 88.062888][ T30] audit: type=1400 audit(1764716364.367:237): avc: denied { read write } for pid=6218 comm="syz.3.71" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 88.088407][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.3.71'. [ 88.317572][ T30] audit: type=1400 audit(1764716364.397:238): avc: denied { ioctl open } for pid=6218 comm="syz.3.71" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 88.471346][ T6226] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.71'. [ 88.856041][ T5936] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 88.882816][ T5936] gspca_sunplus: reg_w_riv err -71 [ 88.894432][ T5936] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 88.907462][ T5936] usb 3-1: USB disconnect, device number 3 [ 89.329282][ T30] audit: type=1400 audit(1764716365.627:239): avc: denied { mount } for pid=6232 comm="syz.0.74" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 89.335832][ T6236] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 89.383478][ T6237] netlink: 20 bytes leftover after parsing attributes in process `syz.2.73'. [ 89.392359][ T6237] openvswitch: netlink: Flow actions attr not present in new flow. [ 89.931043][ T6245] netlink: 12 bytes leftover after parsing attributes in process `syz.4.77'. [ 90.403627][ T6249] tipc: Started in network mode [ 90.444556][ T6249] tipc: Node identity 12b347a3d9b8, cluster identity 4711 [ 90.479197][ T6245] capability: warning: `syz.4.77' uses deprecated v2 capabilities in a way that may be insecure [ 90.480077][ T6249] tipc: Enabled bearer , priority 0 [ 90.562256][ T6244] tipc: Disabling bearer [ 90.661824][ T6264] netlink: 'syz.1.81': attribute type 4 has an invalid length. [ 90.681988][ T6264] netlink: 17 bytes leftover after parsing attributes in process `syz.1.81'. [ 90.917906][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 90.917936][ T30] audit: type=1400 audit(1764716367.217:245): avc: denied { create } for pid=6263 comm="syz.1.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 91.312509][ T6280] netlink: 32 bytes leftover after parsing attributes in process `syz.0.84'. [ 91.321431][ T6280] openvswitch: netlink: Flow key attr not present in new flow. [ 93.204406][ T6299] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 93.387949][ T5936] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 93.541430][ T30] audit: type=1400 audit(1764716369.847:246): avc: denied { listen } for pid=6298 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 93.587601][ T30] audit: type=1400 audit(1764716369.847:247): avc: denied { accept } for pid=6298 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 93.593141][ T5827] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 93.618908][ T5827] CPU: 1 UID: 0 PID: 5827 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 93.618934][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 93.618947][ T5827] Workqueue: hci4 hci_rx_work [ 93.618980][ T5827] Call Trace: [ 93.618986][ T5827] [ 93.618993][ T5827] dump_stack_lvl+0x16c/0x1f0 [ 93.619013][ T5827] sysfs_warn_dup+0x7f/0xa0 [ 93.619033][ T5827] sysfs_create_dir_ns+0x24b/0x2b0 [ 93.619051][ T5827] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 93.619068][ T5827] ? find_held_lock+0x2b/0x80 [ 93.619091][ T5827] ? do_raw_spin_unlock+0x172/0x230 [ 93.619122][ T5827] kobject_add_internal+0x2c4/0x9b0 [ 93.619148][ T5827] kobject_add+0x16e/0x240 [ 93.619168][ T5827] ? __pfx_kobject_add+0x10/0x10 [ 93.619190][ T5827] ? do_raw_spin_unlock+0x172/0x230 [ 93.619218][ T5827] ? kobject_put+0xab/0x590 [ 93.619244][ T5827] device_add+0x288/0x1950 [ 93.619271][ T5827] ? __pfx_dev_set_name+0x10/0x10 [ 93.619299][ T5827] ? __pfx_device_add+0x10/0x10 [ 93.619325][ T5827] ? mgmt_send_event_skb+0x2fb/0x460 [ 93.619360][ T5827] hci_conn_add_sysfs+0x17e/0x230 [ 93.619381][ T5827] le_conn_complete_evt+0x1260/0x2150 [ 93.619416][ T5827] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 93.619443][ T5827] ? hci_event_packet+0x459/0x11c0 [ 93.619478][ T5827] hci_le_conn_complete_evt+0x23c/0x370 [ 93.619513][ T5827] hci_le_meta_evt+0x357/0x5e0 [ 93.619531][ T5827] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 93.619563][ T5827] hci_event_packet+0x685/0x11c0 [ 93.619591][ T5827] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 93.619611][ T5827] ? __pfx_hci_event_packet+0x10/0x10 [ 93.619642][ T5827] ? kcov_remote_start+0x384/0x670 [ 93.619661][ T5827] ? lockdep_hardirqs_on+0x7c/0x110 [ 93.619685][ T5827] hci_rx_work+0x2c9/0xeb0 [ 93.619723][ T5827] process_one_work+0x9ba/0x1b20 [ 93.619757][ T5827] ? __pfx_process_one_work+0x10/0x10 [ 93.619787][ T5827] ? assign_work+0x1a0/0x250 [ 93.619807][ T5827] worker_thread+0x6c8/0xf10 [ 93.619836][ T5827] ? __kthread_parkme+0x19e/0x250 [ 93.619854][ T5827] ? __pfx_worker_thread+0x10/0x10 [ 93.619875][ T5827] kthread+0x3c5/0x780 [ 93.619894][ T5827] ? __pfx_kthread+0x10/0x10 [ 93.619916][ T5827] ? rcu_is_watching+0x12/0xc0 [ 93.619933][ T5827] ? __pfx_kthread+0x10/0x10 [ 93.619953][ T5827] ret_from_fork+0x855/0xa50 [ 93.619971][ T5827] ? __pfx_ret_from_fork+0x10/0x10 [ 93.619990][ T5827] ? __switch_to+0x7af/0x10d0 [ 93.620011][ T5827] ? __pfx_kthread+0x10/0x10 [ 93.620031][ T5827] ret_from_fork_asm+0x1a/0x30 [ 93.620067][ T5827] [ 93.620090][ T5827] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 93.890225][ T5827] Bluetooth: hci4: failed to register connection device [ 93.953829][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 93.965711][ T30] audit: type=1400 audit(1764716369.947:248): avc: denied { create } for pid=6298 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.001288][ T5936] usb 2-1: config 0 has an invalid interface number: 151 but max is 0 [ 94.009475][ T5936] usb 2-1: config 0 has no interface number 0 [ 94.034853][ T5936] usb 2-1: config 0 interface 151 has no altsetting 0 [ 94.062283][ T5936] usb 2-1: New USB device found, idVendor=2770, idProduct=9051, bcdDevice=d9.3e [ 94.113592][ T30] audit: type=1400 audit(1764716370.417:249): avc: denied { connect } for pid=6298 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.116163][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.190285][ T5936] usb 2-1: Product: syz [ 94.194527][ T5936] usb 2-1: Manufacturer: syz [ 94.199119][ T5936] usb 2-1: SerialNumber: syz [ 94.231366][ T5936] usb 2-1: config 0 descriptor?? [ 94.312417][ T30] audit: type=1400 audit(1764716370.437:250): avc: denied { ioctl } for pid=6298 comm="syz.2.90" path="socket:[10441]" dev="sockfs" ino=10441 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.419536][ T5936] usb 2-1: can't set config #0, error -71 [ 94.438019][ T5936] usb 2-1: USB disconnect, device number 4 [ 94.487771][ T30] audit: type=1400 audit(1764716370.447:251): avc: denied { connect } for pid=6298 comm="syz.2.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 94.497794][ T6321] syz.0.93 uses obsolete (PF_INET,SOCK_PACKET) [ 94.513966][ T30] audit: type=1400 audit(1764716370.447:252): avc: denied { name_connect } for pid=6298 comm="syz.2.90" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 94.603564][ T30] audit: type=1400 audit(1764716370.907:253): avc: denied { create } for pid=6323 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 94.663997][ T6317] loop6: detected capacity change from 0 to 524287999 [ 94.693472][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.695427][ T6327] syz_tun: entered allmulticast mode [ 94.710607][ T30] audit: type=1400 audit(1764716370.937:254): avc: denied { bind } for pid=6323 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 94.736303][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.763482][ T6326] syz_tun: left allmulticast mode [ 94.791463][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.799427][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.808640][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.816672][ T24] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 94.817458][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.832685][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.842870][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.853281][ T5836] ldm_validate_partition_table(): Disk read failed. [ 94.860084][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.873186][ T5836] Buffer I/O error on dev loop6, logical block 0, async page read [ 94.882724][ T5836] Dev loop6: unable to read RDB block 0 [ 94.884852][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 94.888756][ T5836] loop6: unable to read partition table [ 94.897193][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 94.914185][ T6317] ldm_validate_partition_table(): Disk read failed. [ 94.921514][ T6317] Dev loop6: unable to read RDB block 0 [ 94.927605][ T6317] loop6: unable to read partition table [ 94.941789][ T6317] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 94.948779][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 94.951960][ T6321] ldm_validate_partition_table(): Disk read failed. [ 94.960843][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 94.967144][ T6321] Dev loop6: unable to read RDB block 0 [ 94.982907][ T6321] loop6: unable to read partition table [ 94.990443][ T6321] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 94.993059][ T5930] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 95.033281][ T24] usb 4-1: config 0 has an invalid interface number: 17 but max is 0 [ 95.043253][ T24] usb 4-1: config 0 has no interface number 0 [ 95.060047][ T24] usb 4-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 95.077102][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.088377][ T24] usb 4-1: Product: syz [ 95.095140][ T24] usb 4-1: Manufacturer: syz [ 95.099749][ T24] usb 4-1: SerialNumber: syz [ 95.107474][ T24] usb 4-1: config 0 descriptor?? [ 95.147787][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 95.163229][ T5930] usb 2-1: config 0 has an invalid interface number: 84 but max is 0 [ 95.180428][ T5930] usb 2-1: config 0 has an invalid interface number: 66 but max is 0 [ 95.188588][ T5930] usb 2-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 95.212163][ T6329] netlink: 32 bytes leftover after parsing attributes in process `syz.2.99'. [ 95.222281][ T5930] usb 2-1: config 0 has no interface number 0 [ 95.230350][ T5930] usb 2-1: config 0 has no interface number 1 [ 95.236483][ T5930] usb 2-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 17944, setting to 64 [ 95.251919][ T5930] usb 2-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 95.265153][ T5930] usb 2-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 95.290265][ T5930] usb 2-1: config 0 interface 66 altsetting 153 bulk endpoint 0x5 has invalid maxpacket 32 [ 95.304638][ T5930] usb 2-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 95.318386][ T5930] usb 2-1: config 0 interface 66 altsetting 153 endpoint 0x86 has invalid maxpacket 34869, setting to 1024 [ 95.330225][ T5930] usb 2-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 1024 [ 95.342596][ T5930] usb 2-1: config 0 interface 66 altsetting 153 has 2 endpoint descriptors, different from the interface descriptor's value: 216 [ 95.357964][ T5930] usb 2-1: config 0 interface 66 has no altsetting 0 [ 95.367436][ T5930] usb 2-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 95.377098][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.385391][ T5930] usb 2-1: Product: syz [ 95.389604][ T5930] usb 2-1: Manufacturer: syz [ 95.399424][ T6313] netlink: 12 bytes leftover after parsing attributes in process `syz.3.94'. [ 95.403633][ T5930] usb 2-1: SerialNumber: syz [ 95.443380][ T5930] usb 2-1: config 0 descriptor?? [ 95.457783][ T5930] ljca 2-1:0.84: bulk endpoints not found [ 95.723105][ T5930] ljca 2-1:0.66: probe with driver ljca failed with error -71 [ 95.745315][ T5930] usb 2-1: USB disconnect, device number 5 [ 96.464516][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 96.464685][ T30] audit: type=1400 audit(1764716372.697:258): avc: denied { create } for pid=6348 comm="syz.4.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 96.898348][ T30] audit: type=1400 audit(1764716373.197:259): avc: denied { read write } for pid=6351 comm="syz.1.105" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 96.958823][ T6356] netlink: 24 bytes leftover after parsing attributes in process `syz.2.106'. [ 96.996537][ T30] audit: type=1400 audit(1764716373.227:260): avc: denied { open } for pid=6351 comm="syz.1.105" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 97.021529][ T30] audit: type=1400 audit(1764716373.227:261): avc: denied { ioctl } for pid=6351 comm="syz.1.105" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 97.094492][ T30] audit: type=1400 audit(1764716373.397:262): avc: denied { ioctl } for pid=6357 comm="syz.4.108" path="socket:[9812]" dev="sockfs" ino=9812 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 97.216329][ T5930] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 97.453613][ T5930] usb 2-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 97.484105][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.520261][ T5930] usb 2-1: Product: syz [ 97.540219][ T5930] usb 2-1: Manufacturer: syz [ 97.544862][ T5930] usb 2-1: SerialNumber: syz [ 97.572063][ T5930] usb 2-1: config 0 descriptor?? [ 97.593421][ T5930] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 97.610326][ T30] audit: type=1400 audit(1764716373.907:263): avc: denied { read write } for pid=6364 comm="syz.2.110" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 97.616732][ T6365] 9pnet_fd: Insufficient options for proto=fd [ 97.649683][ T5930] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 97.690780][ T30] audit: type=1400 audit(1764716373.917:264): avc: denied { open } for pid=6364 comm="syz.2.110" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 97.692562][ T5930] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 97.771298][ T5930] usb 2-1: media controller created [ 97.814952][ T5930] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 97.823621][ T30] audit: type=1400 audit(1764716374.137:265): avc: denied { append } for pid=6351 comm="syz.1.105" name="i2c-1" dev="devtmpfs" ino=2824 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 97.832492][ T6353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.865345][ T6353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.881529][ T6370] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 97.903341][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.111'. [ 97.907903][ T30] audit: type=1400 audit(1764716374.137:266): avc: denied { setopt } for pid=6351 comm="syz.1.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 97.953336][ T24] snd_usb_podhd 4-1:0.17: Line 6 POD HD300 found [ 97.986268][ T24] usb 4-1: selecting invalid altsetting 5 [ 98.004282][ T30] audit: type=1326 audit(1764716374.137:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6351 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f313758f749 code=0x7ffc0000 [ 98.004814][ T24] snd_usb_podhd 4-1:0.17: set_interface failed [ 98.080411][ T5930] DVB: Unable to find symbol mt352_attach() [ 98.263174][ T24] snd_usb_podhd 4-1:0.17: Line 6 POD HD300 now disconnected [ 98.392364][ T24] snd_usb_podhd 4-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 98.405179][ T5930] DVB: Unable to find symbol nxt6000_attach() [ 98.411811][ T5930] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 98.425207][ T24] usb 4-1: USB disconnect, device number 3 [ 99.039534][ T5930] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 99.065451][ T5930] dvb-usb: schedule remote query interval to 1000 msecs. [ 99.074035][ T5930] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 99.087509][ T5930] dvb-usb: bulk message failed: -22 (7/0) [ 99.095887][ T5930] dvb-usb: bulk message failed: -22 (7/0) [ 99.122074][ T5902] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 99.198971][ T6393] netlink: 'syz.3.118': attribute type 1 has an invalid length. [ 99.301635][ T6396] binder: 6395:6396 ioctl c0306201 200000000180 returned -14 [ 99.331977][ T5902] usb 3-1: config 0 has an invalid interface number: 84 but max is 0 [ 99.347275][ T5902] usb 3-1: config 0 has an invalid interface number: 66 but max is 0 [ 99.387498][ T6398] bond1: (slave ip6gretap1): making interface the new active one [ 99.396456][ T5902] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 99.580870][ T57] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 99.609528][ T5902] usb 3-1: config 0 has no interface number 0 [ 99.609783][ T6398] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 99.635576][ T5902] usb 3-1: config 0 has no interface number 1 [ 99.719178][ T5902] usb 3-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 17944, setting to 64 [ 99.745454][ T5902] usb 3-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 99.769309][ T5902] usb 3-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 99.790402][ T5902] usb 3-1: config 0 interface 66 altsetting 153 bulk endpoint 0x5 has invalid maxpacket 32 [ 99.802132][ T24] usb 2-1: USB disconnect, device number 6 [ 99.802258][ T5902] usb 3-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 99.820291][ T5902] usb 3-1: config 0 interface 66 altsetting 153 endpoint 0x86 has invalid maxpacket 34869, setting to 1024 [ 99.833659][ T5902] usb 3-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 1024 [ 99.844143][ T5902] usb 3-1: config 0 interface 66 altsetting 153 has 2 endpoint descriptors, different from the interface descriptor's value: 216 [ 99.862441][ T5902] usb 3-1: config 0 interface 66 has no altsetting 0 [ 99.873439][ T57] usb 5-1: unable to get BOS descriptor or descriptor too short [ 99.885458][ T5902] usb 3-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 99.895883][ T57] usb 5-1: config 13 has an invalid interface number: 161 but max is 0 [ 99.911664][ T5902] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.919688][ T5902] usb 3-1: Product: syz [ 99.924125][ T57] usb 5-1: config 13 has no interface number 0 [ 99.937802][ T57] usb 5-1: config 13 interface 161 has no altsetting 0 [ 99.945095][ T5902] usb 3-1: Manufacturer: syz [ 99.949941][ T5902] usb 3-1: SerialNumber: syz [ 99.951136][ T6401] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 99.957296][ T57] usb 5-1: New USB device found, idVendor=064b, idProduct=7825, bcdDevice=d2.04 [ 99.975176][ T6405] netlink: 16 bytes leftover after parsing attributes in process `syz.3.121'. [ 99.986008][ T24] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 99.986100][ T5902] usb 3-1: config 0 descriptor?? [ 100.015211][ T57] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.059437][ T6402] openvswitch: netlink: Message has 592 unknown bytes. [ 100.066644][ T6402] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 100.293021][ T57] usb 5-1: Product: syz [ 100.297199][ T57] usb 5-1: Manufacturer: syz [ 100.305636][ T5902] ljca 3-1:0.84: bulk endpoints not found [ 100.327794][ T57] usb 5-1: SerialNumber: syz [ 100.349912][ T5902] ljca 3-1:0.66: probe with driver ljca failed with error -71 [ 100.391249][ T5902] usb 3-1: USB disconnect, device number 4 [ 100.944123][ T57] upd78f0730 5-1:13.161: upd78f0730 converter detected [ 100.983594][ T57] usb 5-1: upd78f0730 converter now attached to ttyUSB0 [ 101.041152][ T57] usb 5-1: USB disconnect, device number 3 [ 101.052281][ T57] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 101.084122][ T57] upd78f0730 5-1:13.161: device disconnected [ 101.423807][ T6434] Bluetooth: MGMT ver 1.23 [ 102.460561][ T30] kauditd_printk_skb: 186 callbacks suppressed [ 102.460576][ T30] audit: type=1400 audit(1764716378.767:454): avc: denied { add_name } for pid=6416 comm="dhcpcd-run-hook" name="resolv.conf.dummy0.ipv4ll" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.599625][ T30] audit: type=1400 audit(1764716378.767:455): avc: denied { create } for pid=6416 comm="dhcpcd-run-hook" name="resolv.conf.dummy0.ipv4ll" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 102.626036][ T6439] netlink: 8 bytes leftover after parsing attributes in process `syz.3.127'. [ 102.644628][ T6442] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 102.694032][ T30] audit: type=1400 audit(1764716378.767:456): avc: denied { write } for pid=6416 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.dummy0.ipv4ll" dev="tmpfs" ino=2307 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 102.725662][ T6443] capability: warning: `syz.3.127' uses 32-bit capabilities (legacy support in use) [ 102.757129][ T30] audit: type=1400 audit(1764716378.767:457): avc: denied { append } for pid=6416 comm="dhcpcd-run-hook" name="resolv.conf.dummy0.ipv4ll" dev="tmpfs" ino=2307 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 102.793972][ T30] audit: type=1400 audit(1764716378.977:458): avc: denied { write } for pid=6436 comm="syz.3.127" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 102.837431][ T30] audit: type=1400 audit(1764716379.037:459): avc: denied { read } for pid=6436 comm="syz.3.127" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 103.042798][ T30] audit: type=1400 audit(1764716379.037:460): avc: denied { open } for pid=6436 comm="syz.3.127" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 103.106746][ T30] audit: type=1400 audit(1764716379.097:461): avc: denied { getopt } for pid=6436 comm="syz.3.127" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 103.128939][ T30] audit: type=1400 audit(1764716379.207:462): avc: denied { create } for pid=6446 comm="syz.4.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 103.206213][ T30] audit: type=1400 audit(1764716379.207:463): avc: denied { getopt } for pid=6446 comm="syz.4.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 103.414244][ T6460] netlink: 16 bytes leftover after parsing attributes in process `syz.4.132'. [ 103.579183][ T6469] ADFS-fs (nbd0): error: unable to read block 3, try 0 [ 103.640825][ T5827] Bluetooth: hci1: hcon ffff88807936c000 sent 1 < count 8 [ 103.650694][ T5827] Bluetooth: hci1: hcon ffff88807936c000 sent 0 < count 2 [ 103.657817][ T5827] Bluetooth: hci1: hcon ffff888079368000 sent 1 < count 23380 [ 103.677967][ T5827] Bluetooth: hci1: hcon ffff888079368000 sent 0 < count 4 [ 103.685136][ T5827] Bluetooth: hci1: hcon ffff888079368000 sent 0 < count 1387 [ 103.693329][ T5827] Bluetooth: hci1: hcon ffff88807936c000 sent 0 < count 3603 [ 103.741994][ T6476] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 103.946365][ T6482] netlink: 'syz.4.138': attribute type 4 has an invalid length. [ 103.957463][ T6482] netlink: 17 bytes leftover after parsing attributes in process `syz.4.138'. [ 104.307657][ T6485] IPv6: syztnl2: Disabled Multicast RS [ 104.614750][ T6492] Cannot find add_set index 4 as target [ 105.244353][ T6501] netlink: 'syz.0.142': attribute type 11 has an invalid length. [ 105.354515][ T6506] smc: net device bond0 applied user defined pnetid SYZ2 [ 105.469799][ T6508] netlink: 16 bytes leftover after parsing attributes in process `syz.4.146'. [ 105.870285][ T6041] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 106.240344][ T6041] usb 1-1: Using ep0 maxpacket: 32 [ 106.354215][ T6041] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 106.924168][ T6041] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.959932][ T6041] usb 1-1: Product: syz [ 106.983487][ T6041] usb 1-1: Manufacturer: syz [ 107.072271][ T6041] usb 1-1: SerialNumber: syz [ 107.111649][ T6041] usb 1-1: config 0 descriptor?? [ 107.178357][ T6523] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 107.233208][ T6525] ADFS-fs (nbd2): error: unable to read block 3, try 0 [ 107.268323][ T6523] i2c i2c-0: Invalid block write size 58 [ 107.281683][ T5827] Bluetooth: hci4: hcon ffff888078d20000 sent 1 < count 8 [ 107.288941][ T5827] Bluetooth: hci4: hcon ffff888078d20000 sent 0 < count 2 [ 107.296631][ T5827] Bluetooth: hci4: hcon ffff888022f50000 sent 1 < count 23380 [ 107.325514][ T5827] Bluetooth: hci4: hcon ffff888022f50000 sent 0 < count 4 [ 107.327107][ T6527] netlink: 32 bytes leftover after parsing attributes in process `syz.1.153'. [ 107.333965][ T6041] snd-usb-6fire 1-1:0.0: unable to receive device firmware state. [ 107.351477][ T5827] Bluetooth: hci4: hcon ffff888022f50000 sent 0 < count 1387 [ 107.359204][ T5827] Bluetooth: hci4: hcon ffff888078d20000 sent 0 < count 3603 [ 107.370214][ T6041] snd-usb-6fire 1-1:0.0: probe with driver snd-usb-6fire failed with error -121 [ 108.449475][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 108.449512][ T30] audit: type=1400 audit(1764716384.747:470): avc: denied { kexec_image_load } for pid=6531 comm="syz.4.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 108.451001][ T57] usb 1-1: USB disconnect, device number 9 [ 108.789926][ T30] audit: type=1400 audit(1764716385.087:471): avc: denied { read } for pid=6547 comm="syz.1.157" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 108.838309][ T30] audit: type=1400 audit(1764716385.117:472): avc: denied { ioctl } for pid=6547 comm="syz.1.157" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 108.949042][ T30] audit: type=1400 audit(1764716385.237:473): avc: denied { setopt } for pid=6547 comm="syz.1.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 110.036219][ T30] audit: type=1400 audit(1764716385.807:474): avc: denied { setopt } for pid=6559 comm="syz.4.160" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 110.240244][ T30] audit: type=1800 audit(1764716386.537:475): pid=6561 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.161" name="bus" dev="overlay" ino=207 res=0 errno=0 [ 110.369152][ T6561] netlink: 16 bytes leftover after parsing attributes in process `syz.0.161'. [ 110.383255][ T6569] loop2: detected capacity change from 0 to 7 [ 110.446031][ T6569] Dev loop2: unable to read RDB block 7 [ 110.659307][ T6575] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 110.765648][ T6569] loop2: unable to read partition table [ 110.771663][ T6569] loop2: partition table beyond EOD, truncated [ 110.800650][ T6569] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 110.842038][ T5191] Dev loop2: unable to read RDB block 7 [ 110.849925][ T5191] loop2: unable to read partition table [ 110.873141][ T5191] loop2: partition table beyond EOD, truncated [ 110.995109][ T6579] openvswitch: netlink: Message has 592 unknown bytes. [ 111.024137][ T6579] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 111.132346][ T6580] openvswitch: netlink: Message has 592 unknown bytes. [ 111.140675][ T6580] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 111.603923][ T30] audit: type=1400 audit(1764716387.907:476): avc: denied { create } for pid=6581 comm="syz.4.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 111.631898][ T30] audit: type=1400 audit(1764716387.937:477): avc: denied { write } for pid=6581 comm="syz.4.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 111.831216][ T30] audit: type=1326 audit(1764716388.137:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6581 comm="syz.4.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdba818f749 code=0x7ffc0000 [ 112.390586][ T30] audit: type=1326 audit(1764716388.137:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6581 comm="syz.4.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdba818f749 code=0x7ffc0000 [ 114.195475][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 114.195490][ T30] audit: type=1400 audit(1764716390.497:515): avc: denied { ioctl } for pid=6609 comm="syz.2.175" path="socket:[11024]" dev="sockfs" ino=11024 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 114.226059][ C1] vkms_vblank_simulate: vblank timer overrun [ 114.305778][ T30] audit: type=1400 audit(1764716390.537:516): avc: denied { bind } for pid=6609 comm="syz.2.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 114.325054][ T6041] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 114.367508][ T6616] ADFS-fs (nbd3): error: unable to read block 3, try 0 [ 114.400319][ T5827] Bluetooth: hci0: hcon ffff888079338000 sent 1 < count 8 [ 114.410348][ T5827] Bluetooth: hci0: hcon ffff888079338000 sent 0 < count 2 [ 114.420221][ T5827] Bluetooth: hci0: hcon ffff888021f04000 sent 1 < count 23380 [ 114.433983][ T5827] Bluetooth: hci0: hcon ffff888021f04000 sent 0 < count 4 [ 114.497494][ T6617] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 114.534254][ T6041] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 114.543872][ T5827] Bluetooth: hci0: hcon ffff888021f04000 sent 0 < count 1387 [ 114.554532][ T5827] Bluetooth: hci0: hcon ffff888079338000 sent 0 < count 3603 [ 114.574715][ T6041] usb 1-1: config 0 has no interface number 0 [ 114.600726][ T6041] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 114.610690][ T6041] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.618825][ T6041] usb 1-1: Product: syz [ 114.625199][ T6041] usb 1-1: Manufacturer: syz [ 114.629855][ T6041] usb 1-1: SerialNumber: syz [ 114.672090][ T6041] usb 1-1: config 0 descriptor?? [ 115.362500][ T6041] usb 1-1: Firmware version (0.0) predates our first public release. [ 115.376568][ T6041] usb 1-1: Please update to version 0.2 or newer [ 115.433061][ T6627] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 115.448558][ T6041] usb 1-1: USB disconnect, device number 10 [ 115.560478][ T9] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 115.722215][ T9] usb 5-1: config 7 has an invalid interface number: 252 but max is 0 [ 115.731709][ T9] usb 5-1: config 7 has no interface number 0 [ 115.737842][ T9] usb 5-1: config 7 interface 252 altsetting 8 endpoint 0xF has invalid wMaxPacketSize 0 [ 115.748123][ T9] usb 5-1: config 7 interface 252 has no altsetting 0 [ 115.759729][ T9] usb 5-1: string descriptor 0 read error: -22 [ 115.767938][ T9] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice=56.c0 [ 115.777410][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.778336][ T30] audit: type=1400 audit(1764716392.077:517): avc: denied { relabelfrom } for pid=6632 comm="syz.3.179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 115.806316][ T30] audit: type=1400 audit(1764716392.117:518): avc: denied { relabelto } for pid=6632 comm="syz.3.179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 115.832356][ T9] idmouse 5-1:7.252: Unable to find bulk-in endpoint. [ 116.084633][ T30] audit: type=1400 audit(1764716392.387:519): avc: denied { getopt } for pid=6624 comm="syz.4.178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 116.104857][ T6625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.114780][ T6625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.130399][ T5888] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 116.138176][ T57] usb 5-1: USB disconnect, device number 4 [ 116.145769][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 116.300228][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 116.309706][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 116.318803][ T5888] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 116.327217][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 116.335214][ T5888] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 116.353486][ T24] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 116.361933][ T24] usb 3-1: config 0 has no interface number 0 [ 116.368127][ T5888] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 116.377610][ T24] usb 3-1: config 0 interface 41 has no altsetting 0 [ 116.384867][ T5888] usb 4-1: config 128 has no interface number 0 [ 116.392166][ T5888] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 116.405584][ T5888] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 116.424036][ T5888] usb 4-1: config 128 interface 127 has no altsetting 0 [ 116.433169][ T24] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 116.440309][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 116.452668][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.460949][ T24] usb 3-1: Product: syz [ 116.461115][ T5888] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 116.474426][ T24] usb 3-1: Manufacturer: syz [ 116.479049][ T24] usb 3-1: SerialNumber: syz [ 116.483706][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.501133][ T5888] usb 4-1: Product: syz [ 116.505927][ T24] usb 3-1: config 0 descriptor?? [ 116.514271][ T5888] usb 4-1: Manufacturer: syz [ 116.522698][ T5888] usb 4-1: SerialNumber: syz [ 116.531455][ T24] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22 [ 116.634319][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 116.643581][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.652605][ T9] usb 2-1: Product: syz [ 116.656869][ T9] usb 2-1: Manufacturer: syz [ 116.661646][ T9] usb 2-1: SerialNumber: syz [ 116.720870][ T24] usb 3-1: USB disconnect, device number 5 [ 116.876446][ T6644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.885639][ T6644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.005933][ T6648] loop2: detected capacity change from 0 to 7 [ 117.022149][ T6648] Dev loop2: unable to read RDB block 7 [ 117.027754][ T6648] loop2: unable to read partition table [ 117.050410][ T6648] loop2: partition table beyond EOD, truncated [ 117.070281][ T6648] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 117.296951][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 117.341965][ T5191] Dev loop2: unable to read RDB block 7 [ 117.347766][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 117.358260][ T5191] loop2: unable to read partition table [ 117.371104][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 117.381980][ T5191] loop2: partition table beyond EOD, truncated [ 117.402938][ T9] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 117.420766][ T9] usb 2-1: USB disconnect, device number 7 [ 117.960292][ T5827] Bluetooth: hci4: command tx timeout [ 119.372345][ T30] audit: type=1400 audit(1764716395.177:520): avc: denied { write } for pid=6656 comm="syz.4.186" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 119.441235][ T30] audit: type=1400 audit(1764716395.177:521): avc: denied { open } for pid=6656 comm="syz.4.186" path="/37/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 120.058647][ T5827] Bluetooth: hci4: command tx timeout [ 120.069893][ T57] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 120.090227][ T30] audit: type=1400 audit(1764716396.147:522): avc: denied { setopt } for pid=6667 comm="syz.4.188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 120.257166][ T5888] usb 4-1: USB disconnect, device number 4 [ 120.299825][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.337149][ T57] usb 1-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 120.385155][ T57] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 120.466202][ T57] usb 1-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 120.500752][ T57] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.528514][ T57] usb 1-1: config 0 descriptor?? [ 120.560244][ T5929] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 120.668174][ T30] audit: type=1400 audit(1764716396.967:523): avc: denied { connect } for pid=6683 comm="syz.4.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 120.730293][ T5929] usb 2-1: Using ep0 maxpacket: 16 [ 120.750682][ T5929] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.771025][ T30] audit: type=1400 audit(1764716397.077:524): avc: denied { write } for pid=6668 comm="syz.0.189" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 120.780372][ T5929] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.798958][ T30] audit: type=1400 audit(1764716397.107:525): avc: denied { open } for pid=6668 comm="syz.0.189" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 120.834727][ T5929] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice=e5.00 [ 120.855497][ T5929] usb 2-1: New USB device strings: Mfr=255, Product=0, SerialNumber=0 [ 120.884942][ T5929] usb 2-1: Manufacturer: syz [ 120.974760][ T5929] usb 2-1: config 0 descriptor?? [ 121.191132][ T24] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 121.324440][ T6695] loop2: detected capacity change from 0 to 7 [ 121.334008][ T6695] Dev loop2: unable to read RDB block 7 [ 121.340199][ T6695] loop2: unable to read partition table [ 121.347283][ T6695] loop2: partition table beyond EOD, truncated [ 121.358470][ T24] usb 5-1: config 0 has an invalid interface number: 17 but max is 0 [ 121.368388][ T6695] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 121.391826][ T24] usb 5-1: config 0 has no interface number 0 [ 121.404713][ T24] usb 5-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 121.448853][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.463988][ T24] usb 5-1: Product: syz [ 121.468622][ T24] usb 5-1: Manufacturer: syz [ 121.473301][ T24] usb 5-1: SerialNumber: syz [ 121.521556][ T24] usb 5-1: config 0 descriptor?? [ 121.557940][ T5929] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 121.567848][ T5929] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 121.575411][ T5929] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 121.584576][ T5929] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 121.593086][ T5929] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 121.694496][ T5929] mcp2221 0003:04D8:00DD.0002: USB HID v0.05 Device [syz] on usb-dummy_hcd.1-1/input0 [ 121.760338][ T6687] netlink: 12 bytes leftover after parsing attributes in process `syz.4.195'. [ 122.123955][ T5827] Bluetooth: hci4: command tx timeout [ 122.396416][ T5929] usb 2-1: USB disconnect, device number 8 [ 122.487125][ T5191] Dev loop2: unable to read RDB block 7 [ 122.508058][ T5191] loop2: unable to read partition table [ 122.525437][ T5191] loop2: partition table beyond EOD, truncated [ 122.720362][ T5930] usb 1-1: USB disconnect, device number 11 [ 122.967254][ T6708] netlink: 8 bytes leftover after parsing attributes in process `syz.0.200'. [ 123.526128][ T30] audit: type=1400 audit(1764716399.827:526): avc: denied { create } for pid=6714 comm="syz.3.201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 123.605788][ T6717] netlink: 64 bytes leftover after parsing attributes in process `syz.3.201'. [ 123.616061][ T30] audit: type=1400 audit(1764716399.847:527): avc: denied { connect } for pid=6714 comm="syz.3.201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 123.698939][ T6717] tmpfs: Unknown parameter 'usrquota.*Ô¸èÄïbVxÆþžîç×Eé ƒÞNXìæ6—$î„5n' [ 123.869035][ T6725] erspan0: entered promiscuous mode [ 123.887560][ T6725] erspan0: entered allmulticast mode [ 123.918601][ T30] audit: type=1400 audit(1764716400.217:528): avc: denied { read } for pid=6728 comm="syz.2.205" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 124.141439][ T30] audit: type=1400 audit(1764716400.247:529): avc: denied { open } for pid=6728 comm="syz.2.205" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 124.210187][ T5827] Bluetooth: hci4: command tx timeout [ 124.292683][ T6734] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2305 sclass=netlink_route_socket pid=6734 comm=syz.2.205 [ 124.430182][ T6735] netlink: 4 bytes leftover after parsing attributes in process `syz.1.204'. [ 124.726920][ T6731] bond1: Removing last arp target with arp_interval on [ 124.734720][ T6731] bond1: entered allmulticast mode [ 124.741631][ T6731] 8021q: adding VLAN 0 to HW filter on device bond1 [ 125.077918][ T6740] erspan0: entered promiscuous mode [ 125.111867][ T6740] erspan0: entered allmulticast mode [ 125.258439][ T6749] openvswitch: netlink: Message has 592 unknown bytes. [ 125.266870][ T6749] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 125.375753][ T24] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 found [ 125.382200][ T24] usb 5-1: selecting invalid altsetting 5 [ 125.387975][ T24] snd_usb_podhd 5-1:0.17: set_interface failed [ 125.400488][ T24] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 now disconnected [ 125.525465][ T24] snd_usb_podhd 5-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 125.622737][ T24] usb 5-1: USB disconnect, device number 5 [ 125.681592][ T6752] ======================================================= [ 125.681592][ T6752] WARNING: The mand mount option has been deprecated and [ 125.681592][ T6752] and is ignored by this kernel. Remove the mand [ 125.681592][ T6752] option from the mount to silence this warning. [ 125.681592][ T6752] ======================================================= [ 125.735143][ T6753] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 125.813032][ T6753] overlayfs: overlapping lowerdir path [ 125.860406][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 125.860420][ T30] audit: type=1400 audit(1764716402.157:532): avc: denied { mount } for pid=6751 comm="syz.4.210" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 125.920794][ T6748] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 125.927415][ T6748] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 125.942033][ T6748] vhci_hcd vhci_hcd.0: Device attached [ 126.220727][ T24] usb 40-1: SetAddress Request (2) to port 0 [ 126.263139][ T24] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 126.280230][ T5827] Bluetooth: hci4: command tx timeout [ 126.343998][ T30] audit: type=1400 audit(1764716402.647:533): avc: denied { unmount } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 126.967656][ T6754] vhci_hcd: connection reset by peer [ 126.985877][ T3915] vhci_hcd: stop threads [ 126.992767][ T6773] netlink: 168 bytes leftover after parsing attributes in process `syz.2.214'. [ 127.008414][ T3915] vhci_hcd: release socket [ 127.021552][ T3915] vhci_hcd: disconnect device [ 127.322064][ T6782] input: syz1 as /devices/virtual/input/input6 [ 127.335999][ T30] audit: type=1400 audit(1764716403.617:534): avc: denied { ioctl } for pid=6781 comm="syz.0.215" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 127.411457][ T6782] 9pnet_fd: Insufficient options for proto=fd [ 127.618332][ T6787] fuse: Unknown parameter 'Group_id' [ 127.630556][ T30] audit: type=1400 audit(1764716403.937:535): avc: denied { remount } for pid=6786 comm="syz.4.218" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 128.127032][ T30] audit: type=1400 audit(1764716404.427:536): avc: denied { ioctl } for pid=6793 comm="syz.0.220" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=11693 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 128.411944][ T5827] Bluetooth: hci4: command tx timeout [ 128.752293][ T30] audit: type=1800 audit(1764716405.057:537): pid=6799 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.221" name="bus" dev="overlay" ino=268 res=0 errno=0 [ 128.792688][ T6794] netlink: 28 bytes leftover after parsing attributes in process `syz.0.220'. [ 128.822503][ T6799] netlink: 16 bytes leftover after parsing attributes in process `syz.3.221'. [ 129.418796][ T6802] openvswitch: netlink: Message has 592 unknown bytes. [ 129.425691][ T6802] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 130.217707][ T6813] netlink: 4 bytes leftover after parsing attributes in process `syz.2.225'. [ 130.449766][ T5827] Bluetooth: hci4: command tx timeout [ 130.709093][ T6813] bridge_slave_1: left allmulticast mode [ 130.716027][ T6813] bridge_slave_1: left promiscuous mode [ 130.725673][ T6813] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.800473][ T6813] bridge_slave_0: left allmulticast mode [ 130.807290][ T6813] bridge_slave_0: left promiscuous mode [ 130.819915][ T6813] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.133281][ T6819] netlink: 'syz.1.226': attribute type 10 has an invalid length. [ 131.155959][ T6819] netlink: 55 bytes leftover after parsing attributes in process `syz.1.226'. [ 131.288962][ T6823] netlink: 12 bytes leftover after parsing attributes in process `syz.3.227'. [ 131.321831][ T24] usb 40-1: device descriptor read/8, error -110 [ 131.388421][ T6829] ADFS-fs (nbd3): error: unable to read block 3, try 0 [ 131.725379][ T24] usb usb40-port1: attempt power cycle [ 132.233409][ T30] audit: type=1400 audit(1764716408.397:538): avc: denied { validate_trans } for pid=6834 comm="syz.1.232" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 132.283648][ T30] audit: type=1400 audit(1764716408.497:539): avc: denied { write } for pid=6834 comm="syz.1.232" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 132.377172][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.387836][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.520248][ T5827] Bluetooth: hci4: command tx timeout [ 132.603185][ T6841] netlink: 16 bytes leftover after parsing attributes in process `syz.1.234'. [ 132.612612][ T30] audit: type=1800 audit(1764716408.907:540): pid=6841 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.234" name="bus" dev="overlay" ino=289 res=0 errno=0 [ 132.688642][ T6845] process 'syz.3.233' launched '/dev/fd/10' with NULL argv: empty string added [ 132.728298][ T30] audit: type=1400 audit(1764716408.987:541): avc: denied { execute } for pid=6839 comm="syz.3.233" dev="tmpfs" ino=35 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 132.761585][ T24] usb usb40-port1: unable to enumerate USB device [ 132.853193][ T30] audit: type=1400 audit(1764716409.017:542): avc: denied { execute_no_trans } for pid=6839 comm="syz.3.233" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=35 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 132.936603][ T6852] loop2: detected capacity change from 0 to 7 [ 133.013937][ T6852] Dev loop2: unable to read RDB block 7 [ 133.019546][ T6852] loop2: unable to read partition table [ 133.025366][ T6852] loop2: partition table beyond EOD, truncated [ 133.032605][ T6852] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 133.417920][ T6858] netlink: 'syz.1.237': attribute type 4 has an invalid length. [ 133.729795][ T6858] netlink: 17 bytes leftover after parsing attributes in process `syz.1.237'. [ 134.371976][ T30] audit: type=1400 audit(1764716410.677:543): avc: denied { mounton } for pid=6868 comm="syz.4.241" path="/49/file0" dev="tmpfs" ino=308 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 134.520970][ T30] audit: type=1400 audit(1764716410.827:544): avc: denied { open } for pid=6872 comm="syz.2.243" path="/dev/ptyq8" dev="devtmpfs" ino=127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 134.680428][ T5827] Bluetooth: hci4: command tx timeout [ 135.050231][ T10] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 135.317894][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.336722][ T6881] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 135.485302][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.603243][ T10] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 135.698581][ T10] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 135.724524][ T10] usb 1-1: Manufacturer: syz [ 135.758987][ T10] usb 1-1: config 0 descriptor?? [ 135.905957][ T30] audit: type=1800 audit(1764716412.207:545): pid=6894 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.247" name="bus" dev="overlay" ino=327 res=0 errno=0 [ 135.948243][ T6894] netlink: 16 bytes leftover after parsing attributes in process `syz.4.247'. [ 136.020384][ T5931] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 136.202510][ T5931] usb 2-1: config 0 has an invalid interface number: 17 but max is 0 [ 136.212627][ T5931] usb 2-1: config 0 has no interface number 0 [ 136.222769][ T5931] usb 2-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 136.231869][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.239856][ T5931] usb 2-1: Product: syz [ 136.244433][ T5931] usb 2-1: Manufacturer: syz [ 136.249646][ T5931] usb 2-1: SerialNumber: syz [ 136.256998][ T5931] usb 2-1: config 0 descriptor?? [ 136.394323][ T6903] loop2: detected capacity change from 0 to 7 [ 136.403069][ T6903] Dev loop2: unable to read RDB block 7 [ 136.408637][ T6903] loop2: unable to read partition table [ 136.415726][ T6903] loop2: partition table beyond EOD, truncated [ 136.421981][ T6903] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 136.432525][ T6889] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 136.479192][ T6887] netlink: 12 bytes leftover after parsing attributes in process `syz.1.246'. [ 136.590222][ T6889] usb 5-1: Using ep0 maxpacket: 8 [ 136.612044][ T6889] usb 5-1: config 0 has an invalid interface number: 52 but max is 0 [ 136.675767][ T6889] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.685968][ T6889] usb 5-1: config 0 has no interface number 0 [ 136.692104][ T5902] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 136.693190][ T6889] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 136.711354][ T6889] usb 5-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 136.725513][ T6889] usb 5-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 136.749178][ T6889] usb 5-1: config 0 interface 52 has no altsetting 0 [ 136.757612][ T6889] usb 5-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice= 0.00 [ 136.772754][ T5827] Bluetooth: hci4: command tx timeout [ 136.790283][ T6889] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=35 [ 136.798468][ T6889] usb 5-1: SerialNumber: syz [ 136.812412][ T6889] usb 5-1: config 0 descriptor?? [ 136.860203][ T5902] usb 4-1: Using ep0 maxpacket: 32 [ 136.868383][ T5902] usb 4-1: New USB device found, idVendor=1b3d, idProduct=01cb, bcdDevice= 8.00 [ 136.887769][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.928748][ T5902] usb 4-1: config 0 descriptor?? [ 136.956239][ T5902] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 136.981359][ T5902] usb 4-1: Detected FT4232H [ 137.022355][ T6889] synaptics_usb 5-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 137.041625][ T6889] synaptics_usb 5-1:0.52: probe with driver synaptics_usb failed with error -5 [ 137.165376][ T6899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.194732][ T6899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.208838][ T6909] netlink: 'syz.2.252': attribute type 4 has an invalid length. [ 137.213036][ T6899] bridge0: port 3(ip6gretap0) entered blocking state [ 137.246931][ T6909] netlink: 17 bytes leftover after parsing attributes in process `syz.2.252'. [ 137.260347][ T6899] bridge0: port 3(ip6gretap0) entered disabled state [ 137.267251][ T6899] ip6gretap0: entered allmulticast mode [ 137.276818][ T6899] ip6gretap0: entered promiscuous mode [ 137.283258][ T6899] bridge0: port 3(ip6gretap0) entered blocking state [ 137.290211][ T6899] bridge0: port 3(ip6gretap0) entered forwarding state [ 137.378690][ T5902] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 138.213110][ T5902] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 138.363284][ T5902] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 138.449778][ T5902] usb 4-1: USB disconnect, device number 5 [ 138.469504][ T10] uclogic 0003:256C:006D.0003: failed retrieving Huion firmware version: -71 [ 138.684621][ T10] uclogic 0003:256C:006D.0003: failed probing parameters: -71 [ 138.693954][ T5902] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 138.715814][ T10] uclogic 0003:256C:006D.0003: probe with driver uclogic failed with error -71 [ 138.732576][ T5902] ftdi_sio 4-1:0.0: device disconnected [ 138.805169][ T10] usb 1-1: USB disconnect, device number 12 [ 138.840213][ T5827] Bluetooth: hci4: command tx timeout [ 139.000424][ T6889] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 139.127605][ T6923] openvswitch: netlink: Message has 592 unknown bytes. [ 139.134704][ T6923] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 139.268300][ T57] usb 5-1: USB disconnect, device number 6 [ 139.291882][ T5931] snd_usb_podhd 2-1:0.17: Line 6 POD HD300 found [ 139.307956][ T6889] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 139.362608][ T5931] usb 2-1: selecting invalid altsetting 5 [ 139.368364][ T5931] snd_usb_podhd 2-1:0.17: set_interface failed [ 139.382294][ T6926] netlink: 'syz.3.256': attribute type 3 has an invalid length. [ 139.390033][ T6889] usb 3-1: config 0 has no interface number 0 [ 139.422169][ T6889] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 139.431634][ T5931] snd_usb_podhd 2-1:0.17: Line 6 POD HD300 now disconnected [ 139.438986][ T5931] snd_usb_podhd 2-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 139.458186][ T6889] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.461351][ T30] audit: type=1400 audit(1764716415.767:546): avc: denied { write } for pid=6928 comm="syz.1.257" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 139.470165][ T6889] usb 3-1: Product: syz [ 139.516902][ T5931] usb 2-1: USB disconnect, device number 9 [ 139.522258][ T6931] loop6: detected capacity change from 0 to 2640 [ 139.529534][ T6931] buffer_io_error: 40 callbacks suppressed [ 139.529547][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.546381][ T6889] usb 3-1: Manufacturer: syz [ 139.551189][ T6889] usb 3-1: SerialNumber: syz [ 139.576081][ T6889] usb 3-1: config 0 descriptor?? [ 139.602690][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.612654][ T30] audit: type=1400 audit(1764716415.857:547): avc: denied { ioctl } for pid=6928 comm="syz.1.257" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 139.653019][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.701239][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.737972][ T30] audit: type=1400 audit(1764716415.997:548): avc: denied { map } for pid=6930 comm="syz.4.258" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 139.763623][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.849169][ T6938] netlink: 80 bytes leftover after parsing attributes in process `syz.1.257'. [ 139.883544][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.924717][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.036014][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.137798][ T6931] ldm_validate_partition_table(): Disk read failed. [ 140.331752][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.416260][ T6889] usb 3-1: Firmware version (0.0) predates our first public release. [ 140.496953][ T6931] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.547962][ T6889] usb 3-1: Please update to version 0.2 or newer [ 140.659793][ T6931] Dev loop6: unable to read RDB block 0 [ 140.760263][ T30] audit: type=1400 audit(1764716416.037:549): avc: denied { name_connect } for pid=6934 comm="syz.3.259" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 140.849944][ T6889] usb 3-1: USB disconnect, device number 6 [ 140.920220][ T5827] Bluetooth: hci4: command tx timeout [ 140.985653][ T6931] loop6: unable to read partition table [ 141.099920][ T6931] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 141.554763][ T30] audit: type=1400 audit(1764716417.837:550): avc: denied { read } for pid=6942 comm="syz.3.261" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 141.726419][ T6952] netlink: 'syz.0.265': attribute type 21 has an invalid length. [ 141.737366][ T6952] IPv6: NLM_F_CREATE should be specified when creating new route [ 141.756661][ T6954] netlink: 'syz.1.263': attribute type 4 has an invalid length. [ 141.777534][ T6954] netlink: 17 bytes leftover after parsing attributes in process `syz.1.263'. [ 142.340221][ T5932] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 142.997668][ T5932] usb 2-1: config 0 has an invalid interface number: 17 but max is 0 [ 143.008021][ T5932] usb 2-1: config 0 has no interface number 0 [ 143.010583][ T5827] Bluetooth: hci4: command tx timeout [ 143.016420][ T5932] usb 2-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 143.028770][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.039535][ T5932] usb 2-1: Product: syz [ 143.068972][ T5932] usb 2-1: Manufacturer: syz [ 143.127352][ T5932] usb 2-1: SerialNumber: syz [ 143.374304][ T5932] usb 2-1: config 0 descriptor?? [ 145.080429][ T5827] Bluetooth: hci4: command tx timeout [ 147.580310][ T5827] Bluetooth: hci4: command tx timeout [ 147.628709][ T5932] snd_usb_podhd 2-1:0.17: Line 6 POD HD300 found [ 147.635164][ T5932] usb 2-1: selecting invalid altsetting 5 [ 147.641918][ T5932] snd_usb_podhd 2-1:0.17: set_interface failed [ 147.648995][ T5932] snd_usb_podhd 2-1:0.17: Line 6 POD HD300 now disconnected [ 147.660920][ T5932] snd_usb_podhd 2-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 147.685832][ T5932] usb 2-1: USB disconnect, device number 10 [ 148.687149][ T5932] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 149.093909][ T7004] netlink: 'syz.3.278': attribute type 4 has an invalid length. [ 149.101720][ T7004] netlink: 17 bytes leftover after parsing attributes in process `syz.3.278'. [ 149.121779][ T5932] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 149.140293][ T5932] usb 1-1: config 0 has no interface number 0 [ 149.188898][ T5960] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 149.493008][ T5932] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 149.506073][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.521169][ T5932] usb 1-1: Product: syz [ 149.525701][ T5932] usb 1-1: Manufacturer: syz [ 149.531502][ T5932] usb 1-1: SerialNumber: syz [ 149.539799][ T5932] usb 1-1: config 0 descriptor?? [ 149.548493][ T5960] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 149.566809][ T5960] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 149.593635][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 149.675492][ T5827] Bluetooth: hci4: command tx timeout [ 149.693625][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 149.720958][ T5960] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 149.803798][ T5960] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 149.813201][ T5960] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 149.821832][ T5960] usb 2-1: Product: syz [ 149.839568][ T5960] usb 2-1: Manufacturer: syz [ 149.845584][ T5960] usb 2-1: SerialNumber: syz [ 149.877560][ T5960] usb 2-1: config 0 descriptor?? [ 149.903089][ T6981] libceph: connect (1)[c::]:6789 error -101 [ 149.915012][ T6981] libceph: mon0 (1)[c::]:6789 connect error [ 149.945133][ T6981] libceph: connect (1)[c::]:6789 error -101 [ 149.963179][ T6981] libceph: mon0 (1)[c::]:6789 connect error [ 150.054053][ T7011] ceph: No mds server is up or the cluster is laggy [ 150.067584][ T30] audit: type=1400 audit(1764716426.367:551): avc: denied { name_bind } for pid=7010 comm="syz.4.281" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 150.110351][ T5960] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 150.122472][ T5960] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 150.150246][ T5819] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 150.191864][ T5932] usb 1-1: Firmware version (0.0) predates our first public release. [ 150.207017][ T5932] usb 1-1: Please update to version 0.2 or newer [ 150.571843][ T5819] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 150.626692][ T5819] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.645766][ T5819] usb 4-1: Product: syz [ 150.903621][ T5932] usb 1-1: USB disconnect, device number 13 [ 150.916168][ T5819] usb 4-1: Manufacturer: syz [ 150.930507][ T5960] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 150.942108][ T5819] usb 4-1: SerialNumber: syz [ 150.947794][ T5960] radio-si470x 2-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 150.980690][ T5819] usb 4-1: config 0 descriptor?? [ 150.999332][ T5960] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -5 [ 151.666333][ T5819] airspy 4-1:0.0: Board ID: 00 [ 151.680615][ T5819] airspy 4-1:0.0: Firmware version: [ 151.720254][ T5827] Bluetooth: hci4: command tx timeout [ 152.566698][ T30] audit: type=1326 audit(1764716428.507:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7047 comm="syz.0.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdec58f749 code=0x7ffc0000 [ 152.602953][ T30] audit: type=1326 audit(1764716428.507:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7047 comm="syz.0.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdec58f749 code=0x7ffc0000 [ 152.643502][ T5932] usb 2-1: USB disconnect, device number 11 [ 152.663079][ T30] audit: type=1326 audit(1764716428.507:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7047 comm="syz.0.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7efdec58f749 code=0x7ffc0000 [ 152.825897][ T7059] netlink: 'syz.4.290': attribute type 4 has an invalid length. [ 152.855432][ T30] audit: type=1326 audit(1764716428.997:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7047 comm="syz.0.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdec58f749 code=0x7ffc0000 [ 152.900226][ T5819] airspy 4-1:0.0: usb_control_msg() failed -71 request 12 [ 152.917690][ T7059] netlink: 17 bytes leftover after parsing attributes in process `syz.4.290'. [ 152.922794][ T30] audit: type=1326 audit(1764716428.997:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7047 comm="syz.0.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdec58f749 code=0x7ffc0000 [ 152.962470][ T7061] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 152.972315][ T5819] airspy 4-1:0.0: Registered as swradio24 [ 152.978332][ T5819] airspy 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 152.989058][ T7061] audit: out of memory in audit_log_start [ 153.009223][ T5819] usb 4-1: USB disconnect, device number 6 [ 154.070345][ T5827] Bluetooth: hci4: command tx timeout [ 154.190665][ T30] audit: type=1400 audit(1764716430.497:557): avc: denied { read } for pid=7077 comm="syz.0.295" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 154.368556][ T30] audit: type=1400 audit(1764716430.557:558): avc: denied { open } for pid=7077 comm="syz.0.295" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 155.709586][ T7078] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 155.768146][ T7091] openvswitch: netlink: Message has 592 unknown bytes. [ 155.777907][ T7091] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 156.007206][ T7078] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 156.121305][ T5827] Bluetooth: hci4: command tx timeout [ 156.125244][ T7078] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 156.153815][ T7078] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.159857][ T7078] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 156.179428][ T7078] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 156.194802][ T7078] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.203324][ T7078] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 156.228783][ T7078] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 156.327278][ T7078] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.344661][ T7078] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 156.366921][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 156.366932][ T30] audit: type=1400 audit(1764716432.667:560): avc: denied { bind } for pid=7092 comm="syz.1.298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 156.398240][ T7078] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 156.444315][ T7078] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.472081][ T7078] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 156.499105][ T7078] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 156.520610][ T5827] Bluetooth: hci1: command 0x0c1a tx timeout [ 156.531751][ T7100] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 156.538252][ T7100] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 156.546783][ T7078] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 156.673793][ T7100] vhci_hcd vhci_hcd.0: Device attached [ 156.704762][ T7095] team0 (unregistering): Port device team_slave_0 removed [ 156.795878][ T30] audit: type=1400 audit(1764716433.087:561): avc: denied { bind } for pid=7104 comm="syz.4.300" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 156.881104][ T5932] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 157.067755][ T7095] team0 (unregistering): Port device team_slave_1 removed [ 157.083505][ T5931] usb 40-1: SetAddress Request (6) to port 0 [ 157.089637][ T5931] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 157.180200][ T5932] usb 2-1: Using ep0 maxpacket: 16 [ 157.229757][ T5932] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 157.248201][ T5932] usb 2-1: config 0 has no interface number 0 [ 157.254582][ T7101] vhci_hcd: connection reset by peer [ 157.730477][ T3568] vhci_hcd: stop threads [ 157.751045][ T3568] vhci_hcd: release socket [ 157.805929][ T3568] vhci_hcd: disconnect device [ 157.832998][ T5932] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 157.842869][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.852545][ T5932] usb 2-1: Product: syz [ 157.857470][ T5932] usb 2-1: Manufacturer: syz [ 157.862805][ T5932] usb 2-1: SerialNumber: syz [ 157.880736][ T5932] usb 2-1: config 0 descriptor?? [ 157.895783][ T30] audit: type=1400 audit(1764716434.197:562): avc: denied { ioctl } for pid=7115 comm="syz.0.303" path="socket:[12937]" dev="sockfs" ino=12937 ioctlcmd=0x943a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 157.930744][ T5932] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 157.956175][ T7119] netlink: 'syz.4.304': attribute type 4 has an invalid length. [ 157.980265][ T7119] netlink: 17 bytes leftover after parsing attributes in process `syz.4.304'. [ 158.201031][ T5823] Bluetooth: hci3: command 0x0c1a tx timeout [ 158.216976][ T5827] Bluetooth: hci0: command 0x0c1a tx timeout [ 158.360316][ T5827] Bluetooth: hci2: command 0x0c1a tx timeout [ 158.455265][ T5932] gspca_spca1528: reg_w err -110 [ 158.520239][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 158.534404][ T5932] spca1528 2-1:0.1: probe with driver spca1528 failed with error -110 [ 158.610326][ T5827] Bluetooth: hci1: command 0x0c1a tx timeout [ 158.930409][ T5819] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 159.118244][ T7139] openvswitch: netlink: Message has 592 unknown bytes. [ 159.125253][ T7139] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 159.362805][ T5819] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 159.427647][ T5819] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 159.454504][ T5819] usb 1-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 159.475926][ T5819] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.502440][ T5819] usb 1-1: config 0 descriptor?? [ 159.621354][ T30] audit: type=1400 audit(1764716435.917:563): avc: denied { read } for pid=7141 comm="syz.2.311" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 160.281283][ T5823] Bluetooth: hci3: command 0x0c1a tx timeout [ 160.287512][ T5827] Bluetooth: hci0: command 0x0c1a tx timeout [ 160.347528][ T7152] netlink: 'syz.2.312': attribute type 13 has an invalid length. [ 160.393682][ T7152] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 160.416280][ T7152] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 160.425040][ T7152] gretap1: entered promiscuous mode [ 160.430709][ T7152] gretap1: entered allmulticast mode [ 160.459083][ T5827] Bluetooth: hci2: command 0x0c1a tx timeout [ 160.504079][ T6889] usb 2-1: USB disconnect, device number 12 [ 160.545057][ T6981] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 160.655366][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 160.668354][ T7155] fuse: Bad value for 'group_id' [ 160.680762][ T5827] Bluetooth: hci1: command 0x0c1a tx timeout [ 160.697295][ T7155] fuse: Bad value for 'group_id' [ 160.704444][ T5819] dragonrise 0003:0079:0006.0004: global environment stack underflow [ 160.715543][ T5819] dragonrise 0003:0079:0006.0004: item 0 4 1 11 parsing failed [ 160.724225][ T30] audit: type=1400 audit(1764716437.017:564): avc: denied { ioctl } for pid=7154 comm="syz.1.313" path="socket:[13009]" dev="sockfs" ino=13009 ioctlcmd=0x89e5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 160.749818][ T5819] dragonrise 0003:0079:0006.0004: parse failed [ 160.760456][ T5819] dragonrise 0003:0079:0006.0004: probe with driver dragonrise failed with error -22 [ 160.806019][ T6981] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 160.820319][ T6981] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 160.834160][ T6981] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 160.852691][ T6981] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 160.868981][ T6981] usb 4-1: Manufacturer: syz [ 160.895766][ T6981] usb 4-1: config 0 descriptor?? [ 160.978945][ T5819] usb 1-1: USB disconnect, device number 14 [ 161.061838][ T6981] rc_core: IR keymap rc-hauppauge not found [ 161.070107][ T6981] Registered IR keymap rc-empty [ 161.088837][ T6981] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 161.128574][ T6981] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input8 [ 161.330249][ T5930] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 161.460318][ T5930] usb 3-1: device descriptor read/64, error -71 [ 161.685074][ T30] audit: type=1400 audit(1764716437.987:565): avc: denied { create } for pid=7195 comm="syz.0.318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 161.709392][ T5930] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 161.741045][ T30] audit: type=1400 audit(1764716438.047:566): avc: denied { write } for pid=7195 comm="syz.0.318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 161.762504][ T7200] netlink: 36 bytes leftover after parsing attributes in process `syz.0.318'. [ 161.854734][ T5930] usb 3-1: device descriptor read/64, error -71 [ 161.910409][ T5819] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 161.972173][ T5930] usb usb3-port1: attempt power cycle [ 162.071942][ T5819] usb 2-1: Using ep0 maxpacket: 32 [ 162.106221][ T5819] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 162.116452][ T5819] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 162.126870][ T5819] usb 2-1: config 0 has no interface number 0 [ 162.135892][ T5819] usb 2-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 162.149338][ T5819] usb 2-1: config 0 interface 89 has no altsetting 0 [ 162.171354][ T5819] usb 2-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 162.183036][ T5819] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.191836][ T5819] usb 2-1: Product: syz [ 162.201069][ T5819] usb 2-1: Manufacturer: syz [ 162.206739][ T5819] usb 2-1: SerialNumber: syz [ 162.258608][ T5819] usb 2-1: config 0 descriptor?? [ 162.281619][ T5931] usb 40-1: device descriptor read/8, error -110 [ 162.295509][ T5819] hub 2-1:0.89: bad descriptor, ignoring hub [ 162.323487][ T5930] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 162.345412][ T5819] hub 2-1:0.89: probe with driver hub failed with error -5 [ 162.350647][ T5930] usb 3-1: device descriptor read/8, error -71 [ 162.360506][ T5823] Bluetooth: hci3: command 0x0c1a tx timeout [ 162.366548][ T5827] Bluetooth: hci0: command 0x0c1a tx timeout [ 162.380675][ T5819] option 2-1:0.89: GSM modem (1-port) converter detected [ 162.520348][ T5827] Bluetooth: hci2: command 0x0c1a tx timeout [ 162.534883][ T5819] usb 4-1: USB disconnect, device number 7 [ 162.610249][ T5930] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 162.672886][ T5931] usb usb40-port1: attempt power cycle [ 162.680279][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 162.686553][ T5930] usb 3-1: device descriptor read/8, error -71 [ 162.713084][ T7215] netlink: 'syz.1.317': attribute type 1 has an invalid length. [ 162.732092][ T30] audit: type=1400 audit(1764716439.027:567): avc: denied { bind } for pid=7210 comm="syz.0.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 162.766184][ T7216] netlink: 8 bytes leftover after parsing attributes in process `syz.1.317'. [ 162.775118][ T7216] netlink: 16 bytes leftover after parsing attributes in process `syz.1.317'. [ 162.893570][ T5930] usb usb3-port1: unable to enumerate USB device [ 163.137398][ T7223] openvswitch: netlink: Message has 592 unknown bytes. [ 163.145590][ T7223] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 163.430974][ T5931] usb usb40-port1: unable to enumerate USB device [ 163.631544][ T7225] fuse: Bad value for 'fd' [ 164.760205][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 164.830466][ T5931] usb 2-1: USB disconnect, device number 13 [ 164.837042][ T5931] option 2-1:0.89: device disconnected [ 165.267532][ T30] audit: type=1400 audit(1764716441.537:568): avc: denied { associate } for pid=7236 comm="syz.4.326" name="file1" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 165.600389][ T5930] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 165.657739][ T7257] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 165.664281][ T7257] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 165.758916][ T7257] vhci_hcd vhci_hcd.0: Device attached [ 166.020259][ T6889] usb 36-1: SetAddress Request (2) to port 0 [ 166.033931][ T6889] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 166.276635][ T7258] vhci_hcd: connection reset by peer [ 166.282470][ T3915] vhci_hcd: stop threads [ 166.297593][ T3915] vhci_hcd: release socket [ 166.305845][ T3915] vhci_hcd: disconnect device [ 166.425030][ T7278] comedi comedi3: board detection failed [ 166.750411][ T5930] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 166.840274][ T5823] Bluetooth: hci4: command 0x0409 tx timeout [ 166.950282][ T5931] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 166.998730][ T5930] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 167.019579][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.029135][ T5930] usb 5-1: Product: syz [ 167.040042][ T5930] usb 5-1: Manufacturer: syz [ 167.055707][ T5930] usb 5-1: SerialNumber: syz [ 167.071957][ T5930] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 167.109570][ T7291] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7291 comm=syz.0.338 [ 167.135373][ T5861] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 167.160522][ T5931] usb 3-1: Using ep0 maxpacket: 8 [ 167.182072][ T5931] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.209714][ T7295] openvswitch: netlink: Message has 592 unknown bytes. [ 167.216780][ T7295] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 167.240889][ T5931] usb 3-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 167.284501][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.585823][ T5931] usb 3-1: config 0 descriptor?? [ 168.246372][ T5861] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 168.269888][ T5861] ath9k_htc: Failed to initialize the device [ 168.273207][ T5960] usb 3-1: USB disconnect, device number 11 [ 168.398842][ T5827] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 168.407774][ T5823] Bluetooth: hci5: command 0x1003 tx timeout [ 168.655614][ T5960] usb 5-1: USB disconnect, device number 8 [ 168.671703][ T30] audit: type=1400 audit(1764716444.977:569): avc: denied { read write } for pid=7303 comm="syz.1.340" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 168.708800][ T5960] usb 5-1: ath9k_htc: USB layer deinitialized [ 168.753005][ T30] audit: type=1400 audit(1764716445.007:570): avc: denied { open } for pid=7303 comm="syz.1.340" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 168.858719][ T30] audit: type=1400 audit(1764716445.157:571): avc: denied { mount } for pid=7311 comm="syz.1.342" name="/" dev="ramfs" ino=13910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 168.921484][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 169.615499][ T30] audit: type=1800 audit(1764716445.917:572): pid=7318 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.344" name="bus" dev="overlay" ino=398 res=0 errno=0 [ 169.656710][ T7318] netlink: 16 bytes leftover after parsing attributes in process `syz.1.344'. [ 169.777244][ T7323] Driver unsupported XDP return value 0 on prog (id 99) dev N/A, expect packet loss! [ 169.880342][ T5931] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 170.204183][ T30] audit: type=1400 audit(1764716446.487:573): avc: denied { mount } for pid=7333 comm="syz.0.351" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 170.285494][ T5931] usb 3-1: config 0 has an invalid interface number: 17 but max is 0 [ 170.729653][ T5931] usb 3-1: config 0 has no interface number 0 [ 170.737745][ T30] audit: type=1400 audit(1764716446.487:574): avc: denied { mounton } for pid=7333 comm="syz.0.351" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 170.854202][ T5931] usb 3-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 171.008763][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.020065][ T5931] usb 3-1: Product: syz [ 171.025973][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 171.066687][ T30] audit: type=1400 audit(1764716447.277:575): avc: denied { unmount } for pid=5814 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 171.127624][ T6889] usb 36-1: device descriptor read/8, error -110 [ 171.134029][ T5931] usb 3-1: Manufacturer: syz [ 171.473972][ T5931] usb 3-1: SerialNumber: syz [ 171.644833][ T5931] usb 3-1: config 0 descriptor?? [ 171.999467][ T7338] ALSA: mixer_oss: invalid OSS volume '' [ 172.012905][ T30] audit: type=1400 audit(1764716448.087:576): avc: denied { connect } for pid=7338 comm="syz.0.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 172.194967][ T5902] IPVS: starting estimator thread 0... [ 172.317305][ T7321] netlink: 12 bytes leftover after parsing attributes in process `syz.2.346'. [ 172.331220][ T6889] usb usb36-port1: attempt power cycle [ 172.343625][ T5931] snd_usb_podhd 3-1:0.17: Line 6 POD HD300 found [ 172.362916][ T5931] usb 3-1: selecting invalid altsetting 5 [ 172.370341][ T7350] IPVS: using max 73 ests per chain, 175200 per kthread [ 172.379801][ T5931] snd_usb_podhd 3-1:0.17: set_interface failed [ 172.387264][ T5931] snd_usb_podhd 3-1:0.17: Line 6 POD HD300 now disconnected [ 172.389615][ T30] audit: type=1400 audit(1764716448.697:577): avc: denied { listen } for pid=7354 comm="syz.1.356" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 172.395004][ T5931] snd_usb_podhd 3-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 172.432737][ T5931] usb 3-1: USB disconnect, device number 12 [ 172.790575][ T5902] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 172.912929][ T6889] usb usb36-port1: unable to enumerate USB device [ 172.940227][ T5931] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 172.960251][ T5902] usb 2-1: Using ep0 maxpacket: 8 [ 172.968534][ T5902] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 172.978632][ T5902] usb 2-1: config 0 has no interface number 0 [ 173.000459][ T5902] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 173.013463][ T5902] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 173.025675][ T5902] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 173.038514][ T5902] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 173.080444][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 173.093182][ T5902] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 173.109409][ T30] audit: type=1400 audit(1764716449.407:578): avc: denied { read } for pid=7366 comm="syz.4.359" name="file0" dev="fuse" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 173.110185][ T5931] usb 4-1: Using ep0 maxpacket: 8 [ 173.149292][ T5931] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 173.168678][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.195133][ T5902] usb 2-1: config 0 descriptor?? [ 173.211664][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.234619][ T5902] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 173.237681][ T5931] usb 4-1: config 0 descriptor?? [ 173.263650][ T5931] asix 4-1:0.0: probe with driver asix failed with error -22 [ 173.410249][ T5960] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 173.439014][ T5902] usb 2-1: USB disconnect, device number 14 [ 173.439084][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 173.594511][ T5960] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 173.825339][ T5902] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 173.829803][ T7372] 9pnet_fd: Insufficient options for proto=fd [ 173.841059][ T5960] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 173.855334][ T5960] usb 1-1: config 1 has no interface number 0 [ 173.866951][ T5960] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 173.881739][ T5960] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 173.894249][ T5960] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 173.903660][ T5960] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 173.942516][ T5960] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 173.956844][ T5960] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.966811][ T5960] usb 1-1: Product: syz [ 173.972322][ T5960] usb 1-1: Manufacturer: syz [ 173.977062][ T5960] usb 1-1: SerialNumber: syz [ 173.998552][ T7370] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 174.009998][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 174.010013][ T30] audit: type=1400 audit(1764716450.297:580): avc: denied { setopt } for pid=7383 comm="syz.2.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 174.076343][ T6889] usb 4-1: USB disconnect, device number 8 [ 174.252546][ T30] audit: type=1400 audit(1764716450.557:581): avc: denied { read } for pid=7369 comm="syz.0.360" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 174.498520][ T7370] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 175.170370][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 175.200398][ T5960] cdc_ncm 1-1:1.1: failed GET_NTB_PARAMETERS [ 175.206426][ T5960] cdc_ncm 1-1:1.1: bind() failure [ 175.320501][ T5819] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 175.615570][ T7396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.040197][ T5819] usb 2-1: Using ep0 maxpacket: 32 [ 176.059877][ T5819] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 176.069691][ T5819] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.100824][ T7396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.111514][ T7404] openvswitch: netlink: Message has 592 unknown bytes. [ 176.123464][ T5819] usb 2-1: Product: syz [ 176.127648][ T5819] usb 2-1: Manufacturer: syz [ 176.134302][ T5819] usb 2-1: SerialNumber: syz [ 176.184887][ T7404] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 176.302488][ T5819] usb 2-1: config 0 descriptor?? [ 176.472289][ T5819] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 176.494812][ T5819] dvb-usb: bulk message failed: -22 (2/0) [ 176.594037][ T7407] netlink: 20 bytes leftover after parsing attributes in process `syz.4.369'. [ 176.783711][ T7394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.792574][ T5819] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 176.812423][ T7394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.831333][ T5819] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 176.842616][ T5819] usb 2-1: media controller created [ 176.928000][ T5819] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 176.949257][ T30] audit: type=1400 audit(1764716453.247:582): avc: denied { write } for pid=7409 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 177.076522][ T30] audit: type=1400 audit(1764716453.367:583): avc: denied { ioctl } for pid=7409 comm="syz.2.371" path="socket:[14505]" dev="sockfs" ino=14505 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 177.111915][ T5819] usb 2-1: selecting invalid altsetting 7 [ 177.117652][ T5819] cxusb: set interface failed [ 177.123070][ T5819] dvb-usb: bulk message failed: -22 (1/0) [ 177.129332][ T7418] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 177.135834][ T7418] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 177.148319][ T7422] netlink: 28 bytes leftover after parsing attributes in process `syz.3.372'. [ 177.171619][ T5819] DVB: Unable to find symbol lgdt330x_attach() [ 177.183363][ T5819] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 177.240635][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 177.265910][ T7418] vhci_hcd vhci_hcd.0: Device attached [ 177.302152][ T5819] rc_core: IR keymap rc-dvico-portable not found [ 177.308612][ T5819] Registered IR keymap rc-empty [ 177.326175][ T5819] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 177.382979][ T5819] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input9 [ 177.415928][ T6889] usb 1-1: USB disconnect, device number 15 [ 177.451263][ T5819] dvb-usb: schedule remote query interval to 100 msecs. [ 177.458228][ T5819] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 177.500014][ T30] audit: type=1400 audit(1764716453.797:584): avc: denied { ioctl } for pid=7434 comm="syz.3.375" path="socket:[14225]" dev="sockfs" ino=14225 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 177.535063][ T6981] usb 42-1: SetAddress Request (2) to port 0 [ 177.550251][ T6981] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 177.564611][ T5819] usb 2-1: USB disconnect, device number 15 [ 177.608726][ T7421] vhci_hcd: connection reset by peer [ 177.619019][ T6173] vhci_hcd: stop threads [ 177.625053][ T5932] dvb-usb: bulk message failed: -22 (1/0) [ 177.646267][ T6173] vhci_hcd: release socket [ 178.040745][ T6173] vhci_hcd: disconnect device [ 178.310204][ T30] audit: type=1400 audit(1764716454.017:585): avc: denied { write } for pid=7434 comm="syz.3.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 178.352595][ T5819] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 178.973608][ T7451] openvswitch: netlink: Message has 592 unknown bytes. [ 178.980510][ T7451] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.264157][ T7459] 9pnet_fd: Insufficient options for proto=fd [ 179.321925][ T7463] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7463 comm=syz.4.382 [ 179.322518][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 179.720735][ T7455] tipc: Started in network mode [ 179.732721][ T7455] tipc: Node identity 4, cluster identity 4711 [ 179.750036][ T7455] tipc: Node number set to 4 [ 180.061266][ T7478] loop7: detected capacity change from 0 to 2 [ 180.271246][ T30] audit: type=1400 audit(1764716456.567:586): avc: denied { getopt } for pid=7474 comm="syz.2.386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 180.272245][ T7472] bond3 (unregistering): Released all slaves [ 180.349652][ T7488] warning: `syz.0.389' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 181.144416][ T7493] misc userio: Invalid payload size [ 181.400454][ T5827] Bluetooth: hci4: command 0x0409 tx timeout [ 181.414720][ T7505] binder: 7503:7505 ioctl 4018620d 0 returned -22 [ 181.514835][ T5932] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 181.516948][ T7513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.649870][ T7514] openvswitch: netlink: Message has 592 unknown bytes. [ 181.657488][ T7514] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 181.871652][ T5932] usb 2-1: device descriptor read/64, error -71 [ 181.882077][ T7513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.920646][ T30] audit: type=1400 audit(1764716458.227:587): avc: denied { read } for pid=7511 comm="syz.4.397" name="usbmon7" dev="devtmpfs" ino=740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 181.961179][ T5881] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 182.069597][ T30] audit: type=1400 audit(1764716458.227:588): avc: denied { open } for pid=7511 comm="syz.4.397" path="/dev/usbmon7" dev="devtmpfs" ino=740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 182.120379][ T5932] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 182.285706][ T5932] usb 2-1: device descriptor read/64, error -71 [ 182.307757][ T30] audit: type=1400 audit(1764716458.257:589): avc: denied { ioctl } for pid=7511 comm="syz.4.397" path="/dev/usbmon7" dev="devtmpfs" ino=740 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 182.853626][ T6981] usb 42-1: device descriptor read/8, error -110 [ 182.869728][ T5932] usb usb2-port1: attempt power cycle [ 182.905652][ T6889] libceph: connect (1)[c::]:6789 error -101 [ 182.922557][ T6889] libceph: mon0 (1)[c::]:6789 connect error [ 182.967188][ T30] audit: type=1400 audit(1764716458.607:590): avc: denied { ioctl } for pid=7526 comm="syz.4.400" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 183.292474][ T6981] usb usb42-port1: attempt power cycle [ 183.360359][ T5881] usb 5-1: device descriptor read/64, error -71 [ 183.490138][ C1] ------------[ cut here ]------------ [ 183.495763][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci4 [ 183.502422][ C1] WARNING: kernel/workqueue.c:2257 at 0x0, CPU#1: swapper/1/0 [ 183.509864][ C1] Modules linked in: [ 183.513834][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 183.522744][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 183.532774][ C1] RIP: 0010:__queue_work+0xcab/0x10f0 [ 183.538130][ C1] Code: 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 0c 04 00 00 48 8d 3d c9 6a 04 0f 48 8b 75 18 <67> 48 0f b9 3a e9 86 f7 ff ff e8 e6 96 39 00 90 0f 0b 90 e9 0b f6 [ 183.557713][ C1] RSP: 0018:ffffc90000a08be8 EFLAGS: 00010046 [ 183.563759][ C1] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100f18b132 [ 183.571711][ C1] RDX: ffff888027980978 RSI: ffffffff8a53c810 RDI: ffffffff908882e0 [ 183.579661][ C1] RBP: ffff888078c58978 R08: 0000000000000005 R09: 0000000000000000 [ 183.587607][ C1] R10: 0000000000000100 R11: 00000000ffffffff R12: 1ffff9200014118f [ 183.595554][ C1] R13: ffffffff81842960 R14: 0000000000000101 R15: ffff888027980800 [ 183.603509][ C1] FS: 0000000000000000(0000) GS:ffff888124aa3000(0000) knlGS:0000000000000000 [ 183.612414][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 183.618972][ C1] CR2: 0000200000012000 CR3: 0000000074a13000 CR4: 00000000003526f0 [ 183.626937][ C1] Call Trace: [ 183.630198][ C1] [ 183.633019][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 183.638890][ C1] call_timer_fn+0x19a/0x5a0 [ 183.643458][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 183.648549][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 183.654332][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 183.660126][ C1] ? __run_timers+0x559/0xae0 [ 183.664798][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 183.670581][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 183.676371][ C1] __run_timers+0x569/0xae0 [ 183.680854][ C1] ? __pfx___run_timers+0x10/0x10 [ 183.685863][ C1] run_timer_base+0x114/0x190 [ 183.690516][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 183.695689][ C1] ? rcu_is_watching+0x12/0xc0 [ 183.700424][ C1] run_timer_softirq+0x1a/0x40 [ 183.705166][ C1] handle_softirqs+0x219/0x8b0 [ 183.709908][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 183.715170][ C1] __irq_exit_rcu+0x109/0x170 [ 183.719823][ C1] irq_exit_rcu+0x9/0x30 [ 183.724055][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 183.729674][ C1] [ 183.732586][ C1] [ 183.735502][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 183.741455][ C1] RIP: 0010:default_idle_call+0x98/0xb0 [ 183.746974][ C1] Code: 3c 24 e8 0b d9 ff ff e8 c6 e9 ff ff 90 e8 80 f1 ff ff bf ff ff ff ff 89 c6 e8 84 8a 33 f6 e8 0f 2a 33 f6 e8 8a 9f 67 f6 fb 90 cc cc cc cc 90 0f 0b 90 eb ab 66 2e 0f 1f 84 00 00 00 00 00 0f [ 183.766554][ C1] RSP: 0018:ffffc90000197df8 EFLAGS: 00000206 [ 183.772596][ C1] RAX: 000000000096806f RBX: 0000000000000001 RCX: ffffffff819195d1 [ 183.780539][ C1] RDX: 0000000000000000 RSI: ffffffff8daa1838 RDI: ffffffff8bf1b880 [ 183.788510][ C1] RBP: ffffed1003b54498 R08: 0000000000000001 R09: 0000000000000001 [ 183.796466][ C1] R10: ffffffff908599d7 R11: 00000000ffffffff R12: 0000000000000001 [ 183.804411][ C1] R13: ffff88801daa24c0 R14: ffffffff908599d0 R15: 0000000000000000 [ 183.812374][ C1] ? trace_cpu_idle+0x31/0x140 [ 183.817123][ C1] ? default_idle_call+0x96/0xb0 [ 183.822034][ C1] do_idle+0x38d/0x500 [ 183.826081][ C1] ? __pfx_do_idle+0x10/0x10 [ 183.830648][ C1] cpu_startup_entry+0x4f/0x60 [ 183.835381][ C1] start_secondary+0x21d/0x2b0 [ 183.840126][ C1] ? __pfx_start_secondary+0x10/0x10 [ 183.845397][ C1] common_startup_64+0x13e/0x148 [ 183.850315][ C1] [ 183.853311][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 183.860560][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 183.869469][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 183.879508][ C1] Call Trace: [ 183.882771][ C1] [ 183.885595][ C1] dump_stack_lvl+0x3d/0x1f0 [ 183.890175][ C1] vpanic+0x640/0x6f0 [ 183.894147][ C1] panic+0xca/0xd0 [ 183.897853][ C1] ? __pfx_panic+0x10/0x10 [ 183.902280][ C1] ? check_panic_on_warn+0x1f/0xb0 [ 183.907640][ C1] check_panic_on_warn+0xab/0xb0 [ 183.912572][ C1] __warn+0x108/0x3c0 [ 183.916533][ C1] __report_bug+0x2a0/0x520 [ 183.921021][ C1] ? __pfx___report_bug+0x10/0x10 [ 183.926043][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 183.931844][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 183.937115][ C1] ? __pfx_debug_object_activate+0x10/0x10 [ 183.942903][ C1] report_bug_entry+0xb2/0x220 [ 183.947646][ C1] ? __queue_work+0xcab/0x10f0 [ 183.952386][ C1] handle_bug+0x18a/0x260 [ 183.956691][ C1] exc_invalid_op+0x17/0x50 [ 183.961169][ C1] asm_exc_invalid_op+0x1a/0x20 [ 183.965990][ C1] RIP: 0010:__queue_work+0xcab/0x10f0 [ 183.971338][ C1] Code: 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 0c 04 00 00 48 8d 3d c9 6a 04 0f 48 8b 75 18 <67> 48 0f b9 3a e9 86 f7 ff ff e8 e6 96 39 00 90 0f 0b 90 e9 0b f6 [ 183.990924][ C1] RSP: 0018:ffffc90000a08be8 EFLAGS: 00010046 [ 183.996977][ C1] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100f18b132 [ 184.004924][ C1] RDX: ffff888027980978 RSI: ffffffff8a53c810 RDI: ffffffff908882e0 [ 184.012870][ C1] RBP: ffff888078c58978 R08: 0000000000000005 R09: 0000000000000000 [ 184.020814][ C1] R10: 0000000000000100 R11: 00000000ffffffff R12: 1ffff9200014118f [ 184.028766][ C1] R13: ffffffff81842960 R14: 0000000000000101 R15: ffff888027980800 [ 184.036724][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.042521][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 184.047787][ C1] ? __queue_work+0xc7a/0x10f0 [ 184.052530][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.058316][ C1] call_timer_fn+0x19a/0x5a0 [ 184.062882][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 184.067971][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.073769][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.079550][ C1] ? __run_timers+0x559/0xae0 [ 184.084208][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.090002][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 184.095786][ C1] __run_timers+0x569/0xae0 [ 184.100272][ C1] ? __pfx___run_timers+0x10/0x10 [ 184.105278][ C1] run_timer_base+0x114/0x190 [ 184.109930][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 184.115103][ C1] ? rcu_is_watching+0x12/0xc0 [ 184.119847][ C1] run_timer_softirq+0x1a/0x40 [ 184.124612][ C1] handle_softirqs+0x219/0x8b0 [ 184.129358][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 184.134624][ C1] __irq_exit_rcu+0x109/0x170 [ 184.139289][ C1] irq_exit_rcu+0x9/0x30 [ 184.143519][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 184.149145][ C1] [ 184.152058][ C1] [ 184.154978][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 184.160937][ C1] RIP: 0010:default_idle_call+0x98/0xb0 [ 184.166460][ C1] Code: 3c 24 e8 0b d9 ff ff e8 c6 e9 ff ff 90 e8 80 f1 ff ff bf ff ff ff ff 89 c6 e8 84 8a 33 f6 e8 0f 2a 33 f6 e8 8a 9f 67 f6 fb 90 cc cc cc cc 90 0f 0b 90 eb ab 66 2e 0f 1f 84 00 00 00 00 00 0f [ 184.186036][ C1] RSP: 0018:ffffc90000197df8 EFLAGS: 00000206 [ 184.192076][ C1] RAX: 000000000096806f RBX: 0000000000000001 RCX: ffffffff819195d1 [ 184.200019][ C1] RDX: 0000000000000000 RSI: ffffffff8daa1838 RDI: ffffffff8bf1b880 [ 184.207959][ C1] RBP: ffffed1003b54498 R08: 0000000000000001 R09: 0000000000000001 [ 184.215901][ C1] R10: ffffffff908599d7 R11: 00000000ffffffff R12: 0000000000000001 [ 184.223847][ C1] R13: ffff88801daa24c0 R14: ffffffff908599d0 R15: 0000000000000000 [ 184.231794][ C1] ? trace_cpu_idle+0x31/0x140 [ 184.236536][ C1] ? default_idle_call+0x96/0xb0 [ 184.241447][ C1] do_idle+0x38d/0x500 [ 184.245498][ C1] ? __pfx_do_idle+0x10/0x10 [ 184.250058][ C1] cpu_startup_entry+0x4f/0x60 [ 184.254790][ C1] start_secondary+0x21d/0x2b0 [ 184.259540][ C1] ? __pfx_start_secondary+0x10/0x10 [ 184.264811][ C1] common_startup_64+0x13e/0x148 [ 184.269731][ C1] [ 184.273047][ C1] Kernel Offset: disabled [ 184.277342][ C1] Rebooting in 86400 seconds..