last executing test programs: 6.572090801s ago: executing program 4 (id=75): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902120008000000000904"], 0x0) syz_clone3(0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000d46420000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r2}, 0x10) ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, &(0x7f0000000000)=0x1) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x9000f4) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 5.356568699s ago: executing program 0 (id=88): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_clone(0x10080000, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) 5.189534645s ago: executing program 3 (id=89): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f}}, 0x50) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x0, 0x0) lsetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@known='security.apparmor\x00', 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) 5.123112178s ago: executing program 3 (id=90): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r5, 0x0) r6 = syz_clone(0x10080000, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) syz_pidfd_open(r6, 0x0) setns(0xffffffffffffffff, 0x10000000) getpgid(0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x0) 4.507379702s ago: executing program 0 (id=94): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r3}, 0x10) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x0, 0x0) tee(r4, r1, 0x8, 0x8) 4.219260334s ago: executing program 3 (id=95): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b7040000000000008500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="0400ffff07"], 0xd) 4.190858255s ago: executing program 3 (id=96): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f00000018010000646c012500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000800000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x0, 0x1, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 4.139986737s ago: executing program 3 (id=97): bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002005207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703e6ffffffffff840000007100000095000000000000008b4dcc5b9feddd0effff700109"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={r1, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000300)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6, &(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x7a, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f00000005c0), &(0x7f0000000600), 0x8, 0x2c, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) r3 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000c00)={{{@in=@rand_addr=0xff, @in=@multicast1, 0x4e21, 0xc000, 0x4e24, 0x0, 0xa, 0xa0, 0x0, 0x11, r2, r3}, {0x1f, 0x1, 0x8, 0x8000000000000001, 0xa77, 0x0, 0x3, 0x6}, {0xffffffffffffffff, 0x1, 0x7, 0x200}, 0x81, 0x6e6bb7, 0x2, 0x1, 0x2, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x36}, 0x4d4, 0xff}, 0xa, @in6=@remote, 0x3505, 0x4, 0x2, 0xb2, 0x10001, 0x0, 0x7f}}, 0xe8) close(r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000004c0)='kmem_cache_free\x00', r1}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000080)=0x454e, 0x4) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x30d4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{}, 0x0, &(0x7f0000000040)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) syz_clone(0x24001100, 0x0, 0x0, 0x0, 0x0, 0x0) 3.981474533s ago: executing program 4 (id=98): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r5, 0x0) syz_clone(0x10080000, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) 3.595632178s ago: executing program 0 (id=99): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) 3.54028409s ago: executing program 1 (id=100): r0 = socket(0x1e, 0x5, 0x0) r1 = epoll_create1(0x0) ppoll(&(0x7f0000003e40)=[{r1, 0x1001}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x179e1f}) 3.54002115s ago: executing program 0 (id=101): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={0xffffffffffffffff, &(0x7f0000000340), 0x0}, 0x20) unshare(0x2040400) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x0, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = fsopen(0x0, 0x0) unshare(0x0) fsmount(r0, 0x0, 0x0) r1 = syz_usb_connect$uac1(0x0, 0x8d, &(0x7f0000000680)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7b, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0x73}, [@feature_unit={0x9, 0x24, 0x6, 0x0, 0x0, 0x1, [0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x23, 0x71, {0x7, 0x25, 0x1, 0x2, 0x40}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x2}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x0, 0x4, 0x0, 0x20, "cd", "03"}]}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x43, 0x3, 0x6, {0x7, 0x25, 0x1, 0x82, 0x2}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x0, 0x1, 0x19, 0x0, 0x20, 0x1}, 0x19, &(0x7f0000000200)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "9bc6652cd78f43cbff127ee631e6c21f"}]}, 0x4, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$uac1(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xe, 0x4, 0x4, 0x20002, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) 3.502513732s ago: executing program 1 (id=102): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffec850000006d000000670000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r1}, 0x10) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400101042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x7800007, 0x12, r2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x14b042, 0x0) pwritev2(r3, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5405, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 3.317245969s ago: executing program 1 (id=103): r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0x505}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000002c0), 0xa79, r2}, 0x38) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000540)=@buf={0x4d, &(0x7f00000004c0)="98085b56c753e1f3bca50d4a1571f5928290778bb2e6ebd4fbb592a43ce6fecddd3cf208db56905c0853a27a89e651f6ccb8a4ddd75f16d64f5526817ed494bf1c9cdc115bc303b90f6058e486"}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0xf, 0x4, 0x4, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r8}, &(0x7f0000000040), &(0x7f0000000140)=r7}, 0x20) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000100)=ANY=[@ANYBLOB="98030000", @ANYRES16=r5, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r6, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c0900005603330080b0c000ffffffffffff080211000001"], 0x398}, 0x1, 0x0, 0x0, 0x5}, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', r9, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0x10, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000001c0)={'veth0\x00', 0x0}) sendto$packet(r10, &(0x7f0000000180)="0b041000e0ff020002004788aa96a13bb1000000000088641100", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r12}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x9a}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_connect$cdc_ncm(0x3, 0x73, &(0x7f0000000580)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x61, 0x2, 0x1, 0x7, 0x10, 0xf, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x81, 0xe07, 0x133, 0x1}, {0x6, 0x24, 0x1a, 0x9e44}, [@call_mgmt={0x5, 0x24, 0x1, 0x2, 0x6}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x8, 0x8, 0xfb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x6, 0x4, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x1, 0xfe, 0x81}}}}}}}]}}, &(0x7f00000008c0)={0xa, &(0x7f0000000600)={0xa, 0x6, 0x200, 0x6, 0xff, 0xed, 0x20}, 0x2b, &(0x7f00000006c0)={0x5, 0xf, 0x2b, 0x3, [@ssp_cap={0x1c, 0x10, 0xa, 0x4, 0x4, 0x6, 0xf000, 0x3, [0xff7e0f, 0x3f00, 0xf, 0xc0]}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x9, 0x8, 0x665}]}, 0x6, [{0x65, &(0x7f0000000700)=@string={0x65, 0x3, "7768ad1d8d91c22a55386243f87bca53b2142af552ae5c6dedd97aa1fdc4fea9ef1ea76102e430a797c13ec1dc39738ad4238d355bd3f3003f7ecaed92a26d1a23c27b9ed84c6d66adf9a79311f33b5c83020ef70ba8eb18f4e4b989df9b8a440cbf12"}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x44f}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x1009}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x2c09}}, {0x1e, &(0x7f0000000840)=@string={0x1e, 0x3, "35c0233220269002d6c409c5555743ea5cd052e9fbbd0204eaaec93a"}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x43f}}]}) 3.092717698s ago: executing program 4 (id=104): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x121002) write$evdev(r0, &(0x7f00000001c0)=[{{}, 0x2}], 0x18) 3.04028659s ago: executing program 4 (id=105): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000c00)="89e7ee2c7cdad9b4b47380c905", 0xd}, {&(0x7f0000000280)="95beaa7f", 0x4}], 0x2) 2.963690853s ago: executing program 4 (id=107): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220f000000837b9765b405f064a8"], 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) 2.188375404s ago: executing program 3 (id=108): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902120008000000000904"], 0x0) syz_clone3(0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000d46420000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r2}, 0x10) ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, &(0x7f0000000000)=0x1) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x9000f4) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.325472388s ago: executing program 1 (id=111): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) fsmount(0xffffffffffffffff, 0x0, 0x71) socket$inet6(0xa, 0x3, 0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0207a20802"], 0x10}}, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000080)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x4e21, 0x0, 0x2}, {0x400, 0x9, 0x0, 0xffffffffffffffff}, {0x0, 0x4}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@loopback, 0x4d5, 0x32}, 0x0, @in6=@mcast1, 0x0, 0x0, 0x0, 0xb7}}, 0xe8) sendmmsg(r1, &(0x7f0000000180), 0x400000000000077, 0x0) 1.187095693s ago: executing program 2 (id=113): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.140327445s ago: executing program 2 (id=114): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x121002) write$evdev(r0, &(0x7f00000001c0)=[{{}, 0x2, 0xf}], 0x18) 1.140144695s ago: executing program 2 (id=115): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r5, 0x0) syz_clone(0x10080000, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) 745.17137ms ago: executing program 4 (id=116): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000d00)={0x44, &(0x7f0000000300)=ANY=[@ANYBLOB="000001000000aa"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f00000001c0), 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 525.499379ms ago: executing program 0 (id=117): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 468.140611ms ago: executing program 0 (id=118): bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002005207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703e6ffffffffff840000007100000095000000000000008b4dcc5b9feddd0effff700109"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={r1, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000300)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6, &(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x7a, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f00000005c0), &(0x7f0000000600), 0x8, 0x2c, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) r3 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000c00)={{{@in=@rand_addr=0xff, @in=@multicast1, 0x4e21, 0xc000, 0x4e24, 0x0, 0xa, 0xa0, 0x0, 0x11, r2, r3}, {0x1f, 0x1, 0x8, 0x8000000000000001, 0xa77, 0x0, 0x3, 0x6}, {0xffffffffffffffff, 0x1, 0x7, 0x200}, 0x81, 0x6e6bb7, 0x2, 0x1, 0x2, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x36}, 0x4d4, 0xff}, 0xa, @in6=@remote, 0x3505, 0x4, 0x2, 0xb2, 0x10001, 0x0, 0x7f}}, 0xe8) close(r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000004c0)='kmem_cache_free\x00', r1}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000080)=0x454e, 0x4) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x30d4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{}, 0x0, &(0x7f0000000040)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) syz_clone(0x24001100, 0x0, 0x0, 0x0, 0x0, 0x0) 438.541092ms ago: executing program 1 (id=119): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000c00)="89e7ee2c7cdad9b4b47380", 0xb}, {&(0x7f0000000280)="95beaa7f", 0x4}], 0x2) 363.739875ms ago: executing program 1 (id=120): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r5, 0x0) r6 = syz_clone(0x10080000, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) syz_pidfd_open(r6, 0x0) setns(0xffffffffffffffff, 0x10000000) getpgid(0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x0) 275.677718ms ago: executing program 2 (id=121): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000c00)="89e7ee2c7cdad9b4b47380c90500", 0xe}, {&(0x7f0000000280)="95beaa7f", 0x4}], 0x2) 279.09µs ago: executing program 2 (id=122): ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x40085503, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001800350f0000000000000000060000003ef9af912cb78f22543fe13af1ece0291069cda7aad21fd1d2c854b713357b21608de20126f33a307f8030ad6f927243ac8268739be4"], 0x14}}, 0x0) 0s ago: executing program 2 (id=123): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x200400, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000009007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x4033d7aec3e79acc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000100)) timer_create(0x5, &(0x7f0000000280)={0x0, 0x25, 0x1, @thr={&(0x7f0000000000)="59ba64448c984b6c025555a8462774615df265f12c57a9b4bad27dc605f48fbb5f431aec126da0d4810141896c6027794f5b50f760e8b5ad04b38ad9cf0bb647e831b46f7ccc19d0cdda00da675b984853ac00f18520aaf7f6bf36d1b17f920385ac", &(0x7f0000000780)="e5cc0bb1ff872aa2e8574f82e4b719083f39b7075cef3902175c10578b396d160c38c712ddddeb05c85bae34856c8f984954b1098b42c14f382e11f74beb040bf8dda0944aa0db5209dd8fa47dc3b4dca4a192edcda438c06683a7d0adadc433c26e44e0befcd5160158bd6d42a4dff38c186de5b2442a00bb52d0e96b712d8ecd8298f8e96869086d62ef0275a68a135635762e375a3d5cb35de2e2f7f3b9c39f9d2816a1c9ebdbd1c4daf65143cdcaea75f937a8b942254522bed989be41405be0d9f90b407499cee68d04edcdb494fabeb8db211846c2f47f9727fc015fbf41a5d49c62d038136979cf6fc76b53cccd8391c47e"}}, &(0x7f0000000540)) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r6, &(0x7f00000000c0)={0x20002000}) epoll_wait(r5, &(0x7f00000011c0)=[{}], 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = socket$packet(0x11, 0x2, 0x300) close(r7) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.140' (ED25519) to the list of known hosts. [ 22.864656][ T23] audit: type=1400 audit(1719878155.539:66): avc: denied { mounton } for pid=343 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.866139][ T343] cgroup1: Unknown subsys name 'net' [ 22.887170][ T23] audit: type=1400 audit(1719878155.539:67): avc: denied { mount } for pid=343 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.893549][ T343] cgroup1: Unknown subsys name 'net_prio' [ 22.919936][ T343] cgroup1: Unknown subsys name 'devices' [ 22.926137][ T23] audit: type=1400 audit(1719878155.609:68): avc: denied { unmount } for pid=343 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.060731][ T343] cgroup1: Unknown subsys name 'hugetlb' [ 23.066446][ T343] cgroup1: Unknown subsys name 'rlimit' [ 23.229155][ T23] audit: type=1400 audit(1719878155.909:69): avc: denied { setattr } for pid=343 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=9239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.250307][ T345] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.252214][ T23] audit: type=1400 audit(1719878155.909:70): avc: denied { mounton } for pid=343 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.285108][ T23] audit: type=1400 audit(1719878155.909:71): avc: denied { mount } for pid=343 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.308010][ T23] audit: type=1400 audit(1719878155.949:72): avc: denied { relabelto } for pid=345 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.333161][ T23] audit: type=1400 audit(1719878155.949:73): avc: denied { write } for pid=345 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.333196][ T343] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.358498][ T23] audit: type=1400 audit(1719878155.989:74): avc: denied { read } for pid=343 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.358514][ T23] audit: type=1400 audit(1719878155.989:75): avc: denied { open } for pid=343 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.695785][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.702965][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.710398][ T353] device bridge_slave_0 entered promiscuous mode [ 23.724872][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.731916][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.739177][ T353] device bridge_slave_1 entered promiscuous mode [ 23.792796][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.799706][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.806818][ T356] device bridge_slave_0 entered promiscuous mode [ 23.830639][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.837474][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.844826][ T356] device bridge_slave_1 entered promiscuous mode [ 23.859087][ T354] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.865921][ T354] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.873253][ T354] device bridge_slave_0 entered promiscuous mode [ 23.883406][ T354] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.890326][ T354] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.897618][ T354] device bridge_slave_1 entered promiscuous mode [ 23.926842][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.933731][ T355] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.941114][ T355] device bridge_slave_0 entered promiscuous mode [ 23.947568][ T352] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.954432][ T352] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.961766][ T352] device bridge_slave_0 entered promiscuous mode [ 23.972119][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.979061][ T355] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.986140][ T355] device bridge_slave_1 entered promiscuous mode [ 24.000130][ T352] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.006968][ T352] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.014336][ T352] device bridge_slave_1 entered promiscuous mode [ 24.202024][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.208881][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.218577][ T354] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.225404][ T354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.232556][ T354] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.239307][ T354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.269131][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.275964][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.283116][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.289867][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.306012][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.312866][ T355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.319992][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.326736][ T355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.343928][ T352] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.350783][ T352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.357916][ T352] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.364653][ T352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.406732][ T107] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.414782][ T107] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.422004][ T107] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.429165][ T107] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.436110][ T107] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.443038][ T107] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.450020][ T107] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.456931][ T107] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.464014][ T107] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.471573][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.478871][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.497884][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.505600][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.513801][ T357] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.520633][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.527774][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.535864][ T357] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.542703][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.578613][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.586733][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.595043][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.603779][ T107] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.610629][ T107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.618106][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.626027][ T107] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.632862][ T107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.640029][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.647739][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.658266][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.681482][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.688748][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.696663][ T107] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.703505][ T107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.710836][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.720042][ T107] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.726853][ T107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.734114][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.742219][ T107] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.749057][ T107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.756416][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.764505][ T107] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.771328][ T107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.778572][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.800833][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.809594][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.817697][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.826958][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.835064][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.843118][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.851100][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.859033][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.866866][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.875254][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.883302][ T107] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.890146][ T107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.897579][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.905760][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.939283][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.947195][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.955446][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.963639][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.971610][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.979833][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.987749][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.994583][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.002036][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.010402][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.020984][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.029059][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.057194][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.065685][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.074169][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.082976][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.091318][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.099136][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.106754][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.115697][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.123969][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.131790][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.148968][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.156992][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.173454][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.181559][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.189515][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.197619][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.208205][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.216222][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.239480][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.247505][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.256167][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.265110][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.273408][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.281644][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.289970][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.298189][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.346803][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.357684][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.366765][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.374938][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.382951][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.391177][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.399420][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.407495][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.415703][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.423792][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.432115][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.440152][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.448311][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.456255][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.495716][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.508252][ T387] [ 25.510433][ T387] ********************************************************** [ 25.518608][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.519339][ T378] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 25.530497][ T387] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** [ 25.549219][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.559029][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.566987][ T378] EXT4-fs error (device loop0): __ext4_new_inode:926: comm syz.0.1: reserved inode found cleared - inode=1 [ 25.568469][ T387] ** ** [ 25.593146][ T387] ** trace_printk() being used. Allocating extra memory. ** [ 25.598858][ T390] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 25.609535][ T374] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.624704][ T374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.645337][ T390] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 25.658292][ T387] ** ** [ 25.665756][ T387] ** This means that this is a DEBUG kernel and it is ** [ 25.693760][ T387] ** unsafe for production use. ** [ 25.713525][ T387] ** ** [ 25.726385][ T9] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 25.730583][ T387] ** If you see this message and you are not debugging ** [ 25.746042][ T387] ** the kernel, report this immediately to your vendor! ** [ 25.753739][ T387] ** ** [ 25.761560][ T387] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** [ 25.769158][ T387] ********************************************************** [ 25.860507][ T402] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.879883][ T403] netlink: 72 bytes leftover after parsing attributes in process `syz.0.8'. [ 25.988790][ T397] ====================================================== [ 25.988790][ T397] WARNING: the mand mount option is being deprecated and [ 25.988790][ T397] will be removed in v5.15! [ 25.988790][ T397] ====================================================== [ 26.085859][ T397] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.144315][ T413] syz.0.12 (413) used greatest stack depth: 21304 bytes left [ 26.175121][ T397] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 26.215778][ T355] attempt to access beyond end of device [ 26.215778][ T355] loop4: rw=2049, want=45104, limit=40427 [ 26.222435][ T429] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 26.242135][ T429] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 26.292401][ T431] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 26.359147][ T433] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19'. [ 26.598700][ T453] request_module fs-cramfs succeeded, but still no fs? [ 26.677426][ T458] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 26.692465][ T458] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 26.718528][ T431] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 27.012009][ T473] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 27.032719][ T473] EXT4-fs (loop4): Test dummy encryption mode enabled [ 27.039466][ T473] EXT4-fs (loop4): can't mount with dioread_nolock if block size != PAGE_SIZE [ 27.079918][ T124] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 27.143434][ T488] kernel profiling enabled (shift: 0) [ 27.204076][ T473] FAT-fs (loop4): Directory bread(block 64) failed [ 27.210469][ T473] FAT-fs (loop4): Directory bread(block 65) failed [ 27.216797][ T473] FAT-fs (loop4): Directory bread(block 66) failed [ 27.223275][ T473] FAT-fs (loop4): Directory bread(block 67) failed [ 27.229726][ T473] FAT-fs (loop4): Directory bread(block 68) failed [ 27.235967][ T473] FAT-fs (loop4): Directory bread(block 69) failed [ 27.242522][ T473] FAT-fs (loop4): Directory bread(block 70) failed [ 27.248884][ T473] FAT-fs (loop4): Directory bread(block 71) failed [ 27.255212][ T473] FAT-fs (loop4): Directory bread(block 72) failed [ 27.261832][ T473] FAT-fs (loop4): Directory bread(block 73) failed [ 27.868741][ T124] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.883955][ T23] kauditd_printk_skb: 67 callbacks suppressed [ 27.883963][ T23] audit: type=1400 audit(1719878160.559:143): avc: denied { write } for pid=495 comm="syz.3.44" name="001" dev="devtmpfs" ino=9238 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 27.957020][ T504] Zero length message leads to an empty skb [ 27.957816][ T124] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 27.974630][ T179] attempt to access beyond end of device [ 27.974630][ T179] loop4: rw=1, want=1256, limit=256 [ 27.990814][ T179] attempt to access beyond end of device [ 27.990814][ T179] loop4: rw=1, want=1832, limit=256 [ 28.001511][ T124] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 is Bulk; changing to Interrupt [ 28.048739][ T179] attempt to access beyond end of device [ 28.048739][ T179] loop4: rw=1, want=29472, limit=256 [ 28.071957][ T124] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 28.081393][ T124] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.096517][ T179] attempt to access beyond end of device [ 28.096517][ T179] loop4: rw=1, want=33800, limit=256 [ 28.117931][ T469] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 28.140514][ T124] hub 1-1:1.0: bad descriptor, ignoring hub [ 28.166142][ T124] hub: probe of 1-1:1.0 failed with error -5 [ 28.233714][ T124] cdc_wdm 1-1:1.0: skipping garbage [ 28.259128][ T124] cdc_wdm 1-1:1.0: skipping garbage [ 28.322130][ T124] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 28.416655][ T23] audit: type=1400 audit(1719878161.089:144): avc: denied { mount } for pid=520 comm="syz.2.54" name="/" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.456876][ T23] audit: type=1400 audit(1719878161.129:145): avc: denied { unmount } for pid=356 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.497889][ T525] SELinux: Context system_u: is not valid (left unmapped). [ 28.514412][ T23] audit: type=1400 audit(1719878161.179:146): avc: denied { relabelfrom } for pid=524 comm="syz.1.56" name="" dev="pipefs" ino=11879 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 28.551510][ T23] audit: type=1400 audit(1719878161.179:147): avc: denied { bind } for pid=528 comm="syz.4.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.571707][ T23] audit: type=1400 audit(1719878161.189:148): avc: denied { read } for pid=530 comm="syz.4.57" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.664719][ T124] usb 1-1: USB disconnect, device number 2 [ 28.674116][ T23] audit: type=1400 audit(1719878161.189:149): avc: denied { relabelto } for pid=524 comm="syz.1.56" name="" dev="pipefs" ino=11879 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:" [ 28.805697][ T23] audit: type=1400 audit(1719878161.449:150): avc: denied { block_suspend } for pid=532 comm="syz.4.58" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 29.007962][ T393] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.020955][ T554] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 29.100518][ T23] audit: type=1400 audit(1719878161.779:151): avc: denied { create } for pid=557 comm="syz.3.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.121992][ T23] audit: type=1400 audit(1719878161.809:152): avc: denied { getopt } for pid=557 comm="syz.3.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.142848][ T558] syz.3.68 (558) used greatest stack depth: 20600 bytes left [ 29.247859][ T393] usb 3-1: Using ep0 maxpacket: 8 [ 29.598037][ T393] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 29.606991][ T393] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.619025][ T393] usb 3-1: config 0 descriptor?? [ 29.987921][ T5] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 30.036471][ T591] usb usb8: usbfs: process 591 (syz.3.80) did not claim interface 0 before use [ 30.237888][ T5] usb 5-1: Using ep0 maxpacket: 16 [ 30.248161][ T393] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 30.259732][ T393] asix 3-1:0.0 (unnamed net_device) (uninitialized): Error reading PHYID register: ffffffe0 [ 30.703806][ T5] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 30.867987][ T5] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 30.877031][ T5] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.885210][ T5] usb 5-1: Product: syz [ 30.889652][ T5] usb 5-1: Manufacturer: syz [ 30.903991][ T5] usb 5-1: SerialNumber: syz [ 30.910429][ T5] usb 5-1: config 0 descriptor?? [ 30.949104][ T5] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 30.957303][ T5] usb 5-1: Detected FT232RL [ 31.360423][ T5] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 31.617971][ T5] ftdi_sio 5-1:0.0: GPIO initialisation failed: -71 [ 31.631851][ T5] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 31.648491][ T5] usb 5-1: USB disconnect, device number 2 [ 31.659383][ T5] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 31.738761][ T5] ftdi_sio 5-1:0.0: device disconnected [ 32.277878][ T357] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.538257][ T393] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 32.548587][ T393] asix: probe of 3-1:0.0 failed with error -71 [ 32.555456][ T393] usb 3-1: USB disconnect, device number 2 [ 32.753155][ T357] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.764625][ T357] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.774395][ T357] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 32.790833][ T357] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.803759][ T357] usb 4-1: config 0 descriptor?? [ 32.811940][ T664] binder: 663:664 ioctl 8912 20000540 returned -22 [ 32.818726][ T664] netlink: 4 bytes leftover after parsing attributes in process `syz.1.103'. [ 32.828073][ T496] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 33.093902][ T496] usb 1-1: Using ep0 maxpacket: 16 [ 33.111033][ T393] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.364965][ T496] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 33.373601][ T496] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.383523][ T496] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.384282][ T23] kauditd_printk_skb: 9 callbacks suppressed [ 33.384291][ T23] audit: type=1400 audit(1719878166.069:162): avc: denied { append } for pid=144 comm="syslogd" name="messages" dev="tmpfs" ino=909 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.420711][ T23] audit: type=1400 audit(1719878166.069:163): avc: denied { open } for pid=144 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=909 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.443330][ T357] usbhid 4-1:0.0: can't add hid device: -71 [ 33.449114][ T23] audit: type=1400 audit(1719878166.069:164): avc: denied { getattr } for pid=144 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=909 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.449221][ T357] usbhid: probe of 4-1:0.0 failed with error -71 [ 33.471778][ T393] usb 2-1: Using ep0 maxpacket: 8 [ 33.478070][ T639] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 33.491189][ T357] usb 4-1: USB disconnect, device number 2 [ 33.657949][ T496] usb 1-1: string descriptor 0 read error: -22 [ 33.663989][ T496] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 33.672971][ T496] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.688086][ T393] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 33.697735][ T393] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 33.707207][ T393] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 33.718778][ T496] usb 1-1: 0:2 : does not exist [ 33.858046][ T639] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.868796][ T639] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.877959][ T393] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.878296][ T639] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 33.898876][ T393] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.907711][ T393] usb 2-1: Product: ဉ [ 33.911899][ T393] usb 2-1: Manufacturer: я [ 33.918449][ T639] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 33.927352][ T639] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.936019][ T639] usb 5-1: config 0 descriptor?? [ 33.956768][ T393] usb 2-1: SerialNumber: Ⰹ [ 34.248082][ T496] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 34.337961][ T393] cdc_ncm 2-1:1.0: bind() failure [ 34.343660][ T393] cdc_ncm 2-1:1.1: bind() failure [ 34.350026][ T393] usb 2-1: USB disconnect, device number 2 [ 34.419370][ T639] plantronics 0003:047F:FFFF.0001: bogus close delimiter [ 34.426216][ T639] plantronics 0003:047F:FFFF.0001: item 0 0 2 10 parsing failed [ 34.433953][ T639] plantronics 0003:047F:FFFF.0001: parse failed [ 34.440151][ T639] plantronics: probe of 0003:047F:FFFF.0001 failed with error -22 [ 34.487884][ T496] usb 4-1: Using ep0 maxpacket: 16 [ 34.607929][ T496] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 34.621765][ T639] usb 5-1: USB disconnect, device number 3 [ 34.767959][ T496] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 34.776881][ T496] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.785114][ T496] usb 4-1: Product: syz [ 34.785855][ T23] audit: type=1400 audit(1719878167.469:165): avc: denied { bind } for pid=688 comm="syz.1.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.789348][ T496] usb 4-1: Manufacturer: syz [ 34.813066][ T496] usb 4-1: SerialNumber: syz [ 34.818948][ T496] usb 4-1: config 0 descriptor?? [ 34.898728][ T496] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 34.906617][ T496] usb 4-1: Detected FT232RL [ 35.016100][ T23] audit: type=1400 audit(1719878167.669:166): avc: denied { write } for pid=688 comm="syz.1.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.277947][ T496] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 35.537908][ T496] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 35.544992][ T496] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 35.554361][ T496] usb 4-1: USB disconnect, device number 3 [ 35.560810][ T496] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 35.568066][ T393] usb 1-1: USB disconnect, device number 3 [ 35.570465][ T496] ftdi_sio 4-1:0.0: device disconnected [ 35.665069][ T375] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 36.011235][ T375] usb 5-1: Using ep0 maxpacket: 8 [ 36.147983][ T375] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 36.156874][ T375] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.165800][ T375] usb 5-1: config 0 descriptor?? [ 36.212759][ T393] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.367823][ C1] ================================================================== [ 36.375734][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 [ 36.382663][ C1] Read of size 8 at addr ffff8881e06df640 by task syz.2.123/747 [ 36.390106][ C1] [ 36.392280][ C1] CPU: 1 PID: 747 Comm: syz.2.123 Not tainted 5.4.276-syzkaller-00021-g58de09405d1e #0 [ 36.401841][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 36.411731][ C1] Call Trace: [ 36.414856][ C1] [ 36.417554][ C1] dump_stack+0x1d8/0x241 [ 36.421721][ C1] ? debug_smp_processor_id+0x20/0x20 [ 36.426926][ C1] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 36.432574][ C1] ? printk+0xd1/0x111 [ 36.436473][ C1] ? profile_pc+0xa4/0xe0 [ 36.440647][ C1] ? wake_up_klogd+0xb2/0xf0 [ 36.445068][ C1] ? profile_pc+0xa4/0xe0 [ 36.449234][ C1] print_address_description+0x8c/0x600 [ 36.454614][ C1] ? panic+0x89d/0x89d [ 36.458521][ C1] ? profile_pc+0xa4/0xe0 [ 36.462682][ C1] __kasan_report+0xf3/0x120 [ 36.467110][ C1] ? profile_pc+0xa4/0xe0 [ 36.471276][ C1] ? _raw_spin_lock+0xc0/0x1b0 [ 36.475876][ C1] kasan_report+0x30/0x60 [ 36.480065][ C1] profile_pc+0xa4/0xe0 [ 36.484033][ C1] profile_tick+0xb9/0x100 [ 36.488288][ C1] tick_sched_timer+0x237/0x3c0 [ 36.492975][ C1] ? tick_setup_sched_timer+0x460/0x460 [ 36.498358][ C1] __hrtimer_run_queues+0x3e9/0xb90 [ 36.503396][ C1] ? hrtimer_interrupt+0x890/0x890 [ 36.508335][ C1] ? cpumask_next+0xc/0x20 [ 36.512596][ C1] ? ktime_get+0xf9/0x130 [ 36.516769][ C1] ? ktime_get_update_offsets_now+0x26c/0x280 [ 36.522662][ C1] hrtimer_interrupt+0x38a/0x890 [ 36.527436][ C1] smp_apic_timer_interrupt+0x110/0x460 [ 36.532815][ C1] apic_timer_interrupt+0xf/0x20 [ 36.537583][ C1] [ 36.540375][ C1] RIP: 0010:_raw_spin_lock+0xc0/0x1b0 [ 36.545584][ C1] Code: fd 4c 89 ff be 04 00 00 00 e8 2c dc 42 fd 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 f0 41 0f b1 4d 00 <75> 33 48 c7 04 24 0e 36 e0 45 49 c7 04 1c 00 00 00 00 65 48 8b 04 [ 36.565017][ C1] RSP: 0000:ffff8881e06df640 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 36.573256][ C1] RAX: 0000000000000000 RBX: 1ffff1103c0dbec8 RCX: 0000000000000001 [ 36.581066][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8881e06df660 [ 36.588877][ C1] RBP: ffff8881e06df6d0 R08: dffffc0000000000 R09: 0000000000000003 [ 36.596688][ C1] R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000 [ 36.604500][ C1] R13: ffff8881e4b3e1c0 R14: 1ffff1103c0dbecc R15: ffff8881e06df660 [ 36.612327][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 36.617526][ C1] unix_dgram_sendmsg+0xd81/0x1ff0 [ 36.622476][ C1] ? unix_dgram_poll+0x670/0x670 [ 36.627252][ C1] ? security_socket_sendmsg+0x7d/0xa0 [ 36.632536][ C1] ? unix_dgram_poll+0x670/0x670 [ 36.637312][ C1] ____sys_sendmsg+0x5ac/0x8f0 [ 36.641913][ C1] ? __sys_sendmsg_sock+0x2b0/0x2b0 [ 36.646946][ C1] ? __sys_sendmmsg+0x3e6/0x700 [ 36.651633][ C1] __sys_sendmmsg+0x3c3/0x700 [ 36.656158][ C1] ? __ia32_sys_sendmsg+0x90/0x90 [ 36.661013][ C1] ? __wake_up+0x120/0x1c0 [ 36.665286][ C1] ? remove_wait_queue+0x120/0x120 [ 36.670208][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 36.675415][ C1] ? __fget+0x407/0x490 [ 36.679407][ C1] ? futex_exit_release+0x1e0/0x1e0 [ 36.684441][ C1] ? unix_dgram_connect+0xaec/0xcd0 [ 36.689491][ C1] ? fput_many+0x15e/0x1b0 [ 36.693727][ C1] ? check_preemption_disabled+0x153/0x320 [ 36.699373][ C1] ? switch_fpu_return+0x1d4/0x410 [ 36.704330][ C1] ? fpu__clear+0x3c0/0x3c0 [ 36.708664][ C1] __x64_sys_sendmmsg+0x9c/0xb0 [ 36.713353][ C1] do_syscall_64+0xca/0x1c0 [ 36.717686][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 36.723411][ C1] RIP: 0033:0x7f33a7772b99 [ 36.727664][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 36.747104][ C1] RSP: 002b:00007f33a69f4048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 36.755354][ C1] RAX: ffffffffffffffda RBX: 00007f33a7900fa0 RCX: 00007f33a7772b99 [ 36.763173][ C1] RDX: 0000000000000651 RSI: 0000000020000000 RDI: 0000000000000007 [ 36.770976][ C1] RBP: 00007f33a77f377e R08: 0000000000000000 R09: 0000000000000000 [ 36.778783][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.786594][ C1] R13: 000000000000000b R14: 00007f33a7900fa0 R15: 00007ffe65071e78 [ 36.794423][ C1] [ 36.796573][ C1] The buggy address belongs to the page: [ 36.802061][ C1] page:ffffea000781b7c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 36.810995][ C1] flags: 0x8000000000000000() [ 36.815501][ C1] raw: 8000000000000000 0000000000000000 ffffea000781b7c8 0000000000000000 [ 36.823919][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 36.832420][ C1] page dumped because: kasan: bad access detected [ 36.838684][ C1] page_owner tracks the page as allocated [ 36.844227][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT) [ 36.855779][ C1] prep_new_page+0x18f/0x370 [ 36.860201][ C1] get_page_from_freelist+0x2d13/0x2d90 [ 36.865580][ C1] __alloc_pages_nodemask+0x393/0x840 [ 36.870788][ C1] dup_task_struct+0x85/0x600 [ 36.875300][ C1] copy_process+0x56d/0x3230 [ 36.879725][ C1] _do_fork+0x197/0x900 [ 36.883717][ C1] __x64_sys_clone3+0x2da/0x300 [ 36.888407][ C1] do_syscall_64+0xca/0x1c0 [ 36.892746][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 36.898468][ C1] page last free stack trace: [ 36.902986][ C1] __free_pages_ok+0x847/0x950 [ 36.907590][ C1] __free_pages+0x91/0x140 [ 36.911839][ C1] __free_slab+0x221/0x2e0 [ 36.916092][ C1] unfreeze_partials+0x14e/0x180 [ 36.920866][ C1] put_cpu_partial+0x44/0x180 [ 36.925381][ C1] __slab_free+0x297/0x360 [ 36.929633][ C1] qlist_free_all+0x43/0xb0 [ 36.933976][ C1] quarantine_reduce+0x1d9/0x210 [ 36.938745][ C1] __kasan_kmalloc+0x41/0x210 [ 36.943259][ C1] __kmalloc+0x105/0x2e0 [ 36.947338][ C1] kvmalloc_node+0x7e/0xf0 [ 36.951594][ C1] seq_read+0x23c/0xe60 [ 36.955583][ C1] __vfs_read+0x103/0x730 [ 36.959778][ C1] vfs_read+0x148/0x360 [ 36.963742][ C1] ksys_read+0x199/0x2c0 [ 36.967825][ C1] do_syscall_64+0xca/0x1c0 [ 36.972162][ C1] [ 36.974331][ C1] addr ffff8881e06df640 is located in stack of task syz.2.123/747 at offset 0 in frame: [ 36.983878][ C1] _raw_spin_lock+0x0/0x1b0 [ 36.988216][ C1] [ 36.990384][ C1] this frame has 1 object: [ 36.994637][ C1] [32, 36) 'val.i.i.i' [ 36.994639][ C1] [ 37.000800][ C1] Memory state around the buggy address: [ 37.006272][ C1] ffff8881e06df500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.014171][ C1] ffff8881e06df580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.022068][ C1] >ffff8881e06df600: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 [ 37.029961][ C1] ^ [ 37.035954][ C1] ffff8881e06df680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.043852][ C1] ffff8881e06df700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.051747][ C1] ================================================================== [ 37.059647][ C1] Disabling lock debugging due to kernel taint [ 37.197968][ T393] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.208675][ T393] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.218228][ T393] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 37.227028][ T393] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.235556][ T393] usb 1-1: config 0 descriptor?? [ 37.357954][ T375] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 37.367679][ T375] asix 5-1:0.0 (unnamed net_device) (uninitialized): Error reading PHYID register: ffffffe0 [ 37.787944][ T393] usbhid 1-1:0.0: can't add hid device: -71 [ 37.793698][ T393] usbhid: probe of 1-1:0.0 failed with error -71 [ 37.800940][ T393] usb 1-1: USB disconnect, device number 4 [ 39.417975][ T375] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 39.428078][ T375] asix: probe of 5-1:0.0 failed with error -71 [ 39.434798][ T375] usb 5-1: USB disconnect, device number 4