last executing test programs: 3m57.857063804s ago: executing program 0 (id=750): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) lsm_get_self_attr(0x64, 0xffffffffffffffff, &(0x7f0000000040)=0xffffffffffffffd1, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001500010300000000000000"], 0x14}}, 0x0) mlock2(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r2, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 3m56.932067739s ago: executing program 0 (id=752): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0bfc0000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x40820}, 0x0) writev(r0, &(0x7f0000000040), 0x2) close(r0) 3m56.868241352s ago: executing program 0 (id=753): prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x9, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0xb9d, 0x0, 0x10000000001, 0x13, 0x0, 0x0, 0x0, 0x2, 0x4], 0x100000, 0x200}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3m56.722587801s ago: executing program 0 (id=754): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00'}) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) setrlimit(0x1, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000080)={0x5631, 0x24, [0xffff, 0x3, 0x7, 0x4, 0x9, 0x2, 0xffff, 0xc072, 0x10000]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = syz_io_uring_setup(0x110, &(0x7f0000000200)={0x0, 0xfec6, 0x4000, 0x1, 0x100003d4}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0xdb4, 0x0, 0x0, 0x0, 0x0) exit(0x7) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000000)={0x8, 0xffffffffffffffff, 0x4, {0x4, 0x1}, 0x8}, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000003000), r4) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="142293df231cc932f43bac4d957c9e00a6f9", @ANYRES16=r5, @ANYBLOB="01002bbd7000fbdbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000050}, 0x20040084) socket$nl_netfilter(0x10, 0x3, 0xc) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 3m55.869827718s ago: executing program 0 (id=759): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100200000001f0000083900000008000300", @ANYRES32=r2, @ANYBLOB="1c005a8018000080140005"], 0x38}, 0x1, 0x0, 0x0, 0x4810}, 0x10) 3m55.546592217s ago: executing program 0 (id=760): socket(0x10, 0x803, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) io_uring_setup(0x4aec, &(0x7f0000000140)={0x0, 0x81fa, 0x80, 0x1, 0x7a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x6c, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x6c}}, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000, 0x2, 0x3}, 0x18, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x3f, 0x40, 0x42, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000001a40), 0x1003, r9}, 0x38) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c9, &(0x7f0000000100)) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2000, r3}, 0x0) 3m55.206186701s ago: executing program 32 (id=760): socket(0x10, 0x803, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) io_uring_setup(0x4aec, &(0x7f0000000140)={0x0, 0x81fa, 0x80, 0x1, 0x7a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x6c, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x6c}}, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000, 0x2, 0x3}, 0x18, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x3f, 0x40, 0x42, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000001a40), 0x1003, r9}, 0x38) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c9, &(0x7f0000000100)) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2000, r3}, 0x0) 2m33.830479183s ago: executing program 3 (id=1086): r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xedc6) r1 = syz_open_pts(r0, 0x141881) ioctl$TCFLSH(r1, 0x540b, 0x2) r2 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r2, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "5f9fb2ad", {0x1, 0xf, 0x4, 0x0, 0x80}}) socket(0x10, 0x3, 0x4) io_cancel(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00", @ANYBLOB, @ANYBLOB], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) write$P9_RREMOVE(r7, &(0x7f00000002c0)={0x7, 0x7b, 0x2}, 0x7) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r8}, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='btrfs\x00', 0x418, &(0x7f0000000100)='barrier') 2m30.679763758s ago: executing program 3 (id=1097): bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) shutdown(r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socket$inet6(0xa, 0x3, 0x7) (async) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4ea2, 0x380003, @local, 0x10000}, 0x1c) (async) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4ea2, 0x380003, @local, 0x10000}, 0x1c) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x6}, 0x1c) r3 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, 0x0) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={r6, 0x200}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000100)={r6, 0x100}, 0x8) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000100)={r6, 0x100}, 0x8) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000080)='sys_enter\x00', r7}, 0x10) getresgid(0x0, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "a24b9f", 0x8, 0x11, 0x0, @remote, @local, {[], {0x0, 0x4e23, 0x8}}}}}}, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x7, 0x490083) ioctl$VIDIOC_S_TUNER(r3, 0x4054561e, &(0x7f0000000040)={0x3, "6ef9145208ffdfffffffffff7f5ecce56a782806ecbef846f300", 0x3, 0x1000, 0x4, 0x80000002, 0x8, 0x2, 0x6, 0x3ff}) 2m29.883673941s ago: executing program 3 (id=1101): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x34, r2, 0x1, 0x0, 0x0, {0x2c}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0xa8, r2, 0x410, 0x70bd2b, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x3}}, {@pci={{0x8}, {0x11}}, {0x8}}]}, 0xa8}}, 0x4040000) sendmsg$DEVLINK_CMD_SB_POOL_GET(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0xc8, r2, 0xa08, 0x70bd2a, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x81}, {0x6, 0x11, 0xa7}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x4}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x77}, {0x6, 0x11, 0x5}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r3, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09"], 0x80}}, 0x0) 2m29.426598557s ago: executing program 3 (id=1106): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x1000810, &(0x7f0000000400)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r5 = dup3(r3, r4, 0x0) ioctl$MON_IOCX_GETX(r5, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000002240)=""/4119, 0x1017}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r5, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x2, 0x8, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x806}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x800}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000840}, 0x8c0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r6, 0x0) setpgid(0x0, r6) r7 = open(&(0x7f0000000140)='./file0\x00', 0x181000, 0x40) mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup\x00', 0x0, 0xb24050, 0x0) r8 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x122) ioctl$AUTOFS_IOC_READY(r8, 0x9360, 0x800000000000001) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r7) 2m28.515401494s ago: executing program 3 (id=1111): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0xc8080) preadv2(r0, &(0x7f0000000500)=[{&(0x7f00000000c0)=""/156, 0x9c}, {&(0x7f00000001c0)=""/6, 0x6}, {&(0x7f0000000400)=""/34, 0x22}, {&(0x7f0000000440)=""/139, 0x8b}], 0x4, 0x9, 0x6, 0x6) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0x639) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000540)={@private=0xa010102, @multicast2, 0x0, "ec12843cd00d245fe79a2c4e291ee5cea69546441c9f370331aa249e43bb5c77", 0x1, 0x5, 0x3, 0x2}, 0x3c) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) r3 = socket(0x11, 0x3, 0x0) r4 = epoll_create1(0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0xe000202b}) dup3(r3, r5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe2, 0x0) modify_ldt$read(0x0, &(0x7f0000000840)=""/4096, 0x1000) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r6, &(0x7f0000001ac0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000002c0)={{0x0, 0x5, 0xfeff, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x1, r7, 0x0, 0x0, 'syz1\x00', 0x0}) 2m26.976616347s ago: executing program 3 (id=1123): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f0000000480)={0x18}, 0x18) write$FUSE_INIT(r2, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x772, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0xffffff77, 0x6, '9P2000'}, 0x13) write$FUSE_INIT(r3, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x29) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, 0x0) 2m11.935359779s ago: executing program 33 (id=1123): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f0000000480)={0x18}, 0x18) write$FUSE_INIT(r2, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x772, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0xffffff77, 0x6, '9P2000'}, 0x13) write$FUSE_INIT(r3, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x29) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, 0x0) 2m3.694805181s ago: executing program 1 (id=1227): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x200, 0x800, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x4, 0x5}, {0x7, 0x6}, {0x5, 0xfff1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x9}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x24008884) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)=ANY=[@ANYBLOB="1400"/14], 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x8010) userfaultfd(0x80001) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) syz_open_dev$dri(0x0, 0x8, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f0000000580)='7\x00', 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_GET_MAP(0xffffffffffffffff, 0xc0286404, 0x0) socket(0x14, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r4 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) writev(r4, &(0x7f0000000380)=[{&(0x7f00000003c0)="4f7ff52393f0e581f36263164cf871", 0xf}, {&(0x7f00000027c0)="82fccbaa7ea51c37edfc45414637e426993e2cb671faf231c018947157ec504c47f8fec0c54da6526361767c28d93415076425e931b5fe42bb0216d3d96b5c4720de92e3ea89369f263a72c32202a4933ad82f7468fd3d82180a43e781771e28129510443b4cbd364114efe9198c3344c16c7c27a09c4a4451f760dc9cba011c1152e881030f5a3d8e367a831a4b86a4f1938caad99abdbe94bbc0fe6b1881467adb0a43048afcfb41b3e3895a710b8649587421e130a9b048838579b80d31fea39d7135efa85ace12470f0f68283c3049e0d416a5c464b43e4bcda872d55d41e5ca6d32958689f0f794773527cf5dce1364641e230ba41945a90c73db044db83373897b1bfe11a065e4fd2ec53c4091b1039989014343cdca7a7e93564c8d6eccc396f63b9ff525a944d931a93a2d2c61625d2050f7d93822a8fc9968220a3fe873d2e55019d63962780d2dfb68f193c99519794c41b73ae0dec77cd98d8f2c04f31a467e3b12f5b5029bc0f5d7d5fe444cb38f34fcc37519b9c12840073bc7390fb5a73dcc9519429b002e15babb08ba4092ff231a57e47e1fbe09d2baea405ce2f47a5d78233481fd21d322f223759fe7be9759561f48919ea8f4b5f337a3d8701d1f596f0fef0398df846197cbbd1d5bbd57f8bb162eafd2d938044cd6e3e59c674bee0a4c77467a082b12f0860f17e5cd578ff7ed0cbbfd52eb1cc6a0c0a8b5fdd725cd2e23c1d02978bbff9dd563f1faa46d13e85e36a1a39657a7b916247f465e09a70f1e3a00546d6ad0b53517ec56e82e0eaafc413d389fb6bb02228b3386b2d8b228ea014af8cf79cb8c9818b38b318a871580fa59daa165fe787490953f971e6978a43725200db4bdb3286b30aa8c41706cd30d4a74f2ac45241df6420d79dcda4f27d69036e901741c432c5ef8e75d3c0e501b586eda997202dbe64d237c895ab97e1ef1e2e10c764e25198b575c789bfb3c3fc5e5a24b401a360baf2cfae4178c615d8088c281e937f80f5497bebba4b461e663747c3e62b3dd1006dcc16752f9a4652955f3838bf0c776724741e5acc8e03207797343943701eb2129d1e28cf22ebf9e87ad5c284ce9181cd7de07cf7e76a6464ae286ecfe4073d527ea4dc8e2faa646b10bbf94d703f7f895ec226e5c4d6908a8c742c8129b00851eeb6fb8fea290b8725f6e148a1586f052aabd7dcb6d940ebed4d4c684c00ca12ea6309c287b64f7889fdea68f2a772a1f41db6236431eb5b8765a422b80eb0127e62c37961518e77c1d2cda72867f54635d70b61371d0d32a9e0c0cb405b7ff444801337671c929866a438b06cc71ffc670be4095995ce66dbc6e9ba3521834d2d5978b90b03f8bffb6da86da7a203f5f82be3e60f6a88ca61b1ea8c8c9bdb07107c5fcd58a51bdf6fce7928a37fa6b6e1da20600dbbe3777c4243328ae6ecb4daa6beda4ba08e14add53da9b656709d6e8a9b8822802d584cd68933ca093cb2559353c304e17bf810e86cbab7951aa1b9c302c20a563f691cc807eb5589577bda05e4384f66ee6a3c87233bbb8c9d72980ceddaee35cc4b99fe3a48e250ed432cb83c77878eba08c3ebe8679d3719ce7b207469cba18fb5f1d088edf4698bcb3a9be8828e9ea817144732323470f78436c42ea55f4d733d853508632d82efcfdba05063c0f99a114bbc8a3a36998a5ccb94231cfd017b370cba4cbeb69bc009761b097e5d937e5ccbe7cf3217a21c40e83c3c11346045e9efbb3cc32209f3d35a18f381b3b45cf63375107aa3ce600dcd000ac591299a2d94f6bc22bfd39d651bb411f8f5b943c5668a7053f9ffc93e5d801c7653fb545200fc3f625dc809d148614a39d99b5643204552a1425d88cdb79f1f3f8d40278a5e583020a0d2d2eba2279f193729e085cbb22730241495dee2fe7a02930be4e19aa41e5774ff0cac24aa9a0c03ad68a8458279100b772f7ec4fa262cf48f66147d388a00c66d1b20fbcd9f193649d12a1a5ce144d741e9bb3ac3eaaab974637eb79ed3b66eb5aab78c88b2e590ef379c491c5b0f446624483ed0dafc3badb0735227a9c776aee59b16de7e9616cf89218685343a992f8e677c280f272470f7a048276f34e63a5a2b010aba9ed4add1a778677d0f90d9225bd8905eda8d14eb79f3661ef14b7f1ecb8db1448ad8c880a6c02d5d505b70305475182b2ded0f02d983cd66373db424fac19aad75ff0d06684fa959d71451bdf1fd3c4759a45265b7f51ad1df4d2d64994a075c77e4992f9748d770e3a05799b4c5d2879cc52aa16cd80ee4a22710d9607591c8c5b3111082c6c85dc4ade59c6b36c032cc8c3105a58edeb633194829751228bd3b0e7077870ce9f33195e11ed4e40e8f997f75b2edf2224846ce3ebdb3c12efc3a1197de9005dada8f430c3842b47a63911b5d2ad19a83554d5031a950f06b58528ae5a6845f4a9f470e907d50bb9b383a4796758b021f6338a414eab8f364aa9db5dc881bf77a5993b5edbe90ef2fa009ec47eb56dc70ca9a9270a90dfc39042fd4272637368d90559ad5cbda5fa0ce319c440f8d510cec13ec1b79b67f8e8678b15b5bcec1530f7dd959f51d36fdabe1d644f6f6137c7c8be10835181af0be0b0df158993d159585adbd3b319944ccfd917ec6b48df4fa30b73dbca578e7db8d4618e007e74862de91e04f26e092182cc10773218ef63aab9cb7c6d4dc70fa1c67d27435fad1700890a215e11431683a8b35fad5df3d1a941468dcc0fc7327c6c3500b7e9019527c5b540d90a23b318f35f689694414225f8e4fb86ced5e76674e74057054039360b48fb07e4b16985cd1e0fa23ccd94b65b419b1692e5aa47e8418c09fe7e3544a7a9dd0257cee1f6412195b3faacb30b85950954b29a21540e913e4246337801f00c6c8d7eec7353fcd949a806ed05516f47060e2b8ce36e50115759602853775337a82f5de7ea5baf9b90b93e63087e5b83374f617e19c809fb7ec6f5d808c0d6513541db879db4b1fe96b5bff4c06d0f4bc78b8e2edcfa5c6121586e1db5555a0f79221cda405b89c48e273c54d8fa082c6eb10b19e081739c77fb2cae8dd4f0d4aa9c40123ca9e7ecd9a7940dcb0cd35f53b5fe860a94cd3aacd33ad4010bafbae2da293840ffce174ccd38d84cb798d24c483327b00e4a05689403191e8d0451abaef2d202b02985429944f1a46aca8edf4d296f851a6dd4968070db01ae146c2eea577bdf413f43706c2b2203a2289284191547918210bf0b9511a854a73b4819359b58d4330ae13f57ea7c884d050ba17b9434729b0157418e9c2fe1753a761d11c7df1087e7b76a077a575bdeb9a2e23765a891c6b8781c4f31e3fd44dc366d46425c7fb88d87b0eb8e0282b2e8e0e115046bc99bf62362091d99f91a1a6c086c869b11f5be9c5af7683cdff41611aae01b0442cc713e807b3c6c4cb68fa87e4120e6d7fee5c20cd833f3764be474262b4b4cf2ed89fc756d78ed6525e7a6126d494b56e4abb9a6f5b38a770c7e8a853a68a7f115605d17cb41be0535d69cc4ba5154aa7c1fc137818367c4d75880bef8750274c82e51c8a1465cf22e74ebedf0903ff32dcdcc82f373428542f5a2383eb189f84c7740fb596dc149c857696c8f3dc86085e278559fd653ce4d8c36cee80a83be491b4a39459823b293960012862dfdb940b911f97e5b31e63cb7d68db0f67127f8c974c16886b09c038797a43a06469ed2e84e2c17fbe4ef82d9e58b1fe164b08e49ccc9f71f060373be546d5f0277bec5743fcce8f723ea6961207a34f96909610716f6ba1fbcb4322bbf4007c70660f16701f8bfde45eaa739c7f7dfbf3aafe1f9638901b13cb44d9c1ab501b2e900a3eb20b13562395b7570ae32a19b2646b246cd11141368dfd21cf7ada115a9027ad9ef8453201ab80e62444dd0d432d61d1996bd642f103cb5ab031cff0ab2ac5bb508f85caf1168c58ec8a1eb779bd4c0677aa0bcc8754d34fdd87c6277f288c663c30d3331b979e19ba3b1a0b7edd7ab8b4b0c59b9f4e1d29e37e4c0bb0c33e8ce5de37e363c8e7d22754d3bf6b217261450916a595de0fba9e6c0e42bd5b3673b39e0ec8a8952c4960cb1ba8297c9ae91f3e33dbf508c2acaf31a2677b597bb6f8923b474a754087e60d001937412c01cb6cd6818d89925e07f3242140af1f119721d70127b9b6ed40ef6a5af58cc1869835029a3db89c7dea60e3a3c3ff23d68aa4f170334ee9c2d7e2fb96c7c84f6c74d2acfce5b5375e2791bb83dad1c054ea0c47a51f25df6e3c6d7c8a6577574b95a6ac1c06cd048b6e0866eb7ac30bbe0256ff157a65c2029d12f684bfc9f36572b75714a153750736835eb37ce807f790e6f53474082ccbf8313e50a6807e8237a8e4ff237ef4f7e5f5e03f56169f66dc2cc90c07ecc3a525c305ac32fd5613996ff2ada286a03690f66de7be9dfe5f3964405addfa0d69de225716e23212ba736924eaed452a92d029bef82e21cac26e793ba918d9d186198db25aa36feb206a9cebbd7263bea0990e7fdff4db4ccd21634299afe1550fb6d2f28b43b02ba65dadaa420af7f22067948fcec4e2ab566959a4c0e925d63ac69c6ef9eedcd3c0932a26e1e07a7adf19bde32312b41f836943621f3b9c5b5965dae1421470f241b455be436062488b523cd9fcf0648dd75b11a4806ab140a10aec046a9678d291f6a26202d0cf3f93bded3e2514ca08b560960d7aad1127d80c64c8b2382bc26139ec36c24288e0de3e1d8a7ceae69ab455294cc303235cb7f838d2a27fba1fc33783d6f5c3a0d6f8a8b6932f2ae3c43edf8cb0afbde7a4faa475f93530c7bfa149dae19459c64f6ea84eeb46ac40827b6ed4ddfa352dd5a8ea8f733404daf72603c4f45599732dd1fcc10e92704f866a45d6057ccddaf1674c91c64818d867af9bf37bb525bfe67a23ef345c7652d7273152fb733cb94b6fcbca84ad35a9d9abd2756c7903da535a83cc52de61616720f250ec19d72a643ec5dae04fc4efa8cdea534c89fc21f1338289739b56d60d174f996acc97df89b1fb260c6dbbd249072f3b11ee8fd859ca4f6d46f822a551ba820776b98405ed54368d981d92f33fd1b6d211a56807e2e82cf6611057475191df6649b35cb7f04819d3c42698e1b39f4fc321a3be8df658760a8fc1b7ea2fd1d5c4a6cd7a837aca5e2b6cfe79a4dfdc6d321c2ff4f056cdf0dff7d035dfcf777354dace298b44751fb6ac4c301cb7bacb3987fa01cc6073f59621014012d63690d6dc73647c78ffc6760606a2e6d275097a15c2dc17e209249758693763a801ca117caa6b6adb16323a33c0464e83bb21ec032ec3a74a3e8aee593e9be3d515d19b6f5be9cbf5b0fbf74e22e974c10ddda1364f153fd21ce9e0371ddd61cdff47a72dfa9b6cb22518648fb13e94f81f31f5d770e86ea52d8ad2976dea031fcc999bc569dc96b9fce7afc0fa2cce9f9b3b1cacf2f78c78d539e14c1f53b7a9aa2d31a323b04d1c8e2f64e568b6f3a2f4404aaf360e54f6c8fa6cace1c5a8a95f7593b1d4e29f4d838fbeb17b64ee24e1b93f7dcd207b02cc01baf7852a4c1609b8a3f45ea8e5ce94eb7b5cd2b6d08424a0b027edf186433cade2691bf65fefff3ea22f5baad8b5193a98b55bf50451a5c341769a6b09771d75bfbb46de52881c4ffb0e6f991b768a581fee04b9c9df06e6a80bb1d83103c595a56e38ab3d74878026419c91e18", 0xfdd}], 0x2) 2m3.320107308s ago: executing program 1 (id=1230): r0 = socket(0x10, 0x3, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000000000)) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) ioprio_get$pid(0x2, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x31, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000380)='asymmetric\x00', 0x0, &(0x7f0000000880)="1080", 0x2, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) gettid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) semtimedop(0x0, 0x0, 0x0, 0x0) mq_open(&(0x7f0000000580)='!\x7f\x00\xca\x00\x00\x00\f\x00vt\x00\x01E!\x05\x99\xb7|`', 0x6e93ebbbcc0884f2, 0x61, 0x0) 2m0.562550777s ago: executing program 1 (id=1237): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0, @ANYRES16=0x0, @ANYRES64=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRESHEX=r0, @ANYRESHEX=r0, @ANYRES32], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="95c7ed270cb1ff58000000000000000018010000786c6c8dbabb55cf9f8d0700881662a7a727a7a618e430b5c58df660f345a456288ef50000bc18c10fea00000000000701ffb700000000000000b70000000000000000000000690700006609ad4d2199aa0aef882e485f999dd7b217092da616107c7359678b1a90ab97afe709e0ad99c8a39bba0388e517087eb269f972df42b0bb3fc446b705c1f6eb9834eba9cabf4b2413e64fc42e26be1343e38d53e7cce1760a628ba32cffffffffff549be431602d968eed8706b23f26fbbfe2c9e332cc9e3a987b6708edb44501501a144ac25b2ce34401eaf18ab477000bf94cbdf2d0264b0dfb86b4f2829c9c194b37101e4064b826ef", @ANYBLOB="16d7b2d425a8a45d3944edd80df61e01b8fc6d00d6aad6f3c4293fe93364a9372569e8a546ea9823b71afb76ad2ccab7cb2c1191fae67fd491e66ed8ac1ed1e27e34b44802f218202df7187820385761246f847e309ea3cff768963d5b1a175fca065c1fd484d7c3fbdeb31a00b57116f68261bd05ab8fa7003b4cb7a0a79757a1e11668f44f7c4c9581efd401f19a5245f84ea58c1fcacf3fa8f5f5254b3d0d17273b1a75e564ff883de779bb187985ce71a06a53772804757e1602472b2960c2ed9c79c05c5a71cb22bb625e9a8e6b34ee35bf61ff65eafca088fbd0d2cfbad3cb236c7f17037f1962f99a5f8267ec1933ff3f92ef", @ANYRESHEX=r0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r1}, 0x10) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000980)={0x6}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r5, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r5, 0x0, 0x7, &(0x7f0000000140)=0x30, 0x4) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffff0180c20000000800460c0020006800000011907800000000000000000703c70000004e2000089078291a6b9f1159d85c56c0ba504666ebf55a1fc266b506836bf1d12ae959f14523"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x21, 0x0, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) syslog(0x9, &(0x7f00000001c0), 0x0) sendfile(r6, r6, 0x0, 0x9) 1m59.53447844s ago: executing program 1 (id=1238): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x1000810, &(0x7f0000000400)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) chdir(&(0x7f0000000080)='./file1\x00') r4 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r6 = dup3(r4, r5, 0x0) ioctl$MON_IOCX_GETX(r6, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000002240)=""/4119, 0x1017}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r6, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x2, 0x8, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x806}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x800}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000840}, 0x8c0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r7, 0x0) r8 = open(&(0x7f0000000140)='./file0\x00', 0x181000, 0x40) mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup\x00', 0x0, 0xb24050, 0x0) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x122) ioctl$AUTOFS_IOC_READY(r9, 0x9360, 0x800000000000001) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r8) 1m59.444831076s ago: executing program 1 (id=1240): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000180), 0x4) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e7cfc12178ac0ab1e6227c2b6ddaa5effda90", 0x5, 0x16, 0xfffffffe, 0x1}, 0x3c) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r2, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f0000000180)=0x13) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newsa={0x13c, 0x10, 0x413, 0x70bd29, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x27}, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x4e24, 0x0, 0x8800, 0x0, 0x20, 0x21}, {@in6=@mcast1, 0x0, 0x32}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x8, 0x80000, 0x81, 0x80000}, {0x0, 0x5, 0x4, 0x4000006}, {0x0, 0xfffffffd, 0x80000}, 0x0, 0x0, 0xa, 0x4, 0x81, 0x68}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x80}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x612fc0b6c779297b}, 0x0) 1m58.48414535s ago: executing program 1 (id=1243): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2060, 0x0) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(0xffffffffffffffff, 0xc1004110, &(0x7f0000000000)={0x0, [0x0, 0xffff133a, 0x3], [{0x0, 0x0, 0x0, 0x1}, {0x35, 0x35}, {0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xe6f6}], 0xc}) unshare(0x2040600) r9 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r9, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) sendmmsg$inet6(r9, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000000000008000a000100000008001800ac1414aa08001900e000000214001b0017"], 0x58}}, 0x0) 1m58.249348211s ago: executing program 34 (id=1243): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2060, 0x0) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(0xffffffffffffffff, 0xc1004110, &(0x7f0000000000)={0x0, [0x0, 0xffff133a, 0x3], [{0x0, 0x0, 0x0, 0x1}, {0x35, 0x35}, {0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xe6f6}], 0xc}) unshare(0x2040600) r9 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r9, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) sendmmsg$inet6(r9, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000000000008000a000100000008001800ac1414aa08001900e000000214001b0017"], 0x58}}, 0x0) 1m57.962921795s ago: executing program 6 (id=1196): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) r4 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r4, &(0x7f0000000140)=[{&(0x7f0000000a40)=""/65, 0x41}], 0x1, 0xfffffffc, 0x104) 1m56.943299959s ago: executing program 6 (id=1247): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000007500)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x6, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000540)=[@flowinfo={{0x14, 0x29, 0xb, 0x7}}, @dontfrag={{0x14}}, @flowinfo={{0x14}}], 0x48}}], 0x1, 0x68034) r1 = socket(0xa, 0x2, 0x0) r2 = dup(r1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, &(0x7f0000000280), &(0x7f0000000080)=r2}, 0x20) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1m56.92646519s ago: executing program 6 (id=1248): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) read$FUSE(r0, &(0x7f00000022c0)={0x2020}, 0x2020) r1 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100, 0x0, 0x2000000}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r1, 0x48e9, 0x0, 0x2, 0x0, 0x0) write$FUSE_NOTIFY_RESEND(r0, &(0x7f00000076c0)={0x14, 0x7, 0x0, 0x4000000}, 0x14) 1m56.8559609s ago: executing program 6 (id=1249): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x1000810, &(0x7f0000000400)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) chdir(&(0x7f0000000080)='./file1\x00') r4 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r6 = dup3(r4, r5, 0x0) ioctl$MON_IOCX_GETX(r6, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000002240)=""/4119, 0x1017}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r6, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x2, 0x8, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x806}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x800}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000840}, 0x8c0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r7, 0x0) r8 = open(&(0x7f0000000140)='./file0\x00', 0x181000, 0x40) mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup\x00', 0x0, 0xb24050, 0x0) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x122) ioctl$AUTOFS_IOC_READY(r9, 0x9360, 0x800000000000001) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r8) 1m56.758704259s ago: executing program 6 (id=1250): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r0}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) chroot(&(0x7f0000000000)='./file0\x00') mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x89901) move_mount(r2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x206) 1m56.446398523s ago: executing program 6 (id=1254): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) socket(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000a40)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xefff}}}}}}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000340)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x8, 0xc2, 0xffff, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x25, 0x1}]}}}}}}}}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'pim6reg1\x00', 0x2}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x1a0, 0x4c, 0x1a, 0x1a0, 0x73, 0x300, 0x258, 0x258, 0x300, 0x258, 0x3, 0x0, {[{{@ipv6={@remote, @local, [0x0, 0x0, 0xff], [0x0, 0xffffff00], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x11}, 0x0, 0x138, 0x1a0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'veth0\x00', 0x24, 0x3, 0x8, 0x2, 0x39, 0x80000001, {0x8001}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0xe, 0xb, 0xc, 0xc07, 'syz1\x00', 'syz0\x00', {0x2}}}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@icmp6={{0x28}, {0xc, "fc84"}}, @common=@icmp6={{0x28}, {0x0, "e1f6", 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x14, 0x8000, 0x7, 0x18d, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0x8000000000000000, 0x8000f, 0x7fff, 0xfffffffffffffffe, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x9, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) getrusage(0xffffffffffffffff, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r6 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r6, &(0x7f00000052c0)={0xa, 0x4e20, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xc}, 0x1c) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) 1m56.224755713s ago: executing program 35 (id=1254): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) socket(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000a40)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xefff}}}}}}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000340)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x8, 0xc2, 0xffff, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x25, 0x1}]}}}}}}}}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'pim6reg1\x00', 0x2}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x1a0, 0x4c, 0x1a, 0x1a0, 0x73, 0x300, 0x258, 0x258, 0x300, 0x258, 0x3, 0x0, {[{{@ipv6={@remote, @local, [0x0, 0x0, 0xff], [0x0, 0xffffff00], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x11}, 0x0, 0x138, 0x1a0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @common=@unspec=@rateest={{0x68}, {'veth1_vlan\x00', 'veth0\x00', 0x24, 0x3, 0x8, 0x2, 0x39, 0x80000001, {0x8001}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0xe, 0xb, 0xc, 0xc07, 'syz1\x00', 'syz0\x00', {0x2}}}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@icmp6={{0x28}, {0xc, "fc84"}}, @common=@icmp6={{0x28}, {0x0, "e1f6", 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x14, 0x8000, 0x7, 0x18d, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0x8000000000000000, 0x8000f, 0x7fff, 0xfffffffffffffffe, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x9, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) getrusage(0xffffffffffffffff, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r6 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r6, &(0x7f00000052c0)={0xa, 0x4e20, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xc}, 0x1c) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) 17.438137521s ago: executing program 8 (id=1672): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x8021}, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e24, 0x1ff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2a}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0xc96f20a, @local, 0x6}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="e60cb6d8071a4c67158373aa2717622ed96dd814fb5b3f0c9b4cf02ec0fd7b94d8c088e73e247a70aa09b06ce7af090fe66a8129b6099cc8a072dbb3da6c7cad147e10662174988e17a4bced573519478e8254f81263da7f3a0377d6fa9c149bad0e09e3ebf7a9e049b79427030b98bd626693836eebb95767b660140437f6df6e75d7a19c8fbd4579537f0161f4b08c6f23bea8fced483b0bcb181297ea072f812edf3bd80f28207edd52779af532ca253bc5e0201617eb873992286d2ad25bd90c9d83e7780227deff708bac8404e9861e5b95694219eddbeba6bcdf6bb92c940917735b292b189be781db192df87fffff8be5ac4a26354c28", 0xfa}, {&(0x7f00000000c0)="0fec09963a6ceedb461bfd617d1ba526d0209cc369223fe1453c361d8c2308bb36d2dce7a409f8d2efe0", 0x2a}], 0x2}}], 0x1, 0x4001c00) 17.178493076s ago: executing program 8 (id=1674): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000001a40), 0x800, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f0000001a80)=@s={0x5, @SEQ_MIDIPUTC=0x9b, 0x1c, 0xd}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x54}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r4 = accept4$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000100)=0x10, 0x100000) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') preadv(r5, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000140)={@initdev, @initdev}, &(0x7f0000000180)=0xc) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0xf0b, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x800000, 0x0, 0xffffffff}, 0x20, 0x0, 0x7, 0x8, 0x101, 0x14, 0x0, 0x0, 0x0, 0x0, {0x200}}}}]}, 0x78}}, 0x4080) 16.789836759s ago: executing program 8 (id=1677): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002214c6a0009050702000000da000905890e"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newtaction={0xc0, 0x30, 0x1, 0x2, 0x25dfdbfc, {}, [{0xac, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x2, 0x4, 0x8000447, {}, {0x0, 0x0, 0x0, 0x0, 0x9}, 0xfffffffd, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x3c, 0x2, 0x0, 0x0, {{0xb}, {0x10, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE64={0xc, 0x8, 0x8000000000000001}], [], []]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x8010}, 0x44830) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r2, &(0x7f0000000580)='1\x00', 0x2) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000980)=ANY=[@ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f0000000540)=ANY=[@ANYRES32=r3]) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r4, 0x800442d2, &(0x7f0000000440)={0x1, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, @link_local}]}) r5 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, &(0x7f0000000000)={0x40, 0xe, 0x39, {0x39, 0x22, "d2cfe3bff236de6cd67f5ead472b99f4e346cadfb285f9236518898a071d8cad76a9cbae41243c375c9065cc3ba50d040e03e14772ed0b"}}, &(0x7f0000000040)={0x0, 0x3, 0x45, @string={0x45, 0x3, "3a7b12f58d5a5173679c76378bc8b8306a4590c42642a5a6858043a02842afd8586752f348e3902807990b96eb9035ec3c5e842b56cab9e86fece15a58a232817f04b8"}}, &(0x7f00000000c0)={0x0, 0xf, 0xa8, {0x5, 0xf, 0xa8, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x8, 0x3, 0xfff9}, @generic={0x7a, 0x10, 0x2, "1f89f732be20c8e76b28fd94737439eafe33a2841037473cd66b194733e6d3e50c6c42426a1963964c470f154765ac4df82ae0e36fd2c93ecc253dd4c13e97c3daad580d66f5fc54cdabfac83e5ac3df652f3c3a052f9132a4ba1ae8e8fefb877fd240fe70fd6d5846fe277b8c2eb80e7b9a4afa61242f"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xdb, 0x9, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x7, 0x8, 0x9}, @wireless={0xb, 0x10, 0x1, 0x8, 0x40, 0x0, 0x0, 0xa3, 0x3}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x2, 0x0, 0x3, "8be6ab3f", "c344a658"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x18, 0x8, 0xfe, 0x7, 0x8, 0x7ff}}}, &(0x7f0000000740)={0x84, &(0x7f0000000280)={0x0, 0x14, 0x9a, "f9d9d5f99bcfc83e99f71cf47626374ecf9157508a2bf9e76bb387ae225c6aa211535f1bb8f9d8218b5200dde50ecd767a1013bcdba656054c7514226c83542b2c4f4f58c074c7ca483d2a12556612c0259efb0c9a30cea667072f5aececbcda293e7749636c7e35389602e8b1efbfd791880cbfbf7520bbdb641dc6ba3487b24652d85b3739b68df9f8d8e3ae3f7f757a202c3df673d181e2b1"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0xb9}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x400, 0x10}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x7}, &(0x7f0000000480)={0x40, 0x9, 0x1}, &(0x7f00000004c0)={0x40, 0xb, 0x2, "d831"}, &(0x7f0000000500)={0x40, 0xf, 0x2, 0x8a}, &(0x7f0000000580)={0x40, 0x13, 0x6, @local}, &(0x7f00000005c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000600)={0x40, 0x19, 0x2, "8fd4"}, &(0x7f0000000640)={0x40, 0x1a, 0x2, 0x999}, &(0x7f0000000680)={0x40, 0x1c, 0x1, 0xcb}, &(0x7f00000006c0)={0x40, 0x1e, 0x1, 0x5}, &(0x7f0000000700)={0x40, 0x21, 0x1, 0x1}}) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000008c0)={0x14, &(0x7f0000000800)={0x0, 0x23, 0x51, {0x51, 0x21, "87ea4d1836c4e8715c3dbc771511890997d05de538e3054916da4dda1567592fff4543a20e95aa7c947d9e424fe1dbcfa24664524a8ce5b2f47c1afbe1a1678d94183b4f2d28e3337fcb54bcb849de"}}, &(0x7f0000000880)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b80)={0x1c, &(0x7f0000000900)={0x40, 0xe, 0x73, "5e5a308a345328ba908bb88271a43715a7fc3ec0d7c5dbc43b21f6fba80701643f0a0954b12feda0c87a03e329590ff41e0c4a6a676c9c7b46c6c0f9e06eda78a9055e88b4d22af2e5652304296d0d0714e4d80cb0380274f2f1ecde5de1867657ace66aa1144d73d11a88c66c78c081a41426"}, &(0x7f0000000b00)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000b40)={0x0, 0x8, 0x1, 0x6}}) 13.534679169s ago: executing program 8 (id=1686): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0xcc) fanotify_mark(0xffffffffffffffff, 0x601, 0x30, 0xffffffffffffffff, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r4 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x38, 0x2, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040090}, 0x1004) ioctl$VIDIOC_ENUM_FREQ_BANDS(r4, 0xc0405665, &(0x7f00000000c0)={0x0, 0x1, 0x7, 0x8, 0x2, 0x100059a, 0xbfc4bb97dfede4bd}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 11.198664157s ago: executing program 8 (id=1693): close(0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)={0x14, 0x38, 0x701, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) setpgid(0x0, r0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x24000, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x36, 0x3e, 0x72, 0x20, 0x6cd, 0x10c, 0x7109, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0xd, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x6c, 0x0, 0x1, 0x25, 0xd1, 0x16, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0xff}}]}}]}}]}}, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) mknod$loop(0x0, 0x6000, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SIOCSIFHWADDR(r4, 0x890b, &(0x7f0000000000)={'ipvlan0\x00', @random="0200ff7fffff"}) 9.266425947s ago: executing program 8 (id=1701): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES16=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x2cc}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_IRQCHIP(r3, 0xc208ae62, &(0x7f00000002c0)={0x1, 0x0, @pic={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) r4 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000740)={'bond_slave_0\x00', &(0x7f0000000700)=@ethtool_pauseparam={0x13, 0x2, 0x967e, 0x5}}) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x481, 0x0) r7 = dup(r6) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r8}, 0x10) ioctl$PTP_EXTTS_REQUEST2(r7, 0x40603d07, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) sendmmsg$inet(r4, &(0x7f0000000600)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e01, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="100000004407000000"], 0x10}}], 0x2, 0xe000) preadv(r1, &(0x7f0000000100), 0x8004b53c5bd8e4d, 0x9, 0x80003) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES16=r0, @ANYRES16=0x0, @ANYRES32=r0], 0x2cc}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) ioctl$KVM_SET_IRQCHIP(r3, 0xc208ae62, &(0x7f00000002c0)={0x1, 0x0, @pic={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) (async) socket$inet(0x2, 0x3, 0x4) (async) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) (async) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000740)={'bond_slave_0\x00', &(0x7f0000000700)=@ethtool_pauseparam={0x13, 0x2, 0x967e, 0x5}}) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x481, 0x0) (async) dup(r6) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r8}, 0x10) (async) ioctl$PTP_EXTTS_REQUEST2(r7, 0x40603d07, 0x0) (async) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) (async) sendmmsg$inet(r4, &(0x7f0000000600)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e01, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="100000004407000000"], 0x10}}], 0x2, 0xe000) (async) preadv(r1, &(0x7f0000000100), 0x8004b53c5bd8e4d, 0x9, 0x80003) (async) 8.380730913s ago: executing program 7 (id=1705): prlimit64(0x0, 0x4, &(0x7f0000000140)={0x8, 0x40008b}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xb635773f06ebbeef, 0x10010, 0xffffffffffffffff, 0x1bec3000) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000004540)='./file0\x00') r4 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x2000, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) socket(0x1d, 0x2, 0x6) chdir(0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x141842, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x275a, 0x0) copy_file_range(r8, &(0x7f00000001c0)=0xffffffffffffff7f, r7, 0x0, 0x81, 0x10000000000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r9 = getpid() sched_setscheduler(r9, 0x2, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x100000b, 0x2010, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) connect$unix(r10, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) futimesat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={{0x77359400}}) 6.766486431s ago: executing program 7 (id=1707): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) syz_open_procfs(0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r5}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r7, 0x701, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x40000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {}, {0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc10c5541, &(0x7f0000000080)=0x1f00) 6.617486689s ago: executing program 7 (id=1709): socket(0x10, 0x803, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) io_uring_setup(0x4aec, &(0x7f0000000140)={0x0, 0x81fa, 0x80, 0x1, 0x7a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x6c, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x6c}}, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x2000, 0x2, 0x3}, 0x18, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x3f, 0x40, 0x42, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000001a40), 0x1003, r8}, 0x38) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c9, &(0x7f0000000100)) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2000, r3}, 0x0) 4.562753099s ago: executing program 7 (id=1715): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00'}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0xf59}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) quotactl$Q_GETINFO(0xffffffff80000501, &(0x7f00000014c0)=@filename='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = io_uring_setup(0x1abf, &(0x7f0000000000)={0x0, 0xa4ec, 0x0, 0x1, 0x3a8}) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101100) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000240)=0xffe) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x24400, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_io_uring_setup(0x1bff, &(0x7f0000000340)={0x0, 0x4, 0x1, 0x8003, 0x4025f}, 0x0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_io_uring_setup(0x41a, &(0x7f00000000c0)={0x0, 0x400000, 0x20000, 0xfffffffb, 0x10}, &(0x7f0000000200), &(0x7f0000000400)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[@ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0xfff, 0x6], 0x2) 4.320466719s ago: executing program 5 (id=1716): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0xc8080) preadv2(r0, &(0x7f0000000500)=[{&(0x7f00000000c0)=""/156, 0x9c}, {&(0x7f00000001c0)=""/6, 0x6}, {&(0x7f0000000400)=""/34, 0x22}, {&(0x7f0000000440)=""/139, 0x8b}], 0x4, 0x9, 0x6, 0x6) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0x639) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000540)={@private=0xa010102, @multicast2, 0x0, "ec12843cd00d245fe79a2c4e291ee5cea69546441c9f370331aa249e43bb5c77", 0x1, 0x5, 0x3, 0x2}, 0x3c) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) r3 = socket(0x11, 0x3, 0x0) r4 = epoll_create1(0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0xe000202b}) dup3(r3, r5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x4ffe2, 0x0) modify_ldt$read(0x0, &(0x7f0000000840)=""/4096, 0x1000) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f0000001ac0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000002c0)={{0x0, 0x5, 0xfeff, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x1, r8, 0x0, 0x0, 'syz1\x00', 0x0}) 3.126617987s ago: executing program 4 (id=1721): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet(r0, &(0x7f0000001fc0)={0x2, 0x0, @remote}, 0x10) (async, rerun: 64) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080), 0x4) (async, rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xff, 0x8}}, '\x00'}) (async, rerun: 64) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) (rerun: 64) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000034d564b0000000001"]) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x0) (async, rerun: 64) open(&(0x7f0000000100)='./bus\x00', 0x143142, 0xa2) (async, rerun: 64) close(0x3) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@decrefs={0x40046307, 0x3}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda={0x66646185, 0x8, 0x1, 0x16}, @flat=@handle={0x73682a85, 0x1000, 0x3}, @fda={0x66646185, 0x9, 0x1, 0x38}}, &(0x7f00000001c0)={0x0, 0x0, 0xfffffffffffffd98}}, 0x40}, @register_looper], 0x0, 0x0, 0x0}) (async, rerun: 64) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (rerun: 64) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) (async) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000540)={0x0, 0x0, 0x0, &(0x7f00000004c0)=""/120, 0x0, 0x80a0000}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x5000}) (async) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000380)) (async, rerun: 32) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x20000) (async, rerun: 32) ioctl$VHOST_GET_VRING_ENDIAN(r4, 0x4028af11, &(0x7f00000001c0)) (async, rerun: 64) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x8}, @hci_rp_read_page_scan_activity={{0x8}, {0x7, 0x7, 0xffc}}}}, 0xb) (rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) (rerun: 64) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000200)={0x2, @vbi={0x9, 0x7, 0x80000000, 0x34524742, [0x1001, 0x7], [0x9, 0xfff], 0x108}}) (async, rerun: 64) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000940), &(0x7f0000000980)='system_u:object_r:netutils_exec_t:s0\x00', 0xf, 0x0) (rerun: 64) 3.076356855s ago: executing program 2 (id=1723): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff", @ANYRESDEC=0x0], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000002c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000100)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7aa, &(0x7f0000000000)={{@any, 0xffffffff}, @any, 0x7, 0x4, 0x40000, 0x7ffffffffffffffe, 0x7ffffffffffffffc, 0x0, 0x9}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x14, r1, 0x1, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4000804) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r6, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000b00)={0x2c, r7, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_SEC_KEY={0x10, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x2c}}, 0x20000000) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0x124, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x4c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xd1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_SEC_LEVEL={0x2c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000001}, @NL802154_ATTR_SEC_LEVEL={0x2c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_SEC_LEVEL={0x44, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x124}, 0x1, 0x0, 0x0, 0x84d}, 0x10) 2.993633787s ago: executing program 4 (id=1724): r0 = fsopen(&(0x7f00000001c0)='binder\x00', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x208, 0x1ffe0000000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x800002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) syslog(0x2, &(0x7f0000000640), 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz1\x00', 0x1ff) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50) rt_sigaction(0x40, 0x0, 0x0, 0x8, &(0x7f0000001540)) syz_open_dev$tty20(0xc, 0x4, 0x1) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='xfs\x00', 0x808c, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000400)={0x2, 0x9, 0x0, {0x7, 0xe}, 0x7, 0x40}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="6c6f63eb20696f2b6d656d00"], 0xc) write$vga_arbiter(r3, &(0x7f00000000c0), 0xf) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) msgctl$IPC_INFO(0xffffffffffffffff, 0x3, &(0x7f0000000300)=""/249) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x0, 0x18c, 0x203, 0x320, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x20, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x6}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) listen(r2, 0x9) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 2.734722798s ago: executing program 7 (id=1725): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040)={0x400, 0x203}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mknod(0x0, 0x800, 0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00001c7000/0x3000)=nil, 0x3000, 0xb635773f06ebbeee, 0x40010, 0xffffffffffffffff, 0xf405000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendto$inet(r0, &(0x7f0000000100)="ab", 0xff04, 0x40048c4, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0400000004000000040000000500010000080000b409878474d6b866ffde5558ae84dc91d03dee03992c45d6a9df3e82d4f6213ed34908d790", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) close(r6) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000f9ffffff0000000000200000850000002000000018010000756c6c2500000000002020207b1af8ff00000000bfa10000000000000701fffff8ffffffb702000008000000b70300000000000085000000700000009500000000000000ade06e93a40d8100a2ade2a4ad670d8e134ff9ad579b57800ed63015eb"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e09f547ed3f02dc1fd3d6487775b", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0x10001, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRESDEC=r8, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r8, @ANYBLOB="04005b0006006500400004691ce5"], 0x28}}, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x600, &(0x7f0000000840)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 2.500034743s ago: executing program 2 (id=1726): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f0000000480)={0x18}, 0x18) write$FUSE_INIT(r2, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x772, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="050000"], 0x50) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={r8, &(0x7f0000000180), &(0x7f0000000200), 0x1}, 0x20) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000000c0)={{0x3, 0x2, 0x8, 0x3, 0x1000}}) sendmmsg$unix(r7, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$gtp(&(0x7f0000000340), r2) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) write$P9_RVERSION(r2, &(0x7f0000000180)={0x13, 0x65, 0xffff, 0xffffff77, 0x6, '9P2000'}, 0x13) write$FUSE_INIT(r3, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) 2.398453992s ago: executing program 7 (id=1727): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000405707000a00000000000109022400010000950009040103000000092104000001220700090581030004000008"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000e80)={0x24, 0x0, 0x0, &(0x7f0000000980)={0x0, 0x22, 0xa, {[@global=@item_4={0x3, 0x1, 0x7, "490d868e"}, @local=@item_4={0x3, 0x2, 0x7, "3edb206e"}]}}, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000180)) syz_usb_disconnect(r0) 2.087053718s ago: executing program 4 (id=1728): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x4) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) chroot(&(0x7f0000000000)='./file0/../file0\x00') mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x60) getdents64(r0, 0x0, 0x0) 1.976308425s ago: executing program 4 (id=1729): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff2}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}}, 0x20040000) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000240)={0x3, @raw_data="566e425a6c36af37b33fac9d31c8a9c7044410d324b03e044e454d2092a62fea8f13441431ce248bfc73a6726ae61ba45d8f392ff66fe0b17f0e11f5d2367d5593205ab1efa97d40619a552e7da2518125b850a186ef691daa55c9e50ffaf6ddc25220ded32aeba4524cec1afbd17abba1d15ea05e97ed3dcad452db6e088991e2c78b05df55de7fdeba7411ce65700c0a1ad7946fd8464cfc8f174e1b5abb7a37a06731ed19ddfa970bb58a27fd9fa194c09273031900"}) 1.820841599s ago: executing program 5 (id=1730): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x6de4, &(0x7f0000000180)={0x0, 0x113a, 0x2, 0x2}, &(0x7f00000000c0), &(0x7f0000000000)) io_uring_enter(r3, 0x0, 0xe38e, 0x5, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) getdents64(r4, &(0x7f0000001f00)=""/4093, 0xffd) io_uring_register$IORING_REGISTER_BUFFERS2(r3, 0xf, &(0x7f00000024c0)={0x2, 0x0, 0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000240)=""/191, 0xbf}], &(0x7f0000002480)=[0x0, 0x2]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) socket$nl_route(0x10, 0x3, 0x0) ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)=ANY=[]) read$FUSE(r5, 0x0, 0x0) creat(0x0, 0x6a) mknod(&(0x7f00000000c0)='./file1/file3\x00', 0xc000, 0xc1b) r6 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x543240, 0x0) ioctl$int_in(r7, 0x5452, &(0x7f00000000c0)=0x9) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f00000000c0)={0x0, 0x3234564e, 0x0, @discrete={0xfffffffa}}) syz_fuse_handle_req(r5, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) 1.726474416s ago: executing program 4 (id=1731): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x5, 0x2}, 0x1c) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000500)="c6291789c23057a8f61cfdf6894ed5678ca31d571a2afca1b6dca1c9f24b1af275c7118797e9141a4db290f7f58cf7957c4e2602c8cb07efd826cd2dcbdcd4476c63257638fbf343ace184e239045a67507248ad81c658374dd17e9e604dfe00a306d80275c7a610620d7d6aab543926f631efd828da17f2c8f47a7c2246d8ca2a3cec7303c7", 0x86}, {&(0x7f00000005c0)="cf9e034ffff83276af188123d87a86802692f5fdf4cd12e2859811b58c6b34f7dd8f2b128bb34c51b8aa65f4b438e5552defcd78b7a7f31c402f0d331a8e01b0cbec3dc8bd5dc95b9436ad0543fcdb9c7b7e0e1c93ad5108a04ae9c533a1d29e8fac550117e2c39f5052a8c7fd04053af72f9c3ca4f8e06e77d8fc4431d12c6d6e6f0b3c9fe858d2c565c2b27b", 0x8d}, {&(0x7f0000000180)="c4c5c12b68ace27a67aa4cc2048347135f952bbb68b0d0819565c2584d63f3068c66b79e40ba8b7737d11b5c6b166034a24c4647d101697f8e9f0352386475", 0x3f}, {&(0x7f0000000300)="e16b97ab109ff1e23d56c309f687679c267b7dd9d500f8cbf738ca22d7dcb69609044969902661b70b57b19a6279", 0x2e}], 0x4, &(0x7f0000000400)=[{0x20, 0x3a, 0xcc, "b92cbdda3669a847629ad9ab8a6f"}], 0x20}, 0x80) setsockopt$MRT6_TABLE(0xffffffffffffffff, 0x29, 0xd1, &(0x7f0000000040)=0xffffffff, 0x4) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240), 0x8) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="a0cd0a59e14a1a001ae85ec303fc69a0037e77a9b70767bcbe8add839d0efaed096b61b9bcf43f9e58"], &(0x7f00000000c0)='syzkaller\x00', 0xffff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r6}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r7, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x2}]) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) 1.27480092s ago: executing program 2 (id=1732): socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000100)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000040)="26753fa466231a419b9acb7114c8505fb367a3361a938551a4b887de0592b3e98e5ff92ca2c52311ebd58feb279c14c1255b1abc0aa8f109fbe3dc851afd8a578e50b7481137384839d3b30854fc1b609dd4116d3cc6b751b9c6f17d902419a2993a74c22205225900dc5345d6a41b805cdcb52e3c6e2337de3ef6c2be9721377df3fab1254ca214aaa50d468a9bd38d4469db0951d1b6d99ff743a0436e7cfe627af9350817a8908ba562", 0xab}], 0x2) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010000000004"], 0x57) 1.021182134s ago: executing program 2 (id=1733): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e21, 0x4004, @loopback, 0x2007}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async) listen(r0, 0x0) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x8000000004) (rerun: 32) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) (async) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) (async, rerun: 64) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) (rerun: 64) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x19) (async, rerun: 32) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r4}, 0x18) (async) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x108, 0x100, 0x100, 0x1, 0x4000}}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) pidfd_getfd(r7, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r2, 0x0) 882.388007ms ago: executing program 2 (id=1734): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x6c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x40, 0x3, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x30, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xfffffffffffffffc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000900)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c5819c", 0x34, 0x3a, 0x0, @dev, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "5ad10a", 0x0, 0x2b, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, [], "aaa12ba2"}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r5}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x80540, 0x188) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x700, 0x0, 0x0, 0x0, {{0x14, 0x4, 0x0, 0x0, 0x50, 0x0, 0x89, 0xfd, 0x0, 0x0, @broadcast, @private, {[@timestamp_addr={0x44, 0x14, 0xf9, 0x1, 0x0, [{@multicast2, 0x7f}, {@multicast2, 0x40}]}, @rr={0x7, 0x27, 0xa5, [@empty, @private=0xa010100, @local, @rand_addr=0x64010100, @loopback, @remote, @private=0xa010100, @loopback, @broadcast]}]}}}}}) 881.495292ms ago: executing program 5 (id=1735): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00'}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0xf59}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) quotactl$Q_GETINFO(0xffffffff80000501, &(0x7f00000014c0)=@filename='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = io_uring_setup(0x1abf, &(0x7f0000000000)={0x0, 0xa4ec, 0x0, 0x1, 0x3a8}) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101100) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000240)=0xffe) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x24400, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_io_uring_setup(0x1bff, &(0x7f0000000340)={0x0, 0x4, 0x1, 0x8003, 0x4025f}, 0x0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0xffffffff, 0xffdffffe}, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[@ANYRES64], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0xfff, 0x6], 0x2) 760.131355ms ago: executing program 4 (id=1736): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff", @ANYRESDEC=0x0], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000002c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000100)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7aa, &(0x7f0000000000)={{@any, 0xffffffff}, @any, 0x7, 0x4, 0x40000, 0x7ffffffffffffffe, 0x7ffffffffffffffc, 0x0, 0x9}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x14, r1, 0x1, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4000804) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r6, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000b00)={0x2c, r7, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_SEC_KEY={0x10, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x2c}}, 0x20000000) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0x124, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x4c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xd1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_SEC_LEVEL={0x2c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000001}, @NL802154_ATTR_SEC_LEVEL={0x2c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_SEC_LEVEL={0x44, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x124}, 0x1, 0x0, 0x0, 0x84d}, 0x10) 216.415984ms ago: executing program 5 (id=1737): r0 = socket$kcm(0x2, 0x3, 0x2) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x6}, {0x0, [0x0, 0x2e, 0x61, 0x61]}}, &(0x7f0000000140)=""/183, 0x1e, 0xb7, 0x1, 0x1, 0x0, @void, @value}, 0x28) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d8000000", @ANYRES16, @ANYBLOB="04002dbd7000f2dbdf254f0000000c00839ced540000680000004c007a8008000400000000181c000200134ecc4d908540c3c8630b918a29360800040004005111335ced5fd94e0800040009000000080004000300000048007a801400010003d869f47d8c428eaa74b31794b4b314b5000400000000000c0003004180081ee4f88f1a080004000c0000000c0003007858754e3c504054080004000800000004007a8020007a800800040005000000140002002929590c"], 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) ioctl$FS_IOC_GETVERSION(r4, 0xc040ff0b, &(0x7f0000000180)) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1d, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x1, 0xc, 0x5, 0xb73}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x492, @void, @value}, 0x94) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9521, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x10}, @multicast1}}}, @ip_retopts={{0x10}}], 0x30}, 0x8004) socket$kcm(0x2, 0x3, 0x2) (async) socket$inet6(0xa, 0x3, 0x8000000003c) (async) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @local, 0x7}, 0x1c) (async) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x6}, {0x0, [0x0, 0x2e, 0x61, 0x61]}}, &(0x7f0000000140)=""/183, 0x1e, 0xb7, 0x1, 0x1, 0x0, @void, @value}, 0x28) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d8000000", @ANYRES16, @ANYBLOB="04002dbd7000f2dbdf254f0000000c00839ced540000680000004c007a8008000400000000181c000200134ecc4d908540c3c8630b918a29360800040004005111335ced5fd94e0800040009000000080004000300000048007a801400010003d869f47d8c428eaa74b31794b4b314b5000400000000000c0003004180081ee4f88f1a080004000c0000000c0003007858754e3c504054080004000800000004007a8020007a800800040005000000140002002929590c"], 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_pidfd_open(r3, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) ioctl$FS_IOC_GETVERSION(r4, 0xc040ff0b, &(0x7f0000000180)) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1d, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x1, 0xc, 0x5, 0xb73}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x492, @void, @value}, 0x94) (async) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9521, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) (async) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x10}, @multicast1}}}, @ip_retopts={{0x10}}], 0x30}, 0x8004) (async) 94.613808ms ago: executing program 5 (id=1738): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r5 = dup3(r3, r4, 0x0) ioctl$MON_IOCX_GETX(r5, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000002240)=""/4119, 0x1017}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r5, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x2, 0x8, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x806}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x800}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000840}, 0x8c0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r6, 0x0) setpgid(0x0, r6) r7 = open(&(0x7f0000000140)='./file0\x00', 0x181000, 0x40) mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup\x00', 0x0, 0xb24050, 0x0) r8 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x122) ioctl$AUTOFS_IOC_READY(r8, 0x9360, 0x800000000000001) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r7) 89.702203ms ago: executing program 5 (id=1739): r0 = socket$inet6(0xa, 0x3, 0x2) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000dc0)=ANY=[@ANYBLOB="01000000000000000a004e2300000006fe8000000000000000000000000000aa080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000070000000a004e21000003a8fc010000000000000000000000000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c1e34890000000000000000000000000000000000000000000000000000000000000000000000000a004e2400000006000000000000000000000000000000010a0000000000000000000000000000000000000000000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f9ffffff240000672aff02000000000000000000000000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000040fe80000000000000000000000000003405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001100000000000a004e2400000006ff02000000000000000000000000000109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2400000007fe88000000000000000000000000000101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000006ff0100000000000000000000000000010200"/1038], 0x410) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000001c0)={0x0, 0x4, 0x1b}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$alg(0x26, 0x5, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2000000) ioctl$KVM_CLEAR_DIRTY_LOG(r5, 0xc018aec0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) open$dir(&(0x7f0000000040)='.\x00', 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f0000000100)='.\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, 0x0) bind$alg(r3, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) r6 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) r7 = getpid() r8 = fsopen(&(0x7f0000000100)='squashfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000000)='s\x19\x18\x00\x00e', &(0x7f0000000280)='R\xcc\x18(\x9e#*S\xd2\xba\x83\x10\x90zu\xbc\x1cO\x82>oW\xdb\xebr\xf0s.\xf5w\x8ceo\xf5\xf7\n\x8d\x89\xe7\xd2J\xe4\xac\xdc[ _H\x81UP,\xa8\x8c\xebo_\xa3\xa7\x9f\xfa\x95\x02\xec,|\xcf\x8d\x153R\x8f\"\xd0\xa5\x13jH7+@E\x16FT-\x8a\v\x1c\rk\xac\xf1\xa3@Y\x88`f\xfd\x86\x0e~\xf6\x9aTQ\x04\xa0\x9f\xb7\xa0\r\xafH\x8e\xef\'~uG\xbc\xba\xb9C\xcc\xa2\xd7#\x86\xce\x12\xa5\xd8m\x8bT\x85\x17\xd0)\xb6{\x88\xad\x9c;\xd4\xba\xf5b\xfa\xba\x9f\xb4\x98\x04\x96iH\xaaDrB\x8a\xb0\v\x86\xc0\x9d\x89\x8c\xa8\xa5\xc6\xcc\x9fq>\x1bS\x82\xe0\xeb\xf9rI8\x81\xfe\xa0\x1ee@\x92\x16\xbfT\xb9m\xce7\xbc[-\xe2\\|\x1bZ\x1f\xcac/l\xfd\xf4\x9d\xd0q\x81\xce\xff\xde\xa75\xe0r\xff\x1e\x15\x06*\x0eE\x1b=\xa6d\xd5\xe7k\x10\x86\xf0\x16\xed\r)\xabh\xd8fs\xbf\xf9\xc8o\xc5y\x1f\xa7\x14b\x0eY\x1b\xa9(\x00\xc5F\xc9P\xc3u=!B\xc2\x18\x8b;\xf1\x8e\xb9_J\xd0\x18\x1f\xc5+`rtr\xa8\xced9s\xb9\x8a\xf2)\xec\xdb\x1d\vp\xd2l\x87\x96\x91\x87\x1fs\xfc\xc6\xce\xe73Th/\xa5\xc5\xe6gE\xa4\xe6\xeaT1\xee\xcb\x88c\xd28\xe9\xca_\a0W\x95WU\xab\rwp\xa7b,\xb8y\xc8\x1f\xe0\xca\xaf\xc9\xb5\xce0W\x91\\\x1c\xfaG \xbd\x89Ly\x80\x02\xedI\xfb\x1f\xe3\xdf\xaa\xaf?\x80\x12\x8b\x14\r\x12C\xd9\xcb\xb0\x85Sa\xec\x88,\td\xf2\xf4\x06\x00\xa4\xf9\x87\'^\xcc\x1d\x15X\x06\xee\x7f\x02\x14\xe6\x95\x8f\xe8\a\x90/v\xe5EWH\x8dI\xeb\x81^\xf3]\xca\xf5\x9b\x93jI\xe0\xab\xda\x93\xca9\x96ns\x11\xff<3\xf6?{\xf0\'D\xa1\x19\xda\x86\xeb-\xbc$f\x84/X\x99\xa5\xfe', 0x0) sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(r7, 0xffffffb3, &(0x7f0000000240)=0x2) r9 = memfd_create(&(0x7f0000001840)='\b\x9d\x85\xf0\xce\x95\xe2\n\xa1c\xdc\xdc\xf2>c\rG\xfcO\x8c=\xc1\x00\x8aSpA\xd4\x91\x9a\x02n(\xa0<\x01\x16\x98\x85D\x89>N\x8ar\x17O\x05KR\xe2{mn\xcc\xbfS\xc0\xa7\v\xb5$\xee\x02\x00\x00\x00\xa9\x1cn,B\xd5?\xe5\x04\x00+P\x00\x00\x10\x00\x00]\xdeL\xdb\x95\x80\x00\x00\x00\x00\x00\x00\x1d\xe7m\x04A\xdb\x8d\x01\x00\x00\x00\x00\x00\x00\x00\x00\xdd\x06\x00\xcfF\x032+\x9b\x7f\x19\xc6\xa2w\xb0\x87\xf8\xc1\xd8\xc2\x92\xb6\x19\"\x9a\xe8\xdf\x95Bh~\xec\xefD%Xl\xe6/\xf2\xc4\xeb]\x84\x8b o\xbb]\xac\"%\xe7\a\x7f\xc3\xae\xe5\xd4\x91\x05\x13\x110\xbb\az\xd4\x1e\x1b/\xfc\x1d\xb0\x8b\x0eQs\x81I`I\xe97\xe3B\xa9\xe7\x19Wy\xa0[,\xe8\xe9\xa9\x8dn\xe4%6\xe0\xe0\xe2W\x11}bq\xebS\x1b\xe1\xcb\x90~F1\xd5\xc3\xc52m\x15\x96y\xa9/-\x04\xb1\xe2\xa50\x90\xcb\x1f\xd8\x03\xb7\xc06\x1db\xd6\xcc\xf5\t\x00\xdd\xe9H5\xf4h\x8e\x8c1\xadx\xa4\xb4\xe1+\x1d $2wu\xfe\x87\x19\x9a\xe1F}+\xf3\xccg\"\xb3~%!\x99\x8b+\xa8\xb1\x99\x9ev\x1f(\xd6i|V\r\xf4\x19\xd2[b\xf4\x17S~n\t(\xb4k\xdf\x8d\x1fH\xa6!V\x1b\x18\x81\x14G\x10\x9b>#\x18]\xa3\x06@\xf5\x0f\x03\x15\x13\xb7\xeb\x18pU\xbe\xf4\x81S\x00\x98\xa8\xdaT\xcb\x06\xa7\xc7\xd8G]\xc4\x81E\xd3\xee\xc3\xfa\x8a\x91\xb3u\x18nM\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xa9\xa0:\xde\xf3F4\xed1\x05\x91Q\xa0\xf3\xea\xd9\xe2I\x1a=\x9d\xc6\x96T\xaa\xa46\xbc~\xef\x89\x1f0G\x95\xe1bH\xcck\xa0/`\x1a\x96@\x9ep4\xe4N\x015S\xd1\xf6', 0x0) splice(0xffffffffffffffff, 0x0, r9, &(0x7f0000000140)=0x7fffffffffffffff, 0x2, 0x0) kcmp(r6, r7, 0x6, r5, 0xffffffffffffffff) 0s ago: executing program 2 (id=1740): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0xc8080) preadv2(r0, &(0x7f0000000500)=[{&(0x7f00000000c0)=""/156, 0x9c}, {&(0x7f00000001c0)=""/6, 0x6}, {&(0x7f0000000400)=""/34, 0x22}, {&(0x7f0000000440)=""/139, 0x8b}], 0x4, 0x9, 0x6, 0x6) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0x639) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC_PROXY(r1, 0x0, 0xd3, &(0x7f0000000540)={@private=0xa010102, @multicast2, 0x0, "ec12843cd00d245fe79a2c4e291ee5cea69546441c9f370331aa249e43bb5c77", 0x1, 0x5, 0x3, 0x2}, 0x3c) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) r3 = socket(0x11, 0x3, 0x0) r4 = epoll_create1(0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0xe000202b}) dup3(r3, r5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x4ffe2, 0x0) modify_ldt$read(0x0, &(0x7f0000000840)=""/4096, 0x1000) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f0000001ac0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000002c0)={{0x0, 0x5, 0xfeff, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x1, r8, 0x0, 0x0, 'syz1\x00', 0x0}) kernel console output (not intermixed with test programs): etlink: 12 bytes leftover after parsing attributes in process `syz.2.1239'. [ 389.185601][T10371] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 389.233131][T10219] veth0_vlan: entered promiscuous mode [ 389.258560][T10219] veth1_vlan: entered promiscuous mode [ 389.306246][T10219] veth0_macvtap: entered promiscuous mode [ 389.322322][T10219] veth1_macvtap: entered promiscuous mode [ 389.336916][ T10] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 389.384267][T10219] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 389.407511][T10219] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 389.419411][T10219] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.431407][T10219] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.440693][T10219] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.449714][T10219] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.577324][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 389.588685][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 389.603874][ T10] usb 6-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00 [ 390.178412][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 390.198402][ T10] usb 6-1: config 0 descriptor?? [ 390.203385][ T2984] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 390.224278][ T2984] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 390.289861][ T9882] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.321769][ T2984] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 390.332066][ T2984] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 390.344722][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 390.344754][ T30] audit: type=1400 audit(1750661316.697:1199): avc: denied { mounton } for pid=10219 comm="syz-executor" path="/root/syzkaller.5dOZJX/syz-tmp" dev="sda1" ino=2049 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 390.411342][ T30] audit: type=1400 audit(1750661316.697:1200): avc: denied { mount } for pid=10219 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 390.465592][T10376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.474343][ T30] audit: type=1400 audit(1750661316.697:1201): avc: denied { mounton } for pid=10219 comm="syz-executor" path="/root/syzkaller.5dOZJX/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 390.474412][ T30] audit: type=1400 audit(1750661316.727:1202): avc: denied { mounton } for pid=10219 comm="syz-executor" path="/root/syzkaller.5dOZJX/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=28029 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 390.474456][ T30] audit: type=1400 audit(1750661316.757:1203): avc: denied { mounton } for pid=10219 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2774 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 390.474495][ T30] audit: type=1400 audit(1750661316.767:1204): avc: denied { mount } for pid=10219 comm="syz-executor" name="/" dev="gadgetfs" ino=6467 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 390.474549][ T30] audit: type=1400 audit(1750661316.787:1205): avc: denied { mounton } for pid=10219 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 390.501301][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.529684][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.576236][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.625621][ T9882] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.655562][T10376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.703780][ T30] audit: type=1400 audit(1750661317.057:1206): avc: denied { read } for pid=10400 comm="syz.4.1245" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 390.705399][T10401] sd 0:0:1:0: PR command failed: 1026 [ 390.725946][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.742924][T10401] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 390.752256][T10401] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 390.765462][ T9882] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.902428][ T9882] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.937393][ T30] audit: type=1400 audit(1750661317.057:1207): avc: denied { open } for pid=10400 comm="syz.4.1245" path="/252/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 390.963573][ T30] audit: type=1400 audit(1750661317.057:1208): avc: denied { ioctl } for pid=10400 comm="syz.4.1245" path="/252/file0/file0" dev="fuse" ino=0 ioctlcmd=0x70cb scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 391.002897][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 391.116887][ T5827] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 391.177188][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 391.222137][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 391.241674][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 391.254469][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 391.277095][ T5827] usb 5-1: Using ep0 maxpacket: 16 [ 391.391422][ T5827] usb 5-1: unable to get BOS descriptor or descriptor too short [ 391.412179][ T5827] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 391.432162][ T5827] usb 5-1: can't read configurations, error -71 [ 391.444808][ T10] usbhid 6-1:0.0: can't add hid device: -71 [ 391.451926][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 391.470469][ T10] usb 6-1: USB disconnect, device number 15 [ 391.571314][T10409] chnl_net:caif_netlink_parms(): no params data found [ 391.704720][T10409] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.712539][T10409] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.720632][T10409] bridge_slave_0: entered allmulticast mode [ 391.734725][T10409] bridge_slave_0: entered promiscuous mode [ 391.745836][T10409] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.753516][T10409] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.761306][T10409] bridge_slave_1: entered allmulticast mode [ 391.772681][T10409] bridge_slave_1: entered promiscuous mode [ 391.829694][T10409] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 391.842503][T10409] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 391.910200][T10409] team0: Port device team_slave_0 added [ 391.938116][T10409] team0: Port device team_slave_1 added [ 392.010124][T10409] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 392.018423][T10409] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 392.045600][T10409] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 392.062763][T10409] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 392.071332][T10409] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 392.099043][T10409] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 392.129331][T10429] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 392.136515][T10429] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 392.150720][T10429] bridge0: port 1(netdevsim0) entered disabled state [ 392.351216][T10409] hsr_slave_0: entered promiscuous mode [ 392.364640][T10409] hsr_slave_1: entered promiscuous mode [ 392.366772][ T1206] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 392.372661][T10409] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 392.386144][T10409] Cannot create hsr debugfs directory [ 392.635989][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 392.661552][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 392.695150][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 392.756308][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 392.783618][ T1206] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 393.299912][ T51] Bluetooth: hci4: unexpected event 0x03 length: 17 > 11 [ 393.344524][ T1206] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.350797][ T5820] Bluetooth: hci2: command tx timeout [ 393.351846][ T1206] usb 6-1: Product: syz [ 393.364034][ T5820] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 393.365114][ T1206] usb 6-1: Manufacturer: syz [ 393.376900][ T5820] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 393.380982][ T1206] usb 6-1: SerialNumber: syz [ 393.393431][ T5820] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 393.408824][ T1206] usb 6-1: config 0 descriptor?? [ 393.411348][ T5820] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 393.430339][ T5820] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 393.557790][T10448] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1257'. [ 393.634868][ T1206] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 393.746258][ T9882] bond0 (unregistering): Released all slaves [ 394.177540][ T5859] usb 6-1: USB disconnect, device number 16 [ 394.365909][T10409] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 394.442724][T10470] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1262'. [ 394.539068][T10471] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1262'. [ 394.816284][T10409] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 394.839449][ T9882] hsr_slave_0: left promiscuous mode [ 394.848402][ T9882] hsr_slave_1: left promiscuous mode [ 394.888935][ T9882] veth0_macvtap: left promiscuous mode [ 395.105887][T10477] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(13) [ 395.112537][T10477] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 395.124454][T10477] vhci_hcd vhci_hcd.0: Device attached [ 395.145840][T10477] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(15) [ 395.152485][T10477] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 395.160862][T10477] vhci_hcd vhci_hcd.0: Device attached [ 395.168283][T10477] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 395.181261][T10477] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(19) [ 395.187880][T10477] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 395.196315][T10477] vhci_hcd vhci_hcd.0: Device attached [ 395.216325][T10477] vhci_hcd vhci_hcd.0: pdev(5) rhport(4) sockfd(21) [ 395.222965][T10477] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 395.240790][T10477] vhci_hcd vhci_hcd.0: Device attached [ 395.261991][T10477] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(24) [ 395.268617][T10477] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 395.287666][T10477] vhci_hcd vhci_hcd.0: Device attached [ 395.306881][ T5927] vhci_hcd: vhci_device speed not set [ 395.308543][T10477] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 395.337124][T10477] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 395.351020][T10477] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 395.362900][T10477] vhci_hcd vhci_hcd.0: port 0 already used [ 395.370486][T10493] vhci_hcd: connection closed [ 395.370891][T10489] vhci_hcd: connection closed [ 395.376161][T10480] vhci_hcd: connection closed [ 395.376436][T10483] vhci_hcd: connection closed [ 395.381144][ T9864] vhci_hcd: stop threads [ 395.385676][ T5927] usb 43-1: new low-speed USB device number 3 using vhci_hcd [ 395.392409][ T9864] vhci_hcd: release socket [ 395.394612][T10487] vhci_hcd: connection closed [ 395.415280][T10482] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 395.429248][ T5820] Bluetooth: hci2: command tx timeout [ 395.434735][ T9864] vhci_hcd: disconnect device [ 395.455738][ T9864] vhci_hcd: stop threads [ 395.460258][ T9864] vhci_hcd: release socket [ 395.465148][ T9864] vhci_hcd: disconnect device [ 395.470212][ T9864] vhci_hcd: stop threads [ 395.475358][ T9864] vhci_hcd: release socket [ 395.505529][ T9864] vhci_hcd: disconnect device [ 395.513456][ T5820] Bluetooth: hci5: command tx timeout [ 395.533812][ T9864] vhci_hcd: stop threads [ 395.542302][ T9864] vhci_hcd: release socket [ 395.549592][ T9864] vhci_hcd: disconnect device [ 395.565881][ T9864] vhci_hcd: stop threads [ 395.575908][ T9864] vhci_hcd: release socket [ 395.601184][ T9864] vhci_hcd: disconnect device [ 396.615233][T10409] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 396.736632][T10508] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 396.904113][T10409] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 397.108413][ T9882] IPVS: stop unused estimator thread 0... [ 397.163822][T10441] chnl_net:caif_netlink_parms(): no params data found [ 397.240500][ T9882] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.288901][T10409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 397.351347][ T9882] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.379568][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 397.379584][ T30] audit: type=1400 audit(1750661323.727:1223): avc: denied { shutdown } for pid=10528 comm="syz.2.1271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 397.413493][ T30] audit: type=1400 audit(1750661323.727:1224): avc: denied { getopt } for pid=10528 comm="syz.2.1271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 397.471158][ T30] audit: type=1400 audit(1750661323.817:1225): avc: denied { mounton } for pid=10533 comm="syz.4.1273" path="/260/file0" dev="tmpfs" ino=1419 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 397.493945][ C1] vkms_vblank_simulate: vblank timer overrun [ 397.507036][ T5820] Bluetooth: hci2: command tx timeout [ 397.544160][ T9882] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.565844][T10441] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.574046][T10441] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.581793][T10441] bridge_slave_0: entered allmulticast mode [ 397.583763][ T30] audit: type=1400 audit(1750661323.927:1226): avc: denied { read } for pid=10531 comm="syz.2.1272" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 397.588359][ T5820] Bluetooth: hci5: command tx timeout [ 397.618214][T10441] bridge_slave_0: entered promiscuous mode [ 397.631878][T10441] bridge0: port 2(bridge_slave_1) entered blocking state [ 397.639239][T10441] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.646430][T10441] bridge_slave_1: entered allmulticast mode [ 397.653923][T10441] bridge_slave_1: entered promiscuous mode [ 397.715905][ T9882] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.854444][T10409] 8021q: adding VLAN 0 to HW filter on device team0 [ 397.870029][ T30] audit: type=1400 audit(1750661324.217:1227): avc: denied { create } for pid=10540 comm="syz.5.1275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 397.870205][T10441] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.380011][ T30] audit: type=1400 audit(1750661324.717:1228): avc: denied { bind } for pid=10540 comm="syz.5.1275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 398.401681][ T30] audit: type=1400 audit(1750661324.747:1229): avc: denied { accept } for pid=10540 comm="syz.5.1275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 398.429671][T10441] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 398.469856][T10544] syz.4.1276: attempt to access beyond end of device [ 398.469856][T10544] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 398.472950][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.490090][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 398.522110][ T30] audit: type=1400 audit(1750661324.747:1230): avc: denied { read } for pid=10540 comm="syz.5.1275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 398.725841][T10441] team0: Port device team_slave_0 added [ 398.766533][T10441] team0: Port device team_slave_1 added [ 399.623294][ T5820] Bluetooth: hci2: command tx timeout [ 399.672573][ T5820] Bluetooth: hci5: command tx timeout [ 399.792990][T10441] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.800357][T10441] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.826274][ C1] vkms_vblank_simulate: vblank timer overrun [ 399.840317][T10441] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.960312][T10574] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 400.086508][ T9864] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.093805][ T9864] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.139918][T10441] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 400.148283][T10441] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 400.190525][T10441] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.455786][T10441] hsr_slave_0: entered promiscuous mode [ 400.464156][T10441] hsr_slave_1: entered promiscuous mode [ 400.910082][ T5927] vhci_hcd: vhci_device speed not set [ 400.910378][ T30] audit: type=1400 audit(1750661327.257:1231): avc: denied { setopt } for pid=10577 comm="syz.5.1284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 400.948556][T10441] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 400.956145][T10441] Cannot create hsr debugfs directory [ 400.971384][ T9882] bridge_slave_1: left allmulticast mode [ 400.977722][ T9882] bridge_slave_1: left promiscuous mode [ 400.984519][ T9882] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.994565][ T9882] bridge_slave_0: left allmulticast mode [ 401.002762][ T9882] bridge_slave_0: left promiscuous mode [ 401.008692][ T9882] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.382285][ T30] audit: type=1400 audit(1750661327.717:1232): avc: denied { setopt } for pid=10585 comm="syz.2.1286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 401.421048][ T9882] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 401.432087][ T9882] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 401.548351][T10591] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1285'. [ 401.643733][ T9882] bond0 (unregistering): Released all slaves [ 401.746930][ T5820] Bluetooth: hci5: command tx timeout [ 402.211691][T10597] syz.4.1287: attempt to access beyond end of device [ 402.211691][T10597] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 402.391790][T10441] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 402.443650][T10441] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 402.480015][T10441] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 402.660154][T10441] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 402.694434][ T9882] hsr_slave_0: left promiscuous mode [ 402.722917][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 402.722931][ T30] audit: type=1400 audit(1750661329.067:1235): avc: denied { ioctl } for pid=10612 comm="syz.4.1292" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 402.756965][ T9882] hsr_slave_1: left promiscuous mode [ 402.762879][ T9882] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 402.775397][ T9882] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 402.815974][ T9882] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 402.824930][ T9882] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 402.891081][ T9882] veth1_macvtap: left promiscuous mode [ 402.896643][ T9882] veth0_macvtap: left promiscuous mode [ 402.903118][ T9882] veth1_vlan: left promiscuous mode [ 402.909514][ T9882] veth0_vlan: left promiscuous mode [ 403.744854][ T9882] team0 (unregistering): Port device team_slave_1 removed [ 403.785630][ T9882] team0 (unregistering): Port device team_slave_0 removed [ 403.966716][ T5827] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 404.083046][T10623] bridge0: port 1(netdevsim0) entered blocking state [ 404.090095][T10623] bridge0: port 1(netdevsim0) entered disabled state [ 404.098654][T10623] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 404.110015][T10623] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 404.125728][T10623] bridge0: port 1(netdevsim0) entered blocking state [ 404.132510][T10623] bridge0: port 1(netdevsim0) entered forwarding state [ 404.151630][ T5827] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 404.170297][ T5827] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 404.192744][ T5827] usb 6-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 404.195549][T10409] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.210674][ T5827] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.257431][ T5827] usb 6-1: config 0 descriptor?? [ 404.294282][T10441] 8021q: adding VLAN 0 to HW filter on device bond0 [ 404.332848][T10441] 8021q: adding VLAN 0 to HW filter on device team0 [ 404.371137][ T2984] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.378245][ T2984] bridge0: port 1(bridge_slave_0) entered forwarding state [ 404.406369][ T2984] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.413559][ T2984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 404.455305][T10636] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 404.464071][T10636] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 404.480869][T10636] bridge0: port 1(netdevsim0) entered disabled state [ 404.683112][ T5827] hid (null): global environment stack underflow [ 404.702894][ T5827] logitech-djreceiver 0003:046D:C534.0012: global environment stack underflow [ 404.721435][T10409] veth0_vlan: entered promiscuous mode [ 404.727754][ T5827] logitech-djreceiver 0003:046D:C534.0012: item 0 0 1 11 parsing failed [ 404.736381][ T5827] logitech-djreceiver 0003:046D:C534.0012: logi_dj_probe: parse failed [ 404.745587][ T5827] logitech-djreceiver 0003:046D:C534.0012: probe with driver logitech-djreceiver failed with error -22 [ 404.760356][T10409] veth1_vlan: entered promiscuous mode [ 404.772421][T10441] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.786986][ T51] Bluetooth: hci6: command 0x1003 tx timeout [ 404.791146][T10409] veth0_macvtap: entered promiscuous mode [ 404.800529][ T5820] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 404.818506][T10409] veth1_macvtap: entered promiscuous mode [ 404.859848][T10409] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.877756][T10409] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.893363][T10409] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.902502][T10409] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.918448][T10409] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.930933][T10409] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.968795][T10626] input: syz0 as /devices/virtual/input/input33 [ 404.998748][ T30] audit: type=1400 audit(1750661331.347:1236): avc: denied { read } for pid=5171 comm="acpid" name="event4" dev="devtmpfs" ino=3185 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 405.028258][ T30] audit: type=1400 audit(1750661331.347:1237): avc: denied { open } for pid=5171 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3185 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 405.069564][ T5827] usb 6-1: USB disconnect, device number 17 [ 405.071521][ T9882] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.084725][ T9882] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.095271][ T30] audit: type=1400 audit(1750661331.347:1238): avc: denied { ioctl } for pid=5171 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3185 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 405.224562][T10657] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 405.482819][ T9867] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.502310][ T9867] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.544507][T10441] veth0_vlan: entered promiscuous mode [ 405.555994][T10659] overlayfs: missing 'lowerdir' [ 405.589998][T10441] veth1_vlan: entered promiscuous mode [ 405.626024][ T30] audit: type=1400 audit(1750661331.967:1239): avc: denied { bind } for pid=10661 comm="syz.2.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 405.639954][T10441] veth0_macvtap: entered promiscuous mode [ 405.672993][T10441] veth1_macvtap: entered promiscuous mode [ 405.701535][ T30] audit: type=1400 audit(1750661331.967:1240): avc: denied { name_bind } for pid=10661 comm="syz.2.1297" src=512 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 405.711528][T10441] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 405.740946][T10441] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 405.851946][T10441] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.860860][ T30] audit: type=1400 audit(1750661331.967:1241): avc: denied { node_bind } for pid=10661 comm="syz.2.1297" saddr=ffff:ffff:800:: src=512 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 405.885066][T10441] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.909681][T10441] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.926683][ T30] audit: type=1400 audit(1750661332.007:1242): avc: denied { create } for pid=10661 comm="syz.2.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 405.960389][T10441] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.456057][T10673] syz.7.1244: attempt to access beyond end of device [ 406.456057][T10673] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 406.707154][ T2984] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.729536][ T2984] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.804855][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.814938][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.931925][ T30] audit: type=1400 audit(1750661333.277:1243): avc: denied { read write } for pid=10688 comm="syz.7.1302" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 406.958209][ T30] audit: type=1400 audit(1750661333.277:1244): avc: denied { open } for pid=10688 comm="syz.7.1302" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 407.386117][ T5927] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 407.835789][ T5973] libceph: connect (1)[c::]:6789 error -101 [ 407.848062][ T5973] libceph: mon0 (1)[c::]:6789 connect error [ 407.965571][T10704] ceph: No mds server is up or the cluster is laggy [ 408.137128][ T5927] usb 9-1: Using ep0 maxpacket: 8 [ 408.147065][ T5927] usb 9-1: unable to get BOS descriptor or descriptor too short [ 408.155910][ T5927] usb 9-1: config 4 interface 0 has no altsetting 0 [ 408.165685][ T5927] usb 9-1: string descriptor 0 read error: -22 [ 408.172744][ T5927] usb 9-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 408.187708][ T5927] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.466403][ T5927] usb 9-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 408.498653][ T5927] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 408.540232][ T5927] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 408.560931][ T5927] usb 9-1: media controller created [ 408.613827][ T5927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 408.675577][T10699] usb 9-1: dvb_usb_au6610: wlen=0, aborting [ 408.685656][ T30] audit: type=1400 audit(1750661335.017:1245): avc: denied { append } for pid=10698 comm="syz.8.1255" name="i2c-1" dev="devtmpfs" ino=3190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 408.727956][ T5927] zl10353_read_register: readreg error (reg=127, ret==0) [ 408.846525][ T5927] usb 9-1: USB disconnect, device number 2 [ 408.856672][ T5926] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 409.038638][ T5926] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 409.049774][ T5926] usb 5-1: config 0 has no interface number 0 [ 409.072335][ T5926] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 409.091718][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.106096][ T5926] usb 5-1: Product: syz [ 409.111823][ T5926] usb 5-1: Manufacturer: syz [ 409.119138][ T5926] usb 5-1: SerialNumber: syz [ 409.134472][ T5926] usb 5-1: config 0 descriptor?? [ 409.145164][ T5926] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 409.171643][ T5926] usb 5-1: selecting invalid altsetting 1 [ 409.177526][ T5926] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 409.197086][ T5926] usb 5-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 409.936687][ T5927] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 409.995271][T10734] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 410.127705][ T5927] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 410.131436][ T10] usb 5-1: USB disconnect, device number 41 [ 410.226301][ T5927] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 410.237146][ T5927] usb 9-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 410.246342][ T5927] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.274236][ T5927] usb 9-1: config 0 descriptor?? [ 410.429350][ T30] audit: type=1400 audit(1750661336.777:1246): avc: denied { read } for pid=10735 comm="syz.5.1315" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 410.454083][ T30] audit: type=1400 audit(1750661336.777:1247): avc: denied { open } for pid=10735 comm="syz.5.1315" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 410.692214][ T30] audit: type=1400 audit(1750661337.027:1248): avc: denied { read append } for pid=10735 comm="syz.5.1315" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 411.104466][ T30] audit: type=1400 audit(1750661337.037:1249): avc: denied { open } for pid=10735 comm="syz.5.1315" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 411.127983][ C1] vkms_vblank_simulate: vblank timer overrun [ 411.140983][ T5927] isku 0003:1E7D:319C.0013: unknown main item tag 0x0 [ 411.153736][ T5927] isku 0003:1E7D:319C.0013: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.8-1/input0 [ 411.166686][ T30] audit: type=1400 audit(1750661337.037:1250): avc: denied { ioctl } for pid=10735 comm="syz.5.1315" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 411.191605][ C1] vkms_vblank_simulate: vblank timer overrun [ 411.528067][T10726] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 412.694600][ T30] audit: type=1400 audit(1750661337.667:1251): avc: denied { map } for pid=10741 comm="syz.4.1317" path="socket:[29187]" dev="sockfs" ino=29187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 412.816698][ T5827] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 412.829675][ T30] audit: type=1400 audit(1750661337.667:1252): avc: denied { read } for pid=10741 comm="syz.4.1317" path="socket:[29187]" dev="sockfs" ino=29187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 412.880436][ T30] audit: type=1400 audit(1750661337.677:1253): avc: denied { create } for pid=10741 comm="syz.4.1317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 412.893237][T10750] bridge_slave_0: left allmulticast mode [ 412.916001][ T30] audit: type=1400 audit(1750661337.677:1254): avc: denied { bind } for pid=10741 comm="syz.4.1317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 412.942825][T10750] bridge_slave_0: left promiscuous mode [ 412.969971][T10750] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.984058][T10756] overlayfs: conflicting lowerdir path [ 413.004261][ T5859] usb 9-1: USB disconnect, device number 3 [ 413.039958][T10750] bridge_slave_1: left allmulticast mode [ 413.046129][T10750] bridge_slave_1: left promiscuous mode [ 413.052990][T10750] bridge0: port 2(bridge_slave_1) entered disabled state [ 413.063235][T10750] bond0: (slave bond_slave_0): Releasing backup interface [ 413.073831][T10750] bond0: (slave bond_slave_1): Releasing backup interface [ 413.083155][T10750] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 413.093003][T10750] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 413.102500][T10750] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 413.110486][T10750] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 413.199613][T10763] netlink: 'syz.2.1322': attribute type 46 has an invalid length. [ 413.210601][T10763] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1322'. [ 413.704601][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 413.704617][ T30] audit: type=1400 audit(1750661340.047:1265): avc: denied { write } for pid=10777 comm="syz.8.1327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 413.762087][T10779] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1324'. [ 413.828454][ T30] audit: type=1400 audit(1750661340.157:1266): avc: denied { remove_name } for pid=10409 comm="syz-executor" name="work" dev="tmpfs" ino=42 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 413.947886][ T30] audit: type=1400 audit(1750661340.157:1267): avc: denied { rmdir } for pid=10409 comm="syz-executor" name="bus" dev="tmpfs" ino=40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 414.255136][T10795] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1331'. [ 414.332716][T10798] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 415.076836][ T10] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 415.586763][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 415.593305][ T10] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 415.604491][ T10] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 415.614301][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 416.164583][ T51] Bluetooth: hci6: command 0x1003 tx timeout [ 416.194123][ T5820] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 416.213479][ T10] usb 5-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 416.237201][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.249342][ T10] usb 5-1: config 0 descriptor?? [ 416.295686][T10813] bridge_slave_0: left allmulticast mode [ 416.429491][T10813] bridge_slave_0: left promiscuous mode [ 416.441901][T10813] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.464634][T10813] bridge_slave_1: left allmulticast mode [ 416.883754][ T10] hid-steam 0003:28DE:1205.0014: unknown main item tag 0x0 [ 416.891178][ T10] hid-steam 0003:28DE:1205.0014: unknown main item tag 0x0 [ 417.220534][ T10] hid-steam 0003:28DE:1205.0014: unknown main item tag 0x0 [ 417.232641][T10813] bridge_slave_1: left promiscuous mode [ 417.250386][ T10] hid-steam 0003:28DE:1205.0014: unknown main item tag 0x0 [ 417.268019][ T10] hid-steam 0003:28DE:1205.0014: unknown main item tag 0x0 [ 417.271235][T10813] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.301820][ T10] hid-steam 0003:28DE:1205.0014: hidraw0: USB HID v0.00 Device [HID 28de:1205] on usb-dummy_hcd.4-1/input0 [ 417.420813][T10813] bond0: (slave bond_slave_0): Releasing backup interface [ 417.471966][T10813] bond0: (slave bond_slave_1): Releasing backup interface [ 417.525006][ T30] audit: type=1400 audit(1750661343.867:1268): avc: denied { setopt } for pid=10831 comm="syz.2.1341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 417.563249][T10813] team0: Port device team_slave_0 removed [ 417.576175][T10813] team0: Port device team_slave_1 removed [ 417.583777][ T48] usb 5-1: USB disconnect, device number 43 [ 417.587943][ T30] audit: type=1400 audit(1750661343.897:1269): avc: denied { write } for pid=10831 comm="syz.2.1341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 417.615806][T10813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 417.625651][T10813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 417.636254][ T30] audit: type=1400 audit(1750661343.947:1270): avc: denied { read } for pid=10831 comm="syz.2.1341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 417.678161][T10813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 417.693329][T10813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 417.756717][ T5827] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 417.791726][T10839] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1343'. [ 417.918194][ T5827] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 417.928699][ T5827] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 417.939062][ T5827] usb 6-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 417.948187][ T5827] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.958480][ T5827] usb 6-1: config 0 descriptor?? [ 418.014594][T10845] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1342'. [ 418.241058][T10849] bridge0: entered allmulticast mode [ 418.247843][T10849] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1346'. [ 418.381561][T10851] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1344'. [ 418.529007][ T30] audit: type=1400 audit(1750661344.847:1271): avc: denied { read } for pid=10848 comm="syz.4.1346" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 418.674430][ T30] audit: type=1400 audit(1750661344.867:1272): avc: denied { open } for pid=10848 comm="syz.4.1346" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 418.701413][T10849] bridge0 (unregistering): left allmulticast mode [ 418.707904][ T30] audit: type=1400 audit(1750661344.997:1273): avc: denied { ioctl } for pid=10848 comm="syz.4.1346" path="/newroot/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64c6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 418.899305][ T30] audit: type=1400 audit(1750661345.247:1274): avc: denied { map } for pid=10829 comm="syz.5.1339" path="socket:[30391]" dev="sockfs" ino=30391 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 418.925000][ T5827] Bluetooth: Can't get state to change to load configuration err [ 418.928410][ T30] audit: type=1400 audit(1750661345.267:1275): avc: denied { read } for pid=10829 comm="syz.5.1339" path="socket:[30391]" dev="sockfs" ino=30391 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 418.933201][ T48] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 418.964283][ T5827] Bluetooth: Loading sysconfig file failed [ 418.970246][ T5827] ath3k 6-1:0.0: probe with driver ath3k failed with error -16 [ 418.980037][ T5827] usb 6-1: USB disconnect, device number 18 [ 419.138078][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 419.152745][ T48] usb 5-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 419.162007][ T48] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.174410][ T48] usb 5-1: config 0 descriptor?? [ 419.183613][ T48] smsusb:smsusb_probe: board id=8, interface number 0 [ 419.194848][ T48] smsusb:smsusb_probe: Device initialized with return code -19 [ 419.403496][T10849] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.414582][T10849] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.913905][T10871] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 420.124382][ T10] usb 5-1: USB disconnect, device number 44 [ 420.282213][ T30] audit: type=1400 audit(1750661346.627:1276): avc: denied { write } for pid=10878 comm="syz.7.1353" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 420.282300][T10879] usb usb8: usbfs: process 10879 (syz.7.1353) did not claim interface 0 before use [ 420.505216][ T30] audit: type=1400 audit(1750661346.847:1277): avc: denied { bind } for pid=10875 comm="syz.4.1352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 420.526321][T10881] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1352'. [ 420.560673][ T30] audit: type=1400 audit(1750661346.867:1278): avc: denied { ioctl } for pid=10875 comm="syz.4.1352" path="socket:[30440]" dev="sockfs" ino=30440 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 420.595349][ T30] audit: type=1400 audit(1750661346.937:1279): avc: denied { append } for pid=10875 comm="syz.4.1352" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 420.927802][T10888] Cannot find add_set index 0 as target [ 420.942401][ T30] audit: type=1400 audit(1750661347.287:1280): avc: denied { read } for pid=10889 comm="syz.8.1355" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 420.971987][ T30] audit: type=1400 audit(1750661347.287:1281): avc: denied { open } for pid=10889 comm="syz.8.1355" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 420.999234][ T30] audit: type=1400 audit(1750661347.317:1282): avc: denied { map } for pid=10889 comm="syz.8.1355" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 422.621003][T10904] syzkaller0: entered promiscuous mode [ 422.631904][T10904] syzkaller0: entered allmulticast mode [ 422.929195][T10917] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1362'. [ 424.446909][ T10] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 424.802420][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 424.816468][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 424.826248][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 424.837962][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 424.851779][ T10] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 424.861626][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.869819][ T10] usb 5-1: Product: syz [ 424.874076][ T10] usb 5-1: Manufacturer: syz [ 424.878915][ T10] usb 5-1: SerialNumber: syz [ 424.885683][ T10] usb 5-1: config 0 descriptor?? [ 424.936698][ T48] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 425.097572][ T48] usb 6-1: Using ep0 maxpacket: 16 [ 425.103167][ T10] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 425.108014][ T48] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 425.132485][ T48] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 425.179627][ T48] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 425.189056][ T48] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.197161][ T48] usb 6-1: Product: syz [ 425.206319][ T48] usb 6-1: Manufacturer: syz [ 425.215778][ T48] usb 6-1: SerialNumber: syz [ 425.453959][ T48] usb 6-1: 2:1 : format type 0 is detected, processed as PCM [ 425.469023][ T48] usb 6-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 426.065479][ T5927] usb 6-1: USB disconnect, device number 19 [ 426.230918][ T48] usb 5-1: USB disconnect, device number 45 [ 426.269033][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 426.269048][ T30] audit: type=1326 audit(1750661352.617:1291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.304410][T10945] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1369'. [ 426.383436][ T30] audit: type=1326 audit(1750661352.647:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.438420][ T30] audit: type=1326 audit(1750661352.647:1293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.495623][ T30] audit: type=1326 audit(1750661352.647:1294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.546681][ T30] audit: type=1326 audit(1750661352.647:1295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.592723][T10957] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1372'. [ 426.597245][ T30] audit: type=1326 audit(1750661352.937:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.643686][ T30] audit: type=1326 audit(1750661352.937:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 426.964050][ T30] audit: type=1326 audit(1750661352.937:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=269 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 427.048465][ T30] audit: type=1326 audit(1750661352.937:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 427.155204][ T30] audit: type=1326 audit(1750661352.937:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10942 comm="syz.5.1368" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 427.395889][T10976] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 427.416832][ T48] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 427.926748][ T48] usb 9-1: device descriptor read/64, error -71 [ 428.416690][ T48] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 428.559018][ T48] usb 9-1: device descriptor read/64, error -71 [ 428.667340][ T48] usb usb9-port1: attempt power cycle [ 428.707141][ T5827] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 428.895476][ T5827] usb 5-1: Using ep0 maxpacket: 16 [ 428.910438][ T5827] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.934800][ T5827] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 428.963898][ T5827] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 428.981509][ T5827] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 428.999527][ T5827] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 429.011651][ T5827] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.019932][ T5827] usb 5-1: Product: syz [ 429.024180][ T5827] usb 5-1: Manufacturer: syz [ 429.034542][ T48] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 429.043363][ T5827] usb 5-1: SerialNumber: syz [ 429.068008][ T48] usb 9-1: device descriptor read/8, error -71 [ 429.196976][ T5859] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 429.256174][ T5827] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 429.275174][ T5827] usb 5-1: USB disconnect, device number 46 [ 429.318658][ T48] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 429.347996][ T48] usb 9-1: device descriptor read/8, error -71 [ 429.378521][ T5859] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 429.389645][ T5859] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 429.399371][ T5859] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 429.411236][ T5859] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 429.426144][ T5859] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 429.441109][ T5859] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.449571][ T5859] usb 6-1: Product: syz [ 429.453915][ T5859] usb 6-1: Manufacturer: syz [ 429.459745][ T48] usb usb9-port1: unable to enumerate USB device [ 429.466290][ T5859] usb 6-1: SerialNumber: syz [ 429.474332][ T5859] usb 6-1: config 0 descriptor?? [ 429.508635][T10998] syz.2.1385 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 429.543112][ T5820] Bluetooth: hci4: unexpected event for opcode 0x1004 [ 429.685560][ T5859] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 429.790029][T11001] openvswitch: netlink: Message has 4 unknown bytes. [ 429.961025][T11013] IPv6: sit1: Disabled Multicast RS [ 429.995863][ T5973] usb 6-1: USB disconnect, device number 20 [ 430.144203][T11020] overlayfs: failed to clone lowerpath [ 430.272202][ T5859] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 430.439155][ T5859] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 430.448370][ T5859] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.460220][ T5859] usb 5-1: config 0 descriptor?? [ 430.467139][ T5859] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 430.606671][ T5827] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 430.761730][ T5827] usb 9-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 430.771341][ T5827] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.792119][ T5827] usb 9-1: config 0 descriptor?? [ 430.804283][ T5827] cp210x 9-1:0.0: cp210x converter detected [ 431.623931][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 431.623946][ T30] audit: type=1400 audit(1750661357.967:1322): avc: denied { listen } for pid=11015 comm="syz.4.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 432.090040][T11045] netlink: 420 bytes leftover after parsing attributes in process `syz.5.1400'. [ 432.166114][T11049] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1395'. [ 432.361177][ T30] audit: type=1400 audit(1750661357.967:1323): avc: denied { accept } for pid=11015 comm="syz.4.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 433.284048][T11067] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd7": -EINTR [ 433.512182][ T5827] cp210x 9-1:0.0: failed to get vendor val 0x370c size 13: -71 [ 433.639239][ T5820] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 433.651561][ T5820] Bluetooth: hci4: Injecting HCI hardware error event [ 433.664142][ T5820] Bluetooth: hci4: hardware error 0x00 [ 433.771230][ T5827] cp210x 9-1:0.0: GPIO initialisation failed: -71 [ 433.781052][ T5827] usb 9-1: cp210x converter now attached to ttyUSB0 [ 433.789027][ T5827] usb 9-1: USB disconnect, device number 8 [ 433.808599][ T5827] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 433.965396][T11080] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 433.981132][ T5827] cp210x 9-1:0.0: device disconnected [ 434.628575][ T30] audit: type=1400 audit(1750661360.977:1324): avc: denied { write } for pid=11083 comm="syz.5.1408" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 435.010330][ T1206] usb 5-1: USB disconnect, device number 47 [ 435.487294][T11101] ubi31: attaching mtd0 [ 435.525431][T11101] ubi31: scanning is finished [ 435.530351][T11101] ubi31: empty MTD device detected [ 435.993653][ T5820] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 436.003283][ T30] audit: type=1400 audit(1750661362.037:1325): avc: denied { create } for pid=11095 comm="syz.7.1411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 436.024606][ T30] audit: type=1400 audit(1750661362.147:1326): avc: denied { sys_admin } for pid=11095 comm="syz.7.1411" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 436.188413][T11101] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 436.899755][T11119] tipc: Enabled bearer , priority 10 [ 436.916374][ T30] audit: type=1400 audit(1750661363.257:1327): avc: denied { read write } for pid=11116 comm="syz.7.1417" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 437.023728][ T30] audit: type=1400 audit(1750661363.257:1328): avc: denied { open } for pid=11116 comm="syz.7.1417" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 437.227939][T11123] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1417'. [ 437.248060][ T30] audit: type=1326 audit(1750661363.367:1329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248105][ T30] audit: type=1326 audit(1750661363.367:1330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248139][ T30] audit: type=1326 audit(1750661363.367:1331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248177][ T30] audit: type=1326 audit(1750661363.367:1332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248210][ T30] audit: type=1326 audit(1750661363.367:1333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=286 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248245][ T30] audit: type=1326 audit(1750661363.367:1334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248282][ T30] audit: type=1326 audit(1750661363.367:1335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.248320][ T30] audit: type=1326 audit(1750661363.367:1336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11112 comm="syz.5.1415" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 437.360033][ C1] vkms_vblank_simulate: vblank timer overrun [ 437.409914][ C1] vkms_vblank_simulate: vblank timer overrun [ 437.861587][ C1] vkms_vblank_simulate: vblank timer overrun [ 437.890731][ C1] vkms_vblank_simulate: vblank timer overrun [ 438.006671][ C1] vkms_vblank_simulate: vblank timer overrun [ 438.558751][T11127] tty tty29: ldisc open failed (-12), clearing slot 28 [ 438.632561][T11136] syz.7.1421: attempt to access beyond end of device [ 438.632561][T11136] loop7: rw=0, sector=64, nr_sectors = 1 limit=0 [ 438.656928][T11136] syz.7.1421: attempt to access beyond end of device [ 438.656928][T11136] loop7: rw=0, sector=256, nr_sectors = 1 limit=0 [ 438.851503][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=256, location=256 [ 438.862353][T11136] syz.7.1421: attempt to access beyond end of device [ 438.862353][T11136] loop7: rw=0, sector=512, nr_sectors = 1 limit=0 [ 438.880602][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=512, location=512 [ 438.899577][T11136] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 438.907416][T11136] UDF-fs: Scanning with blocksize 512 failed [ 438.915738][T11136] syz.7.1421: attempt to access beyond end of device [ 438.915738][T11136] loop7: rw=0, sector=64, nr_sectors = 2 limit=0 [ 438.932137][T11136] syz.7.1421: attempt to access beyond end of device [ 438.932137][T11136] loop7: rw=0, sector=512, nr_sectors = 2 limit=0 [ 438.945641][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=256, location=256 [ 439.025942][T11136] syz.7.1421: attempt to access beyond end of device [ 439.025942][T11136] loop7: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 439.047214][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=512, location=512 [ 439.437493][ T1206] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 439.630720][T11136] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 439.654147][T11136] UDF-fs: Scanning with blocksize 1024 failed [ 439.664025][T11136] syz.7.1421: attempt to access beyond end of device [ 439.664025][T11136] loop7: rw=0, sector=64, nr_sectors = 4 limit=0 [ 439.682891][T11136] syz.7.1421: attempt to access beyond end of device [ 439.682891][T11136] loop7: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 439.697859][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=256, location=256 [ 439.709114][T11136] syz.7.1421: attempt to access beyond end of device [ 439.709114][T11136] loop7: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 439.740448][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=512, location=512 [ 439.760380][T11136] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 439.772629][T11136] UDF-fs: Scanning with blocksize 2048 failed [ 439.792480][T11136] syz.7.1421: attempt to access beyond end of device [ 439.792480][T11136] loop7: rw=0, sector=64, nr_sectors = 8 limit=0 [ 439.811177][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=256, location=256 [ 439.824351][T11136] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=512, location=512 [ 439.838403][T11136] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 439.846269][T11136] UDF-fs: Scanning with blocksize 4096 failed [ 439.863227][ T1206] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 439.873651][ T1206] usb 9-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 439.885779][T11136] UDF-fs: warning (device loop7): udf_fill_super: No partition found (1) [ 439.894905][ T1206] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.906405][ T1206] usb 9-1: config 0 descriptor?? [ 439.929118][ T1206] pwc: Askey VC010 type 2 USB webcam detected. [ 440.126150][T11159] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 440.140968][T11159] ref_ctr increment failed for inode: 0x9a offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88807aae35c0 [ 440.211554][ T1206] pwc: recv_control_msg error -71 req 02 val 2b00 [ 440.221910][ T1206] pwc: recv_control_msg error -71 req 02 val 2700 [ 440.249543][ T1206] pwc: recv_control_msg error -71 req 02 val 2c00 [ 440.264856][T11167] cifs: Bad value for 'port' [ 440.273781][ T1206] pwc: recv_control_msg error -71 req 04 val 1000 [ 440.292384][ T1206] pwc: recv_control_msg error -71 req 04 val 1300 [ 440.305069][ T1206] pwc: recv_control_msg error -71 req 04 val 1400 [ 440.325976][ T1206] pwc: recv_control_msg error -71 req 02 val 2000 [ 440.344941][ T1206] pwc: recv_control_msg error -71 req 02 val 2100 [ 440.361027][ T1206] pwc: recv_control_msg error -71 req 04 val 1500 [ 440.376462][ T1206] pwc: recv_control_msg error -71 req 02 val 2500 [ 440.392941][ T1206] pwc: recv_control_msg error -71 req 02 val 2400 [ 440.416183][ T1206] pwc: recv_control_msg error -71 req 02 val 2600 [ 440.436468][ T1206] pwc: recv_control_msg error -71 req 02 val 2900 [ 440.452923][ T1206] pwc: recv_control_msg error -71 req 02 val 2800 [ 440.475378][ T1206] pwc: recv_control_msg error -71 req 04 val 1100 [ 440.501375][ T1206] pwc: recv_control_msg error -71 req 04 val 1200 [ 440.540955][ T1206] pwc: Registered as video103. [ 440.563778][ T1206] input: PWC snapshot button as /devices/platform/dummy_hcd.8/usb9/9-1/input/input35 [ 440.611388][ T1206] usb 9-1: USB disconnect, device number 9 [ 441.123721][T11186] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1433'. [ 441.623762][T11188] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 441.896714][ T48] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 442.051766][ T48] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 442.063910][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.079835][ T48] usb 5-1: Product: syz [ 442.089055][ T48] usb 5-1: Manufacturer: syz [ 442.096682][ T48] usb 5-1: SerialNumber: syz [ 442.105593][ T48] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 442.143952][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 442.143968][ T30] audit: type=1400 audit(1750661368.487:1362): avc: denied { firmware_load } for pid=5859 comm="kworker/1:4" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 442.177232][ C1] vkms_vblank_simulate: vblank timer overrun [ 442.210405][ T5859] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 442.296116][T11198] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 442.376858][ T5869] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 442.452069][ T48] usb 5-1: USB disconnect, device number 48 [ 442.528416][ T5869] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 442.541360][ T5869] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 442.550658][ T5869] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 442.559423][ T5869] usb 6-1: Product: syz [ 442.563623][ T5869] usb 6-1: Manufacturer: syz [ 442.568332][ T5869] usb 6-1: SerialNumber: syz [ 442.575614][ T5869] usb 6-1: config 0 descriptor?? [ 442.581561][ T1206] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 442.592490][T11188] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 442.600578][ T5869] hub 6-1:0.0: bad descriptor, ignoring hub [ 442.608328][ T5869] hub 6-1:0.0: probe with driver hub failed with error -5 [ 442.766849][ T1206] usb 9-1: Using ep0 maxpacket: 8 [ 442.773125][ T1206] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.784769][ T1206] usb 9-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 442.794107][ T1206] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.805215][ T1206] usb 9-1: config 0 descriptor?? [ 442.933599][T11203] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1437'. [ 443.180714][ T5869] usb 6-1: USB disconnect, device number 21 [ 443.266696][ T5859] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 443.274179][ T5859] ath9k_htc: Failed to initialize the device [ 443.282750][ T48] usb 5-1: ath9k_htc: USB layer deinitialized [ 443.414357][ T1206] belkin 0003:050D:3201.0015: hiddev0,hidraw0: USB HID v0.00 Device [HID 050d:3201] on usb-dummy_hcd.8-1/input0 [ 443.626974][ T5869] usb 9-1: USB disconnect, device number 10 [ 443.692227][T11207] batman_adv: batadv0: Adding interface: geneve2 [ 443.699084][T11207] batman_adv: batadv0: Not using interface geneve2 (retrying later): interface not active [ 444.310964][T11227] FAULT_INJECTION: forcing a failure. [ 444.310964][T11227] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 444.341445][T11227] CPU: 1 UID: 0 PID: 11227 Comm: syz.8.1446 Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 PREEMPT(full) [ 444.341470][T11227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 444.341480][T11227] Call Trace: [ 444.341485][T11227] [ 444.341493][T11227] dump_stack_lvl+0x16c/0x1f0 [ 444.341524][T11227] should_fail_ex+0x512/0x640 [ 444.341548][T11227] _copy_from_user+0x2e/0xd0 [ 444.341572][T11227] video_usercopy+0xedd/0x1720 [ 444.341595][T11227] ? __pfx___video_do_ioctl+0x10/0x10 [ 444.341614][T11227] ? selinux_kernel_read_file+0x110/0x130 [ 444.341636][T11227] ? __pfx_video_usercopy+0x10/0x10 [ 444.341672][T11227] v4l2_ioctl+0x1ba/0x250 [ 444.341692][T11227] ? __pfx_v4l2_ioctl+0x10/0x10 [ 444.341712][T11227] __x64_sys_ioctl+0x18b/0x210 [ 444.341732][T11227] do_syscall_64+0xcd/0x4c0 [ 444.341758][T11227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.341774][T11227] RIP: 0033:0x7ff3c678e929 [ 444.341787][T11227] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 444.341802][T11227] RSP: 002b:00007ff3c7594038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 444.341818][T11227] RAX: ffffffffffffffda RBX: 00007ff3c69b5fa0 RCX: 00007ff3c678e929 [ 444.341828][T11227] RDX: 00002000000003c0 RSI: 00000000c040565e RDI: 0000000000000003 [ 444.341837][T11227] RBP: 00007ff3c7594090 R08: 0000000000000000 R09: 0000000000000000 [ 444.341846][T11227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.341856][T11227] R13: 0000000000000000 R14: 00007ff3c69b5fa0 R15: 00007fff2b29cf18 [ 444.341877][T11227] [ 444.509282][ C1] vkms_vblank_simulate: vblank timer overrun [ 444.786506][ T30] audit: type=1400 audit(1750661371.127:1363): avc: denied { write } for pid=11217 comm="syz.2.1445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 445.166989][ T48] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 445.268640][ T30] audit: type=1400 audit(1750661371.577:1364): avc: denied { execute_no_trans } for pid=11235 comm="syz.2.1449" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 445.298409][ C1] vkms_vblank_simulate: vblank timer overrun [ 445.479307][ T48] usb 9-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 445.572882][ T48] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.592678][ T48] usb 9-1: Product: syz [ 445.600427][ T48] usb 9-1: Manufacturer: syz [ 445.609182][ T48] usb 9-1: SerialNumber: syz [ 445.621071][ T48] usb 9-1: config 0 descriptor?? [ 445.634535][ T48] ch341 9-1:0.0: ch341-uart converter detected [ 445.900938][T11250] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 445.983403][T11252] ptrace attach of "./syz-executor exec"[11253] was attempted by "./syz-executor exec"[11252] [ 446.301513][ T48] usb 9-1: failed to send control message: -71 [ 446.452684][ T48] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 446.491823][ T48] usb 9-1: USB disconnect, device number 11 [ 446.517007][ T48] ch341 9-1:0.0: device disconnected [ 446.611201][ T30] audit: type=1400 audit(1750661372.957:1365): avc: denied { connect } for pid=11261 comm="syz.2.1458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 446.906714][ T5859] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 447.463057][T11276] bio_check_eod: 2 callbacks suppressed [ 447.463089][T11276] syz.8.1461: attempt to access beyond end of device [ 447.463089][T11276] nbd8: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 447.559512][ T5859] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 447.567918][ T5859] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 447.579380][ T5859] usb 5-1: config 220 has no interface number 2 [ 447.585698][ T5859] usb 5-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 447.599658][ T5859] usb 5-1: config 220 interface 0 has no altsetting 0 [ 447.606533][ T5859] usb 5-1: config 220 interface 76 has no altsetting 0 [ 447.613517][ T5859] usb 5-1: config 220 interface 1 has no altsetting 0 [ 447.623434][ T5859] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 447.645378][ T5859] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.653624][ T5859] usb 5-1: Product: syz [ 447.658196][ T5859] usb 5-1: Manufacturer: syz [ 447.662847][ T5859] usb 5-1: SerialNumber: syz [ 447.971448][T11291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 447.980518][ T30] audit: type=1400 audit(1750661374.307:1366): avc: denied { setopt } for pid=11263 comm="syz.4.1457" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 448.008851][T11291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.022805][ T5869] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 448.212187][ T5869] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 448.255443][T11298] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 448.273668][ T5869] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 448.281918][ T5859] usb 5-1: selecting invalid altsetting 0 [ 448.289619][ T5859] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 448.296128][ T5859] usb 5-1: No valid video chain found. [ 448.310281][ T5859] usb 5-1: selecting invalid altsetting 0 [ 448.316089][ T5859] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 448.319323][ T5869] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.334018][ T5859] usb 5-1: USB disconnect, device number 49 [ 448.366174][ T5869] usb 6-1: config 0 descriptor?? [ 448.809683][ T5869] keytouch 0003:0926:3333.0016: fixing up Keytouch IEC report descriptor [ 448.860192][ T5869] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0016/input/input37 [ 448.955162][ T30] audit: type=1400 audit(1750661375.247:1367): avc: denied { create } for pid=11308 comm="syz.4.1468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 449.040186][ T30] audit: type=1400 audit(1750661375.257:1368): avc: denied { setopt } for pid=11308 comm="syz.4.1468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 449.094418][ T30] audit: type=1400 audit(1750661375.267:1369): avc: denied { setopt } for pid=11308 comm="syz.4.1468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 449.193082][ T30] audit: type=1400 audit(1750661375.427:1370): avc: denied { bind } for pid=11305 comm="syz.8.1467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 449.251513][ T5869] keytouch 0003:0926:3333.0016: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 449.287875][ T30] audit: type=1400 audit(1750661375.627:1371): avc: denied { add_name } for pid=11315 comm="syz.4.1471" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 449.303721][ T5869] usb 6-1: USB disconnect, device number 22 [ 449.308649][ C1] vkms_vblank_simulate: vblank timer overrun [ 449.309016][ T30] audit: type=1400 audit(1750661375.627:1372): avc: denied { create } for pid=11315 comm="syz.4.1471" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 449.341301][ C1] vkms_vblank_simulate: vblank timer overrun [ 449.353996][ T30] audit: type=1400 audit(1750661375.627:1373): avc: denied { associate } for pid=11315 comm="syz.4.1471" name="file1" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 449.375711][ C1] vkms_vblank_simulate: vblank timer overrun [ 449.385175][ T30] audit: type=1400 audit(1750661375.697:1374): avc: denied { unmount } for pid=5809 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 449.405443][ C1] vkms_vblank_simulate: vblank timer overrun [ 449.552489][T11322] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 450.824040][ T30] audit: type=1400 audit(1750661377.167:1375): avc: denied { read } for pid=11329 comm="syz.5.1476" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 450.897775][T11331] syz.8.1474: attempt to access beyond end of device [ 450.897775][T11331] nbd8: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 452.317052][T11354] syz.4.1481: attempt to access beyond end of device [ 452.317052][T11354] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 452.444491][T11365] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1480'. [ 452.755367][T11368] netlink: 212408 bytes leftover after parsing attributes in process `syz.7.1483'. [ 452.820477][T11368] netlink: zone id is out of range [ 452.825740][T11368] netlink: get zone limit has 8 unknown bytes [ 453.055589][T11382] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1487'. [ 453.632265][T11388] syz.7.1486: attempt to access beyond end of device [ 453.632265][T11388] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 453.706815][ T5827] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 453.928814][ T5827] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 453.966910][ T5827] usb 5-1: config 0 interface 0 has no altsetting 0 [ 454.002725][ T5827] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 454.039888][ T5827] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 454.065622][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 454.065638][ T30] audit: type=1400 audit(1750661380.407:1384): avc: denied { ioctl } for pid=11395 comm="syz.7.1490" path="socket:[32198]" dev="sockfs" ino=32198 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 454.068466][ T5827] usb 5-1: Product: syz [ 454.107063][ T5827] usb 5-1: Manufacturer: syz [ 454.111966][ T5827] usb 5-1: SerialNumber: syz [ 454.128025][ T5827] usb 5-1: config 0 descriptor?? [ 454.139636][ T5827] usb 5-1: selecting invalid altsetting 0 [ 454.643753][T11406] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1493'. [ 455.446406][T11415] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1496'. [ 455.495012][ T30] audit: type=1400 audit(1750661381.837:1385): avc: denied { bind } for pid=11412 comm="syz.5.1495" lport=259 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 455.519777][ T30] audit: type=1400 audit(1750661381.837:1386): avc: denied { name_bind } for pid=11412 comm="syz.5.1495" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 455.540680][ C1] vkms_vblank_simulate: vblank timer overrun [ 455.558436][ T30] audit: type=1400 audit(1750661381.837:1387): avc: denied { node_bind } for pid=11412 comm="syz.5.1495" saddr=fc02::1 src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 455.620002][T11429] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1500'. [ 455.630886][T11429] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1500'. [ 455.642396][T11429] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 456.337965][ T48] usb 5-1: USB disconnect, device number 50 [ 456.368714][T11433] syz.8.1501: attempt to access beyond end of device [ 456.368714][T11433] nbd8: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 456.603186][ T30] audit: type=1400 audit(1750661382.937:1388): avc: denied { view } for pid=11440 comm="syz.4.1502" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 456.622247][ C1] vkms_vblank_simulate: vblank timer overrun [ 456.733621][T11446] overlayfs: missing 'lowerdir' [ 456.746661][ T10] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 456.958308][ T10] usb 6-1: device descriptor read/64, error -71 [ 457.206707][ T10] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 457.215163][T11452] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1506'. [ 457.352272][T11457] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 457.456694][ T10] usb 6-1: device descriptor read/64, error -71 [ 457.591642][ T10] usb usb6-port1: attempt power cycle [ 458.065039][ T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 458.156648][ T10] usb 6-1: device descriptor read/8, error -71 [ 458.416646][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 458.487185][ T10] usb 6-1: device descriptor read/8, error -71 [ 458.973741][ T10] usb usb6-port1: unable to enumerate USB device [ 458.984145][T11494] syz.7.1514: attempt to access beyond end of device [ 458.984145][T11494] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 459.351640][ T30] audit: type=1400 audit(1750661385.697:1389): avc: denied { bind } for pid=11503 comm="syz.7.1516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 459.387152][ T30] audit: type=1400 audit(1750661385.697:1390): avc: denied { listen } for pid=11503 comm="syz.7.1516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 459.410874][T11505] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1516'. [ 459.427965][ T30] audit: type=1400 audit(1750661385.697:1391): avc: denied { accept } for pid=11503 comm="syz.7.1516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 459.687473][ T30] audit: type=1400 audit(1750661386.027:1392): avc: denied { setattr } for pid=11507 comm="syz.7.1519" name="[io_uring]" dev="anon_inodefs" ino=32784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 459.875279][T11514] overlayfs: missing 'lowerdir' [ 460.074885][ T30] audit: type=1400 audit(1750661386.407:1393): avc: denied { listen } for pid=11507 comm="syz.7.1519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 460.215907][ T30] audit: type=1400 audit(1750661386.557:1394): avc: denied { setattr } for pid=11524 comm="syz.8.1523" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 460.567160][ T5859] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 460.646647][ T10] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 460.806778][ T5859] usb 5-1: device descriptor read/64, error -71 [ 461.206936][ T5859] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 461.210417][T11538] xt_hashlimit: max too large, truncated to 1048576 [ 461.225662][T11538] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 461.291135][ T10] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 461.306799][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.315467][ T10] usb 9-1: Product: syz [ 461.336655][ T10] usb 9-1: Manufacturer: syz [ 461.341479][ T10] usb 9-1: SerialNumber: syz [ 461.476757][ T5859] usb 5-1: device descriptor read/64, error -71 [ 461.483126][ T5827] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 461.596930][ T5859] usb usb5-port1: attempt power cycle [ 461.638505][ T5827] usb 6-1: config 17 has an invalid interface number: 44 but max is 0 [ 461.661383][ T5827] usb 6-1: config 17 has no interface number 0 [ 461.684640][ T5827] usb 6-1: config 17 interface 44 has no altsetting 0 [ 461.708648][ T5827] usb 6-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice= 8.85 [ 461.718103][ T5827] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.727097][ T5827] usb 6-1: Product: syz [ 461.731441][ T5827] usb 6-1: Manufacturer: syz [ 461.736128][ T5827] usb 6-1: SerialNumber: syz [ 461.936933][ T5859] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 461.991766][ T5859] usb 5-1: device descriptor read/8, error -71 [ 462.136367][ T5827] (null): radio-mr800 - initialization failed [ 462.168800][ T5827] radio-mr800 6-1:17.44: probe with driver radio-mr800 failed with error -22 [ 462.207975][ T5827] usbhid 6-1:17.44: couldn't find an input interrupt endpoint [ 462.236481][ T5827] usb 6-1: USB disconnect, device number 27 [ 462.245148][ T30] audit: type=1326 audit(1750661388.587:1395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11547 comm="syz.5.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 462.276891][ T5859] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 462.304862][ T30] audit: type=1326 audit(1750661388.587:1396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11547 comm="syz.5.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 462.344469][ T5859] usb 5-1: device descriptor read/8, error -71 [ 462.376654][ T30] audit: type=1326 audit(1750661388.587:1397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11547 comm="syz.5.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 462.403748][ T10] cdc_ncm 9-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 462.411471][ T10] cdc_ncm 9-1:1.0: setting rx_max = 16384 [ 462.421832][ T30] audit: type=1326 audit(1750661388.597:1398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11547 comm="syz.5.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 462.466906][ T5859] usb usb5-port1: unable to enumerate USB device [ 463.167351][T11560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1530'. [ 463.408641][T11562] batman_adv: batadv0: Removing interface: geneve2 [ 463.454585][T11562] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1532'. [ 463.456175][T11565] overlayfs: missing 'lowerdir' [ 463.752138][ T10] cdc_ncm 9-1:1.0: setting tx_max = 16384 [ 463.802103][ T10] cdc_ncm 9-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.8-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 463.929029][ T10] usb 9-1: USB disconnect, device number 12 [ 463.936118][ T10] cdc_ncm 9-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.8-1, CDC NCM (NO ZLP) [ 464.363007][T11585] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=73 sclass=netlink_xfrm_socket pid=11585 comm=syz.7.1539 [ 464.376944][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 464.376959][ T30] audit: type=1400 audit(1750661390.727:1418): avc: denied { read } for pid=11586 comm="syz.4.1540" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 464.543996][ T30] audit: type=1400 audit(1750661390.887:1419): avc: denied { audit_control } for pid=11592 comm="syz.7.1543" capability=30 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 464.709180][ T1206] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 464.774746][T11604] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1546'. [ 464.899662][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 464.923145][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 464.938532][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 464.962497][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 465.133970][ T1206] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 465.146513][ T1206] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.176820][ T1206] usb 6-1: Product: syz [ 465.185143][ T1206] usb 6-1: Manufacturer: syz [ 465.191550][ T1206] usb 6-1: SerialNumber: syz [ 465.202555][ T1206] usb 6-1: config 0 descriptor?? [ 465.565907][ T1206] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 465.991417][T11636] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1552'. [ 466.070315][ T5859] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 466.094082][ T10] usb 6-1: USB disconnect, device number 28 [ 466.257371][ T5859] usb 5-1: no configurations [ 466.262314][ T5859] usb 5-1: can't read configurations, error -22 [ 466.407112][ T5859] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 466.587094][ T5859] usb 5-1: no configurations [ 466.591795][ T5859] usb 5-1: can't read configurations, error -22 [ 466.619363][ T5859] usb usb5-port1: attempt power cycle [ 467.063938][T11655] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1559'. [ 467.237090][ T5859] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 467.319542][ T5859] usb 5-1: no configurations [ 467.324205][ T5859] usb 5-1: can't read configurations, error -22 [ 467.467154][ T5859] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 467.495481][ T5859] usb 5-1: no configurations [ 467.522215][ T5859] usb 5-1: can't read configurations, error -22 [ 467.530545][ T5859] usb usb5-port1: unable to enumerate USB device [ 467.647491][T11669] netlink: 'syz.5.1563': attribute type 1 has an invalid length. [ 467.655536][T11669] netlink: 144 bytes leftover after parsing attributes in process `syz.5.1563'. [ 467.667708][T11669] netlink: 'syz.5.1563': attribute type 1 has an invalid length. [ 467.675597][T11669] netlink: 'syz.5.1563': attribute type 2 has an invalid length. [ 467.692525][T11669] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1563'. [ 467.703865][T11669] netlink: 'syz.5.1563': attribute type 1 has an invalid length. [ 467.705679][T11660] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1560'. [ 467.712129][T11669] netlink: 144 bytes leftover after parsing attributes in process `syz.5.1563'. [ 467.730480][T11669] netlink: 'syz.5.1563': attribute type 1 has an invalid length. [ 467.738417][T11669] netlink: 'syz.5.1563': attribute type 2 has an invalid length. [ 467.756647][T11669] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1563'. [ 468.646905][ T5827] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 468.808260][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 468.828678][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 468.838932][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 468.850091][ T5827] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 468.864402][ T5827] usb 9-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 468.874134][ T5827] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.883640][ T5827] usb 9-1: Product: syz [ 468.888116][ T5827] usb 9-1: Manufacturer: syz [ 468.893185][ T5827] usb 9-1: SerialNumber: syz [ 468.901451][ T5827] usb 9-1: config 0 descriptor?? [ 469.110222][ T5827] adutux 9-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 469.227162][ T5859] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 469.299900][ T30] audit: type=1400 audit(1750661395.647:1420): avc: denied { bind } for pid=11701 comm="syz.2.1573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 469.410836][ T5859] usb 5-1: Using ep0 maxpacket: 8 [ 469.438601][ T5859] usb 5-1: config 0 has an invalid interface number: 186 but max is 0 [ 469.460535][ T5859] usb 5-1: config 0 has no interface number 0 [ 469.473338][ T5859] usb 5-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 469.504442][ T5859] usb 5-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 469.522112][ T5859] usb 5-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 469.533601][ T5859] usb 5-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 469.551451][ T1206] usb 9-1: USB disconnect, device number 13 [ 469.551858][ T5859] usb 5-1: New USB device found, idVendor=07c0, idProduct=1501, bcdDevice=b8.c5 [ 469.574412][ T5859] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.583347][ T5859] usb 5-1: Product: syz [ 469.589324][ T5859] usb 5-1: Manufacturer: syz [ 469.594202][ T5859] usb 5-1: SerialNumber: syz [ 469.603572][ T5859] usb 5-1: config 0 descriptor?? [ 469.901325][ T5859] iowarrior 5-1:0.186: IOWarrior product=0x1501, serial=42424242 interface=186 now attached to iowarrior0 [ 470.019968][T11721] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 470.029001][T11721] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 470.313910][ T5859] usb 5-1: USB disconnect, device number 59 [ 470.808053][T11728] netlink: 44 bytes leftover after parsing attributes in process `syz.8.1577'. [ 470.817623][T11728] netlink: 43 bytes leftover after parsing attributes in process `syz.8.1577'. [ 470.826609][T11728] netlink: 'syz.8.1577': attribute type 6 has an invalid length. [ 470.834332][T11728] netlink: 'syz.8.1577': attribute type 5 has an invalid length. [ 470.842836][T11728] netlink: 43 bytes leftover after parsing attributes in process `syz.8.1577'. [ 470.860249][ T30] audit: type=1400 audit(1750661397.197:1421): avc: denied { append } for pid=11725 comm="syz.8.1577" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 471.337857][ T30] audit: type=1400 audit(1750661397.687:1422): avc: denied { write } for pid=11746 comm="syz.8.1583" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 471.596017][T11749] overlayfs: missing 'lowerdir' [ 471.661400][ T5859] usb 9-1: new full-speed USB device number 14 using dummy_hcd [ 471.830555][ T5859] usb 9-1: config 0 has an invalid interface number: 200 but max is 0 [ 471.900447][ T5859] usb 9-1: config 0 has no interface number 0 [ 471.907232][ T5859] usb 9-1: config 0 interface 200 has no altsetting 0 [ 471.920434][ T5859] usb 9-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 471.936506][ T5859] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.044621][ T5859] usb 9-1: Product: syz [ 472.075139][ T5859] usb 9-1: Manufacturer: syz [ 472.102112][ T5859] usb 9-1: SerialNumber: syz [ 472.169495][ T5859] usb 9-1: config 0 descriptor?? [ 472.269400][T11760] input: syz0 as /devices/virtual/input/input39 [ 472.506077][T11763] loop8: detected capacity change from 0 to 16384 [ 474.351430][T11769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.400990][T11769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.624389][ T5859] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.200/input/input40 [ 475.110412][T11784] syz.5.1589: attempt to access beyond end of device [ 475.110412][T11784] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 475.146264][ T5859] usb 9-1: USB disconnect, device number 14 [ 475.407560][T11800] 9pnet_fd: Insufficient options for proto=fd [ 475.429817][ T30] audit: type=1400 audit(1750661657.779:1423): avc: denied { append } for pid=11799 comm="syz.5.1594" name="sg0" dev="devtmpfs" ino=768 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 475.453556][ C1] vkms_vblank_simulate: vblank timer overrun [ 475.471822][ T30] audit: type=1400 audit(1750661657.779:1424): avc: denied { connect } for pid=11799 comm="syz.5.1594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 475.481588][T11805] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1595'. [ 475.524982][ T30] audit: type=1400 audit(1750661657.779:1425): avc: denied { read } for pid=11799 comm="syz.5.1594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 475.591416][ T30] audit: type=1400 audit(1750661657.779:1426): avc: denied { bind } for pid=11799 comm="syz.5.1594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 475.704537][ T30] audit: type=1326 audit(1750661658.049:1427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11813 comm="syz.7.1598" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f219bf8e929 code=0x0 [ 475.826734][ T1206] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 475.923157][T11820] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1599'. [ 476.078117][ T1206] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.089331][ T1206] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 476.098426][ T1206] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.118737][ T1206] usb 6-1: config 0 descriptor?? [ 476.288268][ T30] audit: type=1400 audit(1750661658.539:1428): avc: denied { create } for pid=11819 comm="syz.8.1599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 476.585568][ T30] audit: type=1400 audit(1750661658.929:1429): avc: denied { getopt } for pid=11811 comm="syz.2.1597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 477.081734][ T1206] keytouch 0003:0926:3333.0017: fixing up Keytouch IEC report descriptor [ 477.095219][ T30] audit: type=1400 audit(1750661659.439:1430): avc: denied { read } for pid=11831 comm="syz.8.1602" path="socket:[33281]" dev="sockfs" ino=33281 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 477.139387][ T1206] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0017/input/input41 [ 477.234660][ T1206] keytouch 0003:0926:3333.0017: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 477.281738][T11809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.313595][T11838] mmap: syz.8.1604 (11838): VmData 37728256 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 477.337628][T11809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.359188][T11843] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 477.416808][ T10] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 477.438045][T11809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.447143][T11809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.599709][T11846] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 477.845088][ T1206] usb 6-1: USB disconnect, device number 29 [ 477.859614][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 477.874578][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 477.891688][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 477.905536][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 477.926942][ T10] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 477.936195][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.944275][ T10] usb 5-1: Product: syz [ 477.948737][ T10] usb 5-1: Manufacturer: syz [ 477.953315][ T10] usb 5-1: SerialNumber: syz [ 477.961087][ T10] usb 5-1: config 0 descriptor?? [ 478.170716][ T10] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 478.376068][T11854] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1608'. [ 478.575643][T11858] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1610'. [ 478.596334][ T30] audit: type=1400 audit(1750661660.919:1431): avc: denied { create } for pid=11857 comm="syz.2.1610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 479.073608][ T30] audit: type=1400 audit(1750661660.919:1432): avc: denied { write } for pid=11857 comm="syz.2.1610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 479.187119][ T30] audit: type=1400 audit(1750661661.529:1433): avc: denied { read } for pid=11873 comm="syz.2.1612" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 479.228530][ T1206] usb 5-1: USB disconnect, device number 60 [ 479.334365][T11880] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1613'. [ 479.438319][ T30] audit: type=1400 audit(1750661661.789:1434): avc: denied { map } for pid=11881 comm="syz.7.1615" path="socket:[34215]" dev="sockfs" ino=34215 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 480.582319][ T30] audit: type=1400 audit(1750661662.929:1435): avc: denied { create } for pid=11913 comm="syz.7.1624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 480.603275][ C1] vkms_vblank_simulate: vblank timer overrun [ 480.769463][T11919] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1626'. [ 480.853055][T11922] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 480.876745][ T30] audit: type=1400 audit(1750661663.119:1436): avc: denied { write } for pid=11917 comm="syz.4.1626" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 480.960582][T11926] netlink: 'syz.7.1627': attribute type 10 has an invalid length. [ 481.083929][T11926] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 481.171556][T11934] program syz.4.1628 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 481.287842][T11935] pimreg: entered allmulticast mode [ 481.346550][T11935] pimreg: left allmulticast mode [ 481.581703][T11942] overlayfs: missing 'lowerdir' [ 481.906691][ T1206] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 482.379170][ T1206] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 482.394875][ T1206] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 482.414897][ T1206] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 482.426166][ T1206] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 482.476443][ T1206] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 482.485664][ T1206] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.496742][ T1206] usb 5-1: Product: syz [ 482.501155][ T1206] usb 5-1: Manufacturer: syz [ 482.506346][ T1206] usb 5-1: SerialNumber: syz [ 482.515001][ T1206] usb 5-1: config 0 descriptor?? [ 482.788911][ T1206] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 482.970304][T11966] FAULT_INJECTION: forcing a failure. [ 482.970304][T11966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.006669][T11966] CPU: 0 UID: 0 PID: 11966 Comm: syz.5.1639 Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 PREEMPT(full) [ 483.006696][T11966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 483.006703][T11966] Call Trace: [ 483.006707][T11966] [ 483.006711][T11966] dump_stack_lvl+0x16c/0x1f0 [ 483.006736][T11966] should_fail_ex+0x512/0x640 [ 483.006753][T11966] _copy_from_iter+0x29f/0x16f0 [ 483.006769][T11966] ? __alloc_skb+0x200/0x380 [ 483.006784][T11966] ? __pfx__copy_from_iter+0x10/0x10 [ 483.006799][T11966] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 483.006814][T11966] netlink_sendmsg+0x829/0xdd0 [ 483.006827][T11966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.006846][T11966] ____sys_sendmsg+0xa98/0xc70 [ 483.006857][T11966] ? copy_msghdr_from_user+0x10a/0x160 [ 483.006871][T11966] ? __pfx_____sys_sendmsg+0x10/0x10 [ 483.006889][T11966] ___sys_sendmsg+0x134/0x1d0 [ 483.006904][T11966] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.006917][T11966] ? __lock_acquire+0x622/0x1c90 [ 483.006951][T11966] __sys_sendmsg+0x16d/0x220 [ 483.006966][T11966] ? __pfx___sys_sendmsg+0x10/0x10 [ 483.006991][T11966] do_syscall_64+0xcd/0x4c0 [ 483.007008][T11966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.007018][T11966] RIP: 0033:0x7f872678e929 [ 483.007028][T11966] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.007038][T11966] RSP: 002b:00007f87245f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.007048][T11966] RAX: ffffffffffffffda RBX: 00007f87269b5fa0 RCX: 00007f872678e929 [ 483.007055][T11966] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 483.007061][T11966] RBP: 00007f87245f6090 R08: 0000000000000000 R09: 0000000000000000 [ 483.007067][T11966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.007072][T11966] R13: 0000000000000000 R14: 00007f87269b5fa0 R15: 00007fffcfc4bd98 [ 483.007085][T11966] [ 483.655188][T11977] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1641'. [ 483.847472][ T1206] usb 5-1: USB disconnect, device number 61 [ 483.921121][T11981] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1642'. [ 484.351767][ T30] audit: type=1400 audit(1750661666.699:1437): avc: denied { read } for pid=11983 comm="syz.8.1643" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 484.521078][ T30] audit: type=1400 audit(1750661666.869:1438): avc: denied { setopt } for pid=11992 comm="syz.5.1645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 484.542549][ T30] audit: type=1400 audit(1750661666.899:1439): avc: denied { connect } for pid=11992 comm="syz.5.1645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 484.582283][ T30] audit: type=1400 audit(1750661666.929:1440): avc: denied { getopt } for pid=11992 comm="syz.5.1645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 484.858457][T11998] tmpfs: Unknown parameter 'hid' [ 484.917622][T11999] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 484.931992][ T30] audit: type=1400 audit(1750661667.209:1441): avc: denied { shutdown } for pid=11992 comm="syz.5.1645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 485.056142][T12007] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1649'. [ 485.095391][T11997] overlayfs: missing 'lowerdir' [ 485.416777][ T1206] usb 9-1: new full-speed USB device number 15 using dummy_hcd [ 485.512418][T12016] xt_hashlimit: max too large, truncated to 1048576 [ 485.519532][T12016] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 485.570004][ T1206] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 485.580739][ T1206] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 485.592052][ T1206] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 485.601233][ T1206] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 485.609275][ T1206] usb 9-1: SerialNumber: syz [ 485.618421][ T1206] usb 9-1: 0:2 : does not exist [ 485.879608][ T1206] usb 9-1: USB disconnect, device number 15 [ 486.018814][T12024] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1654'. [ 486.496918][ T30] audit: type=1400 audit(1750661668.819:1442): avc: denied { ioctl } for pid=12022 comm="syz.4.1655" path="socket:[33598]" dev="sockfs" ino=33598 ioctlcmd=0x3ba0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 486.521850][ C1] vkms_vblank_simulate: vblank timer overrun [ 486.528223][T12025] netlink: 'syz.4.1655': attribute type 2 has an invalid length. [ 486.609545][ T51] Bluetooth: hci5: command tx timeout [ 487.459495][T12034] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1658'. [ 487.532294][ T30] audit: type=1400 audit(1750661669.859:1443): avc: denied { write } for pid=12033 comm="syz.8.1658" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 487.746675][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 488.500473][T12049] xt_hashlimit: max too large, truncated to 1048576 [ 489.231764][T12046] netlink: 68 bytes leftover after parsing attributes in process `syz.8.1662'. [ 489.594564][ T30] audit: type=1400 audit(1750661671.939:1444): avc: denied { setopt } for pid=12051 comm="syz.4.1663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 490.013407][T12051] block nbd4: shutting down sockets [ 491.149035][T12075] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1668'. [ 491.986785][ T48] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 492.140722][T12105] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 492.147274][T12105] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 492.216674][T12105] vhci_hcd vhci_hcd.0: Device attached [ 492.226466][ T10] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 492.249036][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 492.266923][T12107] vhci_hcd: connection closed [ 492.280657][ T36] vhci_hcd: stop threads [ 492.306797][ T36] vhci_hcd: release socket [ 492.311320][ T48] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 492.322307][ T36] vhci_hcd: disconnect device [ 492.333142][ T48] usb 5-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 492.350374][ T48] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.390730][ T48] usb 5-1: config 0 descriptor?? [ 492.398054][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 492.408027][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 492.444093][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 492.477779][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 492.526641][ T10] usb 9-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 492.566953][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.601183][ T10] usb 9-1: config 0 descriptor?? [ 492.844579][ T48] hid-steam 0003:28DE:1142.0018: unknown main item tag 0x0 [ 492.857831][ T48] hid-steam 0003:28DE:1142.0018: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 492.934774][ T48] hid-steam 0003:28DE:1142.0018: Steam wireless receiver connected [ 493.514748][ T10] hdpvr 9-1:0.0: unexpected answer of status request, len 0 [ 493.531189][ T10] hdpvr 9-1:0.0: device init failed [ 493.591639][T12115] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 493.603199][ T48] hid-steam 0003:28DE:1142.0018: No HID_FEATURE_REPORT submitted - nothing to read [ 493.618650][ T10] hdpvr 9-1:0.0: probe with driver hdpvr failed with error -12 [ 493.623426][ T48] hid-steam 0003:28DE:1142.0019: unknown main item tag 0x0 [ 493.657377][T12119] RDS: rds_bind could not find a transport for fc02::1, load rds_tcp or rds_rdma? [ 493.699423][T12126] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1682'. [ 493.715105][ T48] hid-steam 0003:28DE:1142.0019: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 494.012435][ T48] usb 5-1: USB disconnect, device number 62 [ 494.055610][ T48] hid-steam 0003:28DE:1142.0018: Steam wireless receiver disconnected [ 494.348621][ T30] audit: type=1400 audit(1750661676.629:1445): avc: denied { watch } for pid=12129 comm="syz.5.1684" path="/164/file1" dev="tmpfs" ino=886 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 494.550986][ T30] audit: type=1400 audit(1750661676.629:1446): avc: denied { watch_sb watch_reads } for pid=12129 comm="syz.5.1684" path="/164/file1" dev="tmpfs" ino=886 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 494.576397][ T30] audit: type=1400 audit(1750661676.889:1447): avc: denied { create } for pid=12129 comm="syz.5.1684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 494.621781][ T30] audit: type=1400 audit(1750661676.909:1448): avc: denied { bind } for pid=12129 comm="syz.5.1684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 495.064139][ T5926] usb 9-1: USB disconnect, device number 16 [ 495.907180][ T5895] kworker/0:4 (5895) used greatest stack depth: 16872 bytes left [ 496.066811][ T5926] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 496.454629][ T5926] usb 5-1: unable to get BOS descriptor or descriptor too short [ 496.478057][ T5926] usb 5-1: not running at top speed; connect to a high speed hub [ 496.499732][ T5926] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 496.510163][ T5926] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 496.526983][ T5926] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 496.561895][ T5926] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 496.581164][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.608380][ T5926] usb 5-1: Product: syz [ 496.617457][ T5926] usb 5-1: Manufacturer: syz [ 496.623193][ T5926] usb 5-1: SerialNumber: syz [ 496.848651][ T5926] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 496.855820][ T5926] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 496.863715][ T5926] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 497.360657][ T5926] usb 5-1: USB disconnect, device number 63 [ 497.595383][ T30] audit: type=1400 audit(1750661679.939:1449): avc: denied { mounton } for pid=12167 comm="syz.8.1693" path="/76/file1/file0" dev="autofs" ino=35934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 498.070360][T12178] 9pnet_fd: Insufficient options for proto=fd [ 498.149854][ T10] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 498.316674][ T10] usb 9-1: Using ep0 maxpacket: 32 [ 498.354001][ T10] usb 9-1: config 13 has an invalid interface number: 108 but max is 0 [ 498.445055][ T10] usb 9-1: config 13 has no interface number 0 [ 498.479219][ T10] usb 9-1: New USB device found, idVendor=06cd, idProduct=010c, bcdDevice=71.09 [ 498.502841][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.543249][ T10] usb 9-1: Product: syz [ 498.573567][ T10] usb 9-1: Manufacturer: syz [ 498.588954][T12174] overlayfs: missing 'lowerdir' [ 498.593760][ T10] usb 9-1: SerialNumber: syz [ 498.608323][ T10] keyspan 9-1:13.108: Keyspan 1 port adapter converter detected [ 498.622208][T12174] sch_tbf: peakrate 256 is lower than or equals to rate 4294967295 ! [ 498.627445][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 84 [ 498.685106][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 81 [ 498.706658][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 1 [ 498.724802][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 2 [ 498.745957][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 83 [ 498.781075][ T10] keyspan 9-1:13.108: found no endpoint descriptor for endpoint 3 [ 498.824782][ T10] usb 9-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 498.850942][ T10] usb 9-1: USB disconnect, device number 17 [ 498.871977][ T10] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 498.889987][ T10] keyspan 9-1:13.108: device disconnected [ 498.897986][T12183] syz.5.1696: attempt to access beyond end of device [ 498.897986][T12183] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 499.091644][T12195] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 499.577554][T12203] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1702'. [ 500.086771][ T5869] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 500.236655][ T5869] usb 6-1: Using ep0 maxpacket: 16 [ 500.243675][ T5869] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.257330][ T5869] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 500.283857][ T5869] usb 6-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=b4.5b [ 500.296492][ T5869] usb 6-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 500.305224][ T5869] usb 6-1: Product: syz [ 500.313053][ T5869] usb 6-1: Manufacturer: syz [ 500.319092][ T5869] usb 6-1: SerialNumber: syz [ 500.324958][ T5869] usb 6-1: config 0 descriptor?? [ 500.332791][ T5869] usb 6-1: NFC: intf ffff8880252c8000 id ffffffff8f564ae0 [ 500.405271][ T30] audit: type=1400 audit(1750661682.749:1450): avc: denied { mount } for pid=12210 comm="syz.7.1705" name="/" dev="ramfs" ino=35010 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 500.472232][ T30] audit: type=1400 audit(1750661682.749:1451): avc: denied { map } for pid=12210 comm="syz.7.1705" path="socket:[35004]" dev="sockfs" ino=35004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 500.689169][ T30] audit: type=1326 audit(1750661683.039:1452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 500.724300][T12209] atomic_op ffff888044b2e198 conn xmit_atomic 0000000000000000 [ 500.896617][ T30] audit: type=1326 audit(1750661683.039:1453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 500.922683][ T30] audit: type=1326 audit(1750661683.059:1454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 501.353908][T12209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.362427][ T30] audit: type=1326 audit(1750661683.059:1455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 501.385898][ C1] vkms_vblank_simulate: vblank timer overrun [ 501.392681][T12209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.392789][ T30] audit: type=1326 audit(1750661683.059:1456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 501.423807][ C1] vkms_vblank_simulate: vblank timer overrun [ 501.478915][ T5827] usb 6-1: USB disconnect, device number 30 [ 501.494438][ T30] audit: type=1326 audit(1750661683.059:1457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 501.575427][ T30] audit: type=1326 audit(1750661683.069:1458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 501.619263][ T30] audit: type=1326 audit(1750661683.069:1459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12208 comm="syz.5.1704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872678e929 code=0x7ffc0000 [ 502.776150][T12238] syz.5.1712: attempt to access beyond end of device [ 502.776150][T12238] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 503.180601][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880593bbc00: rx timeout, send abort [ 503.682211][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880593b8400: rx timeout, send abort [ 503.691342][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880593bbc00: abort rx timeout. Force session deactivation [ 504.190518][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880593b8400: abort rx timeout. Force session deactivation [ 505.166118][T12262] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 505.838773][T12279] syz.4.1724: attempt to access beyond end of device [ 505.838773][T12279] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 506.018092][T12287] netlink: 'syz.7.1725': attribute type 10 has an invalid length. [ 506.142242][T12287] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 506.607301][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 506.607317][ T30] audit: type=1400 audit(1750661688.949:1492): avc: denied { mount } for pid=12294 comm="syz.4.1728" name="/" dev="configfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 506.636140][ C1] vkms_vblank_simulate: vblank timer overrun [ 506.643236][ T30] audit: type=1400 audit(1750661688.979:1493): avc: denied { search } for pid=12294 comm="syz.4.1728" name="/" dev="configfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 506.666367][ T30] audit: type=1400 audit(1750661688.979:1494): avc: denied { search } for pid=12294 comm="syz.4.1728" name="/" dev="configfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 506.688611][ C1] vkms_vblank_simulate: vblank timer overrun [ 506.696730][ T30] audit: type=1400 audit(1750661688.979:1495): avc: denied { mounton } for pid=12294 comm="syz.4.1728" path="/" dev="configfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 506.719078][ C1] vkms_vblank_simulate: vblank timer overrun [ 506.726316][ T30] audit: type=1400 audit(1750661688.979:1496): avc: denied { read open } for pid=12294 comm="syz.4.1728" path="/" dev="configfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 506.750196][ T30] audit: type=1400 audit(1750661689.099:1497): avc: denied { unmount } for pid=5809 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 506.770354][ C1] vkms_vblank_simulate: vblank timer overrun [ 507.288159][ T30] audit: type=1400 audit(1750661689.439:1498): avc: denied { sqpoll } for pid=12298 comm="syz.5.1730" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 507.597284][T12309] netlink: 'syz.2.1732': attribute type 4 has an invalid length. [ 507.609654][T12309] netlink: 'syz.2.1732': attribute type 4 has an invalid length. [ 508.581936][T12336] program syz.5.1739 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 508.600926][T10573] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 508.706784][ T31] INFO: task syz.3.1123:9939 blocked for more than 143 seconds. [ 508.749953][ T30] audit: type=1400 audit(1750661691.099:1499): avc: denied { mount } for pid=12335 comm="syz.5.1739" name="/" dev="hugetlbfs" ino=36358 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 508.768682][ T31] Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 [ 508.790077][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 508.799589][T10573] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 508.811366][T10573] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 508.864378][ T31] task:syz.3.1123 state:D stack:27992 pid:9939 tgid:9932 ppid:5810 task_flags:0x400040 flags:0x00004004 [ 508.898111][T10573] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 48, changing to 9 [ 508.944264][ T31] Call Trace: [ 509.056436][ T31] [ 509.060636][T10573] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8240, setting to 1024 [ 509.060939][ T31] __schedule+0x116a/0x5de0 [ 509.074789][T10573] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 509.076271][ T31] ? __lock_acquire+0x622/0x1c90 [ 509.085712][T10573] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.092850][ T31] ? __pfx___schedule+0x10/0x10 [ 509.099107][T10573] usb 5-1: Product: syz [ 509.103695][ T31] ? find_held_lock+0x2b/0x80 [ 509.108330][T10573] usb 5-1: Manufacturer: syz [ 509.115960][ T31] ? schedule+0x2d7/0x3a0 [ 509.118451][T10573] usb 5-1: SerialNumber: syz [ 509.121890][ T31] schedule+0xe7/0x3a0 [ 509.143109][ T31] netfs_wait_for_request+0x161/0x5a0 [ 509.149046][T10573] usb 5-1: config 0 descriptor?? [ 509.162768][ T31] ? __pfx_netfs_write_collection+0x10/0x10 [ 509.168756][ T31] ? __pfx_netfs_wait_for_request+0x10/0x10 [ 509.174680][ T31] ? netfs_wake_collector+0x114/0x160 [ 509.180205][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 509.186305][ T31] ? netfs_unbuffered_write+0x19c/0x230 [ 509.191987][ T31] netfs_unbuffered_write_iter_locked+0x8c3/0xc80 [ 509.198514][ T31] netfs_unbuffered_write_iter+0x414/0x6d0 [ 509.204350][ T31] v9fs_file_write_iter+0xbf/0x100 [ 509.209508][ T31] vfs_write+0x6c4/0x1150 [ 509.214341][ T31] ? __pfx_v9fs_file_write_iter+0x10/0x10 [ 509.221847][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 509.226919][ T31] ? __pfx_vfs_write+0x10/0x10 [ 509.231711][ T31] ksys_write+0x12a/0x250 [ 509.236029][ T31] ? __pfx_ksys_write+0x10/0x10 [ 509.241333][ T31] do_syscall_64+0xcd/0x4c0 [ 509.245861][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.251786][ T31] RIP: 0033:0x7f165198e929 [ 509.256195][ T31] RSP: 002b:00007f165281b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 509.264667][ T31] RAX: ffffffffffffffda RBX: 00007f1651bb6160 RCX: 00007f165198e929 [ 509.274512][ T31] RDX: 0000000000000029 RSI: 0000200000000200 RDI: 0000000000000006 [ 509.282604][ T31] RBP: 00007f1651a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 509.301227][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 509.309805][ T31] R13: 0000000000000000 R14: 00007f1651bb6160 R15: 00007ffd9f7443a8 [ 509.318586][ T31] [ 509.322044][ T31] [ 509.322044][ T31] Showing all locks held in the system: [ 509.329910][ T31] 1 lock held by khungtaskd/31: [ 509.334753][ T31] #0: ffffffff8e5c4940 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 509.345188][ T31] 2 locks held by getty/5572: [ 509.350522][ T31] #0: ffff88803265c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 509.360713][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 509.360852][T10573] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 509.370861][ T31] 3 locks held by syz.3.1123/9939: [ 509.370876][ T31] #0: ffff8880358dfcf8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 [ 509.370924][ T31] #1: ffff8880553b4428 (sb_writers#19){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 509.402372][ T31] #2: ffff888074ea07b8 (&sb->s_type->i_mutex_key#23){++++}-{4:4}, at: netfs_start_io_direct+0x116/0x260 [ 509.413694][ T31] 1 lock held by syz.5.1739/12335: [ 509.419289][ T31] #0: ffffffff8e5cfe00 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6e0 [ 509.429424][ T31] [ 509.431749][ T31] ============================================= [ 509.431749][ T31] [ 509.440219][ T31] NMI backtrace for cpu 0 [ 509.440232][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 PREEMPT(full) [ 509.440253][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 509.440263][ T31] Call Trace: [ 509.440269][ T31] [ 509.440276][ T31] dump_stack_lvl+0x116/0x1f0 [ 509.440305][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 509.440326][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 509.440349][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 509.440377][ T31] watchdog+0xf70/0x12c0 [ 509.440402][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.440419][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 509.440445][ T31] ? __kthread_parkme+0x19e/0x250 [ 509.440470][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.440488][ T31] kthread+0x3c2/0x780 [ 509.440503][ T31] ? __pfx_kthread+0x10/0x10 [ 509.440520][ T31] ? rcu_is_watching+0x12/0xc0 [ 509.440541][ T31] ? __pfx_kthread+0x10/0x10 [ 509.440557][ T31] ret_from_fork+0x5d4/0x6f0 [ 509.440581][ T31] ? __pfx_kthread+0x10/0x10 [ 509.440596][ T31] ret_from_fork_asm+0x1a/0x30 [ 509.440626][ T31] [ 509.440631][ T31] Sending NMI from CPU 0 to CPUs 1: [ 509.559272][ C1] NMI backtrace for cpu 1 [ 509.559285][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 PREEMPT(full) [ 509.559303][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 509.559311][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 509.559333][ C1] Code: 6b 72 02 e9 03 fb 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 f0 29 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 509.559347][ C1] RSP: 0018:ffffc90000197df8 EFLAGS: 000002c2 [ 509.559358][ C1] RAX: 0000000001b4b869 RBX: 0000000000000001 RCX: ffffffff8b801c19 [ 509.559367][ C1] RDX: 0000000000000000 RSI: ffffffff8de1a168 RDI: ffffffff8c157aa0 [ 509.559376][ C1] RBP: ffffed1003c56488 R08: 0000000000000001 R09: ffffed10170a6645 [ 509.559385][ C1] R10: ffff8880b853322b R11: 0000000000000001 R12: 0000000000000001 [ 509.559394][ C1] R13: ffff88801e2b2440 R14: ffffffff90a81150 R15: 0000000000000000 [ 509.559402][ C1] FS: 0000000000000000(0000) GS:ffff888124853000(0000) knlGS:0000000000000000 [ 509.559417][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 509.559426][ C1] CR2: 000000110c3f529a CR3: 0000000032ae0000 CR4: 00000000003526f0 [ 509.559434][ C1] DR0: 0000000000000008 DR1: 0000000000000008 DR2: 0000000000000006 [ 509.559442][ C1] DR3: 0000000000000004 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 509.559450][ C1] Call Trace: [ 509.559455][ C1] [ 509.559459][ C1] default_idle+0x13/0x20 [ 509.559471][ C1] default_idle_call+0x6d/0xb0 [ 509.559483][ C1] do_idle+0x391/0x510 [ 509.559501][ C1] ? __pfx_do_idle+0x10/0x10 [ 509.559516][ C1] ? trace_sched_exit_tp+0x31/0x130 [ 509.559537][ C1] cpu_startup_entry+0x4f/0x60 [ 509.559552][ C1] start_secondary+0x21d/0x2b0 [ 509.559569][ C1] ? __pfx_start_secondary+0x10/0x10 [ 509.559587][ C1] common_startup_64+0x13e/0x148 [ 509.559609][ C1] [ 509.560431][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 509.755020][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc2-syzkaller-00378-gb67ec639010f #0 PREEMPT(full) [ 509.766807][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 509.776849][ T31] Call Trace: [ 509.780117][ T31] [ 509.783032][ T31] dump_stack_lvl+0x3d/0x1f0 [ 509.787617][ T31] panic+0x71c/0x800 [ 509.791502][ T31] ? __pfx___irq_work_queue_local+0x10/0x10 [ 509.797381][ T31] ? __pfx_panic+0x10/0x10 [ 509.801786][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 509.807148][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 509.813115][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 509.818474][ T31] ? watchdog+0xdda/0x12c0 [ 509.822873][ T31] ? watchdog+0xdcd/0x12c0 [ 509.827276][ T31] watchdog+0xdeb/0x12c0 [ 509.831506][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.836194][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 509.841387][ T31] ? __kthread_parkme+0x19e/0x250 [ 509.846420][ T31] ? __pfx_watchdog+0x10/0x10 [ 509.851082][ T31] kthread+0x3c2/0x780 [ 509.855133][ T31] ? __pfx_kthread+0x10/0x10 [ 509.859707][ T31] ? rcu_is_watching+0x12/0xc0 [ 509.864456][ T31] ? __pfx_kthread+0x10/0x10 [ 509.869031][ T31] ret_from_fork+0x5d4/0x6f0 [ 509.873611][ T31] ? __pfx_kthread+0x10/0x10 [ 509.878185][ T31] ret_from_fork_asm+0x1a/0x30 [ 509.882948][ T31] [ 509.886177][ T31] Kernel Offset: disabled [ 509.890488][ T31] Rebooting in 86400 seconds..