last executing test programs: 17m23.783320555s ago: executing program 2 (id=1186): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi0\x00', 0x8080, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, &(0x7f0000bbdffc)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r3, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40)=ANY=[@ANYBLOB="0200000000000000000000000400000000"], 0x24, 0x0) rmdir(&(0x7f0000000040)='./bus\x00') creat(0x0, 0x248) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000009000000030000004f0c000001000000", @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000540)={'c6xdigio\x00', [0x109, 0x80008000, 0x86c, 0xa, 0x0, 0x0, 0x1, 0xf, 0x1000, 0x1, 0x8, 0x5, 0x6, 0x1, 0x1138fce9, 0x6, 0xffffffa7, 0x2000001, 0xfffffffd, 0x65c, 0x3ff, 0x10004, 0x800, 0xe2df, 0x9, 0x6, 0x4, 0x3, 0x7, 0x5, 0x5]}) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8, 0x12, r1, 0xfae76000) r4 = socket(0x5, 0x1, 0xf9d5) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000011}, 0x0) 17m22.564834699s ago: executing program 2 (id=1188): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f0000000040)=ANY=[], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) mlockall(0x7) 17m20.619672529s ago: executing program 2 (id=1191): socket$inet_sctp(0x2, 0x5, 0x84) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x840000000002, 0x3, 0xff) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0xfffffffffffffffd, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7ffffffc}, 0x0, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) 17m17.008041159s ago: executing program 2 (id=1195): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = getpgid(0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) syz_pidfd_open(r0, 0x0) setns(0xffffffffffffffff, 0x66020000) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 17m16.468243731s ago: executing program 2 (id=1197): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f0000000140)='./file1\x00', 0x1bb) 17m16.138851768s ago: executing program 2 (id=1201): socket$packet(0x11, 0x3, 0x300) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r3, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r3, 0x40044620, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x11, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bind$packet(r7, &(0x7f00000001c0)={0x11, 0x0, r9, 0x1, 0x2, 0x6, @broadcast}, 0x14) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x40, 0x28, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xffffff01, 0xb7c56ad10922c48a, 0x3}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40098}, 0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x4}, 0x8) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8, @loopback, 0x7}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000100)='e', 0x1}], 0x1}, 0x4048043) 17m15.617909388s ago: executing program 32 (id=1201): socket$packet(0x11, 0x3, 0x300) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r3, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r3, 0x40044620, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x11, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bind$packet(r7, &(0x7f00000001c0)={0x11, 0x0, r9, 0x1, 0x2, 0x6, @broadcast}, 0x14) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x40, 0x28, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xffffff01, 0xb7c56ad10922c48a, 0x3}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40098}, 0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x4}, 0x8) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8, @loopback, 0x7}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000100)='e', 0x1}], 0x1}, 0x4048043) 13m35.270721294s ago: executing program 1 (id=1751): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x101882, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$packet(0x11, 0x3, 0x300) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x3ff}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0xfffffdef}}, 0x40045) recvfrom(r3, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4112, 0x0, 0x0) 13m34.277161357s ago: executing program 1 (id=1757): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x388, &(0x7f0000000040)={[{0x39, 0x4e00, "f6c33e93a5f00fe2768e2ec4d40a962be752ba6f758c0379a4303c794af325fe16683dbac6e064a3b42d24660a3daaffc85835f13cfaf87292"}, {0xd5, 0x4e00, "e653976d45b679004db1a84444130b9713ed5296e8e4158a598c00e578daca42919aac61ca87c7d48182c944fd6ce0766f27aaa6f823ac90b8759ca20e6c9ad164f8ba3d46fdc471031b03ba9f6d7d749f317fa299e6c73eee384b51595e62e9489cc5318f70f977b683f4b1a3341cd9b4a9c7e7749643fe263a5832de8bf281d99f3825d253a125e13e5a86dfe7e6fac0aedfa28d9b6ac9978cdbf0a268cb62424b9095c0fc6822c7ff8409fcaa715887719ebfbffbc91a7dda206a6afa948f034f56df29bf60a6a1ee7eb09fa41226eaecec57a5"}, {0x49, 0x4e00, "d9a636f4ccb02ac8ef3a2992de19d2b1416b2344b467d9f09ff0ee40f70820116b496a459bf8fdd6a6e8c0fdb82a5974a21b75e6bc2d0efa200fafcc9d266066e37699818314c41ad8"}, {0x13, 0x4e00, "0920ca5c143f6924fea94289ab988586ca6006"}, {}, {0x4d, 0x4e00, "786f0b2b7c2e7314a98a62cd22694a653b8992bb181ac7e621af77f3258dd22a8bb59c2a74e82cd700a9c134c040d842b1f6cc5abd069beffeb31bd880ad562654fc55b022a30c249afa4a0bf6"}, {0xeb, 0x4e00, "8867a964faa2f2dfad05aa35071c1784b4f528784e73c525e379abc9766ea8083063f40978782ade985632fa009ea25c05385012106812a94f43b7a0ac71cd7ea99c1c37c342e2382ae54284cf3ce237f4208ac05f1204bd641148c6a355c874ee7d6f5bfd0b95e3a57a5ece81fc9527141512199716ffd80c64c7a9cbe7da4e813e433129958e6617a15111daeccbc162d707f688d7d27573c6db51a5bab78ec6a6a7708fdadf5098c59b8f6ec3ac7c61ac2e343c1524e5c3d31f1d5f9789205c017093c0559e31ae20d0e94c2becfe766a9825d07fef73e65fe80974a3f23220f5f8c59fe1e190ae400c"}, {0xb8, 0x4e00, "b9bdf376c7950d99f810b878aaa0e396bdddc345317d33598ec2922c083fe4c408b85d83a7f8aa8f523e13b6132470b3e987d9f27276feec064e1e139f950e5c547441bed2ecf47e210a8822591be0de00125544172b2030fcde1bde4c33050ce1e47b4c5cf3cacd4a0bab89432e714e31f0bf4a045441ba627599af6b9fb2a43cecc5d280b393ad575b13ab226859bf76fce0ce2674ee7a7c4ed22111b38d786ab855eb66aa5c4fb7b4a1375c70e2694498256cba2438d3"}]}) r1 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000780)=@conn_svc_rsp={0x0, 0x0, 0xa, "ba24c753", {0x3, 0x107, 0x0, 0x4, 0x0, 0x28, 0xc5}}) r2 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_clone3(0x0, 0x0) getpriority(0x1, r6) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="e43f6642531e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0xe000, 0x2, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x1, 0x1, 0x10, 0x0, @void}}}}}}}, 0x0) write$sequencer(r1, 0x0, 0x8) 13m29.755705373s ago: executing program 1 (id=1763): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x8000000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f00000002c0)=@framed={{}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) utimensat(0xffffffffffffffff, 0x0, &(0x7f0000000880)={{0x77359400}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) unshare(0x60060200) 13m26.645562839s ago: executing program 1 (id=1768): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = getpgid(0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) syz_pidfd_open(r0, 0x0) setns(0xffffffffffffffff, 0x66020000) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 13m26.399840628s ago: executing program 1 (id=1772): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01080000000000000000010000000900"], 0xd0}}, 0x0) acct(0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000020301040000000000000000000000000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r5, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)={0x20, 0x1, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc}]}, 0x20}}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600, 0x0, 0x2000]}}], 0xffc8) 13m26.290014206s ago: executing program 1 (id=1773): ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_audit(0x10, 0x3, 0x9) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r7, 0x1, 0x5, 0x0, 0x0) sendmsg$inet(r7, 0x0, 0x4008040) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000ba08eba177024999b210d99249c091fddaa84578300e8fe07d32f4b4c40a0301020000000000000000010001000000d9ccfd1e7b21e3f0f4497890309806480951b24288c9745d88a7777ead83623e69eb198dc46174cb25a55917944683f17f81e3c09f590c34db4c884522d271751ed875ac23780d35dec0406d6b7132257424db54a578c9e6a039076d0db4781dce1ab5287076e3ef2d69ce59a9ff947db7f132713aeaae2ec58439989ec0bcd578194e01"], 0x1c}}, 0x4090) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000d40)=@nat={'nat\x00', 0x2, 0x5, 0x4b0, 0x0, 0xf0, 0xffffffff, 0x0, 0x310, 0x3e0, 0x3e0, 0xffffffff, 0x3e0, 0x3e0, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @remote, [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x510) sched_setaffinity(0x0, 0x0, 0x0) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) 13m26.04968367s ago: executing program 33 (id=1773): ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_audit(0x10, 0x3, 0x9) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r7, 0x1, 0x5, 0x0, 0x0) sendmsg$inet(r7, 0x0, 0x4008040) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000ba08eba177024999b210d99249c091fddaa84578300e8fe07d32f4b4c40a0301020000000000000000010001000000d9ccfd1e7b21e3f0f4497890309806480951b24288c9745d88a7777ead83623e69eb198dc46174cb25a55917944683f17f81e3c09f590c34db4c884522d271751ed875ac23780d35dec0406d6b7132257424db54a578c9e6a039076d0db4781dce1ab5287076e3ef2d69ce59a9ff947db7f132713aeaae2ec58439989ec0bcd578194e01"], 0x1c}}, 0x4090) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000d40)=@nat={'nat\x00', 0x2, 0x5, 0x4b0, 0x0, 0xf0, 0xffffffff, 0x0, 0x310, 0x3e0, 0x3e0, 0xffffffff, 0x3e0, 0x3e0, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @remote, [], [], 'batadv0\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x510) sched_setaffinity(0x0, 0x0, 0x0) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) 2m39.194301095s ago: executing program 0 (id=3579): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x80001, 0x0) ioctl$TIOCSRS485(r0, 0x542f, 0x0) 2m37.912496547s ago: executing program 0 (id=3581): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x14, 0x26, 0xffff, 0x70bd2b}, 0x14}}, 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_getevents(r1, 0x4, 0x3, &(0x7f0000000400)=[{}, {}, {}], 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f00000000c0)=0x6, 0x4) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x54, 0x0, 0x4, @local}, 0x10) io_pgetevents(r1, 0xd, 0x4, &(0x7f0000000340)=[{}, {}, {}, {}], &(0x7f0000000080)={0x77359400}, &(0x7f00000003c0)={&(0x7f00000001c0)={[0x9]}, 0x8}) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r4, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1b, 0x3, 0x4}) sendmmsg$inet6(r3, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 2m37.082592721s ago: executing program 0 (id=3586): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000600)=0x14) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000080)=0x14) pause() r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x100, 0x0) setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1d) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000084}, 0x4800) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="38000000200025a729bd7000fddbdf250a0010cdff00000102000100080006000000000014000200fc00000000000000000000000000000142e70747e0826d720ca74d26e3e41d75e1d1819790ab16a3d4ca1c8fa85ce8"], 0x38}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x109942, 0x0) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, &(0x7f0000000580)) ioctl$PPPIOCSACTIVE(r9, 0x40107446, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6, 0xcd, 0x8}]}) ioctl$PPPIOCSACTIVE(r9, 0x40107446, &(0x7f0000000080)={0x0, 0x0}) 2m32.566337872s ago: executing program 0 (id=3597): r0 = socket(0x10, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) (fail_nth: 2) 2m31.941850529s ago: executing program 0 (id=3600): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x20100, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000004c0), 0x101c02, 0x0) readv(r5, &(0x7f0000003900)=[{&(0x7f0000002900)=""/4096, 0x1000}], 0x1) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r6, &(0x7f0000000040)={0x23, 0x1, 0x9, 0xfe}, 0x10) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) syz_open_pts(r7, 0x80000) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000040)={0x283}) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000300)={0x0, @bt={0x7, 0x3ff, 0x0, 0x3, 0x9, 0xd, 0x2, 0x2, 0x8, 0x3ff, 0x9, 0x80000001, 0xe1b, 0x7, 0x13, 0x5, {0x0, 0x2}, 0x0, 0x6}}) 2m30.544013835s ago: executing program 0 (id=3604): openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000080)='udf\x00', 0x2008087, 0x0) 2m15.481455604s ago: executing program 34 (id=3604): openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000080)='udf\x00', 0x2008087, 0x0) 10.794819673s ago: executing program 7 (id=3999): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x20100, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0x24000044) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0x1}}, 0x20) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, 0x0, 0x0) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000004c0), 0x101c02, 0x0) readv(r7, &(0x7f0000003900)=[{&(0x7f0000002900)=""/4096, 0x1000}], 0x1) ioctl$VIDIOC_ENUMSTD(r7, 0xc0485619, &(0x7f0000000280)={0x0, 0x4000, "0425195da2fc9bd3231ce497938c6549648815a6e67ab6de", {0x5, 0x7}, 0xfffffffe}) r8 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r8, &(0x7f0000000040)={0x23, 0x1, 0x9, 0xfe}, 0x10) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) syz_open_pts(r9, 0x80000) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000040)={0x283}) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000300)={0x0, @bt={0x7, 0x3ff, 0x0, 0x3, 0x9, 0xd, 0x2, 0x2, 0x8, 0x3ff, 0x9, 0x80000001, 0xe1b, 0x7, 0x13, 0x5, {0x0, 0x2}, 0x0, 0x6}}) 9.197210576s ago: executing program 7 (id=4004): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) sendto$inet(r1, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) 7.563862292s ago: executing program 6 (id=4012): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x53b, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_simple={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x9f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4060040}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000000000010000000a000000090002008d001f106f194eb3050001"], 0x30}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={0x0, 0x268}, 0x1, 0x0, 0x0, 0x9231c4a7561e4693}, 0x840) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xe}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x8, 0xf}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 7.42185536s ago: executing program 4 (id=4013): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x141842, 0x8) r1 = io_uring_setup(0x3a19, &(0x7f0000000240)={0x0, 0xcb6c, 0x5042, 0x3, 0x227, 0x0, r0}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000480), 0x66) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000480)={0xa, @pix={0x9, 0x1, 0x41414770, 0x0, 0x7ff, 0xffff, 0xa, 0x9, 0x1, 0x7, 0x0, 0x6}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvfrom$unix(r4, &(0x7f0000001e00)=""/4096, 0x1000, 0x10000, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000701fefffffffeffffff017c0000040042800c00018006000600800a0000140002801000"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x6b0d, 0x8, 0x1, 'queue0\x00', 0x8000}) socket$netlink(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t'], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800110000ec3be630bc58ebef3b41b8a3007af21e8f04934e2262c5a471e84bcbb8ba4ab87de8628923b6e5f7e54d5b497df520c85a3b65283f24ff9d9c5dcc4f09a298b073b205f0930001f04a1171c90214d744b29c8f9d1fb3bd8997945f86739abd25258d0e9e733f408488963f6c5a06e4365a52cf5fa6df0d519ccf439b6a2ec43a5ed0dbcda67a0cf7b52daa5daec0b7250d0af5afe7da413e3756099fdf1fcc01ee632414f9d56541f1a6", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x1, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) add_key(0x0, &(0x7f0000000180), &(0x7f0000000100), 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 6.073302984s ago: executing program 7 (id=4016): move_pages(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000064000/0x1000)=nil], &(0x7f0000000240)=[0x1], 0x0, 0x0) ptrace$setregset(0x4205, 0x0, 0x2, &(0x7f0000000040)={&(0x7f0000000000)="2d17b8551699ba8ed74a766376f880698af26c447e01a1b326b1824051dd5302926d3d462c8560bb26b135d6fdabd04e95", 0x31}) socket$inet(0x10, 0x3, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000005c0)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@private0}}, &(0x7f0000000180)=0xe8) quotactl$Q_GETINFO(0x0, &(0x7f0000000100)=@md0, r0, &(0x7f00000001c0)) r1 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000010151204000200"/20, @ANYRES32=0x0, @ANYBLOB="2b03000000000000180012800b00010067656e65766500000800028004000600"], 0x38}, 0x1, 0x0, 0x0, 0x400c841}, 0x40000) getrusage(0x0, &(0x7f0000000200)) syz_open_dev$amidi(&(0x7f0000000080), 0x39b437c8, 0x100) landlock_restrict_self(0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) 6.047932367s ago: executing program 6 (id=4017): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl812\x00', [0x4f27, 0x5, 0x10000, 0x4, 0x5, 0xcc7, 0x8, 0x7, 0xa, 0x100, 0x2, 0x1, 0x1, 0x1, 0x6, 0x101, 0x0, 0x1a449, 0x3, 0x40000003, 0x89, 0xcaa7, 0x0, 0x20001e58, 0xb, 0xe69, 0x3c, 0x8, 0x6, 0x0, 0xfffffff8]}) preadv(r0, &(0x7f0000001cc0)=[{0x0}], 0x1, 0x0, 0x7f) 5.987658309s ago: executing program 4 (id=4018): socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000180), 0xac, 0x301000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOWNER(r1, 0x400454cc, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x8400, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r5, 0x8010500c, &(0x7f00000009c0)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = dup3(0xffffffffffffffff, r4, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f00000001c0)=[@request_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)}) mount(&(0x7f0000000100)=@md0, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='virtiofs\x00', 0x5, 0x0) 5.839102446s ago: executing program 3 (id=4020): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000001240)={0x38, 0x3, 0x2, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0x4fa11, 0xfffffffe}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r2, 0x0, 0x40000) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) lgetxattr(0x0, 0x0, &(0x7f0000000380)=""/78, 0x4e) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setrlimit(0xf, &(0x7f0000000140)={0x1, 0xbd}) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000080)='udf\x00', 0x2008087, 0x0) 5.686222033s ago: executing program 6 (id=4021): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0x2, 0x4) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto(r0, &(0x7f0000000740)="50fbdf12a30d7a48b2c5c84948f3426077a9f0ca1475183db3bf52a6b2cdb77ef9af2a603a3e78adff59fbb22bae1b2443011fd801251bcef8f165533aac58c7556dd51edc5a6865d4e29f0bbd0ed602050000000000002944de604d849a1e", 0x5f, 0x4008044, 0x0, 0x0) 5.356838084s ago: executing program 4 (id=4022): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) select(0x0, 0x0, &(0x7f0000000080)={0x3}, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x11, 0xffffffffffffffff, 0xd1584000) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000001880)={0x0, 0x6, 0x5, [0x2, 0x9, 0x3, 0x0, 0x0]}, &(0x7f00000018c0)=0x12) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0xb, 0x0) madvise(&(0x7f0000b16000/0x1000)=nil, 0x1000, 0x15) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(r1, 0x0, 0x0, 0xffffffffffffff80, 0x7) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0xc}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x101, 'syz1\x00', 0x0}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000300)=ANY=[@ANYRESHEX], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r2}, 0x18) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendmmsg$inet(r4, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000001800)=[{&(0x7f00000000c0)="cd8a940311238f124853dd729798c2b1bf95066b39aa9a831544d87a4f2650ff56372a3d3e5e5489590cb89fa1c915616e1fc9601f5aa56f90be84471c929192f8be73327c6a38a365bd5d56086155da58c8ec85f3b5098486ed4a82582c3d8ac8c315e30d1db468dd3e21f3c3fa405bcd060ec1ec9b375474dd2c66fc1e04412ba16850b15f1186c9404de0a71eec6ca56d964b2565f44fff907540164f3cde0616a356419507ac0a2424edffc3fa86ef1646a4c1ecb232097e050cc9d6a1c9e910b5a2c8547a95466ca306491dc8f4c967447d7ba9", 0xd6}, {&(0x7f0000000540)="aaafe4a6cf25554a5d43bc1050169d1ab168da250a8dad3c38d4678ec56d0ebdb81fc1b68842a7f935dae0b823b18e1dd8b7b412ec0f8a148c21b55ec6094eb1b486e7982a15ed265198235ca726e365a87c30174ded1cca20087cbd6a7f26f065b568c6968c8a353d87e0c43d87b67589af90a1aaa3f36c9609ee01d7372b863463204fa6258856f1a0ce5b4f3d8500ffc0d9d8974ee847c59f360e0fe4ae077e5a80c27766d0d183963e6fcbd7683fd585f29f6f062d94e2f9f8266b643e9e2888afbd0bba241cc78404d50dc13dd91bb17cf40f83dd9c989b9990783a6fd2461ffb168ffe8805921d34bb6c260136929bace72c21d6058a4e63216b97055c2fe6979cd79bf0c0ee8ab7481471fb1d1fd9695598f866481a335473f0b6c6d207ae25be60b12a38df85e61f7df347ede821a35d112d0ad37df76cbd72390f9fead32d37d3b6d674dfeab63a933de1e53a8c12b0368f574e967729f61f5b8a0e3df334959f580475e33d648c01c5846454b03dc9b02eae654e50056046da50859b07401bf281717d009a1a1291ea7f7e64a7fbb81157e41d5c5cda78f5d252cad97910ff2996a51f7203de9463993dbbc01dfc49d7d8d5f09be3b698143b6726c41da1843101feec071576625f0ecafbfc7f901012e513ed094d77badf91472b249d0aa931994ca0b17ca8b744e018aef33ae2f656eacb8e14530ad0f3c19adf63f898caec6e4d786eda00c332f26146a9108db68944405e563ab01d3d64718c935ff0b99176fe7ceb7174e97a9cc0eaf7f5aee8b9e7a1417e8447d2d2b0fcc6f2f4ea7afeda171b8820c0c137077f7c42f11c4affc77f3db95d665f5cba058c941f33e1d58bd9b4925288790cbd763b7718193f224c953d494bcb2af90f823c841667c60b5728e43f2f082911d5f8293d50192d2b7c95fe9fb5f9e11bdf9b34054b3f26cefe7e36b580b9829fd937fa4609905ded4560c527efc048138989a27129e492d6610d13777ca7f320cbb1f1d654be4c28246e95f6f6164e9a8a94ff5f1cce36369a3c058ed7a8c7f7659247ecfd76a1f719e11240e78ab79bf2e8970974fc595d27bc4f2553c2d6a75c016f64569808d11a022f7266016b2870908ace59cd9870ae6108e35b0fbdde7a3d8c3d0f53ff3c6e1397178501ed24ea6f0709f30b3de642ed335eb33fb4f9d4e68e619edc179cd5e0a169ec412c593c64af62da8ef3e5f0886ec871a67ad058d82466fe74cbd93bd4f4e8e6c57830d2907eea9cd779f14d8574c2306a481e41fc6a5e287378f4162ba6dcacec7a622174e3fc6b87ede401f175e855f08c1ffdc5d6c117fb76b5254d14adde76d9dd29e775ee7b9f30b5f1ba44028c7bc10e98eedd53aef295c185c75c637dddeece70504df81770b0cd9aa16e301108a8381a09f8a65ad5e08e1ab8996269509d994a2f6bc0fcfd9f389d3853151e7cee50d9aea9b405bdd43232175832dbecd7110e82c58d06dbc90ad0070a44e9c9607af26b8d0a5e6ae07e849c6a555b15ee4f26a6612948b98498880fc513bf3c46ce3d986341ebe96228b2d101876883337593b34a87fa69c885e94e4e7c6ab0731ebb820dbff0901737264fdea9788ee3de41e46b8356b70642d8b8c0665dd03f15f1bd877398859161928e03f80a023cf91a07ee5f49a272530b31b4c69c6e2482e19eb7d419b586b5643eabd24eb44c47248a5af6f4f9d1028fdadf673658839654655e8e07bac17c4b2e048fcdb775d190d572f3ba75feede969078c6ba6efc3c69a8e9d11459b2d6399402429f22488d44f0f44e681a4de0d506e191cebf076d14476755159eae499626042d6678f77d97c1fd2999794363f468ed4dace0da2c300591a4b5204ed7865fd005b3763eb0ff1cba9d895a07aba892b42fd220d53e16d925fa0eab19e799a4fac9e77d838b6d4a1d73e454789e501f6554a3e2a8f770318a01f023be38819c0b57dd5d8e3af4550678c8901c6992f323ab8356d5e1cce227bd656f374566fd045674af42985f8c77a7ed66bd34ec6edb638befb10dfa9698d3c603f4733ac9ba007c9c760e6910091620d9b773dd3071c79c985a51f49f1596bc0d20dd684c3c52caf885626d24ffb6681ab0e01bff134fa16d5b7cdfb339a67336915189046b478e6091038aa97f924fe299d1ed8819614b611224dab1026405c36ca2c22fe4d90f5c91a5e4733f114810fdc9fdd65edbe98762765b7cfcec52e5819fd9ca90bb2c89d7ef310f8718afc209e8fe6950e0904707ef40798267fb824ba3353eb94929bbc57834d2e8e5c3f224ed7cdb06e288cc8b1e76089a695127779a03e33d141215038123c901f7be90c0bea925ea97ede50ca4f3c4fafd16c07856303848d50a78594047ef76b345bee7c841b839082ae1831c2e83ab364e1ff1ea4504e553a6b348fc42a3164f705e62996822905507ae782e3f450f0227a45c2c61c7c7fab5ca8c6898acd48107103abc596ea20956cc47913ae45e781f7e23e9c05b8fc37360ff0bfbc5b7c3dd9867447cc56e3229c68ebaff07eb0afabb48edbcaabd04a60fd36aca8a20420125ec6a40b8934a5148c1d7fbdd63aacd6fe5a0ba36c33a4346907fcd8ab8a43c31b4283042815b2a18c641881ae0ab626298337cf0abf002d8c45cd034c7ea72497320ba16d077f82128d9cf9c380e74724bcb1381086d6b804a12d0632223e2949b7bf2e130da04ec414396b56dc727fd68571e793bae1e2ca5fbc1be6284571e7c20f8e4582af5efb670297dd9855e5f96817d3c821075ae6cf0664bf79f8ab6ae41f9ba5989464faab93ddca516732e86e425737a6db285e96c7345bdd792341def1f85635b519bbc494ac06a39e04e6591a96dc526a8a964972da29c4beedca300589bcf0ba3347ef99284997dd7c21ba21e36d5dace9fd4f7caf82e1bd4b22f161e2e7249acf051c7f9e010dc5f21f354a68d1b6e32d6ab3efcfb83cbb58e40019fdd867497aeb37022f7212bdadd934d2c9b8a1fbbbb2c40eaf7bd309e0c3485cb9651f75124fdaf0dd2a8cdbdeeec3550aeefefd499c70d5cfebd702f624c3991625cf1e4cdf6959fdd5f85197434654693ac5d63eccb72431dce1d8921e656c07f59cbe5260be67554165e06a2c1a16fa22d81d6bb57eb4312539d77834d036c741f1aecf0cce2f8f0a548c6f250a23536de6b9e59d0de823fc463a743dd201a101b6852bf3aed317e32c4a81a9a4e17685a7dd3aadc0428c173aff8d816a759e265f0082bc5832ac8e8ea5bd0b6f8053dff65cefc20c19ca8d419cc3a6b83c4ae8bdd8936be043cda0a45c030de80dde62928142968fa74ce6127fc89ee5cc34886722a8a77e6135b739339d968106d2f90f9e596aabf35dacb0ec4422200028acdb3e64a661b48d5f2a7ebd6e9f12078ab0807349fc8292e24a9e39a493cfdf3f941289661c2dab0a97ad01502f670649ca038853dc42048819bb6cd9c74b7d7eed6662a2e439d33b93070116563577c6f6c94b972dc2b3d3e889789c38bc8302a25b2ff9527877b10d81fb34e508464e17a9b2713ad462b1497ed527e53936610e357ef9d6783f006fc510f9aeba945be2984f8ab0c9b93f299e3243b83227f83505d8a2b05720246c20f8f6983e3dc02dbae752c2bcf12586390fa22b0b25eb745b579a55e9e41cf4738432e80f74f1c4e6372a33149faa1ac79de1fee1641318ac3c072b3cadf085166522b97ba886f2f1b8f219598bf97527fece9b0bc2c3b442e54903d43df58a2d0efe44036d8659c43cb32310366e1d75a1aed082f92c24808590c89a84a0a73dbe6feefba09523c17d3d55ebe6e7c5f092016a2d3f6d9344efbf550cb41745c695a0ab91041f7aa91826b194b4a64473cb49720f9b963c091925880aed40aec7783bf242aa82ffebf8a0ce22634fb404a5bfcefb2e156d63881cca38aa5a02e0c11b7b4e74fc374c02351e075520d801e47665b6b0311a34f90ef1050b1f2093cb4d59b255ff16a1bb5756e17d5afce555c82d5f7f2e6efdc6b58151c746b1f65f1ac57e780ca559f8648379e62a5668b157338a102b77f0dae6fe4af8ccf59b7041c274670bf05359fc4ab753e8ef1397d09757a1088675ad1124c6e7199f32326e4eeeebb91fa305f263ce617e924dd3c63b8fec2b5fed2f1df7f0b0dbca20838abcaee48bad671615371580961f6fdba33b228307b8cb69fb9e8aa3201b638714073d274e0bedaf9ab3b3b8650389e9b5a1d43ddf5ddf5079db3ef3df2501e16a5c799a4b16af5215a81bec38dfe86b0b0ad1823f95895114cd792cfbfdb554d526d545f819f5b7645ecec0c3166fb98966f8cd626299efe76ff143e828da183aabdc7ca6fb65cc26d1a5d9f4a998300309ddb5f75a469a0dcfce938adbf8193ad174ae97d7216e008ae30311c5861d4554fce086422353ceddc27956f067626012c8e6f2c3c67a8aafb78a216a28de2874ea6d9d11c9f509536bdcc009e809300ed417cfc26ec76fce16ec6d53aed55d7974da5f14773e5bdc47ea56f21780bcd5b080b01197176231969bcaa26702826b20c2fc38ea6f4251e50606ad8592941fe4a976f970be83542a8418471931221fca00db91f136b26ef0a9429212882db80e5b97a39a92738a12ac1155c7b0b2ec55a6bfcc9c401baf2dbb94769d585a06ab67a50012c6a700b461f1eb8fb6bf026643d83d08b40d7013e6068aab0f651a6b17480b7bc0a07b2498875bf3248a4a4772b9af148a5431bfe587bb21d42246b460b5e352e6692f321d478e80b7e836ff8a1bfb603d3938343e06f187a29894c8f817d3445971d632e25258d4dec716c2fa0027bcd56c90bad6aab5367537dbc9e9843ecc204bebd0c5d9a55eb1368f8e0286cc882349c1955d9e63b3c99adcf2807fb90cdbc1d4c37141bea36eb446e5dbf7a1eb7d16ad2a63916613a9c5f7d32cb34f91e7bafaa5cef619455629ecc1ec30eca782e34a3b43234b798880110a831f7f96e49981cf6f3b9065d8c3bca539bb84d3b78a643bed7732d9526c61d1e15427e2b1773130c4da045141937d8ab21f716a0e6532a3d47c5572a3befd2ab54fc5eca268c02978e9907360b13a584a75275bf59cde6f03be893d5e8004e4928869022a336f1ef7c570272cdff3c8f3f53f3567b4e35b2e1bfce355debe7bf7a310b2c59c08f9f85475ab100990612a5bb1c22bc863191b0b2d700e89a39369f566f4e3a61269ae8043e5397f1591c143cad9daf01a7e5ba0d1bf9982aa3d26daa73b89ae2dc4a7232581f81d96bc78c2a30ddbb8834e1961a82104807c2cd89fbe1c762ccd384ccdb9443c1eaf64703e7d449b3a25d665d7df237564fe0390ae9eb41650fa36a997d220d701f4ec6a9797bdf1c0e16c2562521021ad733d554b529c35e921000690", 0xf00}, {&(0x7f00000001c0)="68934f35f737cfb2e31384916ca489f95291bad71dab25511fa82b2e50b7b6bfd2226457ed531113379ed4da07951d06a7cd0b1d85dd259620e1c8a5fc71d4dc5dbef95173c0c74433ba9c02b232d7a6501bb7ffcb41d6214e0b2406b6bfa55cfebe3d79de5f166b0f0b3cc0a28b4e71a082fa511a214e2d805f28d88ff660364c82bf1dd191cb0e4115f0ba2ab45dd2ff3d649fb61b3424b8325dbd6191cef6fb48286a85dafd6526655153c2cc7768664b79d869d400817cbbdbc04044bad1aaee10ea85", 0xc5}, {&(0x7f0000001540)="e2cc0771cee145108caeac6c93f33f3b9b6f962426e63dae91a9a9dcb388e48eab05678b81cacf12044319db3198c1702b9c8d7af98e42b9526f6c380f30802b02159db456050a4242956beef413aefc801b60524ab0e0a7a8b701f85562466076f60e030d732d1bbdd6b313f5a16a620d6e476bad276c1ffb9338a2b443cfe5778c072bf80d93824f9b1445a30ff6b06533c02ce2e78d953374e9d03d6267da7e864296664ca506d424bfe9090e4d79fcc6c75856292111f99d88409216c06086eacc33", 0xc4}, {&(0x7f0000001440)="7af6e271ac46b0f4e2355fc30c0a2c8b614abdcc96494064a4a7a8a9e2c2c35f380f84e3e5ca202a12028156b51c738bb665ce6ab36afe7570cfad67a0ae842e9336306abb5dc0c555e546529847c0f871d8b0de6d7e7020dc9ee1a2fac576842654a0936000c63deebde207f04e7264cbeeb1e3ca50ad0b729f94399c3b16160d835397672525c1a8cf9fe143b83f0baf321768b60e0600000085b9c26b4a8832a58cb0863e104c778d56e7830427a151e9499750deeae376434c7484e73dfad82a8951035c30a94092f93d46eb3462a3f1e7decc264a1f4a514ceef4b66f492a93238e816aee97cb2c62ede01482be8dcfd687", 0xf4}, {&(0x7f0000001700)="24fe6156792df98f40a0b003f3f2cd6c61a6193a9dcd320ebf60104bb89f4248654354b649e3201370ff5c4727c29669ca3aeb31b9d2fb159ed00b7c72c1dac4e9c42dd06be0e027ee4c077c63b38682aab5934d1c0c7829397cac3c1b218518d0a0ceee7330c8df05bb0e1eb7ace0414f90c8a4a884f538ef33e56df4cf940559cf487b180af5c360a8ad049a81871aa9e99b8ac58710c0bed0947c8af7c6700a2a56f64ce71052a7b9bad0d35c149659424a5321fba168057069d88c07b3eea0999833cef2dbdc4541b1e1aba8f586fe51c2919534e9060a72752970caf15402378c", 0xe3}], 0x6}}], 0x1, 0x20008804) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r3, &(0x7f0000001640)='io.weight\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x38) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_getevents(r6, 0x4, 0x4, &(0x7f00000019c0)=[{}, {}, {}, {}], 0x0) 5.275847405s ago: executing program 5 (id=4023): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) r2 = open(&(0x7f0000002280)='./file1\x00', 0x400, 0x10) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000108008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000000c0)={0xc21, 0x0, 0xf29, 0x0, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000022c0)={r4, 0x4}, &(0x7f0000002380)=0x8) fsopen(&(0x7f0000000200)='iso9660\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x7a, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffff00000000000086dd6076db4000442f00fe800000000000000000000000000021ff020000000000000000000000000001042065580000000000000800000086dd080088be00000000100000000100000000000000080022eb0000000020e37f100200000000000008000100000800655800000000"], 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup3(r6, r0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x11, r7, 0x0) 4.829854163s ago: executing program 6 (id=4024): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x11, @private=0xa010101, 0x2, 0x0, 'ovf\x00', 0x11, 0xfffffff8, 0x15}, 0x2c) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000740)=[@rdmsr={0x32, 0x18, {0x40000010}}, @in_dx={0x82, 0x20, {0xe5fc}}, @wr_crn={0x46, 0x20, {0x7, 0x10}}, @wr_crn={0x46, 0x20, {0x8, 0x8}}, @wr_drn={0x6e, 0x20, {0x3, 0x2}}, @set_irq_handler={0xbe, 0x20, {0xb0, 0x1}}, @wrmsr={0x1e, 0x20, {0xb38, 0x9}}, @out_dx={0xaa, 0x28, {0xe33f, 0x0, 0xfffffffffffffffe}}, @in_dx={0x82, 0x20, {0xa0e2, 0x2}}, @rdmsr={0x32, 0x18, {0x358}}, @wrmsr={0x1e, 0x20, {0xb58, 0x53}}, @uexit={0x0, 0x18, 0x4ef}, @set_irq_handler={0xbe, 0x20, {0x98}}, @wr_drn={0x6e, 0x20, {0x5, 0x2}}, @rdmsr={0x32, 0x18, {0x222}}, @in_dx={0x82, 0x20, {0xa615}}, @code={0xa, 0x5a, {"400f236066baf80cb8d8ea3b8cef66bafc0c66ed470f1039f3430f1efbb805000000b9070000000f01c10f20e035000004000f22e0c4c1b711e12ddf3900003e450f01cfc421f96e06"}}, @set_irq_handler={0xbe, 0x20, {0x18, 0x1}}, @wr_drn={0x6e, 0x20, {0x7, 0x8}}, @out_dx={0xaa, 0x28, {0x5e53, 0x1, 0xcff4}}, @set_irq_handler={0xbe, 0x20, {0x61}}, @in_dx={0x82, 0x20, {0x6d8d, 0x1}}, @out_dx={0xaa, 0x28, {0x4823, 0xae43a637ea8e6437, 0x8}}, @in_dx={0x82, 0x20, {0x40c2, 0x2}}, @wrmsr={0x1e, 0x20, {0x84e, 0x3}}], 0x352}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000001c0)={"04dfc86351907bcbc9293982262169af775bedfb0a63cb8031ecdc0051097e022d45a9640a4a4b506dc328f61ac030dacac442d82c9e81e6847961e65610b8f6e25f9eaf1a9f48ac011b67d68f8725991345a1f8ed6450a11246c6429fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8a481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16893a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2a3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521afbcd560c15cd9f33e36417a251af7100392b6cdb000000000000000efb5589f279cfd594911cb11f2a7336af10b28e80056a2eec8287c735f2346449f1629fde95d6c78bed90645bb2805721ee6dd6068cfd6174d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a450a32cfdfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f235074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0000e9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf6556ce92ae6438bb3e3aa258c8c4ba664f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c50263b3e0314004ec808df7cec279d75785fa2124d10200000000000000cb9506ee7142eb108b3f4125ade3d9a73646bfdac795c753895b2ad51d358eff496d1c1a885c30b85b50eca87ef14ee50ae3301805f1691b3a391d7575c9a0a514710ad3e590491d60bdab122222c66cbb155452a01cb9750d14ffdc77ad11d4495c53bf38c8185c769c1409eb0b1c613eac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c50527200"}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) 4.709912603s ago: executing program 6 (id=4025): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) prlimit64(0x0, 0xe, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x11, @private=0xa010101, 0x2, 0x0, 'ovf\x00', 0x11, 0xfffffff8, 0x15}, 0x2c) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000740)=[@rdmsr={0x32, 0x18, {0x40000010}}, @in_dx={0x82, 0x20, {0xe5fc}}, @wr_crn={0x46, 0x20, {0x7, 0x10}}, @wr_crn={0x46, 0x20, {0x8, 0x8}}, @wr_drn={0x6e, 0x20, {0x3, 0x2}}, @set_irq_handler={0xbe, 0x20, {0xb0, 0x1}}, @wrmsr={0x1e, 0x20, {0xb38, 0x9}}, @out_dx={0xaa, 0x28, {0xe33f, 0x0, 0xfffffffffffffffe}}, @in_dx={0x82, 0x20, {0xa0e2, 0x2}}, @rdmsr={0x32, 0x18, {0x358}}, @wrmsr={0x1e, 0x20, {0xb58, 0x53}}, @uexit={0x0, 0x18, 0x4ef}, @set_irq_handler={0xbe, 0x20, {0x98}}, @wr_drn={0x6e, 0x20, {0x5, 0x2}}, @rdmsr={0x32, 0x18, {0x222}}, @in_dx={0x82, 0x20, {0xa615}}, @code={0xa, 0x5a, {"400f236066baf80cb8d8ea3b8cef66bafc0c66ed470f1039f3430f1efbb805000000b9070000000f01c10f20e035000004000f22e0c4c1b711e12ddf3900003e450f01cfc421f96e06"}}, @set_irq_handler={0xbe, 0x20, {0x18, 0x1}}, @wr_drn={0x6e, 0x20, {0x7, 0x8}}, @out_dx={0xaa, 0x28, {0x5e53, 0x1, 0xcff4}}, @set_irq_handler={0xbe, 0x20, {0x61}}, @in_dx={0x82, 0x20, {0x6d8d, 0x1}}, @out_dx={0xaa, 0x28, {0x4823, 0xae43a637ea8e6437, 0x8}}, @in_dx={0x82, 0x20, {0x40c2, 0x2}}, @wrmsr={0x1e, 0x20, {0x84e, 0x3}}], 0x352}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000001c0)={"04dfc86351907bcbc9293982262169af775bedfb0a63cb8031ecdc0051097e022d45a9640a4a4b506dc328f61ac030dacac442d82c9e81e6847961e65610b8f6e25f9eaf1a9f48ac011b67d68f8725991345a1f8ed6450a11246c6429fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8a481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16893a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2a3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521afbcd560c15cd9f33e36417a251af7100392b6cdb000000000000000efb5589f279cfd594911cb11f2a7336af10b28e80056a2eec8287c735f2346449f1629fde95d6c78bed90645bb2805721ee6dd6068cfd6174d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a450a32cfdfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f235074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0000e9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf6556ce92ae6438bb3e3aa258c8c4ba664f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c50263b3e0314004ec808df7cec279d75785fa2124d10200000000000000cb9506ee7142eb108b3f4125ade3d9a73646bfdac795c753895b2ad51d358eff496d1c1a885c30b85b50eca87ef14ee50ae3301805f1691b3a391d7575c9a0a514710ad3e590491d60bdab122222c66cbb155452a01cb9750d14ffdc77ad11d4495c53bf38c8185c769c1409eb0b1c613eac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c50527200"}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x51, &(0x7f0000000100)=[{&(0x7f00000006c0)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703360000001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 4.519087258s ago: executing program 3 (id=4026): openat$autofs(0xffffffffffffff9c, 0x0, 0x208080, 0x0) sendmsg$xdp(0xffffffffffffffff, 0x0, 0x41) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000003c0), 0x40001, 0x0) r5 = dup(r4) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d10, &(0x7f00000002c0)={0x1, 0x9}) add_key$keyring(&(0x7f0000000080), &(0x7f0000001100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="06000000000000006a050103400001020301090200000000a8869c758d2cf030ca0000000000000000040700030122bc0309058103ff030000"], &(0x7f0000002540)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac1(0x3, 0xa5, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x93, 0x3, 0x1, 0x0, 0x10, 0x1d, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x5, 0x79, 0xea, {0x7, 0x25, 0x1, 0x1, 0x5, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x1, 0xe7, 0x80}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x0, 0x10, 0x0, 'q'}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x9, 0x1, 0x9, "5c44d1"}, @as_header={0x7, 0x24, 0x1, 0x2, 0x7, 0x2}, @as_header={0x7, 0x24, 0x1, 0x40, 0xde, 0x1001}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x8, 0x4, 0x0, 0x6}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xb7, 0xa, 0x9, {0x7, 0x25, 0x1, 0x0, 0x3, 0x10a}}}}}}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x4, 0x0, 0x43, 0x10, 0x9}, 0x13, &(0x7f00000001c0)={0x5, 0xf, 0x13, 0x2, [@wireless={0xb, 0x10, 0x1, 0x4, 0x90, 0x6, 0xfc, 0x1, 0x4}, @ptm_cap={0x3}]}, 0x1, [{0x52, &(0x7f0000000200)=ANY=[@ANYBLOB="52037ffbf4ce4e14fcd4e01b21228627889dc90100bbd67275be478b87ca2a555e00000000c5674a747bd48487afaed4893f6dfc576754031f8e8a21525fe5083e5f19a47f2fb44102a2423aed4e20223506"]}]}) 4.060441795s ago: executing program 5 (id=4027): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='sched_switch\x00', r1, 0x0, 0x36}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfec8d000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_procfs(0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x1, 0x40001039, r5, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "0aec3ae6579d978966587abb37b8a6fa071d1f82"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4048010) 3.126044374s ago: executing program 4 (id=4028): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) r2 = open(&(0x7f0000002280)='./file1\x00', 0x400, 0x10) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000108008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000000c0)={0xc21, 0x0, 0xf29, 0x0, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000022c0)={r4, 0x4}, &(0x7f0000002380)=0x8) fsopen(&(0x7f0000000200)='iso9660\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x7a, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffff00000000000086dd6076db4000442f00fe800000000000000000000000000021ff020000000000000000000000000001042065580000000000000800000086dd080088be00000000100000000100000000000000080022eb0000000020e37f100200000000000008000100000800655800000000"], 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup3(r6, r0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x11, r7, 0x0) 3.063470213s ago: executing program 5 (id=4029): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x141842, 0x8) r1 = io_uring_setup(0x3a19, &(0x7f0000000240)={0x0, 0xcb6c, 0x5042, 0x3, 0x227, 0x0, r0}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000480), 0x66) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000480)={0xa, @pix={0x9, 0x1, 0x41414770, 0x0, 0x7ff, 0xffff, 0xa, 0x9, 0x1, 0x7, 0x0, 0x6}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvfrom$unix(r4, &(0x7f0000001e00)=""/4096, 0x1000, 0x10000, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000701fefffffffeffffff017c0000040042800c00018006000600800a0000140002801000"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x6b0d, 0x8, 0x1, 'queue0\x00', 0x8000}) socket$netlink(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t'], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800110000ec3be630bc58ebef3b41b8a3007af21e8f04934e2262c5a471e84bcbb8ba4ab87de8628923b6e5f7e54d5b497df520c85a3b65283f24ff9d9c5dcc4f09a298b073b205f0930001f04a1171c90214d744b29c8f9d1fb3bd8997945f86739abd25258d0e9e733f408488963f6c5a06e4365a52cf5fa6df0d519ccf439b6a2ec43a5ed0dbcda67a0cf7b52daa5daec0b7250d0af5afe7da413e3756099fdf1fcc01ee632414f9d56541f1a6", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x1, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) add_key(0x0, &(0x7f0000000180), &(0x7f0000000100), 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 2.441585176s ago: executing program 7 (id=4030): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1b, 0x3, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 2.282863255s ago: executing program 7 (id=4031): read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000040)={0x11, 0x4}, 0x14) syz_emit_ethernet(0x16, &(0x7f0000000580)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}, @void, {@llc_tr={0x11, {@snap={0xaa, 0xab, "ab", "ffdd0b", 0x88f7}}}}}, 0x0) 2.223599863s ago: executing program 4 (id=4032): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x408202, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[], 0x48) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/237, 0xed, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) (async) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) (async) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) ioctl(0xffffffffffffffff, 0x8b2a, &(0x7f0000000040)) (async) ioctl(0xffffffffffffffff, 0x8b2a, &(0x7f0000000040)) setreuid(0xee01, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) getpid() (async) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r4, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) socket$netlink(0x10, 0x3, 0x4) (async) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190d09004beafd0d36020a8429000b4e230f00000000a2bc5603ca00000f7f89004e002050da742dac0000000101ff05020003000200000000000100000000005839", 0x48}], 0x1) syz_clone(0x108e1100, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x108e1100, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$vcsa(&(0x7f00000000c0), 0x200, 0x44200) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f0000000000)={0x80, 0x40000105, 0x0, 0x0}) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f00000001c0)={0x100, 0x40000891, 0x0, 0x0}) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da00090589"], 0x0) 2.172474471s ago: executing program 7 (id=4033): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='autogroup\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff7000/0x8000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xc89f, 0x1000, 0x0, 0x20002fa}) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, 0x0, &(0x7f0000000300)) ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000000)={0x3, @vbi={0x0, 0x400, 0x0, 0x3de6309979d131fe, [], [0xfffffffe, 0x5]}}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000008340)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="b04c", 0x2}], 0x1, 0x0, 0x0, 0x80014}}, {{&(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000680)=[{&(0x7f00000003c0)="858ed6dea8d562c73742d8bf2f205d34f7ec7e9f4a0128452531d222ec8cc8e0bb142b36a7a4ad1d1dd2f4a16cb6d06450c135186cd01af713a8a40d508db7aec7ecde6cbb313c46d5aa897fb987b29b7b39f11ba4c70d1afb27ce96925656f7712ec9356a81a59cbc6f28b478bd2b8730b61985762f5e112b642a8c40320457341de504ef4e7027811cdd890c2fc1ff295b489ce823772fd3fc30b81a8bc8663e7ea16954a688b5cedcf382ca1aad", 0xaf}, {&(0x7f0000000480)="1cd3ed564ab7942af7cf62efb5b911ba45ab6eb169942fb24cfcdc81d109a6c87d513baae06bc73d870994ed6f6131d3995e77d21fbe693a6547d80e614384d537d5322b13ee7229f10ecb7f471c436eaeae1ec2ecda2e3d3a0468749304821a3d291c24a9f1f15b8f5b8439d71f39a5550797f55530982369cfd311ee9dcb610c6faad660ff67ea602fb364ba43feb66a3736122487dde7aff6b4c166fd7b716b8743a6", 0xa4}, {&(0x7f0000000540)="5a3e9b3e828a80e6fddfefb2322231a30a5727acc0ae29672c2ab096f23c939701bfb2b358d12bd0b35bae127d741696e2311557374d438b666fcda93fc635540118bd424e1e652381af7ec20a8cb9ec780ce106ce471b61dc12d529d141c5343ec7259fd1d063b3e6f094ab7d2ed4e8497da30b2de976d08b5e164addfbd24aa5a4a4b0e7b0db00ae2173b31f9f8725a60788499817f80041b1d7c5e8", 0x9d}, {&(0x7f0000000600)="9b403e8db3c74abd2c7b153c2c12c8164d07f6d99b5c319325c4e72ee43a0a0697121a9079d62656d246245df8c8c1e1d341a31e63520f44a8766ebdbd21829bb43f70121f41f14e185b73464349489b7c67099593cce83e6012a666f132527406c32b678a71ec8c514f135ca66d6054751a6dbb9bb681", 0x77}, {&(0x7f0000001400)="2af0da784863752c44b374a06a3e9363d155431059658ba32c6884bc22ed05ccc87e2c7588bf3af082a30fe515306ad32afee6869cdfdd81d244f5ea9a9f149c5346d02487e1ba0f9f375dc6b94a2a127d57cf6efd355df340e2ca580019cc6b66c4098e593912d6bed610841e93b68f4d64bb047dee272eb1d471e6d937484b09972b4f7283555e211312ff5576a1ab067d4e9ec2e86b1e0a583afd6eeeda00686b87e3a7f30e1d6ae58e546eebd8d13399977869bd5294ef9c62827deed32482cf3e638fff68ddd5908ec584e3de07ed40dc7b8abc01fb187e7463c5c785ed8e9f5a31bb728c8a3389ddb00f57ed0f306852cb6190af0a2ca0fb8ff306c97b6b3805985fbbe3d19ea792bbf027c26c3420460a106bcd440055a2126bcc4b020ea7b5427744c6bb569023c7bbd8573d03daa2b3526f6e31a544090c61869cf117d127f723f71e78bf54ce75d1987e034e866802c89239e2bc5fe6872de574dba870936205fff40fa798b4f629b4757a7de4391f253c6a282ef624540f840283398d2bf0597e07e47000f2d7095ae6c70e1423e43beb903765f05b2d60328976d5d7bf14d300b091bddb289eb154df6fabe69a5bccf171b12897cf0424f94aee1c119569c20e61f744d64c3e822b1047d7a26ec5883506f1276ea886c5c694b5cdd634e9f326fc3f89cb45be20f2429a2abab22348097a8363cfe60e44351cd53d14a25dd1f8a2ca9ba57622e6c64dedd86300c77933fc87f001f9a2ff999d302af141c8a5c5ab3e57209794608327be4951f1fdddf3abd051ea5c0c061bebfea3f40cf52859339a9930b6f598b2d5b04ebe3f884c99118b345b0b50e33735a9f428feb0663dbf7d9531ff51c5c1494530eb80edc891a220782b55d7e42e813df8a959c1de602dedcb3ddc39847a582d811f13c7d03600d92965eb8d761ef7390ede39abc6f6fb2f6fc3b615778b4407cea546bd4930f3f074883429b87dc04534b574f495dfc83087391bed98da899753d8161258ea3d13cbb6bc2675cb771ade03f1e049de942805396dfefd66729b331b74f7d15f440697c3c9b4adfbf2aa06b19e59165627e469f12354fa1c06506ed48d0c1a248c9166fe28f310baead0bc17c78fc6e210d2187ec77e86dda08b71066dcc84a6c0c3bccb835c5be671b65da383ac706a7ddf592e9b6c64f32b1c67f6c06e85d764603a95c0a9fc612d41e854569e442f6aaf32c616fb78a5a469c93a330f1c3382bfd338446b1d10c457ede62ef8318e4df9b19bf210b03b6c84179b5dac314d92d231d54a3dbf216c6fffa91736beeeafbf2ef8dbbc25f52145bf76e1013dffd8b88f564ae4faec66ed7761074cbc3e409b89287e5ddd2df73d296dd49a310007f626ac8d2b729b5dc2247ec96f915fcfad13be8dc6815c93852e02e82dcbda16f9186067cd3087dd4772f23047f781f101e1c0627a088c6b9e90a10d6a4b87074f7c38f6484d440b2261033e4f1b7c1bd168b33dab1f2001c2722add50c5cdd33740c0058c441b936d61a6ef61f280e64a8f028aa44e9d819c710fc6cbb6eaede1ae3f3cdfa180c968310a54916628a2ff05b0b7a670494f06a5e81bcfd141b65ab12c69169416d6ce5b0a02d8d4c872d9e06bcda5ef45cf0da8dee40cebdd5e9ee30da8f92c9b390f782490850564e72b02e7cae2ef95d1ba2e3e3263cfcf7ae31a3948bef45a9e166ebe27473ffd7d6ee98fa710a5443297d9f84fcfdd5f5fb8c6df00628c5f6af0e7832fb3fa5eedd33403e512a6cbc8dfe2374599a69138f813ff4c04e47895a16368adae24c70a86bccf75df59758eabecb8b07978eb72658916e91af8c8d2a0530595a34914b78f8998268e22d7db5efb771697395890e78724d9b277963be0c5640a262f59f5d870adbe03f2b6b6c689d69dc1c136877d0e59b6379f4148874e0f69dd21ddcf56d3d29337fca8d0373dbe166eb6f3ba08fe2da4c8605a190b1d6c78e2b1e113ced978aaeff435a148d4c9d6867f958b2ea563c7288b60fb2db12c8b547669bdb7cd7e7a0cec57b7a1063992165d69c522c1c391c6441dd7ba0f84dc76923a7fadaa3035c16498c46850a1cd447bc1bd50a72dfac520699b1f7d07f0805e2a581054b9efb09ef8e3828b453060008c311fa97e40a534123ac789f96e0488555066f0efbc72f906be55184569ebadfd7f99dc07b370cbc062060df4046cb7b886fc8e0873c747f006fb0d289fc7a3510bde3c17c49929809a00dcc4e7a7f60806a4a515ea5b0e0a1b69e2ad91d60145520d39d87bef8acffe28b9b91d9443b238693e70d4bec40be0d8295b7ab564292d4b8fc91ae17b07cb323b7b0e31ebd1c422bb3bd9c4e9621d8c36fbbc3eaf8519538fdf04ef0a87a303eec42bc90766df1b312f0716c60cfc6c3d78f7423e634b6bf70a5e1b8cb5c0e9ab5acbf93eff69cad37869011093247ca32b54aeb7499530d91347cad73b662073537aa20ced9b9dbc74d3e90af07644fe6113dc5ebdc93c1efcb21c4cd8075ca71bcb35c5e8b834077361303a06cd6905bb5c3dd403396aa039adb0cc981c2c14408ca9e82a6c6828841758b4fd573bfe5cc4e2cc17714ddb8e6aff27b1e0ee7f3ddb9a2590253fe121296a64f2607c37225d8d392f0119a3f119cfd3a4ac7fd1905bb69e0bcb0fddafb7d464197beae169339680b518c17f288acc8796ab33debfffc4c91cb9b7e3b5583db95766c6aa5212488a7bb84c4695ee505a2442e2f04022eb97a55d8a004de2f7a5c04d2cd98b85ecff8ee4ed74e767a7580e944a7ca655191f0db91e3e8a415ac35dedfda7c2c981edf80868f87740ca5c299e42e91b0d0690ca186ea984033b0078843ae949dafa37981c4000839d5e4a061d277089b589461b7496ba98099e7404790e953a32299f8a0b79f7983aa54e12c0ddeee232ef7853b0e49bd6fa124891006dcde184076aa67b1396234938c2501dd443eedd220d2427c606ca3f08f70a346c33af9ddc2656b0cebe22c65d7d9fbaea75a526e6e28996f1085f6313d591fac5c43b7b09b31da5a71690208395c71f88dfe6d6eb4e07b1a6c9f2f0d2bc8d92b95b7e86a216d5fbf5cea74f81be5357438a91f90950901f5e6131f0fd5a768e259082172331eab296627c3d6dc7a4e906e6f720c89f37f7225d48a62bb238e7bea6f65cba424d5948e8586cbc628e902979b5f3b452b11bc4a4d13b2a2c79b6d43da659bd8ba91ea74dae730dc2a37c72ff1412e16017b34d70079a636b46735aa067ccf4ed91876ca018b4965434ed2468603370280955def2609a4b38728e63084290ea380d8489f8e2a0d14daeb174c0478490f506433788690d542838941b3656cb3bdfd66046c3b8e78ce0ff66db88ffe563c5df8bb742205201644b08c0a5d1e3fae91cf4372bb60f30abf1be0f0551e464331f86ce2b2de9d580ec031de4a3c9a202c0548c3534f217849d7b11f63718ac333b15dc17f712b3741ecf8e66e81e333852aac24f7a01c4a207f560b5ec38b52efdfa90461951a186428fca70198da17eb7f9774ae8142dc25d6cc57da5bb26d6fc043cfe40962514c8553a7b8cfd7d300bfd62599221964e6f5ca7155f92f162e8331ff530a619ce10d056fe8401127044042735d7aef3710091ef01f581ec02a7afc5f6e17378f3423295e632e1206931714e56332af675d7b4787f154820b5507b2d0dfb1ea14ad2e99bbd9a41bb29124744bb26c8575a456005a5ece01156546d1bdfcc575b905a0dfc15ba2885edd05882507dc5a0132428f6a2d8c05b4e9901900d25c858c2ac5f8bf189594f0aaf331cf17565ab259ec1460cc2c6d6c62a865a57743de921b809afc194143f03e30ad4fedd558f522e0845348dce01bdcf43b322b38ed6569dcdba9b31f5ecd3d4a51020669ce669a5cb6eb14604dca82f5ec36a3bbad1bb5417c7430448d1fbd1f1d2e44dc254786b0cdfcc75964e0e4f695f944a907c0cdc95ed292d82c3dc157f959b329d6dbdb717b64d1f4da14a6866626fdc03612b58be37e65dafc3395bf0981d639ed507846cac4bdae634d284f51520925d57702bacf21ed9d3d3cad3f8c9dc8109e044c745e8b0d07ba2d2dc5fb74c5589339dcd9f006c71e0cda2ddc00e349362ac8f7e7f765d492a518e43af4ae2eac8fe13a288303933c2f968d223f973aef7160774201fd3751a4e564ee6bc86fec98de4bab9f79dd7fda6ad277049123e001ee9889392aea6f7d91e8e9a4cf451dfb9da5beeae171888b81eb1066f6932e439c814acd20b8095290b59a2d03e093b1dd36cc3b0127ae8079cfcbc93f85c523e6f37660dff5cb07b0d11ae08caf601367348fa72c7eba8cfa0b812b9d9950e3384023c4ad962e3b1c1d6a5c5afecd424b04c8287d0dbc0cb5844dfb14a840ac5bf971e3cdda18486c03e97eed8b488b29e5cbee7384958163fd0e74fa84129abc7cdd2c251b1ca35bcfdf2edfa829ad7f1141d436db1e3ece6d703958efb49fb342ebca0f6ee5de27452a2b7efa70b56eec21365a83e6994820091057d0de13dd6c71b07458253784ae40031f4914f42e9f00fdeb9153043609d92a1e24f5523d345bf5fe47de953fb1b434f15699a9178f685a84cd72be4aa7710eac9b9f1f3de02519087d774d6521f421395328aa6e627a09d5c64d0a0d83f769446a4b461bb94b3d072d951af3122571308354674f679e728a1139cb35e17e5ace6208553647b8d2f0096ec659ee46c346c686b65d051bdd87bcf4eb78566e6c52c4bd33dca7cba33cdd4b869fab60749ed0556c51ad65f624025738058b1117c3c9a08011eaa3b8b5dcf976666a82f7b9a39be35885cbafcf0d475a64a3c938e2098f0588e09cb6b63ba532d544d397372915c7453f266a3fea5b2973d64eac01a8e7c12da5b6e5e408f733c197815b198db65526882ba3ae018561e4b42aeddb2fd7193092ed9c0af35b70320c054dff76b83f3f172462cd1c44b8b31bc2977e277152a0ff76de2f27728ba2859c2f3d591b8049666328bc44ad1dda87518b5c18d49911b0746731277b326eebefbfd930f31991b758c50a76f7fffd6a16b6a5208532ffd8a0b96cf99ecbb41f963d9fdc6da60af522aa447884e0b17a453d66651a133797c24c95911f95a10283725cf6769a6aa8d2ccdaeb6db5566b64affa64044c6fd81e45ebef0a1809106badb733dd07b4a181d0276069e381f78610910a96c4338c5a6945ed386367df001427bf4bda1a410919b462385ab7133ff84f87c571b0c722f4444822c72d6d553c374a3411a6e9843a7a799a6b20c00c7bef3c1862c1f3b450bebab4e121b3e30a95f4dd563a82771477293229dda2456e2da4066b722ae123c1a2fa7c0ded373191eeecd04ec225d16215b0baabab95e4000b7cf8eccb16e780d18c21bc2a9a70d4611cf32822ae6008843bb14c38160dd4ce93304dedbd570ce90c37a1a19f181d4ec9acb268233576dfb7e963251e42d93efb9b86201e3b17cbb5ea12a5ab8e908f0f7885b191a802e29b1d19986bc7dc984c9253b5d5e9fa600650c77bdca5234ecb43b3fe4a986725aa3009876b3a1fcf99134f7d7471d99636b3c1d8bacce717b0e3d94f69d2264ad8a0b9c63b52e8e4e32871d5f445f6fff8c8062797dec8a4f4271f26cd46f69b8028424e752905d7ca55fc5aa24a0763f000c5b3b7b61f7b2f70e88da3735e06052994eaecc504150a5636c7392d501c5c176eb1498c87436b5baaa895110e2ccc6e425c9948ea79b00a75f5a819d", 0x1000}], 0x5, &(0x7f0000000c40)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @cred={{0x1c}}], 0xc0, 0x4008000}}, {{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000d00)="3b443fd86dcef46a242cd36c05c67032ea3265e6219ede4e616116f280dbe92034951e047c67a5e474c9b1b97bc092c5a591d95dcd39e08245f3213dd13357f3bf4052ada3307d4d9a1afdb6115a14d5ffd24a78b6f443db04179793fddb6f4cef43f96d7bceb79d14741869183efba241063659d2dce964ae48cad1845cd7042048eae6455ed3bd4dce819051ca968f3eed1fb04ae9b14cafedcc7217ad4e", 0x9f}, {&(0x7f0000002400)="36740f333565d3e939ca9a2bc77cd4ed923c9997222c6f89e05fbdd0af4bf47af5449e36517cb573eeb67ea3ffdb4760c225fe7cedd1073e27d543b1e5880248e38b3030d8f93db50a8cf862ba26eef9ef10338d5fdf231ba4b563a070a5b47f506b4d1ee1247bafe5c991be8a153dbeadbd19de14bd159548b8fe3f9e24881d5230c705ec97156d53830b4f0447a58e46e6e64d554e", 0x96}, {&(0x7f0000000dc0)="373b0652938fdd03f925ef2ec2aa1b3f88136de6119398546b3659512a23", 0x1e}], 0x3, &(0x7f00000008c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r4, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000034000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32, @ANYRES32=r0, @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r0, @ANYRES32, @ANYRES32=r1, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r0, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRESHEX=r0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32=r2, @ANYBLOB="0000000084b0839356aeb962fce5febc02fbd59410ac9c00009929ee000069519965e5a878"], 0xc8, 0x48017}}, {{0x0, 0x0, &(0x7f0000002700)=[{&(0x7f00000025c0)="c8797abad59a319e8046ca57ae66d7bfe118c94956db8b9b9bc772a51119de02fa10feee4cb6d3d7371c8fa9a6bae6cc5d072e56b82d2d6c5225e223766a838d222cea507d85502aa016074bef052cc17d7f8ac1b35fcbd3e31b337278db99ca79f4fc0d2256d371c23a2ac47557f713f8164984668fa3ef7caa9bf6abf3c729cf4e6b06e1baf4e8f0dc058b20a0a00792600611f45bf3f240bc77b5287a907232642d2dd96532eed866c6b40f589436dc8a43294ff14eacd51fb6fefeef44636ec58ba69fefc3d9c752fa8c1d7275501af86f61ad35", 0xd6}, {&(0x7f00000026c0)="c6433c1f9246ff8ba2fa5387314563516991cbf6390b", 0x16}], 0x2, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32=r1, @ANYBLOB="300040000000060001000000010000009b29756b1675146c640acdb80000000000000080499de960a7894074688c", @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x80, 0x8000}}], 0x4, 0x4050) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x1001d, 0xfa11, 0xffffffff}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x0, 0x18c, 0x203, 0x8000000, 0x19030000, 0x3f0, 0x2e0, 0x2e0, 0x3f0, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r6, &(0x7f0000001380)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x4}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @time={0xffff, 0xa5}, {}, {0x2}, @connect={{0x2, 0x3}, {0x1}}}, {0x0, 0x0, 0x0, 0x0, @time={0x2, 0x2}, {0x0, 0x8}, {}, @control}, {0x0, 0x0, 0x1, 0x0, @time, {}, {}, @connect={{}, {0x0, 0x5}}}], 0x68) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000001c0)={'wg1\x00', 0x4000}) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r7, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}}, 0x12) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f00000000c0)=0xf) syz_open_dev$sndmidi(&(0x7f0000000080), 0xc, 0x109042) syz_open_dev$amidi(&(0x7f0000000040), 0x2, 0x2) ioctl$TCFLSH(r8, 0x400455c8, 0x4) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000040)=0x32) socket$nl_netfilter(0x10, 0x3, 0xc) getpgrp(0xffffffffffffffff) 1.737932175s ago: executing program 4 (id=4034): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r1 = syz_usb_connect(0x5, 0x2d, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000000)='\"', 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000aa5a0a2003045bfae2590102030109021b0001000010000904cd00019128e024bfb66eff347073ada30009058202000200000027ee0433f3e8a1172fc796a8ca7ac1c7c07285be3b7184b7837016050fb9c0a3585bda8ee36c74e7bf960f35365c0493840a0932fcf0899028365a89f1505db2896907459436f41a4b42ec2079a1fb0a04b0e4c13ffc8af36018ae16a9d49c3310976bd8a12aa2eb7d4054f970ee19e9d9009f82f1d176018e97c4196a722b4c9cb1bb45a31d845d8958464dd9800f33b06e94da4e9cda7eb3918f3a4525ea5b81fa9db637a17198a220bdce9293130e4778d764deac9ba5cd2b5e279917fcbbd6eed107c4a8982bfe3f865822164e15bfe5dc60695c48b48da1a49cad37f0bfa02c79c652bafb7b742f9e9aeee63a5cd17c3c731fff7743206085521a8ff537bf9c4dc8bcb419de7c8b1d7e1eaab39231034325d052d412baf5c1d50fbf3fb42ad2fe8b5f34d59c10711ff6d6019d4bc2536fd678d90d80a054531faca3022cbf3bad6b99c03f8efa594f10984aa7bfc89fa457fcff3db95aa6c7b46603ee071dbc862b3e0cc6cbd0b036a8aa0af614cad93cd641575c326629d5da6049a09ca69928ab6eef73135c737a4c97994249215b20aa98835b5458ddd394c5380ac7db2255c7c65ed2f7cb812bbc0688d03ae2a70f40fb8080a855f1748e28051e64db"], 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000140)={0x2}) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/comedi4\x00', 0x0, 0x0) ioctl$COMEDI_BUFCONFIG(r4, 0x8020640d, &(0x7f0000000000)={0x1, 0x2, 0xffffffff, 0x3}) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x141800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) epoll_create(0x401) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000780)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f0000000e40)=[{{&(0x7f0000000200)=@nfc, 0x80, &(0x7f0000000900)=[{&(0x7f0000000580)=""/164, 0xa4}, {&(0x7f0000000040)=""/50, 0x32}, {&(0x7f0000000640)=""/69, 0x45}, {&(0x7f00000006c0)=""/168, 0xa8}, {0x0}, {&(0x7f0000000800)=""/106, 0x6a}, {&(0x7f0000000880)=""/82, 0x52}], 0x7}, 0xfffffffc}, {{&(0x7f0000000980)=@pppoe={0x18, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000000b80)=[{0x0}], 0x1}, 0xfffffffc}, {{&(0x7f0000000bc0)=@l2tp={0x2, 0x0, @initdev}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000ac0)=""/142, 0x8e}, {&(0x7f0000000d00)=""/167, 0xa7}], 0x2, &(0x7f0000000e00)=""/41, 0x29}, 0x9}], 0x3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x20}}, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r9 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r9, 0xc0d05604, &(0x7f0000000100)={0x9}) syz_usb_disconnect(r1) landlock_create_ruleset(&(0x7f00000002c0)={0x2da8}, 0x18, 0x0) 1.657984705s ago: executing program 5 (id=4035): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x11, @private=0xa010101, 0x2, 0x0, 'ovf\x00', 0x11, 0xfffffff8, 0x15}, 0x2c) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000740)=[@rdmsr={0x32, 0x18, {0x40000010}}, @in_dx={0x82, 0x20, {0xe5fc}}, @wr_crn={0x46, 0x20, {0x7, 0x10}}, @wr_crn={0x46, 0x20, {0x8, 0x8}}, @wr_drn={0x6e, 0x20, {0x3, 0x2}}, @set_irq_handler={0xbe, 0x20, {0xb0, 0x1}}, @wrmsr={0x1e, 0x20, {0xb38, 0x9}}, @out_dx={0xaa, 0x28, {0xe33f, 0x0, 0xfffffffffffffffe}}, @in_dx={0x82, 0x20, {0xa0e2, 0x2}}, @rdmsr={0x32, 0x18, {0x358}}, @wrmsr={0x1e, 0x20, {0xb58, 0x53}}, @uexit={0x0, 0x18, 0x4ef}, @set_irq_handler={0xbe, 0x20, {0x98}}, @wr_drn={0x6e, 0x20, {0x5, 0x2}}, @rdmsr={0x32, 0x18, {0x222}}, @in_dx={0x82, 0x20, {0xa615}}, @code={0xa, 0x5a, {"400f236066baf80cb8d8ea3b8cef66bafc0c66ed470f1039f3430f1efbb805000000b9070000000f01c10f20e035000004000f22e0c4c1b711e12ddf3900003e450f01cfc421f96e06"}}, @set_irq_handler={0xbe, 0x20, {0x18, 0x1}}, @wr_drn={0x6e, 0x20, {0x7, 0x8}}, @out_dx={0xaa, 0x28, {0x5e53, 0x1, 0xcff4}}, @set_irq_handler={0xbe, 0x20, {0x61}}, @in_dx={0x82, 0x20, {0x6d8d, 0x1}}, @out_dx={0xaa, 0x28, {0x4823, 0xae43a637ea8e6437, 0x8}}, @in_dx={0x82, 0x20, {0x40c2, 0x2}}, @wrmsr={0x1e, 0x20, {0x84e, 0x3}}], 0x352}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000001c0)={"04dfc86351907bcbc9293982262169af775bedfb0a63cb8031ecdc0051097e022d45a9640a4a4b506dc328f61ac030dacac442d82c9e81e6847961e65610b8f6e25f9eaf1a9f48ac011b67d68f8725991345a1f8ed6450a11246c6429fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8a481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16893a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2a3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521afbcd560c15cd9f33e36417a251af7100392b6cdb000000000000000efb5589f279cfd594911cb11f2a7336af10b28e80056a2eec8287c735f2346449f1629fde95d6c78bed90645bb2805721ee6dd6068cfd6174d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a450a32cfdfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f235074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0000e9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf6556ce92ae6438bb3e3aa258c8c4ba664f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c50263b3e0314004ec808df7cec279d75785fa2124d10200000000000000cb9506ee7142eb108b3f4125ade3d9a73646bfdac795c753895b2ad51d358eff496d1c1a885c30b85b50eca87ef14ee50ae3301805f1691b3a391d7575c9a0a514710ad3e590491d60bdab122222c66cbb155452a01cb9750d14ffdc77ad11d4495c53bf38c8185c769c1409eb0b1c613eac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c50527200"}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) 1.570840825s ago: executing program 5 (id=4036): syz_emit_ethernet(0x7e, &(0x7f0000000400)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @rand_addr, {[@lsrr={0x83, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@rand_addr=0x64010184}, {@private}, {@local}, {@remote}, {@private, 0x9}, {@dev}, {@private}]}]}}}}}}}, 0x0) 1.512657898s ago: executing program 5 (id=4037): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) r2 = fsopen(&(0x7f00000002c0)='pstore\x00', 0x1) fsconfig$FSCONFIG_SET_BINARY(r2, 0x2, &(0x7f0000000300)='\x00', &(0x7f0000000340)='?', 0x1) timer_settime(r1, 0x0, &(0x7f00000000c0)={{0x77359400}, {0x77359400}}, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000440)={0x28, 0x0, 0x0, @my=0x1}, 0x10) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) syz_usb_connect(0x1, 0x24, &(0x7f0000001280)={{0x12, 0x1, 0x6aabd10a3ab38484, 0xe4, 0x1, 0xe3, 0x8, 0xf11, 0x1000, 0x183e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x41, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x18, 0x0, 0x0, 0x81, 0x9f, 0xe9, 0x20}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = accept4$unix(r3, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r9, 0xb97534d5fe9704cf, 0x800, 0x25ffdbfb, {{0x12}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x20008080}, 0x8008) recvmsg(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)=""/68, 0x44}], 0x1}, 0x80) 1.435779961s ago: executing program 3 (id=4038): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a00)={0x0, 0x0}, &(0x7f0000000a40)=0xc) read$FUSE(0xffffffffffffffff, 0x0, 0x0) getresgid(&(0x7f0000000c00)=0x0, &(0x7f0000000c40), &(0x7f0000000c80)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000010c0)={{{@in=@loopback, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in6=@loopback}}, &(0x7f0000000280)=0xe8) setreuid(0x0, r7) r8 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000080)={0x2, @sliced={0x8, [0x0, 0x7, 0x5, 0x3fb, 0x9, 0x2, 0x6, 0x9, 0x1ff, 0xdd, 0x494, 0x139, 0x7, 0x5, 0x5, 0x7, 0x6, 0x404, 0x2, 0x1000, 0x1, 0x1, 0xd, 0x6, 0x9, 0x8, 0xf6, 0x5, 0x3, 0xe, 0x4, 0x5, 0x9, 0x5, 0x5, 0x258d, 0xa, 0x9, 0x6, 0x1, 0xe, 0x40, 0x7ff, 0x7, 0x7f, 0xdea, 0x5, 0xbb], 0x80000000}}) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000003240)="76f601b79d0b8024975fdd8f656e8bf24d780bf012cb4400066e0fe9456a33f6df61556ee2e30c88532cbc8344c9ca6b9cbcfbe5ef2eaf2ac52ee63c39d1c7646eab3e3351a1f93bbcdbea29f986de9091f926fec86804cb2b480d61bcb83651af576d999dbc5515469ba763dfb38f7de2bcaade317f13f93049197331e2470097907748d5c3912ccfa6577ab574f06eae14f868df308b56480633236e2223543a824039f9a5ebe4fb6d9e471208d7f0dc7267d8698b08f82bb2d2d2856ea7831dd74a8dec5ad9d06465aa99ccbf76b6a4d7033638723c4d78dd983c30ae9491132269785d0dd465bb80a77d017f7fc49de56ccabbffe672e344083c71c5273d7db110f01e37dd0a43ad7f3f36a1352a4b8e48e03eccdde6506bff72c7b0575c644e0ffa346564b2c28f77234c4eae534b85a5b65fa047946f699254d43b541e6e716c125fd165d050a284f734e8b9ad8a17d266e9ec62e81cc18da293476a8f4d4ccf1bc06aecc4a114177193b445fb798351c2e1eda33007d180835d5e62ea422c211ebf84e093c6e440761fc6262d4d8b6b71cd4338a8ccbceb389a4b5874386ac43bf3704d679355614c25b742e3d0a90919a0d9d4cc6b90015fdfad15048255fb0ff3e5452b9bc7c822b70e2c0ff03f5a8e4a148659e2928b5d7e9326eb82d5455695033e9904f95882b78f5d0b84e1c034c9b301f5c7fe44dfb4bb4985f2bd2dd8eba5654b514e30a2e3d99fb2b5e0e81daafee331738e04b95152ad4f8afc5cc6a2ba8ff344e2724ec912e5d8b8e723c2f0626d0084e9a0a1f65bd2380848a04ac8581e5d28bb9b2a0e5bd452cff9d5b308831f7a1dd9d3f024976c2fa48bcf6f716a11fa47fa51f2111e39b808593de2e6056bf332b0fe5cdcc7aa245ccef134a6ed75f65cc455c54c28caffa73d11114c6eafa5c1ad207948e62b94d98cbebc12c67ff583b6e5e5be78dbe96e5e698ca3f73c78b0a1b71e045c09f23a3e43a6d6f5ef1a6712f4e0136e2af8c02c342d8e07df7674b53afa04fe0ec3a068872f51db415500390c40d26f01d4ff7b3e2486215a869f381cc6a4dbe3988dc41abadab498fc62664656e78cab25f859959664f49e90fe2321b6118a5cbd89ff6dd57784ce48971e28d079c70951268d339439df0708d0dd1ea2fd5ea3f9fa226081cfc4c828812c67a22175206f1d75135b49afca01a131f70cf035995203dfe9f3ebe68d63289d180a925ac2b8bded6c0d3b4e506166466c18a2687b9e07185471474bb82d82a9d34bab8a1af6aa028551d4ee82e55fef192900a1473970144f70e2b13fff4745a554620194b5acabf2a8a875af9cb71159792c280729353e792af78fbbdd8dc7124bd2495782758c0024947926f6ebe795513f75596c24e14af3b26e9aa55ab42b59c02a2c5c4e0bd954728a830d12ec71a68c2ae43a3fc3b63295d388eddc0184427ee7beb44197debb94ae81038d64c62504fd902d7bf369897ba91f3a58c745d9c43d994dfce48eb7e9fdddb1db227ba7639fb38c276be3c99877780c01295fd6315a6927daba562934d0ba9026c50c1c5d6afb122c4a4dff00affb1c50d2d3dbe690e84e32ebfd94f1ce1701f12c56695d3fa94cb51ab30ec8cb419543d895362b884033852ada44d4b54b3d17224bc9a67dc3233e4a4c4ea9f24baba1fb192785d5f3163245c758f4022c5dd91b36c9eccf3038417b1b6412ba70f69608036a9866e11082732160306282ee8e8c24ef127d6db45167c0a712097082bb41ade27a097401aa35f3966261135c527a2e7340ebbf05e80dc7ec1bf28007c3f8d1301e67135298a8505929d24c398e9320889f87d9f9f2843eb5b183c8e8158145d9942ff5515aaf21f7905a2094ef92c149d7d30139b68313e0922a53deebe8634d166574b20766906aeaf2fd17441ef004b215f2f7ecf57530ddcccc1cf66c1cf4a90990f36cc2e1b2f39f3ff93f7188e465434d714e9fc17418c017af1f1afdcf316791cfdae8afecedd0d31273627a9294ce823a55e5aba9099cddcc6a7fc56c3fc6ece09952a595fd74f4eddc99080a5d1f27f7f61c38b23f816554faf226c923ae87ee25ae8857b3631cd63c0221a6d31304e828d6e469abe990059762d7cf792d7317b6d7b8959594efd072d46bad84c142e515faa6d548a2615ba2f7cf9174d4a16bb1dbb67061ca8e37181d71fe592690499111d347e9e5afda01a1def2d2f6094f85f3a9d22fd77ab4d0abd3844eee9c1932a4a3d3662b007a481aeb8173042f50448fd7866a163865ca5d8ff077fa9fb376bd98263e73dfd919c9616eeb71c9338fcbb009de5fd05981bc9220f139360ce7d54b5d5c13d997c1854a4c22ff914956dd56ab72f672f2d29ac1616fe4f3b83bbeb1476365dcd53cd339acecfef65cf5ac0ee07ac32d0491769c22d73bd9192be651a644f99145bfb074ef9a456e59e2f3b02a8157825781515c8308cdfb3d08d9bd5022f5f95fafd2394c2f13478913021bb81ef726a828e22b7e4c3d51b26202256287e13f90cc8cfcf08278d8752add529ad774ff3b76d9c1bb60a50de3e6cc40c82bd1c024401c8709643a3613bcb37203aa6bd33d662690f1703faa5bb6469bbbdba05a35f57d8e4d8ec3ef464f253b05347a8853f4778e2c6d3209175d0c7cf278eb1efb5e9b8dad578b4d385cc616c2f88aac6d6d395100f6c56abcb8cd80618ca747e6dbc6962750e68a90bb08cddcb87ca7c82a82cf221f233847cc69bde9d5c5d45ddb36e8d7c7e397fa1ecc289c39607d21f42dd7ebc1def6e2516addecad46e02370ae6b452b672e45db0d99444584f3d1b74895d932e7b7bcf8a368c9eb9906a1717e218dea999dd525b7c5ab20f6086cc22964cd1bb14e9d6fbfac2455fcc39127ed4f6b44391eea05079823d77cce1b29d496590faa6fce916390911c3dc9fa2d9da2e569e89333916f23f32c47a8fd2761c35a1d68235fe9a11c1dec3a716b9f3ef50a1fe45761326fdb3050cb70cc0a612b130fd1a80540f5fb83a796d52a4bc40803010f9ebaf3137dddbd07223719cf99e6d4e8d5de492f0e00a8a864ae0e4b2c23f7ff14f0b0629fb039075b1892af4be415ec00bd355edc3307b8f6f0e3160443264f737dd7a4f028000d2b9eba6a2660d266970db8b6f2660f183a97eb559cc35d8b1285ae0274bc4b7da062e003cf5c7f6274161b276af5571f1cb4560294b7d8c4300d9a4f4edac05d8cd83c32e09172de52d894d7fe2911fdcb443ffbd651cb110e44497ea026e882005508c30f26a61d5249d156aedd1c68c28ecb9dc3309f7d0351c2428e12e89e944a4c8920aab265259c0c4ec045e825a757cf60adf36e64f13761055a3b1413e2994ecbbc42477197b96357d163118f5b3c580751ae8be747d3e39390d3f8a7d14c030c7f69a80ef2848733dca8af7d2c6254a0d9fd210bfc9292bc32b86c7be6cbd49f3d9d63a15bcb364b1e7b50933c519620fddaa805334fe3706411ae900ceb67714271763067d18a539769131e09893a47187eeb1f9ef3d4cf78ebf1bb86a7d03c569288c847cb522e63016393647c28762b1f4309f32f1fe8032272ffe746362624b4db110bfd77573924a095bb670e240aa77409d970a5bd73388a8e1fc07117e79730c1f460ae276b4e6cc9a6710473093b8ed5632e566b9af3610f3979d66177f617563afcf52a0c79acef4005c96e170b444f3b4b53d2f9e13cf1916981342ec9a5bd0161f70d29b037d8a40a869e37007c655b9cc1fb7ba9e0e0ab8511ee616158fab5d8367425ac10c1a2fee9a6f1e9513c4183f4aa2709ef577b53c417fbf665446ae633aed91ff3dde78609caa95c81bb038d3a127c6e46c05f47b2c1340cac500b7345def40ba783ba57af7074438114ea5ae50731547136552359d32eec66c1fee823e3cf2093556a95f3fd604d929db8f82ef1de9c08bfacf62b745b400b43c7298efb1c0bdb69efcb5c3a694b034e8fe3a1677f3932cb3475d13584dc0e0c17912798248251c4260a160dda45224247a26222e3b7cc0d2b8774d3d0889e02ec7e55c160f2137ec4907b6b1850ba4863d44b4404ccd738c87c38aaff8aea9628cf2352fb0ade0735d1655785fadab3014bdf97331233372eaccd96c4de1eceaf2df26fd89711a26e7723d41e00df5c4c781bc4860e4aa40cee880a50a44e76d94ed2b4f00f2f96ae4bb4720b6a5b577ccceb8ee9ee32d5763652c50cf1cd187566e50c758efea2fdb84f0470bff3f323ee06d5b1ecb279d0be632fd91d527399718ec2afe0d29d99aac333d14ff8625490a4569b3b9c79213e34309ac4efed69ef444c6c2f3045114217294e03463e93aa99f20dca9be754573c9facdf7b6b20193639d192583c556ebde9b370fcadffeb60a083153ed76cf7476ca0630d6a0e99d0c523474b308a53fe9ff2139291320c6759e4d3f1fbc4fab69f20f361c646da2c8469a561939fd7a142517393c306ce8d978a8599fec8a7e84deeb5bbce13af734be5a0dbd9a83220d7d253b382fd06988d633aa74b1b45d89acb36561a5842a2273e32fd8ba9d65ca01595f48ac22d20cc952c01c1002f7fe23bb0275db973da143e21c7d6dffdd489c6895729b5376260b5556faa270ea6b066c8b9a9cb5a632c82c2ae5578ba6455182a5994f78d1cb5cb9e374ef15dc1bf2a37946248883f7e758f1884ff2a08de8c1c80f27aa301c1bbb3ef908cc4044b35fa5451b2d8898dfeb44e563f04c7b1e32df465c50520688d42c8ae5fae42ecd61a32fb9623ce2fc1166ba86d5ff4a8ba3201c5623c8baf622b07f726b5c85ae0fe565abbc0078365bf3ce1c621341feb2442f0a9e742abbe9c709509710c261f607fab542e66b119db4abf09deb5c39210f8037075d25602b1ae06611d05f05f7055a00053c8f98076b86bdb96b0f1ea857fb9efa386a7f3166bc508e2805b2a002b1c5ae57f1bd674343692668605dc166429a8990b0e267158f683ad949867e5570657a7a63bf8c7f7dd224be3c5b046240521e71fea3acd66ba4400c4b5fa67a132e2c9420cc5fa35e699a5cfcc2a858f102f3416296da7648fba51ef15cf5a34f55960b0774fba55ed48dbc9740a29ed7740b9ae3b7ab12d1f15a334a0ce35a08dd753c7d04860df615823e2133bce7c868b3b796a6b5e908ce7a2908f6da91f6ab5a689f7de9371193a3ddf175d263de90554b3144e00a7913802c0e0ff668f6209e021143e16d8c504c65bbf971b0d7f96b5cee9c658b3b7b6504b5527a07a069c413bf69e4de1385a60bcf803f20288ac67acaccc72717d659236d0e54c4bc5941b28f04c55a90b9ca924d1cfbec332eae77c0aa17072fcde7bb374ba98e477d91ce4f0af024b0129a38566ec1b67550def350a769f121323fbe6aefc06607d47c40e5d1d37581090a0a1da4aeef2645f0295d739c6bb351519880b7d52e248840948544a347e448c8edbb69e2683ea2cbbc065ccbe647dfcef8c303dc4d3b9d2a3e530fd2806a5d97af84dcb27ca971bf308936e80aed0bf19e30c4bd031c50ecbb9eef983e28fb7ef801dabed9b9a0db66845abce23fdde3e891411b178efc28ee2b1c99c57e695ffb3a40ef3cc54682a48af5606c4387446b331d9ca16a3a365e5900032012017abf905882865dd4327f19e22a64408ee22ba9df65a4cbd49b4eb116b0953389e9ab221f4283df5add7c6e68cbdebb27da8d043324f691860519896e6ec2f7cdb943f4685b29b55edab73e6a25d08ac1e2f93e4d742bc68a8d5e9b5812e0beea9d3edd1337bc04f21ce6c027488fd60f210fccbda760b4c49df1e6c4c6efc4e9b9c1e6521e17b8be28f176fc6a32b01f22127429bf62dda91d3f7b82dc49c87c8dfb43c7662caf5a1f18e1ffd64e34aa69e30f3b56c5aac615d00cd8ea46647768ee60d91dae060f925f426955e129de1a6055077e0e2f5fabd2db7ff00bc6bd9a7b3943eff29b8a970ca5d62f7bc6c89caa082daae81a4a830fa900f36681c5c565aee005650a2de1cd050ee90bee8c2a73a66aea7921b84cd1fd03193bf7e46cd3917c334435112fcc93912129a8b3a5f7bb187848a47d5ceeb04fc6583ef79d868675f3fcf00cd2f3a5fef9aa3e6cc26e966e600b9389729a211348496630cda2796d7d9ca68d05481b627f3ac7181dfa4d21d7f41556b4abfb8571d93990a16e2cc8a9da8f633c6e9c0dcbf6bdbc94f11d8fe065954a7c680c67211a454a47787145e034b3bcac7de6d5840d7c082ae8db142d7e012b9af4fab57567473eb48787ae1a7d1baaff6353a934ada7c61fe99646074236569427a3f5b13a39f2cbc5da377fbca0fb0bb23fa76647db85a65d7f15811b9fb5c8fa1c885699d95e682176ba9a4469c98b0c36911bd0727353f63a5be311c5f6e980acad3d12075d843c5e5534a429fd1ec12ca9f55919dbdcfe24bc93c2306e0f4ae92d669f9308bee0489a554d8f2711e7d420bc19ef7352c0a413176e37265b2bf3b91f0babb91c52b718e4cddfd6089c8c5b7798c8485c7781ef02397131cbb66edbf7b2b4a0c330199fa5a75ee2c32304b7542d01142da5a141bf3b50947cc5cd0ac0c3b466f0996968b995b47001bad22247abec283375c5f561a6cf310b47c5f9c632e81936f7fc12d022701e125b2c33354b76684e71353f1ecf31a99ce6381a8909875197f64bb45db0005f481b240e3871595c054fff99aa4d65ce3a87350bf13eb46970fa24e5423065aeceaae9f2c68b344331775ccd80451a7f9997e520d78057db61c4df4809f91168562bfa029e66f021cde933cc6363f3c5dffa411cb5cc06b457164204bf3f5cd76aa52108a92d682fa2b71de3826f881236caf8c7973ddfa4e8f1b0b988218c18e3602aecb4fd97d62cc2cda19206762ca7f59fa5977f8d352bfdf3c523474a910e5f578005a0666aa87e5891d85a14bbd18362db1f83149e9aa42b954ebf38338822b4c6a50f3076c596f7d9745d2f370a32ce1a6baddcb9dabce333920833c48926ba45248d5b06138429d416e58924ba0de09e1c7eec17d67b49df099e327e0838e4040136c62c52a5862c19f30a8cc7447245287dbb90d48685efce5e0a123c115cc9097d36ef525c0e4253436c00a3c9506f5a0dc9e8cac925773a9be019e2fd3129ce7f4667c5080ad69a404fb59ffa21bb4cc869bbe7a820a389046f0f881fa1b7648141bd11c62bd3205ee515c1772d7792728bd0511971b827ec39032e6d5c04a809b1339b135da3cb4e286599901d67fecc5b2c128b280245bc0394edc4af94fea14b5a2340aa878763a559ebe78cce2f98a9255ae118bddf67813693a5b42ee4ff06776f4ec742f375d5935f8bdbc3c250b84cd98cbfdc97442327c3968e45b333f639316c9bf57d0349ff8ae7f2b1f7d93e1e362d13cf8b65d84c47cec544cb1d8309cd87cd091a6a22af33d543b4c7b5adb6b5cc1e3fc1de630c37a966c9f114a5ff169a7be7868d9f055a020b230bf1867de75e7ede74c3517e6bcffc95bac076186a0ff834467c458cf01b07ca2355d0de6e00bc6896aaaf87c0c4085a2ca6246f0be731caf0eed29996cd2b92e628fac2a736bb7e03960db3c0bb69e402d6c5cd47bdd6f1fd426bd29b039e33850fe512f87a6b679cecb67e9193a2abceeeee290546478b664981e38f2ee15550f5659270755569c6d43b1fff0cf035fb87c84bdc68d4ab2d6779b8018c7d4b6cc4a3ff791ff85f648f9ec9037a6880c16a26e50fa72e51d31d60db2d633c15c5306912272521bf3cc7a4485ed277f8526e33d68c9ebefc29a021a9dfbaa9e4d7efbc2dbde91d1bb842adbac1f89be8b3f83c734dbd95829ce1057d3f05c3d267ddde80abf9de0dffba52183c14573fa056f799f2013285c3fdf81b8c4c6e091496d84c83a3ef01d278fa5db5e42f1900e9823383e42cc65b912766dc430920d7d83708f581c6f0290af10eaaf38635002d084d1eb5890eb16f96a17d211ac3f1dccf80866d25019ded5c4ecfdc2d5cb2db77ba1b034105a7eca24668c34eff7428aad5c125f9c09fd55909f320e645e692b27768ac4885b8bbf9fc872c8492b8775819554e10fc97566a98256d9125551df83f12c6b3c3ad9cf5386910e2674d1c86396027a9740de6a25eafcd082ab7109a9c62d1bca922e211902feba09790fb838ec7a54c9e53aae6b55f83d99ee3ee572b7c852c10819de5fd369dbc6e397c4516000d8a2cd6c008d903bd5b77065e070fed37ff4b1139b9dd002ec64f08de653dc715d0bdfb9c4a3fda41812926a7a0a5c450acf97c05183e22f998e6ceaea047ffa223ee94ce9d6f00430d0a458dc75da361795d8db8105b10b6168236869affab9d93fdd212edf27179c6d58467e529808e916b8dd36a4c69d79650b293b9d5bac76bd7a05774730a612d6b95a897a6bcf2e0fabf626eefc72ec3cc6ed16559ae241a4c1bb67fcab7f11097697e449fd72c400e3ef33905abb39126353a30e0a97e3e50b0540b86cc1bbca1463b458b8fb7b31fcd9fca318d812259202ca30b01c84b738d5df2109d10119c1f59476ff79c5079f5cd62e841dccf465387ddc03b64e490a01056e977af2e7dd8605154bd2e5f6d3a479b364c4fd310a77f703e250ef72c12b58218bf782718bd4cb4f1dc7611fa5e1d4619fa74266908d2c56e8ee16c653c19bfea26cee24cef0b21fdf58524b0dfaa4bdc64c41574d8141e7347717f7917dfd04c6f67e5b6e93e209d00de1357fbca3e6a4edf72db6c6cb478dd6f9063d47821202088e0a74a34d73db9e79dc768d7be40c61391f533dca18d3883f309f5a07119d35d53c3f9772e841f2732dbbbb267fcebd2b5026428fedafcfc3dddeb9b41f8d1c91053f1ace44bf3fa83e63d529a745a0b0b30d9f10106a1897842e526a9bd5263d708fbd2941ba74a4df42f775a893d21a2ca1367729cbe0898e7c050658845e2f214544bb6e096ff38822d9548cffa5a067b9a5ea9b18c66a26d43dca63af3446a9a21320bd31fd1b81a0e2445a204500fb81440db7ca7290465a534d2959dc4130a47600e31f3bb01fdf32206f677d33d2bb9342121fb8fb20b70e8735f99c03b2bd2ef23fbbb36cc80b2c1bce07b25b6fe954e7be7b2d18c1ef4360a08bbd008a9731d0278d98a590c68fca65429c97fbf55ea8cc6dfddd632860636ce83d31de7830b2a44feb1d170c205fb81dfe9ef8a5a8466ca11a32504fe99b4d966a2a8496a59528f599e67bba155d7bbc07829c2e7ab72af135fc2243da1d5a4e57766a0d961a7cdf9927427b5540670dc163035ea513c424fc19669baaf42027a4db91c48580749c8fe16d7eaf966013be709275e853c606ec55fe8d6392c04dbb70b4ca6dfea39794f767ffd0e1e23cc259d9ab6d44d1d9b5b5535780044e2c225ec1f115ba0c318f792fa33082d14726d1a6692152049a6d84bb20e5a0b8e959651058c1a98ee505aecec531c1ecf9f6cd0e29b431d590ab262ef4634ea6c58924e644b4a30486dc4dbea2c4a5ff48ce239118c487b916a35ef951628d6cd230c066eca77e8825c049eb5dcc1e2ab929947e60b918e71c67e3ae950a2525af9c5a0c8c87b2167a8350b10df2d03f3b8e98e04b61ec23ffeea024c33c2760844b11f7407cee92c96b1173b0bfbf29bb8776caa7d7afed041ec9c79d8366de9ce3fea29bd18e54b79729d421c129c2dd53f402d454723044606cbf2633cf247da4c3afad442d1206af2ab8d4b70ad760fe6e7d54da7d68bb2e1825b96a6cb6097932e997d4affe457e95f84bcd289721474ffff8693f85edba1df635aa88062f774816eb24905b738df5a79475719f5e89c01eb6435dc1544f2b820c8f947120409f7022497263d2ac2dc71038be6eebc685a52a526c6d761623a812f0eeffdc89ffc70718a8a6f4c7c23d2b72d2f5ea05027cfa2eb99e4020e100f9e50117c6bddb51ad52f9d39a8830efdbb0d82cd80a0c446073462d4492443ff56d935bfc3c1830111c8979bba57f67b38da169fc1c470655e8485c90a7ce3ad4132ba766ec66effa597bffd92136d6e8fc3b84dd3adca34be23e2f6fe9e778bebd0fbf2d08d88ba7697c68c92adc26d584ae8c2bff41f22a646f1f4803d16e93f111582fd7687b146e565d02e371947af9d17a786c7d918faa99d3fa5fe430a23fee503cfcd8138478dedb14ce289ca5cc0a9cc4a00abdff3eeb9748c88c830a2736be5ace3e8a8bb4e6f4554bb72b53ed71d0337a194add661a4b1988ff84471487eb914a8777bbe55f9efcf046c6d894c13525ad3068e95a1c43137982e322cc2bbb4e4f165b3ea3bc9ea3eeefa632bad1fa0e94cb0406df27897ec1b6245229569db6fcf050f80477cc0a9251e7049b6cdb2a1fcd30f599d69f1d199fd1c941fa7499bd8233aed4706d1cd9922b06f23ee5d1fa6bc6a812409866bccfcbe00d22ea203847682bfdf9b8b2bf9bf56a8ffc4a4dc6e824ed948c7c57694f9f63fce433d83df6816e18f7398a5976822d521acce0a5a11053c35c5b7ccbaa0f17e1d86e5d770f18621dff506a243406f1cb02cca430ffad67f7a8223c818e4ecf75f08741884fb7022d51f1467381603a15ff97bdc94b9365091da2236e717095bfa47b4a6664b01f8c6560caae804b5270aca832e04980e0fa6a4c591ae67c70619af1ac6ec31b8d7ab690d109201759946c89450f6dcd9f9b6510eece71fc35c62cf23bad04ee4e7842fa35ab89c75d119842633ca11ba36571eee22d3a63d7f29a486529e7d5499e3fca66e057cb439b36e47a9c3a7d616872b18efdda8c11080a04a2ad4c1818a1e6db2096abaa7bb839faf42c7ca7db712b3d4af7fe9162feebf98766f7fa41760e4821d6d1022d0566e04f1f444c6ab77488e058934b9559f980b946959c69cfc2357cb2a2930c5365b5a8391b5afba04d6e3a529df2c3008b30d47cbca616e460724d18a863d27e011c87827a791c714c99f418e114514c6d2e6e25455f01bc671f859503ec6a66391de7c7f7f35bb96060bfafde238b40c0e8a50bf3cef9bfd67f1b81b78c487bfe5f92b62cc3597912fe585d8c2b3e8f53c657849af981858fbb5ca6f9c4eaa7975f6c54f8e15569c45c823530d1dce4fd298cebb35d0002036ede29f413f79927c0f59592d12f65e15344e9c37a976f57853390f878201e07159f7ea30c47e30318986eb252f8402b659dd7bafed4d256f0f6e57d75ab533e36d09bdf032cced915185497ec9317162b61c0a89a442779009ed252f221db25916173849a3ed33ecb7b250c3dafaa6729f24b7e83a02e3d86edefa24658f458002dd5470882c04bd9f7bca1a93aa360b7dc9cb70b60b7b1d95a7e03e99113aad7f36b9a0e666c184ed4103598235d17e3eb30a41acd42d49694f6e05a115b09ca85f3b5d0ee8e0c6419a4b85ac6a2e21200a9d0860139033fe7e16d2ef0ab6a5871dabdc7413e271090a317ff039f28b229ce168e838f22e1c6d105186ebaca8e0a03818241898c2f09d66c94576b4e5d89c5a56475928bd42eb9b01f4be5f5b25d64001c0f03f89d94a1", 0x2000, &(0x7f0000000f00)={&(0x7f0000000680)={0x50, 0x0, 0x42d, {0x7, 0x2b, 0x5, 0x4000000, 0x4b36, 0x758f, 0x2, 0x5, 0x0, 0x0, 0x4, 0xff}}, &(0x7f00000001c0)={0x18, 0x0, 0x6, {0x9}}, &(0x7f0000000400)={0x18, 0x0, 0x3, {0x9}}, &(0x7f0000000440)={0x18, 0xfffffffffffffffe, 0x6, {0x9}}, &(0x7f0000000480)={0x18, 0xfffffffffffffffe, 0x2, {0xded2}}, &(0x7f00000004c0)={0x28, 0x0, 0x4, {{0x58, 0x5, 0x2, r1}}}, &(0x7f0000000500)={0x60, 0x0, 0xffff, {{0x8000000000000000, 0x0, 0x5, 0x2, 0x5, 0x7, 0x2, 0x6b}}}, &(0x7f00000005c0)={0x18, 0xfffffffffffffff5, 0x2, {0x10000}}, &(0x7f0000000600)={0x17, 0xffffffffffffffda, 0x1, {'\x00\x00\x00\x00\x00\x00\x00'}}, &(0x7f0000000640)={0x20, 0x0, 0xac9, {0x0, 0x2}}, &(0x7f0000000740)={0x78, 0xfffffffffffffff5, 0x3, {0xffff, 0x1, 0x0, {0x2, 0xa, 0x6, 0x82d, 0x6, 0x4, 0x2, 0x9, 0x4291, 0x8000, 0x2, 0x0, 0x0, 0x401, 0x3}}}, &(0x7f00000008c0)={0x90, 0xffffffffffffffda, 0x2, {0x0, 0x2, 0x2, 0x8000, 0x2, 0x80, {0x1, 0x1, 0x4, 0x8, 0xaea, 0x0, 0xa, 0x1, 0x9, 0xc000, 0x5, 0x0, 0x0, 0x8, 0xc}}}, &(0x7f0000000980)={0x48, 0xfffffffffffffff5, 0xd, [{0x5, 0x4}, {0x3, 0xd03, 0x3, 0x9, '/+:'}]}, &(0x7f0000000a80)=ANY=[@ANYBLOB="58010000daffffff08000000000000000400000000000000010000000000000009000000000000000700000000000000010000005f080000040000000000000006000000000000000400000000000000000000000000008004000000000000008100000000000000ff03000009000000090000000020000004000000", @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="8a8d00000100000000000000030000000000000009000000000000000100000000010000250000000000000002000000000000000300000000000000ff01000000000000090000000000000004000000c200000001000000000000000004000000000000060000000000000003000000000000004e090000000000000600000000000000ffff00000b000000070000000010000002000000", @ANYRES32=r4, @ANYRES32, @ANYBLOB="09000000b800000000000000000000000000000000000000010000000d000000030000007363ffff645f73776974"], &(0x7f0000000cc0)={0xa0, 0xfffffffffffffffe, 0x0, {{0x5, 0x1, 0x1, 0x8, 0x6, 0x2, {0x3, 0xffffffffffffffff, 0x6, 0x5, 0x5123, 0x2, 0x81, 0x3, 0xf, 0xa000, 0x5, 0x0, r5, 0x2, 0x3}}, {0x0, 0xe}}}, &(0x7f0000000d80)={0x20, 0xffffffffffffffda, 0x0, {0x9, 0x4, 0x0, 0x8}}, &(0x7f0000000dc0)={0x130, 0x0, 0x6a, {0x79, 0x6, 0x0, '\x00', {0x8000, 0x0, 0x677, 0x0, r7, 0xffffffffffffffff, 0x8000, '\x00', 0x2, 0xbd17, 0x7fffffff, 0x0, {0x9, 0x400}, {0x4000009, 0x1}, {0x14, 0x6}, {0xa117, 0x4}, 0xed4, 0x1, 0x1, 0xf}}}}) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xf3a, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="140000002e00010825840000000000000000005e"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000180)="71e67a15cdf0311cfcf33a52a7d8", 0xe) accept4$alg(r9, 0x0, 0x0, 0x0) io_setup(0x20000000001005, &(0x7f0000000880)) 1.240306924s ago: executing program 6 (id=4039): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000004180)='/proc/mdstat\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000009780)={0x2020}, 0x2020) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$TCFLSH(r5, 0x400455c8, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x88, 0x94, 0x5b, 0x40, 0x46d, 0x8b7, 0xca8e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdd, 0xc5, 0x42}}]}}]}}, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0xffffffc0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffee4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 70.701701ms ago: executing program 3 (id=4040): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b40)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x38, 0x0, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008894}, 0x4c010) 40.962937ms ago: executing program 3 (id=4041): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[], 0x0) 0s ago: executing program 3 (id=4042): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x6) syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040ed5000410"], 0x11) syz_usb_connect(0x2, 0x56, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b09040000014106cf000824"], 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x0, 0x22802) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000340)=0x4, 0x12) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x14, 0x32, 0x20, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'hsr0\x00', 0x4}, 0x18) kernel console output (not intermixed with test programs): altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1434.059644][T20122] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1434.071313][T20122] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1434.084983][T20122] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1434.107101][T20122] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1434.117115][T20122] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1434.127326][T20122] usb 4-1: Product: syz [ 1434.134065][T20122] usb 4-1: Manufacturer: syz [ 1434.138834][T20122] usb 4-1: SerialNumber: syz [ 1434.146801][T20122] usb 4-1: config 0 descriptor?? [ 1434.152677][T20589] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1434.163721][T20122] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1434.174693][T20122] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1434.204513][T20122] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1434.342751][T20594] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3615'. [ 1434.356609][T20594] libceph: resolve '0..' (ret=-3): failed [ 1434.446328][T20119] ath6kl: Unsupported hardware version: 0x0 [ 1434.462016][T20119] ath6kl: Failed to init ath6kl core: -22 [ 1434.476133][T20130] usb 4-1: USB disconnect, device number 68 [ 1434.497749][T20119] ath6kl_usb 7-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 1434.659934][ T5922] usb 7-1: USB disconnect, device number 57 [ 1435.184678][T20585] batadv_slave_1: left promiscuous mode [ 1435.323285][ T30] audit: type=1800 audit(1762471305.876:1083): pid=20600 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.3618" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 1435.376531][T20119] usb 5-1: USB disconnect, device number 47 [ 1435.961960][T20609] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3620'. [ 1436.167078][T20617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3624'. [ 1436.181144][ T5922] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1436.331590][ T5922] usb 7-1: Using ep0 maxpacket: 32 [ 1436.339428][ T5922] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1436.791109][ T5922] usb 7-1: New USB device found, idVendor=d575, idProduct=8f3b, bcdDevice=82.88 [ 1436.800172][ T5922] usb 7-1: New USB device strings: Mfr=141, Product=3, SerialNumber=3 [ 1436.811869][ T5922] usb 7-1: Product: syz [ 1436.816072][ T5922] usb 7-1: Manufacturer: syz [ 1436.820675][ T5922] usb 7-1: SerialNumber: syz [ 1436.831949][ T5922] usb 7-1: config 0 descriptor?? [ 1436.842124][ T5922] cdc_wdm 7-1:0.0: probe with driver cdc_wdm failed with error -22 [ 1436.871210][T20128] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1437.035863][T20128] usb 5-1: Using ep0 maxpacket: 8 [ 1437.061394][T20128] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1437.073057][T20128] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1437.081677][T20130] usb 7-1: USB disconnect, device number 58 [ 1437.098532][T20128] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1437.122028][T20128] pvrusb2: ********** [ 1437.126032][T20128] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1437.138303][T18426] Bluetooth: hci3: unexpected event for opcode 0x1004 [ 1437.146688][T20128] pvrusb2: Important functionality might not be entirely working. [ 1437.154660][T20128] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1437.166178][T20128] pvrusb2: ********** [ 1437.361707][T20119] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 1437.497828][T20627] capability: warning: `syz.3.3626' uses 32-bit capabilities (legacy support in use) [ 1437.535441][T20119] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1437.535471][T20119] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1437.535494][T20119] usb 6-1: config 0 has no interface number 1 [ 1437.535538][T20119] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1437.535561][T20119] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1437.535590][T20119] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1437.535619][T20119] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1437.535652][T20119] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1437.537610][T20119] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1437.537640][T20119] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.537662][T20119] usb 6-1: Product: syz [ 1437.537679][T20119] usb 6-1: Manufacturer: syz [ 1437.537696][T20119] usb 6-1: SerialNumber: syz [ 1437.540188][T20119] usb 6-1: config 0 descriptor?? [ 1437.541571][T20623] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1437.544661][T20119] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1437.574398][T20119] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1437.667446][T20119] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1438.454109][ T30] audit: type=1400 audit(1762471308.556:1084): avc: denied { mount } for pid=20631 comm="syz.6.3627" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1438.492314][ T5922] usb 6-1: USB disconnect, device number 85 [ 1438.616208][ T30] audit: type=1400 audit(1762471309.166:1085): avc: denied { unmount } for pid=13508 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1438.651727][T20128] usb 5-1: USB disconnect, device number 48 [ 1438.652452][T20128] pvrusb2: Device being rendered inoperable [ 1440.221332][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1440.240359][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1440.294027][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1440.476834][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1440.492114][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1440.528051][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1440.548012][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1440.557953][T20651] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1440.568282][T20651] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 1441.226577][T20662] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3635'. [ 1441.322743][T18426] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 1441.332272][T18426] Bluetooth: hci3: Injecting HCI hardware error event [ 1441.343327][ T5823] Bluetooth: hci3: hardware error 0x00 [ 1441.440092][T20664] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3631'. [ 1441.803670][T20664] bridge5: entered allmulticast mode [ 1443.338277][ T30] audit: type=1326 audit(1762471313.886:1086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1443.421230][ T5922] usb 7-1: new full-speed USB device number 59 using dummy_hcd [ 1443.582995][ T5922] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1443.583066][ T5922] usb 7-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1443.583097][ T5922] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.585535][ T5922] usb 7-1: config 0 descriptor?? [ 1443.591849][T20688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3643'. [ 1443.621436][ T5823] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 1443.841543][T12636] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1444.001264][T12636] usb 5-1: Using ep0 maxpacket: 8 [ 1444.002597][ T5922] lenovo 0003:17EF:6047.0010: unknown main item tag 0x0 [ 1444.014696][ T30] audit: type=1326 audit(1762471314.576:1087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.041924][ T5922] lenovo 0003:17EF:6047.0010: unknown main item tag 0x0 [ 1444.053057][ T5922] lenovo 0003:17EF:6047.0010: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.6-1/input0 [ 1444.071519][ T30] audit: type=1326 audit(1762471314.576:1088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.075312][T12636] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1444.112087][T12636] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1444.149158][ T30] audit: type=1326 audit(1762471314.576:1089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.183135][ T30] audit: type=1326 audit(1762471314.576:1090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.189646][T12636] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1444.211494][ T30] audit: type=1326 audit(1762471314.576:1091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.271748][T12636] pvrusb2: ********** [ 1444.275745][T12636] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1444.461331][T12636] pvrusb2: Important functionality might not be entirely working. [ 1444.461348][T12636] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1444.461359][T12636] pvrusb2: ********** [ 1444.486012][ T30] audit: type=1326 audit(1762471314.576:1092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.486187][ T30] audit: type=1326 audit(1762471314.576:1093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.486745][ T30] audit: type=1326 audit(1762471314.576:1094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.487083][ T30] audit: type=1326 audit(1762471314.576:1095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20674 comm="syz.5.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99b858f6c9 code=0x7fc00000 [ 1444.566690][T20700] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3646'. [ 1444.971856][ T6100] block nbd0: Possible stuck request ffff888026297000: control (read@0,1024B). Runtime 270 seconds [ 1444.971897][ T6100] block nbd0: Possible stuck request ffff8880262971c0: control (read@1024,1024B). Runtime 270 seconds [ 1444.971928][ T6100] block nbd0: Possible stuck request ffff888026297380: control (read@2048,1024B). Runtime 270 seconds [ 1444.971974][ T6100] block nbd0: Possible stuck request ffff888026297540: control (read@3072,1024B). Runtime 270 seconds [ 1445.124652][ C1] vkms_vblank_simulate: vblank timer overrun [ 1445.471190][T20707] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3648'. [ 1445.634920][ T5922] lenovo 0003:17EF:6047.0010: Failed to switch F7/9/11 mode: -71 [ 1445.762455][ T5922] lenovo 0003:17EF:6047.0010: Failed to switch middle button: -71 [ 1445.763039][ T5922] lenovo 0003:17EF:6047.0010: Fn-lock setting failed: -71 [ 1445.763491][ T5922] lenovo 0003:17EF:6047.0010: Sensitivity setting failed: -71 [ 1445.767144][ T5922] usb 7-1: USB disconnect, device number 59 [ 1445.951131][T20128] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 1446.101063][T20128] usb 6-1: Using ep0 maxpacket: 16 [ 1446.102989][T20128] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 1446.103006][T20128] usb 6-1: config 0 has no interface number 0 [ 1446.105488][T20128] usb 6-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1446.105510][T20128] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1446.105532][T20128] usb 6-1: Product: syz [ 1446.105550][T20128] usb 6-1: Manufacturer: syz [ 1446.105567][T20128] usb 6-1: SerialNumber: syz [ 1446.107661][T20128] usb 6-1: config 0 descriptor?? [ 1446.110275][T20128] uvcvideo 6-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 1446.110302][T20128] uvcvideo 6-1:0.105: No valid video chain found. [ 1446.288261][T18426] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1446.289218][T18426] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1446.292023][T18426] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1446.293721][T18426] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1446.294473][T18426] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1446.539801][ T5922] usb 6-1: USB disconnect, device number 86 [ 1446.671365][T20712] FAULT_INJECTION: forcing a failure. [ 1446.671365][T20712] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1446.671418][T20712] CPU: 1 UID: 0 PID: 20712 Comm: syz.6.3649 Not tainted syzkaller #0 PREEMPT(full) [ 1446.671441][T20712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1446.671453][T20712] Call Trace: [ 1446.671460][T20712] [ 1446.671479][T20712] dump_stack_lvl+0x16c/0x1f0 [ 1446.671515][T20712] should_fail_ex+0x512/0x640 [ 1446.671545][T20712] _copy_from_user+0x2e/0xd0 [ 1446.671571][T20712] copy_clone_args_from_user+0x150/0x7e0 [ 1446.671599][T20712] ? get_pid_task+0xfc/0x250 [ 1446.671619][T20712] ? __pfx_copy_clone_args_from_user+0x10/0x10 [ 1446.671660][T20712] __do_sys_clone3+0xbd/0x290 [ 1446.671686][T20712] ? __pfx___do_sys_clone3+0x10/0x10 [ 1446.671728][T20712] ? __fget_files+0x20e/0x3c0 [ 1446.671770][T20712] do_syscall_64+0xcd/0xfa0 [ 1446.671792][T20712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.671812][T20712] RIP: 0033:0x7f277518f6c9 [ 1446.671829][T20712] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1446.671848][T20712] RSP: 002b:00007f2775fc9f08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 1446.671868][T20712] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f277518f6c9 [ 1446.671882][T20712] RDX: 00007f2775fc9f20 RSI: 0000000000000058 RDI: 00007f2775fc9f20 [ 1446.671895][T20712] RBP: 00007f2775fca090 R08: 0000000000000000 R09: 0000000000000058 [ 1446.671908][T20712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1446.671920][T20712] R13: 00007f27753e6038 R14: 00007f27753e5fa0 R15: 00007ffcbbf28268 [ 1446.671949][T20712] [ 1448.342429][ T5823] Bluetooth: hci1: command tx timeout [ 1448.484903][T20709] chnl_net:caif_netlink_parms(): no params data found [ 1449.184745][T20119] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1449.564546][ T2341] pvrusb2: Invalid write control endpoint [ 1449.575559][T20119] usb 4-1: device descriptor read/64, error -71 [ 1449.738354][ T2341] pvrusb2: Invalid write control endpoint [ 1449.738369][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1449.738380][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1449.738389][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1449.738400][ T2341] pvrusb2: Device being rendered inoperable [ 1449.749345][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1449.749390][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1449.750113][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1449.750126][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1449.750136][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1449.819251][T20709] bridge0: port 1(bridge_slave_0) entered blocking state [ 1449.903772][T20119] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1449.914563][T20709] bridge0: port 1(bridge_slave_0) entered disabled state [ 1449.931317][T20709] bridge_slave_0: entered allmulticast mode [ 1449.938936][T20709] bridge_slave_0: entered promiscuous mode [ 1449.942637][T20709] bridge0: port 2(bridge_slave_1) entered blocking state [ 1450.003406][T20709] bridge0: port 2(bridge_slave_1) entered disabled state [ 1450.003606][T20709] bridge_slave_1: entered allmulticast mode [ 1450.005491][T20709] bridge_slave_1: entered promiscuous mode [ 1450.041171][T20119] usb 4-1: device descriptor read/64, error -71 [ 1450.077607][T20709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1450.083204][T20709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1450.152237][T20119] usb usb4-port1: attempt power cycle [ 1450.196654][T20709] team0: Port device team_slave_0 added [ 1450.198413][T20709] team0: Port device team_slave_1 added [ 1450.225753][T20709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1450.225764][T20709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1450.225779][T20709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1450.227238][T20709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1450.227247][T20709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1450.227261][T20709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1450.273370][T20709] hsr_slave_0: entered promiscuous mode [ 1450.340679][ C1] vkms_vblank_simulate: vblank timer overrun [ 1450.365890][T20709] hsr_slave_1: entered promiscuous mode [ 1450.379378][T20709] debugfs: 'hsr0' already exists in 'hsr' [ 1450.379400][T20709] Cannot create hsr debugfs directory [ 1450.420186][T20128] usb 5-1: USB disconnect, device number 49 [ 1450.426941][ T5823] Bluetooth: hci1: command tx timeout [ 1450.607748][T20749] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3659'. [ 1450.731732][T20119] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1450.748008][T20709] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1450.755686][T20119] usb 4-1: device descriptor read/8, error -71 [ 1450.759081][T20709] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1451.311579][T20130] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 1451.313671][T20709] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1451.458643][T20709] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1451.491319][T20130] usb 7-1: Using ep0 maxpacket: 8 [ 1451.612073][T20130] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1451.640000][T20130] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1451.857332][T20130] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1451.883933][T20130] pvrusb2: ********** [ 1451.887937][T20130] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1451.917886][T20130] pvrusb2: Important functionality might not be entirely working. [ 1451.937243][T20130] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1451.964240][T20130] pvrusb2: ********** [ 1452.407855][ T30] kauditd_printk_skb: 52 callbacks suppressed [ 1452.407872][ T30] audit: type=1400 audit(1762471322.956:1148): avc: denied { read } for pid=20764 comm="syz.4.3663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1452.427767][T20709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1452.507201][ T5823] Bluetooth: hci1: command tx timeout [ 1452.558616][T20709] 8021q: adding VLAN 0 to HW filter on device team0 [ 1452.564633][T10487] bridge0: port 1(bridge_slave_0) entered blocking state [ 1452.564757][T10487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1452.570618][ T1098] bridge0: port 2(bridge_slave_1) entered blocking state [ 1452.570711][ T1098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1452.611922][T20709] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1452.611940][T20709] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1452.932146][T20128] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1453.040412][T20709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1453.101484][T20128] usb 6-1: Using ep0 maxpacket: 8 [ 1453.102804][T20128] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1453.102828][T20128] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1453.109520][T20128] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1453.109532][T20128] pvrusb2: ********** [ 1453.109537][T20128] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1453.109544][T20128] pvrusb2: Important functionality might not be entirely working. [ 1453.109549][T20128] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1453.109568][T20128] pvrusb2: ********** [ 1453.269704][T20775] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3665'. [ 1453.465662][T20788] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3662'. [ 1453.624949][T20792] bridge1: entered allmulticast mode [ 1454.241589][ T30] audit: type=1400 audit(1762471324.276:1149): avc: denied { connect } for pid=20790 comm="syz.4.3666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1454.241645][ T30] audit: type=1400 audit(1762471324.276:1150): avc: denied { read } for pid=20790 comm="syz.4.3666" laddr=fe80::8c40:a9ff:fee5:171c lport=52742 faddr=ff01::1 fport=19973 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1454.571909][ T5823] Bluetooth: hci1: command tx timeout [ 1454.590964][T20709] veth0_vlan: entered promiscuous mode [ 1454.619197][T20709] veth1_vlan: entered promiscuous mode [ 1454.890580][T20709] veth0_macvtap: entered promiscuous mode [ 1454.904040][ T2341] pvrusb2: Invalid write control endpoint [ 1454.904162][T20128] usb 6-1: USB disconnect, device number 87 [ 1454.936359][T20130] usb 7-1: USB disconnect, device number 60 [ 1454.953532][T20709] veth1_macvtap: entered promiscuous mode [ 1454.968220][T20130] pvrusb2: Device being rendered inoperable [ 1455.025261][T20804] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3668'. [ 1455.036917][T20709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1455.043647][ T2341] pvrusb2: Invalid write control endpoint [ 1455.056707][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1455.069795][T20709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1455.080770][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1455.091426][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1455.106568][T15214] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.111475][ T2341] pvrusb2: Device being rendered inoperable [ 1455.122623][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1455.157709][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_e) [ 1455.167329][T15214] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.180427][T15214] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.203156][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1455.207629][T15214] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.213118][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1455.431288][T20130] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 1455.587183][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1455.598403][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1455.614003][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1455.651782][T20130] usb 7-1: Using ep0 maxpacket: 8 [ 1455.658601][T20130] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1455.687288][T20130] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1455.737280][T20130] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1455.738753][T15214] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1455.764952][T20130] pvrusb2: ********** [ 1455.765075][T15214] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1455.768966][T20130] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1455.768982][T20130] pvrusb2: Important functionality might not be entirely working. [ 1455.854776][T20130] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1455.918350][T20130] pvrusb2: ********** [ 1456.428849][T20130] usb 7-1: USB disconnect, device number 61 [ 1456.437010][ T2341] pvrusb2: Invalid write control endpoint [ 1456.813401][T20822] netlink: 'syz.5.3672': attribute type 10 has an invalid length. [ 1456.821420][T20822] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3672'. [ 1456.834142][T20822] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 1457.122599][ T2341] pvrusb2: Invalid write control endpoint [ 1457.128345][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1457.226257][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1457.253470][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1457.352296][ T2341] pvrusb2: Device being rendered inoperable [ 1457.568784][T20827] netlink: 'syz.6.3674': attribute type 10 has an invalid length. [ 1457.576838][T20827] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3674'. [ 1457.587256][T20827] bridge0: port 3(veth0_vlan) entered blocking state [ 1457.596077][T20827] bridge0: port 3(veth0_vlan) entered disabled state [ 1457.651425][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1457.661106][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1457.720298][T20827] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 1457.760909][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1457.772372][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1458.608235][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1458.683890][T20836] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3677'. [ 1459.004947][T20128] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1459.177453][T20128] usb 4-1: Using ep0 maxpacket: 8 [ 1459.203701][T20128] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1459.229351][T20128] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1459.277999][T20128] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1459.313838][T20851] : renamed from veth0_vlan (while UP) [ 1459.320465][T20128] pvrusb2: ********** [ 1459.360168][T20128] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1459.441594][T20128] pvrusb2: Important functionality might not be entirely working. [ 1459.456933][T20128] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1459.544553][T20128] pvrusb2: ********** [ 1459.661304][T20855] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3679'. [ 1459.728496][T20856] bridge7: entered allmulticast mode [ 1459.894927][T20845] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3680'. [ 1460.279759][T20128] usb 4-1: USB disconnect, device number 73 [ 1460.289585][ T2341] pvrusb2: Invalid write control endpoint [ 1460.550468][T20865] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3684'. [ 1460.630096][ T2341] pvrusb2: Invalid write control endpoint [ 1460.652284][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1460.706096][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1460.750001][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1460.783838][ T2341] pvrusb2: Device being rendered inoperable [ 1460.821233][T17286] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1460.849105][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1460.893942][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1460.935660][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1461.051595][T17286] usb 6-1: Using ep0 maxpacket: 8 [ 1461.058583][T17286] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1461.077638][T17286] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1461.085752][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1461.085766][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1461.632739][T17286] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1461.647188][T17286] pvrusb2: ********** [ 1461.655506][T17286] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1461.669241][T17286] pvrusb2: Important functionality might not be entirely working. [ 1461.679436][T17286] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1461.730774][T17286] pvrusb2: ********** [ 1462.162690][T20128] usb 7-1: new full-speed USB device number 62 using dummy_hcd [ 1462.394620][T20128] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1462.394724][T20128] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1462.399923][T20128] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1462.399985][T20128] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1462.400060][T20128] usb 7-1: Product: syz [ 1462.400123][T20128] usb 7-1: Manufacturer: syz [ 1462.400162][T20128] usb 7-1: SerialNumber: syz [ 1462.477587][T20128] usb 7-1: config 0 descriptor?? [ 1462.708530][T20128] usb 7-1: selecting invalid altsetting 0 [ 1463.061280][T20119] usb 4-1: new full-speed USB device number 74 using dummy_hcd [ 1463.573549][T20119] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1463.573580][T20119] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.573624][T20119] usb 4-1: config 0 has no interface number 1 [ 1463.573671][T20119] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1463.573694][T20119] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1463.573722][T20119] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1463.573770][T20119] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1463.573815][T20119] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1463.576750][T20119] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1463.576805][T20119] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1463.576828][T20119] usb 4-1: Product: syz [ 1463.576845][T20119] usb 4-1: Manufacturer: syz [ 1463.576862][T20119] usb 4-1: SerialNumber: syz [ 1463.583037][T20119] usb 4-1: config 0 descriptor?? [ 1463.862523][T20893] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1464.374532][T20119] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1464.406282][ T2341] pvrusb2: Invalid write control endpoint [ 1464.439351][T17286] usb 6-1: USB disconnect, device number 88 [ 1464.449700][T20119] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1464.487553][ T2341] pvrusb2: Invalid write control endpoint [ 1464.523523][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1464.544567][T20119] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1464.545600][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1464.602039][T20119] usb 4-1: USB disconnect, device number 74 [ 1464.722905][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1464.733798][ T2341] pvrusb2: Device being rendered inoperable [ 1464.740253][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1464.747439][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1464.762284][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1464.767838][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1464.790594][T20912] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3698'. [ 1465.110870][T20122] usb 7-1: USB disconnect, device number 62 [ 1465.262041][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1465.330889][T16732] udevd[16732]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.151/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1465.624213][T20918] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3694'. [ 1465.897987][T20898] bridge1: entered allmulticast mode [ 1467.535924][ T10] usb 4-1: new full-speed USB device number 75 using dummy_hcd [ 1467.882605][T20953] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3707'. [ 1467.952682][ T10] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1467.963759][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1468.131478][ T10] usb 4-1: config 0 has no interface number 1 [ 1468.138738][ T10] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1468.150477][ T10] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1468.150508][ T10] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1468.150536][ T10] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1468.725968][T20122] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1469.031481][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1469.071515][ T10] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1469.096304][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1469.104448][ T10] usb 4-1: Product: syz [ 1469.108668][ T10] usb 4-1: Manufacturer: syz [ 1469.114209][ T10] usb 4-1: SerialNumber: syz [ 1469.201167][ T10] usb 4-1: config 0 descriptor?? [ 1469.221993][T20941] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1469.229651][T20122] usb 7-1: Using ep0 maxpacket: 8 [ 1469.238636][T20122] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1469.244410][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1469.248465][T20122] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1469.275988][T20122] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1469.293060][T20122] pvrusb2: ********** [ 1469.298346][T20122] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1469.299348][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1469.309610][T20122] pvrusb2: Important functionality might not be entirely working. [ 1469.327787][T20122] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1469.343087][T20122] pvrusb2: ********** [ 1469.501182][ T10] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1469.628064][ T10] usb 4-1: USB disconnect, device number 75 [ 1470.187413][T16732] udevd[16732]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1470.316293][T20974] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1470.437439][T20980] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3713'. [ 1470.443776][T20980] libceph: resolve '0..' (ret=-3): failed [ 1470.850829][ T30] audit: type=1400 audit(1762471341.396:1151): avc: denied { accept } for pid=20983 comm="syz.3.3715" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1472.682838][T20994] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 1473.200138][ T2341] pvrusb2: Invalid write control endpoint [ 1473.224076][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1473.234658][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1473.245198][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1473.254975][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1473.267270][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1473.276957][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1473.287440][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1473.297835][T20999] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1473.307425][T20999] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 1473.328538][T20122] usb 7-1: USB disconnect, device number 63 [ 1473.479687][T20996] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 8933, magic 89 != 6b] [ 1473.521178][ T30] audit: type=1400 audit(1762471344.026:1152): avc: denied { read write } for pid=20992 comm="syz.3.3718" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1473.551610][T20996] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 8933, magic 89 != 6b] [ 1473.714724][ T30] audit: type=1400 audit(1762471344.026:1153): avc: denied { open } for pid=20992 comm="syz.3.3718" path="/55/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1473.737729][ C0] vkms_vblank_simulate: vblank timer overrun [ 1473.794798][ T30] audit: type=1400 audit(1762471344.026:1154): avc: denied { ioctl } for pid=20992 comm="syz.3.3718" path="/55/file0/file0" dev="fuse" ino=0 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1473.901041][ T2341] pvrusb2: Invalid write control endpoint [ 1474.307140][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1474.346641][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1474.364669][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1474.395176][ T2341] pvrusb2: Device being rendered inoperable [ 1474.552809][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1474.570956][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1474.589995][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1474.601141][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1475.096638][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1475.116692][T21018] tipc: Enabling of bearer rejected, failed to enable media [ 1475.395261][ T6100] block nbd0: Possible stuck request ffff888026297000: control (read@0,1024B). Runtime 300 seconds [ 1475.408568][ T6100] block nbd0: Possible stuck request ffff8880262971c0: control (read@1024,1024B). Runtime 300 seconds [ 1475.419852][ T5922] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1475.427543][ T6100] block nbd0: Possible stuck request ffff888026297380: control (read@2048,1024B). Runtime 300 seconds [ 1475.443792][ T6100] block nbd0: Possible stuck request ffff888026297540: control (read@3072,1024B). Runtime 300 seconds [ 1475.831150][ T5922] usb 5-1: Using ep0 maxpacket: 16 [ 1475.843800][ T5922] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 1475.852347][ T5922] usb 5-1: config 0 has no interface number 0 [ 1475.861059][ T5922] usb 5-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1476.221491][T20122] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1476.399075][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1476.411247][ T5922] usb 5-1: Product: syz [ 1476.415422][ T5922] usb 5-1: Manufacturer: syz [ 1476.420009][ T5922] usb 5-1: SerialNumber: syz [ 1476.435142][ T5922] usb 5-1: config 0 descriptor?? [ 1476.476196][ T5922] hub 5-1:0.132: bad descriptor, ignoring hub [ 1476.505327][ T5922] hub 5-1:0.132: probe with driver hub failed with error -5 [ 1476.524196][ T5922] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.132/input/input68 [ 1476.571158][T20122] usb 4-1: device descriptor read/64, error -71 [ 1477.815664][T20122] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1477.863427][T21044] batadv_slave_1: entered promiscuous mode [ 1478.381173][T20122] usb 4-1: device descriptor read/64, error -71 [ 1478.493586][T20122] usb usb4-port1: attempt power cycle [ 1479.457445][T21048] wg1: left promiscuous mode [ 1479.471709][T21048] wg1: left allmulticast mode [ 1479.541978][T21055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=21055 comm=syz.3.3733 [ 1479.695760][T21048] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1479.738881][T21048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1479.898805][T21048] veth0_vlan: left allmulticast mode [ 1480.086299][T21048] team1: left promiscuous mode [ 1480.091526][T21048] team1: left allmulticast mode [ 1480.096726][T21048] batman_adv: batadv0: Interface deactivated: macvlan2 [ 1480.112983][T21048] bridge1: left allmulticast mode [ 1480.123130][T21048] bridge2: left allmulticast mode [ 1480.139681][T21048] bridge3: left allmulticast mode [ 1480.160469][T21048] bridge4: left allmulticast mode [ 1480.176284][T21048] gretap1: left allmulticast mode [ 1480.200164][T21048] bridge5: left allmulticast mode [ 1480.216651][T21048] bridge6: left allmulticast mode [ 1480.224788][T21048] bridge7: left allmulticast mode [ 1480.237431][T21044] batadv_slave_1: left promiscuous mode [ 1480.287268][ T1098] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1480.310621][ T36] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1480.334539][ T36] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1480.349648][ T36] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1480.433863][T12639] usb 5-1: USB disconnect, device number 50 [ 1482.385065][T21081] tipc: Enabling of bearer rejected, failed to enable media [ 1482.957635][T21093] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3744'. [ 1483.135622][T21094] bridge2: entered allmulticast mode [ 1483.625434][T17248] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1484.343404][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.349831][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.424810][T17248] usb 4-1: device descriptor read/64, error -71 [ 1484.771158][T17248] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1484.966146][ T30] audit: type=1804 audit(1762471355.276:1155): pid=21106 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.6.3747" name="/newroot/368/file1" dev="fuse" ino=1 res=1 errno=0 [ 1485.065639][ T30] audit: type=1800 audit(1762471355.276:1156): pid=21106 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.3747" name="/" dev="fuse" ino=1 res=0 errno=0 [ 1485.098935][T17248] usb 4-1: device descriptor read/64, error -71 [ 1485.216250][T17248] usb usb4-port1: attempt power cycle [ 1485.352095][ T30] audit: type=1800 audit(1762471355.906:1157): pid=21120 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.3752" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 1485.889779][T21090] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1485.898653][T21090] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1485.931218][T17248] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1486.041837][T17248] usb 4-1: device descriptor read/8, error -71 [ 1486.301388][T17248] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1486.333176][T17248] usb 4-1: device descriptor read/8, error -71 [ 1486.430250][ T30] audit: type=1400 audit(1762471356.976:1158): avc: denied { watch } for pid=21132 comm="syz.4.3756" path="/204" dev="tmpfs" ino=1064 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1486.455544][T17248] usb usb4-port1: unable to enumerate USB device [ 1486.461830][T12639] usb 7-1: new full-speed USB device number 64 using dummy_hcd [ 1486.497865][T21134] wg2: entered promiscuous mode [ 1486.502949][T21134] wg2: entered allmulticast mode [ 1486.541095][ T5863] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 1486.575273][ T30] audit: type=1400 audit(1762471357.126:1159): avc: denied { getopt } for pid=21135 comm="syz.7.3757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1486.623461][T12639] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1486.634010][T12639] usb 7-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1486.643492][T12639] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1486.662777][T21137] GUP no longer grows the stack in syz.7.3757 (21137): 200000004000-20000000a000 (200000002000) [ 1486.676555][T21137] CPU: 1 UID: 0 PID: 21137 Comm: syz.7.3757 Not tainted syzkaller #0 PREEMPT(full) [ 1486.676577][T21137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1486.676585][T21137] Call Trace: [ 1486.676590][T21137] [ 1486.676596][T21137] dump_stack_lvl+0x16c/0x1f0 [ 1486.676620][T21137] gup_vma_lookup+0x1d2/0x220 [ 1486.676636][T21137] __get_user_pages+0x241/0x3530 [ 1486.676654][T21137] ? find_held_lock+0x2b/0x80 [ 1486.676670][T21137] ? __pfx___get_user_pages+0x10/0x10 [ 1486.676688][T21137] get_user_pages_remote+0x243/0xab0 [ 1486.676702][T21137] ? mast_spanning_rebalance.isra.0+0x2060/0x2060 [ 1486.676716][T21137] ? __pfx_get_user_pages_remote+0x10/0x10 [ 1486.676731][T21137] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1486.676750][T21137] __access_remote_vm+0x250/0xaa0 [ 1486.676765][T21137] ? do_raw_spin_lock+0x12c/0x2b0 [ 1486.676777][T21137] ? __pfx___access_remote_vm+0x10/0x10 [ 1486.676794][T21137] proc_pid_cmdline_read+0x4de/0x8e0 [ 1486.676810][T21137] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 1486.676825][T21137] ? rw_verify_area+0xcf/0x6c0 [ 1486.676842][T21137] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 1486.676854][T21137] vfs_readv+0x5c1/0x8b0 [ 1486.676874][T21137] ? __pfx_vfs_readv+0x10/0x10 [ 1486.676903][T21137] ? __fget_files+0x20e/0x3c0 [ 1486.676919][T21137] ? do_preadv+0x1a6/0x270 [ 1486.676934][T21137] do_preadv+0x1a6/0x270 [ 1486.676951][T21137] ? __pfx_do_preadv+0x10/0x10 [ 1486.676972][T21137] do_syscall_64+0xcd/0xfa0 [ 1486.676984][T21137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1486.676996][T21137] RIP: 0033:0x7f2dca18f6c9 [ 1486.677005][T21137] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1486.677016][T21137] RSP: 002b:00007f2dcb060038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1486.677027][T21137] RAX: ffffffffffffffda RBX: 00007f2dca3e6090 RCX: 00007f2dca18f6c9 [ 1486.677036][T21137] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 000000000000000d [ 1486.677043][T21137] RBP: 00007f2dca211f91 R08: 0000000000000000 R09: 0000000000000000 [ 1486.677050][T21137] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 1486.677058][T21137] R13: 00007f2dca3e6128 R14: 00007f2dca3e6090 R15: 00007ffde1445368 [ 1486.677077][T21137] [ 1486.905834][T12639] usb 7-1: config 0 descriptor?? [ 1486.931384][ T5863] usb 6-1: Using ep0 maxpacket: 8 [ 1487.016327][ T5863] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1487.036466][ T5863] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.056373][ T5863] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1487.067530][ T5863] pvrusb2: ********** [ 1487.077311][ T5863] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1487.089481][ T5863] pvrusb2: Important functionality might not be entirely working. [ 1487.097548][ T5863] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1487.110486][ T5863] pvrusb2: ********** [ 1487.548596][T12639] usbhid 7-1:0.0: can't add hid device: -71 [ 1487.548701][T12639] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1487.600143][T12639] usb 7-1: USB disconnect, device number 64 [ 1489.550203][T21150] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3761'. [ 1489.751499][T21156] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3763'. [ 1489.856942][T21156] libceph: resolve '0..' (ret=-3): failed [ 1490.700668][T17248] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1490.871575][T17248] usb 5-1: Using ep0 maxpacket: 16 [ 1490.889440][T17248] usb 5-1: Dual-Role OTG device on HNP port [ 1490.889910][T17248] usb 5-1: New USB device found, idVendor=0403, idProduct=fa06, bcdDevice=df.9d [ 1490.889938][T17248] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1490.889960][T17248] usb 5-1: Product: syz [ 1490.889976][T17248] usb 5-1: Manufacturer: syz [ 1490.889992][T17248] usb 5-1: SerialNumber: syz [ 1490.897333][T17248] usb 5-1: config 0 descriptor?? [ 1491.352655][T21157] Illegal XDP return value 4294967274 on prog (id 875) dev syz_tun, expect packet loss! [ 1491.587304][T21172] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3767'. [ 1492.234777][ T2341] pvrusb2: Invalid write control endpoint [ 1493.095410][T20129] usb 6-1: USB disconnect, device number 89 [ 1493.169419][ T2341] pvrusb2: Invalid write control endpoint [ 1493.189934][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1493.201564][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1493.209353][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1493.219696][ T2341] pvrusb2: Device being rendered inoperable [ 1493.231650][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1493.241297][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1493.253745][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1493.262358][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1493.276091][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1493.409099][ T30] audit: type=1400 audit(1762471363.956:1160): avc: denied { append } for pid=21192 comm="syz.3.3772" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1493.442575][ T30] audit: type=1400 audit(1762471363.986:1161): avc: denied { read } for pid=21192 comm="syz.3.3772" name="usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1493.468237][ T30] audit: type=1400 audit(1762471363.986:1162): avc: denied { open } for pid=21192 comm="syz.3.3772" path="/dev/usbmon7" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1493.756765][T17248] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 1493.770760][T17248] ftdi_sio ttyUSB0: unknown device type: 0xdf9d [ 1494.359725][T17248] usb 5-1: USB disconnect, device number 51 [ 1494.368746][T17248] ftdi_sio 5-1:0.0: device disconnected [ 1495.431948][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1495.441584][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1495.452050][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1495.973129][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1495.987346][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1495.997819][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1496.010009][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1496.019673][T21204] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1496.029485][T21204] UDF-fs: warning (device nbd6): udf_fill_super: No partition found (1) [ 1496.309694][T21200] bridge0: port 2(bridge_slave_1) entered disabled state [ 1496.317248][T21200] bridge0: port 1(bridge_slave_0) entered disabled state [ 1496.371546][T21214] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=21214 comm=syz.7.3777 [ 1496.951106][ T5863] usb 6-1: new full-speed USB device number 90 using dummy_hcd [ 1498.095118][ T5863] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1498.103467][ T5863] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1498.113595][ T5863] usb 6-1: config 0 has no interface number 1 [ 1498.119912][ T5863] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1498.176190][ T5863] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1498.494100][ T5863] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1498.639512][ T5863] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1498.748949][ T5863] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1498.859313][ T5863] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1498.913173][ T5863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.925490][T21239] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3785'. [ 1498.943643][ T5863] usb 6-1: Product: syz [ 1498.947822][ T5863] usb 6-1: Manufacturer: syz [ 1498.974661][ T5863] usb 6-1: SerialNumber: syz [ 1498.998735][ T5863] usb 6-1: config 0 descriptor?? [ 1499.032444][T21218] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1499.068428][T21243] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3784'. [ 1499.126856][ T5863] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1499.525616][ T5863] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1499.605341][T21218] IPVS: Error connecting to the multicast addr [ 1500.649511][ T5863] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1500.755342][ T5863] usb 6-1: USB disconnect, device number 90 [ 1500.974306][T16732] udevd[16732]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1501.684599][T21267] lo speed is unknown, defaulting to 1000 [ 1501.692514][T21267] lo speed is unknown, defaulting to 1000 [ 1501.722398][T21267] lo speed is unknown, defaulting to 1000 [ 1501.737648][T21267] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1501.750597][T21267] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1501.816756][T21267] lo speed is unknown, defaulting to 1000 [ 1501.825272][T21267] lo speed is unknown, defaulting to 1000 [ 1501.835191][T21267] lo speed is unknown, defaulting to 1000 [ 1501.842044][T21267] lo speed is unknown, defaulting to 1000 [ 1501.848746][T21267] lo speed is unknown, defaulting to 1000 [ 1501.855793][T21267] lo speed is unknown, defaulting to 1000 [ 1501.862813][T21267] lo speed is unknown, defaulting to 1000 [ 1501.869419][T21267] lo speed is unknown, defaulting to 1000 [ 1501.884629][T12637] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1502.137196][T12637] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1502.146567][T12637] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1502.170966][T12637] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1502.191574][T12637] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1502.203032][T12637] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1502.212377][T12637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1502.220416][T12637] usb 4-1: Product: syz [ 1502.231485][T12637] usb 4-1: Manufacturer: syz [ 1502.236248][T12637] usb 4-1: SerialNumber: syz [ 1502.481532][T12637] usb 4-1: 0:2 : does not exist [ 1502.531417][T12637] usb 4-1: USB disconnect, device number 83 [ 1502.741343][T20129] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1502.919445][ T30] audit: type=1400 audit(1762471373.456:1163): avc: denied { watch_reads } for pid=21275 comm="syz.6.3795" path="/377/bus" dev="overlay" ino=1993 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1502.952326][T21270] bridge0: port 2(bridge_slave_1) entered disabled state [ 1502.960380][T21270] bridge0: port 1(bridge_slave_0) entered disabled state [ 1502.970042][T20129] usb 6-1: Using ep0 maxpacket: 16 [ 1502.998143][T20129] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 1503.023299][T20129] usb 6-1: config 0 has no interface number 0 [ 1503.050298][T20129] usb 6-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1503.060700][T20129] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1503.077497][T20129] usb 6-1: Product: syz [ 1503.132631][T20129] usb 6-1: Manufacturer: syz [ 1503.151786][T20129] usb 6-1: SerialNumber: syz [ 1503.537335][T20129] usb 6-1: config 0 descriptor?? [ 1503.552073][T21281] netlink: 'syz.3.3797': attribute type 10 has an invalid length. [ 1503.559917][T21281] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3797'. [ 1503.569792][T21281] bridge0: port 3(veth0_vlan) entered blocking state [ 1503.576847][T21281] bridge0: port 3(veth0_vlan) entered disabled state [ 1503.585127][T21281] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 1503.608612][T20129] hub 6-1:0.132: bad descriptor, ignoring hub [ 1503.625892][T20129] hub 6-1:0.132: probe with driver hub failed with error -5 [ 1503.698987][T20129] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.132/input/input69 [ 1503.987136][ T30] audit: type=1804 audit(1762471374.426:1164): pid=21287 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.6.3796" name="/newroot/378/file1" dev="fuse" ino=1 res=1 errno=0 [ 1504.133932][ T30] audit: type=1800 audit(1762471374.496:1165): pid=21287 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.3796" name="/" dev="fuse" ino=1 res=0 errno=0 [ 1505.049206][T17248] IPVS: starting estimator thread 0... [ 1505.142090][T21297] IPVS: using max 62 ests per chain, 148800 per kthread [ 1505.451367][ T6100] block nbd0: Possible stuck request ffff888026297000: control (read@0,1024B). Runtime 330 seconds [ 1505.462157][ T6100] block nbd0: Possible stuck request ffff8880262971c0: control (read@1024,1024B). Runtime 330 seconds [ 1505.473323][ T6100] block nbd0: Possible stuck request ffff888026297380: control (read@2048,1024B). Runtime 330 seconds [ 1505.484575][T20129] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1505.512052][ T6100] block nbd0: Possible stuck request ffff888026297540: control (read@3072,1024B). Runtime 330 seconds [ 1506.191329][T20129] usb 7-1: Using ep0 maxpacket: 8 [ 1506.210806][T20129] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1506.221222][T20129] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1506.240940][T20129] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1506.271664][T20129] pvrusb2: ********** [ 1506.287289][T20129] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1506.301700][T20129] pvrusb2: Important functionality might not be entirely working. [ 1506.309518][T20129] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1506.321759][T17248] usb 6-1: USB disconnect, device number 91 [ 1506.338825][T20129] pvrusb2: ********** [ 1506.513583][T21311] FAULT_INJECTION: forcing a failure. [ 1506.513583][T21311] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1506.513615][T21311] CPU: 0 UID: 0 PID: 21311 Comm: syz.3.3804 Not tainted syzkaller #0 PREEMPT(full) [ 1506.513637][T21311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1506.513650][T21311] Call Trace: [ 1506.513656][T21311] [ 1506.513666][T21311] dump_stack_lvl+0x16c/0x1f0 [ 1506.513700][T21311] should_fail_ex+0x512/0x640 [ 1506.513717][T21311] _copy_from_user+0x2e/0xd0 [ 1506.513732][T21311] memdup_user+0x6b/0xe0 [ 1506.513743][T21311] strndup_user+0x78/0xe0 [ 1506.513753][T21311] __do_sys_request_key+0x122/0x3d0 [ 1506.513771][T21311] ? __pfx___do_sys_request_key+0x10/0x10 [ 1506.513786][T21311] ? ksys_write+0x1ac/0x250 [ 1506.513803][T21311] do_syscall_64+0xcd/0xfa0 [ 1506.513814][T21311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1506.513826][T21311] RIP: 0033:0x7f5226f8f6c9 [ 1506.513835][T21311] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1506.513846][T21311] RSP: 002b:00007f5227e7f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 1506.513856][T21311] RAX: ffffffffffffffda RBX: 00007f52271e6090 RCX: 00007f5226f8f6c9 [ 1506.513864][T21311] RDX: 0000200000000380 RSI: 00002000000001c0 RDI: 0000200000000140 [ 1506.513871][T21311] RBP: 00007f5227e7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1506.513878][T21311] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1506.513885][T21311] R13: 00007f52271e6128 R14: 00007f52271e6090 R15: 00007ffc61e973d8 [ 1506.513900][T21311] [ 1506.519738][T21311] bridge0: port 2(bridge_slave_1) entered disabled state [ 1506.521014][T21311] bridge0: port 1(bridge_slave_0) entered disabled state [ 1506.541806][T21311] bridge_slave_1: left allmulticast mode [ 1506.541891][T21311] bridge_slave_1: left promiscuous mode [ 1506.542454][T21311] bridge0: port 2(bridge_slave_1) entered disabled state [ 1506.558696][T21311] bridge_slave_0: left allmulticast mode [ 1506.558762][T21311] bridge_slave_0: left promiscuous mode [ 1506.560704][T21311] bridge0: port 1(bridge_slave_0) entered disabled state [ 1506.576516][T21315] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3805'. [ 1506.733320][T17248] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1506.738373][T21319] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3805'. [ 1506.894671][T17248] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1506.894689][T17248] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1506.894701][T17248] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1506.894726][T17248] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1506.894741][T17248] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1506.896248][T17248] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1506.896266][T17248] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1506.896278][T17248] usb 6-1: Product: syz [ 1506.896287][T17248] usb 6-1: Manufacturer: syz [ 1506.899545][T17248] cdc_wdm 6-1:1.0: skipping garbage [ 1506.899557][T17248] cdc_wdm 6-1:1.0: skipping garbage [ 1506.902459][T17248] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1506.902471][T17248] cdc_wdm 6-1:1.0: Unknown control protocol [ 1506.928402][ C0] vkms_vblank_simulate: vblank timer overrun [ 1507.075644][T21322] netlink: 'syz.4.3806': attribute type 10 has an invalid length. [ 1507.448617][T21322] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3806'. [ 1507.491564][T21322] bridge0: port 3() entered blocking state [ 1507.491784][T21322] bridge0: port 3() entered disabled state [ 1507.539760][ C0] cdc_wdm 6-1:1.0: Unexpected error -71 [ 1507.541707][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.541734][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.542018][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.542044][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.542493][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.542518][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.543157][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.543180][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.543369][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.543392][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.543649][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.543674][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.543879][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.543902][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.544093][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.544118][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.544307][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.544331][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.544526][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 1507.544557][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1507.546837][T12637] usb 6-1: USB disconnect, device number 92 [ 1507.546836][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1507.562702][T21322] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 1508.327922][T21330] tipc: Enabling of bearer rejected, failed to enable media [ 1509.302015][ T2341] pvrusb2: Invalid write control endpoint [ 1509.312685][T20129] usb 7-1: USB disconnect, device number 65 [ 1509.610590][ T2341] pvrusb2: Invalid write control endpoint [ 1509.869180][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1509.967613][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1509.987816][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1510.003083][ T2341] pvrusb2: Device being rendered inoperable [ 1510.012591][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1510.026540][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1510.060528][ T2341] pvrusb2: Attached sub-driver cx25840 [ 1510.067244][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1510.080601][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1510.306986][T21357] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3816'. [ 1510.719119][T21357] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3816'. [ 1510.729176][T21346] netlink: 'syz.3.3814': attribute type 3 has an invalid length. [ 1512.080362][T21375] tipc: Enabling of bearer rejected, failed to enable media [ 1512.211360][T20129] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 1512.215931][T21371] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=21371 comm=syz.5.3819 [ 1512.591634][T12637] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1512.654871][T20129] usb 7-1: New USB device found, idVendor=041e, idProduct=4011, bcdDevice=af.98 [ 1512.664197][T20129] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1512.680104][T20129] usb 7-1: config 0 descriptor?? [ 1512.691644][T20129] pwc: Creative Labs Webcam Pro Ex detected. [ 1512.773999][T12637] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1513.121155][T12637] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1513.134683][T12637] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1513.280734][T12637] usb 6-1: config 0 descriptor?? [ 1513.289456][T12637] pwc: Askey VC010 type 2 USB webcam detected. [ 1513.440728][ T30] audit: type=1400 audit(1762471383.986:1166): avc: denied { getopt } for pid=21372 comm="syz.6.3820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1513.652418][T21391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1513.667746][T21391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1513.687754][T21391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1513.702571][T21391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1513.768181][T12637] pwc: send_video_command error -71 [ 1513.775037][T12637] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1513.789622][T12637] Philips webcam 6-1:0.0: probe with driver Philips webcam failed with error -71 [ 1513.842636][T12637] usb 6-1: USB disconnect, device number 93 [ 1515.031709][T20129] pwc: send_video_command error -71 [ 1515.037322][T20129] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1515.045023][T20127] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 1515.059303][T20129] Philips webcam 7-1:0.0: probe with driver Philips webcam failed with error -71 [ 1515.071642][T20129] usb 7-1: USB disconnect, device number 66 [ 1515.159093][T21405] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3828'. [ 1515.202712][T20127] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1515.219642][T21409] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3828'. [ 1515.221031][T20127] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1515.284492][T20127] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1515.759204][T20127] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1515.767481][T20127] usb 4-1: Product: syz [ 1515.771864][T20127] usb 4-1: Manufacturer: syz [ 1515.776467][T20127] usb 4-1: SerialNumber: syz [ 1515.791807][T20127] usb 4-1: config 0 descriptor?? [ 1515.801702][T20127] usb 4-1: selecting invalid altsetting 0 [ 1516.576385][T21421] tipc: Enabling of bearer rejected, failed to enable media [ 1518.673058][T12637] usb 4-1: USB disconnect, device number 84 [ 1518.791602][T21442] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3836'. [ 1519.613733][T21446] FAULT_INJECTION: forcing a failure. [ 1519.613733][T21446] name failslab, interval 1, probability 0, space 0, times 0 [ 1519.651367][T21446] CPU: 1 UID: 0 PID: 21446 Comm: syz.4.3839 Not tainted syzkaller #0 PREEMPT(full) [ 1519.651396][T21446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1519.651409][T21446] Call Trace: [ 1519.651416][T21446] [ 1519.651425][T21446] dump_stack_lvl+0x16c/0x1f0 [ 1519.651465][T21446] should_fail_ex+0x512/0x640 [ 1519.651488][T21446] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 1519.651520][T21446] should_failslab+0xc2/0x120 [ 1519.651544][T21446] kmem_cache_alloc_noprof+0x75/0x6e0 [ 1519.651572][T21446] ? fuse_request_alloc+0x22/0x200 [ 1519.651608][T21446] ? fuse_request_alloc+0x22/0x200 [ 1519.651636][T21446] fuse_request_alloc+0x22/0x200 [ 1519.651666][T21446] fuse_get_req+0x748/0xfd0 [ 1519.651684][T21446] ? find_held_lock+0x2b/0x80 [ 1519.651712][T21446] ? bpf_ksym_find+0x127/0x1c0 [ 1519.651740][T21446] ? __pfx_fuse_get_req+0x10/0x10 [ 1519.651758][T21446] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1519.651787][T21446] ? is_bpf_text_address+0x94/0x1a0 [ 1519.651811][T21446] ? kernel_text_address+0x8d/0x100 [ 1519.651834][T21446] ? __kernel_text_address+0xd/0x40 [ 1519.651856][T21446] ? unwind_get_return_address+0x59/0xa0 [ 1519.651879][T21446] ? arch_stack_walk+0xa6/0x100 [ 1519.651905][T21446] __fuse_simple_request+0xb5/0xe10 [ 1519.651934][T21446] fuse_do_getattr+0x281/0x540 [ 1519.651963][T21446] ? __pfx_fuse_do_getattr+0x10/0x10 [ 1519.651997][T21446] ? __pfx__kstrtoull+0x10/0x10 [ 1519.652039][T21446] ? look_up_lock_class+0x59/0x150 [ 1519.652074][T21446] ? __lock_acquire+0xb8a/0x1c90 [ 1519.652121][T21446] fuse_update_get_attr+0x5e7/0x6d0 [ 1519.652156][T21446] fuse_file_write_iter+0x620/0x990 [ 1519.652183][T21446] vfs_write+0x7d3/0x11d0 [ 1519.652204][T21446] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 1519.652229][T21446] ? __pfx___mutex_lock+0x10/0x10 [ 1519.652249][T21446] ? __pfx_vfs_write+0x10/0x10 [ 1519.652290][T21446] ksys_write+0x12a/0x250 [ 1519.652309][T21446] ? __pfx_ksys_write+0x10/0x10 [ 1519.652338][T21446] do_syscall_64+0xcd/0xfa0 [ 1519.652359][T21446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1519.652379][T21446] RIP: 0033:0x7f798938f6c9 [ 1519.652395][T21446] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1519.652413][T21446] RSP: 002b:00007f798a15f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1519.652433][T21446] RAX: ffffffffffffffda RBX: 00007f79895e5fa0 RCX: 00007f798938f6c9 [ 1519.652447][T21446] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 1519.652458][T21446] RBP: 00007f798a15f090 R08: 0000000000000000 R09: 0000000000000000 [ 1519.652471][T21446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1519.652482][T21446] R13: 00007f79895e6038 R14: 00007f79895e5fa0 R15: 00007ffe235cb068 [ 1519.652513][T21446] [ 1520.185864][T21458] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3841'. [ 1520.218182][T21458] bond_slave_0: entered promiscuous mode [ 1520.224325][T21458] bond_slave_1: entered promiscuous mode [ 1520.250049][T21455] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3843'. [ 1520.279272][T21458] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1520.331892][T21458] bond_slave_0: left promiscuous mode [ 1520.337356][T21458] bond_slave_1: left promiscuous mode [ 1520.396098][T21456] tipc: Enabling of bearer rejected, failed to enable media [ 1520.428073][T21465] tipc: Enabling of bearer rejected, failed to enable media [ 1520.561780][T12637] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 1520.742497][T21475] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3846'. [ 1520.791646][T12637] usb 7-1: Using ep0 maxpacket: 8 [ 1520.808229][T12637] usb 7-1: config 162 has an invalid interface number: 143 but max is 0 [ 1521.230178][T21475] libceph: resolve '0..' (ret=-3): failed [ 1521.238560][T12637] usb 7-1: config 162 has an invalid descriptor of length 122, skipping remainder of the config [ 1521.275949][T12637] usb 7-1: config 162 has no interface number 0 [ 1521.295614][T12637] usb 7-1: config 162 interface 143 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1521.350208][T12637] usb 7-1: config 162 interface 143 has no altsetting 0 [ 1521.383252][T12637] usb 7-1: New USB device found, idVendor=0c10, idProduct=0000, bcdDevice=95.a7 [ 1521.488939][T12637] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1521.543188][T12637] usb 7-1: Product: syz [ 1521.547372][T12637] usb 7-1: Manufacturer: syz [ 1521.570601][T12637] usb 7-1: SerialNumber: syz [ 1522.161563][T12637] usb 7-1: USB disconnect, device number 67 [ 1522.239865][T21485] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3850'. [ 1522.314900][T21487] bridge8: entered allmulticast mode [ 1522.548036][T21488] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=43 sclass=netlink_route_socket pid=21488 comm=syz.7.3847 [ 1523.154355][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1523.164783][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1523.175445][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1523.185170][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1523.195921][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1523.205592][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1523.215742][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1523.225984][T21493] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1523.237050][T21493] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 1524.088756][T21501] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=21501 comm=syz.3.3854 [ 1524.497384][T21510] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3856'. [ 1524.654920][T21511] bridge6: entered allmulticast mode [ 1526.864055][T21544] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3864'. [ 1526.877472][T21544] libceph: resolve '0..' (ret=-3): failed [ 1526.900055][T21545] sp0: Synchronizing with TNC [ 1526.908910][T21545] sp0: Found TNC [ 1527.296116][ T30] audit: type=1804 audit(1762471397.806:1167): pid=21548 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.6.3865" name="/newroot/390/file1" dev="fuse" ino=1 res=1 errno=0 [ 1528.162259][T21551] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3862'. [ 1528.291577][ T30] audit: type=1800 audit(1762471398.836:1168): pid=21548 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.3865" name="/" dev="fuse" ino=1 res=0 errno=0 [ 1528.454007][T12639] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1528.545013][ T5823] Bluetooth: hci2: unexpected event for opcode 0x1004 [ 1528.623592][T12639] usb 4-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 1528.632780][T12639] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1528.762725][T12639] usb 4-1: config 0 descriptor?? [ 1528.821147][T20121] usb 7-1: new full-speed USB device number 68 using dummy_hcd [ 1528.837785][T12639] usb 4-1: selecting invalid altsetting 1 [ 1528.895311][T12639] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1529.076851][T21557] tipc: Enabling of bearer rejected, failed to enable media [ 1529.144624][T20121] usb 7-1: config 0 has an invalid interface number: 151 but max is 1 [ 1529.153108][T20121] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1529.170306][T20121] usb 7-1: config 0 has no interface number 1 [ 1529.177945][T20121] usb 7-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1529.189058][T20121] usb 7-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1529.204381][T20121] usb 7-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1529.215988][T20121] usb 7-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1529.230804][T12639] libceph: connect (1)[c::]:6789 error -22 [ 1529.239152][T12639] libceph: mon0 (1)[c::]:6789 connect error [ 1529.245690][T20121] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1529.262154][T20121] usb 7-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1529.272123][T20121] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1529.281218][T20121] usb 7-1: Product: syz [ 1529.289118][T20121] usb 7-1: Manufacturer: syz [ 1529.299341][T20121] usb 7-1: SerialNumber: syz [ 1529.329582][T20121] usb 7-1: config 0 descriptor?? [ 1529.336485][T21555] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1529.362212][T20121] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1529.383655][T20121] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1529.500366][T20121] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1529.510309][T12637] libceph: connect (1)[c::]:6789 error -22 [ 1529.516381][T12637] libceph: mon0 (1)[c::]:6789 connect error [ 1529.637565][T21555] IPVS: Error connecting to the multicast addr [ 1529.697339][T20129] usb 7-1: USB disconnect, device number 68 [ 1529.731910][T21559] ceph: No mds server is up or the cluster is laggy [ 1531.218563][T20121] usb 4-1: USB disconnect, device number 85 [ 1531.801121][T20121] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 1532.091743][T20121] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 1532.100124][T20121] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1532.573034][ T5823] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1532.582791][ T5823] Bluetooth: hci2: Injecting HCI hardware error event [ 1532.586366][T20121] usb 5-1: config 0 has no interface number 1 [ 1532.592078][ T5823] Bluetooth: hci2: hardware error 0x00 [ 1532.620418][T20121] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1532.633156][T20121] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1532.645965][T20121] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1532.660968][T20121] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1532.676079][T20121] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1532.691776][T20121] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1532.701977][T20121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1532.711081][T20121] usb 5-1: Product: syz [ 1532.715297][T20121] usb 5-1: Manufacturer: syz [ 1532.719943][T20121] usb 5-1: SerialNumber: syz [ 1532.734261][T20121] usb 5-1: config 0 descriptor?? [ 1532.740233][T21592] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1532.755234][T20121] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1532.883200][T20121] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1533.020091][T20121] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1533.162859][T20121] usb 5-1: USB disconnect, device number 52 [ 1533.170186][T21599] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3878'. [ 1533.226378][T16732] udevd[16732]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1533.259827][T21600] bridge3: entered allmulticast mode [ 1533.370102][T21608] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3879'. [ 1533.383302][T21608] libceph: resolve '0..' (ret=-3): failed [ 1533.438357][T21610] tipc: Enabling of bearer rejected, failed to enable media [ 1533.490527][T21612] FAULT_INJECTION: forcing a failure. [ 1533.490527][T21612] name failslab, interval 1, probability 0, space 0, times 0 [ 1533.503939][T21612] CPU: 0 UID: 0 PID: 21612 Comm: syz.5.3880 Not tainted syzkaller #0 PREEMPT(full) [ 1533.503964][T21612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1533.503975][T21612] Call Trace: [ 1533.503983][T21612] [ 1533.503991][T21612] dump_stack_lvl+0x16c/0x1f0 [ 1533.504025][T21612] should_fail_ex+0x512/0x640 [ 1533.504054][T21612] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 1533.504087][T21612] should_failslab+0xc2/0x120 [ 1533.504110][T21612] kmem_cache_alloc_node_noprof+0x78/0x770 [ 1533.504138][T21612] ? __alloc_skb+0x2b2/0x380 [ 1533.504168][T21612] ? __alloc_skb+0x2b2/0x380 [ 1533.504188][T21612] ? __pfx_netlink_insert+0x10/0x10 [ 1533.504214][T21612] __alloc_skb+0x2b2/0x380 [ 1533.504238][T21612] ? __pfx___alloc_skb+0x10/0x10 [ 1533.504263][T21612] ? netlink_autobind.isra.0+0x158/0x370 [ 1533.504298][T21612] netlink_alloc_large_skb+0x69/0x140 [ 1533.504328][T21612] netlink_sendmsg+0x698/0xdd0 [ 1533.504361][T21612] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1533.504401][T21612] ____sys_sendmsg+0xa98/0xc70 [ 1533.504421][T21612] ? copy_msghdr_from_user+0x10a/0x160 [ 1533.504447][T21612] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1533.504481][T21612] ___sys_sendmsg+0x134/0x1d0 [ 1533.504508][T21612] ? __pfx____sys_sendmsg+0x10/0x10 [ 1533.504531][T21612] ? __lock_acquire+0x622/0x1c90 [ 1533.504599][T21612] __sys_sendmsg+0x16d/0x220 [ 1533.504626][T21612] ? __pfx___sys_sendmsg+0x10/0x10 [ 1533.504672][T21612] do_syscall_64+0xcd/0xfa0 [ 1533.504693][T21612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1533.504714][T21612] RIP: 0033:0x7f99b858f6c9 [ 1533.504730][T21612] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1533.504749][T21612] RSP: 002b:00007f99b94f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1533.504768][T21612] RAX: ffffffffffffffda RBX: 00007f99b87e5fa0 RCX: 00007f99b858f6c9 [ 1533.504781][T21612] RDX: 0000000004000804 RSI: 0000200000000400 RDI: 0000000000000003 [ 1533.504794][T21612] RBP: 00007f99b94f1090 R08: 0000000000000000 R09: 0000000000000000 [ 1533.504806][T21612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1533.504818][T21612] R13: 00007f99b87e6038 R14: 00007f99b87e5fa0 R15: 00007ffe93371388 [ 1533.504849][T21612] [ 1534.754809][ T5823] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1535.528254][T21628] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3886'. [ 1535.559771][ T6100] block nbd0: Possible stuck request ffff888026297000: control (read@0,1024B). Runtime 360 seconds [ 1535.570483][ T6100] block nbd0: Possible stuck request ffff8880262971c0: control (read@1024,1024B). Runtime 360 seconds [ 1535.581620][ T6100] block nbd0: Possible stuck request ffff888026297380: control (read@2048,1024B). Runtime 360 seconds [ 1535.592570][ T6100] block nbd0: Possible stuck request ffff888026297540: control (read@3072,1024B). Runtime 360 seconds [ 1536.031100][ T30] audit: type=1400 audit(1762471406.556:1169): avc: denied { ioctl } for pid=21625 comm="syz.7.3885" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9378 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1536.098252][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1536.109924][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1536.119986][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1536.129602][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1536.140642][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1536.150254][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1536.160128][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=256, location=256 [ 1536.170014][T21631] UDF-fs: error (device nbd6): udf_read_tagged: read failed, block=512, location=512 [ 1536.179665][T21631] UDF-fs: warning (device nbd6): udf_fill_super: No partition found (1) [ 1536.239298][ T30] audit: type=1400 audit(1762471406.566:1170): avc: denied { unmount } for pid=20709 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1536.419644][T21641] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3889'. [ 1536.621085][T12637] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1536.787754][T21645] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3891'. [ 1536.921082][T12637] usb 6-1: Using ep0 maxpacket: 32 [ 1536.927797][T12637] usb 6-1: config 9 has an invalid interface number: 95 but max is 0 [ 1536.936423][T12637] usb 6-1: config 9 has no interface number 0 [ 1536.943294][T12637] usb 6-1: config 9 interface 95 altsetting 82 endpoint 0x9 has invalid maxpacket 2039, setting to 64 [ 1536.962761][T12637] usb 6-1: config 9 interface 95 altsetting 82 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 1537.001941][T12637] usb 6-1: config 9 interface 95 has no altsetting 0 [ 1537.070653][T12637] usb 6-1: New USB device found, idVendor=0763, idProduct=1041, bcdDevice=da.59 [ 1537.080505][T12637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1537.421692][T12637] usb 6-1: Product: syz [ 1537.431333][T12637] usb 6-1: Manufacturer: syz [ 1537.435993][T12637] usb 6-1: SerialNumber: syz [ 1537.466003][ T30] audit: type=1400 audit(1762471408.016:1171): avc: denied { create } for pid=21651 comm="syz.4.3893" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1537.821274][ T30] audit: type=1400 audit(1762471408.286:1172): avc: denied { bind } for pid=21651 comm="syz.4.3893" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1538.125699][T12637] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1538.156543][ T30] audit: type=1400 audit(1762471408.286:1173): avc: denied { write } for pid=21651 comm="syz.4.3893" lport=512 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1538.243832][T12637] usb 6-1: USB disconnect, device number 94 [ 1538.369748][T15422] udevd[15422]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:9.95/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1538.893878][T21664] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3895'. [ 1538.968213][T21665] bridge4: entered allmulticast mode [ 1540.385244][ T30] audit: type=1400 audit(1762471410.916:1174): avc: denied { setopt } for pid=21672 comm="syz.5.3897" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1540.676026][ T30] audit: type=1400 audit(1762471410.916:1175): avc: denied { connect } for pid=21672 comm="syz.5.3897" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1540.871915][T12637] usb 5-1: new full-speed USB device number 53 using dummy_hcd [ 1541.240612][T12637] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 1542.211351][T12637] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1542.421077][T12637] usb 5-1: config 0 has no interface number 1 [ 1542.427555][T12637] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1542.598138][T12637] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1542.624495][T12637] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1542.641236][T12637] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1542.660135][T21689] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3902'. [ 1542.676348][T12637] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1542.693900][T12637] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1542.714750][T12637] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.723116][T12637] usb 5-1: Product: syz [ 1542.728223][T12637] usb 5-1: Manufacturer: syz [ 1542.734009][T12637] usb 5-1: SerialNumber: syz [ 1542.742349][T12637] usb 5-1: config 0 descriptor?? [ 1542.748660][T21676] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1542.772959][T12637] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1542.789736][T12637] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1542.819270][T12637] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1542.991079][T12637] usb 7-1: new full-speed USB device number 69 using dummy_hcd [ 1543.181711][T12637] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1543.289637][T12637] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1543.425800][T12637] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1543.438066][T12637] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1543.439616][T17248] usb 5-1: USB disconnect, device number 53 [ 1543.446943][T12637] usb 7-1: Product: syz [ 1543.470204][T12637] usb 7-1: Manufacturer: syz [ 1543.485367][T12637] usb 7-1: SerialNumber: syz [ 1543.507354][T12637] usb 7-1: config 0 descriptor?? [ 1543.525710][T12637] usb 7-1: selecting invalid altsetting 0 [ 1543.919584][T21716] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3909'. [ 1544.092353][T21715] bridge0: entered allmulticast mode [ 1544.600617][T21724] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3911'. [ 1544.610772][T21724] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3911'. [ 1544.671478][T21724] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3911'. [ 1544.685374][T21724] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3911'. [ 1545.797031][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.797089][T17248] usb 7-1: USB disconnect, device number 69 [ 1545.803894][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.987421][T21748] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3917'. [ 1549.467644][T21765] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 1549.573108][T21777] FAULT_INJECTION: forcing a failure. [ 1549.573108][T21777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1549.607918][T21777] CPU: 0 UID: 0 PID: 21777 Comm: syz.6.3926 Not tainted syzkaller #0 PREEMPT(full) [ 1549.607943][T21777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1549.607955][T21777] Call Trace: [ 1549.607961][T21777] [ 1549.607969][T21777] dump_stack_lvl+0x16c/0x1f0 [ 1549.608004][T21777] should_fail_ex+0x512/0x640 [ 1549.608031][T21777] _copy_to_user+0x32/0xd0 [ 1549.608057][T21777] simple_read_from_buffer+0xcb/0x170 [ 1549.608088][T21777] proc_fail_nth_read+0x197/0x240 [ 1549.608113][T21777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1549.608138][T21777] ? rw_verify_area+0xcf/0x6c0 [ 1549.608165][T21777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1549.608188][T21777] vfs_read+0x1e4/0xcf0 [ 1549.608209][T21777] ? __pfx___mutex_lock+0x10/0x10 [ 1549.608236][T21777] ? __pfx_vfs_read+0x10/0x10 [ 1549.608263][T21777] ? __fget_files+0x20e/0x3c0 [ 1549.608292][T21777] ksys_read+0x12a/0x250 [ 1549.608309][T21777] ? __pfx_ksys_read+0x10/0x10 [ 1549.608337][T21777] do_syscall_64+0xcd/0xfa0 [ 1549.608358][T21777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.608378][T21777] RIP: 0033:0x7f277518e0dc [ 1549.608394][T21777] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1549.608413][T21777] RSP: 002b:00007f2775fca030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1549.608429][T21777] RAX: ffffffffffffffda RBX: 00007f27753e5fa0 RCX: 00007f277518e0dc [ 1549.608442][T21777] RDX: 000000000000000f RSI: 00007f2775fca0a0 RDI: 0000000000000004 [ 1549.608453][T21777] RBP: 00007f2775fca090 R08: 0000000000000000 R09: 0000000000000000 [ 1549.608464][T21777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1549.608475][T21777] R13: 00007f27753e6038 R14: 00007f27753e5fa0 R15: 00007ffcbbf28268 [ 1549.608505][T21777] [ 1549.616567][T21779] bridge5: entered allmulticast mode [ 1550.597221][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=256, location=256 [ 1550.606900][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=512, location=512 [ 1550.616943][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=256, location=256 [ 1550.626817][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=512, location=512 [ 1550.636948][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=256, location=256 [ 1550.646515][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=512, location=512 [ 1550.656669][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=256, location=256 [ 1550.666242][T21790] UDF-fs: error (device nbd7): udf_read_tagged: read failed, block=512, location=512 [ 1550.676556][T21790] UDF-fs: warning (device nbd7): udf_fill_super: No partition found (1) [ 1552.164618][T21789] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3924'. [ 1553.475979][T21804] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3931'. [ 1553.861421][T21804] libceph: resolve '0..' (ret=-3): failed [ 1554.081478][T20121] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 1554.249355][T20121] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 1554.300754][T20121] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1554.576535][T20121] usb 5-1: config 0 has no interface number 1 [ 1554.582919][T12637] usb 6-1: new full-speed USB device number 95 using dummy_hcd [ 1554.601929][T20121] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1554.629734][T20121] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1554.630514][T21823] FAULT_INJECTION: forcing a failure. [ 1554.630514][T21823] name failslab, interval 1, probability 0, space 0, times 0 [ 1554.654514][T21823] CPU: 0 UID: 0 PID: 21823 Comm: syz.7.3937 Not tainted syzkaller #0 PREEMPT(full) [ 1554.654530][T21823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1554.654537][T21823] Call Trace: [ 1554.654542][T21823] [ 1554.654547][T21823] dump_stack_lvl+0x16c/0x1f0 [ 1554.654571][T21823] should_fail_ex+0x512/0x640 [ 1554.654587][T21823] should_failslab+0xc2/0x120 [ 1554.654601][T21823] kmem_cache_alloc_noprof+0x75/0x6e0 [ 1554.654620][T21823] ? __inet_hash_connect+0x7cb/0x1ee0 [ 1554.654649][T21823] ? __inet_hash_connect+0x7cb/0x1ee0 [ 1554.654670][T21823] __inet_hash_connect+0x7cb/0x1ee0 [ 1554.654698][T21823] ? __pfx___inet_check_established+0x10/0x10 [ 1554.654715][T21823] ? __pfx___inet_hash_connect+0x10/0x10 [ 1554.654733][T21823] ? inet_hash_connect+0x125/0x260 [ 1554.654749][T21823] tcp_v4_connect+0xe66/0x1c10 [ 1554.654768][T21823] ? __pfx_tcp_v4_connect+0x10/0x10 [ 1554.654785][T21823] __inet_stream_connect+0x915/0xf50 [ 1554.654802][T21823] ? __pfx___inet_stream_connect+0x10/0x10 [ 1554.654823][T21823] tcp_sendmsg_fastopen+0x3ed/0x750 [ 1554.654837][T21823] ? stack_trace_save+0x8e/0xc0 [ 1554.654853][T21823] tcp_sendmsg_locked+0x2438/0x42e0 [ 1554.654871][T21823] ? __lock_acquire+0xb8a/0x1c90 [ 1554.654893][T21823] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1554.654907][T21823] ? do_raw_spin_lock+0x12c/0x2b0 [ 1554.654919][T21823] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1554.654935][T21823] ? __local_bh_enable_ip+0xa4/0x120 [ 1554.654952][T21823] tcp_sendmsg+0x2e/0x50 [ 1554.654963][T21823] ? __pfx_tcp_sendmsg+0x10/0x10 [ 1554.654974][T21823] inet_sendmsg+0xb9/0x140 [ 1554.654988][T21823] smc_sendmsg+0x224/0x520 [ 1554.655008][T21823] __sys_sendto+0x4a3/0x520 [ 1554.655022][T21823] ? __pfx___sys_sendto+0x10/0x10 [ 1554.655049][T21823] ? ksys_write+0x1ac/0x250 [ 1554.655059][T21823] ? __pfx_ksys_write+0x10/0x10 [ 1554.655072][T21823] __x64_sys_sendto+0xe0/0x1c0 [ 1554.655084][T21823] ? do_syscall_64+0x91/0xfa0 [ 1554.655095][T21823] ? lockdep_hardirqs_on+0x7c/0x110 [ 1554.655112][T21823] do_syscall_64+0xcd/0xfa0 [ 1554.655123][T21823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.655135][T21823] RIP: 0033:0x7f2dca18f6c9 [ 1554.655145][T21823] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1554.655156][T21823] RSP: 002b:00007f2dcb081038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1554.655167][T21823] RAX: ffffffffffffffda RBX: 00007f2dca3e5fa0 RCX: 00007f2dca18f6c9 [ 1554.655175][T21823] RDX: 000000000000004d RSI: 0000000000000000 RDI: 0000000000000003 [ 1554.655182][T21823] RBP: 00007f2dcb081090 R08: 0000200000000080 R09: 0000000000000010 [ 1554.655189][T21823] R10: 00000000200047ee R11: 0000000000000246 R12: 0000000000000001 [ 1554.655196][T21823] R13: 00007f2dca3e6038 R14: 00007f2dca3e5fa0 R15: 00007ffde1445368 [ 1554.655212][T21823] [ 1554.661746][T20121] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1554.960024][T20121] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1555.046439][T12637] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1555.054712][T12637] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1555.066828][T20121] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1555.083450][T12637] usb 6-1: config 0 has no interface number 1 [ 1555.089567][T12637] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1555.111575][T12637] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1555.125744][T12637] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1555.144391][T20121] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1555.182920][T20121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.735355][T20121] usb 5-1: Product: syz [ 1556.061842][T20121] usb 5-1: Manufacturer: syz [ 1556.073636][T12637] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1556.086937][T20121] usb 5-1: SerialNumber: syz [ 1556.268134][T12637] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1556.288630][T12637] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1556.301789][T20121] usb 5-1: config 0 descriptor?? [ 1556.318175][T12637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1556.371502][T21811] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1556.440698][T12637] usb 6-1: Product: syz [ 1556.445437][T12637] usb 6-1: Manufacturer: syz [ 1556.450062][T12637] usb 6-1: SerialNumber: syz [ 1556.482512][T12637] usb 6-1: config 0 descriptor?? [ 1556.488251][T21821] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1556.490851][T20121] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1557.092559][T21832] Trying to write to read-only block-device nullb0 [ 1557.093285][T12637] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1557.122455][T20121] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1557.188232][T20121] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1557.198447][T12637] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1557.273062][T20121] usb 5-1: USB disconnect, device number 54 [ 1557.313418][T12637] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1557.369282][T12637] usb 6-1: USB disconnect, device number 95 [ 1557.619905][T19181] udevd[19181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.151/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1557.622356][T21844] traps: syz.4.3945[21844] attempts to use CLI/STI, pretending it's a NOP, ip:200000000002 [ 1557.921356][T12637] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1558.165343][T12637] usb 6-1: Using ep0 maxpacket: 8 [ 1558.195057][T12637] usb 6-1: config 0 has an invalid interface number: 52 but max is 0 [ 1558.214505][T12637] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1558.225373][T12637] usb 6-1: config 0 has no interface number 0 [ 1558.232095][T12637] usb 6-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 255, changing to 11 [ 1559.296209][T12637] usb 6-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 59391, setting to 1024 [ 1559.307607][T12637] usb 6-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1559.321047][T12637] usb 6-1: config 0 interface 52 has no altsetting 0 [ 1559.329031][T12637] usb 6-1: New USB device found, idVendor=06cb, idProduct=0001, bcdDevice= 0.00 [ 1559.348097][T12637] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=35 [ 1559.356518][T12637] usb 6-1: SerialNumber: syz [ 1559.364169][T12637] usb 6-1: config 0 descriptor?? [ 1560.489152][T12637] input: USB Synaptics Device 06cb:0001 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.52/input/input70 [ 1560.583006][T21852] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=21852 comm=syz.6.3947 [ 1560.722002][T21867] tipc: Enabling of bearer rejected, failed to enable media [ 1560.945971][T21871] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1561.195858][T20127] usb 6-1: USB disconnect, device number 96 [ 1561.290439][T21885] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1562.143455][ T30] audit: type=1400 audit(1762471432.696:1176): avc: denied { map } for pid=21882 comm="syz.3.3955" path="socket:[74267]" dev="sockfs" ino=74267 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1562.177978][ T30] audit: type=1400 audit(1762471432.696:1177): avc: denied { read accept } for pid=21882 comm="syz.3.3955" path="socket:[74267]" dev="sockfs" ino=74267 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1562.372547][T21898] netlink: 'syz.4.3961': attribute type 1 has an invalid length. [ 1562.380297][T21898] netlink: 'syz.4.3961': attribute type 2 has an invalid length. [ 1562.487201][T21902] trusted_key: encrypted_key: insufficient parameters specified [ 1562.495972][T17248] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 1562.631207][T17248] usb 7-1: device descriptor read/64, error -71 [ 1562.817896][T21908] traps: syz.7.3964[21908] attempts to use CLI/STI, pretending it's a NOP, ip:200000000002 [ 1562.881607][T17248] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1563.021431][T17248] usb 7-1: device descriptor read/64, error -71 [ 1563.154269][T17248] usb usb7-port1: attempt power cycle [ 1563.606914][T21904] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=21904 comm=syz.3.3963 [ 1563.631908][T17248] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 1563.661828][T17248] usb 7-1: device descriptor read/8, error -71 [ 1563.683422][T21917] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3967'. [ 1563.740598][T21922] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3969'. [ 1563.797014][T21926] overlayfs: failed to resolve './file1': -2 [ 1563.804924][T21926] netlink: 'syz.5.3971': attribute type 21 has an invalid length. [ 1563.911772][T17248] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 1563.946260][T17248] usb 7-1: device descriptor read/8, error -71 [ 1564.011092][T20129] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1564.063615][T17248] usb usb7-port1: unable to enumerate USB device [ 1564.161311][T20129] usb 5-1: Using ep0 maxpacket: 32 [ 1564.179168][T20129] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 1564.201547][T20129] usb 5-1: config 0 has no interface number 0 [ 1564.207720][T20129] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1564.235266][T20129] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1564.254563][T20129] usb 5-1: config 0 interface 85 has no altsetting 0 [ 1564.273359][T20129] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1564.287213][T20129] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.296025][T20129] usb 5-1: Product: syz [ 1564.300193][T20129] usb 5-1: Manufacturer: syz [ 1564.308816][T20129] usb 5-1: SerialNumber: syz [ 1564.328510][T20129] usb 5-1: config 0 descriptor?? [ 1564.468434][T21943] FAULT_INJECTION: forcing a failure. [ 1564.468434][T21943] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1564.482017][T21943] CPU: 0 UID: 0 PID: 21943 Comm: syz.3.3975 Not tainted syzkaller #0 PREEMPT(full) [ 1564.482051][T21943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1564.482063][T21943] Call Trace: [ 1564.482071][T21943] [ 1564.482079][T21943] dump_stack_lvl+0x16c/0x1f0 [ 1564.482116][T21943] should_fail_ex+0x512/0x640 [ 1564.482146][T21943] _copy_from_user+0x2e/0xd0 [ 1564.482172][T21943] br_dev_read_uargs+0x145/0x3d0 [ 1564.482193][T21943] ? rcu_is_watching+0x12/0xc0 [ 1564.482218][T21943] ? __pfx_br_dev_read_uargs+0x10/0x10 [ 1564.482238][T21943] ? __mutex_lock+0x1c5/0x1060 [ 1564.482264][T21943] old_deviceless+0xbd/0x700 [ 1564.482283][T21943] ? __pfx___mutex_lock+0x10/0x10 [ 1564.482302][T21943] ? __pfx_old_deviceless+0x10/0x10 [ 1564.482321][T21943] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1564.482346][T21943] ? rcu_is_watching+0x12/0xc0 [ 1564.482370][T21943] ? trace_contention_end+0xdd/0x130 [ 1564.482397][T21943] br_ioctl_stub+0x3e8/0x4c0 [ 1564.482417][T21943] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1564.482434][T21943] ? __pfx___mutex_lock+0x10/0x10 [ 1564.482464][T21943] ? do_vfs_ioctl+0x128/0x14f0 [ 1564.482496][T21943] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1564.482520][T21943] br_ioctl_call+0x53/0xa0 [ 1564.482542][T21943] sock_ioctl+0x365/0x6b0 [ 1564.482564][T21943] ? __pfx_sock_ioctl+0x10/0x10 [ 1564.482582][T21943] ? hook_file_ioctl_common+0x145/0x410 [ 1564.482618][T21943] ? selinux_file_ioctl+0x180/0x270 [ 1564.482640][T21943] ? selinux_file_ioctl+0xb4/0x270 [ 1564.482664][T21943] ? __pfx_sock_ioctl+0x10/0x10 [ 1564.482685][T21943] __x64_sys_ioctl+0x18e/0x210 [ 1564.482716][T21943] do_syscall_64+0xcd/0xfa0 [ 1564.482737][T21943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1564.482758][T21943] RIP: 0033:0x7f5226f8f6c9 [ 1564.482774][T21943] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1564.482792][T21943] RSP: 002b:00007f5227ea0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1564.482811][T21943] RAX: ffffffffffffffda RBX: 00007f52271e5fa0 RCX: 00007f5226f8f6c9 [ 1564.482825][T21943] RDX: 0000000000000000 RSI: 0000000000008940 RDI: 0000000000000003 [ 1564.482837][T21943] RBP: 00007f5227ea0090 R08: 0000000000000000 R09: 0000000000000000 [ 1564.482849][T21943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1564.482861][T21943] R13: 00007f52271e6038 R14: 00007f52271e5fa0 R15: 00007ffc61e973d8 [ 1564.482893][T21943] [ 1564.792870][T21945] tipc: Enabling of bearer rejected, failed to enable media [ 1565.043437][T20129] appletouch 5-1:0.85: Failed to request geyser raw mode [ 1565.050678][T20129] appletouch 5-1:0.85: probe with driver appletouch failed with error -5 [ 1565.122757][T21951] netlink: 'syz.3.3977': attribute type 1 has an invalid length. [ 1565.130552][T21951] netlink: 'syz.3.3977': attribute type 2 has an invalid length. [ 1565.348238][T21950] trusted_key: encrypted_key: insufficient parameters specified [ 1565.364883][T20129] usb 5-1: USB disconnect, device number 55 [ 1565.611245][ T6100] block nbd0: Possible stuck request ffff888026297000: control (read@0,1024B). Runtime 390 seconds [ 1565.623097][ T6100] block nbd0: Possible stuck request ffff8880262971c0: control (read@1024,1024B). Runtime 390 seconds [ 1565.634392][ T6100] block nbd0: Possible stuck request ffff888026297380: control (read@2048,1024B). Runtime 390 seconds [ 1565.646246][ T6100] block nbd0: Possible stuck request ffff888026297540: control (read@3072,1024B). Runtime 390 seconds [ 1565.712288][T21962] netlink: 'syz.6.3978': attribute type 1 has an invalid length. [ 1565.747127][T21962] netlink: 'syz.6.3978': attribute type 2 has an invalid length. [ 1565.928763][T21966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3981'. [ 1565.985311][T21967] trusted_key: encrypted_key: insufficient parameters specified [ 1566.587300][T21974] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1566.672404][T20122] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1567.023958][T20122] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1567.151930][T20122] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1567.191150][T20122] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.770950][T20122] usb 5-1: Product: syz [ 1567.793171][T20122] usb 5-1: Manufacturer: syz [ 1567.807476][T20122] usb 5-1: SerialNumber: syz [ 1567.982018][T20122] usb 5-1: config 0 descriptor?? [ 1568.073432][T20122] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1568.107493][T15412] udevd[15412]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1568.149828][T21988] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3988'. [ 1568.263357][T17248] usb 5-1: USB disconnect, device number 56 [ 1569.022955][T22010] netlink: 'syz.6.3993': attribute type 1 has an invalid length. [ 1569.030708][T22010] netlink: 'syz.6.3993': attribute type 2 has an invalid length. [ 1569.610199][T22009] trusted_key: encrypted_key: insufficient parameters specified [ 1571.219515][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1571.229449][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1571.239941][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1571.250195][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1571.262117][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1571.272355][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1571.282889][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1571.292556][T22033] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1571.302589][T22033] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 1572.085697][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1572.095416][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1572.105557][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1572.115433][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1572.125317][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1572.134859][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1572.145325][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 1572.155258][T22044] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 1572.164732][T22044] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 1573.503705][T18426] Bluetooth: hci1: command 0x0406 tx timeout [ 1573.517094][T22077] netlink: 'syz.4.4013': attribute type 1 has an invalid length. [ 1573.525490][T22077] netlink: 'syz.4.4013': attribute type 2 has an invalid length. [ 1573.649185][T22079] trusted_key: encrypted_key: insufficient parameters specified [ 1573.820870][T22046] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1573.893619][T22046] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1574.191679][T22085] Cannot find map_set index 135 as target [ 1574.545427][ T1098] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.564108][ T6868] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.595089][ T6868] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.610290][ T6868] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.981153][T22101] virtio-fs: tag not found [ 1575.146474][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1575.156475][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1575.167020][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1575.177297][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1575.187566][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1575.197200][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1575.207797][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 1575.217516][T22105] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 1575.227031][T22105] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 1576.000380][T22116] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5392 sclass=netlink_route_socket pid=22116 comm=syz.7.4016 [ 1576.551617][T22127] netlink: 'syz.6.4025': attribute type 10 has an invalid length. [ 1576.567245][T22127] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4025'. [ 1576.591697][T22127] bridge0: port 3(veth0_vlan) entered blocking state [ 1576.601285][T22127] bridge0: port 3(veth0_vlan) entered disabled state [ 1576.651567][ T5871] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1576.782514][ T5871] usb 4-1: device descriptor read/64, error -71 [ 1576.816575][T22127] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 1577.517389][ T5871] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1577.651147][ T5871] usb 4-1: device descriptor read/64, error -71 [ 1577.905511][ T5871] usb usb4-port1: attempt power cycle [ 1577.906508][T22139] netlink: 'syz.5.4029': attribute type 1 has an invalid length. [ 1577.919404][T22139] netlink: 'syz.5.4029': attribute type 2 has an invalid length. [ 1578.168210][T22140] trusted_key: encrypted_key: insufficient parameters specified [ 1578.316186][ T30] audit: type=1804 audit(1762471448.866:1178): pid=22137 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.4.4028" name="/newroot/262/file1" dev="fuse" ino=1 res=1 errno=0 [ 1578.377210][ T30] audit: type=1800 audit(1762471448.866:1179): pid=22137 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.4028" name="/" dev="fuse" ino=1 res=0 errno=0 [ 1578.544450][ T5871] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1578.547655][ T30] audit: type=1400 audit(1762471449.096:1180): avc: denied { checkpoint_restore } for pid=22149 comm="syz.7.4033" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1578.593599][ T5871] usb 4-1: device descriptor read/8, error -71 [ 1578.906534][T22150] dlm: no local IP address has been set [ 1578.913952][T22150] dlm: cannot start dlm midcomms -107 [ 1578.928822][T22155] Bluetooth: MGMT ver 1.23 [ 1578.938792][ T30] audit: type=1400 audit(1762471449.486:1181): avc: denied { bind } for pid=22149 comm="syz.7.4033" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1579.012760][T22150] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 1579.121071][ T5871] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1579.143569][ T5871] usb 4-1: device descriptor read/8, error -71 [ 1579.251454][ T5871] usb usb4-port1: unable to enumerate USB device [ 1579.261154][T20129] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 1579.442333][T20129] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 1579.451821][T20129] usb 5-1: config 0 has an invalid descriptor of length 191, skipping remainder of the config [ 1579.471492][T20129] usb 5-1: config 0 has no interface number 0 [ 1579.481222][T20129] usb 5-1: config 0 interface 205 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1579.494582][T17248] usb 6-1: new low-speed USB device number 97 using dummy_hcd [ 1579.508000][T20129] usb 5-1: New USB device found, idVendor=0403, idProduct=fa5b, bcdDevice=59.e2 [ 1579.521008][T20129] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1579.535439][T20129] usb 5-1: Product: syz [ 1579.539751][T20129] usb 5-1: Manufacturer: syz [ 1579.544681][T20129] usb 5-1: SerialNumber: syz [ 1579.569954][T20129] usb 5-1: config 0 descriptor?? [ 1579.691368][T17248] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1579.700694][T17248] usb 6-1: config 65 has an invalid interface number: 24 but max is 0 [ 1579.710397][T17248] usb 6-1: config 65 has no interface number 0 [ 1579.731717][T17248] usb 6-1: string descriptor 0 read error: -22 [ 1579.738062][T17248] usb 6-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice=18.3e [ 1580.247776][T17248] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.269556][T17248] ldusb 6-1:65.24: Interrupt in endpoint not found [ 1580.311901][T15214] Bluetooth: (null): Invalid header checksum [ 1580.318104][T15214] Bluetooth: (null): Invalid header checksum [ 1580.421534][ T6868] Bluetooth: (null): Invalid header checksum [ 1580.481924][T22163] netlink: 96 bytes leftover after parsing attributes in process `syz.5.4037'. [ 1580.490932][ T5871] usb 7-1: new high-speed USB device number 74 using dummy_hcd [ 1580.496684][T17248] usb 6-1: USB disconnect, device number 97 [ 1580.531910][ T6868] Bluetooth: (null): Invalid header checksum [ 1580.641923][ T6870] Bluetooth: (null): Invalid header checksum [ 1580.653472][ T5871] usb 7-1: New USB device found, idVendor=046d, idProduct=08b7, bcdDevice=ca.8e [ 1580.665530][ T5871] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1580.689573][ T5871] pwc: Logitech ViewPort AV 100 webcam detected. [ 1580.751353][T15214] Bluetooth: (null): Invalid header checksum [ 1580.863204][ T6868] Bluetooth: (null): Invalid header checksum [ 1580.951251][T17248] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 1580.971751][ T31] INFO: task syz.0.3604:20562 blocked for more than 143 seconds. [ 1580.971999][ T6868] Bluetooth: (null): Invalid header checksum [ 1580.979709][ T31] Not tainted syzkaller #0 [ 1580.991599][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1581.000326][ T31] task:syz.0.3604 state:D stack:27240 pid:20562 tgid:20561 ppid:11180 task_flags:0x400140 flags:0x00080002 [ 1581.018087][ T31] Call Trace: [ 1581.023753][ T31] [ 1581.026717][ T31] __schedule+0x1190/0x5de0 [ 1581.032263][ T31] ? check_path.constprop.0+0x24/0x50 [ 1581.037779][ T31] ? __pfx___schedule+0x10/0x10 [ 1581.043065][ T31] ? find_held_lock+0x2b/0x80 [ 1581.047838][ T31] ? schedule+0x2d7/0x3a0 [ 1581.051189][T18426] Bluetooth: hci6: command 0x1003 tx timeout [ 1581.052753][ T31] ? bdev_open+0xa2/0xe40 [ 1581.059846][ T5823] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1581.063265][ T31] schedule+0xe7/0x3a0 [ 1581.075060][ T31] schedule_preempt_disabled+0x13/0x30 [ 1581.082767][ T6868] Bluetooth: (null): Invalid header checksum [ 1581.090747][ T31] __mutex_lock+0x818/0x1060 [ 1581.095619][ T31] ? bdev_open+0xa2/0xe40 [ 1581.101623][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1581.106941][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 1581.112703][ T31] ? bdev_open+0xa2/0xe40 [ 1581.117453][ T31] bdev_open+0xa2/0xe40 [ 1581.122089][ T31] ? iput+0x35/0x40 [ 1581.124308][T17248] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1581.134514][ T31] bdev_file_open_by_dev+0x182/0x210 [ 1581.139910][ T31] setup_bdev_super+0x78/0x730 [ 1581.144834][ T31] get_tree_bdev_flags+0x363/0x620 [ 1581.150018][ T31] ? __pfx_udf_fill_super+0x10/0x10 [ 1581.155334][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 1581.161497][ T31] ? bpf_lsm_capable+0x9/0x10 [ 1581.161715][T17248] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1581.166241][ T31] ? security_capable+0x7e/0x260 [ 1581.166278][ T31] vfs_get_tree+0x8e/0x340 [ 1581.185798][ T31] path_mount+0x7b9/0x23a0 [ 1581.191665][ T31] ? __pfx_path_mount+0x10/0x10 [ 1581.196596][ T31] ? putname+0x154/0x1a0 [ 1581.198306][ T36] Bluetooth: (null): Invalid header checksum [ 1581.200903][ T31] ? putname+0x154/0x1a0 [ 1581.211491][ T31] ? putname+0x154/0x1a0 [ 1581.215814][ T31] ? __x64_sys_mount+0x293/0x310 [ 1581.216748][T17248] usb 4-1: config 0 has no interface number 1 [ 1581.220818][ T31] __x64_sys_mount+0x293/0x310 [ 1581.232318][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 1581.232854][T17248] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1581.237697][ T31] do_syscall_64+0xcd/0xfa0 [ 1581.253717][T17248] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1581.253778][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.266554][T17248] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1581.283184][ T31] RIP: 0033:0x7f4bde78f6c9 [ 1581.283191][T17248] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1581.301982][T17248] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1581.306978][ T6870] Bluetooth: (null): Invalid header checksum [ 1581.315412][ T31] RSP: 002b:00007f4bdf571038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1581.331508][ T31] RAX: ffffffffffffffda RBX: 00007f4bde9e5fa0 RCX: 00007f4bde78f6c9 [ 1581.339833][ T31] RDX: 0000200000000080 RSI: 0000200000004a00 RDI: 0000200000000000 [ 1581.348175][T17248] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1581.357755][T17248] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1581.365874][T17248] usb 4-1: Product: syz [ 1581.370221][T17248] usb 4-1: Manufacturer: syz [ 1581.375180][ T31] RBP: 00007f4bde811f91 R08: 0000000000000000 R09: 0000000000000000 [ 1581.383347][T17248] usb 4-1: SerialNumber: syz [ 1581.389289][ T31] R10: 0000000002008087 R11: 0000000000000246 R12: 0000000000000000 [ 1581.399780][T17248] usb 4-1: config 0 descriptor?? [ 1581.405530][T22176] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1581.408086][ T31] R13: 00007f4bde9e6038 R14: 00007f4bde9e5fa0 R15: 00007fffcf9a1448 [ 1581.421771][ T36] Bluetooth: (null): Invalid header checksum [ 1581.424090][ T31] [ 1581.441953][ T31] [ 1581.441953][ T31] Showing all locks held in the system: [ 1581.450751][ T31] 1 lock held by pool_workqueue_/3: [ 1581.451577][T17248] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1581.465963][ T31] 1 lock held by khungtaskd/31: [ 1581.476186][ T31] #0: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1581.477009][T17248] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1581.493508][ T31] 2 locks held by getty/5569: [ 1581.499350][ T31] #0: ffff8880314cf0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1581.509461][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1581.512401][T17248] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1581.521888][ T36] Bluetooth: (null): Invalid header checksum [ 1581.534853][ T31] 5 locks held by kworker/1:5/5871: [ 1581.540321][ T31] #0: ffff88802129b948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1581.551924][ T31] #1: ffffc9000449fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1581.563530][ T31] #2: ffff888029499198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1581.593171][ T31] #3: ffff888028c7b198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1581.603745][ T31] #4: ffff888057e06160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1581.618320][ T31] 2 locks held by kworker/u8:3/15214: [ 1581.624120][ T31] #0: ffff888020f39948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1581.635270][ T36] Bluetooth: (null): Invalid header checksum [ 1581.651417][ T31] #1: ffffc9000e877d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1581.661219][T17248] usb 4-1: USB disconnect, device number 90 [ 1581.663299][ T31] 4 locks held by udevd/15412: [ 1581.674600][ T31] #0: ffff888060703b08 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12d0 [ 1581.686216][ T31] #1: ffff88805db9f888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 [ 1581.696727][ T31] #2: ffff88804f815788 (kn->active#19){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 [ 1581.709524][ T31] #3: ffff88807ac36198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1581.719299][ T31] 1 lock held by udevd/15421: [ 1581.724362][ T31] #0: ffff8880261ef358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1581.734699][ T31] 5 locks held by kworker/0:0/17248: [ 1581.740127][ T31] #0: ffff88802129b948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1581.751495][ T36] Bluetooth: (null): Invalid header checksum [ 1581.751685][ T31] #1: ffffc9000f8efd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1581.768995][ T31] #2: ffff888029371198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1581.778465][ T31] #3: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1581.788490][ T31] #4: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1581.797880][ T31] 5 locks held by kworker/0:11/20129: [ 1581.803623][ T31] #0: ffff88802129b948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1581.814928][ T31] #1: ffffc90003517d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1581.826234][ T31] #2: ffff8881453e1198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1581.835626][ T31] #3: ffff88807ac36198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1581.844998][ T31] #4: ffff888144a91278 (&(&priv->bus_notifier)->rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x53/0xa0 [ 1581.857536][ T31] 2 locks held by syz.0.3604/20562: [ 1581.861484][ T36] Bluetooth: (null): Invalid header checksum [ 1581.862819][ T31] #0: ffff88802e9820e0 (&type->s_umount_key#85/1){+.+.}-{4:4}, at: alloc_super+0x1e3/0xb60 [ 1581.879719][ T31] #1: ffff8880261ef358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 1581.889032][ T31] 2 locks held by dhcpcd/22177: [ 1581.895186][ T31] #0: ffff888029658260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 [ 1581.905976][ T31] #1: ffffffff8e3cfcf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1581.916836][ T31] [ 1581.919200][ T31] ============================================= [ 1581.919200][ T31] [ 1581.956770][ T31] NMI backtrace for cpu 0 [ 1581.956789][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1581.956813][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1581.956827][ T31] Call Trace: [ 1581.956835][ T31] [ 1581.956843][ T31] dump_stack_lvl+0x116/0x1f0 [ 1581.956878][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1581.956905][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1581.956935][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1581.956962][ T31] watchdog+0xf3f/0x1170 [ 1581.956992][ T31] ? rcu_is_watching+0x12/0xc0 [ 1581.957018][ T31] ? __pfx_watchdog+0x10/0x10 [ 1581.957040][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1581.957073][ T31] ? __kthread_parkme+0x19e/0x250 [ 1581.957125][ T31] ? __pfx_watchdog+0x10/0x10 [ 1581.957149][ T31] kthread+0x3c5/0x780 [ 1581.957169][ T31] ? __pfx_kthread+0x10/0x10 [ 1581.957191][ T31] ? rcu_is_watching+0x12/0xc0 [ 1581.957215][ T31] ? __pfx_kthread+0x10/0x10 [ 1581.957229][ T31] ret_from_fork+0x675/0x7d0 [ 1581.957239][ T31] ? __pfx_kthread+0x10/0x10 [ 1581.957249][ T31] ret_from_fork_asm+0x1a/0x30 [ 1581.957272][ T31] [ 1581.957305][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1582.077772][ C1] NMI backtrace for cpu 1 [ 1582.077787][ C1] CPU: 1 UID: 0 PID: 15214 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 1582.077810][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1582.077823][ C1] Workqueue: events_unbound toggle_allocation_gate [ 1582.077850][ C1] RIP: 0010:lock_acquire+0x127/0x350 [ 1582.077869][ C1] Code: 0d e2 50 e9 0e 85 c9 0f 84 b1 00 00 00 65 8b 05 47 d5 08 12 85 c0 0f 85 a2 00 00 00 65 48 8b 05 87 93 08 12 8b 90 2c 0b 00 00 <85> d2 0f 85 8c 00 00 00 9c 8f 04 24 fa 48 c7 c7 c3 af b1 8d e8 a0 [ 1582.077889][ C1] RSP: 0018:ffffc9000e877798 EFLAGS: 00000246 [ 1582.077903][ C1] RAX: ffff888040a84900 RBX: ffffffff8e3c4760 RCX: 0000000000000001 [ 1582.077917][ C1] RDX: 0000000000000000 RSI: ffffffff82109284 RDI: fffffbfff1c788ec [ 1582.077930][ C1] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1582.077951][ C1] R10: 000000013ff17007 R11: 0000000000000001 R12: 0000000000000000 [ 1582.077963][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1582.077975][ C1] FS: 0000000000000000(0000) GS:ffff888124b08000(0000) knlGS:0000000000000000 [ 1582.077993][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1582.078006][ C1] CR2: 0000000000000000 CR3: 000000000e182000 CR4: 00000000003526f0 [ 1582.078020][ C1] Call Trace: [ 1582.078027][ C1] [ 1582.078035][ C1] ? do_raw_spin_lock+0x12c/0x2b0 [ 1582.078060][ C1] ___pte_offset_map+0x44/0x4f0 [ 1582.078079][ C1] ? ___pte_offset_map+0x33/0x4f0 [ 1582.078099][ C1] __pte_offset_map_lock+0x8d/0x310 [ 1582.078120][ C1] ? __pfx___pte_offset_map_lock+0x10/0x10 [ 1582.078141][ C1] ? trace_tlb_flush+0x100/0x160 [ 1582.078169][ C1] ? find_held_lock+0x2b/0x80 [ 1582.078191][ C1] ? find_held_lock+0x2b/0x80 [ 1582.078213][ C1] ? walk_to_pmd+0x305/0x4c0 [ 1582.078237][ C1] __get_locked_pte+0x79/0xc0 [ 1582.078259][ C1] ? kmem_cache_alloc_noprof+0x8b/0x6e0 [ 1582.078290][ C1] __text_poke+0x255/0xb70 [ 1582.078310][ C1] ? __pfx_text_poke_memcpy+0x10/0x10 [ 1582.078335][ C1] ? perf_event_text_poke+0x130/0x180 [ 1582.078358][ C1] ? __pfx___text_poke+0x10/0x10 [ 1582.078379][ C1] ? kmem_cache_alloc_noprof+0x8b/0x6e0 [ 1582.078410][ C1] smp_text_poke_batch_finish+0x4f1/0xdb0 [ 1582.078439][ C1] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 1582.078466][ C1] ? arch_jump_label_transform_queue+0xc0/0x120 [ 1582.078498][ C1] arch_jump_label_transform_apply+0x1c/0x30 [ 1582.078523][ C1] jump_label_update+0x376/0x550 [ 1582.078548][ C1] static_key_disable_cpuslocked+0x158/0x1c0 [ 1582.078575][ C1] static_key_disable+0x1a/0x20 [ 1582.078598][ C1] toggle_allocation_gate+0x145/0x280 [ 1582.078619][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 1582.078640][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1582.078668][ C1] ? rcu_is_watching+0x12/0xc0 [ 1582.078697][ C1] process_one_work+0x9cf/0x1b70 [ 1582.078722][ C1] ? __pfx_cfg80211_wiphy_work+0x10/0x10 [ 1582.078743][ C1] ? __pfx_process_one_work+0x10/0x10 [ 1582.078768][ C1] ? assign_work+0x1a0/0x250 [ 1582.078787][ C1] worker_thread+0x6c8/0xf10 [ 1582.078811][ C1] ? __kthread_parkme+0x19e/0x250 [ 1582.078840][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1582.078861][ C1] kthread+0x3c5/0x780 [ 1582.078879][ C1] ? __pfx_kthread+0x10/0x10 [ 1582.078898][ C1] ? rcu_is_watching+0x12/0xc0 [ 1582.078922][ C1] ? __pfx_kthread+0x10/0x10 [ 1582.078940][ C1] ret_from_fork+0x675/0x7d0 [ 1582.078957][ C1] ? __pfx_kthread+0x10/0x10 [ 1582.078977][ C1] ret_from_fork_asm+0x1a/0x30 [ 1582.079011][ C1] [ 1582.083163][ T36] Bluetooth: (null): Invalid header checksum [ 1582.434754][ T36] Bluetooth: (null): Invalid header checksum [ 1582.441168][ T36] Bluetooth: (null): Invalid header checksum [ 1582.447276][ T36] Bluetooth: (null): Invalid header checksum [ 1582.454181][ T36] Bluetooth: (null): Invalid header checksum [ 1582.467302][T20129] usb 5-1: USB disconnect, device number 58 [ 1582.507306][ T5871] pwc: Failed to set LED on/off time (-71) [ 1582.535670][ T5871] pwc: send_video_command error -71 [ 1582.540880][ T5871] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1582.587843][ T5871] Philips webcam 7-1:127.0: probe with driver Philips webcam failed with error -71 [ 1582.607485][ T5871] usb 7-1: USB disconnect, device number 74 [ 1585.625836][ T5182] udevd[5182]: worker [15421] /devices/virtual/block/nbd0 timeout; kill it [ 1585.634730][ T5182] udevd[5182]: seq 25519 '/devices/virtual/block/nbd0' killed