last executing test programs: 16.865552346s ago: executing program 0 (id=58): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000080)="da", 0x1}], 0x1, &(0x7f0000000040)=ANY=[], 0xd0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)="b8", 0x1}], 0x1}}], 0x2, 0x0) close(r2) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="2503feffffff0000000016000000"], 0x28}}, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCSIG(0xffffffffffffffff, 0x40045436, 0x3) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCGETS2(r7, 0x802c542a, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCGETSGCNT(r3, 0x89e1, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x40, 0x0}, @rand_addr=0x64010101}) 13.08782759s ago: executing program 2 (id=68): capset(&(0x7f00000004c0)={0x20080522}, &(0x7f0000000500)={0x0, 0x2000, 0x0, 0x0, 0x0, 0x3cd}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000004500000002"], 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file5\x00', 0x61c0, 0x700) symlinkat(&(0x7f00000001c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file6\x00') r0 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff, 0x0, 0x1}, 0x18, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) landlock_restrict_self(r0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file3\x00', 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file2\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) unlinkat(0xffffffffffffff9c, &(0x7f00000003c0)='./file2\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./file7\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000640)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000740)='./file7\x00', 0xc1c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file3\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000800)='./file3\x00', 0xffffffffffffff9c, &(0x7f0000000840)='./file7\x00', 0x0) 12.978959558s ago: executing program 0 (id=69): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0x0, 0x3, 0x1, 0x4}, 'syz0\x00', 0x10}) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0xee) ioctl$UI_DEV_CREATE(r0, 0x5501) 12.706483491s ago: executing program 4 (id=70): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0x1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r5 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r5, &(0x7f0000002940), 0x40000000000017d, 0x811) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r6 = accept4(r0, 0x0, 0x0, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001380), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f40)={0x3c, r7, 0x1, 0x70bd27, 0x0, {}, [@NL802154_ATTR_SEC_DEVKEY={0x1c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x3c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r6) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0xfffffffc, {}, [@NHA_FDB={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8000000) 12.078199405s ago: executing program 0 (id=71): r0 = memfd_create(&(0x7f0000000880)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\a\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xd5(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\xb5/\x9a\xf3\xb7-S\x1d\xb8F\x81\xd6&\xc00xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x80, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x87}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$tipc(r7, 0x0, 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r8, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r8, 0x12, 0xca, &(0x7f00000000c0)={0x8, 0x1, 0x0, 0x0, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) 9.184911264s ago: executing program 4 (id=73): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000006000/0x4000)=nil) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x9}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() connect$pppoe(r2, &(0x7f0000000300)={0x18, 0x0, {0x3, @broadcast, 'veth0_to_batadv\x00'}}, 0x1e) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00000f2000/0x3000)=nil, 0x3000, 0xb635773f06ebbeee, 0x10, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f0000000400)) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r4, 0x6, &(0x7f0000000440)=0x7fffffff) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) write(r2, &(0x7f0000000040)="240000001e005f0214ffff0600fffff8070000000000000000000100080003000b000000", 0x24) read$FUSE(r1, &(0x7f0000004180)={0x2020}, 0x2020) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000290cf0000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x14) sendmsg$NFNL_MSG_CTHELPER_DEL(r7, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="700100000209010100000000000000000a00000a08000340000000ff5c00020006000340000400000c00028005000100010000001400018008000100ac1414bb08000200ac1e00010c00028005000100110000000c000280050001001b0000000c000280050001003a0000000c00028005000100740000000900010073797a30000000000c00048008000140000000050c00020006000340800100000c0004800800014000000008c800020014000180080001000000000008000200ac1e010106000340000100002c00018014000300fc01000000000000000000000000000014000400200100000000000000000000000000000c00028005000100210000000c00028005000100210000000c000280050001003a0000000c00028005000100210000002c00018014000300fc02000000000000000000000000000114000400fe8000000000000000000000000000bb0c00028005000100060000001400018008000100ac1e000108000200e0000001949f75afc05138c8d000e2467e52a3286c7124a77b74fbc64a7db2e98aea3a78d2c667c41ab7c1c28ce60bbbf93bafc219ff07e8805322e6c5a6dc7429fcfaad0612082bc811cf5b0b4bc733d2a9ce982f231def"], 0x170}, 0x1, 0x0, 0x0, 0x20000004}, 0x4080004) socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872061ce618117c56f0979bd10b97163c953ab1abda4589e9cbe8d0d26b5069f8a98f7dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346d2014006000000e1ffff8816326d7d35c32aac1c7d5b5be399f6609876b5887437a172751151b633fbc02a74067529194e533583412dff048f0000000000000000b2728a04816cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13ceec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad30000000000170022626165866c156a25148972700000b515a1000000000000000eb2e9c15b6c8f6198282d0000000000c2ccf3f69cfcf1e15ea7a9e57aee78e1"], &(0x7f0000000340)='GPL\x00'}, 0x94) open(0x0, 0x48062, 0x0) 8.991903723s ago: executing program 0 (id=74): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x2}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ECN={0x8, 0x6, 0x1}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x51}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000080050005000200000011000300686173683a69702c706f7274"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x0, 0x0, &(0x7f00000002c0)='GPL\x00', 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r0) sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x194, r5, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xa}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xd425}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x800}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x401}]}, @TIPC_NLA_NODE={0x30, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x63b3}, @TIPC_NLA_NODE_ID={0x1e, 0x3, "7c7e8b225d88103cff0380f0db226e38b356df691db30485966e"}, @TIPC_NLA_NODE_ID={0x4}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1ff}]}, @TIPC_NLA_BEARER={0xe0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x315}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffff7f}]}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'ib', 0x3a, 'veth1_macvtap\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xb8e1}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0xde5, @local, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x13, @dev={0xfe, 0x80, '\x00', 0x15}, 0x2}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4011}, 0x4) 8.830687761s ago: executing program 3 (id=75): sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000a0}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x8884) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$inet6(0xa, 0x800, 0xfffffe00) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @ioapic={0xf000, 0x9, 0x200, 0x1, 0x0, [{0x6, 0x5, 0x0, '\x00', 0x5}, {0xff, 0xf6, 0x1, '\x00', 0x5}, {0x2, 0x3, 0x81, '\x00', 0xff}, {0x9, 0x5, 0x6, '\x00', 0x2}, {0x93, 0xff, 0x25, '\x00', 0xe0}, {0x15, 0x5, 0x5, '\x00', 0xfb}, {0x81, 0x7, 0x4, '\x00', 0xbc}, {0xfb, 0x44, 0xa5, '\x00', 0x2}, {0x4, 0x8, 0x6, '\x00', 0x2}, {0x5c, 0x3, 0xb, '\x00', 0x4}, {0xaf, 0x41, 0x90, '\x00', 0xa}, {0x5, 0x3, 0x7}, {0x7, 0xfb, 0x5, '\x00', 0x40}, {0x0, 0xa, 0x6, '\x00', 0xc6}, {0x7, 0xa, 0x3, '\x00', 0x5}, {0x40, 0x5, 0x42}, {0x0, 0x0, 0x8, '\x00', 0x83}, {0xff, 0x3, 0x70, '\x00', 0x8}, {0x9, 0x3, 0xfd, '\x00', 0x6}, {0xcf, 0xd, 0x1, '\x00', 0xf7}, {0x9, 0x7, 0x9, '\x00', 0x83}, {0x2, 0x5, 0x8, '\x00', 0xf1}, {0x2, 0x9, 0x4, '\x00', 0xd}, {0x4, 0x7, 0x9, '\x00', 0xf}]}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6, 0xa, 0x5, 0x180, 0x0, 0x0, 0xf1, 0x0, 0x8, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, 0xbd5], 0x1, 0x3c4212}) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=@getchain={0x24, 0x66, 0x6aefa6b3be0a5ec1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xd, 0x7}, {0xffff, 0xb}, {0xffee, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x10}, 0x8) 8.534265653s ago: executing program 2 (id=77): io_setup(0x6, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) io_submit(0x0, 0x0, &(0x7f00000000c0)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="42000e0080000000ffffffffffff080211000000ffffffffffff00000000000000000000070001002503018c08720603030303030300000010000e800400010007000200fd918f00080026006c09000008000c050000000008000d0000000000"], 0x7c}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) sync_file_range(r6, 0x9d0, 0x4000000006, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000005c0), 0x2, 0xa}}, 0x20) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) 8.033733268s ago: executing program 4 (id=78): syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000280), 0x24000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000040) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000001540), 0x2000, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x9, &(0x7f0000000100)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_256={{0x304}, '\x00', "85c71634839038c8b0f2501d1cd778b690d5d2b7ae66c7909886ad82782dcd51", "b586e95e", "a2a05a2200"}, 0x38) ioctl$FBIOPUT_CON2FBMAP(r2, 0xc0684608, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x2, {0x40, 0x2}}, 0x10, 0x0}, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000000)={'bridge_slave_0\x00', 0x1}) fchdir(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2041, 0x0) ioctl$TCSETAF(r5, 0x5408, &(0x7f00000000c0)={0x49de, 0xfffd, 0x2, 0xbfff, 0x18, "ec05a144f13d8f07"}) write$binfmt_aout(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="adb509"], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x10, "0062ba5d8200"}) syz_open_pts(r5, 0x20800) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) 7.802544879s ago: executing program 1 (id=79): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) r6 = getuid() fchown(r4, r6, 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r4, 0x0, 0x0) r8 = openat$cgroup_subtree(r7, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r8, 0x0, 0x5) write$cgroup_subtree(r8, &(0x7f0000000480)={[{0x2b, 'rdma'}]}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x8, 0x3, 0x1ff, 0x3d, 0x963, 0x3, 0x53, 0x202, 0x1, 0xc}) 6.949579842s ago: executing program 3 (id=80): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x114df, 0x8000, 0xffffffff, 0x89}, &(0x7f00000001c0)=0x0, &(0x7f0000000440)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, 0x0, 0x0, 0x4) (async) io_uring_register$IORING_UNREGISTER_EVENTFD(r3, 0x5, 0x0, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async, rerun: 64) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) r7 = socket$can_j1939(0x1d, 0x2, 0x7) (async) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, 0x0, 0x0, {0x2, 0xff, 0x3}, 0xfe}, 0x18) (async) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (rerun: 64) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) (async) r10 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r10, &(0x7f0000000400), 0x10) (async) setsockopt$CAN_RAW_FILTER(r10, 0x65, 0x1, &(0x7f00000000c0), 0xf00) (async, rerun: 64) setsockopt$CAN_RAW_FILTER(r10, 0x65, 0x1, 0x0, 0x0) (async, rerun: 64) r11 = io_uring_setup(0x4f10, &(0x7f0000000400)={0x0, 0x92a3, 0x800, 0x4, 0x2e8, 0x0, r3}) r12 = syz_io_uring_setup(0x245b, &(0x7f0000000140)={0x0, 0x2475, 0x200, 0x5, 0x199, 0x0, r11}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r13, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r13, r14, &(0x7f00000002c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x27, 0x0, @fd=r2, 0x1, 0x0, 0x4, 0x3, 0x1}) io_uring_enter(r12, 0x3516, 0x3e44, 0x8, 0x0, 0x0) close_range(0xffffffffffffffff, r3, 0x0) (async) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={[{@uuid_on}, {@verity_on}]}) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) 6.603518259s ago: executing program 3 (id=81): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0x0, 0x3, 0x1, 0x4}, 'syz0\x00', 0x10}) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0xee) ioctl$UI_DEV_CREATE(r0, 0x5501) 6.589445084s ago: executing program 1 (id=82): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'ip6tnl0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) creat(&(0x7f00000002c0)='./file0\x00', 0x51) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r3 = dup(r2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x44, 0x1, 0x9, 0x801, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFCTH_TUPLE={0x30, 0x2, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000000}, 0x8) syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@cache_readahead}], [{@seclabel}], 0x6b}}) 6.49464567s ago: executing program 2 (id=83): openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b02d25a806f8c6394f90924fc60040f030047000000053582c137153e370248018000f01700d1", 0x2d}], 0x1}, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x40400, 0x0) r3 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000300)=""/102392, 0x18ff8) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x10, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xbf21, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41000}, 0x94) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r6, 0x4048ae9b, &(0x7f0000000300)={0x70001, 0x0, [0x40000000000, 0x64f, 0x6, 0x6, 0xfffffffffffffffc, 0x4ffff, 0x29]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = syz_io_uring_setup(0x49a, 0x0, &(0x7f0000000500)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, 0x0, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) close(0xffffffffffffffff) syz_io_uring_submit(r8, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x9, 0x0, 0x0, 0x0, {0x200}, 0x1, {0x0, r9}}) close_range(r1, r7, 0x2) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x207a98, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, 0x0) syz_open_pts(r3, 0xc0000) 5.967974678s ago: executing program 3 (id=84): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@bridge_newvlan={0x18, 0x71, 0x1, 0x70bd2d}, 0x18}}, 0x20008000) openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x4084}, 0x4805) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = socket$unix(0x1, 0x2, 0x0) shutdown(r3, 0xb403dc3ee651df83) sched_setaffinity(0x0, 0x14, &(0x7f0000000040)=0x6) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bind$rds(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x2, 0x2, 0x1) r6 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r6, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0xa8c, 0x870, 0x1, 0x2, 0xd59f82, 0x19f5, 0xacc, 0xb, 0x0, 0x3, 0x27fd, 0x2800, 0x440, 0x3, 0xd, 0x0, {0x45, 0x80}, 0xcd, 0x3}}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001840)=@bpf_ext={0x1c, 0x2, &(0x7f0000000300)=@raw=[@map_idx_val={0x18, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000340)='GPL\x00', 0xfffffc00, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x3, 0x3, 0x9, 0xc}, 0x10, 0x2469, r8, 0x0, &(0x7f0000000480), 0x0, 0x10, 0x878}, 0x94) 5.48242998s ago: executing program 0 (id=85): ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406d0494c200000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004282, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x64240, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000440)={r1, 0x2000, {0x0, 0x0, 0x0, 0x40008, 0x0, 0x0, 0x0, 0x3, 0x1c, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c4369d03741250ceaac50104000041dd17c18e8438ef2a565ef1e833236500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200"}}) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x661, 0x0, 0x4, 0xa, 0x4, "995e4c8b0ba6f8ed413b1ee5f3a7c862bbf64092868fd6943a428277be3c0fd8c867f86e662e0c2dd3a486b32ee0690c16eb180e01ed3e5e2ebe64446497c2fc", "a6fbfe5685c698954b3d8be9b663e59116ed4ef1c8cd33175c913d3a6080606ed4003a2011f56d3e90d68d5ac50000ecffffffffffffff00", "067e319230bb1e281e794c5dda5c4300000500", [0x0, 0x6]}) dup(r0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12014101d7f2ae2042070a2031c1010203010902240001000010000904990702740a830009050602000209000909050d020002000110"], 0x0) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x64bd280d467c3fa0, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) waitid$P_PIDFD(0x3, r7, 0x0, 0x1000000, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) r8 = eventfd(0x3) ioctl$VHOST_SET_LOG_FD(r5, 0x4004af07, &(0x7f0000000240)=r8) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$VHOST_SET_VRING_KICK(r5, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000380)={0x1, 0x0, 0x0, &(0x7f0000000280)=""/233, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x0, 0x0, 0x5000}) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000000)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0xfffff000) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f000000a000/0x4000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 5.148278494s ago: executing program 2 (id=86): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xc) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f00000009c0)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wg2\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2182, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/consoles\x00', 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) 4.26137109s ago: executing program 4 (id=87): r0 = socket$netlink(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0xa, 0x3, 0x87) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000003c0)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00fbee01091deadf94d353e6e58e2c7bd39f0934ad8416e8f008d00414e8fa1d21a8dfd975c6f722dce0fa093576f56428f50f0b26"], 0xee, 0x2) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000080)=0xb, 0x4) writev(r0, &(0x7f0000000100)=[{0x0}], 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 4.158729921s ago: executing program 1 (id=88): socket(0x29, 0xa, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={0x0, &(0x7f00000004c0), 0x0, 0x0, 0x1, 0x1}, 0x28) socketpair(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0xfffffffffffffefc, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00'}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2, 0x80805, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000240)=0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x78, 0x30, 0x80d, 0x0, 0x0, {}, [{0x64, 0x1, [@m_ct={0x60, 0x1, 0x0, 0x0, {{0x7}, {0x38, 0x2, 0x0, 0x1, [@TCA_CT_ZONE={0x6, 0x4, 0x800}, @TCA_CT_PARMS={0x18, 0x1, {0x2, 0x8, 0xffffffffffffffff, 0x4, 0x8}}, @TCA_CT_LABELS={0x14, 0x7, "a31a5744c98714e0c10894427408df27"}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x4004885) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000004c00)=""/102392, 0x18ff8) socket(0x23, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00'}) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f00000007c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000680)={0xbc, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_HEADER={0x94, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}]}, @ETHTOOL_A_STRSET_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 3.906305501s ago: executing program 2 (id=89): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socket(0x10, 0x3, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB], &(0x7f0000000180)='GPL\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x884, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xd, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_route={{0xa}, {0x854, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xe9}, @TCA_ROUTE4_POLICE={0x848, 0x5, [@TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x4, 0x7f, 0x2, 0x7, {0x9, 0x2, 0x5, 0x4, 0x2, 0x1}, {0x3, 0x1, 0x8, 0x1, 0x3, 0x9}, 0x2fb8, 0x5, 0x2}}, @TCA_POLICE_RATE={0x404, 0x2, [0xffffffff, 0xad4, 0x10000, 0x5, 0xb60b, 0x2, 0x8, 0x1, 0x2, 0x8, 0x5, 0x4, 0xb2, 0x3, 0xcb9, 0x7, 0x7, 0x8000, 0x9, 0x10, 0xce3, 0x9, 0x7, 0x414b, 0x4603, 0x7, 0xff, 0x1, 0x5, 0x10, 0x7, 0x1ff, 0x100, 0x80002, 0x639d, 0x0, 0x2, 0x9, 0x15b, 0x9, 0x0, 0x80, 0x40, 0x1, 0x29, 0x3ff, 0x542, 0x3, 0x3, 0x4, 0x6, 0x4, 0x6, 0x6, 0x15e6, 0xc, 0x4, 0x7f, 0x9, 0x0, 0x83c, 0x0, 0x8, 0x52, 0x2, 0xa7ac, 0x7, 0xfffffffa, 0x4, 0x3, 0x2, 0x0, 0x9, 0x8, 0x9, 0x34b, 0x2, 0x0, 0xcd, 0x40, 0x4, 0x6, 0x44, 0x8, 0x1, 0x80, 0x3, 0xffff, 0x0, 0x4, 0x2, 0xd, 0x1, 0x8, 0x5, 0x100, 0x0, 0x7, 0x6, 0xfffffff7, 0x5, 0x2c000000, 0x64454b99, 0x1, 0x2, 0x3, 0x401, 0x4, 0x447, 0x0, 0x5c58, 0x0, 0x8001, 0x80000001, 0x16b, 0x3, 0x4, 0xfffffff8, 0x584b, 0x7a498270, 0x7, 0x2, 0x3ec, 0x8, 0x1ff, 0xbc5f, 0x0, 0x7b685e6b, 0x9, 0x0, 0x7, 0x6, 0x8001, 0x9, 0x0, 0x5, 0x400, 0x0, 0xfff, 0x9, 0x6, 0x10000, 0x9cd, 0x6, 0x4, 0x7, 0x6, 0xb1, 0x7, 0x2a34, 0x80, 0x2, 0x4, 0x6, 0xf0, 0x8, 0x8, 0x3, 0x8, 0x3, 0x0, 0x9, 0x6, 0x1ff, 0x10001, 0x2, 0x6, 0xfffffffe, 0x4, 0xfffffff8, 0x3, 0x5, 0x8, 0x6, 0x3, 0x0, 0xffffffff, 0x1, 0x4, 0x7, 0x4, 0x5, 0x4, 0x1ff, 0xfffffffc, 0x5, 0x952, 0x0, 0x7f, 0x3, 0x326, 0x5, 0x3, 0x0, 0x5, 0x0, 0x1, 0x6, 0x100, 0x4, 0x5, 0xe87b, 0x2, 0x8, 0x7fff, 0x9, 0x4, 0x2, 0x6, 0x7fff, 0x1, 0x2, 0xa, 0xf, 0x800, 0x0, 0x2e, 0x4, 0x100, 0x6, 0x2, 0x5d6, 0x0, 0x2, 0xee4, 0x9, 0x3, 0x7, 0x0, 0x4, 0x30e73fe0, 0x7, 0x3, 0x7ff, 0x2, 0x400, 0x1, 0x400000, 0x96c3, 0x1000, 0x0, 0x322c, 0x10001, 0x3, 0x94b, 0x4, 0x2, 0x2, 0x5, 0x8, 0x4, 0x3, 0x2, 0x9, 0x1]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x0, 0x2, 0x400, 0xb94, 0x1000, 0x9, 0x1, 0x1, 0xfffffffd, 0x3ff, 0x5, 0xe0ff, 0x3, 0x38, 0x101, 0x1, 0x8, 0x517, 0x3, 0x240, 0x80000001, 0x401, 0x5, 0x2, 0x200, 0x10, 0x1, 0x66, 0x7, 0x0, 0x9c, 0x7, 0x9, 0x46047eae, 0x6, 0xe, 0x2, 0x5, 0x6, 0x8c, 0x3b0, 0xffffffff, 0x10000, 0x3, 0x8, 0x0, 0xfffffffc, 0x2, 0x4, 0x8, 0x8, 0xd675, 0xf, 0x8, 0x8001, 0xfff, 0x6, 0x5, 0xfffffffa, 0x80000001, 0xe, 0x3, 0x0, 0x100, 0x100, 0x205f800, 0x7fff, 0x3, 0xfc73, 0x2, 0x10001, 0xa473, 0xfffffffd, 0x11, 0x1, 0x9, 0x5, 0x73ec, 0x4, 0xffffffff, 0xffffffff, 0xffffffff, 0x7, 0x8, 0x0, 0xbb, 0x1, 0x3, 0x7, 0x3ff, 0x9, 0x1, 0xf9bb, 0x13, 0x81, 0x7, 0x7, 0x9, 0x7, 0x1, 0xb7, 0x4, 0x1, 0x92b, 0x1, 0x7, 0x8, 0x10, 0x85, 0x5a07f1ff, 0x57ae807c, 0x1ff, 0xfffffff7, 0x6, 0xc, 0x0, 0x8, 0xfffffffb, 0x1, 0x8, 0x8, 0x9, 0xa8, 0xb, 0x2, 0x1, 0x3, 0x8, 0x7f, 0x9, 0xe0, 0xffff751a, 0x2, 0x0, 0x7, 0x9, 0x6, 0x8, 0x8, 0x8, 0x6, 0xc, 0x0, 0x8, 0x3, 0x8, 0xbff1f336, 0x7, 0x5, 0x7, 0x1, 0x8, 0x0, 0x2, 0x4, 0x5, 0x18, 0x5f8381a, 0xa, 0x1fe0000, 0x10, 0x3b, 0x7, 0x2, 0x8, 0x1, 0x9, 0x8000, 0x200, 0x8, 0xfffffffe, 0x6, 0x80, 0xa6c, 0x7, 0x5, 0x6, 0x4, 0x3, 0x0, 0x9, 0xa, 0x0, 0xce, 0x10000, 0x1000, 0xff, 0xe2, 0x7, 0x7f, 0x4, 0x2e3e, 0x6, 0x5, 0xf, 0x9, 0x5170, 0x6, 0x6, 0xffff, 0x9, 0xffffff1e, 0xe, 0x7d12, 0x0, 0xff, 0x2, 0x8000, 0x400, 0xf3, 0xd8fb, 0x5, 0x4, 0x3f8, 0x9, 0x9, 0x1, 0xe23, 0x6, 0x9, 0x7ff, 0x2, 0xa, 0xb, 0x3, 0x9, 0x7, 0xf, 0x128, 0x7, 0xd, 0x4, 0x9, 0x101, 0x1c00, 0x0, 0x7, 0x2, 0x9748, 0x8, 0x400, 0x3, 0x0, 0x1, 0x100, 0x2, 0x5, 0x2cf, 0x6, 0xff, 0x1, 0x794, 0x8a43bf80, 0x2444, 0x8]}]}]}}]}, 0x884}, 0x1, 0x0, 0x0, 0x8c8}, 0x20004804) listen(0xffffffffffffffff, 0x0) accept4$x25(0xffffffffffffffff, 0x0, 0x0, 0x80800) 3.233554159s ago: executing program 4 (id=90): sendmmsg(0xffffffffffffffff, &(0x7f0000007dc0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="3f5c5495f8a1d92fd70cc0ce268a5a3f9624475b567711e3a51610aafb624481a54f14a2abc4dc4ebe3a5e4bee988cd37a63091103dcda6185765d116cf9ae3b50a7be37352b8dd6", 0x48}], 0x1}}], 0x1, 0x8000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="62a02a3a3409"], 0xa) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r2, 0x81, 0x1, &(0x7f0000000040)='P') 3.198992892s ago: executing program 3 (id=91): epoll_create1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0, 0x0, 0x6f2}, 0x18) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) syz_io_uring_setup(0x49f, &(0x7f0000000080)={0x0, 0xe7a8, 0x1, 0x7ffc, 0x8040024e}, &(0x7f0000000140), &(0x7f0000000100)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000280)=""/164, &(0x7f0000000100)=""/47, 0xf000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340)) r3 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000000)={0x1, r3}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) 2.191690884s ago: executing program 1 (id=92): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) r6 = getuid() fchown(r4, r6, 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r4, 0x0, 0x0) r8 = openat$cgroup_subtree(r7, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r8, 0x0, 0x5) write$cgroup_subtree(r8, &(0x7f0000000480)={[{0x2b, 'rdma'}]}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x8, 0x3, 0x1ff, 0x3d, 0x963, 0x3, 0x53, 0x202, 0x1, 0xc}) 2.023346659s ago: executing program 2 (id=93): syz_io_uring_submit(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x2}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004260000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0xc101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) ioctl$SIOCSIFHWADDR(r7, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000280)=""/164, &(0x7f0000000100)=""/47, 0xf000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000340)) r9 = dup(r2) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r9, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xf}}, './file0\x00'}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000000)={0x3, r9}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000791028000000000069000c00000000009500740000000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xa4, &(0x7f000000cf3d)=""/164, 0x0, 0x5, '\x00', 0x0, @sk_reuseport}, 0x94) 1.02383715s ago: executing program 1 (id=94): setxattr(&(0x7f0000000000)='.\x00', &(0x7f0000000040)=@known='trusted.overlay.metacopy\x00', &(0x7f0000000080)='\x00', 0x1, 0x3) write$cgroup_type(0xffffffffffffffff, &(0x7f00000000c0), 0x9) r0 = mq_open(&(0x7f0000000100)='threaded\x00', 0x80, 0x0, &(0x7f0000000140)={0x0, 0x9, 0x7, 0x7}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000008, 0x11, r0, 0x1f3d0000) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/79, 0x4f) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000240)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0xb0, 0x0, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_SEQ_ADJ_ORIG={0x2c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x5000000}]}, @CTA_SEQ_ADJ_REPLY={0x34, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x5a}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x4000000}]}, @CTA_LABELS_MASK={0x8, 0x17, [0x57f1e59]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x1891}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xb, 0x1, 'amanda\x00'}}, @CTA_SEQ_ADJ_ORIG={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x6a4}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20008004}, 0x8010) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000005c0)=0x40, 0x4) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000600)={'macvtap0\x00'}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000640), 0x202001, 0x0) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000680), 0x44400, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8020}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x24, r5, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x1000}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x400c088) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000800)={0x0, r2, 0x2, 0xffffffffffffffff, 0x5, 0x8}) bind$rds(r4, &(0x7f0000000840)={0x2, 0x4e23, @remote}, 0x10) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0xc7, 0x0, 0x0, 0x1}]}) fcntl$getownex(r3, 0x10, &(0x7f0000000940)={0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000980)={0x0, 0x0}) kcmp$KCMP_EPOLL_TFD(r6, r7, 0x7, r4, &(0x7f00000009c0)={r4, r3, 0x5}) close(r1) setsockopt$CAN_RAW_LOOPBACK(r4, 0x65, 0x3, &(0x7f0000000a00)=0x1, 0x4) r8 = open_tree(r4, &(0x7f0000000a40)='./file0\x00', 0x84000) ioctl$TIOCGSID(r8, 0x5429, &(0x7f0000000a80)=0x0) ptrace(0x10, r9) sendmsg$can_raw(r4, &(0x7f0000000b80)={&(0x7f0000000ac0), 0x10, &(0x7f0000000b40)={&(0x7f0000000b00)=@can={{0x1, 0x0, 0x1, 0x1}, 0x6, 0x2148f504bded766c, 0x0, 0x0, "34dabaf485a54c0c"}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) sendmsg$TIPC_CMD_GET_NETID(r4, &(0x7f0000000c80)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x2, 0x70bd2c, 0x25dfdbfb, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4044) 702.402876ms ago: executing program 0 (id=95): epoll_create1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0, 0x0, 0x6f2}, 0x18) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x49f, &(0x7f0000000080)={0x0, 0xe7a8, 0x1, 0x7ffc, 0x8040024e}, &(0x7f0000000140), &(0x7f0000000100)) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000280)=""/164, &(0x7f0000000100)=""/47, 0xf000}) r4 = dup(r2) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000000)={0x1, r4}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000001c0)=0x0) mount$cgroup(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000000c0), 0x10012, &(0x7f0000000800)={[{@subsystem='perf_event'}]}) sched_setaffinity(r5, 0x8, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) 561.705882ms ago: executing program 1 (id=96): timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000000)={0x7, 0x5}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}, [@call={0x85, 0x0, 0x0, 0x61}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e30080670000ec67838717bd86dd", 0x0, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYRES64=r5], 0x14}}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r6, 0xae80, 0x0) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) ioctl$KVM_CAP_X86_DISABLE_EXITS(r5, 0x4068aea3, &(0x7f0000000100)={0x8f, 0x0, 0x8}) 0s ago: executing program 3 (id=97): syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$isdn(0x22, 0x2, 0x10) r1 = socket$isdn(0x22, 0x2, 0x2) r2 = dup3(r1, r0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00'}) mkdir(0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0xc8040) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="02000000017a0000001500000004000007000000001000000000000000200000000000000067e46c2eeb6203951adb0f4c8580a046d6f14570bd195b153ed5c43f5fb5ff0a2f4bf2c46e42374088eb1514d1456cc0a70df9e8069478d4016e0b7127c2ef2bc1"], 0x24, 0x0) socket$inet6(0xa, 0x3, 0xff) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240)={'L-', 0x80000000}, 0x16, 0x2) fspick(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000070000002a0000000500000000000000", @ANYRES32, @ANYBLOB="000f0000001ffffffff0d4cf7c3a9abc57ad0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x10001, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r5}, 0x10) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r8 = dup(r7) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x4000, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r8}, 0x2c, {[], [], 0x6b}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.224' (ED25519) to the list of known hosts. [ 58.643872][ T30] audit: type=1400 audit(1756134985.502:62): avc: denied { mounton } for pid=5832 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 58.647793][ T5832] cgroup: Unknown subsys name 'net' [ 58.671954][ T30] audit: type=1400 audit(1756134985.502:63): avc: denied { mount } for pid=5832 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.694396][ T30] audit: type=1400 audit(1756134985.532:64): avc: denied { unmount } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.799263][ T5832] cgroup: Unknown subsys name 'cpuset' [ 58.807050][ T5832] cgroup: Unknown subsys name 'rlimit' [ 58.933674][ T30] audit: type=1400 audit(1756134985.792:65): avc: denied { setattr } for pid=5832 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 58.957098][ T30] audit: type=1400 audit(1756134985.792:66): avc: denied { create } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 59.006701][ T30] audit: type=1400 audit(1756134985.792:67): avc: denied { write } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 59.027263][ T30] audit: type=1400 audit(1756134985.792:68): avc: denied { read } for pid=5832 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 59.047951][ T30] audit: type=1400 audit(1756134985.822:69): avc: denied { mounton } for pid=5832 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 59.070871][ T5834] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 59.072973][ T30] audit: type=1400 audit(1756134985.822:70): avc: denied { mount } for pid=5832 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 59.104932][ T30] audit: type=1400 audit(1756134985.852:71): avc: denied { read } for pid=5514 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 60.071376][ T5832] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.341695][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 64.341712][ T30] audit: type=1400 audit(1756134991.202:78): avc: denied { create } for pid=5842 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 64.380621][ T30] audit: type=1400 audit(1756134991.232:79): avc: denied { read write } for pid=5842 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 64.404477][ T30] audit: type=1400 audit(1756134991.232:80): avc: denied { open } for pid=5842 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 64.442743][ T30] audit: type=1400 audit(1756134991.242:81): avc: denied { ioctl } for pid=5842 comm="syz-executor" path="socket:[4717]" dev="sockfs" ino=4717 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 64.526915][ T5860] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.547408][ T5860] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.566429][ T5863] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 64.573801][ T5860] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.578566][ T5862] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.581708][ T5863] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 64.590899][ T5858] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.595987][ T5863] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 64.602891][ T5861] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.610906][ T5863] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.618795][ T5858] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.623012][ T5860] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.630909][ T5858] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.637407][ T5860] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.644616][ T5862] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.651458][ T5863] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 64.660443][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.668345][ T5860] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.672791][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.688031][ T5859] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.690543][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.695613][ T5859] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.702813][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.718010][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.725975][ T5850] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.740373][ T30] audit: type=1400 audit(1756134991.542:82): avc: denied { read } for pid=5843 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.796708][ T30] audit: type=1400 audit(1756134991.542:83): avc: denied { open } for pid=5843 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.831365][ T30] audit: type=1400 audit(1756134991.542:84): avc: denied { mounton } for pid=5843 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 65.086902][ T30] audit: type=1400 audit(1756134991.952:85): avc: denied { module_request } for pid=5842 comm="syz-executor" kmod="rtnl-link-nicvf" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 65.182759][ T5842] chnl_net:caif_netlink_parms(): no params data found [ 65.249872][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 65.274897][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 65.380828][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 65.488165][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 65.498304][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.505772][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.514456][ T5847] bridge_slave_0: entered allmulticast mode [ 65.521340][ T5847] bridge_slave_0: entered promiscuous mode [ 65.529771][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.536956][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.544044][ T5842] bridge_slave_0: entered allmulticast mode [ 65.550857][ T5842] bridge_slave_0: entered promiscuous mode [ 65.581619][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.588873][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.596075][ T5847] bridge_slave_1: entered allmulticast mode [ 65.603099][ T5847] bridge_slave_1: entered promiscuous mode [ 65.610105][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.617369][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.624473][ T5842] bridge_slave_1: entered allmulticast mode [ 65.631373][ T5842] bridge_slave_1: entered promiscuous mode [ 65.680856][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.688111][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.695209][ T5843] bridge_slave_0: entered allmulticast mode [ 65.702086][ T5843] bridge_slave_0: entered promiscuous mode [ 65.709596][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.717092][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.724218][ T5843] bridge_slave_1: entered allmulticast mode [ 65.731940][ T5843] bridge_slave_1: entered promiscuous mode [ 65.775235][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.796535][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.823648][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.851352][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.880818][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.899496][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.907077][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.914180][ T5851] bridge_slave_0: entered allmulticast mode [ 65.921808][ T5851] bridge_slave_0: entered promiscuous mode [ 65.938886][ T5842] team0: Port device team_slave_0 added [ 65.944751][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.951926][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.959087][ T5844] bridge_slave_0: entered allmulticast mode [ 65.965671][ T5844] bridge_slave_0: entered promiscuous mode [ 65.974694][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.993532][ T5847] team0: Port device team_slave_0 added [ 65.999646][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.007196][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.014300][ T5851] bridge_slave_1: entered allmulticast mode [ 66.021132][ T5851] bridge_slave_1: entered promiscuous mode [ 66.028497][ T5842] team0: Port device team_slave_1 added [ 66.043378][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.050504][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.057922][ T5844] bridge_slave_1: entered allmulticast mode [ 66.064601][ T5844] bridge_slave_1: entered promiscuous mode [ 66.081004][ T5843] team0: Port device team_slave_0 added [ 66.088456][ T5847] team0: Port device team_slave_1 added [ 66.095297][ T5843] team0: Port device team_slave_1 added [ 66.154564][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.189577][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.196550][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.222710][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.236068][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.257842][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.269514][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.279269][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.286223][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.312474][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.324075][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.331385][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.357505][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.368969][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.375898][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.402485][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.436459][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.443455][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.469422][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.480652][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.487950][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.514689][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.533217][ T5851] team0: Port device team_slave_0 added [ 66.572458][ T5851] team0: Port device team_slave_1 added [ 66.579742][ T5844] team0: Port device team_slave_0 added [ 66.619053][ T5842] hsr_slave_0: entered promiscuous mode [ 66.625119][ T5842] hsr_slave_1: entered promiscuous mode [ 66.633917][ T5844] team0: Port device team_slave_1 added [ 66.650856][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.657917][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.684137][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.699518][ T5847] hsr_slave_0: entered promiscuous mode [ 66.705553][ T5847] hsr_slave_1: entered promiscuous mode [ 66.711622][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 66.717492][ T5847] Cannot create hsr debugfs directory [ 66.727391][ T5857] Bluetooth: hci0: command tx timeout [ 66.727396][ T51] Bluetooth: hci1: command tx timeout [ 66.743529][ T5843] hsr_slave_0: entered promiscuous mode [ 66.749722][ T5843] hsr_slave_1: entered promiscuous mode [ 66.755609][ T5843] debugfs: 'hsr0' already exists in 'hsr' [ 66.761475][ T5843] Cannot create hsr debugfs directory [ 66.774686][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.781824][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.807950][ T51] Bluetooth: hci3: command tx timeout [ 66.807995][ T5857] Bluetooth: hci4: command tx timeout [ 66.813739][ T5850] Bluetooth: hci2: command tx timeout [ 66.822254][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.899356][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.906333][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.932528][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.986501][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.993789][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.019758][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.042783][ T5851] hsr_slave_0: entered promiscuous mode [ 67.050366][ T5851] hsr_slave_1: entered promiscuous mode [ 67.056216][ T5851] debugfs: 'hsr0' already exists in 'hsr' [ 67.062041][ T5851] Cannot create hsr debugfs directory [ 67.183696][ T5844] hsr_slave_0: entered promiscuous mode [ 67.190299][ T5844] hsr_slave_1: entered promiscuous mode [ 67.196132][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 67.201889][ T5844] Cannot create hsr debugfs directory [ 67.381137][ T5842] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 67.392069][ T5842] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 67.414365][ T5842] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 67.437767][ T5842] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 67.507873][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.523636][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.541243][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.561291][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.605364][ T5843] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.616442][ T5843] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.627972][ T5843] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.655550][ T5843] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.744311][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.760921][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.772225][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.783622][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 67.840581][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.889110][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.916406][ T5851] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 67.929182][ T5851] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 67.942002][ T5851] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 67.954345][ T5851] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 67.965725][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.984147][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.001202][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.015056][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.022378][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.047575][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.054646][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.065655][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.072748][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.099407][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.106524][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.146329][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.178056][ T1153] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.185313][ T1153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.207843][ T1153] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.214975][ T1153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.234994][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.327243][ T30] audit: type=1400 audit(1756134995.182:86): avc: denied { sys_module } for pid=5847 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 68.350387][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.364348][ T5843] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.400492][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.407587][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.417976][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.425092][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.504206][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.588800][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.623715][ T3498] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.630859][ T3498] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.681933][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.700801][ T179] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.708024][ T179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.754164][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.813041][ T5850] Bluetooth: hci0: command tx timeout [ 68.819614][ T51] Bluetooth: hci1: command tx timeout [ 68.876041][ T5851] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.886984][ T51] Bluetooth: hci3: command tx timeout [ 68.891076][ T5857] Bluetooth: hci4: command tx timeout [ 68.892435][ T5850] Bluetooth: hci2: command tx timeout [ 68.905987][ T5851] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.929339][ T5842] veth0_vlan: entered promiscuous mode [ 68.955573][ T5847] veth0_vlan: entered promiscuous mode [ 68.969070][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.981892][ T5847] veth1_vlan: entered promiscuous mode [ 68.994208][ T5842] veth1_vlan: entered promiscuous mode [ 69.031959][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.092967][ T5847] veth0_macvtap: entered promiscuous mode [ 69.103281][ T5842] veth0_macvtap: entered promiscuous mode [ 69.130638][ T5847] veth1_macvtap: entered promiscuous mode [ 69.146129][ T5843] veth0_vlan: entered promiscuous mode [ 69.159254][ T5842] veth1_macvtap: entered promiscuous mode [ 69.196549][ T5843] veth1_vlan: entered promiscuous mode [ 69.222504][ T5844] veth0_vlan: entered promiscuous mode [ 69.235643][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.248279][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.263165][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.274730][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.305611][ T5844] veth1_vlan: entered promiscuous mode [ 69.313586][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.323398][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.334976][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.344144][ T5843] veth0_macvtap: entered promiscuous mode [ 69.373135][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.383014][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.414710][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.427873][ T5843] veth1_macvtap: entered promiscuous mode [ 69.448313][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.458686][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.470551][ T3498] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.594712][ T5844] veth0_macvtap: entered promiscuous mode [ 69.595084][ T4576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.613549][ T4576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.631872][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.665617][ T5844] veth1_macvtap: entered promiscuous mode [ 69.694548][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.721944][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.731560][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.748723][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.759625][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.767124][ T1153] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.768497][ T1153] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.793796][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.798280][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.810160][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.851960][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.852374][ T30] audit: type=1400 audit(1756134996.712:87): avc: denied { mounton } for pid=5847 comm="syz-executor" path="/root/syzkaller.FGgBi8/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 69.893071][ T30] audit: type=1400 audit(1756134996.722:88): avc: denied { mount } for pid=5847 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 69.926211][ T30] audit: type=1400 audit(1756134996.722:89): avc: denied { mounton } for pid=5847 comm="syz-executor" path="/root/syzkaller.FGgBi8/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 69.961212][ T30] audit: type=1400 audit(1756134996.722:90): avc: denied { mount } for pid=5847 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 69.977013][ T5851] veth0_vlan: entered promiscuous mode [ 69.991793][ T30] audit: type=1400 audit(1756134996.722:91): avc: denied { mounton } for pid=5847 comm="syz-executor" path="/root/syzkaller.FGgBi8/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 69.995685][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 70.022909][ T30] audit: type=1400 audit(1756134996.722:92): avc: denied { mounton } for pid=5847 comm="syz-executor" path="/root/syzkaller.FGgBi8/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 70.063264][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.066996][ T30] audit: type=1400 audit(1756134996.722:93): avc: denied { unmount } for pid=5847 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 70.071279][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.091468][ T30] audit: type=1400 audit(1756134996.752:94): avc: denied { mounton } for pid=5847 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 70.122673][ T30] audit: type=1400 audit(1756134996.752:95): avc: denied { mount } for pid=5847 comm="syz-executor" name="/" dev="gadgetfs" ino=7331 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 70.147442][ T30] audit: type=1400 audit(1756134996.782:96): avc: denied { mount } for pid=5847 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 70.170374][ T1153] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.181109][ T1153] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.222572][ T1153] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.234131][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.248648][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.259943][ T5851] veth1_vlan: entered promiscuous mode [ 70.274662][ T1153] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.310832][ T3498] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.323180][ T3498] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.386107][ T5851] veth0_macvtap: entered promiscuous mode [ 70.418955][ T5851] veth1_macvtap: entered promiscuous mode [ 70.460058][ T4576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.474890][ T4576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.519344][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.855184][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.866164][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.877424][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.905564][ T5850] Bluetooth: hci0: command tx timeout [ 70.906084][ T5857] Bluetooth: hci1: command tx timeout [ 71.033160][ T5857] Bluetooth: hci2: command tx timeout [ 71.033201][ T5850] Bluetooth: hci3: command tx timeout [ 71.038731][ T5857] Bluetooth: hci4: command tx timeout [ 71.054927][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.063469][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.067566][ T1153] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.094374][ T5970] Zero length message leads to an empty skb [ 71.115181][ T1153] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.207468][ T1153] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.246960][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 71.256824][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 71.333676][ T4576] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.372160][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.435372][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.566947][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.575337][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.584103][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.656958][ T0] NOHZ tick-stop error: local softirq work is pending, handler #240!!! [ 71.681086][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.701538][ T5984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6'. [ 71.702060][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.722335][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.731017][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.731480][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 71.754394][ T5984] bridge_slave_0: left allmulticast mode [ 71.780103][ T5984] bridge_slave_0: left promiscuous mode [ 71.825134][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.982830][ T5986] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 72.225349][ T5984] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.421018][ T5984] bridge_slave_1: left allmulticast mode [ 72.459827][ T5984] bridge_slave_1: left promiscuous mode [ 72.514934][ T5981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 72.578829][ T5984] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.749435][ T5984] bond0: (slave bond_slave_0): Releasing backup interface [ 72.864977][ T5984] bond0: (slave bond_slave_1): Releasing backup interface [ 72.966802][ T5857] Bluetooth: hci0: command tx timeout [ 72.972336][ T5857] Bluetooth: hci1: command tx timeout [ 73.047115][ T5857] Bluetooth: hci3: command tx timeout [ 73.047547][ T51] Bluetooth: hci2: command tx timeout [ 73.114282][ T5984] team0: Port device team_slave_0 removed [ 73.127208][ T51] Bluetooth: hci4: command tx timeout [ 73.317157][ T5984] team0: Port device team_slave_1 removed [ 73.351815][ T5984] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.460399][ T5984] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.507550][ T5984] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.517805][ T6001] overlayfs: failed to resolve './file1': -2 [ 73.566783][ T5984] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.592460][ T6002] exfat: Unknown parameter 'discang¾›rd' [ 73.711014][ T6003] netlink: 5376 bytes leftover after parsing attributes in process `syz.1.11'. [ 73.720961][ T6003] netlink: 5376 bytes leftover after parsing attributes in process `syz.1.11'. [ 74.471289][ T6016] GUP no longer grows the stack in syz.0.12 (6016): 200000004000-20000000a000 (200000002000) [ 74.481685][ T6016] CPU: 1 UID: 0 PID: 6016 Comm: syz.0.12 Not tainted syzkaller #0 PREEMPT(full) [ 74.481712][ T6016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 74.481723][ T6016] Call Trace: [ 74.481730][ T6016] [ 74.481737][ T6016] dump_stack_lvl+0x16c/0x1f0 [ 74.481766][ T6016] gup_vma_lookup+0x1d2/0x220 [ 74.481794][ T6016] __get_user_pages+0x243/0x34a0 [ 74.481820][ T6016] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 74.481843][ T6016] ? rcu_preempt_deferred_qs_irqrestore+0x500/0xbc0 [ 74.481881][ T6016] ? __pfx___get_user_pages+0x10/0x10 [ 74.481906][ T6016] ? __rcu_read_unlock+0x2bc/0x550 [ 74.481930][ T6016] get_user_pages_remote+0x243/0xab0 [ 74.481957][ T6016] ? mas_parent_gap+0x6f0/0x7b0 [ 74.481981][ T6016] ? __pfx_get_user_pages_remote+0x10/0x10 [ 74.482009][ T6016] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 74.482037][ T6016] __access_remote_vm+0x24d/0x850 [ 74.482067][ T6016] ? __pfx___access_remote_vm+0x10/0x10 [ 74.482097][ T6016] proc_pid_cmdline_read+0x4de/0x8e0 [ 74.482123][ T6016] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 74.482147][ T6016] ? rw_verify_area+0xcf/0x6c0 [ 74.482176][ T6016] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 74.482197][ T6016] vfs_readv+0x5be/0x8b0 [ 74.482220][ T6016] ? __pfx_vfs_readv+0x10/0x10 [ 74.482238][ T6016] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 74.482260][ T6016] ? rcu_preempt_deferred_qs_irqrestore+0x500/0xbc0 [ 74.482302][ T6016] ? __fget_files+0x20e/0x3c0 [ 74.482330][ T6016] ? do_preadv+0x1a6/0x270 [ 74.482345][ T6016] do_preadv+0x1a6/0x270 [ 74.482362][ T6016] ? __pfx_do_preadv+0x10/0x10 [ 74.482401][ T6016] do_syscall_64+0xcd/0x4c0 [ 74.482426][ T6016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.482445][ T6016] RIP: 0033:0x7fbaf2d8ebe9 [ 74.482461][ T6016] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.482478][ T6016] RSP: 002b:00007fbaf3c75038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 74.482497][ T6016] RAX: ffffffffffffffda RBX: 00007fbaf2fb6180 RCX: 00007fbaf2d8ebe9 [ 74.482509][ T6016] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 000000000000000a [ 74.482519][ T6016] RBP: 00007fbaf2e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 74.482530][ T6016] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 74.482540][ T6016] R13: 00007fbaf2fb6218 R14: 00007fbaf2fb6180 R15: 00007ffcb14fed98 [ 74.482565][ T6016] [ 74.803570][ T6006] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 74.895769][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 74.895784][ T30] audit: type=1400 audit(1756135001.752:148): avc: denied { setopt } for pid=6011 comm="syz.1.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.393944][ T30] audit: type=1400 audit(1756135001.812:149): avc: denied { write } for pid=6020 comm="syz.3.16" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.417371][ T30] audit: type=1400 audit(1756135001.812:150): avc: denied { ioctl } for pid=6020 comm="syz.3.16" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.447726][ T6015] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 75.450009][ T6026] No buffer was provided with the request [ 75.596899][ T6015] usb 4-1: device descriptor read/64, error -71 [ 75.859037][ T6015] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 76.275002][ T30] audit: type=1400 audit(1756135003.132:151): avc: denied { bind } for pid=6011 comm="syz.1.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 76.301553][ T6015] usb 4-1: device descriptor read/64, error -71 [ 76.391368][ T30] audit: type=1400 audit(1756135003.132:152): avc: denied { name_bind } for pid=6011 comm="syz.1.14" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 76.438785][ T6015] usb usb4-port1: attempt power cycle [ 76.522896][ T30] audit: type=1400 audit(1756135003.132:153): avc: denied { node_bind } for pid=6011 comm="syz.1.14" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 76.614835][ T30] audit: type=1400 audit(1756135003.302:154): avc: denied { create } for pid=6035 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 76.705703][ T30] audit: type=1400 audit(1756135003.342:155): avc: denied { ioctl } for pid=6035 comm="syz.0.19" path="socket:[8756]" dev="sockfs" ino=8756 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 76.793360][ T30] audit: type=1400 audit(1756135003.342:156): avc: denied { bind } for pid=6035 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 76.835161][ T30] audit: type=1400 audit(1756135003.342:157): avc: denied { write } for pid=6035 comm="syz.0.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 76.887045][ T6015] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 76.934806][ T6015] usb 4-1: device descriptor read/8, error -71 [ 77.186755][ T6015] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 77.347432][ T6015] usb 4-1: device descriptor read/8, error -71 [ 77.796435][ T6015] usb usb4-port1: unable to enumerate USB device [ 77.871020][ T6051] netlink: 4 bytes leftover after parsing attributes in process `syz.1.23'. [ 78.765684][ T6060] geneve2: entered promiscuous mode [ 80.120877][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 80.120890][ T30] audit: type=1400 audit(1756135006.982:170): avc: denied { write } for pid=6067 comm="syz.2.28" name="001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 80.162704][ T6070] FAULT_INJECTION: forcing a failure. [ 80.162704][ T6070] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 80.190431][ T6070] CPU: 1 UID: 0 PID: 6070 Comm: syz.4.27 Not tainted syzkaller #0 PREEMPT(full) [ 80.190458][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 80.190467][ T6070] Call Trace: [ 80.190472][ T6070] [ 80.190476][ T6070] dump_stack_lvl+0x16c/0x1f0 [ 80.190494][ T6070] should_fail_ex+0x512/0x640 [ 80.190509][ T6070] _copy_from_user+0x2e/0xd0 [ 80.190524][ T6070] bpf_test_init.isra.0+0xe2/0x140 [ 80.190545][ T6070] bpf_prog_test_run_xdp+0x4f0/0x1590 [ 80.190563][ T6070] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 80.190576][ T6070] ? pfn_swap_entry_to_page+0x540/0x540 [ 80.190592][ T6070] ? fput+0x9b/0xd0 [ 80.190607][ T6070] ? __bpf_prog_get+0x97/0x2a0 [ 80.190620][ T6070] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 80.190632][ T6070] __sys_bpf+0x1050/0x4de0 [ 80.190648][ T6070] ? __pfx___sys_bpf+0x10/0x10 [ 80.190663][ T6070] ? ksys_write+0x190/0x250 [ 80.190676][ T6070] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 80.190697][ T6070] ? fput+0x9b/0xd0 [ 80.190711][ T6070] ? ksys_write+0x1ac/0x250 [ 80.190722][ T6070] ? __pfx_ksys_write+0x10/0x10 [ 80.190735][ T6070] __x64_sys_bpf+0x78/0xc0 [ 80.190750][ T6070] ? lockdep_hardirqs_on+0x7c/0x110 [ 80.190762][ T6070] do_syscall_64+0xcd/0x4c0 [ 80.190775][ T6070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.190787][ T6070] RIP: 0033:0x7f02b098ebe9 [ 80.190796][ T6070] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 80.190807][ T6070] RSP: 002b:00007f02b18b0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 80.190818][ T6070] RAX: ffffffffffffffda RBX: 00007f02b0bb5fa0 RCX: 00007f02b098ebe9 [ 80.190825][ T6070] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 80.190831][ T6070] RBP: 00007f02b18b0090 R08: 0000000000000000 R09: 0000000000000000 [ 80.190838][ T6070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 80.190844][ T6070] R13: 00007f02b0bb6038 R14: 00007f02b0bb5fa0 R15: 00007ffe8bcd4568 [ 80.190858][ T6070] [ 80.442573][ T6068] netlink: 11 bytes leftover after parsing attributes in process `syz.2.28'. [ 80.516845][ T30] audit: type=1400 audit(1756135007.352:171): avc: denied { bind } for pid=6067 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 80.727009][ T5969] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.761068][ T6080] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.30'. [ 80.810110][ T30] audit: type=1400 audit(1756135007.452:172): avc: denied { setopt } for pid=6067 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 80.852330][ T30] audit: type=1400 audit(1756135007.552:173): avc: denied { create } for pid=6075 comm="syz.0.30" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 81.030277][ T5969] usb 5-1: Using ep0 maxpacket: 8 [ 81.060982][ T5969] usb 5-1: config index 0 descriptor too short (expected 30, got 18) [ 81.099825][ T5969] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 81.116725][ T30] audit: type=1400 audit(1756135007.552:174): avc: denied { setattr } for pid=6075 comm="syz.0.30" name="file0" dev="tmpfs" ino=43 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 81.141265][ T5969] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.163616][ T5969] usb 5-1: Product: syz [ 81.170074][ T5969] usb 5-1: Manufacturer: syz [ 81.175312][ T5969] usb 5-1: SerialNumber: syz [ 81.180835][ T30] audit: type=1400 audit(1756135007.562:175): avc: denied { sqpoll } for pid=6067 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 81.202463][ T5969] usb 5-1: config 0 descriptor?? [ 81.212124][ T5969] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 81.331170][ T3091] cfg80211: failed to load regulatory.db [ 81.342037][ T5969] usb 5-1: setting power ON [ 81.347892][ T30] audit: type=1400 audit(1756135007.942:176): avc: denied { unlink } for pid=5847 comm="syz-executor" name="file0" dev="tmpfs" ino=43 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 81.373070][ T5969] dvb-usb: bulk message failed: -22 (2/0) [ 81.390756][ T30] audit: type=1400 audit(1756135008.102:177): avc: denied { setopt } for pid=6085 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 81.838298][ T30] audit: type=1400 audit(1756135008.102:178): avc: denied { watch watch_reads } for pid=6085 comm="syz.0.33" path="/6" dev="tmpfs" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 81.878934][ T5969] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 81.930413][ T5969] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 81.956812][ T5969] usb 5-1: media controller created [ 81.960996][ T30] audit: type=1400 audit(1756135008.102:179): avc: denied { read write } for pid=6085 comm="syz.0.33" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 81.989163][ T6072] delete_channel: no stack [ 82.032909][ T5969] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 82.327245][ T3091] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 82.392956][ T5969] usb 5-1: selecting invalid altsetting 6 [ 82.428882][ T5969] usb 5-1: digital interface selection failed (-22) [ 82.575850][ T5969] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 82.587187][ T3091] usb 2-1: Using ep0 maxpacket: 8 [ 82.597247][ T3091] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 82.658686][ T6099] SELinux: failed to load policy [ 83.378545][ T5969] usb 5-1: setting power OFF [ 83.383397][ T5969] dvb-usb: bulk message failed: -22 (2/0) [ 83.389971][ T5969] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 83.399461][ T5969] (NULL device *): no alternate interface [ 83.402253][ T3091] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 83.417075][ T3091] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.425031][ T3091] usb 2-1: Product: syz [ 83.443267][ T3091] usb 2-1: Manufacturer: syz [ 83.455871][ T3091] usb 2-1: SerialNumber: syz [ 83.462694][ T5969] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 83.478634][ T3091] usb 2-1: config 0 descriptor?? [ 83.495551][ T3091] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 83.529718][ T6107] overlayfs: failed to resolve './file1': -2 [ 83.531130][ T3091] usb 2-1: setting power ON [ 83.574076][ T3091] dvb-usb: bulk message failed: -22 (2/0) [ 83.668548][ T6111] netlink: 5376 bytes leftover after parsing attributes in process `syz.0.39'. [ 83.679686][ T6111] netlink: 5376 bytes leftover after parsing attributes in process `syz.0.39'. [ 83.890221][ T6093] delete_channel: no stack [ 83.913893][ T3091] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 84.223816][ T3091] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 84.267596][ T3091] usb 2-1: media controller created [ 84.343566][ T3091] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 84.369659][ T3091] usb 2-1: selecting invalid altsetting 6 [ 84.375566][ T3091] usb 2-1: digital interface selection failed (-22) [ 84.382263][ T3091] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 84.392843][ T3091] usb 2-1: setting power OFF [ 84.410161][ T3091] dvb-usb: bulk message failed: -22 (2/0) [ 84.422575][ T3091] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 84.453898][ T3091] (NULL device *): no alternate interface [ 84.465728][ T6120] netlink: 8 bytes leftover after parsing attributes in process `syz.0.41'. [ 84.501981][ T3091] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 84.565300][ T6122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.581536][ T6122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.756774][ T5969] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.107117][ T5969] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 85.154214][ T5969] usb 1-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice= 9.99 [ 85.440662][ T5969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.455503][ T5969] usb 1-1: Product: syz [ 85.460301][ T5969] usb 1-1: Manufacturer: syz [ 85.465167][ T5969] usb 1-1: SerialNumber: syz [ 85.477925][ T5969] usb 1-1: config 0 descriptor?? [ 85.500964][ T5925] usb 5-1: USB disconnect, device number 2 [ 85.748240][ T5969] f81534a_ctrl 1-1:0.0: failed to set register 0x116: -5 [ 85.755366][ T5969] f81534a_ctrl 1-1:0.0: failed to enable ports: -5 [ 85.773984][ T5969] f81534a_ctrl 1-1:0.0: probe with driver f81534a_ctrl failed with error -5 [ 85.842089][ T5969] usb 1-1: USB disconnect, device number 2 [ 85.941238][ T6131] input: syz0 as /devices/virtual/input/input5 [ 85.991401][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 85.991416][ T30] audit: type=1400 audit(1756135012.852:190): avc: denied { read } for pid=5204 comm="acpid" name="event4" dev="devtmpfs" ino=2808 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.026459][ T30] audit: type=1400 audit(1756135012.852:191): avc: denied { open } for pid=5204 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2808 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.061098][ T5925] usb 2-1: USB disconnect, device number 2 [ 86.108952][ T6134] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 86.122571][ T30] audit: type=1400 audit(1756135012.852:192): avc: denied { ioctl } for pid=5204 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2808 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.212204][ T30] audit: type=1400 audit(1756135013.062:193): avc: denied { create } for pid=6138 comm="syz.1.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 86.249925][ T6139] FAULT_INJECTION: forcing a failure. [ 86.249925][ T6139] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 86.263847][ T6139] CPU: 0 UID: 0 PID: 6139 Comm: syz.1.46 Not tainted syzkaller #0 PREEMPT(full) [ 86.263870][ T6139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 86.263878][ T6139] Call Trace: [ 86.263883][ T6139] [ 86.263888][ T6139] dump_stack_lvl+0x16c/0x1f0 [ 86.263909][ T6139] should_fail_ex+0x512/0x640 [ 86.263929][ T6139] copy_fpstate_to_sigframe+0x854/0xaf0 [ 86.263954][ T6139] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 86.263974][ T6139] ? posixtimer_deliver_signal+0x105/0x6b0 [ 86.263994][ T6139] ? posixtimer_deliver_signal+0x1c7/0x6b0 [ 86.264007][ T6139] ? x86_task_fpu+0x5f/0x90 [ 86.264026][ T6139] get_sigframe+0x4a8/0x9c0 [ 86.264047][ T6139] ? __pfx_get_sigframe+0x10/0x10 [ 86.264067][ T6139] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.264080][ T6139] ? siginfo_layout+0x177/0x290 [ 86.264100][ T6139] x64_setup_rt_frame+0x12e/0xcf0 [ 86.264123][ T6139] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 86.264148][ T6139] arch_do_signal_or_restart+0x5e4/0x7d0 [ 86.264165][ T6139] ? __fget_files+0x20e/0x3c0 [ 86.264181][ T6139] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 86.264204][ T6139] ? ksys_write+0x1ac/0x250 [ 86.264225][ T6139] ? __pfx_ksys_write+0x10/0x10 [ 86.264243][ T6139] exit_to_user_mode_loop+0x84/0x110 [ 86.264259][ T6139] do_syscall_64+0x3f6/0x4c0 [ 86.264277][ T6139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.264291][ T6139] RIP: 0033:0x7f6b39f8d69f [ 86.264303][ T6139] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 86.264317][ T6139] RSP: 002b:00007f6b3ae27030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 86.264331][ T6139] RAX: 0000000000000001 RBX: 0000000000000004 RCX: 00007f6b39f8d69f [ 86.264340][ T6139] RDX: 0000000000000001 RSI: 00007f6b3ae27090 RDI: 0000000000000004 [ 86.264348][ T6139] RBP: 00007f6b3ae27090 R08: 0000000000000000 R09: 00007f6b3ae26df7 [ 86.264356][ T6139] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 86.264365][ T6139] R13: 00007f6b3a1b6038 R14: 00007f6b3a1b5fa0 R15: 00007ffd632e8058 [ 86.264383][ T6139] [ 86.388262][ T30] audit: type=1400 audit(1756135013.242:194): avc: denied { read write } for pid=6140 comm="syz.3.48" name="video0" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 86.519670][ T30] audit: type=1400 audit(1756135013.242:195): avc: denied { open } for pid=6140 comm="syz.3.48" path="/dev/video0" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 86.571015][ T30] audit: type=1400 audit(1756135013.362:196): avc: denied { block_suspend } for pid=6136 comm="syz.2.47" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 86.628504][ T5933] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 86.815959][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 86.860702][ T5933] usb 5-1: unable to get BOS descriptor or descriptor too short [ 86.936675][ T30] audit: type=1400 audit(1756135013.702:197): avc: denied { ioctl } for pid=6140 comm="syz.3.48" path="/dev/video0" dev="devtmpfs" ino=930 ioctlcmd=0x565f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 86.939701][ T5933] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 86.990392][ T5933] usb 5-1: config 1 has no interface number 1 [ 86.999863][ T5933] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 87.217876][ T5933] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 87.227883][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.236310][ T5933] usb 5-1: Product: syz [ 87.241219][ T5933] usb 5-1: Manufacturer: syz [ 87.245921][ T5933] usb 5-1: SerialNumber: syz [ 87.620135][ T5933] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 87.637330][ T5933] usb 5-1: 2:1 : sample bitwidth 100 in over sample bytes 2 [ 87.653028][ T5933] usb 5-1: 2:1: cannot set freq 16101201 to ep 0x82 [ 88.057304][ T6150] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 88.239158][ T5933] usb 5-1: USB disconnect, device number 3 [ 88.259100][ T6167] netlink: 5 bytes leftover after parsing attributes in process `syz.1.53'. [ 88.268221][ T6167] 0ªX¹¦D: renamed from macvtap0 (while UP) [ 88.304261][ T30] audit: type=1400 audit(1756135015.122:198): avc: denied { connect } for pid=6162 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 88.403363][ T6167] 0ªX¹¦D: entered allmulticast mode [ 88.428010][ T6167] veth0_macvtap: entered allmulticast mode [ 88.517229][ T6167] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 88.617964][ T6167] hub 1-0:1.0: USB hub found [ 88.624251][ T6167] hub 1-0:1.0: 1 port detected [ 88.653815][ T30] audit: type=1400 audit(1756135015.512:199): avc: denied { read write } for pid=6162 comm="syz.1.53" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 91.456319][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 91.456334][ T30] audit: type=1400 audit(1756135018.312:203): avc: denied { nlmsg_write } for pid=6201 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 91.498860][ T30] audit: type=1400 audit(1756135018.352:204): avc: denied { create } for pid=6201 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 91.518008][ C0] vkms_vblank_simulate: vblank timer overrun [ 91.531742][ T30] audit: type=1400 audit(1756135018.352:205): avc: denied { setopt } for pid=6201 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 91.551391][ C0] vkms_vblank_simulate: vblank timer overrun [ 91.560982][ T30] audit: type=1400 audit(1756135018.352:206): avc: denied { write } for pid=6201 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 91.656712][ T5969] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 91.917256][ T5969] usb 4-1: Using ep0 maxpacket: 8 [ 92.221794][ T5969] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 92.233238][ T6210] netlink: 'syz.2.66': attribute type 36 has an invalid length. [ 92.234399][ T30] audit: type=1400 audit(1756135019.082:207): avc: denied { setopt } for pid=6203 comm="syz.2.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 92.279307][ T5969] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 92.288618][ T5969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.299792][ T5969] usb 4-1: Product: syz [ 92.304036][ T5969] usb 4-1: Manufacturer: syz [ 92.305621][ T30] audit: type=1400 audit(1756135019.132:208): avc: denied { read } for pid=6203 comm="syz.2.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 92.310728][ T5969] usb 4-1: SerialNumber: syz [ 92.610028][ T5969] usb 4-1: config 0 descriptor?? [ 92.624602][ T5969] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 92.667255][ T5969] usb 4-1: setting power ON [ 92.671791][ T5969] dvb-usb: bulk message failed: -22 (2/0) [ 93.388297][ T5969] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 93.398311][ T5969] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 93.407574][ T5969] usb 4-1: media controller created [ 93.446419][ T5969] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 93.447126][ T6200] delete_channel: no stack [ 93.487454][ T5969] usb 4-1: selecting invalid altsetting 6 [ 93.495139][ T5969] usb 4-1: digital interface selection failed (-22) [ 93.514666][ T5969] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 93.560359][ T5969] usb 4-1: setting power OFF [ 93.564984][ T5969] dvb-usb: bulk message failed: -22 (2/0) [ 93.597085][ T5969] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 93.617126][ T6217] input: syz0 as /devices/virtual/input/input6 [ 93.806687][ T5969] (NULL device *): no alternate interface [ 94.442363][ T5969] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 94.590666][ T6224] netlink: 'syz.1.65': attribute type 36 has an invalid length. [ 95.357355][ T30] audit: type=1400 audit(1756135022.212:209): avc: denied { read } for pid=6228 comm="syz.4.72" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 96.774291][ T30] audit: type=1400 audit(1756135022.242:210): avc: denied { open } for pid=6228 comm="syz.4.72" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 97.241780][ T30] audit: type=1400 audit(1756135023.812:211): avc: denied { create } for pid=6228 comm="syz.4.72" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 97.326148][ T30] audit: type=1400 audit(1756135023.862:212): avc: denied { bind } for pid=6228 comm="syz.4.72" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 97.627361][ T30] audit: type=1400 audit(1756135024.482:213): avc: denied { write } for pid=6233 comm="syz.4.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 97.649201][ T5925] usb 4-1: USB disconnect, device number 6 [ 97.784892][ T6240] kvm: pic: non byte read [ 97.790917][ T6240] kvm: pic: level sensitive irq not supported [ 97.791002][ T6240] kvm: pic: non byte read [ 97.801793][ T6240] kvm: pic: level sensitive irq not supported [ 97.801851][ T6240] kvm: pic: non byte read [ 97.812676][ T6240] kvm: pic: level sensitive irq not supported [ 97.812735][ T6240] kvm: pic: non byte read [ 97.823542][ T6240] kvm: pic: level sensitive irq not supported [ 97.823598][ T6240] kvm: pic: non byte read [ 97.834381][ T6240] kvm: pic: level sensitive irq not supported [ 97.834436][ T6240] kvm: pic: non byte read [ 97.845900][ T6240] kvm: pic: level sensitive irq not supported [ 97.845956][ T6240] kvm: pic: non byte read [ 97.857288][ T6240] kvm: pic: level sensitive irq not supported [ 97.857344][ T6240] kvm: pic: non byte read [ 97.868204][ T6240] kvm: pic: level sensitive irq not supported [ 97.868268][ T6240] kvm: pic: non byte read [ 98.375420][ T30] audit: type=1400 audit(1756135024.962:214): avc: denied { write } for pid=6241 comm="syz.1.76" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 98.782972][ T30] audit: type=1400 audit(1756135024.972:215): avc: denied { create } for pid=6241 comm="syz.1.76" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 98.895932][ T30] audit: type=1400 audit(1756135025.002:216): avc: denied { setopt } for pid=6241 comm="syz.1.76" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 99.372885][ T30] audit: type=1400 audit(1756135025.992:217): avc: denied { mount } for pid=6252 comm="syz.1.79" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 99.394905][ C1] vkms_vblank_simulate: vblank timer overrun [ 99.450700][ T30] audit: type=1400 audit(1756135026.062:218): avc: denied { ioctl } for pid=6252 comm="syz.1.79" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 99.506964][ T5932] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 99.666780][ T5932] usb 5-1: Using ep0 maxpacket: 8 [ 99.678381][ T5932] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 99.690290][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.997808][ T5932] pvrusb2: Hardware description: Terratec Grabster AV400 [ 100.004868][ T5932] pvrusb2: ********** [ 100.037004][ T5932] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 100.052824][ T5932] pvrusb2: Important functionality might not be entirely working. [ 100.061232][ T5932] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 100.075815][ T6251] : renamed from bridge_slave_0 (while UP) [ 100.083180][ T5932] pvrusb2: ********** [ 100.083178][ T30] audit: type=1400 audit(1756135026.882:219): avc: denied { create } for pid=6250 comm="syz.4.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 100.171743][ T6269] netlink: 'syz.1.82': attribute type 1 has an invalid length. [ 100.187326][ T6270] input: syz0 as /devices/virtual/input/input7 [ 101.306716][ T3091] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 101.458373][ T3091] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.489359][ T3091] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.516435][ T3091] usb 1-1: New USB device found, idVendor=046d, idProduct=c294, bcdDevice= 0.00 [ 102.116997][ T3091] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.141726][ T3091] usb 1-1: config 0 descriptor?? [ 102.199171][ T5932] usb 5-1: USB disconnect, device number 4 [ 102.212001][ T2333] pvrusb2: Invalid write control endpoint [ 102.299279][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 102.299294][ T30] audit: type=1400 audit(1756135029.162:240): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 102.360069][ T6283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.370257][ T30] audit: type=1400 audit(1756135029.222:241): avc: denied { read write } for pid=6282 comm="syz.0.85" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 102.423382][ T6283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.457400][ T2333] pvrusb2: Invalid write control endpoint [ 102.463271][ T2333] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 102.492134][ T30] audit: type=1400 audit(1756135029.222:242): avc: denied { open } for pid=6282 comm="syz.0.85" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 102.515085][ C1] vkms_vblank_simulate: vblank timer overrun [ 102.564042][ T30] audit: type=1400 audit(1756135029.222:243): avc: denied { ioctl } for pid=6282 comm="syz.0.85" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x4c04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 103.114833][ T2333] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 103.124588][ T2333] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 103.134711][ T2333] pvrusb2: Device being rendered inoperable [ 103.143800][ T2333] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 103.173263][ T2333] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 103.279970][ T2333] pvrusb2: Attached sub-driver cx25840 [ 103.285561][ T2333] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 103.326217][ T30] audit: type=1400 audit(1756135030.182:244): avc: denied { map } for pid=6282 comm="syz.0.85" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 103.348918][ C1] vkms_vblank_simulate: vblank timer overrun [ 103.362280][ T2333] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 103.790732][ T6319] netlink: 'syz.1.88': attribute type 10 has an invalid length. [ 103.798696][ T6319] netlink: 40 bytes leftover after parsing attributes in process `syz.1.88'. [ 103.809148][ T6319] dummy0: entered promiscuous mode [ 103.865670][ T6319] bridge0: port 3(dummy0) entered blocking state [ 103.873412][ T6319] bridge0: port 3(dummy0) entered disabled state [ 103.881430][ T6319] dummy0: entered allmulticast mode [ 103.964578][ T6319] bridge0: port 3(dummy0) entered blocking state [ 103.971159][ T6319] bridge0: port 3(dummy0) entered forwarding state [ 104.224246][ T30] audit: type=1400 audit(1756135030.642:245): avc: denied { create } for pid=6310 comm="syz.1.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 104.243667][ C1] vkms_vblank_simulate: vblank timer overrun [ 104.254865][ T30] audit: type=1400 audit(1756135031.082:246): avc: denied { sys_module } for pid=6308 comm="syz.2.89" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 105.187674][ T3091] usbhid 1-1:0.0: can't add hid device: -71 [ 105.214833][ T3091] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 105.226863][ T5932] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 105.453339][ T3091] usb 1-1: USB disconnect, device number 3 [ 105.459445][ T5932] usb 5-1: Using ep0 maxpacket: 16 [ 105.723880][ T5932] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.789777][ T5932] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 105.833797][ T30] audit: type=1400 audit(1756135032.692:247): avc: denied { ioctl } for pid=6340 comm="syz.1.94" path="socket:[10469]" dev="sockfs" ino=10469 ioctlcmd=0x660f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 105.876858][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.908604][ T5932] usb 5-1: config 0 descriptor?? [ 106.096937][ T30] audit: type=1400 audit(1756135032.952:248): avc: denied { mount } for pid=6348 comm="syz.1.96" name="/" dev="overlay" ino=124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 106.118684][ C1] vkms_vblank_simulate: vblank timer overrun [ 106.420661][ T5932] mcp2221 0003:04D8:00DD.0001: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 106.614213][ C0] ================================================================== [ 106.622314][ C0] BUG: KASAN: use-after-free in mcp2221_raw_event+0xf94/0x1030 [ 106.629912][ C0] Read of size 1 at addr ffff888056783fff by task sed/6359 [ 106.637133][ C0] [ 106.639475][ C0] CPU: 0 UID: 0 PID: 6359 Comm: sed Not tainted syzkaller #0 PREEMPT(full) [ 106.639503][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 106.639515][ C0] Call Trace: [ 106.639520][ C0] [ 106.639527][ C0] dump_stack_lvl+0x116/0x1f0 [ 106.639553][ C0] print_report+0xcd/0x630 [ 106.639572][ C0] ? __virt_addr_valid+0x81/0x610 [ 106.639596][ C0] ? __phys_addr+0xe8/0x180 [ 106.639618][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 106.639644][ C0] kasan_report+0xe0/0x110 [ 106.639666][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 106.639690][ C0] mcp2221_raw_event+0xf94/0x1030 [ 106.639712][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 106.639732][ C0] __hid_input_report.constprop.0+0x311/0x450 [ 106.639750][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 106.639774][ C0] hid_irq_in+0x35e/0x870 [ 106.639799][ C0] __usb_hcd_giveback_urb+0x38b/0x610 [ 106.639828][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 106.639850][ C0] dummy_timer+0x1814/0x3a30 [ 106.639875][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 106.639890][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 106.639904][ C0] ? mark_held_locks+0x49/0x80 [ 106.639927][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 106.639940][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 106.639950][ C0] __hrtimer_run_queues+0x1ff/0xad0 [ 106.639966][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 106.639978][ C0] ? read_tsc+0x9/0x20 [ 106.639993][ C0] hrtimer_run_softirq+0x17d/0x350 [ 106.640006][ C0] handle_softirqs+0x216/0x8e0 [ 106.640020][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 106.640034][ C0] __irq_exit_rcu+0x109/0x170 [ 106.640047][ C0] irq_exit_rcu+0x9/0x30 [ 106.640059][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 106.640070][ C0] [ 106.640073][ C0] [ 106.640077][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 106.640089][ C0] RIP: 0010:lock_acquire+0x62/0x350 [ 106.640106][ C0] Code: a9 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 52 84 13 0f 0f 82 74 02 00 00 8b 35 0a b6 13 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 a9 a8 3e 12 0f 85 c7 02 00 00 48 83 c4 [ 106.640116][ C0] RSP: 0000:ffffc9000c1afa60 EFLAGS: 00000206 [ 106.640126][ C0] RAX: 0000000000000046 RBX: ffff8880b8433340 RCX: ffffffff93e31c00 [ 106.640133][ C0] RDX: 0000000000000000 RSI: ffffffff8de2ace0 RDI: ffffffff8c162900 [ 106.640139][ C0] RBP: 0000000000000000 R08: 65e71314f7a92863 R09: 0000000000000001 [ 106.640145][ C0] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001 [ 106.640157][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 106.640168][ C0] ? rcu_read_unlock+0x17/0x60 [ 106.640183][ C0] __folio_batch_add_and_move+0x6b3/0xc90 [ 106.640197][ C0] ? __folio_batch_add_and_move+0x698/0xc90 [ 106.640209][ C0] ? __pfx_lru_add+0x10/0x10 [ 106.640220][ C0] ? const_folio_flags+0x5b/0x100 [ 106.640231][ C0] folio_add_lru_vma+0xb0/0x100 [ 106.640245][ C0] do_wp_page+0x16c7/0x4f00 [ 106.640262][ C0] ? __pfx_do_wp_page+0x10/0x10 [ 106.640276][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 106.640287][ C0] ? ___pte_offset_map+0x2ad/0x4f0 [ 106.640303][ C0] __handle_mm_fault+0x1b2d/0x2a50 [ 106.640322][ C0] ? __pfx___handle_mm_fault+0x10/0x10 [ 106.640338][ C0] ? lock_vma_under_rcu+0x1eb/0x530 [ 106.640356][ C0] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 106.640374][ C0] handle_mm_fault+0x589/0xd10 [ 106.640390][ C0] ? __bpf_trace_exceptions+0x1/0x40 [ 106.640407][ C0] do_user_addr_fault+0x60c/0x1370 [ 106.640418][ C0] ? rcu_is_watching+0x12/0xc0 [ 106.640432][ C0] exc_page_fault+0x5c/0xb0 [ 106.640443][ C0] asm_exc_page_fault+0x26/0x30 [ 106.640452][ C0] RIP: 0033:0x7f28ede9f8ec [ 106.640461][ C0] Code: 1f 80 00 00 00 00 48 8b 31 8b 51 08 4c 01 fe 48 83 fa 26 74 0a 48 83 fa 08 0f 85 ef 3c ff ff 48 8b 51 10 48 83 c1 18 4c 01 fa <48> 89 16 48 39 d9 72 d4 4d 8b 9a 08 02 00 00 4d 85 db 0f 84 ec 0b [ 106.640471][ C0] RSP: 002b:00007fff39db65e0 EFLAGS: 00010206 [ 106.640479][ C0] RAX: 00007f28eddc7cd0 RBX: 00007f28eddd1280 RCX: 00007f28eddcdd40 [ 106.640485][ C0] RDX: 00007f28eddd7a00 RSI: 00007f28ede840f0 RDI: 00007f28eddd54c8 [ 106.640492][ C0] RBP: 00007fff39db6700 R08: 00007f28eddd2f90 R09: 00007f28eddd54c8 [ 106.640498][ C0] R10: 00007f28ede880c0 R11: 0000000000000000 R12: 00007fff39db6690 [ 106.640505][ C0] R13: 00007fff39db6690 R14: 00007f28ede880c0 R15: 00007f28eddc6000 [ 106.640514][ C0] [ 106.640518][ C0] [ 107.067144][ C0] The buggy address belongs to the physical page: [ 107.073525][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56783 [ 107.082261][ C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 107.089352][ C0] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 107.097904][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 107.106449][ C0] page dumped because: kasan: bad access detected [ 107.112827][ C0] page_owner tracks the page as freed [ 107.118162][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13, tgid 13 (kworker/u8:1), ts 67793357079, free_ts 81869054325 [ 107.138528][ C0] post_alloc_hook+0x1c0/0x230 [ 107.143271][ C0] get_page_from_freelist+0x132b/0x38e0 [ 107.148789][ C0] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 107.154649][ C0] alloc_pages_mpol+0x1fb/0x550 [ 107.159469][ C0] new_slab+0x247/0x330 [ 107.163606][ C0] ___slab_alloc+0xcf2/0x1740 [ 107.168264][ C0] __slab_alloc.constprop.0+0x56/0xb0 [ 107.173607][ C0] kmem_cache_alloc_node_noprof+0xf5/0x3b0 [ 107.179389][ C0] kmalloc_reserve+0x18b/0x2c0 [ 107.184127][ C0] __alloc_skb+0x166/0x380 [ 107.188510][ C0] inet6_rt_notify+0x1e0/0x4b0 [ 107.193245][ C0] fib6_add_rt2node+0x24ba/0x3670 [ 107.198252][ C0] fib6_add+0x628/0x1d90 [ 107.202465][ C0] ip6_ins_rt+0xb5/0x110 [ 107.206674][ C0] __ipv6_ifa_notify+0xa73/0xd60 [ 107.211582][ C0] addrconf_dad_completed+0x19a/0x10d0 [ 107.217115][ C0] page last free pid 5866 tgid 5866 stack trace: [ 107.223408][ C0] __free_frozen_pages+0x7d5/0x10f0 [ 107.228582][ C0] __put_partials+0x165/0x1c0 [ 107.233233][ C0] qlist_free_all+0x4d/0x120 [ 107.237792][ C0] kasan_quarantine_reduce+0x195/0x1e0 [ 107.243217][ C0] __kasan_slab_alloc+0x69/0x90 [ 107.248036][ C0] kmem_cache_alloc_node_noprof+0x1d5/0x3b0 [ 107.253898][ C0] __alloc_skb+0x2b2/0x380 [ 107.258284][ C0] alloc_skb_with_frags+0xe0/0x860 [ 107.263364][ C0] sock_alloc_send_pskb+0x7fb/0x990 [ 107.268542][ C0] unix_dgram_sendmsg+0x3e9/0x17f0 [ 107.273625][ C0] sock_write_iter+0x4ff/0x5b0 [ 107.278361][ C0] vfs_write+0x7d0/0x11d0 [ 107.282663][ C0] ksys_write+0x1f8/0x250 [ 107.286962][ C0] do_syscall_64+0xcd/0x4c0 [ 107.291435][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.297297][ C0] [ 107.299590][ C0] Memory state around the buggy address: [ 107.305186][ C0] ffff888056783e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 107.313223][ C0] ffff888056783f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 107.321261][ C0] >ffff888056783f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 107.329287][ C0] ^ [ 107.337231][ C0] ffff888056784000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 107.345284][ C0] ffff888056784080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 107.353331][ C0] ================================================================== [ 107.361372][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 107.368549][ C0] CPU: 0 UID: 0 PID: 6359 Comm: sed Not tainted syzkaller #0 PREEMPT(full) [ 107.377192][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 107.387244][ C0] Call Trace: [ 107.390506][ C0] [ 107.393323][ C0] dump_stack_lvl+0x3d/0x1f0 [ 107.397900][ C0] vpanic+0x6e8/0x7a0 [ 107.401864][ C0] ? __pfx_vpanic+0x10/0x10 [ 107.406343][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 107.411342][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 107.416515][ C0] panic+0xca/0xd0 [ 107.420211][ C0] ? __pfx_panic+0x10/0x10 [ 107.424602][ C0] ? end_report+0x4c/0x170 [ 107.428991][ C0] ? rcu_is_watching+0x12/0xc0 [ 107.433737][ C0] ? lock_release+0x201/0x2f0 [ 107.438399][ C0] check_panic_on_warn+0xab/0xb0 [ 107.443317][ C0] end_report+0x107/0x170 [ 107.447629][ C0] kasan_report+0xee/0x110 [ 107.452026][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 107.457206][ C0] mcp2221_raw_event+0xf94/0x1030 [ 107.462202][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 107.467980][ C0] __hid_input_report.constprop.0+0x311/0x450 [ 107.474017][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 107.479459][ C0] hid_irq_in+0x35e/0x870 [ 107.483763][ C0] __usb_hcd_giveback_urb+0x38b/0x610 [ 107.489111][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 107.494283][ C0] dummy_timer+0x1814/0x3a30 [ 107.498865][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 107.503793][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 107.508709][ C0] ? mark_held_locks+0x49/0x80 [ 107.513462][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 107.519254][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 107.524166][ C0] __hrtimer_run_queues+0x1ff/0xad0 [ 107.529341][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 107.535031][ C0] ? read_tsc+0x9/0x20 [ 107.539083][ C0] hrtimer_run_softirq+0x17d/0x350 [ 107.544167][ C0] handle_softirqs+0x216/0x8e0 [ 107.548917][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 107.554176][ C0] __irq_exit_rcu+0x109/0x170 [ 107.558826][ C0] irq_exit_rcu+0x9/0x30 [ 107.563051][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 107.568664][ C0] [ 107.571583][ C0] [ 107.574493][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 107.580451][ C0] RIP: 0010:lock_acquire+0x62/0x350 [ 107.585642][ C0] Code: a9 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 52 84 13 0f 0f 82 74 02 00 00 8b 35 0a b6 13 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 a9 a8 3e 12 0f 85 c7 02 00 00 48 83 c4 [ 107.605219][ C0] RSP: 0000:ffffc9000c1afa60 EFLAGS: 00000206 [ 107.611266][ C0] RAX: 0000000000000046 RBX: ffff8880b8433340 RCX: ffffffff93e31c00 [ 107.619207][ C0] RDX: 0000000000000000 RSI: ffffffff8de2ace0 RDI: ffffffff8c162900 [ 107.627148][ C0] RBP: 0000000000000000 R08: 65e71314f7a92863 R09: 0000000000000001 [ 107.635089][ C0] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001 [ 107.643039][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 107.650985][ C0] ? rcu_read_unlock+0x17/0x60 [ 107.655735][ C0] __folio_batch_add_and_move+0x6b3/0xc90 [ 107.661435][ C0] ? __folio_batch_add_and_move+0x698/0xc90 [ 107.667309][ C0] ? __pfx_lru_add+0x10/0x10 [ 107.671871][ C0] ? const_folio_flags+0x5b/0x100 [ 107.676869][ C0] folio_add_lru_vma+0xb0/0x100 [ 107.681691][ C0] do_wp_page+0x16c7/0x4f00 [ 107.686169][ C0] ? __pfx_do_wp_page+0x10/0x10 [ 107.690991][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 107.696332][ C0] ? ___pte_offset_map+0x2ad/0x4f0 [ 107.701425][ C0] __handle_mm_fault+0x1b2d/0x2a50 [ 107.706524][ C0] ? __pfx___handle_mm_fault+0x10/0x10 [ 107.711957][ C0] ? lock_vma_under_rcu+0x1eb/0x530 [ 107.717133][ C0] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 107.722664][ C0] handle_mm_fault+0x589/0xd10 [ 107.727402][ C0] ? __bpf_trace_exceptions+0x1/0x40 [ 107.732663][ C0] do_user_addr_fault+0x60c/0x1370 [ 107.737757][ C0] ? rcu_is_watching+0x12/0xc0 [ 107.742506][ C0] exc_page_fault+0x5c/0xb0 [ 107.746983][ C0] asm_exc_page_fault+0x26/0x30 [ 107.751823][ C0] RIP: 0033:0x7f28ede9f8ec [ 107.756208][ C0] Code: 1f 80 00 00 00 00 48 8b 31 8b 51 08 4c 01 fe 48 83 fa 26 74 0a 48 83 fa 08 0f 85 ef 3c ff ff 48 8b 51 10 48 83 c1 18 4c 01 fa <48> 89 16 48 39 d9 72 d4 4d 8b 9a 08 02 00 00 4d 85 db 0f 84 ec 0b [ 107.775797][ C0] RSP: 002b:00007fff39db65e0 EFLAGS: 00010206 [ 107.781850][ C0] RAX: 00007f28eddc7cd0 RBX: 00007f28eddd1280 RCX: 00007f28eddcdd40 [ 107.789798][ C0] RDX: 00007f28eddd7a00 RSI: 00007f28ede840f0 RDI: 00007f28eddd54c8 [ 107.797750][ C0] RBP: 00007fff39db6700 R08: 00007f28eddd2f90 R09: 00007f28eddd54c8 [ 107.805702][ C0] R10: 00007f28ede880c0 R11: 0000000000000000 R12: 00007fff39db6690 [ 107.813739][ C0] R13: 00007fff39db6690 R14: 00007f28ede880c0 R15: 00007f28eddc6000 [ 107.821695][ C0] [ 107.824918][ C0] Kernel Offset: disabled [ 107.829215][ C0] Rebooting in 86400 seconds..