last executing test programs: 3m0.376880644s ago: executing program 1 (id=750): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private0, @in=@empty, 0xfffe, 0x0, 0x0, 0x0, 0xa, 0x0, 0x100}, {0x0, 0x0, 0x0, 0x0, 0x800000000}, {}, 0x0, 0x6e6bb8, 0x0, 0x0, 0x0, 0x3}, {{@in=@rand_addr=0x64010101, 0x0, 0x2b}, 0x0, @in=@private=0xa010100, 0x40000000}}, 0xe8) r6 = socket$key(0xf, 0x3, 0x2) renameat2(r1, &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x4) sendmsg$key(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x10}}, 0x0) close(r5) sendmsg$nl_xfrm(r5, 0x0, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)=0xff) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000040)=0x9) syz_open_dev$video4linux(&(0x7f0000000140), 0x5, 0x101000) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x7f) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x2, 0x4, 0x3ce}, &(0x7f0000000040), 0x0) dup(0xffffffffffffffff) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="800100001000010000000000ffdbdf25fe880000000000000000000000000001ac1414aa00000000000000000000000000000001000000000a0020005c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000010000000033000000fc0200000000000000000000000000010000000000000000fffffffffffff1ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff000000000000000000000000000000000000000000000200000000048000000000000000008d001400736d33000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000802000000000000ab84411f518dc9d5565b9e05de67830aeb529f334e285efe3786823a0a1e08b53bec30240d4d6f58f05cd36e941758cf60d4c5a818aca82c12697c43daf800"/312], 0x180}, 0x1, 0x0, 0x0, 0x20004001}, 0x0) 2m57.685086386s ago: executing program 1 (id=827): syz_usb_connect(0x3, 0x4f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000e45aa5205b109917e9360102030109023d0001000000000904ef0404ff"], 0x0) 2m55.174745404s ago: executing program 1 (id=839): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'mpc624\x00', [0x3c4, 0x13, 0xff, 0x1000, 0x14000000, 0x0, 0xfffffffc, 0x6, 0x8, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x3, 0x403, 0x9, 0x200, 0x1, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6, 0x1000000]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x100) syz_open_dev$vim2m(0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x14, &(0x7f0000000040)=0x6) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB], 0xb) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bind$rds(0xffffffffffffffff, 0x0, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f0000000040)='FROZEN\x00', 0x7) sendfile(r5, r5, 0x0, 0x9) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0xc0, 0x61) mount(&(0x7f00000003c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000040)='udf\x00', 0x8007, 0x0) socket$nl_route(0x10, 0x3, 0x0) 2m54.164039052s ago: executing program 1 (id=840): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r0}, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r1, 0x0, 0x0) 2m53.652185774s ago: executing program 1 (id=843): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r4 = socket(0xa, 0x801, 0x0) getsockopt(r4, 0x1, 0x8, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x1b, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900038073797a3200000000140000001100014707a082b178795ad1fcc02173fc70f8d69cdbd9d470f56c7ae4218d32c5d7fe44d5f0272890f24383fe450fb26ea7dcefadfa5e48e3bcf5693d"], 0x7c}, 0x1, 0x0, 0x0, 0x25}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x30) r6 = syz_open_procfs(0x0, &(0x7f0000000400)='net/rt_acct\x00') preadv(r6, &(0x7f0000000000)=[{&(0x7f0000000100)=""/120, 0x78}], 0x1, 0x4, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB]) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x8014}, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x18000000}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0xfffefffc, 0x3d, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5, 0x4, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r8, &(0x7f0000002180)=""/4101, 0x1005, 0x1) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r9, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xfffffffffffffed2, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, 0xc, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x2004004}, 0x40080) 2m50.456423469s ago: executing program 1 (id=850): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000001c0)='sched_switch\x00', r0}, 0x18) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000036000/0x2000)=nil, &(0x7f0000594000/0x4000)=nil, &(0x7f0000f36000/0x2000)=nil, &(0x7f0000918000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000c12000/0x2000)=nil, &(0x7f000003f000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x30}, 0x68) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 2m42.279768686s ago: executing program 4 (id=871): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x20000050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x8) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES8=r1, @ANYRESHEX=r1, @ANYRESOCT=0x0], 0x50}, 0x1, 0x0, 0x0, 0x8044}, 0xbdb041910372152a) read$msr(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) 2m41.28612803s ago: executing program 4 (id=874): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$sndctrl(0x0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a0f0000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0xc00, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2d, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="01ac0f00"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 2m40.854112241s ago: executing program 4 (id=877): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = dup(r0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000000)={0x8000000}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)=@overlay={0x6, 0x1, 0x4, 0x40, 0xe, {r2, r3/1000+60000}, {0x5, 0x1, 0xe, 0x9, 0x8, 0x0, '\b\x00'}, 0xfffffff8, 0x3, {}, 0x71}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000014c0)=[@text64={0x40, &(0x7f0000001500)="267600410f01b00000000066b88e000f00d066420f3a14ce5736430f0164b107b805000000b9060000000f01c1f30f01330f015b7548b80c000000000000000f23d80f21f835800000000f23f8c44279185abb", 0x53}], 0x1, 0x43, 0x0, 0x0) syz_usb_connect$lan78xx(0x5, 0x0, 0x0, 0x0) syz_emit_ethernet(0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaac2aaaabb9020ce57f63a28e4da53c90e93cc"], 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setgroups(0x400000000000026f, &(0x7f0000000080)=[0x0, 0xee00]) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) madvise(&(0x7f00000cb000/0x3000)=nil, 0x3000, 0x67) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newsa={0x164, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x6c, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x5, 0x543}, {0x7, 0x7fffffffffffffff}, {}, 0x70bd2c, 0x3500, 0x2, 0x4, 0xfd, 0x50}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x60}}, @address_filter={0x28, 0x1a, {@in=@dev={0xac, 0x14, 0x14, 0x27}, @in6=@private1, 0xa, 0x2, 0x8}}]}, 0x164}, 0x1, 0x0, 0x0, 0x880}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), r9) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r10, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x38, r11, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="010027bd7000fcdbdf25020010000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) 2m38.997893073s ago: executing program 4 (id=881): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r0, 0x2) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x8, 0xf, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x90000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x80, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_rfcomm(0x1f, 0x5, 0x3) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r5, &(0x7f00000026c0)="2600000022004701050000070001000000000000002b1f000a4e51f1ee839cd53400b017ca7e", 0x26) connect$netlink(r5, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfb, 0x800}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x20, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write(r5, &(0x7f0000000000)='\"', 0xfdef) 2m37.046442672s ago: executing program 4 (id=886): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x422642, 0x0) read(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYBLOB], 0x44}}, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) sendmmsg$inet6(r5, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) 2m36.021091628s ago: executing program 4 (id=888): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0xd6b, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000000300)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x2, 0x7, 0x20}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffff800}, 0x94) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x8004, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002480)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) socket$alg(0x26, 0x5, 0x0) ioctl$KVM_SET_GUEST_DEBUG(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000080)={0x80000, 0x0, [0x2, 0x9, 0xe, 0x6, 0x81, 0x2, 0x7, 0x8]}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000003e00)={0x4, 0x9c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) ioctl$BTRFS_IOC_FS_INFO(r2, 0x8400941f, &(0x7f0000000940)) sendmsg$can_raw(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f000000a000)=@canfd={{0x5}, 0x2, 0x0, 0x0, 0x0, "0327e1b22b5fcef77300e2c069f986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5ee00000000000000094e2fb263a918fa1efd9b0b"}, 0x48}, 0x2, 0x0, 0x0, 0x4040}, 0x24000895) r4 = getpgid(r1) ptrace$ARCH_GET_FS(0x1e, r4, &(0x7f0000000100), 0x1003) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='cramfs\x00', 0x208000, 0x0) 2m34.945022211s ago: executing program 32 (id=850): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000001c0)='sched_switch\x00', r0}, 0x18) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000036000/0x2000)=nil, &(0x7f0000594000/0x4000)=nil, &(0x7f0000f36000/0x2000)=nil, &(0x7f0000918000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000c12000/0x2000)=nil, &(0x7f000003f000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x30}, 0x68) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 2m20.383962915s ago: executing program 33 (id=888): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0xd6b, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000000300)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x2, 0x7, 0x20}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffff800}, 0x94) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x8004, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002480)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) socket$alg(0x26, 0x5, 0x0) ioctl$KVM_SET_GUEST_DEBUG(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000080)={0x80000, 0x0, [0x2, 0x9, 0xe, 0x6, 0x81, 0x2, 0x7, 0x8]}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000003e00)={0x4, 0x9c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) ioctl$BTRFS_IOC_FS_INFO(r2, 0x8400941f, &(0x7f0000000940)) sendmsg$can_raw(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f000000a000)=@canfd={{0x5}, 0x2, 0x0, 0x0, 0x0, "0327e1b22b5fcef77300e2c069f986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5ee00000000000000094e2fb263a918fa1efd9b0b"}, 0x48}, 0x2, 0x0, 0x0, 0x4040}, 0x24000895) r4 = getpgid(r1) ptrace$ARCH_GET_FS(0x1e, r4, &(0x7f0000000100), 0x1003) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='cramfs\x00', 0x208000, 0x0) 2m2.294218332s ago: executing program 6 (id=922): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$dri(&(0x7f0000000200), 0xffffffffacecc35e, 0x1690c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x200008, 0x8169, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r7}, 0x10) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205647, &(0x7f0000000100)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90b, 0xffffc002, '\x00', @p_u8=&(0x7f0000000280)}}) r8 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r4, 0x39) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r5, 0xffffffffffffffff) r9 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000400)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r9, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) dup(0xffffffffffffffff) close_range(r0, 0xffffffffffffffff, 0x0) 2m0.599965224s ago: executing program 6 (id=980): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mprotect(&(0x7f0000710000/0x3000)=nil, 0x3000, 0x1000009) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x80) syz_io_uring_setup(0x237, &(0x7f0000000240)={0x0, 0x8101, 0x0, 0x0, 0x24f}, &(0x7f0000000040), &(0x7f0000000600)) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)='?', 0x1, 0x20040845, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) shutdown(0xffffffffffffffff, 0x1) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) bind$bt_sco(r0, 0x0, 0x0) 1m58.955060782s ago: executing program 6 (id=982): mprotect(&(0x7f0000710000/0x3000)=nil, 0x3000, 0x1000009) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x80) ioprio_set$pid(0x2, 0x0, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f00000001c0)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}]}, 0x1, 0x1}, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000000c0)='?', 0x1, 0x20040845, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) shutdown(r0, 0x1) bind$bt_sco(0xffffffffffffffff, 0x0, 0x0) 1m57.952239456s ago: executing program 6 (id=985): sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r0, 0x0, 0x0) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1021, 0x400000000000f) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000040000000500000000000000", @ANYRES32, @ANYBLOB="000000001200"/20, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) 1m57.459861651s ago: executing program 6 (id=990): openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r0 = syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x336}, &(0x7f0000000100)=0x0, &(0x7f00000007c0)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f000015bffc)='nfs\x00', 0x1, &(0x7f0000000000)) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect(r4, &(0x7f0000000200)=@ll={0x27, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x40, 0x0, @fd_index=0x3, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="1a", 0x1}], 0x1}) io_uring_enter(r0, 0x4d10, 0x2, 0x2, 0x0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async) syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x336}, &(0x7f0000000100), &(0x7f00000007c0)) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) (async) getpid() (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) (async) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async) mount(0x0, &(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f000015bffc)='nfs\x00', 0x1, &(0x7f0000000000)) (async) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) connect(r4, &(0x7f0000000200)=@ll={0x27, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x40, 0x0, @fd_index=0x3, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="1a", 0x1}], 0x1}) (async) io_uring_enter(r0, 0x4d10, 0x2, 0x2, 0x0, 0x0) (async) 1m57.111717329s ago: executing program 6 (id=994): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r1, 0x0, 0xb9b}, 0x18) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r2, 0x0, 0xb9b}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2}, {0x0, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a"], 0x104}}, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) 1m41.878840105s ago: executing program 34 (id=994): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r1, 0x0, 0xb9b}, 0x18) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r2, 0x0, 0xb9b}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2}, {0x0, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a"], 0x104}}, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) 15.263036806s ago: executing program 0 (id=1303): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000940)=0x28, 0x4) sendmmsg$inet6(r2, &(0x7f0000006780)=[{{0x0, 0x0, &(0x7f0000000540)}, 0xb00}], 0x1, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000005c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x582c952b5e63b23f, 0xffffffffffffffff, 0x892c4000) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) dup(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x25, 0xa, 0x0, 0x0, 0xe4, 0x61, 0x11, 0x98}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x106f) socket$pppl2tp(0x18, 0x1, 0x1) 14.456033583s ago: executing program 3 (id=1304): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x65364000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x0, 0x0, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x15, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000080)=0xff) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d032, 0xffffffffffffffff, 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000400)={0x60, 0x0, &(0x7f0000180000/0x4000)=nil, &(0x7f0000977000/0x3000)=nil, 0x9, 0x0, 0x0, 0x1c, 0x46, 0x4, 0x0, 0x67}) r5 = openat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0xc2480, 0x34, 0x8}, 0x18) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000340)={{0x0, @remote, 0x4e21, 0x4, 'lc\x00', 0x8, 0x8001, 0x6d}, {@loopback, 0x4e22, 0x2, 0x6, 0x44a, 0x3ff}}, 0x44) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x10000050, 0x0, 0x0, 0xb49, 0xa, 0x3, 0xffffff82, 0xfffff000}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='T\x00'/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028004001200060018000900000005001700010000000500160002000000"], 0x54}}, 0x0) socket$netlink(0x10, 0x3, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty, 0x1000}, 0x1c) recvmmsg(r6, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x65942126f3d7b6a8, 0x2, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1, 0x2c}, 0x1c) 14.10040216s ago: executing program 0 (id=1308): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000100)={0x4, r4}) ioctl$DMA_BUF_SET_NAME_A(r6, 0x40086203, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x80) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r7, &(0x7f0000000240)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x10) 13.118245811s ago: executing program 0 (id=1311): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="1400000016000b63d2030000000000000724fc60", 0x14}], 0x1}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(0xffffffffffffffff, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0xffffffffffffff01) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000002300)={0x50, 0x18e1213a919ef28d, r3, {0x7, 0x9, 0x0, 0x25030082, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xc1}}, 0x50) read$FUSE(0xffffffffffffffff, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(0xffffffffffffffff, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r4}, 0x10) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup3(r5, 0xffffffffffffffff, 0x0) r6 = memfd_create(&(0x7f0000000200)='{+\'\x00', 0x6) r7 = memfd_create(&(0x7f0000000240)='\x00', 0x2) memfd_create(&(0x7f00000002c0)='\x00', 0x0) r8 = gettid() r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r9, &(0x7f00000002c0)=""/212, 0xd4) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r9, 0x4040534e, &(0x7f0000000080)={0x335, @tick=0xe, 0x52}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r9, 0x40045304, &(0x7f00000000c0)={0x3, 0x1, 'client1\x00', 0x2, "85d5f3dc07ade253", "c2382b486bb074dcb971c144adc7e6576c93d3b9d1b75d7917ca30cb00", 0x7fe, 0x800}) tkill(r8, 0x7) r10 = memfd_create(&(0x7f0000000300)='\'@,/)A*%)\x00', 0x2) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000340)={{0x1, 0x1, 0x18, r2, {0x9}}, './file0\x00'}) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f0000002580)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYBLOB="00000000004000000000000000f0ffff00000000", @ANYRES32, @ANYBLOB="0000000000000001000000000000010000000000", @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', @ANYRES32=r6, @ANYBLOB="0000000000000000010000000000000100000000", @ANYRESHEX=r1, @ANYBLOB="00000000000000000000000000b0fe0f00000100", @ANYRES32=r7, @ANYBLOB='\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="0000000000000100"/20, @ANYRESDEC=r5, @ANYBLOB="00000000000000000000010000f0ffff00000000", @ANYRES32=r10, @ANYBLOB="00000000000000f0ffffffff00c0010001000000", @ANYRES32=r11, @ANYBLOB="0000000000f0ff0d010000000000000000000100"]) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) quotactl_fd$Q_GETINFO(0xffffffffffffffff, 0xffffffff80000502, 0x0, &(0x7f0000000380)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) 11.18888474s ago: executing program 0 (id=1313): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x800, 0x70bd28, 0x25dfdbfd, {0x1}, ["", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x10}, 0x4040811) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) read$FUSE(r2, &(0x7f0000000580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_DIRENTPLUS(r2, &(0x7f00000029c0)={0x10, 0x0, r3}, 0x10) write$FUSE_DIRENTPLUS(r2, &(0x7f0000003380)={0x10, 0xffffffffffffffda, r3}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x6, &(0x7f0000000140)=0x1000201, 0x4) 10.740212693s ago: executing program 0 (id=1315): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$dri(&(0x7f0000000200), 0xffffffffacecc35e, 0x1690c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x200008, 0x8169, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205647, &(0x7f0000000100)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90b, 0xffffc002, '\x00', @p_u8=&(0x7f0000000280)}}) r9 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r5, 0x39) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r6, 0xffffffffffffffff) r10 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000400)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) dup(0xffffffffffffffff) close_range(r0, 0xffffffffffffffff, 0x0) 8.72547062s ago: executing program 3 (id=1318): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$dri(&(0x7f0000000200), 0xffffffffacecc35e, 0x1690c0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x200008, 0x8169, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205647, &(0x7f0000000100)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90b, 0xffffc002, '\x00', @p_u8=&(0x7f0000000280)}}) r9 = add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r5, 0x39) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r6, 0xffffffffffffffff) r10 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000400)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) dup(0xffffffffffffffff) close_range(r0, 0xffffffffffffffff, 0x0) 7.236362473s ago: executing program 3 (id=1322): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x5) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0xd02) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) 7.176778194s ago: executing program 5 (id=1323): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'mpc624\x00', [0x3c4, 0x13, 0xff, 0x1000, 0x14000000, 0x0, 0xfffffffc, 0x6, 0x8, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x3, 0x403, 0x9, 0x200, 0x1, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6, 0x1000000]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x100) syz_open_dev$vim2m(0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x14, &(0x7f0000000040)=0x6) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB], 0xb) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f0000000040)='FROZEN\x00', 0x7) sendfile(r5, r5, 0x0, 0x9) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0xc0, 0x61) socket$nl_route(0x10, 0x3, 0x0) 7.176124827s ago: executing program 2 (id=1324): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000068000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000212c0011800a0001006c696d69740000001c0002800c00024000000000000000030c0001400000000000000101480000000c0a01010007000000000000070000000900020073797a31000000000900010073797a30000000001c0003800c00008008000340000000020c0000800800034000010002140000001000010000000000000000000084000abe68a3a3cd290579fdcb67bb2aba14f72d96fc3dd13f8bb1cc52da863a805263d3bb22521d78d687e031d3723dc145f1e23c0635c700c217cafe5d6b05de1149815e06fd31704ad844c83fc2081b0c472c0ed7e4505b58dd275c77e9fd2796c20e8429dce038cc6be9a968732c0c63d2b36f8b291b142748cdef61bd401970e2ff85cedf2dda35ea1139a8bd23d01c0c8a0837b9ec1e7e4e784a583e6d69daac35016fbeab6edf84de91bbc1082064f71413843d"], 0xf8}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000003a00000226bd7000fcdbdf636b3a8a83000a000000"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) (async) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$kcm(0x2, 0x4, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000140)={r1, 0x7, 0x0, 0x400}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000140)={r1, 0x7, 0x0, 0x400}) setsockopt$sock_attach_bpf(r2, 0x1, 0x4a, 0x0, 0x0) (async) setsockopt$sock_attach_bpf(r2, 0x1, 0x4a, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) readv(0xffffffffffffffff, &(0x7f0000000040), 0x0) (async) readv(0xffffffffffffffff, &(0x7f0000000040), 0x0) r8 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r8, 0x84, 0x2, &(0x7f00000030c0)=""/4023, &(0x7f0000000000)=0xfb7) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r6, r6, 0x12, 0x0, @void}, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="140100001e0001eb25bd70000000000001"], 0x114}], 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$sock_TIOCINQ(r5, 0x541b, &(0x7f0000000100)) 6.339753649s ago: executing program 2 (id=1325): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x774abb1dc22a86b4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000001180)=ANY=[@ANYBLOB='quota,usrquota_inode_hardlimit=7']) chdir(&(0x7f0000000240)='./file0\x00') mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0xb0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = open(&(0x7f0000000140)='./file0\x00', 0x10000, 0x0) syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) kexec_load(0xff0e, 0x1, &(0x7f0000000900)=[{0x0, 0x0, 0x7ffe0000, 0x3e0000}], 0x0) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0x1000, 0x1) chdir(&(0x7f00000003c0)='./bus\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000280)='./file1\x00', &(0x7f0000000340), 0x0, 0x0, 0x0) 6.335900172s ago: executing program 7 (id=1326): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = epoll_create(0x10000047) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.net/cgroup.procs\x00', 0x2, 0x128) io_setup(0x1000, &(0x7f0000001d00)=0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000003c0)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016fef8a9cedaf6bec340dee49474360d34cb800", 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000004c00)=""/102392, 0x18ff8) io_submit(r3, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8, r2, &(0x7f0000000100)="331e767999fcd25f16458f4625beb50ccf5f5cefa8fb1e529ba065a5408dce94db48b94aaaf38e5a4a227022569863287447e19719aec40f9bc75aa3e46a465636b066cc1098833cb68b222af67ffef277f2465f770e6d1e6ffee834af", 0x5d, 0x7, 0x0, 0x2}]) eventfd(0x10000) r7 = fsopen(&(0x7f0000000000)='msdos\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="31042cbd7000fcdbdf251600000018000180140002006e"], 0x34}, 0x1, 0x0, 0x0, 0x4c810}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000340)) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000340)={'macvlan1\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x7fff, 0x5, 0x20000000, 0x4, 0x5, 0x84, 0xab34, 0x6, 0x5, 0x4, 0x549a, 0xfff, 0xf7f, 0xaa, 0x4000, 0xfffffff9, 0x6, 0x3, 0xfffffffe, 0x3, 0x7, 0x3, 0x55, 0x8, 0x1, 0x3, 0xfff, 0x2, 0x11a7, 0x6, 0x665, 0x7296, 0x7ff, 0x2, 0x1, 0x9, 0x3, 0x1, 0x3, 0x7, 0x0, 0x5, 0x7, 0x9, 0x2, 0xfffffff9, 0x0, 0x429, 0x1, 0x1000000, 0x6, 0x106, 0xc83, 0x1, 0x0, 0x5, 0x8, 0x2, 0x8, 0xf, 0x3, 0x4, 0x4, 0x1, 0x5, 0x8, 0x6, 0xfffff687, 0xf, 0x8000, 0x0, 0x800, 0x81, 0x4, 0xfffeffff, 0x401, 0x1, 0xc60, 0x5, 0x2, 0x7f, 0x4, 0x6, 0x7, 0x8, 0x6, 0x1000, 0x40, 0x5, 0x200, 0xd719, 0xffffff31, 0x10, 0x200, 0x1, 0x9, 0x7fff, 0x80, 0x400, 0x2f54, 0x8, 0x5, 0x80b, 0x8, 0x3e, 0xfffffff9, 0x3, 0x5, 0x3, 0x2, 0x7, 0xcfa2, 0x5, 0x4, 0xd340, 0x2, 0x3, 0xaf, 0x81, 0x1, 0x6, 0x7, 0x0, 0xb, 0x1, 0x2ee, 0x80, 0x2, 0xf3, 0x101, 0x7, 0x9, 0x2, 0xffffffc0, 0xd, 0x231, 0x800, 0x8001, 0x9, 0x4, 0x0, 0xdc80000, 0x725a, 0xedeb, 0x400, 0xfffffff7, 0x7, 0x0, 0x9, 0x80, 0x10001, 0x1, 0x0, 0x2, 0x5, 0x0, 0x7, 0x80000000, 0x1, 0x9, 0x8, 0xaf2b, 0xfffffffe, 0x6, 0x8, 0x101, 0x2, 0x2, 0x0, 0x6, 0x4, 0x800, 0x7fff, 0x39d31630, 0x1ff, 0xf, 0xffffffff, 0x1, 0x1, 0x3, 0x9, 0x0, 0x7fff, 0x10, 0x9, 0xed84, 0xa7a, 0x4, 0x1, 0x1, 0x8, 0x0, 0x4, 0x0, 0x8084, 0xd, 0xe, 0x4, 0x548, 0x389, 0x2, 0x1ff, 0xfffffffd, 0x0, 0x3, 0x2, 0x4, 0x1, 0x3, 0x6, 0x1, 0x8, 0x4, 0xa, 0x4, 0xd3c, 0xa, 0x7f, 0xeb, 0x5636, 0x7b99, 0x3, 0x10001, 0x7, 0xfffffffa, 0x9, 0xfffffffc, 0x7fff0000, 0xe02, 0x3, 0x940, 0x3, 0xb56, 0x9, 0x7, 0x9, 0x3, 0x800, 0xa6, 0x400, 0x0, 0x1, 0x9, 0x8, 0xff, 0x2, 0x7, 0xfffffff8, 0x1, 0x20200, 0x80000001, 0x0, 0x0, 0x6, 0x6]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x81, 0x0, 0x7, 0x8, 0x6, 0x4180}, {0x6, 0x1, 0xfff1, 0x7, 0x8, 0xce1}, 0x4, 0x9, 0x6e7}}]}}]}, 0x45c}}, 0x0) 6.319800113s ago: executing program 3 (id=1327): r0 = syz_io_uring_setup(0x7e71, &(0x7f0000000000)={0x0, 0x27e5, 0x20000, 0x2, 0x8a}, &(0x7f00000000c0), &(0x7f0000000100)) r1 = io_uring_setup(0x2f82, &(0x7f0000000200)={0x0, 0xeea5, 0x20, 0xfffffffe, 0x0, 0x0, r0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000400)={@ifindex, r2, 0x2f, 0x0, 0x0, @void, @value=r3}, 0x20) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x28}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) unshare(0x22020600) fsetxattr$system_posix_acl(r5, &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x1000000000) close(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000018c0)=[{{&(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001800)=[{&(0x7f0000000340)="9e97d8b4450b7ad0fa693c75bcd2b1e7d2558091975a8c90845d15cd50678d7f83c961f2de86bce5068aaafe89876ed7c78ff2dfcfd264fbc7fae02015a5710e4c433ec94340ff7b0f170e2a688c6edc785d9ff9cce29e069463418b146bb45006db5718310dc485eae6641c366a265c5a62f9e0b61d1530025890758ac2da97a0edadb665583881c0c1c2a156c49f66b8e4a7f1243db4d3f1b8", 0x9a}, {&(0x7f0000000400)="268e75f67fdaff90124d644213c71133c48ab54467f3f8fc9a8269317bfaca4e34b3e5a636381058c24762a69db6ef0270edcd6e202a2e4a78638972a301faca62e53f3ce0dc502109ed6b13edda044c6671e4ae73c45bfd106b3e9a9b5cb4227b0b35917eed67ebc1f34e1307e188a2371df444397ca9662dc0621b0c1ffae60aad262a4581fd7e05508adf7e07cd4f70b60b6a001e828315c078892f3a088cb8e71faa23b2b5e8c091709ccfc48355cd60a5233a5a03177b6a023d24e4280af2f9398ea0b17e6cdde1bccf471c4efa2166d58a8c2ce1ec711b1c1536f83073eb3cdb45fafa783c5fe62dd8087633cc94b8308da495d6a682ca406859dc5a365815bfcb5a3ad1759029b5e2b31061a109e9a2799ebe848d22b5d3e2101d5827c959d1bcc1999a4ef74064d11c599675a8a09776fe7ed01e0ff18eea12c03d04f8283005f62d7cab1d29576452da50277af0f8ba349343d338e77a6654a4fefce56ef8dfa4ff1d640d24f1487e5c281287428da3aa61a13245c97e7649f92aa7dee680573463402c8a55ef37d1cd9a5e9defc0b1edd0941b70f4a447d5d1e776f8f8a74445ddcc1b28455e29525060bd286ed154aefc0abde3bd27c12c6ae4d06f67ff3cfceea00f924c656c7a99a0fbbbd9cb8f0f3248d8f96d6619e5156db688a1ea9feb7e0a68a85722a6c03482b8e2c3036b38daca4ba05aad28b8298bd83da30574cc6dd917a5fdda58778444e6a5348e1c6b5307b41397be18243e24cc5659ef7ed1b6ef9251a7a0b9462c53c24d25b334b6a150b8642743bc6292e4595040418524b4e4285690b14facb31701a45ee015ade751ba5ff01b10a6272e76b6f0e67795332356219c298e2d66d7c3879bb35fd29dfbb7e677566c4249aa5cc66de8c3dcbaba6379a76f1b2c39fb9a95ac54a18263adb98f14c89239cb98fd44dc2ca18e3ef19d08dc079122d91d4de7dca71b08a1dbdd8666e0fa850672dbc85e00504215e7ccb131d02fa3b40c1ced64ab38b9a555cecff467718b7580aaa8e10411100db04d29844de521b264dd6d930beabe6d01202820e152e0c9c03a9f016d261deec28bdc11f77ded3c7f5839e3c63fced0855581a73bfe3c9f8f37e0dfc32fcee9c0e496d0660635723946332ce37baab2a361ae6ebdd6b2769f3ffe296bae2f2fdeb09e92ff4b32965e791180cee51afa5b66f397f90b2c07ea6f17632a3b4f7e5de2e314d3ce2007c93760596a853519c0460bf47e39ac868ea01d595774f96decf3f74b4973c6d9be53fd5de3e742add9c954089282dc693ef3c2c5b14aceff0ecbe3e7781b6c89f312ed3c966034d112298483425c3620d602bbdfbc4c1a2605e80277af5f56ae19f91e5602abb2e3482c952fa71a28cd5cea026ebce09bfad1e024be2b383e26d41d9a6993f2e1a5282141cdcb22b608285cd615d751c88a882a66874a33a24186e9a971561b2227aba54804d223e7d20ceebf381fc32e6fdf17a2e713b597dc9b4b10ac6ed26116c2b952fdea4b1ba228c1e71dcccffab51a4bb9d0147e0a342e82020294a489f97a7f0b4cbab874be6e9c1c17f59a53f4110064cdef709070ee90a4a580958f5733717aa12df70d45d4209150d73b3b25ab12eeabaec5660048dbc6d08d0e164925501a3b07ab05aa320e943ee2089c27d6305a06583e35f36be252a3db5f3220b96ebcfef81f439b00a903d4b32c94582733c6ae1170c20ee45d9d6f3f8fe916ddec6058e4f1a8010bdf66061ade666c47c2d4054ad4532467f196560f3f4449b461f4ed516404d72318f9c70a2130d34231fd495fedfcd4560f397e30e0f2a4680f914681cf3a141d4f47aac1983109f35cd7193476d8f3eefa536b70d968833dae0c09589f2a1887432d15bd7fe01164eb3e9fe20bfe7f809654f3088a3dfcd5436b9a23f548cb6ece836f28b1924b84579102c9a7f4f316a77fe356c36ad84a93a8a0cc2b101fa7ce7068d44e7e4f3bc941e0a8626a468b084d74cc81eede865980ab82613b053f4704327fbc3df5f9c4e21a863a416424448f6224fd02f78ec9c7531284451f6383467cde2bdd8f039c828fcd19270dd260026d59e945559e322845e8bef650ae01b6f5e338fcd509d537a9ccabcb6755083d4aee5d8c3f359bca6688273e92182ab748a1de3e521497496d08beeef7ea105590283ef242fdc7b440a5950ed3d612eff5ca4a06f78c6a8640a5d87e540e3ba64955747c7936898c7f345c4334ddf068104b0cd43a63616d374297c5fe3522acc0079f250832a6b909c2981426dc57ab2b44d115c5263bcbb5cec537ceb5183fda8b4bd93ef1cd5b6425b17a01e2d6df9fa6843349f0ec7abc566408ab6ab87bde3b356541098dc62b2cc305920773251944c636092a3f2a952a8d956a87414999d608b5b87404119cd3fbf8b000405b84fc77f213f8f297b6c4a2f433b00828c6116e8210007d3eb087da5efb2e63b0d9a9950ef1678cded60a4ebe3f2c75d24404fa82222524103f55d156fd75e9471f528b84627090a222a4bd1aaa746acd92a7d3fef8c1d196418c4c59efa0ede508bcbc961a76c375c6b067a3f33174812f84b361e4e4edc36b324eda89337542c028bbe0c33b0a8fd7538881aa257447784f9056889c584ebe9c476ee9172fe9b7e23872673a30ef18f7bf6d6a3615d5db0c36757dd5b7824c8509da541efdc20173bc55cc9bc8e68fdafda468fb364250790e0870f8fcf5d35b807c8fef97cd395e1b47c92c472da8372b4385285b662ea481c20c4c96da4e8b725904390bb1724a69543a0f0506db44c8ef0f578023b14866503ca6a09363e2d4c19c022070fd1590bdbeda415ee612f120ea037bd87c5b9773954be83861374554fd8631a7520042ef7be7073f977a97357a41054b6b1d5583122b37e4b4a6eadd7e2dbbe6acbd856201954461635bb35a2b50a35b3ef20211354d9f085e84a6b852f5e86a656781896ab91b968f16fdb52f9170c0301db4fb165f057017fe921a99d4dcbce8568ee26b20e5c5577d8b3e59fa6cbf11f5d57b6f2fee7094ae0693437c260aa026122e02e75bf82825035de990c4471775ef358b5627481aec1d32825964468e5d4d486bd26634386b217fb1b29b58d5d883247a70e651f0414b511fddd487aaffb947e948174ba914c3410e1c78e63dbe23a746076b692c8cbec9d2e63720c9367baf4128215ce9c7ea802c547dffac337ad1c74ca06d8baa1784285d29951c4392a09ed4767e62eecdb0dc3fd0ca7e5bb5fa6380f8a41293734736ba9c8947e30f687b05c2eea8569b1e8d875681f81a4095627fd4f4e83db9af888f017c04d301f379c12b7612ac42e6e4c8c72c6f5feaa3ae8fca5beb606dfb2a18d99013bca2166ba6022715d5193c8f03a26f64bb5486a43cb62752a4d67adf46df757ccd8ceff132a5b520fc52f9c4b8fe558f5487f612efaac72b76008c915ed28570d356b37095e6ff9ba26dc857f6a1dc951eb3d5e5c32025d17fd90b97e09b533b0d4beb5eaa5ffe49afaeb68834b3af93e175361ca1ca64d1b2ee175f0cde7a59f913f0420fedfb44293127c508288899d83eeca83e1ef4b86a447a6fc422b75dc77a44fe0f7949a4b6ed9dad83c358399e069eed34afc40ad548d2e9e8f14314e7aff00a6986d4e8da82829eb6de4ed2ad334c0f1c9826d07d183720aef7539788d8fe70a4ddbb07d95ea3b304677dd89b47963f62f98dae5800406d1670192cb14e658ab6ce62d58296e73c306344ad683fb542a38bb6cd00b298694aea4e2de91e561ce89d1a8206fe01ca83a11e677edfc13c913b033ac7b4a5eeac2363bd10ddf1b02e8639de282b2f1e021e03a324cf6c137606fefd2ebd069d34b3893224011ef5ca8978a25dbe320504a0ac491088ba1b4c1bf4ad4f42f233ae3f53d5a610771e7899f38ad510d7a72453f6f0492f9e476a5708e8615bb380294eb6e5e621aabe0e72575fdaeaf52c0b1cf78fe1ebf5b4e5606a8af0070c7b810b6e57f2e5efe7057f58d9cd1657ef62ce2e01388ff6f776d3b361a7a35569d6d7a8844d5d7574317881eebafd448c9eada486115a9f4a101268651f5e8600dd9984c16a3ce56bb5e15c7b7b08dd803de0ee74e2acb2e6835ae0f548c9cca2d9baab28bdd1bbba0591330d681e401fbfcbe2696d7f81d5f0dc85583cb58790cb00a6f16872598368074daf7dad996db6d892c2a7b38c807b89719a4b245648f79231bf453b3b13159d1cd3176a4c0a3fa3174587aba55aacf2dc1c78d79e79e5791d7ad5007aedc0023bf1ff4907ab3103cea75c9c2367c83fc4698a62a1367aaac4ca46fca0342d6af3ab5629b3a92106e4d598bc066ddf3344d639e581d6c75e5805dacc499f14e3a91a39a690402e309f4fcd280191b26a510ac8e57663cedc27281528d205e57217dc92ce685d915e7080c33a05b3932631eb32346c08af550a6b015659aec459b61e52bc0b0ac435d222c70929191a7aeb31c44df1c57181f5d624d2b71b6d5743ba78ca688380288c585c09e1d7532b61b125a03fef1713636b416cef26b3abe35fb6df698bf849d84239ffb2bb7cf5b5a5b0bd1aafddd00543110d3e424fdd5ef430336186ac3c4099fffb7ede9ecc6b1c86afd496f48ed10064dec78df8c674e21b7aa2211b03e19b5a973d0b28c33c03a5a537b3ce94c0de854e4c51ed021eed94ba80a3547d4de899b310163b2b6721685dc7e85cab3908d6b7b2d1f757d5a1956cea857674a7688e95e796ba0891f95d2bd93e80810645604446792aa5f5271aa08d9ab7c4cd7158b4703d5dee5a7938454f92ac484457a26df81426ea860bd527617725a6e5ec57f60a3e0f2ee4a6265f388c15328cc407b7f12f997253b9471b3d5393a0832e651bca2def20b8eb5ecd343f5a28acd9b6d17e1250d5191caf692ddd9cbb9a74c6e1b6ff381b1002bd3de046247d0b437e1e6a679dd97131ae8d3e5890cc44e7f0c3f3c29d2fd3a7befcd53b405765fe6bbab58370d2d9d43ac7ce9462d7f73e7fe5b4b76a7d1fb098a20a6e21c1f54a0eb31ba5137673b9b13f12ee8c6157679211cfc7db5f9c6912ea027835863d9324d5c625b458fe7f8cb467068c73f1c0b37b115ec3d3734e7934e6d0ff93ef7d690882a898f6f9914264d70a414e2963e183ac0fb9ef0e8089bcd607447b8f146ef8e99da75199b0a3ecef7198911edd13a8dbd8476ac1c0f057fe29d67dacc0b9a1961e22b8481d4db7a066bdb5825aed0948a399eb7d1b9ebd7e0b30bbc998563821b09f07fd4ab9c72bc69ecaa97014bc84113982c14b511b71dc33a7279cca20907b59ef3a63bfc848a47bf79fd34ca83884e2880a367f9f53afda85a369baa7df6019e0ea4b72277f5663ccb0c1074c9209aed184fe7579b6e5a8c54239aa6e0b67624eddd690012e03b8fa042e49c06f979bc81b2377cceff0be91a56974d1541ea53a53cc9d7371afb4761f3c8ea3b365f22074852e604a5c945d74559f7b090a2538b68ec81c5502d3e02f4915a614ab6bd5fa9f367a18a59f022daeb12ed59a12d7dda23a0a5f2a85926428c77e0f24c90f73020d6ad44b1dd19af494c579d22f1d0c562ddbdc759d7de63a55a0375127b3b2a54926f520e8c3fae29f348373488f1298bb2b5836cffe2c214cc6757e9efa8036900959d70fe2224bdd0dd0aafbbf8d9773b293978318937e92d55e9fa93d9661c2f7555dd708bba78a3dd8d1f735415151bcf3e6505db4098484d5cf80d2cb4819a666da7e0f", 0x1000}, {&(0x7f0000001400)="855fe3dfc8ee3367a25752a04239091b616e448373519a137048538162ac38fdc33d824db4280c710df9c9b1b5257fbd0379952c6893f14e78e111c972aeb11f19748bf744262338cbf5af4cfcf5ad338c9bf33b5332748745e84e31d38a77c4c82a3efd304c2721de46b210e63d8295b1c22589fd8ea4c37cc78effb7757060bf0e924e70a624", 0x87}, {&(0x7f00000014c0)="6c858b13abdc098dfb4f43d849d0482145f40a2031376e1127db664b433c63570f9b5491339db15e129a1935641cd038aa23227f7bf2682dc035f4b8e51815bc7f7eee71db6a142fd84c1f29f38158f25be318635e13135962a8b1d3e171bd7551e00fd0c724a219f50a41a53474d67d1d8510446c04a52880ba2217979865a0143f4fd97e8bf9c7de0429abdcc833bed711635b15c34a2096892b85380a957b437869", 0xa3}, {&(0x7f0000001900)="9d1591226600c96fa1df3f8599ced2cdb2233e0b8b0c4e4bbeb0a873849abefbe025638aff5bfd789c3876ca61320eb4396271b9229d545896e37f990fd1d726d821988e19242eaa2cfc33814528cbe82b43ca9b7b57a08ae53f91b19dabd7fbc2de6ec9a2405b7740082a70e2963b676ffefdfe7a2782ed95f99bd82c00010000000000007b09cb375c53d1c94276a2f4ff0316bf0a88190cab6b208ee9d6497fd68564d264fe3746d208cdf8a22088cafcf8d6a2c241f96384caf2ff7f00000000000015e93eae1007b64680ada3d982308bae3bd376e4b39ec3456b92a55c0b949662bac0f5097a4bb2fb3fe2", 0xee}, {&(0x7f00000015c0)="333c0cc8add138c4543849c8117eb6db7cd78a4dd5f5bcc96a2902e29d7276c5466246ba95c2651b79505fd64271c8f774ff6cc8e8f03d020678ce392636ac60de91149f9beb4d7bde63feec370cd1ffb32cb1f496e4f14cbc6002d105bd336331c97ab04a755c3134a1e015", 0x6c}, {&(0x7f0000001640)="d610f55883b4a642c17b6e22c6d0399cc0d80a3be5551341fa4aa5b4bcb82f1687d919295a2d2b433ab88df7cb98c4022154fb6e8b14362113", 0x39}, {&(0x7f0000001680)="e779e7fa692eed577a1b350a98a5090e8346d70d3c01dc34462901cf0d0c0c68069722ce3b42d1b624d36f57b3ad8f6a1c7be7c7735dc7f2c29257f23787f2e37001a38d4671d9874b8606c91f9a08b9b9eccc06c820c703573040d6cd94345debb65cb96af1b811dc497f9d81defa9f234721241d6e02366d2c9ee3ef310c815483e0ac7fe0a7d18b3d0814002ee998b25705ae4a4428287939f5ea07b4bc9e4ef729b0428d462405ed13cd5f455112b0f351805cf7f753d52c61d9a199b955af059159279e84fbee388f", 0xcb}, {&(0x7f0000001a00)="072c58d948e777d3404280a593c4d7c7cec7a35b814562ecdf0455318788274a6d7b559f8568bdedd7f5b942f22efe588ba6565092fb20ab32b8a2a79ec006a7f007e24aac063627c23c7affa2c63a45f258fee8a24d2070aa81106a629e3f00000030d70aa0881b7a2e1d44eb280341bd0079229273e582ce97cea4d8fa0ec3879b9176585175a7b61c37b2614652c79afe6aeea20b993ffbb1931c1ed3cdfa38475c707c9ac59ddac19375367478ed84849fb941205ae94af805bdf627aebdb4c9119be7afa68bc584a83668b0d79b72001e0c88b5ab6adb2ff8a405956fe7a9", 0xe1}], 0x9, 0x0, 0x0, 0x20048890}}], 0x1, 0x0) readv(r7, &(0x7f0000000280)=[{&(0x7f0000000140)=""/177, 0xb1}], 0x1) 6.204310037s ago: executing program 5 (id=1328): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x56b, 0xfffffffffffffffc}) fcntl$lock(r0, 0x24, &(0x7f0000000040)={0x2, 0x2, 0x1, 0x7}) 5.041883886s ago: executing program 0 (id=1329): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x65364000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x0, 0x0, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x15, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000080)=0xff) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d032, 0xffffffffffffffff, 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000400)={0x60, 0x0, &(0x7f0000180000/0x4000)=nil, &(0x7f0000977000/0x3000)=nil, 0x9, 0x0, 0x0, 0x1c, 0x46, 0x4, 0x0, 0x67}) r5 = openat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0xc2480, 0x34, 0x8}, 0x18) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000340)={{0x0, @remote, 0x4e21, 0x4, 'lc\x00', 0x8, 0x8001, 0x6d}, {@loopback, 0x4e22, 0x2, 0x6, 0x44a, 0x3ff}}, 0x44) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x10000050, 0x0, 0x0, 0xb49, 0xa, 0x3, 0xffffff82, 0xfffff000}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='T\x00'/18, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028004001200060018000900000005001700010000000500160002000000"], 0x54}}, 0x0) socket$netlink(0x10, 0x3, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty, 0x1000}, 0x1c) recvmmsg(r6, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x65942126f3d7b6a8, 0x2, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1, 0x2c}, 0x1c) 5.037546225s ago: executing program 5 (id=1330): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x1, 0x7, 0xbfdffffc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x47f6, 0x0, 0x4, 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000380)={0x8, 0x8100003, 0x9, 0x7fffffff, 0x15, "8d593400"}) 4.876120284s ago: executing program 5 (id=1331): r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mprotect(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="fe"]) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x1f, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x100}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000080)=[@timestamp], 0x1) 4.489354925s ago: executing program 2 (id=1332): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000000)="09000000010000", 0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000180)={@loopback, @broadcast, 0xffffffffffffffff, "793fbacefe489b1245d664b7ebf1e172ccc481a1a6b33b4f86ed56c39d44f43d", 0x1, 0x7, 0xff, 0xb}, 0x3c) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, &(0x7f0000000300)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0, 0xc000814}, 0x2400c050) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0500000005000000f80900008500000041000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32], 0x50) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xfffffff6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x50) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000000c0), &(0x7f00000003c0)="79dc3c34d099f01d5fd6a876093626bf850ec6f54258e76c60b091ccf73bd019abac5f8fa93644fc828750c26c493af47648b45d6b1f700240bf5928fd826c090bc53af57be59baccab904420378989878aad437017ef707c634d1f0d0324384859d0505cd5828569fcd0b3753af3b030416cd6a25f29f9c09f93a2c7b882843c23ad3bfb0555dc08b66d754b2612a262cfd79d032fae4bf1c5a3bc64654ffa9ca7dd57bda030df51544a59e5f2a007335cbab", 0x6c, r5}, 0x7e) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="40000300", @ANYRES32=0x0, @ANYBLOB="10d40000b1eb502a200012800b00010067656e65766500001000028004000e000500090020000000"], 0x40}, 0x1, 0x0, 0x0, 0x40881}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 4.390207366s ago: executing program 5 (id=1333): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000001b00)={0x1c, 0x6a, 0xfcdfa0f79c183163, 0x0, 0x25dfdbfc, "", [@nested={0xc, 0x9e, 0x0, 0x1, [@nested={0x8, 0xe0, 0x0, 0x1, [@nested={0x4, 0x12b}]}]}]}, 0x1c}], 0x1, 0x0, 0x0, 0x48000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000200)={0xfffffff8, [[0x5, 0x80000001, 0x40020, 0x0, 0x7fff, 0x3, 0xfffffffe, 0x206], [0x4, 0xfffffffe, 0x0, 0x0, 0x2, 0x940f, 0x0, 0x7], [0x0, 0x2, 0x5, 0x3, 0x100, 0x0, 0x1, 0x4571]], '\x00', [{0x0, 0x1, 0x1}, {0x2, 0x1}, {0x80, 0x80000}, {0x9, 0x4}, {0x2, 0xb}, {0x38}, {0xa5, 0x230d}, {}, {0x0, 0x1}, {0x4000000}, {0x80000000, 0x4}, {0x0, 0x1}], '\x00', 0x10000, 0x0, 0x0, 0x0, 0x0, 0x5000000}) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x8, 0x0) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000000)) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_PIT(r6, 0x8048ae66, &(0x7f00000000c0)={[{0x0, 0x800, 0x0, 0x0, 0x0, 0x18, 0x7, 0x1, 0xa9, 0x4, 0x0, 0x0, 0x40000000}, {0x8, 0x5, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x6, 0xff, 0x0, 0x2, 0x6}, {0x3fe, 0x9, 0x0, 0xfd, 0x0, 0x0, 0xb3, 0x11, 0x3, 0xfe, 0x80, 0xf6, 0x7}], 0x205}) ioctl$KVM_RUN(r7, 0xae80, 0x0) preadv(r5, &(0x7f0000000080)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1, 0x7, 0x562) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66ba4300b006ee0f01c40f009b27000000b9800000c00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a000000328fe858b660002fb90d090000b800680000ba000000000f30", 0x5a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x4004550e, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 4.236084568s ago: executing program 7 (id=1334): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000240)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x10) 3.995981751s ago: executing program 7 (id=1335): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000a96000/0x3000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) iopl(0x3) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wg2\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2182, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendto$inet(r5, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x1ff, 0xffffffff, 0x7, 0x2000000, {0x7, 0xfc01, 0xa, 0x17a, 0x8, 0xc, 0x8, 0x20, 0x6, 0x9, 0x0, 0x7f7fffff, 0xfffffffd, 0x200, "d20bddda7d1db9342de76eec7967fe97752251560ed100"}}) 2.787478517s ago: executing program 7 (id=1336): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, &(0x7f0000000200)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x13, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000001480)='sys_enter\x00', r3}, 0x18) utimes(0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000024000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a140000001100010000000000000000000000000a"], 0x64}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @remote}}, 0x0, 0x0, 0x314, 0x1, 0x24}, 0x9c) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffc000/0x1000)=nil) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl812\x00', [0x4f27, 0x5, 0x10000, 0x4, 0x4, 0xcc7, 0x8, 0x7, 0xd, 0x100, 0x2, 0x1, 0x1, 0x1, 0x2745, 0x8, 0x0, 0x1a449, 0x3, 0x40000003, 0x89, 0xcaa7, 0x0, 0x20001e58, 0x9, 0xe69, 0x3c, 0x8, 0x6, 0x7, 0x2]}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r4, 0x942e, 0x0) 2.763374s ago: executing program 3 (id=1337): sendmmsg(0xffffffffffffffff, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000080)="18", 0x1, 0x0, &(0x7f0000000040)={0x11, 0xe, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) write$vga_arbiter(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[], 0xa) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000740)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, &(0x7f0000000100)=0x60, 0x2) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r7) ioctl$NBD_CLEAR_SOCK(0xffffffffffffffff, 0xab04) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000001c0)={0x0, @loopback, @remote}, &(0x7f0000000200)=0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x20000001) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x15, 0x8, &(0x7f0000001f80)=ANY=[@ANYBLOB="7a0af8ff7525732cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4054ce13f6fcc58912a175bd9cc3c494894ad39b36e34e608f4ac00cf22c27bb8c12bcf4beeb579fc9fa1c9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x20000, 0x0, 0x55, 0x0, &(0x7f0000000380)=""/85, 0x0, 0x4000000}, 0x50) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000140)={0x2, [0xad], 0xab}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x6, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB="b700000018000000bca30000000000002403000040feffff720af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000061140400000000001d430000000000007a0a00fe0000001f6114000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767912d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce0900000000000000499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc682928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348de20f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97b4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b4f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb1bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb36e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b78825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e8a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b60000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffff8, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001e80)=ANY=[@ANYBLOB="600000000301010300000000000000000000000804001080140005800f0001006e657462696f7392dd1d61003400198008"], 0x60}, 0x1, 0x0, 0x0, 0x20000800}, 0x802) 2.155975085s ago: executing program 2 (id=1338): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x5) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0xd02) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) 758.488596ms ago: executing program 5 (id=1339): setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000380)='percpu_alloc_percpu\x00'}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, 0x0, 0x0}, 0x94) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) migrate_pages(0x0, 0x8, &(0x7f0000000000)=0xfffffffffffffffe, &(0x7f0000000080)=0xc000) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x6d, 0x943201) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)=@usbdevfs_driver={0x5, 0xc295, &(0x7f00000008c0)="e44f2ea3edb3000a972bf3eb30798ff236223c13d946a22bde6fe9233bc7d71681f155f2fddf32adee73fd5565699ea865dffdd6d8de2f12a3a897d6fe1211e29aa2cfc41475df6aa60046b38c4fc12773a93e91713493f6e064f6715494e5db2bcc2510320bbc06884696725bb2cccf89"}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="2400000018000900000000000000"], 0x24}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)=r1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x13, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}, [@ldst={0x0, 0x3, 0x4, 0x2, 0x1, 0xfffffffffffffffc, 0x4}, @alu={0x7, 0x1, 0x7, 0xb, 0x8, 0x80, 0x4}, @ldst={0x0, 0x1, 0x0, 0x4, 0x9, 0xfffffffffffffff0, 0xfffffffffffffff0}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @alu={0x7, 0x1, 0x1, 0xa, 0x8, 0x30, 0x8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @map_fd={0x18, 0x4}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000000300)='syzkaller\x00', 0x5, 0x7b, &(0x7f00000003c0)=""/123, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000006c0)={0x4, 0x7, 0xdbd, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000740), 0x0, 0x10, 0x2}, 0x94) 758.235252ms ago: executing program 2 (id=1340): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x56b, 0xfffffffffffffffc}) fcntl$lock(r0, 0x24, &(0x7f0000000040)={0x2, 0x2, 0x1, 0x7}) 486.860715ms ago: executing program 2 (id=1341): socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r1, 0x0, 0x0) sendmmsg(r1, 0x0, 0x0, 0x800) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl(r4, 0xbffff000, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000080050005000200000011000300686173683a69702c706f7274"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 252.643246ms ago: executing program 7 (id=1342): sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r0, 0x0, 0x0) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1021, 0x400000000000f) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005000000000000", @ANYRES32, @ANYBLOB="000000001200000000000000", @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) 194.734986ms ago: executing program 3 (id=1343): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xe0, 0x3ed, 0x1, 0x70bd2a, 0x25dfdbff, "678155a356d7ae3680e4d07158b1c93f9e57ad74cc9dabcd2fe0069fc6f86f2dee79656ef0dbcbd9be12b8efee7f1d8cd234f4fbd5ef2d11c1d29c512dd5bced2fd3a31540d57a679695b82649cd16effd1a6c8418660e8e62f8f3bc62d6e8a2fb429d585a6f73bc0f7a866175967bf973fdbe0fb867699638073231c2e4ec1e023191a34ca2eb4bbba264352dd420f17206b2aabf4bfe1f48cccc53ba6d828a5cf1969021609e4dad030f314ddb9e885c3c8fd69f59f054415a2ef942f816e612375439e0a09e7b4deb8761fd3a69", ["", "", "", "", "", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x8}, 0x80c1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x5c, 0x0, &(0x7f0000000200)=[@increfs_done={0x40106308, 0x3}, @release={0x40046306, 0x2}, @dead_binder_done, @exit_looper, @acquire_done={0x40106309, 0x1}, @acquire={0x40046305, 0x2}, @acquire_done={0x40106309, 0x80}], 0x53, 0x0, &(0x7f0000000280)="e727b1f6fbaecf444ac7b49033274de89a4d583235c0638f0f8f528b358506281c8b5ff3a30d56a24d1c54bc011745607f10aea2c3fa456669a63342f7121926217ecb02cc4880b5f2b3ff1cc53b6667f912cb"}) ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000000340)={{r0}, "0a21f817c8139d6b92313aa2332e101977db611bd65cfef5af20e9cdd7dcb42b5418810caecaef8d886da4250963bd89f613270cbe2dfa034fb2696e7989735a310b38304b74ce03cf59943155a42020e95dbd1e707123b581cc4ad78588790932e61d7533c2a8dea596c794fd9a332dc7a8708f90b109a73b8f106fddd87629395d8f93a96c0415fda2bc062535b58569fc7302a068ed00a49156759b2f9de35198715b17365538b6ea8dbbf2851a3a079905192065c4e8f03ac4581c0f609ba9a28cf1250668b6a5330167411ccad4dcb39de8290bc0d2ee5d411315c3eaf091abce70eb7a7c820cfd56582550cec9460d21f76ef8148d1b1d061f88bc0af40f0a7c3ae846b3129a22188bf96d1ddd1d77a5107dd7a2ff6385ee9c791cd00c5c1434bc8b4a180e6f35815e6352d5282913273a7317602795ba9e670af581c0bb88b774afaa78b5a6b4e797439a7be660e4b6f77c499317d09bad4f9ed72e7d1180eedf7f0fbed0b991fe98b22411d646c1bdbcce2417ea38d38f098d148046641be1512f2e2d5793c3f00eaa47a7d1fd6b50ce70ef4bcd84158fc3dc97860ea3fd92685e6fdf55fc4f4d4efe9572a0469d5f77b349c8ac1f12b2709a00a75b8953be980a9280cc3b49c398c7f8e0814bc982bab98ed3cc1351873de413ca695969bf8de297b976fadc5d7ce699d645e4d4fea2a873b49c701345e86c3cc01f1c2e35d3ed69a7e3d165e4bbb0bce357ddaa58d46d1d0616a2a9b16a162ef224063a02050321e4f8a1b1a242597b34156cdc24e25e4e445e74d9dcb4a15a64ef4e4a91f23d405fe1dd876e9e84cf31e827b49b83c02aafe2a7e8e03ec5239e850759fb7e0b19b425480a3ee07daff1a659739bc53b7e046ef0a25fd574675066eec7ce6b86beb1a057ddf9996d4a9e77598c28a07e2a317c0afc3169971da2d8dc359c9b423ff21a261947e468fdb76f6c611c03da812461214727d3d7789fa4876313933a5b286e42e6a7b00acd2d6e04fae24e49143abc5b4bb8a1703d2119deda5d2b26bda3d16ecf57ac7299983466cc6c60f6cf975e075152f9ac837c28dd563016d9fdac6b86fdcf376e8777c8b922475538b251981e95be00cb11578cfa699b7edbd5d4ac4aa310f386e103cfd8a3222c11c3f3d355e3c5b706436bc5c03a4d105ddad0515ccb3202057024abfd7041ffeb51ce7bfee3a6f75a8ec440f2a4ef83c9743d4904c073daabe300bcfdad6a7956ad1818aa36a7b8fd4dbb4ebb8d2f2610548c74a47101c2274a8f797915014283e7e5465af645038eee0b59001100d74af7e0d830f2947404120403bc922c18e5d556c3b6d368e6bc967ac8ef5b409b129951def21fdfdaf7e94ee5664520e2b752466142d2f034c58b14918ae54b127d766bcd804b5a62e8170f1e852ea8cd1a718a28e7fe933444f8a83b31f935cacfd52594ae559f518f1f24c2c63ccee35fa1a9cb7e396e693715e2001b77ba52e8b97f8de1e12e85f9ab92a2567c24540daea2e7fdd2e0f506514a5c39983105c3ca39eeafb360ab50dd88509abfddf58412774165a1b49f3fc68f41d932442f6893359fe0e29f56b33ee6a1eb4b795ca1d08bdff3b62a8a099e0806f600b36d9a3ba6baca4d7900343163282be0708d7555b2014e8126a31d8c39dec30b083e82e3c8c3cdc894c9d3c0d6330e9b94c102fada88c111305a98a3980b5cb81138329afb9fcef5b4e695ae3dd43c8a217c191707428052f55341474f3dac34b0a6a068f29d3e3b6b5d7f63026e1db286ca3caff375cab1b5f1808bf0ec5322caea0d0d8cb1412ee2fb32fc68149d4efc104bf33747dbd52877c92ec4ac26d9cf093f8710ecb226ea79376484e6fbfec604662276dbd99a839ec21ac5707db3a84a11b17f11b7547f528f9f85b029a5f827d55b28413f02ad0c2ecd0566a7cad5b6f2307dfe3f34d82226b68e496321877ce1ba2b53359fe36b670acbe10b86c95432767cd68204a9b16b0c6ee0aa192cc4318e0efc9d8f047f439ff7246278f1cd6845a60fcc80832c134238364e040af48f505ec7a674bfee589701c9d7fd1f5e364043de4834ecdc3e995f96b9c63268e64bb2a6d675aeb13451fdf8616bb131d0a68bacb482141d9ed0c0c953ae77348e86ae4c93843ffa4b8abd027f1e8ad0c21d8724675f26ba04848ead7f803bafc064d04385aa149f91adc45770ddea0ea99dd22a66bab01f6018132bf146bb865b85e852bea25aaf054bf60ecc4610437bd2eff62633fc6bb6d2394b9f2681c2bc9cd9670f4a89c34b37dbb7a95e6fc7fdfaefd696df533c2c538fcca376ae35589cfcfc38ad9e103809b7aac11e746f3661470d356324dd17faad215d2fdbd703d45d79a863faaf03b668a779db1ff08e6b7cbeb0fd3a545dcbf091e33f6d75dfdf870bb0801fc2f2a383126993337387c5f03fa946cb732d3e39ec14515ac02ec11f379473bff57a469f56966c34cda38c057df35076e2e3987a28d9d2f9268683a7da2ddb2532a9d8ae83d45becf91756497c15274d12ba22bdcc9e14e08dcb9ca5483598b9be5d9d90ea6691b96d49bc039f393991aa4ecf8101e291590426b1e0527c5c0ef167b055c060a2ed5bef4e23278d2a00d91307b914c153114df26e47baa7dc257df6a6be8d6d69118ed0494d1b95f245bbbfb34c7805a66fbbbb3441cbacbf561d6af1ffb6a5737feebc6888ae222227d674bcf0b2a88722db91ac3c21a7b802e7f7dc6b2bd4067aec8883e615ce27b5894e8867924c7102f44bb7adbbc05d0a69226232985cb9f660a65ddec64089a3467981ede734f010152eb31826de8db1327ef81f4572dea58c36aa97a23b3e252b02e9274a6fc330655bb189a30cf7cfb982dabcdca0ca9f616c2d92735bb0073975e20ffd88df507c4a751df0f0d516a6aabceb95cabd7216cd0e7bed7d2174f857bc3349b198f99fb8fc62da14e7ebc5fc4cc7e36c94c22aaab25e94d59179adc22779a86ed7d67be29e9bb7accd254c64d10a39324b24d36a7a92af19ce97290185543d0da819d1f2a08cd2c6aa92d769840bbc55efb519598d5ea8865cdeb7357e1cf1fd61fadb74a5ba47517dd12c226bcbbdf9b9cb9dad81a26354a424b8b931280a5155c8368862eaf65f58ea01c02a4011f1bc38ffee3b8d449b139a37bdb12ed50e0aee4efda25a1674df99dc50312bae05a860467776c14e89036ac82d2b197d744db6a96194243f0535ed28e16a90a0258fb3bfd1d86f39a1474c2d85736b9f1c0e3f7f41f43943f47b73faddf8f47890bc52d8413ab5c736bb4844e4e3a800e6247da0d7ed4610613d17ef3ef713cab6e5669c2cbe79562a8acace5d7674a0b565ba48ae518c8b70fbc3238571ab4e045bd1eed22b1ab0defadfe06e229da84e12d8ef7010c3c847d38df4c7926fbacec616628df640c60b5754e1a6ea85ed4daff4dbcb39e0da04944d46678a3e7c94eabce92997cd48725157e534dc7f8c100a06bd0cf43c4a4079211b5f78be957462e39880d57e80e9a513aab40da245b76078f43430063903f2300528bd68d4488df9abb685517c389cb50d9840e4d3352883f2f3b39768068bea62a59856ee84ee3a3e2c47a9f266bbbf3cb148fddd122883fe767e943096abb16e8fb70bc759126fe6dc1fba79cc98c1ed7bcae02869a0d1818c5a609355e8eec63c04281bdf8cb0b44b6f8f824e866819d86642828de74bc14eb561864efa444da81a53156b54c7277540c5e83c77343805946e332d55d71b63f01b0b86f5a0899c5ab76765c029a5feebfe40eabccbe5b1fbdc2053c866ce5ff0d054adf61d512d6ecdf2810fd99e8d29ceb66b7d42106de133ad546b659e87c44e7915979ebbb63e15b1d734dd71389fa45519d7a323a0b4b6cc3e8d34d6390da8442a7b7d7d2fbfc9f7356c79d18292d88c96e2a9668344af653542686d5071cda2f90ac8d77864fddd8d00c630749616eb0d2a44a493cda3a8434c25c3a1173e094b51bc8066f159ee994b28723a04c22f4331e26e20be8d19d247606c8836362f596574121ea678e5d1c9e748f74da8ea96c0b11bf256829d69953611486fae95b83cae49846907671241a61c9abdee02ce9a27c9c014ba6f24aad3081baf84ba63b0711231f90cfff0802d195618b752c7ce3a856d445a9e8ce361009244fb5f7e02ac09ddc4c59206b964928dd946fbdf78c57bc7a20f82573c5887f01ab53eb12fa1c781192f3808255937caa2752d73f5780cdd54e763c4b0234d82fb68eb28a6cb6ab6106e859354f0c2cd79d3b39c7f5c2467b4ad17a62947450b626ddd21e32811f1c2c1434ff22c92041eb93ff450f0fdb4f7f00de793bed325b0e157642f45a41c5263170a27e5a5991f9727af5ffb718d0937114f123f5ca2403ec62174360b2b8992d5a7cbf217f2d9b36fcb0e730d52027aae0e54bbdafc8eb5af76812256b44844068ca3d36259f262155077795f928146199095401d9b2eee85ae7f09b781cbdc13829391b028d6285052259deddc112275a0c101b974b7ac0d3bb694768a965f392b3c97ad6f22c64ae5e61b85701f475379517bb248ef5f94f524c56d951bb77ad71e64cec8b502f1b6e668a65cf04d5c8ddf40bd27e6aefb23137e146795bc4d24ed552139803c52a8f38c7d659231c14df9234fb29dce81aab9d18a9235a72f2680c8d56eda18d95b63f496f2246f16afb591b4575398cfd7920ca63cc9a9c742c505f772c905fa2e0753e658d21ea2a43ffe1fb34164c2a32ddc2a3056016c7ec8e4c1ef7bcdd4a8cbdaba50daeec81810394388bf7cad7994e6ec714fe008aed5852f701379c3dabb25b62457f08853b167747a97fcad660df7df50ec70e064b8077a225e5e32b691ee2a750fe5ae5ae30019e75e0582b5c637bc9355f7f33f870af8061da143cdecd186cd0c33c9ce614ee01d1eb77e8693309fee778759941f6d157036f12d2f1dee85824f8bdc25ab27807d4c6f65a128f89aa068ef3ddcbaf997d6df3876c95d99eb59c233483086eee86635dfba5454fd69412a24377bb18cb128f999aef97035982ca2b8fe6b7f07b8ef2318c909fc2b75af215c773b08ec5b57cc810bc44f9fe9fa232d6e77651387f2dab52da1fa7109f6c757b1f79401cb9986f50041005143dfde6da896c60eef245c58efb8d0dccc7c121e3eba45a23e6142fe70fd69919be3615dc79b6da8aadf516adef21f5f4208876efbb03957009411bfac0c627e84e987fdbff3a315aabb612480a6ed9d1ab408e58c7a4cfaf2f39acdd09029d489bf0e030648fb620786bccc18c4f04386cf1213bf6ca2c4a7d3803308f6fff3c221359118eed43d09445ebca0ad39d46f515e620d6fb65c4f56a69cc28a3f15d5abc3de90ffde746d4e82ec742c5ed42381b9fb5e84c8335e0b2d7fc4a070d96d89897d9d88f664d4a0888d8fd2beddcab3e41c901dd04ecf6df115cfb072a38765fd7eea577cc5134105c8a41f4263067eb770525ccd874d072e2d5d212d77d79b2789a5aa1ae4b4696707a0ba128ae379860d94285e9b7cc93c36b453ac66cff0ec28cdf34bf9f991f911d6030a10cd648d29a08da1641b74e54c98e54506b815262a133aae580a42f8d362d9e98dafdbeaf47c88d76504258835cc4c81a7edf4a3d0fd9cb39083b170474764771545d99f16b2dbcd2bd31a007fa6d3eaa667ddc09b6771d4173e3fd02e9a15eddf43af9116f5d0f64e5f67a29072329b644a7e370dbdf170d043ae5b2852"}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000001340)) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0505510, &(0x7f0000001600)={0x5, 0xa, 0x8000, 0x34d, &(0x7f0000001380)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) r1 = gettid() ptrace$getregset(0x4204, r1, 0x4, &(0x7f00000016c0)={&(0x7f0000001680)}) open_by_handle_at(r0, &(0x7f0000001700)=@ceph_nfs_snapfh={0x1c, 0x4e, {0x0, 0xa39e, 0x2, 0xa9}}, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r2, &(0x7f0000001800)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x18, 0x140b, 0x2, 0x70bd26, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x40048840}, 0x0) setitimer(0x0, &(0x7f0000001840)={{0x77359400}}, &(0x7f0000001880)) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000018c0), 0x80e00, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000001900)={{0x1, 0x1, 0x18, r0, {0x5}}, './file0\x00'}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f0000001940)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000001d40)='wg1\x00', 0x4) sched_setscheduler(r1, 0x3, &(0x7f0000001d80)=0x80000000) sendmsg$IPSET_CMD_RENAME(r4, &(0x7f0000001e80)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001e40)={&(0x7f0000001e00)={0x20, 0x5, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x15}, 0x2400c005) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000001f00), r4) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000002100)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000020c0)={&(0x7f0000001f40)={0x16c, r5, 0x2, 0xfff, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000088) r6 = userfaultfd(0x800) ioctl$UFFDIO_CONTINUE(r6, 0xc020aa07, &(0x7f0000002140)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) unshare(0x800) getpid() syz_usb_connect$cdc_ecm(0x2, 0x7c, &(0x7f0000005500)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6a, 0x1, 0x1, 0x3, 0x80, 0x6, [{{0x9, 0x4, 0x0, 0xfb, 0x3, 0x2, 0x6, 0x0, 0xa, {{0x8, 0x24, 0x6, 0x0, 0x0, 'PE.'}, {0x5, 0x24, 0x0, 0xd}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x2, 0x8, 0x19}, [@mdlm={0x15, 0x24, 0x12, 0x40}, @network_terminal={0x7, 0x24, 0xa, 0xfb, 0x4, 0x6c}, @network_terminal={0x7, 0x24, 0xa, 0x2, 0x5, 0xcc, 0x6}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x9, 0x5, 0x4}}], {{0x9, 0x5, 0x82, 0x2, 0x3cf, 0x1, 0x61, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x5, 0x7, 0x9}}}}}]}}]}}, &(0x7f00000056c0)={0xa, &(0x7f0000005580)={0xa, 0x6, 0x310, 0x8, 0x2, 0x3, 0x10, 0x8}, 0x77, &(0x7f00000055c0)={0x5, 0xf, 0x77, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x7, 0x9, 0x7}, @generic={0x6b, 0x10, 0xa, "069d7f28736c5e7bc954991852082d4224480fb3dc7179d4b6015c2631d29b1b9604f68406e9b8d5cee448d046227c23a040628a8fcab5af07f60d7ca1da5218ae8008e7f2c6d05dd68b2f817b9b718229e97f2ec43eb6970ff3365724ce647e67ea36b135ac1dbc"}]}, 0x2, [{0x4, &(0x7f0000005640)=@lang_id={0x4, 0x3, 0x423}}, {0x4, &(0x7f0000005680)=@lang_id={0x4, 0x3, 0x449}}]}) 0s ago: executing program 7 (id=1344): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) r2 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80400) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=@setlink={0x28, 0x13, 0xbaa23f3d13f2d1f5, 0x3, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_TXQLEN={0x8, 0xd, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r8, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r8, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f80000002800010429bd7000ffdbdf25ac14141d0000000000000000000000006401010200000000000000000000000001040007000000000000a00000000000", @ANYRESDEC=r0, @ANYRES32=r7, @ANYBLOB="fe8800000000000000000000000001010000000032000000ac1414aa0000000000000000000000008abc483c0000000001000000000000000000000000000000090000000000000003000000000000000000000000000000000000000000000002000000000000000000000000000000fcffffffffffffff050000000000000001000000000000000008000000000000960000002bbd70000100000002000200860000000000000008000020ffffffdfe36cf1806d0944223131b23e7bac2482c413d25116b06226e1cf5f700746154bd65ee3df228b4c26cbe65fdd80f2e22f6578ebc5f357778326a0bc50cc93a6126236cec5f3170000000000000000"], 0xf8}}, 0x41000) kernel console output (not intermixed with test programs): 75.245547][ T9794] do_syscall_64+0xcd/0x4c0 [ 375.245570][ T9794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.245587][ T9794] RIP: 0033:0x7f04ffd8eba9 [ 375.245601][ T9794] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.245617][ T9794] RSP: 002b:00007f0500cdd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 375.245633][ T9794] RAX: ffffffffffffffda RBX: 00007f04fffd5fa0 RCX: 00007f04ffd8eba9 [ 375.245644][ T9794] RDX: 0000200000000600 RSI: 0000000080404518 RDI: 0000000000000003 [ 375.245654][ T9794] RBP: 00007f0500cdd090 R08: 0000000000000000 R09: 0000000000000000 [ 375.245669][ T9794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.245679][ T9794] R13: 00007f04fffd6038 R14: 00007f04fffd5fa0 R15: 00007ffd859a8fd8 [ 375.245726][ T9794] [ 375.245732][ T9794] ERROR: Out of memory at tomoyo_realpath_from_path. [ 375.394659][ C0] vkms_vblank_simulate: vblank timer overrun [ 375.478355][ T9652] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 375.524708][ T9801] FAULT_INJECTION: forcing a failure. [ 375.524708][ T9801] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 375.610726][ T9801] CPU: 0 UID: 0 PID: 9801 Comm: syz.3.956 Not tainted syzkaller #0 PREEMPT(full) [ 375.610753][ T9801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 375.610763][ T9801] Call Trace: [ 375.610768][ T9801] [ 375.610774][ T9801] dump_stack_lvl+0x16c/0x1f0 [ 375.610802][ T9801] should_fail_ex+0x512/0x640 [ 375.610833][ T9801] _copy_from_user+0x2e/0xd0 [ 375.610860][ T9801] copy_msghdr_from_user+0x98/0x160 [ 375.610882][ T9801] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 375.610908][ T9801] ? __lock_acquire+0x62e/0x1ce0 [ 375.610940][ T9801] ___sys_recvmsg+0xdb/0x1a0 [ 375.610966][ T9801] ? __pfx____sys_recvmsg+0x10/0x10 [ 375.610989][ T9801] ? find_held_lock+0x2b/0x80 [ 375.611025][ T9801] do_recvmmsg+0x2fe/0x750 [ 375.611048][ T9801] ? __pfx_do_recvmmsg+0x10/0x10 [ 375.611075][ T9801] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 375.611106][ T9801] ? __fget_files+0x20e/0x3c0 [ 375.611131][ T9801] __x64_sys_recvmmsg+0x22a/0x280 [ 375.611154][ T9801] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 375.611184][ T9801] do_syscall_64+0xcd/0x4c0 [ 375.611208][ T9801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.611225][ T9801] RIP: 0033:0x7f04ffd8eba9 [ 375.611239][ T9801] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.611256][ T9801] RSP: 002b:00007f0500cdd038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 375.611274][ T9801] RAX: ffffffffffffffda RBX: 00007f04fffd5fa0 RCX: 00007f04ffd8eba9 [ 375.611285][ T9801] RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000003 [ 375.611295][ T9801] RBP: 00007f0500cdd090 R08: 0000000000000000 R09: 0000000000000000 [ 375.611305][ T9801] R10: 0000000000002002 R11: 0000000000000246 R12: 0000000000000001 [ 375.611315][ T9801] R13: 00007f04fffd6038 R14: 00007f04fffd5fa0 R15: 00007ffd859a8fd8 [ 375.611337][ T9801] [ 375.830426][ T5859] Bluetooth: hci0: command tx timeout [ 375.866223][ T9809] FAULT_INJECTION: forcing a failure. [ 375.866223][ T9809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 375.887426][ T9809] CPU: 0 UID: 0 PID: 9809 Comm: syz.3.957 Not tainted syzkaller #0 PREEMPT(full) [ 375.887443][ T9809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 375.887449][ T9809] Call Trace: [ 375.887453][ T9809] [ 375.887458][ T9809] dump_stack_lvl+0x16c/0x1f0 [ 375.887477][ T9809] should_fail_ex+0x512/0x640 [ 375.887493][ T9809] _copy_from_user+0x2e/0xd0 [ 375.887510][ T9809] __sys_bpf+0x21d/0x4de0 [ 375.887526][ T9809] ? __pfx___sys_bpf+0x10/0x10 [ 375.887540][ T9809] ? ksys_write+0x190/0x250 [ 375.887553][ T9809] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 375.887575][ T9809] ? fput+0x9b/0xd0 [ 375.887589][ T9809] ? ksys_write+0x1ac/0x250 [ 375.887599][ T9809] ? __pfx_ksys_write+0x10/0x10 [ 375.887612][ T9809] __x64_sys_bpf+0x78/0xc0 [ 375.887626][ T9809] ? lockdep_hardirqs_on+0x7c/0x110 [ 375.887639][ T9809] do_syscall_64+0xcd/0x4c0 [ 375.887654][ T9809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.887665][ T9809] RIP: 0033:0x7f04ffd8eba9 [ 375.887674][ T9809] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.887684][ T9809] RSP: 002b:00007f0500cdd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 375.887694][ T9809] RAX: ffffffffffffffda RBX: 00007f04fffd5fa0 RCX: 00007f04ffd8eba9 [ 375.887701][ T9809] RDX: 0000000000000048 RSI: 0000200000000500 RDI: 000000000000000a [ 375.887707][ T9809] RBP: 00007f0500cdd090 R08: 0000000000000000 R09: 0000000000000000 [ 375.887713][ T9809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.887719][ T9809] R13: 00007f04fffd6038 R14: 00007f04fffd5fa0 R15: 00007ffd859a8fd8 [ 375.887732][ T9809] [ 376.547489][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 376.555749][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.433198][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.460848][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.543795][ T6015] block nbd4: Possible stuck request ffff888026abe000: control (read@0,1024B). Runtime 30 seconds [ 377.564193][ T6015] block nbd4: Possible stuck request ffff888026abe1c0: control (read@1024,1024B). Runtime 30 seconds [ 377.579414][ T6015] block nbd4: Possible stuck request ffff888026abe380: control (read@2048,1024B). Runtime 30 seconds [ 377.591346][ T6015] block nbd4: Possible stuck request ffff888026abe540: control (read@3072,1024B). Runtime 30 seconds [ 377.627103][ T9652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 377.708370][ T9652] 8021q: adding VLAN 0 to HW filter on device team0 [ 377.938039][ T5979] libceph: connect (1)[c::]:6789 error -101 [ 377.946489][ T5979] libceph: mon0 (1)[c::]:6789 connect error [ 377.956904][ T9832] FAULT_INJECTION: forcing a failure. [ 377.956904][ T9832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.979765][ T9828] ceph: No mds server is up or the cluster is laggy [ 378.014502][ T2902] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.021604][ T2902] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.031917][ T2902] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.039018][ T2902] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.051850][ T9832] CPU: 0 UID: 0 PID: 9832 Comm: syz.0.960 Not tainted syzkaller #0 PREEMPT(full) [ 378.051875][ T9832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 378.051885][ T9832] Call Trace: [ 378.051891][ T9832] [ 378.051898][ T9832] dump_stack_lvl+0x16c/0x1f0 [ 378.051925][ T9832] should_fail_ex+0x512/0x640 [ 378.051952][ T9832] _copy_from_user+0x2e/0xd0 [ 378.051978][ T9832] copy_msghdr_from_user+0x98/0x160 [ 378.052001][ T9832] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 378.052035][ T9832] ___sys_sendmsg+0xfe/0x1d0 [ 378.052058][ T9832] ? __pfx____sys_sendmsg+0x10/0x10 [ 378.052110][ T9832] __sys_sendmsg+0x16d/0x220 [ 378.052132][ T9832] ? __pfx___sys_sendmsg+0x10/0x10 [ 378.052170][ T9832] do_syscall_64+0xcd/0x4c0 [ 378.052194][ T9832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.052212][ T9832] RIP: 0033:0x7fe39a38eba9 [ 378.052225][ T9832] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 378.052241][ T9832] RSP: 002b:00007fe39b1e3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 378.052257][ T9832] RAX: ffffffffffffffda RBX: 00007fe39a5d5fa0 RCX: 00007fe39a38eba9 [ 378.052268][ T9832] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 378.052278][ T9832] RBP: 00007fe39b1e3090 R08: 0000000000000000 R09: 0000000000000000 [ 378.052288][ T9832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 378.052298][ T9832] R13: 00007fe39a5d6038 R14: 00007fe39a5d5fa0 R15: 00007ffe3c0af968 [ 378.052321][ T9832] [ 378.210312][ T5979] libceph: connect (1)[c::]:6789 error -101 [ 378.216352][ T5979] libceph: mon0 (1)[c::]:6789 connect error [ 378.414048][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.421401][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.898467][ T9652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.693893][ T9850] tmpfs: Unknown parameter '0x0000000000000007' [ 380.414629][ T30] audit: type=1400 audit(5272695760.254:909): avc: denied { ioctl } for pid=9841 comm="syz.0.961" path="socket:[25891]" dev="sockfs" ino=25891 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 380.703530][ T9] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 380.955352][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 381.066513][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 381.255703][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 381.369798][ T9] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 381.442336][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.459300][ T9] usb 1-1: Product: syz [ 381.477007][ T9] usb 1-1: Manufacturer: syz [ 381.482367][ T9] usb 1-1: SerialNumber: syz [ 381.520337][ T9] usb 1-1: config 0 descriptor?? [ 381.528353][ T9652] veth0_vlan: entered promiscuous mode [ 381.547680][ T9854] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 381.563666][ T9854] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 381.570330][ T9652] veth1_vlan: entered promiscuous mode [ 381.608246][ T9] usb 1-1: ucan: probing device on interface #0 [ 381.621020][ T9867] Illegal XDP return value 685426816 on prog (id 284) dev syz_tun, expect packet loss! [ 381.642408][ T9652] veth0_macvtap: entered promiscuous mode [ 381.725833][ T9652] veth1_macvtap: entered promiscuous mode [ 381.771701][ T9869] FAULT_INJECTION: forcing a failure. [ 381.771701][ T9869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 381.807236][ T9652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 381.833318][ T9652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 381.841242][ T9869] CPU: 0 UID: 0 PID: 9869 Comm: syz.3.968 Not tainted syzkaller #0 PREEMPT(full) [ 381.841262][ T9869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 381.841272][ T9869] Call Trace: [ 381.841277][ T9869] [ 381.841283][ T9869] dump_stack_lvl+0x16c/0x1f0 [ 381.841305][ T9869] should_fail_ex+0x512/0x640 [ 381.841326][ T9869] _copy_from_user+0x2e/0xd0 [ 381.841346][ T9869] copy_msghdr_from_user+0x98/0x160 [ 381.841367][ T9869] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 381.841388][ T9869] ? __pfx__kstrtoull+0x10/0x10 [ 381.841410][ T9869] ___sys_sendmsg+0xfe/0x1d0 [ 381.841432][ T9869] ? __pfx____sys_sendmsg+0x10/0x10 [ 381.841464][ T9869] ? find_held_lock+0x2b/0x80 [ 381.841500][ T9869] __sys_sendmmsg+0x200/0x420 [ 381.841525][ T9869] ? __pfx___sys_sendmmsg+0x10/0x10 [ 381.841554][ T9869] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 381.841594][ T9869] ? fput+0x9b/0xd0 [ 381.841617][ T9869] ? ksys_write+0x1ac/0x250 [ 381.841633][ T9869] ? __pfx_ksys_write+0x10/0x10 [ 381.841652][ T9869] __x64_sys_sendmmsg+0x9c/0x100 [ 381.841672][ T9869] ? lockdep_hardirqs_on+0x7c/0x110 [ 381.841691][ T9869] do_syscall_64+0xcd/0x4c0 [ 381.841714][ T9869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.841729][ T9869] RIP: 0033:0x7f04ffd8eba9 [ 381.841743][ T9869] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 381.841759][ T9869] RSP: 002b:00007f0500cdd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 381.841775][ T9869] RAX: ffffffffffffffda RBX: 00007f04fffd5fa0 RCX: 00007f04ffd8eba9 [ 381.841786][ T9869] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 381.841796][ T9869] RBP: 00007f0500cdd090 R08: 0000000000000000 R09: 0000000000000000 [ 381.841805][ T9869] R10: 0000000020000800 R11: 0000000000000246 R12: 0000000000000001 [ 381.841815][ T9869] R13: 00007f04fffd6038 R14: 00007f04fffd5fa0 R15: 00007ffd859a8fd8 [ 381.841834][ T9869] [ 382.037205][ C0] vkms_vblank_simulate: vblank timer overrun [ 382.057633][ T8871] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.068393][ T8871] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.122253][ T6042] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.135206][ T6042] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.174087][ T5904] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 382.815886][ T5904] usb 3-1: Using ep0 maxpacket: 16 [ 382.816073][ T9] ucan 1-1:0.0 can0: registered device [ 382.868608][ T5904] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 382.875474][ T30] audit: type=1400 audit(5272695762.984:910): avc: denied { mount } for pid=9872 comm="syz.5.969" name="/" dev="ramfs" ino=26979 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 382.902310][ T5904] usb 3-1: config 0 has no interface number 0 [ 382.917243][ T5904] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 382.931017][ T5904] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 382.943173][ T5904] usb 3-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 382.969849][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.224540][ T5904] usb 3-1: config 0 descriptor?? [ 383.236180][ T9880] netlink: 8 bytes leftover after parsing attributes in process `syz.0.963'. [ 383.263121][ T6042] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.296565][ T9880] netlink: 4 bytes leftover after parsing attributes in process `syz.0.963'. [ 383.333402][ T6042] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 384.003114][ T9] ucan 1-1:0.0 can0: firmware string: unknown [ 384.103566][ T6022] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 384.480903][ T5904] usbhid 3-1:0.1: can't add hid device: -71 [ 384.504240][ T6022] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 384.512592][ T5904] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 384.580712][ T5979] usb 1-1: USB disconnect, device number 19 [ 384.608382][ T5904] usb 3-1: USB disconnect, device number 24 [ 384.656914][ T5923] kernel read not supported for file /791/oom_adj (pid: 5923 comm: kworker/1:6) [ 384.736322][ T9900] overlayfs: failed lookup in lower (newroot/3, name='file1', err=-40): overlapping layers [ 384.851897][ T9900] 9p filesystem being mounted at /3/bus/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 386.478983][ T30] audit: type=1400 audit(5272696022.602:911): avc: denied { setopt } for pid=9919 comm="syz.0.979" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 388.102283][ T9934] loop2: detected capacity change from 0 to 7 [ 388.154667][ T5904] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 388.195284][ T5219] Dev loop2: unable to read RDB block 7 [ 388.200895][ T5219] loop2: AHDI p1 p2 p3 [ 388.247482][ T30] audit: type=1400 audit(5272696024.372:912): avc: denied { ioctl } for pid=9919 comm="syz.0.979" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 388.272422][ T5219] loop2: partition table partially beyond EOD, truncated [ 388.363024][ T5219] loop2: p1 start 1601398130 is beyond EOD, truncated [ 388.390899][ T5219] loop2: p2 start 1702059890 is beyond EOD, truncated [ 388.443142][ T5904] usb 1-1: device descriptor read/64, error -71 [ 388.451165][ T30] audit: type=1400 audit(5272696024.372:913): avc: denied { search } for pid=9938 comm="rm" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.044399][ T5219] Dev loop2: unable to read RDB block 7 [ 389.049992][ T5219] loop2: AHDI p1 p2 p3 [ 389.078768][ T30] audit: type=1400 audit(5272696024.372:914): avc: denied { search } for pid=9938 comm="rm" name="dhcpcd" dev="tmpfs" ino=1831 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.143652][ T5904] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 389.184471][ T30] audit: type=1400 audit(5272696024.372:915): avc: denied { search } for pid=9938 comm="rm" name="hook-state" dev="tmpfs" ino=1835 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.194157][ T5219] loop2: partition table partially beyond EOD, truncated [ 389.350748][ T5219] loop2: p1 start 1601398130 is beyond EOD, truncated [ 389.383554][ T5904] usb 1-1: device descriptor read/64, error -71 [ 389.403524][ T30] audit: type=1400 audit(5272696024.422:916): avc: denied { read write } for pid=5849 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 389.427601][ C0] vkms_vblank_simulate: vblank timer overrun [ 389.448984][ T5219] loop2: p2 start 1702059890 is beyond EOD, truncated [ 389.493823][ T5904] usb usb1-port1: attempt power cycle [ 389.550916][ T30] audit: type=1400 audit(5272696024.432:918): avc: denied { execmem } for pid=9939 comm="syz.6.982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 389.650157][ T30] audit: type=1400 audit(5272696024.422:917): avc: denied { open } for pid=5849 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 389.962623][ T30] audit: type=1400 audit(5272696024.442:919): avc: denied { ioctl } for pid=5849 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 390.458224][ T5904] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 390.466153][ T30] audit: type=1400 audit(5272696024.482:920): avc: denied { read } for pid=5514 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 390.489704][ T5904] usb 1-1: Using ep0 maxpacket: 16 [ 390.511572][ T5904] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 390.591802][ T5904] usb 1-1: config 0 has no interface number 0 [ 390.704596][ T5904] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 390.768583][ T5904] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 391.130128][ T5904] usb 1-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 391.363561][ T5904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.386026][ T5904] usb 1-1: config 0 descriptor?? [ 391.509455][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 391.509470][ T30] audit: type=1400 audit(5272696027.612:980): avc: denied { setopt } for pid=9990 comm="syz.3.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 391.716227][T10003] program syz.5.988 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 391.759987][ T30] audit: type=1400 audit(5272696027.612:981): avc: denied { getopt } for pid=9990 comm="syz.3.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 391.922135][ T30] audit: type=1400 audit(5272696027.622:982): avc: denied { write } for pid=9990 comm="syz.3.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 391.944166][ T30] audit: type=1400 audit(5272696027.652:983): avc: denied { remove_name } for pid=9998 comm="rm" name="resolv.conf.eth3.ipv4ll" dev="tmpfs" ino=6166 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 391.963613][ T5847] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 392.051109][ T5979] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 392.136802][ T30] audit: type=1400 audit(5272696027.652:984): avc: denied { unlink } for pid=9998 comm="rm" name="resolv.conf.eth3.ipv4ll" dev="tmpfs" ino=6166 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 392.163579][ T30] audit: type=1400 audit(5272696027.782:985): avc: denied { read write } for pid=9955 comm="syz.5.988" name="video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 392.417114][ T30] audit: type=1400 audit(5272696027.782:986): avc: denied { open } for pid=9955 comm="syz.5.988" path="/dev/video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 392.476349][ T5979] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 392.541902][ T5979] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 392.545299][ T30] audit: type=1400 audit(5272696027.842:987): avc: denied { read } for pid=9955 comm="syz.5.988" name="sg0" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 392.573826][ T5979] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.577641][ T5904] usbhid 1-1:0.1: can't add hid device: -71 [ 392.728318][T10013] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 392.913194][ T5904] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 392.926395][ T5979] usb 6-1: Product: syz [ 392.943572][ T5979] usb 6-1: Manufacturer: syz [ 392.955098][ T5979] usb 6-1: SerialNumber: syz [ 392.965997][ T5904] usb 1-1: USB disconnect, device number 22 [ 392.972846][ T5979] usb 6-1: config 0 descriptor?? [ 393.072025][ T5979] usb 6-1: can't set config #0, error -71 [ 393.131399][ T5979] usb 6-1: USB disconnect, device number 2 [ 393.160652][ T30] audit: type=1400 audit(5272696027.842:988): avc: denied { open } for pid=9955 comm="syz.5.988" path="/dev/sg0" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 393.360128][ T30] audit: type=1400 audit(5272696027.852:989): avc: denied { execute } for pid=9955 comm="syz.5.988" name="file1" dev="tmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 393.730116][T10022] FAULT_INJECTION: forcing a failure. [ 393.730116][T10022] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.775783][T10022] CPU: 1 UID: 0 PID: 10022 Comm: syz.0.1000 Not tainted syzkaller #0 PREEMPT(full) [ 393.775806][T10022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 393.775814][T10022] Call Trace: [ 393.775819][T10022] [ 393.775825][T10022] dump_stack_lvl+0x16c/0x1f0 [ 393.775846][T10022] should_fail_ex+0x512/0x640 [ 393.775867][T10022] _copy_from_user+0x2e/0xd0 [ 393.775887][T10022] __sys_bpf+0x21d/0x4de0 [ 393.775908][T10022] ? __pfx___sys_bpf+0x10/0x10 [ 393.775925][T10022] ? ksys_write+0x190/0x250 [ 393.775943][T10022] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 393.775973][T10022] ? fput+0x9b/0xd0 [ 393.775990][T10022] ? ksys_write+0x1ac/0x250 [ 393.776003][T10022] ? __pfx_ksys_write+0x10/0x10 [ 393.776020][T10022] __x64_sys_bpf+0x78/0xc0 [ 393.776037][T10022] ? lockdep_hardirqs_on+0x7c/0x110 [ 393.776054][T10022] do_syscall_64+0xcd/0x4c0 [ 393.776072][T10022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.776087][T10022] RIP: 0033:0x7fe39a38eba9 [ 393.776098][T10022] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 393.776111][T10022] RSP: 002b:00007fe39b1e3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 393.776125][T10022] RAX: ffffffffffffffda RBX: 00007fe39a5d5fa0 RCX: 00007fe39a38eba9 [ 393.776134][T10022] RDX: 0000000000000050 RSI: 00002000000008c0 RDI: 000000000000000a [ 393.776141][T10022] RBP: 00007fe39b1e3090 R08: 0000000000000000 R09: 0000000000000000 [ 393.776149][T10022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.776157][T10022] R13: 00007fe39a5d6038 R14: 00007fe39a5d5fa0 R15: 00007ffe3c0af968 [ 393.776175][T10022] [ 394.276708][T10042] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1002'. [ 394.505339][T10043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1003'. [ 394.658405][T10042] team1: entered promiscuous mode [ 394.743974][T10042] team1: entered allmulticast mode [ 396.783554][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 397.355375][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 397.355389][ T30] audit: type=1400 audit(5272696033.462:996): avc: denied { create } for pid=10065 comm="syz.2.1010" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 397.390464][ T30] audit: type=1400 audit(5272696033.462:997): avc: denied { connect } for pid=10065 comm="syz.2.1010" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 397.435597][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 397.435609][ T30] audit: type=1400 audit(5272696033.462:998): avc: denied { write } for pid=10065 comm="syz.2.1010" laddr=172.20.20.170 lport=16 faddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 397.435650][ T30] audit: type=1400 audit(5272696033.472:999): avc: denied { write } for pid=10067 comm="syz.3.1009" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 397.494318][ T9] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 397.494347][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.519449][ T9] usb 6-1: config 0 descriptor?? [ 397.607450][ T30] audit: type=1400 audit(5272696033.732:1000): avc: denied { create } for pid=10073 comm="syz.0.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.773126][ T30] audit: type=1400 audit(5272696033.752:1001): avc: denied { bind } for pid=10073 comm="syz.0.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.794206][ T30] audit: type=1400 audit(5272696033.762:1002): avc: denied { accept } for pid=10073 comm="syz.0.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.885426][ T30] audit: type=1400 audit(5272696033.762:1003): avc: denied { setopt } for pid=10073 comm="syz.0.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.897410][T10081] FAULT_INJECTION: forcing a failure. [ 397.897410][T10081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 397.909222][ T30] audit: type=1400 audit(5272696033.762:1004): avc: denied { write } for pid=10073 comm="syz.0.1011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.925114][T10081] CPU: 0 UID: 0 PID: 10081 Comm: syz.0.1014 Not tainted syzkaller #0 PREEMPT(full) [ 397.925137][T10081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 397.925146][T10081] Call Trace: [ 397.925151][T10081] [ 397.925157][T10081] dump_stack_lvl+0x16c/0x1f0 [ 397.925180][T10081] should_fail_ex+0x512/0x640 [ 397.925201][T10081] _copy_from_user+0x2e/0xd0 [ 397.925223][T10081] copy_msghdr_from_user+0x98/0x160 [ 397.925246][T10081] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 397.925268][T10081] ? __pfx__kstrtoull+0x10/0x10 [ 397.925288][T10081] ___sys_sendmsg+0xfe/0x1d0 [ 397.925308][T10081] ? __pfx____sys_sendmsg+0x10/0x10 [ 397.925336][T10081] ? find_held_lock+0x2b/0x80 [ 397.925368][T10081] __sys_sendmmsg+0x200/0x420 [ 397.925388][T10081] ? __pfx___sys_sendmmsg+0x10/0x10 [ 397.925413][T10081] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 397.925441][T10081] ? fput+0x9b/0xd0 [ 397.925460][T10081] ? ksys_write+0x1ac/0x250 [ 397.925475][T10081] ? __pfx_ksys_write+0x10/0x10 [ 397.925493][T10081] __x64_sys_sendmmsg+0x9c/0x100 [ 397.925515][T10081] ? lockdep_hardirqs_on+0x7c/0x110 [ 397.925533][T10081] do_syscall_64+0xcd/0x4c0 [ 397.925553][T10081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.925568][T10081] RIP: 0033:0x7fe39a38eba9 [ 397.925581][T10081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 397.925594][T10081] RSP: 002b:00007fe39b1e3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 397.925609][T10081] RAX: ffffffffffffffda RBX: 00007fe39a5d5fa0 RCX: 00007fe39a38eba9 [ 397.925619][T10081] RDX: 0000000000000001 RSI: 00002000000028c0 RDI: 0000000000000004 [ 397.925628][T10081] RBP: 00007fe39b1e3090 R08: 0000000000000000 R09: 0000000000000000 [ 397.925636][T10081] R10: 000000000004c015 R11: 0000000000000246 R12: 0000000000000001 [ 397.925645][T10081] R13: 00007fe39a5d6038 R14: 00007fe39a5d5fa0 R15: 00007ffe3c0af968 [ 397.925665][T10081] [ 397.991528][ T9] keytouch 0003:0926:3333.0009: fixing up Keytouch IEC report descriptor [ 397.999491][ T30] audit: type=1400 audit(5272696034.092:1005): avc: denied { setopt } for pid=10078 comm="syz.2.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 398.028263][ T9] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0009/input/input10 [ 398.658603][T10097] ALSA: mixer_oss: invalid OSS volume '' [ 399.704107][ T9] keytouch 0003:0926:3333.0009: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 399.737015][ T9] usb 6-1: USB disconnect, device number 3 [ 399.839400][T10106] fido_id[10106]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 400.114751][T10116] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1019'. [ 400.982693][T10130] netlink: 'syz.0.1023': attribute type 5 has an invalid length. [ 401.134056][T10128] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.155348][T10160] loop2: detected capacity change from 0 to 7 [ 402.191430][T10160] Dev loop2: unable to read RDB block 7 [ 402.234000][T10160] loop2: unable to read partition table [ 402.242775][T10160] loop2: partition table beyond EOD, truncated [ 402.254629][T10160] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 402.310013][ T5219] Dev loop2: unable to read RDB block 7 [ 402.334376][ T5219] loop2: unable to read partition table [ 402.346953][ T5219] loop2: partition table beyond EOD, truncated [ 402.373160][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 402.373175][ T30] audit: type=1400 audit(5272696038.492:1026): avc: denied { create } for pid=10163 comm="syz.2.1027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 403.114088][ T30] audit: type=1400 audit(5272696038.852:1027): avc: denied { connect } for pid=10168 comm="syz.0.1028" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 403.254369][ T30] audit: type=1400 audit(5272696039.282:1028): avc: denied { read } for pid=10163 comm="syz.2.1027" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 403.277584][ T30] audit: type=1400 audit(5272696039.282:1029): avc: denied { open } for pid=10163 comm="syz.2.1027" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 403.765556][ T30] audit: type=1400 audit(5272696039.282:1030): avc: denied { ioctl } for pid=10163 comm="syz.2.1027" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 404.053531][ T30] audit: type=1400 audit(5272696039.322:1031): avc: denied { write } for pid=10163 comm="syz.2.1027" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 405.085724][ T30] audit: type=1400 audit(5272696039.732:1032): avc: denied { ioctl } for pid=10163 comm="syz.2.1027" path="socket:[27679]" dev="sockfs" ino=27679 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 405.146518][ T30] audit: type=1400 audit(5272696040.372:1033): avc: denied { ioctl } for pid=10184 comm="syz.0.1031" path="socket:[27406]" dev="sockfs" ino=27406 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 405.250897][ T30] audit: type=1400 audit(5272696040.372:1034): avc: denied { bind } for pid=10184 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 405.553938][T10191] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1033'. [ 405.617745][ T30] audit: type=1400 audit(5272696040.372:1035): avc: denied { write } for pid=10184 comm="syz.0.1031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 406.163492][T10208] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1035'. [ 406.231142][ T5859] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 406.241045][ T5859] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 406.249774][ T5859] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 406.259138][ T5859] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 406.267560][ T5859] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 406.731034][T10212] chnl_net:caif_netlink_parms(): no params data found [ 406.847379][T10233] comedi comedi3: comedi_config --init_data is deprecated [ 407.341123][T10212] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.354530][T10212] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.368075][T10212] bridge_slave_0: entered allmulticast mode [ 407.422330][T10244] vim2m vim2m.0: Fourcc format (0x47425247) invalid. [ 407.460008][T10212] bridge_slave_0: entered promiscuous mode [ 407.624852][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 407.624869][ T30] audit: type=1400 audit(5272696043.732:1042): avc: denied { read } for pid=10230 comm="syz.5.1040" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 407.654869][T10212] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.664511][T10212] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.673374][ T6015] block nbd4: Possible stuck request ffff888026abe000: control (read@0,1024B). Runtime 60 seconds [ 407.684041][ T6015] block nbd4: Possible stuck request ffff888026abe1c0: control (read@1024,1024B). Runtime 60 seconds [ 407.684234][T10212] bridge_slave_1: entered allmulticast mode [ 407.695559][ T6015] block nbd4: Possible stuck request ffff888026abe380: control (read@2048,1024B). Runtime 60 seconds [ 407.712208][ T6015] block nbd4: Possible stuck request ffff888026abe540: control (read@3072,1024B). Runtime 60 seconds [ 407.747877][T10234] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1040'. [ 407.758135][T10212] bridge_slave_1: entered promiscuous mode [ 407.768277][ T30] audit: type=1400 audit(5272696043.732:1043): avc: denied { open } for pid=10230 comm="syz.5.1040" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 407.842230][T10251] netlink: 165 bytes leftover after parsing attributes in process `syz.0.1043'. [ 408.298157][ T5859] Bluetooth: hci6: command tx timeout [ 408.337040][ T30] audit: type=1400 audit(5272696043.842:1044): avc: denied { firmware_load } for pid=48 comm="kworker/u8:3" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 408.416864][T10238] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 408.425843][T10238] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 408.431050][T10212] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 408.458811][T10238] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 408.469438][T10212] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 408.495201][T10238] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 408.599316][ T30] audit: type=1400 audit(5272696044.722:1045): avc: denied { write } for pid=10252 comm="syz.3.1044" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 408.622557][ C0] vkms_vblank_simulate: vblank timer overrun [ 408.636317][T10212] team0: Port device team_slave_0 added [ 408.639785][T10238] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 408.649498][T10238] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 408.650952][T10212] team0: Port device team_slave_1 added [ 408.668781][T10261] comedi comedi3: comedi_config --init_data is deprecated [ 409.157130][ T30] audit: type=1400 audit(5272696044.722:1046): avc: denied { open } for pid=10252 comm="syz.3.1044" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 409.468701][T10238] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 409.605764][T10238] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 409.624508][T10212] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.645276][T10238] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 409.672871][T10212] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.710788][T10212] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.758700][T10212] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.777359][T10238] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 409.921304][T10271] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 410.042188][T10212] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 410.052534][T10273] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1044'. [ 410.068166][ C0] vkms_vblank_simulate: vblank timer overrun [ 410.068638][T10212] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 410.083176][T10238] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 410.154130][ T30] audit: type=1400 audit(5272696046.262:1047): avc: denied { bind } for pid=10268 comm="syz.2.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 410.173683][T10238] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 410.183083][ T30] audit: type=1400 audit(5272696046.262:1048): avc: denied { write } for pid=10268 comm="syz.2.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 410.263239][T10238] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 410.269311][ T30] audit: type=1400 audit(5272696046.332:1049): avc: denied { setopt } for pid=10268 comm="syz.2.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 410.446912][ T30] audit: type=1400 audit(5272696046.462:1050): avc: denied { ioctl } for pid=10276 comm="syz.5.1049" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=27601 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 410.472959][ C0] vkms_vblank_simulate: vblank timer overrun [ 410.490278][ T5859] Bluetooth: hci2: command 0x0406 tx timeout [ 410.498757][ T5859] Bluetooth: hci1: command 0x0406 tx timeout [ 410.537201][ T5854] Bluetooth: hci3: command 0x0406 tx timeout [ 410.543312][ T5859] Bluetooth: hci4: command 0x0406 tx timeout [ 410.733600][ T5854] Bluetooth: hci5: command 0x0c1a tx timeout [ 410.771224][T10212] hsr_slave_0: entered promiscuous mode [ 410.781099][T10212] hsr_slave_1: entered promiscuous mode [ 410.811745][T10212] debugfs: 'hsr0' already exists in 'hsr' [ 410.831352][T10212] Cannot create hsr debugfs directory [ 411.507806][T10286] ALSA: mixer_oss: invalid OSS volume '' [ 411.890221][ T5854] Bluetooth: hci0: command 0x0c1a tx timeout [ 412.052828][T10282] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1049'. [ 412.063075][ T5854] Bluetooth: hci6: command 0x040f tx timeout [ 412.080768][ T30] audit: type=1400 audit(5272696048.202:1051): avc: denied { ioctl } for pid=10276 comm="syz.5.1049" path="socket:[27857]" dev="sockfs" ino=27857 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 412.083161][T10277] fuse: Unknown parameter '' [ 412.105487][ C0] vkms_vblank_simulate: vblank timer overrun [ 412.375100][T10301] loop6: detected capacity change from 0 to 524287999 [ 412.477056][T10212] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 412.502094][T10212] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 412.531125][T10212] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 412.579813][T10212] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 412.773614][ T5904] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 412.781231][ T5854] Bluetooth: hci5: command 0x0c1a tx timeout [ 412.819064][T10212] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.848514][T10212] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.871481][T10212] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 412.882399][T10212] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 412.908209][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 412.908222][ T30] audit: type=1400 audit(5272696049.032:1058): avc: denied { create } for pid=10314 comm="syz.5.1057" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 412.945593][ T7551] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.952693][ T7551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.964097][ T5904] usb 1-1: Using ep0 maxpacket: 16 [ 412.983029][ T5904] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 413.010221][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 413.052797][ T5904] usb 1-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 413.074061][ T7551] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.081114][ T7551] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.099652][ T5904] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.149416][ T5904] usb 1-1: Product: syz [ 413.166224][ T5904] usb 1-1: Manufacturer: syz [ 413.196574][ T5904] usb 1-1: SerialNumber: syz [ 413.262180][ T5904] usb 1-1: config 0 descriptor?? [ 413.528703][ T5904] appledisplay 1-1:0.0: Error while getting initial brightness: -71 [ 413.579344][ T5904] appledisplay 1-1:0.0: probe with driver appledisplay failed with error -71 [ 413.614083][ T30] audit: type=1400 audit(5272696049.742:1059): avc: denied { read } for pid=10322 comm="syz.3.1058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 413.658756][ T5904] usb 1-1: USB disconnect, device number 23 [ 413.682259][ T30] audit: type=1400 audit(5272696049.742:1060): avc: denied { ioctl } for pid=10322 comm="syz.3.1058" path="socket:[28736]" dev="sockfs" ino=28736 ioctlcmd=0x8932 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 413.716760][ T30] audit: type=1400 audit(5272696049.812:1061): avc: denied { write } for pid=10324 comm="syz.2.1059" path="socket:[28741]" dev="sockfs" ino=28741 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 413.730094][T10212] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.881783][ T13] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.905326][ T30] audit: type=1400 audit(5272696050.022:1062): avc: denied { read } for pid=10327 comm="syz.3.1061" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 413.962994][ T30] audit: type=1400 audit(5272696050.022:1063): avc: denied { open } for pid=10327 comm="syz.3.1061" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 414.001644][ T30] audit: type=1400 audit(5272696050.032:1064): avc: denied { getopt } for pid=10327 comm="syz.3.1061" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 414.023559][ T30] audit: type=1400 audit(5272696050.122:1065): avc: denied { mount } for pid=10327 comm="syz.3.1061" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 414.092393][ T13] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.134021][ T5854] Bluetooth: hci6: command 0x040f tx timeout [ 414.250896][ T13] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.293043][T10336] comedi comedi3: comedi_config --init_data is deprecated [ 414.353311][ T30] audit: type=1400 audit(5272696050.472:1066): avc: denied { append } for pid=10337 comm="syz.5.1063" name="sg0" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 414.459087][ T30] audit: type=1400 audit(5272696050.472:1067): avc: denied { ioctl } for pid=10337 comm="syz.5.1063" path="/dev/sg0" dev="devtmpfs" ino=744 ioctlcmd=0x5387 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 414.484620][ C0] vkms_vblank_simulate: vblank timer overrun [ 414.853924][ T5854] Bluetooth: hci5: command 0x0c1a tx timeout [ 415.454230][ T13] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.632063][T10350] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1064'. [ 415.655858][T10350] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1064'. [ 415.665178][T10350] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1064'. [ 415.968118][T10212] veth0_vlan: entered promiscuous mode [ 415.986493][T10352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1065'. [ 416.018367][T10212] veth1_vlan: entered promiscuous mode [ 416.080071][T10212] veth0_macvtap: entered promiscuous mode [ 416.129392][T10212] veth1_macvtap: entered promiscuous mode [ 416.463757][ T5854] Bluetooth: hci6: command 0x040f tx timeout [ 416.512194][T10212] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 416.545552][T10212] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 416.674452][ T6042] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.728620][ T6042] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.737759][ T6042] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.750055][ T6042] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.457762][ T13] bridge_slave_1: left allmulticast mode [ 417.486863][ T13] bridge_slave_1: left promiscuous mode [ 417.514511][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.571836][ T13] bridge_slave_0: left allmulticast mode [ 417.598519][ T13] bridge_slave_0: left promiscuous mode [ 417.712360][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.938784][T10377] netlink: 'syz.3.1072': attribute type 5 has an invalid length. [ 418.227699][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 418.227713][ T30] audit: type=1400 audit(5272696054.342:1075): avc: denied { read write } for pid=10367 comm="syz.0.1069" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 418.277839][ T30] audit: type=1400 audit(5272696054.342:1076): avc: denied { open } for pid=10367 comm="syz.0.1069" path="/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 418.308061][ T30] audit: type=1400 audit(5272696054.342:1077): avc: denied { ioctl } for pid=10367 comm="syz.0.1069" path="/dev/binderfs/binder1" dev="binder" ino=8 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 418.372434][ T30] audit: type=1400 audit(5272696054.342:1078): avc: denied { set_context_mgr } for pid=10367 comm="syz.0.1069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 418.414635][ T30] audit: type=1400 audit(5272696054.342:1079): avc: denied { setopt } for pid=10367 comm="syz.0.1069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 418.435929][ T30] audit: type=1400 audit(5272696054.342:1080): avc: denied { getopt } for pid=10367 comm="syz.0.1069" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 418.536174][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 418.546704][ T5854] Bluetooth: hci6: command 0x040f tx timeout [ 418.555129][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 418.564628][ T13] bond0 (unregistering): Released all slaves [ 418.702309][ T30] audit: type=1400 audit(5272696054.822:1081): avc: denied { append } for pid=10380 comm="syz.2.1074" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 418.759495][T10383] netlink: 144 bytes leftover after parsing attributes in process `syz.5.1073'. [ 418.802863][ T30] audit: type=1400 audit(5272696054.922:1082): avc: denied { read } for pid=10380 comm="syz.2.1074" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 419.538531][T10396] ALSA: mixer_oss: invalid OSS volume '' [ 419.902048][ T2902] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 419.929688][ T2902] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.208203][ T13] hsr_slave_0: left promiscuous mode [ 420.473192][ T13] hsr_slave_1: left promiscuous mode [ 420.506253][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 420.543497][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 420.550999][T10407] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.1079'. [ 420.614366][ T5854] Bluetooth: hci6: command 0x040f tx timeout [ 420.624221][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 420.631612][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 420.698384][ T30] audit: type=1400 audit(5272696056.822:1083): avc: denied { create } for pid=10413 comm="syz.2.1081" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 420.750438][ T30] audit: type=1400 audit(5272696056.822:1084): avc: denied { ioctl } for pid=10413 comm="syz.2.1081" path="socket:[29222]" dev="sockfs" ino=29222 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 420.760329][ T13] veth1_macvtap: left promiscuous mode [ 420.862668][ T13] veth0_macvtap: left promiscuous mode [ 420.869501][ T13] veth1_vlan: left promiscuous mode [ 420.877811][ T13] veth0_vlan: left promiscuous mode [ 420.983653][ T5979] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 421.148301][ T5979] usb 4-1: Using ep0 maxpacket: 32 [ 421.155036][ T5979] usb 4-1: config 0 has an invalid interface number: 239 but max is 0 [ 421.182082][ T5979] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.232058][ T5979] usb 4-1: config 0 has no interface number 0 [ 421.239244][ T5979] usb 4-1: config 0 interface 239 altsetting 4 bulk endpoint 0x2 has invalid maxpacket 8 [ 421.258914][ T5979] usb 4-1: config 0 interface 239 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 421.282234][ T5979] usb 4-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xA9, changing to 0x89 [ 421.317001][ T5979] usb 4-1: config 0 interface 239 altsetting 4 endpoint 0x89 has invalid maxpacket 28648, setting to 1024 [ 421.328901][ T5979] usb 4-1: config 0 interface 239 altsetting 4 bulk endpoint 0x89 has invalid maxpacket 1024 [ 421.350258][ T5979] usb 4-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xD5, changing to 0x85 [ 421.393018][ T5979] usb 4-1: config 0 interface 239 altsetting 4 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 421.427933][ T5979] usb 4-1: config 0 interface 239 altsetting 4 endpoint 0x85 has invalid wMaxPacketSize 0 [ 421.482454][ T5979] usb 4-1: config 0 interface 239 has no altsetting 0 [ 421.518943][ T5979] usb 4-1: New USB device found, idVendor=105b, idProduct=1799, bcdDevice=36.e9 [ 421.542883][ T5979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.656861][ T5979] usb 4-1: Product: syz [ 421.661849][ T5979] usb 4-1: Manufacturer: syz [ 421.666642][ T5979] usb 4-1: SerialNumber: syz [ 421.683015][ T5979] usb 4-1: config 0 descriptor?? [ 421.693096][T10421] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 421.708649][T10421] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 421.753266][ T5854] Bluetooth: hci0: urb ffff88814c3d1c00 submission failed (90) [ 422.088963][ T13] team0 (unregistering): Port device team_slave_1 removed [ 422.182040][ T7540] usb 4-1: USB disconnect, device number 17 [ 422.290032][ T13] team0 (unregistering): Port device team_slave_0 removed [ 422.335939][T10433] netlink: 'syz.0.1084': attribute type 5 has an invalid length. [ 423.131292][T10424] veth0: entered promiscuous mode [ 423.136440][T10424] veth0: left promiscuous mode [ 423.171791][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 423.219325][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 423.290546][ T30] audit: type=1400 audit(5272696059.412:1085): avc: denied { mounton } for pid=10212 comm="syz-executor" path="/root/syzkaller.8jWD4I/syz-tmp" dev="sda1" ino=2053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 423.573370][ T30] audit: type=1400 audit(5272696059.412:1086): avc: denied { mount } for pid=10212 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 423.775971][T10457] FAULT_INJECTION: forcing a failure. [ 423.775971][T10457] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 423.789258][T10457] CPU: 0 UID: 0 PID: 10457 Comm: syz.5.1088 Not tainted syzkaller #0 PREEMPT(full) [ 423.789282][T10457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 423.789291][T10457] Call Trace: [ 423.789296][T10457] [ 423.789303][T10457] dump_stack_lvl+0x16c/0x1f0 [ 423.789328][T10457] should_fail_ex+0x512/0x640 [ 423.789353][T10457] _copy_from_user+0x2e/0xd0 [ 423.789379][T10457] restore_sigcontext+0xcb/0x6a0 [ 423.789401][T10457] ? __pfx_restore_sigcontext+0x10/0x10 [ 423.789441][T10457] ? __pfx_restore_altstack+0x10/0x10 [ 423.789474][T10457] __do_sys_rt_sigreturn+0x1bb/0x230 [ 423.789495][T10457] ? __pfx___do_sys_rt_sigreturn+0x10/0x10 [ 423.789525][T10457] do_syscall_64+0xcd/0x4c0 [ 423.789550][T10457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.789567][T10457] RIP: 0033:0x7fd70d12ada9 [ 423.789581][T10457] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 423.789597][T10457] RSP: 002b:00007fd70df81340 EFLAGS: 00000206 ORIG_RAX: 000000000000000f [ 423.789613][T10457] RAX: ffffffffffffffda RBX: 00007fd70d3d6090 RCX: 00007fd70d12ada9 [ 423.789624][T10457] RDX: 00007fd70df81340 RSI: 00007fd70df81470 RDI: 0000000000000021 [ 423.789634][T10457] RBP: 00007fd70df82090 R08: 0000000000000000 R09: 0000000000000000 [ 423.789643][T10457] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 423.789653][T10457] R13: 00007fd70d3d6128 R14: 00007fd70d3d6090 R15: 00007fff6a90ce98 [ 423.789674][T10457] [ 423.963833][ T30] audit: type=1400 audit(5272696059.412:1087): avc: denied { mount } for pid=10212 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 423.986021][ T30] audit: type=1400 audit(5272696059.412:1088): avc: denied { mounton } for pid=10212 comm="syz-executor" path="/root/syzkaller.8jWD4I/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 424.013172][ T30] audit: type=1400 audit(5272696059.412:1089): avc: denied { mounton } for pid=10212 comm="syz-executor" path="/root/syzkaller.8jWD4I/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=29265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 424.040814][ T30] audit: type=1400 audit(5272696059.412:1090): avc: denied { unmount } for pid=10212 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 424.060549][ T30] audit: type=1400 audit(5272696059.922:1091): avc: denied { mounton } for pid=10212 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 424.083671][ T30] audit: type=1400 audit(5272696059.922:1092): avc: denied { mount } for pid=10212 comm="syz-executor" name="/" dev="gadgetfs" ino=7594 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 424.106164][ T30] audit: type=1400 audit(5272696059.922:1093): avc: denied { mount } for pid=10212 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 424.146878][ T30] audit: type=1400 audit(5272696059.922:1094): avc: denied { mounton } for pid=10212 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 425.714882][T10479] netlink: 'syz.2.1094': attribute type 21 has an invalid length. [ 426.365049][T10485] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1094'. [ 426.965923][T10501] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1101'. [ 427.063682][ T5904] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 427.143962][ T5847] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 427.253570][ T5904] usb 6-1: Using ep0 maxpacket: 16 [ 427.269139][ T5904] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 427.290819][ T5904] usb 6-1: config 0 has no interface number 0 [ 427.318054][ T5904] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 427.358397][ T5847] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 427.361291][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.381239][ T5904] usb 6-1: Product: syz [ 427.386145][ T5904] usb 6-1: Manufacturer: syz [ 427.391017][ T5904] usb 6-1: SerialNumber: syz [ 427.393468][ T5847] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 427.407285][ T5904] usb 6-1: config 0 descriptor?? [ 427.432518][ T5847] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 427.452631][ T5847] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14129, setting to 64 [ 427.453327][ T5904] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 427.564259][ T5847] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 427.690205][ T5847] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 427.710297][ T5847] usb 1-1: Product: syz [ 427.750547][ T5847] usb 1-1: Manufacturer: syz [ 427.843129][ T5847] cdc_wdm 1-1:1.0: skipping garbage [ 427.848589][ T5847] cdc_wdm 1-1:1.0: skipping garbage [ 427.854353][ T5847] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 427.996554][T10515] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1103'. [ 428.104020][T10495] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=10495 comm=syz.0.1097 [ 428.173683][T10495] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10495 comm=syz.0.1097 [ 428.298042][T10494] loop4: detected capacity change from 0 to 524287935 [ 428.569248][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 428.569259][ T30] audit: type=1400 audit(5272696064.692:1098): avc: denied { unlink } for pid=10531 comm="syz.7.1105" name="#5a" dev="tmpfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 429.873502][ T30] audit: type=1400 audit(5272696064.722:1099): avc: denied { mount } for pid=10531 comm="syz.7.1105" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 429.895987][ T30] audit: type=1400 audit(5272696064.862:1100): avc: denied { kexec_image_load } for pid=10531 comm="syz.7.1105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 429.913528][ T5904] gspca_spca1528: reg_w err -71 [ 429.923549][ T5904] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 430.023637][ T5904] usb 6-1: USB disconnect, device number 4 [ 430.309267][ T5904] usb 1-1: USB disconnect, device number 24 [ 430.601471][ T30] audit: type=1400 audit(5272696066.702:1101): avc: denied { unmount } for pid=10212 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 430.621471][ C0] vkms_vblank_simulate: vblank timer overrun [ 430.657722][T10552] FAULT_INJECTION: forcing a failure. [ 430.657722][T10552] name failslab, interval 1, probability 0, space 0, times 0 [ 430.670802][T10552] CPU: 1 UID: 0 PID: 10552 Comm: syz.3.1109 Not tainted syzkaller #0 PREEMPT(full) [ 430.670816][T10552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 430.670822][T10552] Call Trace: [ 430.670826][T10552] [ 430.670830][T10552] dump_stack_lvl+0x16c/0x1f0 [ 430.670852][T10552] should_fail_ex+0x512/0x640 [ 430.670866][T10552] ? fs_reclaim_acquire+0xae/0x150 [ 430.670881][T10552] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 430.670897][T10552] should_failslab+0xc2/0x120 [ 430.670909][T10552] __kmalloc_noprof+0xd2/0x510 [ 430.670922][T10552] tomoyo_realpath_from_path+0xc2/0x6e0 [ 430.670939][T10552] ? tomoyo_profile+0x47/0x60 [ 430.670951][T10552] tomoyo_path_number_perm+0x245/0x580 [ 430.670964][T10552] ? tomoyo_path_number_perm+0x237/0x580 [ 430.670979][T10552] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 430.670993][T10552] ? find_held_lock+0x2b/0x80 [ 430.671017][T10552] ? find_held_lock+0x2b/0x80 [ 430.671029][T10552] ? hook_file_ioctl_common+0x145/0x410 [ 430.671043][T10552] ? __fget_files+0x20e/0x3c0 [ 430.671057][T10552] security_file_ioctl+0x9b/0x240 [ 430.671073][T10552] __x64_sys_ioctl+0xb7/0x210 [ 430.671090][T10552] do_syscall_64+0xcd/0x4c0 [ 430.671110][T10552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.671120][T10552] RIP: 0033:0x7f04ffd8eba9 [ 430.671129][T10552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 430.671140][T10552] RSP: 002b:00007f0500cdd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 430.671150][T10552] RAX: ffffffffffffffda RBX: 00007f04fffd5fa0 RCX: 00007f04ffd8eba9 [ 430.671157][T10552] RDX: 0000200000000080 RSI: 00000000c048aeca RDI: 0000000000000005 [ 430.671163][T10552] RBP: 00007f0500cdd090 R08: 0000000000000000 R09: 0000000000000000 [ 430.671169][T10552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 430.671175][T10552] R13: 00007f04fffd6038 R14: 00007f04fffd5fa0 R15: 00007ffd859a8fd8 [ 430.671188][T10552] [ 430.671192][T10552] ERROR: Out of memory at tomoyo_realpath_from_path. [ 431.624924][ T5904] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 432.703536][ T5904] usb 1-1: Using ep0 maxpacket: 16 [ 432.831518][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.860654][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.950594][ T5904] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 433.004059][ T5904] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 433.013894][T10576] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1114'. [ 433.075186][ T5904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.122619][T10581] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1115'. [ 433.236953][T10581] team4: entered promiscuous mode [ 433.242067][T10581] team4: entered allmulticast mode [ 433.455532][ T5904] usb 1-1: config 0 descriptor?? [ 433.472750][T10555] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1108'. [ 433.584694][T10559] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 433.603060][T10559] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 433.614537][T10559] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 433.628652][T10559] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 433.649732][T10559] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 433.666459][T10559] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 433.694613][T10588] veth0: entered promiscuous mode [ 433.701939][ T5904] usbhid 1-1:0.0: can't add hid device: -71 [ 433.729947][ T5904] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 433.763355][T10587] veth0: left promiscuous mode [ 433.824281][T10593] veth0: entered promiscuous mode [ 433.857223][ T5904] usb 1-1: USB disconnect, device number 25 [ 433.979021][T10599] comedi comedi3: comedi_config --init_data is deprecated [ 433.992159][T10600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1121'. [ 434.256452][T10592] veth0: left promiscuous mode [ 434.536300][ T30] audit: type=1400 audit(5272696070.662:1102): avc: denied { read write } for pid=10603 comm="syz.7.1123" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 434.563082][ T30] audit: type=1400 audit(5272696070.662:1103): avc: denied { open } for pid=10603 comm="syz.7.1123" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 434.586781][ C0] vkms_vblank_simulate: vblank timer overrun [ 434.608652][ T30] audit: type=1400 audit(5272696070.682:1104): avc: denied { ioctl } for pid=10603 comm="syz.7.1123" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x552c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 435.534859][T10640] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1128'. [ 435.612871][T10641] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1129'. [ 435.653612][ T5854] Bluetooth: hci5: command 0x0c1a tx timeout [ 435.660405][ T5854] Bluetooth: hci3: command 0x0406 tx timeout [ 435.666696][ T5854] Bluetooth: hci4: command 0x0406 tx timeout [ 435.669884][T10641] team5: entered promiscuous mode [ 435.672807][ T5854] Bluetooth: hci2: command 0x0406 tx timeout [ 435.677851][T10641] team5: entered allmulticast mode [ 435.734318][ T5859] Bluetooth: hci6: command 0x040f tx timeout [ 435.928152][T10631] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 435.939597][T10631] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 435.947885][T10631] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 435.960180][T10631] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 436.004804][T10631] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 436.034334][T10631] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 436.075375][ T30] audit: type=1400 audit(5272696072.192:1105): avc: denied { append } for pid=10642 comm="syz.5.1130" name="001" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 436.107191][T10643] usb usb1: usbfs: process 10643 (syz.5.1130) did not claim interface 4 before use [ 436.138371][ T30] audit: type=1400 audit(5272696072.252:1106): avc: denied { read append } for pid=10646 comm="syz.3.1131" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 436.201899][ T30] audit: type=1400 audit(5272696072.252:1107): avc: denied { open } for pid=10646 comm="syz.3.1131" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 436.226084][ T30] audit: type=1400 audit(5272696072.252:1108): avc: denied { ioctl } for pid=10646 comm="syz.3.1131" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 436.258049][ T5859] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 436.423605][ T5904] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 437.096955][ T5904] usb 4-1: not running at top speed; connect to a high speed hub [ 437.125463][ T5904] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 437.136873][ T5904] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x82 has invalid maxpacket 975, setting to 64 [ 437.192762][ T5904] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 437.216032][T10656] comedi comedi3: comedi_config --init_data is deprecated [ 437.226172][ T5904] usb 4-1: config 1 interface 0 has no altsetting 0 [ 437.236249][ T5904] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 437.245830][ T5904] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.255480][ T5904] usb 4-1: Product: syz [ 437.262496][ T5904] usb 4-1: Manufacturer: щ [ 437.272660][ T5904] usb 4-1: SerialNumber: syz [ 437.399484][T10647] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 437.603764][ T5859] Bluetooth: hci1: command 0x0406 tx timeout [ 437.644218][T10647] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 437.667413][T10647] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 437.681745][T10659] tmpfs: Bad value for 'usrquota_inode_hardlimit' [ 437.973635][ T5859] Bluetooth: hci3: command 0x0406 tx timeout [ 437.979712][ T5859] Bluetooth: hci4: command 0x0406 tx timeout [ 437.985735][ T5854] Bluetooth: hci2: command 0x0406 tx timeout [ 438.053514][ T50] Bluetooth: hci6: command 0x040f tx timeout [ 438.059560][ T50] Bluetooth: hci5: command 0x0c1a tx timeout [ 438.647869][ T9822] block nbd4: Possible stuck request ffff888026abe000: control (read@0,1024B). Runtime 90 seconds [ 438.658963][ T9822] block nbd4: Possible stuck request ffff888026abe1c0: control (read@1024,1024B). Runtime 90 seconds [ 438.703365][ T9822] block nbd4: Possible stuck request ffff888026abe380: control (read@2048,1024B). Runtime 90 seconds [ 438.747461][ T9822] block nbd4: Possible stuck request ffff888026abe540: control (read@3072,1024B). Runtime 90 seconds [ 439.070759][ T30] audit: type=1400 audit(5272696075.192:1109): avc: denied { write } for pid=10663 comm="syz.0.1137" name="/" dev="9p" ino=17889801302421081418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 439.150464][ T30] audit: type=1400 audit(5272696075.272:1110): avc: denied { add_name } for pid=10663 comm="syz.0.1137" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 439.171245][ C0] vkms_vblank_simulate: vblank timer overrun [ 439.202210][ T5904] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 439.228423][ T30] audit: type=1400 audit(5272696075.302:1111): avc: denied { create } for pid=10663 comm="syz.0.1137" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 439.243795][ T5904] usb 4-1: USB disconnect, device number 18 [ 439.503471][ T7540] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 439.585325][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.591729][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.668937][ T7540] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 439.678280][ T7540] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.687402][ T7540] usb 3-1: Product: syz [ 439.691719][ T7540] usb 3-1: Manufacturer: syz [ 439.698475][ T7540] usb 3-1: SerialNumber: syz [ 439.712756][ T7540] usb 3-1: config 0 descriptor?? [ 439.723195][ T7540] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 025 [ 439.844050][T10679] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1141'. [ 439.943520][T10679] team1: entered promiscuous mode [ 439.948621][T10679] team1: entered allmulticast mode [ 440.184009][T10683] FAULT_INJECTION: forcing a failure. [ 440.184009][T10683] name failslab, interval 1, probability 0, space 0, times 0 [ 440.197162][T10683] CPU: 0 UID: 0 PID: 10683 Comm: syz.3.1142 Not tainted syzkaller #0 PREEMPT(full) [ 440.197187][T10683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 440.197197][T10683] Call Trace: [ 440.197203][T10683] [ 440.197209][T10683] dump_stack_lvl+0x16c/0x1f0 [ 440.197237][T10683] should_fail_ex+0x512/0x640 [ 440.197257][T10683] ? fs_reclaim_acquire+0xae/0x150 [ 440.197280][T10683] ? tomoyo_encode2+0x100/0x3e0 [ 440.197304][T10683] should_failslab+0xc2/0x120 [ 440.197324][T10683] __kmalloc_noprof+0xd2/0x510 [ 440.197341][T10683] ? d_absolute_path+0x136/0x1a0 [ 440.197369][T10683] tomoyo_encode2+0x100/0x3e0 [ 440.197396][T10683] tomoyo_encode+0x29/0x50 [ 440.197419][T10683] tomoyo_realpath_from_path+0x18f/0x6e0 [ 440.197452][T10683] tomoyo_mount_acl+0x664/0x850 [ 440.197474][T10683] ? bpf_ksym_find+0x127/0x1c0 [ 440.197499][T10683] ? is_bpf_text_address+0x94/0x1a0 [ 440.197520][T10683] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 440.197540][T10683] ? __kernel_text_address+0xd/0x40 [ 440.197559][T10683] ? unwind_get_return_address+0x59/0xa0 [ 440.197579][T10683] ? arch_stack_walk+0xa6/0x100 [ 440.197622][T10683] ? tomoyo_init_request_info+0x1f3/0x370 [ 440.197643][T10683] ? tomoyo_init_request_info+0x233/0x370 [ 440.197667][T10683] tomoyo_mount_permission+0x16d/0x420 [ 440.197688][T10683] ? tomoyo_mount_permission+0x14f/0x420 [ 440.197712][T10683] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 440.197751][T10683] security_sb_mount+0x9b/0x260 [ 440.197776][T10683] path_mount+0x15f/0x2000 [ 440.197802][T10683] ? __pfx_path_mount+0x10/0x10 [ 440.197824][T10683] ? kmem_cache_free+0x2d1/0x4d0 [ 440.197839][T10683] ? putname+0x154/0x1a0 [ 440.197865][T10683] ? putname+0x154/0x1a0 [ 440.197889][T10683] ? __x64_sys_mount+0x28d/0x310 [ 440.197909][T10683] __x64_sys_mount+0x28d/0x310 [ 440.197930][T10683] ? __pfx___x64_sys_mount+0x10/0x10 [ 440.197958][T10683] do_syscall_64+0xcd/0x4c0 [ 440.197981][T10683] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.198006][T10683] RIP: 0033:0x7f04ffd8eba9 [ 440.198020][T10683] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 440.198035][T10683] RSP: 002b:00007f0500cbc038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 440.198052][T10683] RAX: ffffffffffffffda RBX: 00007f04fffd6090 RCX: 00007f04ffd8eba9 [ 440.198063][T10683] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000140 [ 440.198073][T10683] RBP: 00007f0500cbc090 R08: 0000000000000000 R09: 0000000000000000 [ 440.198082][T10683] R10: 0000000002208004 R11: 0000000000000246 R12: 0000000000000002 [ 440.198092][T10683] R13: 00007f04fffd6128 R14: 00007f04fffd6090 R15: 00007ffd859a8fd8 [ 440.198115][T10683] [ 440.198709][T10683] ERROR: Out of memory at tomoyo_realpath_from_path. [ 440.234289][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 440.234302][ T30] audit: type=1400 audit(5272696076.242:1114): avc: denied { create } for pid=10680 comm="syz.3.1142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 440.743700][ T7540] (null): failure reading functionality [ 440.803310][ T7540] i2c i2c-1: connected i2c-tiny-usb device [ 441.355151][T10698] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1146'. [ 441.518014][ T30] audit: type=1400 audit(5272696077.462:1115): avc: denied { ioctl } for pid=10687 comm="syz.0.1144" path="socket:[30790]" dev="sockfs" ino=30790 ioctlcmd=0x661b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 441.601716][ T30] audit: type=1400 audit(5272696077.722:1116): avc: denied { write } for pid=10701 comm="syz.7.1147" path="socket:[30795]" dev="sockfs" ino=30795 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 441.616560][ T5904] usb 3-1: USB disconnect, device number 25 [ 441.824432][ T7540] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 441.997354][ T7540] usb 1-1: Using ep0 maxpacket: 32 [ 442.044724][ T7540] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.059119][ T7540] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.069718][ T7540] usb 1-1: config 0 interface 0 has no altsetting 0 [ 442.081544][ T7540] usb 1-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 442.116125][ T7540] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 442.247144][ T7540] usb 1-1: Product: syz [ 442.254427][ T7540] usb 1-1: config 0 descriptor?? [ 442.281822][T10714] SELinux: Context system_u:object_r:lib_t:s0 is not valid (left unmapped). [ 442.292884][ T30] audit: type=1400 audit(5272696078.422:1117): avc: denied { relabelto } for pid=10712 comm="syz.7.1150" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:lib_t:s0" [ 442.319144][ C0] vkms_vblank_simulate: vblank timer overrun [ 442.765636][ T7540] waterforce 0003:1044:7A4D.000A: unknown main item tag 0x0 [ 442.796771][ T7540] waterforce 0003:1044:7A4D.000A: unknown main item tag 0x0 [ 442.803510][ T30] audit: type=1400 audit(5272696078.422:1118): avc: denied { associate } for pid=10712 comm="syz.7.1150" name="kvm" dev="devtmpfs" ino=84 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 srawcon="system_u:object_r:lib_t:s0" [ 442.804589][ T7540] waterforce 0003:1044:7A4D.000A: item fetching failed at offset 2/5 [ 443.722263][ T30] audit: type=1400 audit(5272696079.842:1119): avc: denied { map } for pid=10720 comm="syz.2.1151" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 443.749374][T10724] binder: BINDER_SET_CONTEXT_MGR already set [ 443.782171][ T7540] waterforce 0003:1044:7A4D.000A: hid parse failed with -22 [ 443.787859][T10724] binder: 10720:10724 ioctl 4018620d 200000004a80 returned -16 [ 443.791876][ T7540] waterforce 0003:1044:7A4D.000A: probe with driver waterforce failed with error -22 [ 443.998517][ T5847] usb 1-1: USB disconnect, device number 26 [ 444.019929][T10732] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1154'. [ 444.171555][T10732] team2: entered promiscuous mode [ 444.176885][T10732] team2: entered allmulticast mode [ 444.723628][ T30] audit: type=1400 audit(5272696080.842:1120): avc: denied { read } for pid=10725 comm="syz.3.1153" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:lib_t:s0" [ 444.880120][ T30] audit: type=1400 audit(5272696080.842:1121): avc: denied { open } for pid=10725 comm="syz.3.1153" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:lib_t:s0" [ 445.002389][ T30] audit: type=1400 audit(5272696080.842:1122): avc: denied { ioctl } for pid=10725 comm="syz.3.1153" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:lib_t:s0" [ 445.058699][T10741] overlayfs: failed to resolve './bus': -2 [ 446.755404][T10752] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 446.803665][T10752] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 446.833637][T10752] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 446.839719][T10752] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 446.937466][T10752] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 446.953526][ T30] audit: type=1400 audit(5272696083.072:1123): avc: denied { read append } for pid=10768 comm="syz.3.1162" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 446.979723][T10752] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 446.995205][T10770] fuse: Bad value for 'fd' [ 447.013608][ T30] audit: type=1400 audit(5272696083.072:1124): avc: denied { open } for pid=10768 comm="syz.3.1162" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 447.037989][ T30] audit: type=1400 audit(5272696083.072:1125): avc: denied { ioctl } for pid=10768 comm="syz.3.1162" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 447.064514][ T30] audit: type=1400 audit(5272696083.122:1126): avc: denied { mounton } for pid=10766 comm="syz.0.1161" path="/248/file0" dev="tmpfs" ino=1334 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 447.167918][ T30] audit: type=1400 audit(5272696083.292:1127): avc: denied { create } for pid=10773 comm="syz.3.1163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 447.195667][T10776] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 447.227946][T10775] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1164'. [ 447.246435][T10776] audit: out of memory in audit_log_start [ 447.456750][T10784] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1165'. [ 447.536091][ T30] audit: type=1400 audit(5272696083.662:1128): avc: denied { shutdown } for pid=10782 comm="syz.2.1165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 447.858617][T10790] Bluetooth: MGMT ver 1.23 [ 447.865359][ T30] audit: type=1400 audit(5272696083.992:1129): avc: denied { write } for pid=10791 comm="syz.7.1167" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:lib_t:s0" [ 448.773864][ T5859] Bluetooth: hci1: command 0x0406 tx timeout [ 448.863593][ T5859] Bluetooth: hci3: command 0x0406 tx timeout [ 448.869640][ T5859] Bluetooth: hci4: command 0x0406 tx timeout [ 448.875702][ T50] Bluetooth: hci2: command 0x0406 tx timeout [ 448.941251][ T30] audit: type=1400 audit(5272696085.022:1130): avc: denied { create } for pid=10791 comm="syz.7.1167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 449.024675][ T5854] Bluetooth: hci5: command 0x0c1a tx timeout [ 449.030732][ T5859] Bluetooth: hci6: command 0x040f tx timeout [ 449.491741][T10812] program syz.0.1170 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 449.492112][T10812] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 450.403696][ T5897] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 450.474518][T10823] netlink: 'syz.2.1172': attribute type 8 has an invalid length. [ 450.605520][ T5897] usb 1-1: not running at top speed; connect to a high speed hub [ 450.704537][ T5897] usb 1-1: config 1 interface 0 altsetting 251 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 450.739862][ T5897] usb 1-1: config 1 interface 0 altsetting 251 endpoint 0x82 has invalid maxpacket 975, setting to 64 [ 450.858424][ T5897] usb 1-1: config 1 interface 0 altsetting 251 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 450.983837][T10831] netlink: 'syz.3.1174': attribute type 22 has an invalid length. [ 451.004268][ T5897] usb 1-1: config 1 interface 0 has no altsetting 0 [ 451.491377][ T5897] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 451.670081][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.706387][ T5897] usb 1-1: Product: syz [ 451.807051][ T5897] usb 1-1: Manufacturer: щ [ 451.811590][ T5897] usb 1-1: SerialNumber: syz [ 452.378825][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 452.378844][ T30] audit: type=1400 audit(5272696088.462:1137): avc: denied { create } for pid=10848 comm="syz.3.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 452.444936][T10849] smc: net device bond0 erased user defined pnetid SYZ0 [ 453.218090][ T30] audit: type=1400 audit(5272696089.312:1138): avc: denied { listen } for pid=10839 comm="syz.2.1176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 453.293034][ T5897] usb 1-1: can't set config #1, error -71 [ 453.334877][ T5897] usb 1-1: USB disconnect, device number 27 [ 453.395868][T10857] Failed to get privilege flags for destination (handle=0x2:0x3e) [ 453.408774][ T30] audit: type=1400 audit(5272696089.532:1139): avc: denied { write } for pid=10856 comm="syz.0.1180" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 453.586167][ T30] audit: type=1400 audit(5272696089.582:1140): avc: denied { accept } for pid=10839 comm="syz.2.1176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 454.061968][ T30] audit: type=1400 audit(5272696090.172:1141): avc: denied { read } for pid=10861 comm="syz.0.1181" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 454.183292][ T30] audit: type=1400 audit(5272696090.222:1142): avc: denied { write } for pid=10861 comm="syz.0.1181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 454.382612][ T5897] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 454.466896][ T30] audit: type=1400 audit(5272696090.242:1143): avc: denied { ioctl } for pid=10861 comm="syz.0.1181" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d0c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 454.545545][ T5897] usb 6-1: Using ep0 maxpacket: 8 [ 454.565550][ T5897] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.620918][ T5897] usb 6-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 454.670663][ T5897] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.701875][ T5897] usb 6-1: config 0 descriptor?? [ 454.703480][ T7519] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 455.253274][ T30] audit: type=1400 audit(5272696091.372:1144): avc: denied { write } for pid=10887 comm="syz.3.1186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 455.375131][ T7519] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 455.390609][ T7519] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 455.433700][ T7519] usb 8-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 455.442769][ T7519] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.569599][ T7519] usb 8-1: config 0 descriptor?? [ 455.616543][ T5859] Bluetooth: hci2: unexpected event for opcode 0xffff [ 455.799293][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 455.852493][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 455.929986][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 455.991416][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 455.997901][ T7519] zydacron 0003:13EC:0006.000C: unknown main item tag 0x1 [ 456.057440][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 456.077175][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 456.115046][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 456.122302][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 456.153569][ T7519] zydacron 0003:13EC:0006.000C: item fetching failed at offset 2/5 [ 456.180221][ T5897] megaworld 0003:07B5:0312.000B: unknown main item tag 0x0 [ 456.185295][ T30] audit: type=1400 audit(5272696092.302:1145): avc: denied { unmount } for pid=5845 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 456.232993][ T7519] zydacron 0003:13EC:0006.000C: parse failed [ 456.249727][ T5897] megaworld 0003:07B5:0312.000B: collection stack underflow [ 456.249786][ T7519] zydacron 0003:13EC:0006.000C: probe with driver zydacron failed with error -22 [ 456.305189][ T5897] megaworld 0003:07B5:0312.000B: item 0 0 0 12 parsing failed [ 456.329467][T10875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.334128][ T5897] megaworld 0003:07B5:0312.000B: parse failed [ 456.381445][ T5897] megaworld 0003:07B5:0312.000B: probe with driver megaworld failed with error -22 [ 456.422509][T10875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.444668][ T5897] usb 6-1: USB disconnect, device number 5 [ 456.574346][ T7519] usb 8-1: USB disconnect, device number 2 [ 456.663507][ T5979] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 456.746417][T10922] wireguard0: entered promiscuous mode [ 456.753708][T10922] wireguard0: entered allmulticast mode [ 456.815034][ T5979] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.9e [ 456.826156][ T5979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.843952][ T5979] usb 1-1: config 0 descriptor?? [ 456.884133][ T5847] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 457.079271][ T5847] usb 4-1: not running at top speed; connect to a high speed hub [ 457.345643][T10915] binder: 10914:10915 ioctl c0306201 0 returned -14 [ 457.383930][ T5847] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 457.394962][ T5847] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x82 has invalid maxpacket 975, setting to 64 [ 457.417454][ T5847] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 457.451032][T10915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.467223][ T5847] usb 4-1: config 1 interface 0 has no altsetting 0 [ 457.488215][ T5847] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 457.511705][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.580658][ T5847] usb 4-1: Product: syz [ 457.593451][ T5847] usb 4-1: Manufacturer: щ [ 457.613518][ T5847] usb 4-1: SerialNumber: syz [ 457.635847][T10919] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 457.663601][T10919] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 457.699185][T10919] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 457.759130][T10915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.104877][ T5847] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 458.170717][ T30] audit: type=1400 audit(5272696094.292:1146): avc: denied { write } for pid=10937 comm="syz.5.1196" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 458.252048][ T5847] usb 4-1: USB disconnect, device number 19 [ 458.578081][ T30] audit: type=1400 audit(5272696094.702:1147): avc: denied { write } for pid=10940 comm="syz.5.1197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 458.637841][ T30] audit: type=1400 audit(5272696094.702:1148): avc: denied { setopt } for pid=10940 comm="syz.5.1197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 458.681819][ T30] audit: type=1400 audit(5272696094.702:1149): avc: denied { connect } for pid=10940 comm="syz.5.1197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 458.729292][ T30] audit: type=1400 audit(5272696094.802:1150): avc: denied { recv } for pid=10879 comm="syz.3.1184" saddr=10.128.0.169 src=30006 daddr=10.128.0.146 dest=45280 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 458.943498][ T5897] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 459.655200][ T5859] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 459.664799][ T5859] Bluetooth: hci2: Injecting HCI hardware error event [ 459.684544][ T5859] Bluetooth: hci2: hardware error 0x00 [ 460.039513][ T30] audit: type=1400 audit(5272696096.162:1151): avc: denied { create } for pid=10953 comm="syz.5.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 460.095196][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.117692][ T5897] usb 3-1: New USB device found, idVendor=056a, idProduct=0000, bcdDevice= 0.00 [ 460.196175][ T30] audit: type=1400 audit(5272696096.202:1152): avc: denied { ioctl } for pid=10953 comm="syz.5.1203" path="socket:[30526]" dev="sockfs" ino=30526 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 460.203497][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.313552][ T30] audit: type=1400 audit(5272696096.432:1153): avc: denied { name_connect } for pid=10956 comm="syz.3.1202" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 460.377587][ T30] audit: type=1400 audit(5272696096.462:1154): avc: denied { listen } for pid=10956 comm="syz.3.1202" lport=41785 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 460.403751][ T5897] usb 3-1: config 0 descriptor?? [ 460.514358][ T30] audit: type=1400 audit(5272696096.552:1155): avc: denied { accept } for pid=10956 comm="syz.3.1202" lport=41785 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 460.693449][ C1] sl0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 21100 ms [ 460.701898][ C1] sl0: transmit timed out, bad line quality? [ 460.930669][T10967] FAULT_INJECTION: forcing a failure. [ 460.930669][T10967] name failslab, interval 1, probability 0, space 0, times 0 [ 460.948432][T10967] CPU: 0 UID: 0 PID: 10967 Comm: syz.5.1204 Not tainted syzkaller #0 PREEMPT(full) [ 460.948459][T10967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 460.948473][T10967] Call Trace: [ 460.948479][T10967] [ 460.948486][T10967] dump_stack_lvl+0x16c/0x1f0 [ 460.948513][T10967] should_fail_ex+0x512/0x640 [ 460.948534][T10967] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 460.948553][T10967] should_failslab+0xc2/0x120 [ 460.948571][T10967] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 460.948587][T10967] ? __alloc_skb+0x2b2/0x380 [ 460.948602][T10967] __alloc_skb+0x2b2/0x380 [ 460.948613][T10967] ? __pfx___alloc_skb+0x10/0x10 [ 460.948627][T10967] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 460.948643][T10967] netlink_alloc_large_skb+0x69/0x130 [ 460.948664][T10967] netlink_sendmsg+0x6a1/0xdd0 [ 460.948690][T10967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 460.948722][T10967] ____sys_sendmsg+0xa98/0xc70 [ 460.948748][T10967] ? copy_msghdr_from_user+0x10a/0x160 [ 460.948768][T10967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 460.948803][T10967] ___sys_sendmsg+0x134/0x1d0 [ 460.948825][T10967] ? __pfx____sys_sendmsg+0x10/0x10 [ 460.948884][T10967] __sys_sendmsg+0x16d/0x220 [ 460.948905][T10967] ? __pfx___sys_sendmsg+0x10/0x10 [ 460.948941][T10967] do_syscall_64+0xcd/0x4c0 [ 460.948964][T10967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.948980][T10967] RIP: 0033:0x7fd70d18eba9 [ 460.948992][T10967] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 460.949004][T10967] RSP: 002b:00007fd70dfa3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 460.949015][T10967] RAX: ffffffffffffffda RBX: 00007fd70d3d5fa0 RCX: 00007fd70d18eba9 [ 460.949025][T10967] RDX: 0000000000000010 RSI: 0000200000000380 RDI: 0000000000000003 [ 460.949035][T10967] RBP: 00007fd70dfa3090 R08: 0000000000000000 R09: 0000000000000000 [ 460.949044][T10967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 460.949053][T10967] R13: 00007fd70d3d6038 R14: 00007fd70d3d5fa0 R15: 00007fff6a90ce98 [ 460.949073][T10967] [ 461.159878][ C0] vkms_vblank_simulate: vblank timer overrun [ 461.467417][ T5897] wacom 0003:056A:0000.000D: Unknown device_type for 'HID 056a:0000'. Assuming pen. [ 461.893561][ T5859] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 461.930988][ T5897] wacom 0003:056A:0000.000D: hidraw0: USB HID v0.00 Device [HID 056a:0000] on usb-dummy_hcd.2-1/input0 [ 462.153364][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 462.955158][T10973] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nullb0": -EINTR [ 463.013869][ T5979] usb 1-1: string descriptor 0 read error: -71 [ 463.035306][ T5897] input: Wacom Penpartner Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:056A:0000.000D/input/input12 [ 463.115448][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.165196][ T5979] ath6kl: Failed to submit usb control message: -71 [ 463.457135][T10993] comedi comedi3: comedi_config --init_data is deprecated [ 463.465082][ T5979] ath6kl: unable to send the bmi data to the device: -71 [ 463.472395][ T9] usb 4-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 463.483207][ T5979] ath6kl: Unable to send get target info: -71 [ 463.489500][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.757857][ T5979] ath6kl: Failed to init ath6kl core: -71 [ 463.768243][ T5897] usb 3-1: USB disconnect, device number 26 [ 463.786512][ T9] usb 4-1: Product: syz [ 463.790702][ T9] usb 4-1: Manufacturer: syz [ 463.797647][ T5979] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 463.818800][ T9] usb 4-1: SerialNumber: syz [ 463.847561][ T9] usb 4-1: config 0 descriptor?? [ 463.865989][ T5979] usb 1-1: USB disconnect, device number 28 [ 464.070454][T10976] bridge3: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 464.591723][ T9] usb 4-1: USB disconnect, device number 20 [ 464.751455][ T30] audit: type=1400 audit(5272696100.872:1156): avc: denied { shutdown } for pid=11004 comm="syz.7.1216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 465.342228][T11012] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 465.358075][ T5979] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 465.544080][ T5979] usb 1-1: Using ep0 maxpacket: 16 [ 465.562412][ T5979] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 465.588474][ T5979] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 465.611790][ T5979] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 465.630280][ T5979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.648645][ T5979] usb 1-1: Product: syz [ 465.661698][ T5979] usb 1-1: Manufacturer: syz [ 465.671791][ T5979] usb 1-1: SerialNumber: syz [ 465.797516][ T5979] usb 1-1: config 0 descriptor?? [ 465.868877][ T5979] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 465.885750][ T5979] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 465.958519][T11027] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1221'. [ 466.733670][ T7539] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 467.265531][ T30] audit: type=1400 audit(5272696103.382:1157): avc: denied { read } for pid=11004 comm="syz.7.1216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 467.293336][T11008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 467.302511][T11008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 467.311600][ T30] audit: type=1400 audit(5272696103.432:1158): avc: denied { create } for pid=11007 comm="syz.0.1217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 467.342175][ T5979] em28xx 1-1:0.0: chip ID is em2874 [ 467.381761][ T7539] usb 3-1: config 0 has an invalid interface number: 63 but max is 0 [ 467.415070][ T7539] usb 3-1: config 0 has no interface number 0 [ 467.429231][ T7539] usb 3-1: config 0 interface 63 has no altsetting 0 [ 467.499700][ T7539] usb 3-1: New USB device found, idVendor=04dd, idProduct=8001, bcdDevice=c0.12 [ 467.518752][ T7539] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 467.544210][ T5904] usb 1-1: USB disconnect, device number 29 [ 467.550867][ T5904] em28xx 1-1:0.0: Disconnecting em28xx [ 467.559312][ T7539] usb 3-1: config 0 descriptor?? [ 467.580890][ T5904] em28xx 1-1:0.0: Freeing device [ 467.589422][T11037] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1223'. [ 467.601344][ T7539] safe_serial 3-1:0.63: safe_serial converter detected [ 467.614882][ T7539] safe_serial 3-1:0.63: probe with driver safe_serial failed with error -22 [ 467.707751][T11037] team3: entered promiscuous mode [ 467.713202][T11037] team3: entered allmulticast mode [ 467.800993][ T5904] usb 3-1: USB disconnect, device number 27 [ 468.854885][T11053] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 469.072556][ T6015] block nbd4: Possible stuck request ffff888026abe000: control (read@0,1024B). Runtime 120 seconds [ 469.090235][ T6015] block nbd4: Possible stuck request ffff888026abe1c0: control (read@1024,1024B). Runtime 120 seconds [ 469.153449][ T6015] block nbd4: Possible stuck request ffff888026abe380: control (read@2048,1024B). Runtime 120 seconds [ 469.164603][ T6015] block nbd4: Possible stuck request ffff888026abe540: control (read@3072,1024B). Runtime 120 seconds [ 469.256800][T11056] netlink: 448 bytes leftover after parsing attributes in process `syz.5.1229'. [ 469.752170][T11056] sctp: [Deprecated]: syz.5.1229 (pid 11056) Use of int in max_burst socket option. [ 469.752170][T11056] Use struct sctp_assoc_value instead [ 469.787233][ T30] audit: type=1400 audit(5272696105.902:1159): avc: denied { ioctl } for pid=11055 comm="syz.5.1229" path="socket:[31617]" dev="sockfs" ino=31617 ioctlcmd=0x89f1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 469.811962][ C0] vkms_vblank_simulate: vblank timer overrun [ 470.186248][T11076] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1232'. [ 470.359513][ T30] audit: type=1400 audit(5272696106.312:1160): avc: denied { accept } for pid=11068 comm="syz.0.1234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 470.381604][ T30] audit: type=1400 audit(5272696106.422:1161): avc: denied { egress } for pid=11068 comm="syz.0.1234" saddr=fe80::1c daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 470.441385][ T30] audit: type=1400 audit(5272696106.422:1162): avc: denied { sendto } for pid=11068 comm="syz.0.1234" saddr=fe80::1c daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 471.633814][T11094] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1237'. [ 472.994421][T11094] team2: entered promiscuous mode [ 473.025578][T11094] team2: entered allmulticast mode [ 473.738455][ T30] audit: type=1400 audit(5272696109.842:1163): avc: denied { connect } for pid=11100 comm="syz.3.1241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 474.548340][ T30] audit: type=1400 audit(5272696110.632:1164): avc: denied { write } for pid=11113 comm="syz.2.1247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 474.757252][ T30] audit: type=1400 audit(5272696110.672:1165): avc: denied { create } for pid=11115 comm="syz.0.1246" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 474.777028][ C0] vkms_vblank_simulate: vblank timer overrun [ 474.818488][ T30] audit: type=1400 audit(5272696110.802:1166): avc: denied { read } for pid=11115 comm="syz.0.1246" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 474.842335][ C0] vkms_vblank_simulate: vblank timer overrun [ 474.849078][ T30] audit: type=1400 audit(5272696110.802:1167): avc: denied { open } for pid=11115 comm="syz.0.1246" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 474.874242][ T30] audit: type=1400 audit(5272696110.812:1168): avc: denied { connect } for pid=11111 comm="syz.7.1245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 474.893822][ C0] vkms_vblank_simulate: vblank timer overrun [ 474.978504][ T30] audit: type=1400 audit(5272696110.822:1169): avc: denied { read } for pid=11111 comm="syz.7.1245" path="socket:[32784]" dev="sockfs" ino=32784 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 475.017993][T11125] loop6: detected capacity change from 0 to 524287999 [ 475.283724][ T5979] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 475.492151][ T5979] usb 8-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 476.313665][ T5979] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.321688][ T5979] usb 8-1: Product: syz [ 476.356948][ T5979] usb 8-1: Manufacturer: syz [ 476.363703][ T5979] usb 8-1: SerialNumber: syz [ 476.397945][ T5979] usb 8-1: config 0 descriptor?? [ 476.437752][ T5979] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 476.963596][ T5979] sonixb 8-1:0.0: Error reading register 00: -110 [ 477.178003][T11148] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1255'. [ 477.239832][ T7539] usb 8-1: USB disconnect, device number 3 [ 478.843449][ T30] audit: type=1400 audit(5272696114.802:1170): avc: denied { setopt } for pid=11137 comm="syz.2.1254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 478.874845][ T30] audit: type=1400 audit(5272696114.802:1171): avc: denied { map } for pid=11137 comm="syz.2.1254" path="/proc/983/net/fib_trie" dev="proc" ino=4026533133 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 479.844653][T11170] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1261'. [ 480.263696][T11174] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1262'. [ 480.425044][ T30] audit: type=1400 audit(5272696116.512:1172): avc: denied { getopt } for pid=11159 comm="syz.0.1258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 480.550938][T11174] team6: entered promiscuous mode [ 480.556676][T11174] team6: entered allmulticast mode [ 481.465624][ T30] audit: type=1400 audit(5272696117.582:1173): avc: denied { create } for pid=11190 comm="syz.5.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 481.822820][ T30] audit: type=1400 audit(5272696117.582:1174): avc: denied { bind } for pid=11190 comm="syz.5.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 481.881234][ T30] audit: type=1400 audit(5272696117.582:1175): avc: denied { listen } for pid=11190 comm="syz.5.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 482.465137][T11205] ALSA: mixer_oss: invalid OSS volume '' [ 483.119541][T11212] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1272'. [ 483.639696][ T30] audit: type=1400 audit(5272696119.582:1176): avc: denied { ioctl } for pid=11216 comm="syz.7.1274" path="socket:[32911]" dev="sockfs" ino=32911 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 483.732254][T11223] FAULT_INJECTION: forcing a failure. [ 483.732254][T11223] name failslab, interval 1, probability 0, space 0, times 0 [ 483.749132][ T7539] libceph: connect (1)[c::]:6789 error -101 [ 483.758509][T11223] CPU: 0 UID: 0 PID: 11223 Comm: syz.5.1276 Not tainted syzkaller #0 PREEMPT(full) [ 483.758534][T11223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 483.758543][T11223] Call Trace: [ 483.758549][T11223] [ 483.758556][T11223] dump_stack_lvl+0x16c/0x1f0 [ 483.758583][T11223] should_fail_ex+0x512/0x640 [ 483.758604][T11223] ? fs_reclaim_acquire+0xae/0x150 [ 483.758629][T11223] ? tomoyo_encode2+0x100/0x3e0 [ 483.758654][T11223] should_failslab+0xc2/0x120 [ 483.758675][T11223] __kmalloc_noprof+0xd2/0x510 [ 483.758692][T11223] ? d_absolute_path+0x136/0x1a0 [ 483.758720][T11223] tomoyo_encode2+0x100/0x3e0 [ 483.758747][T11223] tomoyo_encode+0x29/0x50 [ 483.758771][T11223] tomoyo_realpath_from_path+0x18f/0x6e0 [ 483.758808][T11223] tomoyo_path_number_perm+0x245/0x580 [ 483.758830][T11223] ? tomoyo_path_number_perm+0x237/0x580 [ 483.758855][T11223] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 483.758879][T11223] ? find_held_lock+0x2b/0x80 [ 483.758922][T11223] ? find_held_lock+0x2b/0x80 [ 483.758942][T11223] ? hook_file_ioctl_common+0x145/0x410 [ 483.758973][T11223] ? __fget_files+0x20e/0x3c0 [ 483.758997][T11223] security_file_ioctl+0x9b/0x240 [ 483.759024][T11223] __x64_sys_ioctl+0xb7/0x210 [ 483.759051][T11223] do_syscall_64+0xcd/0x4c0 [ 483.759075][T11223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.759093][T11223] RIP: 0033:0x7fd70d18eba9 [ 483.759107][T11223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.759123][T11223] RSP: 002b:00007fd70dfa3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 483.759139][T11223] RAX: ffffffffffffffda RBX: 00007fd70d3d5fa0 RCX: 00007fd70d18eba9 [ 483.759150][T11223] RDX: 00002000000001c0 RSI: 00000000c010640c RDI: 0000000000000003 [ 483.759159][T11223] RBP: 00007fd70dfa3090 R08: 0000000000000000 R09: 0000000000000000 [ 483.759169][T11223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.759178][T11223] R13: 00007fd70d3d6038 R14: 00007fd70d3d5fa0 R15: 00007fff6a90ce98 [ 483.759202][T11223] [ 483.759325][T11223] ERROR: Out of memory at tomoyo_realpath_from_path. [ 483.984527][ T7539] libceph: mon0 (1)[c::]:6789 connect error [ 484.167171][T11218] ceph: No mds server is up or the cluster is laggy [ 484.258417][ T7539] libceph: connect (1)[c::]:6789 error -101 [ 484.272016][ T7539] libceph: mon0 (1)[c::]:6789 connect error [ 485.257474][ T30] audit: type=1400 audit(5272696121.282:1177): avc: denied { name_bind } for pid=11242 comm="syz.2.1284" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 485.278700][ C0] vkms_vblank_simulate: vblank timer overrun [ 485.803816][T11251] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1281'. [ 487.323543][ T30] audit: type=1400 audit(5272696123.012:1178): avc: denied { map } for pid=11240 comm="syz.5.1283" path="/dev/comedi4" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 487.347129][ T30] audit: type=1400 audit(5272696123.012:1179): avc: denied { execute } for pid=11240 comm="syz.5.1283" path="/dev/comedi4" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 487.372550][ T30] audit: type=1800 audit(5272696123.112:1180): pid=11258 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1283" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 487.827089][T11267] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1288'. [ 489.113715][T11276] 9p filesystem being mounted at /272/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 489.129938][ T5847] libceph: connect (1)[c::]:6789 error -101 [ 489.156250][ T5847] libceph: mon0 (1)[c::]:6789 connect error [ 489.238448][ T30] audit: type=1400 audit(5272696125.362:1181): avc: denied { create } for pid=11275 comm="syz.0.1290" name="cpuset.effective_cpus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 489.394305][T11273] ceph: No mds server is up or the cluster is laggy [ 489.993538][ T30] audit: type=1400 audit(5272696126.112:1182): avc: denied { create } for pid=11275 comm="syz.0.1290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 490.059210][ T30] audit: type=1400 audit(5272696126.112:1183): avc: denied { read } for pid=11275 comm="syz.0.1290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 490.200567][T11293] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1295'. [ 490.223734][T11293] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11293 comm=syz.3.1295 [ 490.284766][T11293] 9pnet_fd: Insufficient options for proto=fd [ 490.404076][T11298] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1297'. [ 491.176121][T11310] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 491.372678][T11302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1298'. [ 491.393293][T11302] team3: entered promiscuous mode [ 491.399434][T11302] team3: entered allmulticast mode [ 491.633796][T11312] nbd2: detected capacity change from 0 to 1020 [ 491.644108][ T6001] block nbd2: Send control failed (result -89) [ 491.651683][ T6001] block nbd2: Request send failed, requeueing [ 491.659945][ T5859] block nbd2: Receive control failed (result -32) [ 491.670121][ T6015] block nbd2: Dead connection, failed to find a fallback [ 491.677869][ T6015] block nbd2: shutting down sockets [ 491.683177][ T6015] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.693016][ T6015] buffer_io_error: 10 callbacks suppressed [ 491.693026][ T6015] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.707928][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.717149][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.725207][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.734737][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.742604][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.752455][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.828011][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.828409][T11314] nbd2: detected capacity change from 1020 to 67108884 [ 491.841187][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.852383][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.882578][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.897834][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.923472][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.931702][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.956683][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 491.964685][ T6001] ldm_validate_partition_table(): Disk read failed. [ 491.972808][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 492.002489][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 492.062912][ T6001] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 492.072068][ T6001] Buffer I/O error on dev nbd2, logical block 0, async page read [ 492.089547][ T6001] Dev nbd2: unable to read RDB block 0 [ 492.102420][ T6001] nbd2: unable to read partition table [ 492.565023][ T6001] ldm_validate_partition_table(): Disk read failed. [ 492.572064][ T6001] Dev nbd2: unable to read RDB block 0 [ 492.603192][ T6001] nbd2: unable to read partition table [ 492.722363][T11329] FAULT_INJECTION: forcing a failure. [ 492.722363][T11329] name failslab, interval 1, probability 0, space 0, times 0 [ 492.800183][T11329] CPU: 1 UID: 0 PID: 11329 Comm: syz.5.1305 Not tainted syzkaller #0 PREEMPT(full) [ 492.800206][T11329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 492.800216][T11329] Call Trace: [ 492.800221][T11329] [ 492.800228][T11329] dump_stack_lvl+0x16c/0x1f0 [ 492.800255][T11329] should_fail_ex+0x512/0x640 [ 492.800276][T11329] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 492.800304][T11329] should_failslab+0xc2/0x120 [ 492.800325][T11329] __kmalloc_cache_noprof+0x6a/0x3e0 [ 492.800351][T11329] ? ovl_init_fs_context+0x52/0x5f0 [ 492.800377][T11329] ovl_init_fs_context+0x52/0x5f0 [ 492.800398][T11329] ? __pfx_ovl_init_fs_context+0x10/0x10 [ 492.800420][T11329] alloc_fs_context+0x54a/0x9c0 [ 492.800446][T11329] path_mount+0xbdd/0x2000 [ 492.800473][T11329] ? __pfx_path_mount+0x10/0x10 [ 492.800497][T11329] ? kmem_cache_free+0x2d1/0x4d0 [ 492.800512][T11329] ? putname+0x154/0x1a0 [ 492.800537][T11329] ? putname+0x154/0x1a0 [ 492.800561][T11329] ? __x64_sys_mount+0x28d/0x310 [ 492.800580][T11329] __x64_sys_mount+0x28d/0x310 [ 492.800602][T11329] ? __pfx___x64_sys_mount+0x10/0x10 [ 492.800631][T11329] do_syscall_64+0xcd/0x4c0 [ 492.800655][T11329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.800672][T11329] RIP: 0033:0x7fd70d18eba9 [ 492.800686][T11329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 492.800702][T11329] RSP: 002b:00007fd70dfa3038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 492.800719][T11329] RAX: ffffffffffffffda RBX: 00007fd70d3d5fa0 RCX: 00007fd70d18eba9 [ 492.800730][T11329] RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000000000000000 [ 492.800740][T11329] RBP: 00007fd70dfa3090 R08: 0000200000000380 R09: 0000000000000000 [ 492.800750][T11329] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000002 [ 492.800759][T11329] R13: 00007fd70d3d6038 R14: 00007fd70d3d5fa0 R15: 00007fff6a90ce98 [ 492.800783][T11329] [ 493.449254][ T30] audit: type=1400 audit(5272696129.462:1184): avc: denied { create } for pid=11331 comm="syz.0.1308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 494.883609][ T7539] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 495.103610][ T7539] usb 3-1: Using ep0 maxpacket: 32 [ 495.190890][ T7539] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 495.320610][ T7539] usb 3-1: config 0 has no interface number 0 [ 495.432179][ T7539] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 495.581975][ T7539] usb 3-1: config 0 interface 196 has no altsetting 0 [ 495.589740][ T30] audit: type=1400 audit(5272696129.462:1185): avc: denied { bind } for pid=11331 comm="syz.0.1308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 495.613687][ T30] audit: type=1400 audit(5272696130.142:1186): avc: denied { append } for pid=11339 comm="syz.5.1310" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 495.653879][ T7539] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 495.672851][ T7539] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.682545][ T7539] usb 3-1: Product: syz [ 495.690166][ T7539] usb 3-1: Manufacturer: syz [ 495.697551][ T7539] usb 3-1: SerialNumber: syz [ 495.749573][T11334] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11334 comm=syz.3.1304 [ 495.844228][ T7539] usb 3-1: config 0 descriptor?? [ 495.859538][T11343] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 496.666744][ T7539] ipheth 3-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 496.727134][ T7539] ipheth 3-1:0.196: Apple iPhone USB Ethernet device attached [ 497.431334][ T7539] usb 3-1: USB disconnect, device number 28 [ 497.682724][ T7539] ipheth 3-1:0.196: Apple iPhone USB Ethernet now disconnected [ 497.764963][T11371] netlink: 68 bytes leftover after parsing attributes in process `syz.7.1317'. [ 498.969018][T11381] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1319'. [ 499.611892][ T6015] block nbd4: Possible stuck request ffff888026abe000: control (read@0,1024B). Runtime 150 seconds [ 499.626636][ T6015] block nbd4: Possible stuck request ffff888026abe1c0: control (read@1024,1024B). Runtime 150 seconds [ 499.638135][ T6015] block nbd4: Possible stuck request ffff888026abe380: control (read@2048,1024B). Runtime 150 seconds [ 499.649140][ T6015] block nbd4: Possible stuck request ffff888026abe540: control (read@3072,1024B). Runtime 150 seconds [ 499.967479][T11387] comedi comedi3: comedi_config --init_data is deprecated [ 501.021471][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.027925][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.357701][T11408] sch_tbf: peakrate 3297 is lower than or equals to rate 16768 ! [ 503.972173][T11435] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11435 comm=syz.0.1329 [ 504.930474][T11442] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1336'. [ 507.233642][ T5979] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 507.405583][ T5979] usb 4-1: not running at top speed; connect to a high speed hub [ 507.415517][ T5979] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 507.436803][ T31] INFO: task syz.4.888:9461 blocked for more than 143 seconds. [ 507.456864][ T31] Not tainted syzkaller #0 [ 507.506599][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 507.523615][ T5979] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x82 has invalid maxpacket 975, setting to 64 [ 507.545769][ T31] task:syz.4.888 state:D stack:28280 pid:9461 tgid:9457 ppid:5850 task_flags:0x400140 flags:0x00004004 [ 507.604462][ T31] Call Trace: [ 507.616628][ T31] [ 507.629434][ T5979] usb 4-1: config 1 interface 0 altsetting 251 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 507.641803][ T31] __schedule+0x1190/0x5de0 [ 507.664611][ T31] ? __pfx___schedule+0x10/0x10 [ 507.695148][ T31] ? find_held_lock+0x2b/0x80 [ 507.712753][ T31] ? schedule+0x2d7/0x3a0 [ 507.731395][ T31] ? bdev_open+0xa2/0xe40 [ 507.748767][ T31] schedule+0xe7/0x3a0 [ 507.765716][ T31] schedule_preempt_disabled+0x13/0x30 [ 507.785859][ T31] __mutex_lock+0x81b/0x1060 [ 507.802090][ T31] ? bdev_open+0xa2/0xe40 [ 507.813706][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 507.828963][ T31] ? bd_prepare_to_claim+0x1e0/0x280 [ 507.858803][ T5979] usb 4-1: config 1 interface 0 has no altsetting 0 [ 507.865482][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 507.884589][ T31] ? bdev_open+0xa2/0xe40 [ 507.900530][ T31] bdev_open+0xa2/0xe40 [ 507.926268][ T31] bdev_file_open_by_dev+0x182/0x210 [ 507.954514][ T31] setup_bdev_super+0x39b/0x730 [ 507.960217][ T31] get_tree_bdev_flags+0x363/0x620 [ 507.988044][ T5979] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 508.008766][ T5979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.008774][ T31] ? __pfx_cramfs_blkdev_fill_super+0x10/0x10 [ 508.008804][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 508.054858][ T31] ? cap_capable+0xb3/0x250 [ 508.077989][ T31] cramfs_get_tree+0x40/0x50 [ 508.090960][ T5979] usb 4-1: Product: syz [ 508.092055][ T31] vfs_get_tree+0x8b/0x340 [ 508.109569][ T5979] usb 4-1: Manufacturer: щ [ 508.110671][ T31] path_mount+0x1513/0x2000 [ 508.124015][ T31] ? __pfx_path_mount+0x10/0x10 [ 508.128980][ T31] ? kmem_cache_free+0x2d1/0x4d0 [ 508.145782][ T31] ? putname+0x154/0x1a0 [ 508.145979][ T5979] usb 4-1: SerialNumber: syz [ 508.158503][ T31] ? putname+0x154/0x1a0 [ 508.170402][ T31] ? __x64_sys_mount+0x28d/0x310 [ 508.178380][T11461] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 508.186655][ T31] __x64_sys_mount+0x28d/0x310 [ 508.191593][T11461] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 508.194789][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 508.218385][ T31] do_syscall_64+0xcd/0x4c0 [ 508.233242][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.249405][ T31] RIP: 0033:0x7f44c758eba9 [ 508.263470][ T31] RSP: 002b:00007f44c83d7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 508.277855][T11461] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 508.301096][ T31] RAX: ffffffffffffffda RBX: 00007f44c77d6270 RCX: 00007f44c758eba9 [ 508.333159][ T31] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 0000200000000140 [ 508.361525][ T31] RBP: 00007f44c7611e19 R08: 0000000000000000 R09: 0000000000000000 [ 508.383871][ T31] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000000 [ 508.403553][ T31] R13: 00007f44c77d6308 R14: 00007f44c77d6270 R15: 00007fff7f403628 [ 508.423147][ T31] [ 508.427447][ T31] [ 508.427447][ T31] Showing all locks held in the system: [ 508.450169][ T31] 3 locks held by kworker/u8:0/12: [ 508.485728][ T31] 1 lock held by khungtaskd/31: [ 508.499943][ T31] #0: ffffffff8e5c1260 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 508.517020][ T31] 2 locks held by getty/5605: [ 508.529460][ T5979] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 508.536859][T11464] netlink: 228 bytes leftover after parsing attributes in process `syz.7.1344'. [ 508.549014][ T31] #0: ffff88814e0350a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 508.559773][ T30] audit: type=1400 audit(5272696144.662:1187): avc: denied { nlmsg_read } for pid=11462 comm="syz.7.1344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 508.584565][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 508.610372][ T31] 1 lock held by udevd/5836: [ 508.627219][ T5979] usb 4-1: USB disconnect, device number 21 [ 508.641104][ T31] #0: ffff88802682d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 508.682881][ T31] 4 locks held by kworker/0:3/5847: [ 508.710283][ T31] #0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 508.732245][ T31] #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 508.751920][ T31] #2: ffffffff8e831698 (kernfs_notify_lock){....}-{3:3}, at: kernfs_notify_workfn+0x7f/0xb30 [ 508.772675][ T31] #3: ffff88801c6f5188 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_notify_workfn+0xff/0xb30 [ 508.790256][ T31] 4 locks held by kworker/0:7/5979: [ 508.795710][ T31] #0: ffff8880236c4548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 508.808420][ T31] #1: ffffc900045bfd10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 508.823724][ T31] #2: ffff888029c84198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 508.832987][ T31] #3: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 508.844254][ T31] 2 locks held by syz.4.888/9461: [ 508.850451][ T31] #0: ffff8880524be0e0 (&type->s_umount_key#77/1){+.+.}-{4:4}, at: alloc_super+0x235/0xbd0 [ 508.875379][ T31] #1: ffff88802682d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 508.895704][ T31] 2 locks held by syz.0.1329/11441: [ 508.914588][ T31] 1 lock held by syz.7.1344/11465: [ 508.943521][ T31] [ 508.945935][ T31] ============================================= [ 508.945935][ T31] [ 508.971445][ T31] NMI backtrace for cpu 0 [ 508.971462][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 508.971482][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 508.971492][ T31] Call Trace: [ 508.971498][ T31] [ 508.971504][ T31] dump_stack_lvl+0x116/0x1f0 [ 508.971531][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 508.971549][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 508.971575][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 508.971594][ T31] watchdog+0xf0e/0x1260 [ 508.971618][ T31] ? __pfx_watchdog+0x10/0x10 [ 508.971634][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 508.971656][ T31] ? __kthread_parkme+0x19e/0x250 [ 508.971681][ T31] ? __pfx_watchdog+0x10/0x10 [ 508.971699][ T31] kthread+0x3c2/0x780 [ 508.971716][ T31] ? __pfx_kthread+0x10/0x10 [ 508.971735][ T31] ? rcu_is_watching+0x12/0xc0 [ 508.971757][ T31] ? __pfx_kthread+0x10/0x10 [ 508.971774][ T31] ret_from_fork+0x5d4/0x6f0 [ 508.971791][ T31] ? __pfx_kthread+0x10/0x10 [ 508.971807][ T31] ret_from_fork_asm+0x1a/0x30 [ 508.971846][ T31] [ 508.971852][ T31] Sending NMI from CPU 0 to CPUs 1: [ 509.088022][ C1] NMI backtrace for cpu 1 [ 509.088037][ C1] CPU: 1 UID: 0 PID: 11461 Comm: syz.3.1343 Not tainted syzkaller #0 PREEMPT(full) [ 509.088052][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 509.088060][ C1] RIP: 0010:free_pages_and_swap_cache+0x1bf/0x4a0 [ 509.088084][ C1] Code: 83 c0 03 38 d0 7c 08 84 d2 0f 85 89 02 00 00 42 c7 44 bc 40 01 00 00 00 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 0f 85 61 02 00 00 <4d> 8b 6d 00 31 ff 41 83 e5 02 4c 89 ee e8 3f ab a2 ff 4d 85 ed 0f [ 509.088097][ C1] RSP: 0018:ffffc90002f776a8 EFLAGS: 00000246 [ 509.088108][ C1] RAX: 1ffff11005344cbe RBX: 00000000000000bc RCX: ffffffff8218d984 [ 509.088116][ C1] RDX: 0000000000000000 RSI: ffffffff8218de98 RDI: ffffc90002f776f0 [ 509.088125][ C1] RBP: ffffea0001a56340 R08: 0000000000000001 R09: 0000000000000000 [ 509.088132][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 509.088140][ C1] R13: ffff888029a265f0 R14: 0000000000000002 R15: 0000000000000002 [ 509.088147][ C1] FS: 0000000000000000(0000) GS:ffff8881247b5000(0000) knlGS:0000000000000000 [ 509.088161][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 509.088170][ C1] CR2: 000055556634c5c8 CR3: 000000007cf1c000 CR4: 00000000003526f0 [ 509.088178][ C1] Call Trace: [ 509.088182][ C1] [ 509.088189][ C1] ? __pfx_free_pages_and_swap_cache+0x10/0x10 [ 509.088219][ C1] ? __pfx___might_resched+0x10/0x10 [ 509.088237][ C1] __tlb_batch_free_encoded_pages+0xf9/0x290 [ 509.088257][ C1] tlb_finish_mmu+0x168/0x7c0 [ 509.088276][ C1] exit_mmap+0x403/0xb90 [ 509.088292][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 509.088310][ C1] ? __lock_acquire+0xb97/0x1ce0 [ 509.088335][ C1] __mmput+0x12a/0x410 [ 509.088351][ C1] mmput+0x62/0x70 [ 509.088365][ C1] do_exit+0x7c7/0x2bf0 [ 509.088382][ C1] ? lock_acquire+0x179/0x350 [ 509.088402][ C1] ? __pfx_do_exit+0x10/0x10 [ 509.088419][ C1] ? find_held_lock+0x2b/0x80 [ 509.088435][ C1] do_group_exit+0xd3/0x2a0 [ 509.088453][ C1] get_signal+0x2673/0x26d0 [ 509.088470][ C1] ? hrtimer_nanosleep+0x187/0x380 [ 509.088486][ C1] ? __pfx_get_signal+0x10/0x10 [ 509.088501][ C1] ? do_futex+0x122/0x350 [ 509.088519][ C1] ? __pfx_do_futex+0x10/0x10 [ 509.088537][ C1] arch_do_signal_or_restart+0x8f/0x7d0 [ 509.088554][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 509.088577][ C1] ? xfd_validate_state+0x61/0x180 [ 509.088596][ C1] ? __pfx___x64_sys_clock_nanosleep+0x10/0x10 [ 509.088613][ C1] exit_to_user_mode_loop+0x84/0x110 [ 509.088628][ C1] do_syscall_64+0x3f6/0x4c0 [ 509.088645][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.088658][ C1] RIP: 0033:0x7f04ffd8eba9 [ 509.088668][ C1] Code: Unable to access opcode bytes at 0x7f04ffd8eb7f. [ 509.088673][ C1] RSP: 002b:00007f0500cdd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 509.088685][ C1] RAX: fffffffffffffe00 RBX: 00007f04fffd5fa8 RCX: 00007f04ffd8eba9 [ 509.088693][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f04fffd5fa8 [ 509.088701][ C1] RBP: 00007f04fffd5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 509.088708][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 509.088715][ C1] R13: 00007f04fffd6038 R14: 00007ffd859a8ef0 R15: 00007ffd859a8fd8 [ 509.088728][ C1] [ 509.089077][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 509.410841][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 509.419931][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 509.429964][ T31] Call Trace: [ 509.433224][ T31] [ 509.436132][ T31] dump_stack_lvl+0x3d/0x1f0 [ 509.440708][ T31] vpanic+0x6e8/0x7a0 [ 509.444678][ T31] ? __pfx_vpanic+0x10/0x10 [ 509.449165][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 509.455131][ T31] panic+0xca/0xd0 [ 509.458834][ T31] ? __pfx_panic+0x10/0x10 [ 509.463233][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 509.468591][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 509.474724][ T31] ? watchdog+0xd78/0x1260 [ 509.479120][ T31] ? watchdog+0xd6b/0x1260 [ 509.483517][ T31] watchdog+0xd89/0x1260 [ 509.487749][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.492402][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 509.497580][ T31] ? __kthread_parkme+0x19e/0x250 [ 509.502590][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.507243][ T31] kthread+0x3c2/0x780 [ 509.511291][ T31] ? __pfx_kthread+0x10/0x10 [ 509.515864][ T31] ? rcu_is_watching+0x12/0xc0 [ 509.520608][ T31] ? __pfx_kthread+0x10/0x10 [ 509.525178][ T31] ret_from_fork+0x5d4/0x6f0 [ 509.529746][ T31] ? __pfx_kthread+0x10/0x10 [ 509.534312][ T31] ret_from_fork_asm+0x1a/0x30 [ 509.539065][ T31] [ 509.542259][ T31] Kernel Offset: disabled [ 509.546559][ T31] Rebooting in 86400 seconds..