last executing test programs: 2m1.630257869s ago: executing program 2 (id=1521): ioperm(0x0, 0x2, 0x7e) (async) ioperm(0x0, 0x2, 0x7e) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_emit_ethernet(0x256, &(0x7f00000020c0)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "430093", 0x220, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x22, 0xa, "a78ce5400659808000ffffc0fe4023493b87aafaffffffffffffff2373247202fa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000000000000000800ee00"}, {0x4, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x2, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5c6186c0d3baa75af390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5acaa556b9f30dcab2b90aa235a670670ffc5dc49dfb58d89310000000000"}]}}}}}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x3, 0xff) (async) r1 = socket$inet6(0xa, 0x3, 0xff) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000004c0)={0x0, 0x3, 0x6, @broadcast}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0], 0x0, 0x1a, &(0x7f00000001c0)=[{}, {}, {}, {}], 0x20, 0x0, 0x0, &(0x7f0000000240), 0x8, 0x57, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000600)=@o_path={&(0x7f00000005c0)='./file0\x00', 0x0, 0x4010, r1}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x13, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x40, 0x7f, &(0x7f0000000240)=""/127, 0x41000, 0x10, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x0, 0xb, 0x6, 0x1000}, 0x10, r3, r4, 0x0, 0x0, 0x0, 0x10, 0xce, @void, @value}, 0x94) connect$inet6(r1, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1f}, 0x5}, 0x1c) dup2(r1, r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000071121b000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) 2m1.395559955s ago: executing program 2 (id=1523): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000280), 0x200, 0x121001) r2 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x402300) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000140)={r2, 0x6, {0x0, 0x0, 0x0, 0x6, 0x4858d114, 0x0, 0x0, 0x1a, 0x1, "50fbe6f53806f50066cb8bf8e6fbfef48523da760ef85fffb38b45baf168d7b6ff327617245663a4c6f31b395784e5d0aba034427b8a84e3953c2ca7b318e88b", "87cf46bb8afd27bcf0b2c34cea030066b52172143ad1612c4051c7349228dd7544a9fd109afb653083db4f7d572a1f8c2c58edd7e92103736b4f0c0e760ad41a", "8be9931b4fe5fd2b47b5c97b538fc5d6da057f96430ab2be47332e6797720cd5", [0x8009, 0x4]}}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r1}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x4a, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$kcm(0x10, 0x2, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='fd/3\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r7, 0x40045108, &(0x7f0000000200)) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r8, 0x5100) ioctl$SNDCTL_SEQ_RESET(r8, 0x5100) r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000140)="3e26da95330000004a99b9800000c00f3235000800000f3036660f7d03c483510cf40f0f01cfc48105f51fdcf84e000000c77dea80adce9be6aee6aecb0f01cb0f015e0f", 0xfffffffffffffdac}], 0x1, 0x3, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x56, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, 0x0) r11 = dup2(r3, r2) setsockopt$ax25_SO_BINDTODEVICE(r11, 0x101, 0x19, &(0x7f0000000380)=@rose={'rose', 0x0}, 0x10) syz_open_dev$amidi(&(0x7f0000000480), 0x2, 0x80042) r12 = syz_open_dev$loop(&(0x7f0000000100), 0xd79, 0x80000) ioctl$BLKPG(r12, 0x1269, &(0x7f00000001c0)={0x3, 0x0, 0x98, &(0x7f0000000400)={0x6, 0x0, 0xe}}) 2m0.87087584s ago: executing program 2 (id=1529): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) pipe2$watch_queue(0x0, 0x80) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000980)="b95da254b876314b0c13f8bef6a61815c4a2cf209ed4ae6c48355d365fe6d3e23fc5f34bc3c6559e77784b4fec3b9e623ae10065136506b7a21dfddac6faf343a1f13507d73f4abdda92402f39e3dce935264d0c9a3488773f7ce2cc24644c00ae74d81297a5de961aad2c3e7b06a5d2d16a267dd3d71ccf00e9a9cf94b98d9b39017cda9921874841ebea7c2310b0bb5b5f7bd9c9829710c46d807c016a5dbb7d85e219d87f446b34d28bc6e06ea059be9ec4e015f8ad84eb065a9b2140cdebac098b535ac19ee9dca52efd39dbc2cbf9503d26617ac0894ba3bd7f9f1d043c5dc98e349cb04a985c0d05811d4e3e0a046df0efd1cfbf8f2346c90f8c8595a12b7cdd98ef0e41a2fe27507fb0b5b9b1936b558ca7646208f3a0c07d4697314f8c32a6aabe99e5282847a74a5b0126f90e0314bcd7e839a21170f56479f40ea2b8663c111d2a288a6856a4e001b1121501c03b570375cb33698b9cc19c947039a06fc0e54da91f450df4eb697428425cb86efdba917495b1bd4da17c208c12a2cf606725f82fd26e83ebcaa367a49c2a2658e084c656a487adc4daa8b084211a909c16080e54e067de77543668ff0b0be1c341042be44f3cb74b8fd6831210decd6647021efa2c3c5ea471ab2a517174ec2cc4e70e4047bc9e6f592a2d64e1fd4d64f70082cfc11427b0880fda7924f06f393b4d80cd8c8ade6403f816d383a61314240c6deeffb810a4b51856ffbe187ab25b179efe8d4c2cbd1829314f2b88450482d21eed3b2bdbf9f1dc0196e57ca4e29261e3a981c28896fd9c0b5ed5d43d454cf17f469562d636f7e8d13d3e0dc6cf09e38030f2b09a34050862046bcb73a415f4cd34c0d74762499267b4a934dc708f5fbafb15677b6a2b4a50480b8122acbac081e7120c2a089d8eb7beef4c83d0c67a8affe7748c81c6919e5ae73e1b5c5fb8c311147f19edf3148b8c6d5740dda8b03c97cb20e4c143789bb400ba80b9d6d8aa0a7a6aeae48a0add29e4e249f3e41bda3bca2c2507740565b7ecab7668075d09958889a888eb7d3bdd1f3c5cc93dc08319df8681a72d8a793734a276525314ccc538c05d6a2ae467b72d4144d7f539051b72eabe6b40d65923ea6b220505b6d83de769f25aba5204f41a25d8822be34cdf7786cf997991f905d2424633172f122e42ddd08d181beb4a69d9422d341dc13fd6b9a9a046836d66de6989a367f8f1c1d2f0d7eab3b5be1cb6ff37c830bc58303db47808e08f2a98043667821a4ef89f233daf22b4864c76411a85366891a9ba8a247d1f6c1682c661a7b3c0e2e3a5b38950cb3061c843b070e9ff56b3632e8e447d0ab5af90a9fcc60ec600c3f5595bdcd814cf2bb7a0dd11b8287d73674c40bc37b88c60aa97efcbb443b118dc4bada94e17f0abdbaa02e2130357ecceb4ae1c354e82309b015cf8b0d973d14c146380befdd5de968a85421665b7577ff81c01f00cec40aef77896faa88cda14343157d08f30176a27cb98d798e7ed14f620f985d94c85e8b6e6f1688ad083adb20df39e3758a8530a1ef6427c828197fd9fb92041d3862eef6ef07cee663aa20bc1f7e65d5eb99c822b7f591be4ba06f67e0efeaef013e504eaa4fb04b99a4faa935c19ad69e4e1250f15a918fae4fef77962acd3acbfc0e5214b7f5fd128e7d73f1d615a74073e53c0d32776bca3631398632385d139c4ccae7be38d144b8197ee668ce0534716455330a27e555f7ef16ec357423f1a7b00ac5f3364e23ef44e5f4ce640551a1869863c4f85092ca3db322136cfde8249369140fd6f630fb0dfc92d35234297bc286fb4388e82230ee3e0836480404e794b8a3fc2cf3b8f01897287ecd496f61ed7dc5bdfed8ca7b54ffe5d7dd803357c2214760f3f9f45f7a97eaaa10ec4c9c0c6d6224e31c79006c69293754665e2228b3fc06c94cf974e5c3660168b6cb8eee51cb03554e39f3fbd7eabb6529e3412bf6d97a25e219a9343dee80159684218d91f107d7e2f9ce72e221a2bb227fadee6f8515bdd2f29f72c3956323aebc8ab0b4efb8dac94efea26adf8c601a0f774a4322a5ccadeb59425e6893b0d3886f8e082adb2abbdd1a3b2d5a2de94c0e372ae4989972599a4571e15ac727af6c666f242c6e46acc73e8afd983ca05ad6b9cdeca2ef00f68ecd1576583ed6731a6c5f9a67a405423c63d3e244637ebd2d240b8ee7e7a3951787d6abfb89834abf8ef575c42674043a3dc4145aa3f7834418e0ea3919e910669f262f94c756d83dfdf7f04287a662c6ef9a5c6b3f8243f60cb1dbe86fbc10214a56a4750904b24fb6ca7cd552623ec4f8f6a5e266d02cb1ab0677b1659c22ff7d470144f3ae669085cdd58442f894c3590b43d64c14dde51f8feca879a4d01dc4ff422c151835a7b05fddc3acede5ec72797e55a9806c11ab71afbcbeaf3e737fbab1d945625ba3d7aa0248b464185e4ab1233e5372b211e8ae2847eb16c460c7b360eef504879a10981c3f3a2910a979bd180c17f1f3ab7ab873ec126b592b34b27cc3ade3e0debbf5db1f1a5acb2cb006aba8908bea0f5737475890754a0a45e2ca5b0278b33e81894e990fcd099d069eb2d17fad84e27f89bb68fa64a7f37f23b8e2ceb95924caa144bf216a7bdaa4525842f1c53f0cc1571bf0297dd76dc4dc3d3fcd73abbfb893bd1f6147de511f785eeacd1d1999e46f7e6902561b2edd902f24bfb03f9eaf28cc25b04e669e547d2ce92273e1ce52b71546883cece43df0f5fde7286169e17ce2119b862de08a2e2879707b7667d0644be49cf9e75ac245df7fbe504bfb0ffd3ca3120ce9326f47957d4e6f459ccfde837c6ea67dc19288afb343ea06d3af7aaf201fde1092e3b9e513aa17843588701d31fd0d2bb01c4d528b3fc6be7e5c2fa83cb6ebaa57cd9f91f933b7f368290f2870ebc836147f0e7f3f597414598d5f6222835c525435634cf8345e76fa597611d80b59674f1ee7e97a092f19eb4193a619afa72be67e7cbbf583198012f2b74433b027f948f01aaa872964dfab6c6bcecff57baa4b41b720a0be7a90dfcb477b94b3066f5627bb73e86e07dca88f5a2394ed168048e2f1fad32c32f4487f8951d60ec0b4f5c48401f4300aa1dfc643099ceceb03dc8e9a5c35802b1e7e2bcd5541cdbbb768372ea3318e22cb2d324d49ae46cbbed0517828464feb11f6f177be924f350c6679709c891ba4ffdb6aa552c674f369c6dce65eebc821cf16539c2318d4fffbd59225d5fa3befcf34855643ba2fe2e99e299a930c0babd859effbec66dbf55f1a028f78d76b8f5bcb122b57dcd4f42670d5a24cc2a20b85fcf7b5a75d4947cd1a17a652320ccbf8878275b55c012c02e10c26f4017c0cca94a3c58fb87508c26098fb3059d973f83c08ddd66e8e7b54b95f9bc33b13137426e2a3b45f454f75f02e1c02231961a9225909d08b61cc9365e4ea8cf395e2ea4c224ab32e09850a0f7cabe4b98c7567cee9c43883408aab59481cc703c97f077336e243331ab458c8a8bbca29a92bead701d8dcc699ac0cc6e09619604ea7ccaf8ca0a65bf451fa9c6070acd7f68f89b12fcd9d7ee0a5d350d3a669bf0d0d7352828febdb0361e7a7c7c2d43604298bb08345adbeaef2d07603baaf5675a2479fa8d13ad0b4074dbbe3f90a515c57a6d8572caefe73b527ce61a7fcc746a12c2b9995a7b68352c5b8f9755590aca8ef3567a6e5c72b59daa0d3fcba0c4980f171079fb7b2592cdc2f2e5ea223c82a8b16b45c0236a42f5090002af47401dcdc114b214eb226c49fc3b7cecb2caf276d018654c637bb97a3bb636b044681805c02a87ae1ebe4c90ba24dde649612bfde3befd85462c5356b887c289177d30c886a863e07e8ab49c39b73f2a3f078992a63def5a248aec4ff9a7fc95c78944a0bb62e8d6d9fccf8f22472548e77681b404bf9b045936284aaed9e6b43c91afad7f94a81a3ac4f95ab97e4e5aaa9b9aedd39a58c1cd8c6073e664213f854612297b77de8877b6a665b17a4a6ec3d8930cf89dcf27f81ac62e79f340c4f5a3c7e4ea85015beee33701ba13efe31187c467c86c0fc6c1cb9fd29929f48512db27bbf32c19abfbab7172f6cd6b9e6e5ec18c576d74b49d79542caf5b9b15aaddf90847b1290b2de2bf339631f89025ff36d97ee3c930e23b65d45757604916d28352454b72da21f8f78b1bb51b59d11028a07de785dc6e307e7aa07c931dfd092dd4482016f90d96b97960473bc727aebcb4891385c9c8663fff32327373dc703ecc00d178344e78824b52da671fc65ea4d7c54b00f08cf6c605ee71f0f58146a52676296bcee4f187c8417897314d04e82c9c1cd8304f436eaeef3b4abe96418c112042bf8bf378d1edfd7120c3da1804bf9a9805abf1117772d3bbdbe073ad545e05c2a834e63e3970f581fd0e435e9b63f7e65ed849f8406d0ef47a8bd3e15efa8ff06bcd76f7e9194e155738e65474e3c42787f496ead879d232776006c9833a87e48122bfddee30eaefec402b7057678eb97b19f368353b19b0b1c4048f11f893173e44991867c063efacb953e06077a8c0bace4dd695a2985b81bb1e691f40b0f7e2010201fd406d8667b65980b1df3f8de03a634f8cc27962f68208457b7dc83c2870ec35b03c3aae1f253ecee60ee4651edcb008f3be02888bab88de6464024dfa1eaed986802acb573a56ac4488e474aeb2fb374840500402afae7dcc6ed4fffc57bb03e0a8652e6689c520d4324f109ce416dfc8cb94fa06e84d1fb8bf21826fdfa8c1a09abaf903c357f561591ea1c7016b0e88e749db363aa0f30b1bf89f01999c4253f9eb5d4f24266ece3295e8b23859d76bd07e6f55dc7ef87eef5ba3b0feab3c4f89f31ca03a3999d67bd8570c793c860b67232bb4e2e4f35441ec8f1469fc2b6aef4f0993c24bc9f7d965a2de001038ea01ea5874be947b9c54a3c16bb579bf498c6f04faf01ae0f677ad25ab7f7b572dad9c099b11935389f89069990d1d238322f471f31b813f1ffa61916c0bac510907939af735f8c1202c5a56403fd4a7930e731de25cbcb07fe24b8829684f2d5427fdbde9544484808ca9fb6ebc48b4b1a8878bcc2a5d6b32558159c9c5bdfb0212dbd9a242fa04ecd404c745eb5c992b1ba5fc1acc47f1f77e0b2172fcd66ec68f0babee840afc1bd882896fabf3f3d7ca60e10c833e8820a737d0cf50dc0bf14235361be566b280ef745473a5b12bc469419f3330f583b81887614ea20f23af2344cffd14e78df7dc3e818bf2b875f600e92139f8407f564b284b675e623d9879e4c99467a3a9c387cad16f54f8fa52381641915b13085e617c2bb602a051381bbfe66400b99d1b7e5c2f476b5d6987189d884ac782ebbb17b20b838c76525e9dd3a535f8ab9338b212a0d6062313126cf640544b165938c9ec15248d166a4a2c6af5d901c6dcf030d92e892c694c6ec1ad647443d5f663c0198935d20bd5772a0b7e0ed46fd9e8fa91a9cab6fa6e373dc0fafee011e012d03a22a4f5f34f572da431a8a2abab56f9cb054021d55ceff05b62e545304e84004c313c6be33c3327ce6390bb010af7f4a734278b53bcb357719bc0e1063ae5cfff113889857af659634787814fae43da9bf640f763afbd691c4793540948e7167d0583f701415d40dc1f5bdaeb4c9b4eeb29e504a1b63684d633edbbd572dc586f7d09c92c63cad0a86c1e0f5491f7b9042d29623ef0db2c3860219d9a8f19f3d568a984f269d1ab43516a2ebad72ca8a6c77580b7e142", &(0x7f00000001c0)=@tcp, 0x2}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x8, &(0x7f0000001f80)=ANY=[@ANYBLOB="7a0af8ff7525732cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4054ce13f6fcc58912a175bd9cc3c494894ad39b36e34e608f4ac00cf22c2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x20000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x0, 0x4000000}, 0x28) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000040)={0x34, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x2}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}]}, 0x34}}, 0x4804) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000000), &(0x7f00000002c0)}, 0x20) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @dev, 0x1}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000300)='`', 0x1}], 0x1}, 0x0) sendmsg$inet(r4, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000340)="f1", 0x1}], 0x1}, 0x4040080) sendmsg$kcm(r4, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="bb", 0x1}], 0x1, &(0x7f0000000100)=[{0x20, 0x84, 0x2, "fe8041000000000092"}], 0x20}, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) sched_setscheduler(r5, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001580)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) 1m59.495447171s ago: executing program 2 (id=1535): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000020301040000000000000000000040200800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000002030102000000df00000000000000000800010001000000"], 0x1c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r3, 0x4, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x810) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b000100000000090408000103"], 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r5) sendmsg$NFC_CMD_LLC_SET_PARAMS(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010025bd7000ffdbdf2510000000050010001400000005000f0003000000080001"], 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x800) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x68, r7, 0x20, 0xfffffff9, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}]}, 0x68}}, 0x200008c1) 1m56.712502251s ago: executing program 2 (id=1543): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, 0x0, 0x0, 0x10c000, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) write(r1, &(0x7f0000000500)="240000001e005f021476fffffffffff8070000160000fcda8135bf16633a5700000000006a", 0x25) socket$packet(0x11, 0x2, 0x300) pread64(r1, &(0x7f0000000180)=""/202, 0xca, 0x9) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) sched_rr_get_interval(r3, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) 1m55.716351188s ago: executing program 2 (id=1549): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) getrlimit(0x6, &(0x7f00000000c0)) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="ae0200007d400000056d0100000000000b0002000000030000000000000000000000000000000000000005000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e19200cfc26dd7c500f0dc346c29566e650a418a564b98a842424a97837f5b8551eecb065cf71de135f073a247416174e2a8049b58d95d7b99a9ac9f3b338284496f9dca661d6ac266a011e084f3c1b0be1db46d29d6083a45fbf89e31b5e3dbfd0e35c748de281fe2ba18ef868a87a9a448608c1cad87c8e01e1c920900e6f8deb898195bbeeee2a99400000000000000000000005500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f168a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4c0880e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb4b060000ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd"], 0x2ae) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xb8}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = syz_open_dev$video4linux(&(0x7f0000000180), 0x0, 0x40100) ioctl$VIDIOC_TRY_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000000)={0xfffffff, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x0}) shmat(0x0, &(0x7f0000565000/0x4000)=nil, 0x2000) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) close_range(r1, 0xffffffffffffffff, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) 1m40.167724752s ago: executing program 32 (id=1549): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) getrlimit(0x6, &(0x7f00000000c0)) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="ae0200007d400000056d0100000000000b0002000000030000000000000000000000000000000000000005000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e19200cfc26dd7c500f0dc346c29566e650a418a564b98a842424a97837f5b8551eecb065cf71de135f073a247416174e2a8049b58d95d7b99a9ac9f3b338284496f9dca661d6ac266a011e084f3c1b0be1db46d29d6083a45fbf89e31b5e3dbfd0e35c748de281fe2ba18ef868a87a9a448608c1cad87c8e01e1c920900e6f8deb898195bbeeee2a99400000000000000000000005500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f168a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4c0880e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb4b060000ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd"], 0x2ae) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xb8}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = syz_open_dev$video4linux(&(0x7f0000000180), 0x0, 0x40100) ioctl$VIDIOC_TRY_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000000)={0xfffffff, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x0}) shmat(0x0, &(0x7f0000565000/0x4000)=nil, 0x2000) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) close_range(r1, 0xffffffffffffffff, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) 9.412409795s ago: executing program 4 (id=1954): mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000002c0)={0x83d2, 0x9, 0x1, {0xb, @sliced={0x7, [0x1, 0xfffe, 0x4, 0x3, 0x101, 0xfff, 0x4, 0x6, 0x71, 0x5, 0x6, 0xdd, 0x4, 0x84a, 0x7, 0x3ff, 0x8, 0x101, 0x7, 0x3, 0x7f, 0x7, 0x3, 0x0, 0x6, 0x5, 0x1000, 0x1, 0x7, 0x101, 0x304, 0x4, 0x71, 0x6, 0x9, 0xfff6, 0x9b, 0xff92, 0x53, 0xae, 0x7, 0xc0, 0x8, 0x9, 0x8, 0xb, 0x3, 0x8], 0x9}}, 0x3}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x800000, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) semget(0x0, 0x2, 0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 8.458690055s ago: executing program 4 (id=1956): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800eaef98ac7d30ad94c1d5729e006c7545d37c8788635bed7e999996b20004000000"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x5, 0xe, 0x0, &(0x7f0000000000)="251200d800"/14, 0x0, 0x7ff, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = syz_io_uring_setup(0x893, &(0x7f0000000140)={0x0, 0xaee1, 0x0, 0x0, 0x229}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='task\x00') sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x54, 0x0, 0x0) getdents(r5, &(0x7f0000000000)=""/24, 0x18) getdents64(r5, &(0x7f0000000140)=""/56, 0x38) io_uring_enter(r2, 0x5361, 0xfffffffd, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x10000}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$video4linux(0x0, 0x5, 0x0) 7.393201115s ago: executing program 5 (id=1959): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX]) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x64, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x40041}, 0x800) syz_io_uring_setup(0x4172, &(0x7f0000000780)={0x0, 0x0, 0x40}, &(0x7f0000000100), &(0x7f0000000040)) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) write$cgroup_pid(r4, &(0x7f0000000080), 0x12) r6 = openat$cgroup_procs(r5, &(0x7f0000000300)='tasks\x00', 0x2, 0x0) sendfile(r6, r6, 0x0, 0x2) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f0000000180)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000100)) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x333, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x10, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x2000, 0x3, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x2, 0x0, 0x8}}}}}]}}]}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000a40)=ANY=[@ANYRESDEC=r9], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r10 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_int(r10, 0x1, 0x26, 0x0, &(0x7f0000000100)) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x30, r11, 0x1, 0xfffffffe, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x5}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r8}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) 7.098753353s ago: executing program 1 (id=1960): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_ima(&(0x7f0000000480)='./file0\x00', &(0x7f0000000100), &(0x7f0000000380)=ANY=[@ANYBLOB="0302020100e79f00024a45"], 0xb, 0x1) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYRES64=r1], 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x80044) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000180)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x185) write$cgroup_int(r4, &(0x7f00000000c0)=0x1c3, 0x12) sendmsg$key(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x8000) socket$key(0xf, 0x3, 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x4004010) 6.285282276s ago: executing program 4 (id=1963): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2b, 0x80801, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x140, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xa8, 0xf0, 0x52020000, {0x0, 0x6802000000000000}}, @unspec=@CT0={0x48}}, {{@ipv6={@local, @private2, [], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x258, 0x4c, 0x232, 0x258, 0x0, 0x388, 0x2e8, 0x2e8, 0x388, 0x2e8, 0x3, 0x0, {[{{@ipv6={@mcast2, @mcast2, [], [], 'veth1_to_bond\x00', 'ip6gre0\x00', {}, {}, 0x6, 0x0, 0x3}, 0x0, 0x230, 0x258, 0x0, {}, [@common=@unspec=@cluster={{0x30}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@dev, [], @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@ipv4, [], @ipv4=@broadcast}, {@ipv4=@multicast2, [], @ipv4=@dev, [0xff], 0x0, 0x0, 0x0, 0x1}, {@ipv6=@loopback, [0x0, 0xffffff00], @ipv6=@private2}], 0x1}}]}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x32}}, @private1, [], [], 'team_slave_0\x00', 'xfrm0\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)={0x18, 0x2d, 0x9, 0x70bd26, 0x0, {0x4}, [@nested={0x4, 0x19}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) 6.166105271s ago: executing program 4 (id=1964): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 6.142774912s ago: executing program 1 (id=1965): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) syz_open_dev$MSR(&(0x7f00000000c0), 0x1b3, 0x0) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) iopl(0x3) landlock_create_ruleset(0x0, 0x0, 0x10000000000001) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x48, r2, 0x917, 0x1000, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x48}, 0x1, 0x0, 0x0, 0x44}, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 6.072283108s ago: executing program 1 (id=1966): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r2, @ANYBLOB="a1bcefc5b6ecf82d3fc30c404bed58bd740d0ac06455a4246e3fb7384cb0f1014067da922a576e2635022647aebed58758686b055d"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) flock(r6, 0x1) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) flock(r7, 0x2) flock(r5, 0x2) flock(r5, 0x1) close_range(r5, 0xffffffffffffffff, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90606}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_IFALIASn={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x600}, 0x0) 6.070671501s ago: executing program 4 (id=1967): r0 = syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000086b1d010140000102030109025f00030100600009040000000101"], 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r1}], 0x1, 0x0, 0x0, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000100)=0xcf5) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r2 = syz_open_pts(r1, 0x121500) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000280)=0x3) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x4000000) syz_usb_control_io(r0, &(0x7f0000000440)={0x2c, &(0x7f0000000240)={0x20, 0x3e, 0x2, {0x2, 0x23}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x409}}, &(0x7f00000002c0)={0x0, 0xf, 0x76, {0x5, 0xf, 0x76, 0x2, [@wireless={0xb, 0x10, 0x1, 0x2, 0xa0, 0x2, 0x5, 0x3, 0x9}, @generic={0x66, 0x10, 0xa, "fce55ef030b8b4a430a36964c298d1381247c2766acbbf63606bec1a6c77fa47674ce0dd8b7eefc0a070b3d6974527a8838986d787b45044bbe572c14bb227a9dc5c53b64625f92bcc1d72af04b73ad390edce4bd133fb4949508a41faaccd21362549"}]}}, &(0x7f00000003c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x0, 0x10, 0xc, "35e41419", "c47273d4"}}, &(0x7f0000000400)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x9, 0x10, 0x8, 0x11, 0x7, 0x6, 0xa34d}}}, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x20, 0xd, 0x46, "f7c39bbd012674d6aa869344139c2d82cb17b4ab9423da77dea1a45a6c5e4aeb14d2d425270875dd6d97bdd95c15ca4280dd3ebf2713390a671c7f22b330d173e4ff87246b60"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1}}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x0, 0x20}}, 0x0, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x3}, &(0x7f0000000700)={0x40, 0xb, 0x2, "c4d7"}, 0x0, &(0x7f0000000780)={0x40, 0x13, 0x6, @random="8c89dab65b02"}, 0x0, 0x0, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x24}, &(0x7f0000000880)={0x40, 0x1c, 0x1, 0x5}, &(0x7f00000008c0)={0x40, 0x1e, 0x1}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x9}}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) close_range(r6, 0xffffffffffffffff, 0x2) symlinkat(&(0x7f0000000f00)='./file0\x00', r6, &(0x7f0000000f40)='./file0\x00') prctl$PR_SET_NAME(0xf, &(0x7f00000001c0)='w\xde\xa3\x05\xff\a\x00\x00\x00\x00\x00\x00\x8f\xc0\x9b\x86\xef\\\xc0\x89\av\x9f\xd6\xd1\x98<\xc8\x18E/\x8c\x1a\xe3\xbd') socket$kcm(0x2d, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000ac0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$nl_xfrm(r6, &(0x7f0000000ec0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000f80)=ANY=[@ANYBLOB="540300001d0001002cbd7000ffdbdf25e4000600ac1414bb000000000000000000000000000000000000000000000000000000004e2400034e2200050a0020203a000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="64010100000000000000000000000000000004d432000000000000000000000000000000000000000100000000000000040000000000000008000000000000000000000005000000050000000000000000000000000000000400000000000000fbffffffffffffff030000000000000009007f5a813578000000000000030000000000000001000080000000284a3ba2ea0006000000070000000900000027bd70000735000002000239060000000000000044010500ac141424000000000000000000000000000004d26c00000002000000ffffffff0000000000000000000000000535000002010700000000000500000000020000fc010000000000000000000000000001000004d6330000000a000000ff020000000000000000000000000001000000000101060008000000fcffffff06000000fc010000000000000000000000000000000004d3330000000a00000000000000009532b8cd8200ff0000000001073500000302060001f0ffff000000000000000000000000000000000000000000000000000004d21700000000000000000000000000000000000000000000010235000003007f00070000000600000000000000ff020000000000000000000000000001000004d3ff00000002000000fc00000000000000000000000000000100000000020300000673eb7efde86867ebdc321628ad9bdbe4c3d61d089f52eefcd3b77318b7c61dce01b8c230473d96efe2ea3bc24c7c478b15ce2938081eb7404cad782f5c6e66f836501def5deb951807ad11c739d2df5e309db827fe2de5e7fd3c5cbe7509f93462591e188b99d412d0c7b38d4a3fe207f56ca4bdca5c690e", @ANYRES32=0x0, @ANYBLOB="0300000008000c0006000000c3000800bf000800000fb70028aaab82bc11a06ae232be37c86a1e592dcea021aa3f498b5e08c37686b853c7592af5e7ab23c56427f07f137781daf3db0015c198c84c15044fc84e1795f28e031ed14c10a9faf78d0ba89b028c2ca9aca0a99fea9f00dbd29463e8b1c93da54c"], 0x354}, 0x1, 0x0, 0x0, 0x40000081}, 0x2004c8c1) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_adj\x00') read$FUSE(r7, 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x951, 0x1, 0x6, 0x0, 0x7, 0x8000000000000000, 0x8000000000000001, 0x3}, &(0x7f00000000c0)={0x101, 0x4, 0xc5, 0x1, 0x3d85, 0x28a, 0x6, 0x9}, &(0x7f0000000100)={0x3d8, 0x10000, 0x1, 0x100, 0x8000000000000000, 0x0, 0xce5, 0xeff}, &(0x7f0000000180)={r4, r5+10000000}, &(0x7f0000000200)={&(0x7f00000001c0)={[0xe7]}, 0x8}) 5.79383396s ago: executing program 1 (id=1969): prlimit64(0x0, 0x2, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0xfffffffffffffffd) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x300048c1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0x4a490300eb695027, &(0x7f0000000140)={0x8, 0xc1b9}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f0000000100)=r4, 0x4) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f00000000c0)) fcntl$dupfd(r2, 0x406, r5) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x52cc) openat(0xffffffffffffff9c, 0x0, 0x80c00, 0x63) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f0000000340)=ANY=[@ANYRES64], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) ioctl$int_in(r1, 0x5452, &(0x7f00000001c0)=0x1) close_range(r1, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x2, 0x5004) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 5.007073674s ago: executing program 5 (id=1971): syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x80000) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e25, @multicast2}, 0x10) sendmmsg$inet(r4, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x2000c000) timer_create(0xb, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) timer_create(0x2, 0x0, &(0x7f0000000040)) 4.895491089s ago: executing program 1 (id=1972): truncate(&(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x3) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x240540c7, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000000840)=ANY=[@ANYBLOB="01000000060000000080000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0100004001000000010000c067c8cc060200004a4faa7920a000ad9a3015d38f7c32c177f1ab28405590249481abbf28f7a63adfae437a3deb74d8e3316c735286466f4e0c167ce9e669ee6ad985ed3cb618836e82f04d17125d35491f30b8e2f03f0d576267fb2628ee0429fa8b7707a70403867e4595a7cd16e41869646793628a5437fd183dea81758ab6e38caf01de66f443c3eb2710bcf071296d0f51a155530df26f6c064491744318d6e2a80f20a3f3ff590fb00c1bf18dbf8e1d27a93ce0c077f6a491122742577c1a037bcafdb7d99b994be32b"], 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000680)={0xffffffffffffffff}, 0x4) sendmsg$can_bcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6acd41fd8"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000003f40)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001840)=ANY=[@ANYBLOB="01000000290b0000ffffffff00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0100004001"], 0x80}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000980)={0x14, 0xc, &(0x7f0000000280)="e82f0a38ed136dc2dc767045"}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000180)={0x28, 0x1, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, 0x0) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, &(0x7f0000000080)={0x8, r5}) 4.766193072s ago: executing program 0 (id=1973): socket$pppoe(0x18, 0x1, 0x0) fsopen(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$key(0xf, 0x3, 0x2) io_setup(0x7, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r4 = eventfd(0x80000001) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, 0x0}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0bfc0000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x40820}, 0x0) writev(r5, &(0x7f0000000040), 0x2) close(r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x1000}]}, 0x24}}, 0x0) 3.9565532s ago: executing program 5 (id=1974): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x3, &(0x7f0000001300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) preadv(r0, &(0x7f00000002c0), 0x1000000000000088, 0x5, 0x4843) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x1c, r3, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x8004) socket$inet6_tcp(0xa, 0x1, 0x0) 3.66100975s ago: executing program 0 (id=1976): socket$nl_crypto(0x10, 0x3, 0x15) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x815}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0}, 0x18) ioctl$TCFLSH(r5, 0x400455c8, 0x4) openat$yama_ptrace_scope(0xffffff9c, 0x0, 0x2, 0x0) syz_io_uring_setup(0x468d, &(0x7f0000000300)={0x0, 0x9b92, 0x4, 0x1, 0x226}, &(0x7f0000000280), &(0x7f0000000380)) close(0xffffffffffffffff) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) socket(0x1e, 0x4, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r6, 0x119, 0x1, &(0x7f0000000080), 0x4) 2.837180222s ago: executing program 5 (id=1977): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfffffffffffffff8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = accept$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) memfd_create(&(0x7f0000000000)='y\x105%\xa3\xd5\xfa\xd7\xfa\x17\xe9\x99\xa2\x89\x8e\xcd\xfd', 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="01000000050000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1400000004000000040000000600000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00 \x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f0000000180)={r3, &(0x7f0000000000), 0x0}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) getpid() r5 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x118, 0x118, 0xb, [@enum64={0x1, 0x7, 0x0, 0x13, 0x0, 0x1, [{0x10, 0x6, 0x7}, {0x5, 0x6, 0x9}, {0xf, 0x8}, {0xb, 0x40, 0x1}, {0x7, 0x0, 0x6}, {0xe, 0x9, 0x3}, {0x7, 0x0, 0x4}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}, @typedef={0xd, 0x0, 0x0, 0x8, 0x1}, @volatile={0x1, 0x0, 0x0, 0x9, 0x1}, @type_tag={0xd, 0x0, 0x0, 0x12, 0x1}, @func={0xa, 0x0, 0x0, 0xc, 0x2}, @struct={0x7, 0x7, 0x0, 0x4, 0x0, 0x380, [{0xf, 0x1, 0x9}, {0x0, 0x3, 0x5}, {0x2, 0x0, 0x2}, {0x9, 0x3, 0x3}, {0x0, 0x0, 0x3a2}, {0xb, 0x3, 0x2}, {0xd, 0x4, 0x6}]}, @int={0x6, 0x0, 0x0, 0x1, 0x0, 0x66, 0x0, 0x28, 0x5}, @type_tag={0x8, 0x0, 0x0, 0x12, 0x2}]}, {0x0, [0x2e, 0x0, 0x0, 0x5f, 0x61, 0x2e, 0x5f, 0x51, 0x0]}}, &(0x7f0000000200)=""/38, 0x13b, 0x26, 0x1, 0x4, 0x0, @void, @value}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x7, &(0x7f0000001b40)=ANY=[@ANYBLOB="18470000065b833a3a299a502300000018120000bda2e6e43777061535ce82dcee91d37429363a446cd52c33dcb6c0783f9ca42f9ba147324d4a22ea469d2c72c87c4015182b62e1f205f10c02b9bfcbde0922875ecdd1e5161a475a169c334aabb9cdb9f98495f7cdc3b12962a3f7d04d48786d7d79572dffdb51a731bc9ef37170801c4991220eec0811f16cbf59c676d26a62953c5298ee4e69f16e010000000000000086c7b6fba5589d04dc6ab3c8fdf32a31e198e878db04348c9b61ba7c48953f9f261f5cd7a62969e85d5231ee0652f12f6cfe386fd86b2933642c7dfa8a5aa506c86f2906cd9424bc625ec21d97e75ff7d4eff6a0fc5278f67dd82c5ab9ed21c6ba44ef6de757455bff376adcbc05c2fa2d98a0ddef7315a2a60fd7", @ANYRESHEX=r5, @ANYBLOB="0000f14942000000000000b703000000000001850000000c000080b700000000"], &(0x7f00000000c0)='GPL\x00', 0x2, 0x1000, &(0x7f00000009c0)=""/4096, 0x41000, 0x8, '\x00', r7, 0x0, r8, 0x8, &(0x7f0000000640)={0x5, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f00000005c0)=[{0x4, 0x3, 0xf, 0xc}, {0x2, 0x2, 0x3, 0x3}, {0x5, 0x5, 0x8, 0x9}, {0x0, 0x4, 0x1, 0x4}, {0x4, 0x3, 0x6, 0x3}, {0x5, 0x5, 0xb, 0x3}, {0x3, 0x2, 0xa}], 0x10, 0x2856, @void, @value}, 0x94) r9 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801004800000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r9}, &(0x7f00000006c0), 0x0}, 0x20) sendmsg$inet(r6, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000640)}], 0x1}, 0x3) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={0x0, &(0x7f0000000300)=""/3, 0x46, 0x3, 0x1, 0x0, 0x0, @void, @value}, 0x28) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, &(0x7f0000000080)=0x4, 0x4) 2.83654718s ago: executing program 4 (id=1978): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, 0x1c) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$uac1(0x1, 0xae, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9c, 0x3, 0x1, 0x1, 0x0, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0x3}, [@feature_unit={0xf, 0x24, 0x6, 0x4, 0x5, 0x4, [0x1, 0x1, 0x4, 0x1], 0x4}, @processing_unit={0xa, 0x24, 0x7, 0x1, 0x0, 0x7, "51bc7e"}, @extension_unit={0x8, 0x24, 0x8, 0x6, 0xfc35, 0x8c, 'J'}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x82, 0x4, 0x38, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x240, 0xa, 0x3, 0x67, {0x7, 0x25, 0x1, 0x0, 0xd1, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x84, 0x3, 0xe, 0x3, "d63746d53a"}, @as_header={0x7, 0x24, 0x1, 0x1, 0x80, 0x1001}]}, {{0x9, 0x5, 0x82, 0x9, 0x468, 0xd, 0x9, 0x80, {0x7, 0x25, 0x1, 0x1, 0x3, 0x8}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x0, 0x7, 0x9, 0x4, 0xff, 0x7}, 0x28, &(0x7f0000000100)={0x5, 0xf, 0x28, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x8, 0x2, 0x1}, @ssp_cap={0x1c, 0x10, 0xa, 0x3, 0x4, 0x2, 0xf00, 0x470, [0xffdf8f, 0x101c0ff, 0xff00, 0xc00f]}]}, 0x6, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x42a}}, {0x2e, &(0x7f00000001c0)=@string={0x2e, 0x3, "03481a99fe16b812ab80a6dff3632baaec31227f8289b03ad360d94bc2cf5cc730f4eee0e93284161d7650a0"}}, {0xaf, &(0x7f0000000200)=@string={0xaf, 0x3, "a2bc965aaf0a987d96839e13ed9eea5da17246ee97ef6172b67ac9b9ba82a6ad22a24556370a7e8b206265cbb88a6df07da8f179462abae4e357b01ac622df5277401f111c92ca427de76b858b2414d339599cf924e408add712e80cb7e22263a7c75d03d9e0cecf3d34bd91948d7a8554485b54dd269d39a415abe9e85c10faa920e35afb6a3dee54cbf1bbdbf59d7babd94394754929db13373ed715d0fa7a1dedace504af93bfe2a40ae2d8"}}, {0x1a, &(0x7f00000002c0)=@string={0x1a, 0x3, "9b8509917861e572a1966a890ab9caa75f913185bf98ad73"}}, {0x9c, &(0x7f0000000300)=@string={0x9c, 0x3, "4a0b0ac661f604fb72c2bf0e153240b40de20dbd7c9ad1c44008225c23d0f9c91ef5c9f6915655ee748b27065e5d2e7df8f5b26f6b89dcde15acc9869543db1dd2ffe3aec6daea6b37429bcc5e5d17e3615559eeb485a8c699b98bb4ae97d21ea9f6ea5029e5691014730676c3d7eca00bb8810e93c47d7263a60e8155d37afa2bbcbec055aeba340e0993197ad48bcfcf28b4f280492e3a53a3"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x418}}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000480)={{0x1, 0x1, 0x18, r1, {0x35b, 0xd5d}}, './file0\x00'}) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000980)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r5 = getpgrp(0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000009c0)={0x200, 0x5, {0xffffffffffffffff}, {0x0}, 0x3, 0x4}) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0xd0060, &(0x7f0000000000)={[{@gid={'gid', 0x3d, r8}}]}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r10, 0x8b27, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) r11 = getpgid(0x0) r12 = getegid() statx(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0x800, 0x8, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000b40)=0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000b80)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xffffffffffffffff}}, './file0\x00'}) read$FUSE(0xffffffffffffffff, &(0x7f0000000bc0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(r2, &(0x7f0000002ec0)=[{{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000540)="ae2a71fa57a8f90e3d252324084d3dc4105bd5e87912a00a3997129c41d414949b384404", 0x24}, {&(0x7f0000000580)="d35df8", 0x3}, {&(0x7f00000005c0)="92fdad256fb8685aa99ecc3c1a608eb461794c31b6aeb7aad11fc1ef6404cea7f6de1195338f7afc23940ae6a1c5a5b1d0cc5cf8202820a3cd61578352f59dca551d1b2c7bef57056c97544640987e18d941bf50cb766cd9da1f3c71eebec946209e1c94fa986b4018da", 0x6a}, {&(0x7f0000000640)="47d9db137e049de85318705f4738ca92a7a60718bfe870416ea28970aba1f0ce6c2301551d27fd3b22beebe12aa603088097e0a082a300cda1b665c450c8ab2f011f66d8b704b78c9ae353452890c615087aea4bdbc71629b9ddb4879b8a677dda08fe365f0e69651b71040cc0af30917874ef922c0879f685c5d87e4532b253d10d0c645e386e313e2fe4e3508f5e0588cd7837719040747bd87a3492dee6953756913a8c77ca131c9d6d093c5eaee1254267", 0xb3}, {&(0x7f0000000700)="e8f45233c03b4980a761069a39300197db3c9321ac82e22cb759942e056ba9166703e68a17a7c8d41943610ad00a092afe3a396bf1d630d85c699cbc4f11a35fb41ac208c32ec894c898f51d27759e9712466904f51cf7f0", 0x58}, {&(0x7f0000000780)="dc1cb6305104809619f35acb7e7a665f05031ffc203ec93022273237445a7c821bbad373c61ee78b4ba354f13f1a0a7f446ecc418e5c82dc357b", 0x3a}], 0x6}}, {{&(0x7f0000000840)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000940)=[{&(0x7f00000008c0)="751aaaf0cb1c3926e2c2ee2ed1c3ad7e7911f8ead118f21d1fef66cafcb98e89a21651b7b6151f5cbc471d83b7f287e4bfa4aab33f68f18d322c7e2c5363af946c1441ad23041f6a57c5fccfe1dc8b", 0x4f}], 0x1, &(0x7f0000002c00)=[@rights={{0x34, 0x1, 0x1, [r0, r1, r3, r4, r0, r1, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r5, r6, r8}}}, @rights={{0x28, 0x1, 0x1, [r9, r0, r1, r1, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r11, 0x0, r12}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, r13}}}, @cred={{0x1c, 0x1, 0x2, {r14, r15, r16}}}], 0xe0, 0x200040a0}}, {{&(0x7f0000002d00)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000002d80)="429409aacedcdebdacff0e9499a73dc40427ed43bbbc8cc773cd51a1f4512d27d3aa23ac4be73d4d500ffccf8cbed30ae2b5b5eaf0c40d0ba7bace8290aa04fe1fff97c46f75277a22498134aa62789b9de748a551aaf4a5dded34", 0x5b}, {&(0x7f0000002e00)="e7e620ce4e113ec8afb3bf21c281f3fe0b0202cfa1fb7334d9afe5b22871727a8261d89408ae08b1e92a58dd1eec2b622002e13f6c56bd108182ef8455e245fc37a86c4aae300449", 0x48}], 0x2, 0x0, 0x0, 0x4004004}}], 0x3, 0x40000) 2.7629828s ago: executing program 3 (id=1979): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x4020000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x101800, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=@ipmr_getroute={0x1c, 0x1a, 0x10, 0x70bd2b, 0x25dfdbfb, {0x80, 0x20, 0x80, 0x5c, 0x0, 0x4, 0xfd, 0x2, 0x3700}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan0\x00'}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000002000000a003000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000003c0)="81b1281e2122d4200fb019fa80494bf89c1ac9e82a8a08d4281ccf728d6d96ffcc9e14594fbd8d8e1ffc0e60309b7fb6ac2743559393b7d7b01f0023ffcef19e4924862a6fd4d415951fe31f405a1bf8545d3c3cb84f06f42176baa755ffaae780390dabd737d726099cf5b804e1b38ee1036a6e1c90fbe9207423ce0a69b24efe892a0c50b85aea8a802d0a1421e23111880dc9403a5e81522980df107c88eff12a898439ce7722b02a87128efb3dda9edaa90872bd", &(0x7f00000003c0), 0x1800, r5}, 0x38) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000000010000fd0000000900000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000340)="8afab917c75105ff33f806a7b400b2a05eb1933adcd3eb180e4fe5a99d8d8e09b548f163ab6871bfdcb2627a3276c11370e3ed8bf5704ec6cf2e3be96334592fa7d4b03637ede379663ffeeef114f0846014bff24eb39c1db1a2ef183c6889c0377c3d71933f", 0xcff5, r5}, 0x38) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000640)={r5, &(0x7f0000000740)="27abdcb0f5d9bfd62b1f93f832eaceafe67b87d0c227ff178422fd9988e53c81496f2f8798cae6b8db2a671527e6e9e7700a1bd07f59f92eb429cf7dce606d00e142fef222c8c6f8c78128635971cd513a0635c90678d1ad53a0cf7f4e19a55a8238a081ee1caa7e054bebb97e43e91f84d7243666fc4cc6c7ad9a4929c1877a48deb70ec05379bb05c77c4ff0d79ca7c39abe5c80a5a85d7dad5236bb974ed99a262162e456b054c9921efc4aeb4c373504e2494a45bd638b82433768e8f070481c50c714f75f4f26e9d28bbc2c4292874f5793e9cc32fc2fb5bc0dc3901fb0273ab366f7a2bcdd8b24142a20355dac586f550d5af2305763e6d32bbd97dc1905a167811720f0", &(0x7f0000000540)=""/240}, 0x20) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000390000000c009900540000283f00000010005a800c0003800500060001000000"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x4000) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x24c8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='gpio_direction\x00', r9}, 0x18) stat(0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) 2.347660337s ago: executing program 5 (id=1980): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000300)) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x1c, r1, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x84) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x19, &(0x7f0000000140)=0x400030, 0x4) 2.308093083s ago: executing program 5 (id=1981): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="0100000004000000e27f000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r0, 0xffffffffffffffff}, &(0x7f0000000a00), &(0x7f0000000b00)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000feffff18110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000480)={0x20, 0x7, 0x5, "1e6d703e5e"}, 0x0, 0x0}) 2.267189234s ago: executing program 0 (id=1982): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) (async) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x148, &(0x7f0000000300)={0x0, 0x1, 0x3, 0x10}) mq_timedreceive(r2, &(0x7f0000000840)=""/44, 0x2c, 0x9, &(0x7f0000001980)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000670000000900020073797a3100000000080004400000000009000100938d7a3000000000080003400000000aa23b0b701100010000000000000000000000000a"], 0x64}}, 0x0) (async) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) 2.190450962s ago: executing program 0 (id=1983): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000001a000100000000000000000002000000ef0000000000000008000100e0000001080003", @ANYRES32], 0x34}}, 0x400c840) 2.189714673s ago: executing program 0 (id=1984): socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r2 = getpid() r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x13) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0x9, 0x0, 0x0, 0x0, 0x2) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x3a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0xffffffff, 0x308, 0xffffffff, 0xffffffff, 0x308, 0xffffffff, 0x3, 0x0, {[{{@ip={@multicast1, @local, 0x0, 0x0, 'veth1_to_batadv\x00', 'netdevsim0\x00'}, 0x0, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'vcan0\x00', {0x4386, 0x0, 0x6a, 0x0, 0x0, 0xfe5, 0x20}}}, @common=@addrtype={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'vcan0\x00'}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x400) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x80000000}) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x403, 0x0, 0x3, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8}]}, 0x44}}, 0x0) 1.743479075s ago: executing program 3 (id=1985): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x4000000}) userfaultfd(0x80001) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/4\x00') preadv(r4, &(0x7f0000000340)=[{&(0x7f00000008c0)=""/187, 0xbb}], 0x1, 0x0, 0x4) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x4000000}) close_range(r0, 0xffffffffffffffff, 0x0) 1.416690068s ago: executing program 1 (id=1986): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fcdbdf251200000008000300", @ANYRES32=r2, @ANYBLOB="040081000a000600080211000001000006001a01040000000600100063"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c0) 1.357786666s ago: executing program 3 (id=1987): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000007"], 0x50) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) sched_setscheduler(r2, 0x2, 0x0) r4 = creat(0x0, 0x0) r5 = fanotify_init(0xf00, 0x0) fanotify_mark(r5, 0x105, 0x40009975, r4, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {0x11, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4800) fcntl$setown(r0, 0x8, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000100)) r8 = syz_io_uring_setup(0x5169, &(0x7f0000000600)={0x0, 0x404000, 0x10100, 0x18000001, 0x0, 0x0, r4}, &(0x7f0000000000), &(0x7f0000000040)=0x0) syz_io_uring_setup(0x360b, &(0x7f0000001040), &(0x7f0000000340)=0x0, &(0x7f00000005c0)) syz_io_uring_submit(r10, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r8, 0xb15, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="540100001800010026bd7000000000001d0100001500030000000000000000008ca5be073cff296e020000001e01060000fdfe0c0071ec6d721744cd52f3070000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c035c8d586b2a88d81866930fca15c8a95d29e5b2ea0000080005"], 0x154}, 0x1, 0x0, 0x0, 0x20008080}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r11, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) 1.188229221s ago: executing program 0 (id=1988): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200000032ea7fac1300000000396ea440000001000000000000000000"], 0x50) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1a3089, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_ima(&(0x7f0000000480)='./file0\x00', &(0x7f0000000100), &(0x7f0000000380)=ANY=[@ANYBLOB="0302020100e79f00024a45"], 0xb, 0x1) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYRES64=r2], 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x80044) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x29}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x185) write$cgroup_int(r5, &(0x7f00000000c0)=0x1c3, 0x12) sendmsg$key(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x8000) socket$key(0xf, 0x3, 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="04000000000000000c002b80080001006b6cd97be69efeee5aa4cabf1633f2e90ceab4259c796bdaf2e46d1cecd1e123d37c0e93ead795544b2b107d7bcb4aca9f9719b94e85ff73bbe766b38bf6bade28cfdf4ad0ec9adab666051b157dd1a04ed81087928d793f61770ab13405cb1e02aa08d7a77a828c6c1fbaf475f51b04588d7aecb95e2c35a1d38443024c47d83659dce529fe", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x4004010) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, &(0x7f0000000180)) 1.068359418s ago: executing program 3 (id=1989): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f00000000c0)={&(0x7f0000000040)=""/79, 0x4f}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000008, 0x100010, r0, 0x71c15000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) r1 = inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x3) r2 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_elf32(r2, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0x5, 0x4, 0x7, 0x9, 0x2, 0x6, 0x1227, 0x12e, 0x38, 0x129, 0xeeff, 0x5, 0x20, 0x3, 0x200, 0x1, 0xfffd}, [{0x6, 0x0, 0x4, 0x3000, 0x4, 0x0, 0x10000, 0x9}, {0x3, 0x80000001, 0xc640, 0x3bf, 0x3, 0x619, 0xfffffffb}, {0x1, 0x9, 0x8, 0x7, 0x50, 0x7, 0xc, 0x35}], "6aa81d81d025848cc99cc8c36ff4adbd086ffd76887f0a397a3e1a2d514cc93b3a4231f8acabb3f88b3ce463bd66e218ac23403b5d81c7c8ba13942e664eec9d4a17a9838b7bd7b8ddd458b93d9d1dfec674e3f516d32fe8555371b3334b18e3740c15e15a3a1c837feca700a8c2e5b0ce27162c2e1a4e97816463c7b9a005e0f043ea4c7067362653c70d6c4cf299855a8ea590e671456dcd2b071acd3c63df142a33", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x83b) write(r2, &(0x7f0000000980)="3bf263b45b27385e15d84bffc3570b92d447337aa123079ee933a4f807e4", 0x1e) r3 = syz_open_dev$cec(&(0x7f00000009c0), 0x0, 0xa0641) ioctl$CEC_DQEVENT(r3, 0xc0506107, &(0x7f0000000a00)={0x0, 0x0, 0x0, @lost_msgs}) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)={0x1b, 0x0, 0x0, 0xd, 0x0, 0x1, 0x75, '\x00', 0x0, r0, 0x0, 0x2, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000d00)='/proc/tty/drivers\x00', 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000d40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e40)={0x18, 0x6, &(0x7f0000000b00)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x6e86}, [@call={0x85, 0x0, 0x0, 0x86}, @jmp={0x5, 0x0, 0x0, 0x8, 0x3, 0x30, 0x8}, @exit]}, &(0x7f0000000b40)='GPL\x00', 0x7, 0x63, &(0x7f0000000b80)=""/99, 0x41100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000c40)={0x1, 0x1, 0x2, 0xcf6b}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000d80)=[r3, 0x1, 0x1, 0xffffffffffffffff, r4, r5, r6], &(0x7f0000000dc0)=[{0x5, 0x4, 0x3, 0x7}, {0x3, 0x2, 0x8, 0x4}, {0x2, 0x3, 0x5, 0xb}, {0x0, 0x3, 0x7, 0x2}, {0x4, 0x4, 0x10, 0xa}], 0x10, 0x4, @void, @value}, 0x94) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000f00)) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000f40)) ioctl$HIDIOCGFIELDINFO(r5, 0xc038480a, &(0x7f0000000f80)={0x2, 0xffffffff, 0x80, 0x0, 0x1000000, 0x9, 0x0, 0x5e8, 0x9, 0x6, 0x2, 0xcc9, 0x400, 0x54}) r7 = socket$inet(0x2, 0x80806, 0x4) getdents64(r5, &(0x7f0000000fc0)=""/148, 0x94) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r8, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x2c, r9, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$caif_stream(0x25, 0x1, 0x0) r10 = fsopen(&(0x7f00000011c0)='ocfs2_dlmfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000001200)='\x00', &(0x7f0000001240)='GPL\x00', 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000012c0), r5) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r5, &(0x7f00000013c0)={&(0x7f0000001280), 0xc, &(0x7f0000001380)={&(0x7f0000001340)={0x28, r11, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x26}]}, 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 948.68261ms ago: executing program 3 (id=1990): socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r2 = getpid() r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x13) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0x9, 0x0, 0x0, 0x0, 0x2) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x3a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0xffffffff, 0x308, 0xffffffff, 0xffffffff, 0x308, 0xffffffff, 0x3, 0x0, {[{{@ip={@multicast1, @local, 0x0, 0x0, 'veth1_to_batadv\x00', 'netdevsim0\x00'}, 0x0, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'vcan0\x00', {0x4386, 0x0, 0x6a, 0x0, 0x0, 0xfe5, 0x20}}}, @common=@addrtype={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'vcan0\x00'}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x400) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000000)={0x7, 0x2, 0x80000000}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x403, 0x0, 0x3, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x44}}, 0x0) 0s ago: executing program 3 (id=1991): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2b, 0x80801, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x140, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xa8, 0xf0, 0x52020000, {0x0, 0x6802000000000000}}, @unspec=@CT0={0x48}}, {{@ipv6={@local, @private2, [], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x258, 0x4c, 0x232, 0x258, 0x0, 0x388, 0x2e8, 0x2e8, 0x388, 0x2e8, 0x3, 0x0, {[{{@ipv6={@mcast2, @mcast2, [], [], 'veth1_to_bond\x00', 'ip6gre0\x00', {}, {}, 0x6, 0x0, 0x3}, 0x0, 0x230, 0x258, 0x0, {}, [@common=@unspec=@cluster={{0x30}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@dev, [], @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@ipv4, [], @ipv4=@broadcast}, {@ipv4=@multicast2, [], @ipv4=@dev, [0xff], 0x0, 0x0, 0x0, 0x1}, {@ipv6=@loopback, [0x0, 0xffffff00], @ipv6=@private2}], 0x1}}]}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x32}}, @private1, [], [], 'team_slave_0\x00', 'xfrm0\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)={0x18, 0x2d, 0x9, 0x70bd26, 0x0, {0x4}, [@nested={0x4, 0x19}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) kernel console output (not intermixed with test programs): evice number 22 using dummy_hcd [ 305.102486][ T10] rc_core: IR keymap rc-hauppauge not found [ 305.108413][ T10] Registered IR keymap rc-empty [ 305.116508][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.142262][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.163481][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 305.178103][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input15 [ 305.228658][ T47] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.229108][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.272804][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.291255][ T47] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.373170][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.383798][ T5815] Bluetooth: hci5: command 0x1003 tx timeout [ 305.390186][ T55] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 305.403926][ T47] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 305.412507][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.418688][ T47] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 305.618245][ T47] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.628518][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.653697][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.656449][ T47] usb 5-1: config 0 descriptor?? [ 305.660962][ T30] audit: type=1400 audit(2000000081.466:82761): avc: denied { getopt } for pid=10816 comm="syz.0.1593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 305.802469][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 305.877027][T10822] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1593'. [ 306.329890][ T5847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.342388][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 306.358326][ T30] audit: type=1400 audit(2000000081.786:82762): avc: denied { mount } for pid=10816 comm="syz.0.1593" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 306.391800][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 306.415193][ T3075] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.442432][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 306.502290][ T10] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 306.567964][ T30] audit: type=1400 audit(2000000082.376:82763): avc: denied { unmount } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 306.594281][ T10] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 306.713950][ T47] plantronics 0003:047F:FFFF.0005: reserved main item tag 0xd [ 306.739488][ T47] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 306.787656][ T10] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 306.789765][ T47] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 306.851585][ T30] audit: type=1400 audit(2000000082.656:82764): avc: denied { bind } for pid=10829 comm="syz.0.1597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 306.874229][T10828] input: syz0 as /devices/virtual/input/input17 [ 306.891581][ T30] audit: type=1400 audit(2000000082.676:82765): avc: denied { listen } for pid=10829 comm="syz.0.1597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 306.915062][T10828] input: syz0 as /devices/virtual/input/input18 [ 306.919942][ T10] usb 4-1: USB disconnect, device number 22 [ 306.928407][ T30] audit: type=1400 audit(2000000082.686:82766): avc: denied { write } for pid=10829 comm="syz.0.1597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 307.138626][T10804] netlink: 'syz.4.1589': attribute type 5 has an invalid length. [ 307.251897][ T5959] usb 5-1: USB disconnect, device number 22 [ 307.482382][ T47] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 307.621160][ T3075] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.712236][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 307.720784][ T30] audit: type=1326 audit(2000000083.526:82767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10837 comm="syz.1.1599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47e98e969 code=0x7ffc0000 [ 307.727395][ T47] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 307.745455][ T30] audit: type=1326 audit(2000000083.526:82768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10837 comm="syz.1.1599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47e98e969 code=0x7ffc0000 [ 307.758195][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.789110][ T47] usb 1-1: Product: syz [ 307.793720][ T47] usb 1-1: Manufacturer: syz [ 307.798930][ T47] usb 1-1: SerialNumber: syz [ 307.808281][ T47] usb 1-1: config 0 descriptor?? [ 307.814827][ T30] audit: type=1326 audit(2000000083.556:82769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10837 comm="syz.1.1599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa47e98e969 code=0x7ffc0000 [ 307.842209][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 307.850721][ T47] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 307.856349][ T30] audit: type=1326 audit(2000000083.556:82770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10837 comm="syz.1.1599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47e98e969 code=0x7ffc0000 [ 307.866246][ T47] usb 1-1: setting power ON [ 307.882230][ C0] vkms_vblank_simulate: vblank timer overrun [ 307.898584][ T47] dvb-usb: bulk message failed: -22 (2/0) [ 307.917624][ T47] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 307.937744][ T47] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 307.948259][ T47] usb 1-1: media controller created [ 307.992678][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 308.047414][T10835] dvb-usb: bulk message failed: -22 (3/0) [ 308.053251][T10835] usb 1-1: gpio_write failed. [ 308.057968][T10835] dvb-usb: bulk message failed: -22 (77/0) [ 308.088312][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 308.093171][ T47] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 308.107344][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x16, changing to 0x6 [ 308.122057][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 308.159660][ T47] usb 1-1: selecting invalid altsetting 6 [ 308.180526][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 308.188844][ T47] usb 1-1: digital interface selection failed (-22) [ 308.264172][ T47] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 308.317204][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 308.325194][ T47] usb 1-1: setting power OFF [ 308.738611][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 308.755678][ T10] usb 4-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 308.757768][ T47] dvb-usb: bulk message failed: -22 (2/0) [ 308.771301][ T47] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 308.783187][ T47] (NULL device *): no alternate interface [ 308.785991][ T10] usb 4-1: New USB device strings: Mfr=80, Product=2, SerialNumber=3 [ 308.844641][T10851] sctp: [Deprecated]: syz.1.1603 (pid 10851) Use of struct sctp_assoc_value in delayed_ack socket option. [ 308.844641][T10851] Use struct sctp_sack_info instead [ 308.909492][ T10] usb 4-1: Product: syz [ 308.921507][ T10] usb 4-1: Manufacturer: syz [ 308.934595][ T10] usb 4-1: SerialNumber: syz [ 309.019844][ T10] usb 4-1: config 0 descriptor?? [ 309.027072][ T10] usb 4-1: can't set config #0, error -71 [ 309.041398][ T10] usb 4-1: USB disconnect, device number 23 [ 309.049800][ T55] Bluetooth: hci1: unexpected event for opcode 0x0c12 [ 309.325414][T10864] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1604'. [ 309.775757][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.811622][ T5861] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.993236][T10836] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.260633][ T47] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 310.524122][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.605571][ T47] usb 1-1: USB disconnect, device number 28 [ 310.790750][ T5861] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 310.816451][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.952277][ T5861] usb 5-1: Using ep0 maxpacket: 8 [ 311.215696][ T5861] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 311.232268][ T5861] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.240278][ T5861] usb 5-1: Product: syz [ 311.252755][ T5861] usb 5-1: Manufacturer: syz [ 311.261114][ T5861] usb 5-1: SerialNumber: syz [ 311.267914][ T5861] usb 5-1: config 0 descriptor?? [ 311.275285][ T5861] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 311.295519][ T5861] usb 5-1: setting power ON [ 311.304017][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 311.316931][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 311.316944][ T30] audit: type=1400 audit(2000000087.126:82787): avc: denied { append } for pid=10888 comm="syz.1.1613" name="nbd1" dev="devtmpfs" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 311.318659][T10889] /dev/nbd1: Can't open blockdev [ 311.354783][ T5861] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 311.364956][ T5861] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 311.375041][ T5861] usb 5-1: media controller created [ 311.406866][ T5861] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 311.505024][T10873] dvb-usb: bulk message failed: -22 (3/0) [ 311.510788][T10873] usb 5-1: gpio_write failed. [ 311.515546][T10873] dvb-usb: bulk message failed: -22 (77/0) [ 311.533436][ T5861] usb 5-1: selecting invalid altsetting 6 [ 311.541166][ T5815] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 311.552289][ T5815] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 311.561049][ T5815] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 311.571679][ T5861] usb 5-1: digital interface selection failed (-22) [ 311.580667][ T5815] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 311.587948][ T5861] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 311.598037][ T5815] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 311.875608][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 312.231007][ T30] audit: type=1400 audit(2000000087.576:82788): avc: denied { mounton } for pid=10890 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 312.547873][ T5861] usb 5-1: setting power OFF [ 312.554573][ T5861] dvb-usb: bulk message failed: -22 (2/0) [ 312.560540][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 312.570211][ T5861] (NULL device *): no alternate interface [ 312.589832][ T6240] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.786962][ T6240] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.812670][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 312.869419][ T6240] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.896779][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 312.908076][T10875] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 312.953325][ T5861] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 313.002567][ T24] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 313.015812][ T5861] usb 5-1: USB disconnect, device number 23 [ 313.151540][ T6240] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.187318][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 313.264117][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 313.546642][ T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x16, changing to 0x6 [ 313.546674][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 313.546695][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 313.546719][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 313.551390][ T24] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 313.551416][ T24] usb 2-1: New USB device strings: Mfr=80, Product=2, SerialNumber=3 [ 313.551436][ T24] usb 2-1: Product: syz [ 313.551450][ T24] usb 2-1: Manufacturer: syz [ 313.551464][ T24] usb 2-1: SerialNumber: syz [ 313.558274][ T24] usb 2-1: config 0 descriptor?? [ 313.561615][ T24] ati_remote 2-1:0.0: ati_remote_probe: Unexpected endpoint_in [ 313.782793][ T5815] Bluetooth: hci2: command tx timeout [ 314.299915][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 314.325767][ T9] usb 2-1: USB disconnect, device number 24 [ 314.613737][ T30] audit: type=1400 audit(2000000090.396:82789): avc: denied { create } for pid=10937 comm="syz.3.1621" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 314.613785][ T30] audit: type=1400 audit(2000000090.396:82790): avc: denied { mounton } for pid=10937 comm="syz.3.1621" path="/352/file0" dev="tmpfs" ino=1836 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 314.720955][T10919] tty tty28: ldisc open failed (-12), clearing slot 27 [ 315.584416][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.842190][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 315.898770][ T5815] Bluetooth: hci2: command tx timeout [ 315.910458][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.946354][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 316.555666][T10974] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 316.594920][ T6240] team0: Port device bond0 removed [ 316.603468][ T6240] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 316.612421][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 316.621785][ T10] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 316.656393][ T5959] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.688338][ T6240] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 316.699931][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.715387][ T10] usb 5-1: Product: syz [ 316.719568][ T10] usb 5-1: Manufacturer: syz [ 316.737029][ T6240] bond0 (unregistering): Released all slaves [ 316.743362][ T10] usb 5-1: SerialNumber: syz [ 316.766311][T10890] chnl_net:caif_netlink_parms(): no params data found [ 316.778058][ T10] usb 5-1: config 0 descriptor?? [ 316.793481][ T10] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 316.801509][ T10] usb 5-1: setting power ON [ 316.832151][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 316.878703][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 316.897316][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.904194][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.915320][ T10] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 316.939403][ T10] usb 5-1: media controller created [ 316.961965][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 316.984672][ T10] usb 5-1: selecting invalid altsetting 6 [ 316.990499][ T10] usb 5-1: digital interface selection failed (-22) [ 316.997588][T10955] dvb-usb: bulk message failed: -22 (3/0) [ 317.003377][T10955] usb 5-1: gpio_write failed. [ 317.008057][T10955] dvb-usb: bulk message failed: -22 (79/0) [ 317.014104][ T10] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 317.023726][ T10] usb 5-1: setting power OFF [ 317.028331][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 317.034355][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 317.044418][ T10] (NULL device *): no alternate interface [ 317.199716][T10890] bridge0: port 1(bridge_slave_0) entered blocking state [ 317.217660][T10890] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.225696][T10890] bridge_slave_0: entered allmulticast mode [ 317.236403][T10890] bridge_slave_0: entered promiscuous mode [ 317.249584][T10890] bridge0: port 2(bridge_slave_1) entered blocking state [ 317.262266][T10890] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.269541][T10890] bridge_slave_1: entered allmulticast mode [ 317.280704][T10890] bridge_slave_1: entered promiscuous mode [ 317.853908][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 317.888910][T10890] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 317.921302][T10890] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 317.932443][ T55] Bluetooth: hci2: command tx timeout [ 317.988561][ T6240] hsr_slave_0: left promiscuous mode [ 318.012298][ T55] Bluetooth: hci5: command 0x1003 tx timeout [ 318.045111][T10959] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.106055][ T5815] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 318.122926][ T6240] hsr_slave_1: left promiscuous mode [ 318.129722][ T6240] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 318.133704][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 318.151174][ T6240] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 318.194054][ T6240] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 318.201464][ T6240] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 318.216810][ T10] usb 5-1: USB disconnect, device number 24 [ 318.269611][T11015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1632'. [ 318.398256][ T6240] veth1_macvtap: left promiscuous mode [ 318.422371][ T6240] veth0_macvtap: left promiscuous mode [ 318.422824][T11021] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1635'. [ 318.438256][ T6240] veth1_vlan: left promiscuous mode [ 318.449312][ T6240] veth0_vlan: left promiscuous mode [ 318.522515][ T47] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 318.705651][ T47] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 318.773688][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 318.876034][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 318.902511][ T5861] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.911887][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 318.927136][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 318.936290][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 318.947985][ T30] audit: type=1400 audit(2000000094.756:82791): avc: denied { shutdown } for pid=11024 comm="syz.1.1636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 318.967929][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 318.972492][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.974691][ T30] audit: type=1400 audit(2000000094.756:82792): avc: denied { name_connect } for pid=11024 comm="syz.1.1636" dest=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 319.006125][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.024527][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.073276][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.080995][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.090502][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.102634][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.110238][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.121181][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.132831][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.140312][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.150900][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.192652][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.200476][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.210550][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.221815][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.230336][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 319.239651][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 319.251074][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 319.260731][ T47] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 319.298681][ T47] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 319.320394][ T47] usb 1-1: Product: syz [ 319.329672][ T47] usb 1-1: Manufacturer: syz [ 319.334995][ T47] usb 1-1: SerialNumber: syz [ 319.347476][ T47] usb 1-1: config 0 descriptor?? [ 319.362794][ T47] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 319.511097][ T6240] team0 (unregistering): Port device team_slave_1 removed [ 319.539965][ T6240] team0 (unregistering): Port device team_slave_0 removed [ 319.568063][ T47] usb 1-1: USB disconnect, device number 29 [ 319.580196][ T47] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 319.703189][ T10] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 319.825002][T10890] team0: Port device team_slave_0 added [ 319.864035][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 319.885216][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 319.903745][T10890] team0: Port device team_slave_1 added [ 319.932889][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 319.938317][ T10] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 319.960392][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.988581][ T10] usb 2-1: config 0 descriptor?? [ 319.997060][T10890] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 320.007266][T10890] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 320.013113][ T5815] Bluetooth: hci2: command tx timeout [ 320.042820][T10890] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 320.172532][ T5863] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.438727][T10890] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 320.472363][T10890] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 320.618960][T11047] netlink: 'syz.1.1637': attribute type 3 has an invalid length. [ 320.660912][ T10] pyra 0003:1E7D:2CF6.0006: unknown main item tag 0x0 [ 320.707337][ T10] pyra 0003:1E7D:2CF6.0006: unknown main item tag 0x0 [ 320.861013][ T10] pyra 0003:1E7D:2CF6.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.1-1/input0 [ 320.972760][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.435584][T10890] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 321.484908][ T5863] usb 2-1: USB disconnect, device number 25 [ 321.852338][ T10] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 322.012652][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.033201][ T5863] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.051304][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.073729][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.177203][T11068] input: syz1 as /devices/virtual/input/input19 [ 322.178931][T10890] hsr_slave_0: entered promiscuous mode [ 322.213591][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 322.224107][T10890] hsr_slave_1: entered promiscuous mode [ 322.231175][ T10] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 322.238481][T10890] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 322.262890][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.268942][T10890] Cannot create hsr debugfs directory [ 322.270879][ T10] usb 5-1: Product: syz [ 322.270896][ T10] usb 5-1: Manufacturer: syz [ 322.294055][ T10] usb 5-1: SerialNumber: syz [ 322.301673][ T10] usb 5-1: config 0 descriptor?? [ 322.323120][ T10] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 322.341286][ T10] usb 5-1: setting power ON [ 322.351358][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 322.386264][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 322.393691][ T30] audit: type=1400 audit(2000000098.176:82793): avc: denied { accept } for pid=11067 comm="syz.0.1644" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 322.412650][ T10] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 322.446102][T11081] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1644'. [ 322.473136][ T10] usb 5-1: media controller created [ 322.519515][T11056] dvb-usb: bulk message failed: -22 (3/0) [ 322.526069][T11056] usb 5-1: gpio_write failed. [ 322.530753][T11056] dvb-usb: bulk message failed: -22 (79/0) [ 322.547382][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.625425][ T10] usb 5-1: selecting invalid altsetting 6 [ 322.651510][ T10] usb 5-1: digital interface selection failed (-22) [ 322.680562][ T10] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 322.711267][ T10] usb 5-1: setting power OFF [ 322.721124][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 322.736723][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 322.769871][ T10] (NULL device *): no alternate interface [ 322.828593][ T30] audit: type=1400 audit(2000000098.636:82794): avc: denied { map } for pid=11088 comm="syz.3.1649" path="socket:[27195]" dev="sockfs" ino=27195 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 323.238929][ T5861] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 323.274788][ T30] audit: type=1400 audit(2000000099.086:82795): avc: denied { create } for pid=11097 comm="syz.3.1652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 323.281995][T10890] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 323.365340][T10890] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 323.397481][T11099] netlink: 'syz.3.1652': attribute type 12 has an invalid length. [ 323.423391][T10890] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 323.518429][T10890] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 324.122430][T11118] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1280 sclass=netlink_route_socket pid=11118 comm=syz.1.1654 [ 324.163133][T11059] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.177999][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 324.196466][ T10] usb 5-1: USB disconnect, device number 25 [ 324.269907][ T5861] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 324.300391][T11123] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1655'. [ 324.685879][ T30] audit: type=1400 audit(2000000100.496:82796): avc: denied { ioctl } for pid=11136 comm="syz.3.1656" path="socket:[27470]" dev="sockfs" ino=27470 ioctlcmd=0x89e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 325.215007][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.285688][T11123] team0 (unregistering): Port device team_slave_0 removed [ 325.308105][T11123] team0 (unregistering): Port device team_slave_1 removed [ 325.327201][ T5861] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.500617][T10890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 325.525699][T11149] FAULT_INJECTION: forcing a failure. [ 325.525699][T11149] name failslab, interval 1, probability 0, space 0, times 0 [ 325.538655][T11149] CPU: 1 UID: 0 PID: 11149 Comm: syz.4.1659 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 325.538678][T11149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 325.538688][T11149] Call Trace: [ 325.538693][T11149] [ 325.538700][T11149] dump_stack_lvl+0x16c/0x1f0 [ 325.538729][T11149] should_fail_ex+0x512/0x640 [ 325.538750][T11149] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 325.538779][T11149] should_failslab+0xc2/0x120 [ 325.538797][T11149] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 325.538822][T11149] ? __alloc_skb+0x2b2/0x380 [ 325.538850][T11149] __alloc_skb+0x2b2/0x380 [ 325.538874][T11149] ? __pfx___alloc_skb+0x10/0x10 [ 325.538899][T11149] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 325.538922][T11149] netlink_alloc_large_skb+0x69/0x130 [ 325.538940][T11149] netlink_sendmsg+0x6a1/0xdd0 [ 325.538960][T11149] ? __pfx_netlink_sendmsg+0x10/0x10 [ 325.538987][T11149] ____sys_sendmsg+0xa95/0xc70 [ 325.539006][T11149] ? copy_msghdr_from_user+0x10a/0x160 [ 325.539030][T11149] ? __pfx_____sys_sendmsg+0x10/0x10 [ 325.539061][T11149] ___sys_sendmsg+0x134/0x1d0 [ 325.539086][T11149] ? __pfx____sys_sendmsg+0x10/0x10 [ 325.539142][T11149] __sys_sendmsg+0x16d/0x220 [ 325.539167][T11149] ? __pfx___sys_sendmsg+0x10/0x10 [ 325.539199][T11149] ? rcu_is_watching+0x12/0xc0 [ 325.539226][T11149] do_syscall_64+0xcd/0x260 [ 325.539248][T11149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.539266][T11149] RIP: 0033:0x7f26f838e969 [ 325.539280][T11149] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 325.539296][T11149] RSP: 002b:00007f26f9132038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 325.539311][T11149] RAX: ffffffffffffffda RBX: 00007f26f85b5fa0 RCX: 00007f26f838e969 [ 325.539323][T11149] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000011 [ 325.539333][T11149] RBP: 00007f26f9132090 R08: 0000000000000000 R09: 0000000000000000 [ 325.539343][T11149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 325.539353][T11149] R13: 0000000000000000 R14: 00007f26f85b5fa0 R15: 00007ffd0ed4cf48 [ 325.539376][T11149] [ 325.769580][T10890] 8021q: adding VLAN 0 to HW filter on device team0 [ 325.780380][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.787492][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 325.808614][T11153] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1660'. [ 325.857678][T10890] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 325.868576][T10890] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 325.887759][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 325.894893][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 325.929015][T11153] vlan2: entered promiscuous mode [ 325.937498][T11153] team0: entered promiscuous mode [ 325.942940][T11153] team_slave_0: entered promiscuous mode [ 325.954955][T11153] team_slave_1: entered promiscuous mode [ 326.050077][T11159] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1662'. [ 326.066410][T11159] vlan0: entered promiscuous mode [ 326.106979][T11159] team0: entered promiscuous mode [ 326.112040][T11159] team_slave_0: entered promiscuous mode [ 326.118752][T11159] team_slave_1: entered promiscuous mode [ 326.129376][T11169] delete_channel: no stack [ 326.262256][ T5863] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 326.344129][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.378766][T10890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 326.422419][ T5863] usb 5-1: Using ep0 maxpacket: 32 [ 326.512340][ T5861] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 326.569638][ T5863] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 326.634993][T11184] FAULT_INJECTION: forcing a failure. [ 326.634993][T11184] name failslab, interval 1, probability 0, space 0, times 0 [ 326.647988][T11184] CPU: 0 UID: 0 PID: 11184 Comm: syz.0.1666 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 326.648011][T11184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 326.648021][T11184] Call Trace: [ 326.648027][T11184] [ 326.648033][T11184] dump_stack_lvl+0x16c/0x1f0 [ 326.648057][T11184] should_fail_ex+0x512/0x640 [ 326.648078][T11184] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 326.648104][T11184] should_failslab+0xc2/0x120 [ 326.648122][T11184] __kmalloc_cache_noprof+0x6a/0x3e0 [ 326.648145][T11184] ? alloc_pipe_info+0xc6/0x590 [ 326.648161][T11184] ? alloc_pipe_info+0x10e/0x590 [ 326.648180][T11184] alloc_pipe_info+0x10e/0x590 [ 326.648199][T11184] create_pipe_files+0x8c/0x930 [ 326.648219][T11184] do_pipe2+0xaf/0x1c0 [ 326.648234][T11184] ? __pfx_do_pipe2+0x10/0x10 [ 326.648260][T11184] __x64_sys_pipe+0x33/0x50 [ 326.648276][T11184] do_syscall_64+0xcd/0x260 [ 326.648298][T11184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.648315][T11184] RIP: 0033:0x7f9cce98e969 [ 326.648330][T11184] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 326.648345][T11184] RSP: 002b:00007f9ccf893038 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 326.648362][T11184] RAX: ffffffffffffffda RBX: 00007f9ccebb6160 RCX: 00007f9cce98e969 [ 326.648373][T11184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 326.648383][T11184] RBP: 00007f9ccf893090 R08: 0000000000000000 R09: 0000000000000000 [ 326.648393][T11184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 326.648402][T11184] R13: 0000000000000000 R14: 00007f9ccebb6160 R15: 00007fffee754ca8 [ 326.648426][T11184] [ 326.866477][ T5863] usb 5-1: config 0 has no interface number 0 [ 326.872668][ T5863] usb 5-1: config 0 interface 89 has no altsetting 0 [ 326.906473][ T5863] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 326.912381][ T47] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 326.916443][ T5863] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.926044][ T5861] usb 2-1: device descriptor read/64, error -71 [ 326.931130][ T5863] usb 5-1: Product: syz [ 326.941673][ T5863] usb 5-1: Manufacturer: syz [ 326.946600][ T5863] usb 5-1: SerialNumber: syz [ 326.953472][ T5863] usb 5-1: config 0 descriptor?? [ 327.081311][T10890] veth0_vlan: entered promiscuous mode [ 327.098598][T10890] veth1_vlan: entered promiscuous mode [ 327.109557][ T47] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.02 [ 327.119422][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.136633][ T5863] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 327.147156][ T3539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 327.165989][T11164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 327.170071][ T47] usb 4-1: Product: syz [ 327.178250][T11164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.190375][T11164] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1663'. [ 327.203109][ T47] usb 4-1: Manufacturer: syz [ 327.207721][ T47] usb 4-1: SerialNumber: syz [ 327.212477][ T5861] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 327.224387][T10890] veth0_macvtap: entered promiscuous mode [ 327.345564][ T47] usb 4-1: config 0 descriptor?? [ 327.354730][ T47] hso 4-1:0.0: Not our interface [ 327.361695][T10890] veth1_macvtap: entered promiscuous mode [ 327.383128][ T5861] usb 2-1: device descriptor read/64, error -71 [ 327.470625][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 327.497947][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 327.508923][ T5861] usb usb2-port1: attempt power cycle [ 328.092864][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.119251][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.136878][ T5863] usb 4-1: USB disconnect, device number 24 [ 328.162295][ T5861] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 328.174892][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.185815][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.197118][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.207782][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.221771][ T5861] usb 2-1: device descriptor read/8, error -71 [ 328.221826][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.253376][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 328.262929][T10890] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 328.345010][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.356692][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.368941][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.382735][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.395461][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.406188][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.503124][T10890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.504528][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 328.514638][T10890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 329.109073][T10890] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 329.142223][ T5861] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 329.147838][T10890] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.159033][T10890] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.202415][T10890] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.218544][T10890] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.354392][ T9] usb 5-1: USB disconnect, device number 26 [ 329.407567][T11209] IPv6: NLM_F_CREATE should be specified when creating new route [ 329.432406][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 329.501002][T11209] libceph: resolve '4' (ret=-3): failed [ 329.529653][T11209] netlink: 'syz.3.1669': attribute type 4 has an invalid length. [ 329.536356][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 329.547307][ T5815] Bluetooth: hci3: unexpected event for opcode 0x0c03 [ 329.570668][ T30] audit: type=1400 audit(2000000105.346:82797): avc: denied { read } for pid=11211 comm="syz.0.1670" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 329.631624][ T30] audit: type=1400 audit(2000000105.346:82798): avc: denied { open } for pid=11211 comm="syz.0.1670" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 329.656588][T11215] netlink: 'syz.3.1669': attribute type 4 has an invalid length. [ 329.765738][ T3539] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.795571][ T3539] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.491705][T11212] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 330.520614][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.554863][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.571168][ T5861] usb 2-1: device descriptor read/8, error -71 [ 330.602852][ T30] audit: type=1400 audit(2000000106.406:82799): avc: denied { mounton } for pid=10890 comm="syz-executor" path="/root/syzkaller.VjBC46/syz-tmp" dev="sda1" ino=1950 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 330.706581][ T5861] usb usb2-port1: unable to enumerate USB device [ 330.724124][ T30] audit: type=1400 audit(2000000106.406:82800): avc: denied { mount } for pid=10890 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 330.750356][ T30] audit: type=1400 audit(2000000106.416:82801): avc: denied { mounton } for pid=10890 comm="syz-executor" path="/root/syzkaller.VjBC46/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 330.800713][ T30] audit: type=1400 audit(2000000106.416:82802): avc: denied { mounton } for pid=10890 comm="syz-executor" path="/root/syzkaller.VjBC46/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=27968 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 330.840694][ T30] audit: type=1400 audit(2000000106.446:82803): avc: denied { mounton } for pid=10890 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2728 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 330.917326][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88807b3e9c00: rx timeout, send abort [ 330.927365][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff88807b3e9c00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 330.962291][ T30] audit: type=1800 audit(2000000106.686:82804): pid=11239 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1673" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 332.400359][T11249] netlink: 192 bytes leftover after parsing attributes in process `syz.5.1675'. [ 332.490926][T11249] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1675'. [ 332.888689][T11287] raw_sendmsg: syz.3.1679 forgot to set AF_INET. Fix it! [ 333.266275][T11288] FAULT_INJECTION: forcing a failure. [ 333.266275][T11288] name failslab, interval 1, probability 0, space 0, times 0 [ 333.285023][T11288] CPU: 0 UID: 0 PID: 11288 Comm: syz.4.1680 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 333.285048][T11288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 333.285055][T11288] Call Trace: [ 333.285060][T11288] [ 333.285065][T11288] dump_stack_lvl+0x16c/0x1f0 [ 333.285082][T11288] should_fail_ex+0x512/0x640 [ 333.285097][T11288] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 333.285116][T11288] should_failslab+0xc2/0x120 [ 333.285128][T11288] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 333.285148][T11288] ? sk_prot_alloc+0x60/0x2a0 [ 333.285169][T11288] sk_prot_alloc+0x60/0x2a0 [ 333.285188][T11288] sk_alloc+0x36/0xc20 [ 333.285211][T11288] inet6_create+0x381/0x1300 [ 333.285232][T11288] ? inet6_create+0x7f/0x1300 [ 333.285249][T11288] __sock_create+0x335/0x8d0 [ 333.285265][T11288] mptcp_subflow_create_socket+0xf5/0xed0 [ 333.285284][T11288] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 333.285302][T11288] ? irqentry_exit+0x3b/0x90 [ 333.285317][T11288] __mptcp_nmpc_sk+0x182/0x7d0 [ 333.285334][T11288] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 333.285351][T11288] ? mptcp_listen+0x11f/0x4a0 [ 333.285361][T11288] ? mptcp_listen+0x12d/0x4a0 [ 333.285374][T11288] mptcp_listen+0x135/0x4a0 [ 333.285385][T11288] ? __pfx_mptcp_listen+0x10/0x10 [ 333.285399][T11288] __sys_listen_socket+0x114/0x160 [ 333.285414][T11288] __sys_listen+0xa3/0x110 [ 333.285428][T11288] __x64_sys_listen+0x53/0x80 [ 333.285442][T11288] do_syscall_64+0xcd/0x260 [ 333.285456][T11288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.285467][T11288] RIP: 0033:0x7f26f838e969 [ 333.285476][T11288] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 333.285487][T11288] RSP: 002b:00007f26f9111038 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 [ 333.285498][T11288] RAX: ffffffffffffffda RBX: 00007f26f85b6080 RCX: 00007f26f838e969 [ 333.285505][T11288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 333.285511][T11288] RBP: 00007f26f9111090 R08: 0000000000000000 R09: 0000000000000000 [ 333.285518][T11288] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 333.285524][T11288] R13: 0000000000000000 R14: 00007f26f85b6080 R15: 00007ffd0ed4cf48 [ 333.285538][T11288] [ 334.812272][T11302] FAULT_INJECTION: forcing a failure. [ 334.812272][T11302] name failslab, interval 1, probability 0, space 0, times 0 [ 334.824982][T11302] CPU: 1 UID: 0 PID: 11302 Comm: syz.0.1683 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 334.825008][T11302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 334.825020][T11302] Call Trace: [ 334.825026][T11302] [ 334.825034][T11302] dump_stack_lvl+0x16c/0x1f0 [ 334.825059][T11302] should_fail_ex+0x512/0x640 [ 334.825081][T11302] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 334.825109][T11302] should_failslab+0xc2/0x120 [ 334.825129][T11302] __kmalloc_cache_noprof+0x6a/0x3e0 [ 334.825153][T11302] ? copy_mount_options+0x55/0x190 [ 334.825176][T11302] ? _copy_from_user+0x59/0xd0 [ 334.825202][T11302] copy_mount_options+0x55/0x190 [ 334.825225][T11302] __x64_sys_mount+0x1ac/0x310 [ 334.825246][T11302] ? __pfx___x64_sys_mount+0x10/0x10 [ 334.825273][T11302] do_syscall_64+0xcd/0x260 [ 334.825296][T11302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.825315][T11302] RIP: 0033:0x7f9cce98e969 [ 334.825330][T11302] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 334.825349][T11302] RSP: 002b:00007f9ccf893038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 334.825366][T11302] RAX: ffffffffffffffda RBX: 00007f9ccebb6160 RCX: 00007f9cce98e969 [ 334.825379][T11302] RDX: 0000200000000280 RSI: 0000200000000180 RDI: 0000000000000000 [ 334.825390][T11302] RBP: 00007f9ccf893090 R08: 00002000000006c0 R09: 0000000000000000 [ 334.825401][T11302] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 334.825411][T11302] R13: 0000000000000000 R14: 00007f9ccebb6160 R15: 00007fffee754ca8 [ 334.825435][T11302] [ 335.132193][ T24] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 335.336581][T11309] xt_CT: No such helper "snmp" [ 335.342230][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 335.392856][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 335.673254][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x16, changing to 0x6 [ 335.723856][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 335.737286][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 335.754015][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.792277][ T10] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 335.810918][ T24] usb 6-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 335.821909][ T24] usb 6-1: New USB device strings: Mfr=80, Product=2, SerialNumber=3 [ 335.839620][ T24] usb 6-1: Product: syz [ 335.844685][ T24] usb 6-1: Manufacturer: syz [ 335.849934][ T24] usb 6-1: SerialNumber: syz [ 335.870841][ T24] usb 6-1: config 0 descriptor?? [ 335.881710][ T24] ati_remote 6-1:0.0: ati_remote_probe: Unexpected endpoint_in [ 335.993743][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 336.035313][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 336.073955][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 336.198739][ T9] usb 6-1: USB disconnect, device number 2 [ 336.767008][ T10] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 336.812857][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.856166][ T10] usb 2-1: Product: syz [ 336.877434][ T10] usb 2-1: Manufacturer: syz [ 337.070539][ T10] usb 2-1: SerialNumber: syz [ 337.094180][ T10] usb 2-1: config 0 descriptor?? [ 337.107206][T11315] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 337.114615][T11315] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 337.174744][ T10] usb 2-1: ucan: probing device on interface #0 [ 337.271395][T11343] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1690'. [ 337.549365][ T47] hid-generic C990:2308:0000.0007: hidraw0: HID v0.00 Device [syz0] on syz1 [ 337.562292][ T10] usb 2-1: ucan: device reported invalid tx-fifo size [ 337.569110][ T10] usb 2-1: ucan: probe failed; try to update the device firmware [ 337.803883][ T47] usb 2-1: USB disconnect, device number 30 [ 338.451798][T11378] fuse: Unknown parameter '0x0000000000000006' [ 339.432385][ T972] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 339.654751][ T972] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 339.663835][ T972] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.699451][ T972] usb 2-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 339.787209][ T10] usb 4-1: new low-speed USB device number 25 using dummy_hcd [ 339.950203][ T972] usb 2-1: config 0 has no interface number 0 [ 339.992243][ T972] usb 2-1: config 0 has no interface number 1 [ 340.002735][ T972] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 340.012923][ T972] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.031840][ T972] usb 2-1: config 0 descriptor?? [ 340.380877][ T10] usb 4-1: Invalid ep0 maxpacket: 16 [ 340.394363][ T972] usb 2-1: unknown number of interfaces: 2 [ 340.466507][ T30] audit: type=1400 audit(2000000116.276:82805): avc: denied { read } for pid=11405 comm="syz.4.1706" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 340.522654][ T30] audit: type=1400 audit(2000000116.316:82806): avc: denied { sys_chroot } for pid=11408 comm="dhcpcd" capability=18 scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=capability permissive=1 [ 340.550387][ T30] audit: type=1400 audit(2000000116.316:82807): avc: denied { setgid } for pid=11408 comm="dhcpcd" capability=6 scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=capability permissive=1 [ 340.576039][ T10] usb 4-1: new low-speed USB device number 26 using dummy_hcd [ 340.584418][ T30] audit: type=1400 audit(2000000116.316:82808): avc: denied { setrlimit } for pid=11408 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=process permissive=1 [ 340.631095][ T972] usb 2-1: USB disconnect, device number 31 [ 340.742633][ T10] usb 4-1: Invalid ep0 maxpacket: 16 [ 340.748453][ T10] usb usb4-port1: attempt power cycle [ 341.602179][ T10] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 341.632720][ T10] usb 4-1: Invalid ep0 maxpacket: 16 [ 341.753700][T11437] tipc: Started in network mode [ 341.762480][ T10] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 341.771810][T11437] tipc: Node identity ac14140f, cluster identity 4711 [ 341.783051][T11436] 9pnet_fd: Insufficient options for proto=fd [ 341.793166][T11437] tipc: New replicast peer: 255.255.255.255 [ 341.793404][ T10] usb 4-1: Invalid ep0 maxpacket: 16 [ 341.801069][T11437] tipc: Enabled bearer , priority 10 [ 341.808803][ T10] usb usb4-port1: unable to enumerate USB device [ 342.052173][ T972] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 342.918446][ T5861] tipc: Node number set to 2886997007 [ 342.952194][ T47] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 343.033456][ T972] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 343.051156][ T972] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 343.062295][ T972] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 343.073305][ T972] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 343.087358][ T972] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 343.102436][ T972] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 343.112005][T11471] FAULT_INJECTION: forcing a failure. [ 343.112005][T11471] name failslab, interval 1, probability 0, space 0, times 0 [ 343.116477][ T47] usb 5-1: config 0 has no interfaces? [ 343.124690][ T972] usb 6-1: Manufacturer: syz [ 343.126469][ T972] usb 6-1: config 0 descriptor?? [ 343.134385][ T47] usb 5-1: New USB device found, idVendor=0499, idProduct=103e, bcdDevice=4e.18 [ 343.138001][T11471] CPU: 0 UID: 0 PID: 11471 Comm: syz.1.1720 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 343.138023][T11471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 343.138033][T11471] Call Trace: [ 343.138038][T11471] [ 343.138045][T11471] dump_stack_lvl+0x16c/0x1f0 [ 343.138067][T11471] should_fail_ex+0x512/0x640 [ 343.138087][T11471] ? fs_reclaim_acquire+0xae/0x150 [ 343.138113][T11471] ? tomoyo_encode2+0x100/0x3e0 [ 343.138133][T11471] should_failslab+0xc2/0x120 [ 343.138150][T11471] __kmalloc_noprof+0xd2/0x510 [ 343.138173][T11471] ? d_absolute_path+0x136/0x1a0 [ 343.138195][T11471] tomoyo_encode2+0x100/0x3e0 [ 343.138219][T11471] tomoyo_encode+0x29/0x50 [ 343.138238][T11471] tomoyo_realpath_from_path+0x18f/0x6e0 [ 343.138265][T11471] tomoyo_path_number_perm+0x245/0x580 [ 343.138283][T11471] ? tomoyo_path_number_perm+0x237/0x580 [ 343.138303][T11471] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 343.138323][T11471] ? find_held_lock+0x2b/0x80 [ 343.138362][T11471] ? find_held_lock+0x2b/0x80 [ 343.138383][T11471] ? hook_file_ioctl_common+0x145/0x410 [ 343.138412][T11471] ? __fget_files+0x20e/0x3c0 [ 343.138439][T11471] security_file_ioctl+0x9b/0x240 [ 343.138461][T11471] __x64_sys_ioctl+0xb7/0x200 [ 343.138483][T11471] do_syscall_64+0xcd/0x260 [ 343.138502][T11471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.138518][T11471] RIP: 0033:0x7fa47e98e969 [ 343.138532][T11471] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 343.138547][T11471] RSP: 002b:00007fa47f8bf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 343.138563][T11471] RAX: ffffffffffffffda RBX: 00007fa47ebb5fa0 RCX: 00007fa47e98e969 [ 343.138573][T11471] RDX: 0000200000000940 RSI: 00000000c040565f RDI: 0000000000000003 [ 343.138583][T11471] RBP: 00007fa47f8bf090 R08: 0000000000000000 R09: 0000000000000000 [ 343.138593][T11471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.138603][T11471] R13: 0000000000000000 R14: 00007fa47ebb5fa0 R15: 00007ffec645b148 [ 343.138625][T11471] [ 343.139049][T11471] ERROR: Out of memory at tomoyo_realpath_from_path. [ 343.268238][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.375281][ T47] usb 5-1: Product: syz [ 343.379462][ T47] usb 5-1: Manufacturer: syz [ 343.384350][ T47] usb 5-1: SerialNumber: syz [ 343.392912][ T47] usb 5-1: config 0 descriptor?? [ 343.432197][ T5861] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 343.453413][ T30] audit: type=1400 audit(2000000119.256:82809): avc: denied { write } for pid=11472 comm="syz.1.1721" name="usbmon6" dev="devtmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 343.483144][ T30] audit: type=1400 audit(2000000119.266:82810): avc: denied { ioctl } for pid=11472 comm="syz.1.1721" path="/dev/usbmon6" dev="devtmpfs" ino=734 ioctlcmd=0x9201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 343.582181][ T5861] usb 4-1: Using ep0 maxpacket: 8 [ 343.593680][ T5861] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 343.608758][ T9] usb 5-1: USB disconnect, device number 27 [ 343.612174][ T5861] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 343.686075][ T972] appleir 0003:05AC:8243.0008: unknown main item tag 0x0 [ 343.693736][ T972] appleir 0003:05AC:8243.0008: No inputs registered, leaving [ 343.710889][ T972] appleir 0003:05AC:8243.0008: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.5-1/input0 [ 343.744586][ T5861] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 343.780726][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.814637][ T5861] usb 4-1: Product: syz [ 343.818817][ T5861] usb 4-1: Manufacturer: syz [ 343.847413][ T5861] usb 4-1: SerialNumber: syz [ 343.918223][ T30] audit: type=1400 audit(2000000119.726:82811): avc: denied { listen } for pid=11486 comm="syz.4.1728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 344.001947][ T5847] usb 6-1: USB disconnect, device number 3 [ 344.172605][ T972] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 344.477794][ T972] usb 5-1: device descriptor read/64, error -71 [ 344.676855][ T30] audit: type=1400 audit(2000000120.486:82812): avc: denied { getopt } for pid=11506 comm="syz.0.1733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 344.749065][ T972] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 344.764845][T11508] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1733'. [ 344.862409][ T24] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 345.038276][ T972] usb 5-1: device descriptor read/64, error -71 [ 345.126012][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 345.142928][T11513] sctp: [Deprecated]: syz.5.1735 (pid 11513) Use of struct sctp_assoc_value in delayed_ack socket option. [ 345.142928][T11513] Use struct sctp_sack_info instead [ 345.165398][ T972] usb usb5-port1: attempt power cycle [ 345.177495][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.190769][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.200840][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 345.209949][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.222880][ T24] usb 2-1: config 0 descriptor?? [ 345.512204][ T47] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 345.512496][ T972] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 345.542912][ T972] usb 5-1: device descriptor read/8, error -71 [ 345.693354][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 345.706254][ T47] usb 1-1: New USB device found, idVendor=0572, idProduct=0320, bcdDevice= 1.85 [ 345.717526][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.717940][ T24] logitech 0003:046D:C20E.0009: rdesc size test failed for formula gp [ 345.734255][ T47] usb 1-1: Product: syz [ 345.738414][ T47] usb 1-1: Manufacturer: syz [ 345.743179][ T47] usb 1-1: SerialNumber: syz [ 345.748947][ T24] logitech 0003:046D:C20E.0009: unknown main item tag 0x0 [ 345.757018][ T47] usb 1-1: config 0 descriptor?? [ 345.764792][ T47] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 345.771683][ T24] logitech 0003:046D:C20E.0009: item fetching failed at offset 10/11 [ 345.780639][ T24] logitech 0003:046D:C20E.0009: parse failed [ 345.786725][ T24] logitech 0003:046D:C20E.0009: probe with driver logitech failed with error -22 [ 345.795881][ T47] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 345.802489][ T972] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 345.812267][ T47] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 345.833721][ T972] usb 5-1: device descriptor read/8, error -71 [ 345.922221][ T47] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 345.940708][ T47] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 345.953443][ T972] usb usb5-port1: unable to enumerate USB device [ 345.971490][ T30] audit: type=1400 audit(2000000121.776:82813): avc: denied { setopt } for pid=11517 comm="syz.0.1737" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 346.004870][ T47] usb 1-1: dvb_usb_v2: found a 'DVBSky T330' in warm state [ 346.033460][ T5861] usb 4-1: cannot find UAC_HEADER [ 346.068017][ T47] usb 1-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 346.253681][ T47] usb 1-1: USB disconnect, device number 30 [ 346.264816][ T5861] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 346.485220][ T5861] usb 4-1: USB disconnect, device number 29 [ 346.879966][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 346.926807][T11530] [U] .ú [ 347.099804][T11548] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1745'. [ 347.111294][T11549] FAULT_INJECTION: forcing a failure. [ 347.111294][T11549] name failslab, interval 1, probability 0, space 0, times 0 [ 347.127131][T11549] CPU: 0 UID: 0 PID: 11549 Comm: syz.4.1744 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 347.127155][T11549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 347.127165][T11549] Call Trace: [ 347.127172][T11549] [ 347.127178][T11549] dump_stack_lvl+0x16c/0x1f0 [ 347.127203][T11549] should_fail_ex+0x512/0x640 [ 347.127224][T11549] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 347.127254][T11549] should_failslab+0xc2/0x120 [ 347.127272][T11549] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 347.127309][T11549] ? __alloc_skb+0x2b2/0x380 [ 347.127337][T11549] __alloc_skb+0x2b2/0x380 [ 347.127359][T11549] ? __pfx___alloc_skb+0x10/0x10 [ 347.127381][T11549] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 347.127403][T11549] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 347.127432][T11549] netlink_alloc_large_skb+0x69/0x130 [ 347.127454][T11549] netlink_sendmsg+0x6a1/0xdd0 [ 347.127477][T11549] ? __pfx_netlink_sendmsg+0x10/0x10 [ 347.127504][T11549] ____sys_sendmsg+0xa95/0xc70 [ 347.127525][T11549] ? copy_msghdr_from_user+0x10a/0x160 [ 347.127548][T11549] ? __pfx_____sys_sendmsg+0x10/0x10 [ 347.127579][T11549] ___sys_sendmsg+0x134/0x1d0 [ 347.127605][T11549] ? __pfx____sys_sendmsg+0x10/0x10 [ 347.127659][T11549] __sys_sendmsg+0x16d/0x220 [ 347.127684][T11549] ? __pfx___sys_sendmsg+0x10/0x10 [ 347.127715][T11549] ? rcu_is_watching+0x12/0xc0 [ 347.127743][T11549] do_syscall_64+0xcd/0x260 [ 347.127766][T11549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.127783][T11549] RIP: 0033:0x7f26f838e969 [ 347.127798][T11549] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 347.127815][T11549] RSP: 002b:00007f26f9132038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 347.127833][T11549] RAX: ffffffffffffffda RBX: 00007f26f85b5fa0 RCX: 00007f26f838e969 [ 347.127844][T11549] RDX: 0000000000000000 RSI: 0000200000006040 RDI: 0000000000000004 [ 347.127855][T11549] RBP: 00007f26f9132090 R08: 0000000000000000 R09: 0000000000000000 [ 347.127866][T11549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.127876][T11549] R13: 0000000000000000 R14: 00007f26f85b5fa0 R15: 00007ffd0ed4cf48 [ 347.127900][T11549] [ 347.482228][ T5861] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 347.632220][ T3075] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 347.639839][ T5861] usb 4-1: device descriptor read/64, error -71 [ 347.741667][ T972] usb 2-1: USB disconnect, device number 32 [ 347.908401][ T30] audit: type=1400 audit(2000000123.666:82814): avc: denied { ioctl } for pid=11556 comm="syz.4.1748" path="socket:[28612]" dev="sockfs" ino=28612 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 347.977039][ T3075] usb 6-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice=26.ea [ 348.373918][ T3075] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.393188][ T3075] usb 6-1: config 0 descriptor?? [ 348.407372][ T3075] usb 6-1: Invalid firmware size=18. [ 348.872595][ T5861] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 348.992775][ T972] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 349.152192][ T972] usb 2-1: Using ep0 maxpacket: 8 [ 349.380660][T11571] CUSE: unknown device info "ÿ" [ 349.385837][T11571] CUSE: zero length info key specified [ 349.432988][ T30] audit: type=1400 audit(2000000125.236:82815): avc: denied { connect } for pid=11566 comm="syz.4.1751" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 349.622249][ T5861] usb 4-1: device descriptor read/64, error -71 [ 349.902619][ T5861] usb usb4-port1: attempt power cycle [ 350.290909][ T972] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 350.355825][ T972] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 350.369527][ T972] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 350.378808][ T972] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.386853][ T972] usb 2-1: Product: syz [ 350.391086][ T972] usb 2-1: Manufacturer: syz [ 350.405804][ T972] usb 2-1: SerialNumber: syz [ 352.083413][ T24] usb 6-1: USB disconnect, device number 4 [ 353.238673][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 353.309134][ T972] usb 2-1: cannot find UAC_HEADER [ 353.354508][ T972] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 353.371424][ T972] usb 2-1: USB disconnect, device number 33 [ 353.395587][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 353.497679][ T24] usb 6-1: config 0 has no interfaces? [ 353.547703][ T24] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 353.842465][ T972] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 353.932806][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.208026][ T24] usb 6-1: Product: syz [ 354.212288][ T24] usb 6-1: Manufacturer: syz [ 354.216889][ T24] usb 6-1: SerialNumber: syz [ 354.232662][ T24] usb 6-1: config 0 descriptor?? [ 354.504960][ T972] usb 2-1: Using ep0 maxpacket: 32 [ 354.819287][ T972] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 354.861478][T11650] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1767'. [ 354.876785][ T972] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 354.889550][ T972] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 354.901565][T11650] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1767'. [ 354.937328][ T972] usb 2-1: Product: syz [ 354.951716][ T972] usb 2-1: Manufacturer: syz [ 354.960237][ T972] usb 2-1: SerialNumber: syz [ 355.018775][T11653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.028393][T11653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.253606][ T972] usb 2-1: config 0 descriptor?? [ 355.291323][T11625] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 355.301990][ T972] hub 2-1:0.0: bad descriptor, ignoring hub [ 355.419791][ T972] hub 2-1:0.0: probe with driver hub failed with error -5 [ 355.657695][ T5861] usb 2-1: USB disconnect, device number 34 [ 355.692361][ T5847] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 355.842342][ T5847] usb 4-1: Using ep0 maxpacket: 32 [ 356.422188][ T5847] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 356.433952][ T5847] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 356.445917][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 356.458875][ T5847] usb 4-1: Product: syz [ 356.463631][ T5847] usb 4-1: Manufacturer: syz [ 356.487569][ T5847] usb 4-1: SerialNumber: syz [ 356.506423][ T5847] usb 4-1: config 0 descriptor?? [ 356.514903][T11662] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 356.554581][ T5847] hub 4-1:0.0: bad descriptor, ignoring hub [ 356.588533][ T5847] hub 4-1:0.0: probe with driver hub failed with error -5 [ 356.873423][ T5847] usb 4-1: USB disconnect, device number 33 [ 356.887993][ T30] audit: type=1400 audit(2000000132.696:82816): avc: denied { read } for pid=11672 comm="syz.0.1770" path="socket:[29827]" dev="sockfs" ino=29827 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 357.638004][ T10] usb 6-1: USB disconnect, device number 5 [ 358.090332][T11698] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(13) [ 358.096975][T11698] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 358.107974][T11698] vhci_hcd vhci_hcd.0: Device attached [ 358.178221][T11693] netlink: 'syz.1.1773': attribute type 23 has an invalid length. [ 358.372933][ T10] usb 36-1: SetAddress Request (2) to port 0 [ 358.382703][ T47] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 358.389338][ T10] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 358.419864][ T30] audit: type=1400 audit(2000000134.216:82817): avc: denied { write } for pid=11711 comm="syz.3.1776" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 358.454260][T11712] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 358.476886][T11712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1776'. [ 358.488966][T11713] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1776'. [ 358.507121][T11712] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1776'. [ 358.517241][T11713] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1776'. [ 358.552321][ T47] usb 6-1: Using ep0 maxpacket: 8 [ 358.615160][T11699] vhci_hcd: connection reset by peer [ 358.635032][ T47] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 358.650491][ T3539] vhci_hcd: stop threads [ 358.689076][ T47] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 358.711237][ T3539] vhci_hcd: release socket [ 358.774518][ T3539] vhci_hcd: disconnect device [ 358.809843][ T47] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 358.873296][ T47] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.879585][ T30] audit: type=1400 audit(2000000134.636:82818): avc: denied { mount } for pid=11714 comm="syz.4.1777" name="/" dev="rpc_pipefs" ino=29862 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 358.889625][ T47] usb 6-1: Product: syz [ 358.944258][ T47] usb 6-1: Manufacturer: syz [ 358.948961][ T47] usb 6-1: SerialNumber: syz [ 359.153427][T11715] netlink: 'syz.4.1777': attribute type 1 has an invalid length. [ 359.164375][T11715] netlink: 'syz.4.1777': attribute type 2 has an invalid length. [ 359.726024][T11715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1777'. [ 360.853836][ T5861] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 361.044335][ T5861] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 361.102321][ T5861] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 361.114609][ T5861] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 361.136227][ T5861] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 361.169425][ T5861] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.200434][ T5861] usb 1-1: Product: syz [ 361.210522][ T5861] usb 1-1: Manufacturer: syz [ 361.216825][ T30] audit: type=1400 audit(2000000137.016:82819): avc: denied { name_bind } for pid=11756 comm="syz.4.1783" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 361.218744][ T5861] usb 1-1: SerialNumber: syz [ 361.244711][ T47] usb 6-1: cannot find UAC_HEADER [ 361.288314][ T5861] usb 1-1: config 0 descriptor?? [ 361.317477][T11748] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 361.318029][ T47] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 361.344711][T11748] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 361.349787][ T47] usb 6-1: USB disconnect, device number 6 [ 361.383146][ T5861] usb 1-1: ucan: probing device on interface #0 [ 361.402243][T11763] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1785'. [ 361.467952][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 361.763890][ T5815] Bluetooth: hci0: unexpected event for opcode 0x0c12 [ 362.245806][ T30] audit: type=1400 audit(2000000138.056:82820): avc: denied { listen } for pid=11778 comm="syz.3.1788" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 362.277312][ T5861] usb 1-1: ucan: device reported invalid device info [ 362.284086][ T5861] usb 1-1: ucan: probe failed; try to update the device firmware [ 362.317354][ T5861] usb 1-1: USB disconnect, device number 31 [ 362.341896][ T30] audit: type=1400 audit(2000000138.106:82821): avc: denied { accept } for pid=11778 comm="syz.3.1788" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 362.654036][T11799] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 362.745278][T11802] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 362.751799][T11802] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 362.855577][T11803] netlink: 'syz.4.1793': attribute type 39 has an invalid length. [ 362.872281][T11802] vhci_hcd vhci_hcd.0: Device attached [ 362.880213][T11808] vhci_hcd: connection closed [ 362.881435][ T12] vhci_hcd: stop threads [ 362.901002][ T12] vhci_hcd: release socket [ 362.927366][ T12] vhci_hcd: disconnect device [ 363.038646][ T30] audit: type=1400 audit(2000000138.806:82822): avc: denied { write } for pid=11796 comm="syz.1.1791" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 363.227299][ T5847] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 363.403652][ T5847] usb 1-1: config 1 interface 0 has no altsetting 0 [ 363.415574][ T5847] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 363.431441][ T5847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.529153][ T5847] usb 1-1: Product: syz [ 363.536526][ T10] usb 36-1: device descriptor read/8, error -110 [ 363.544877][ T5847] usb 1-1: Manufacturer: syz [ 363.563557][ T5847] usb 1-1: SerialNumber: syz [ 363.942578][ T47] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 363.995484][ T10] usb usb36-port1: attempt power cycle [ 364.114344][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 364.126847][ T47] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 364.163182][ T47] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 364.188527][ T47] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 364.198351][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.218214][ T47] usb 5-1: Product: syz [ 364.227975][ T47] usb 5-1: Manufacturer: syz [ 364.232701][ T47] usb 5-1: SerialNumber: syz [ 364.392376][ T5861] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 364.545880][ T5815] Bluetooth: hci4: unexpected event for opcode 0x0c12 [ 364.572504][ T5861] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 364.593402][ T10] usb usb36-port1: unable to enumerate USB device [ 364.616574][ T5861] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 384, setting to 64 [ 364.650129][ T5861] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 364.668987][ T5861] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.687529][ T5861] usb 2-1: Product: syz [ 364.697039][ T5861] usb 2-1: Manufacturer: syz [ 364.701977][ T5861] usb 2-1: SerialNumber: syz [ 364.709780][ T5861] usb 2-1: config 0 descriptor?? [ 364.716481][T11848] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 364.842303][ T5861] rc_core: IR keymap rc-streamzap not found [ 364.848241][ T5861] Registered IR keymap rc-empty [ 364.863025][ T5861] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 364.887807][ T5861] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input21 [ 365.080095][T11886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1799'. [ 365.101325][ T5861] usb 2-1: USB disconnect, device number 35 [ 365.672164][ T972] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 365.757484][T11901] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1806'. [ 365.769203][ T30] audit: type=1400 audit(2000000141.586:82823): avc: denied { watch } for pid=11900 comm="syz.1.1806" path="/334" dev="tmpfs" ino=1772 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 365.802244][ T5861] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 365.822201][ T972] usb 4-1: Using ep0 maxpacket: 32 [ 365.829997][ T972] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 365.846293][ T972] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 365.860098][ T972] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 365.870634][ T972] usb 4-1: Product: syz [ 365.875509][ T972] usb 4-1: Manufacturer: syz [ 365.880196][ T972] usb 4-1: SerialNumber: syz [ 365.888242][ T972] usb 4-1: config 0 descriptor?? [ 365.902771][T11897] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 365.913708][ T972] hub 4-1:0.0: bad descriptor, ignoring hub [ 365.919982][ T972] hub 4-1:0.0: probe with driver hub failed with error -5 [ 365.970050][ T5847] usb 1-1: USB disconnect, device number 32 [ 365.972218][ T5861] usb 6-1: Using ep0 maxpacket: 8 [ 366.021220][ T5861] usb 6-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=18.37 [ 366.050937][ T5861] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.074719][ T5861] usb 6-1: Product: syz [ 366.078930][ T5861] usb 6-1: Manufacturer: syz [ 366.084225][ T5861] usb 6-1: SerialNumber: syz [ 366.091398][ T5861] usb 6-1: config 0 descriptor?? [ 366.101776][ T5861] radio-si470x 6-1:0.0: could not find interrupt in endpoint [ 366.126119][ T5861] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 366.266265][ T5847] usb 4-1: USB disconnect, device number 34 [ 366.313816][ T5861] radio-raremono 6-1:0.0: this is not Thanko's Raremono. [ 366.324135][ T5861] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 366.344198][ T5861] usb 6-1: USB disconnect, device number 7 [ 366.663922][ T47] usb 5-1: cannot find UAC_HEADER [ 366.705217][ T5815] Bluetooth: hci1: unexpected event for opcode 0x0c12 [ 366.772482][T11940] netlink: 'syz.4.1816': attribute type 1 has an invalid length. [ 366.780881][T11940] netlink: 15 bytes leftover after parsing attributes in process `syz.4.1816'. [ 366.789859][ T47] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 366.792255][ T47] usb 5-1: USB disconnect, device number 32 [ 366.839252][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 366.968823][T11944] netlink: 'syz.3.1818': attribute type 1 has an invalid length. [ 366.985555][T11944] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1818'. [ 367.597255][ T47] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 367.998100][ T47] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 368.040041][ T47] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 368.071924][ T47] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 368.086131][ T47] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 368.100769][ T47] usb 6-1: Manufacturer: syz [ 368.117417][ T47] usb 6-1: config 0 descriptor?? [ 368.663485][ T47] rc_core: IR keymap rc-hauppauge not found [ 368.671462][ T47] Registered IR keymap rc-empty [ 368.678410][ T47] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 368.693154][ T47] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input23 [ 368.729171][ T47] usb 6-1: USB disconnect, device number 8 [ 368.794950][ T30] audit: type=1400 audit(2000000144.606:82824): avc: denied { mounton } for pid=11977 comm="syz.1.1830" path="/341/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 368.823677][ T5847] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 369.023276][ T5847] usb 5-1: Using ep0 maxpacket: 8 [ 369.030091][ T5847] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 369.034453][T11989] overlayfs: failed to get inode (-116) [ 369.040347][ T5847] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x16, changing to 0x6 [ 369.049899][T11989] overlayfs: failed to get inode (-116) [ 369.058933][ T5847] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 369.120789][T11990] FAULT_INJECTION: forcing a failure. [ 369.120789][T11990] name failslab, interval 1, probability 0, space 0, times 0 [ 369.133635][T11990] CPU: 1 UID: 0 PID: 11990 Comm: syz.3.1832 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 369.133659][T11990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 369.133670][T11990] Call Trace: [ 369.133676][T11990] [ 369.133683][T11990] dump_stack_lvl+0x16c/0x1f0 [ 369.133708][T11990] should_fail_ex+0x512/0x640 [ 369.133730][T11990] ? fs_reclaim_acquire+0xae/0x150 [ 369.133754][T11990] should_failslab+0xc2/0x120 [ 369.133772][T11990] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 369.133800][T11990] ? security_inode_alloc+0x3b/0x2b0 [ 369.133824][T11990] security_inode_alloc+0x3b/0x2b0 [ 369.133846][T11990] inode_init_always_gfp+0xce4/0x1030 [ 369.133876][T11990] alloc_inode+0x86/0x240 [ 369.133896][T11990] sock_alloc+0x40/0x280 [ 369.133915][T11990] do_accept+0xf7/0x530 [ 369.133937][T11990] ? do_raw_spin_lock+0x12c/0x2b0 [ 369.133957][T11990] ? __pfx_do_accept+0x10/0x10 [ 369.133996][T11990] io_accept+0x259/0x950 [ 369.134022][T11990] ? __pfx_io_accept+0x10/0x10 [ 369.134045][T11990] ? rcu_is_watching+0x12/0xc0 [ 369.134068][T11990] io_issue_sqe+0x4f2/0x1350 [ 369.134091][T11990] io_submit_sqes+0x921/0x25d0 [ 369.134131][T11990] __do_sys_io_uring_enter+0xd6a/0x1630 [ 369.134153][T11990] ? __pfx___schedule+0x10/0x10 [ 369.134169][T11990] ? fdget_pos+0x2a2/0x370 [ 369.134187][T11990] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 369.134209][T11990] ? fput+0x70/0xf0 [ 369.134228][T11990] ? ksys_write+0x1b9/0x240 [ 369.134262][T11990] do_syscall_64+0xcd/0x260 [ 369.134284][T11990] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.134302][T11990] RIP: 0033:0x7f19a2f8e969 [ 369.134317][T11990] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 369.134335][T11990] RSP: 002b:00007f19a3e58038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 369.134352][T11990] RAX: ffffffffffffffda RBX: 00007f19a31b6160 RCX: 00007f19a2f8e969 [ 369.134364][T11990] RDX: 0000000000003e44 RSI: 0000000000003516 RDI: 0000000000000006 [ 369.134375][T11990] RBP: 00007f19a3e58090 R08: 0000000000000000 R09: 0000000000000000 [ 369.134385][T11990] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 369.134395][T11990] R13: 0000000000000000 R14: 00007f19a31b6160 R15: 00007ffef8a7fc58 [ 369.134419][T11990] [ 369.402374][T11989] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1833'. [ 369.418623][ T5847] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 369.430753][T11989] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1833'. [ 369.454959][ T5847] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 369.480100][ T5847] usb 5-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 369.509154][ T5847] usb 5-1: New USB device strings: Mfr=80, Product=2, SerialNumber=3 [ 369.519873][ T5847] usb 5-1: Product: syz [ 369.525213][ T5847] usb 5-1: Manufacturer: syz [ 369.529815][ T5847] usb 5-1: SerialNumber: syz [ 369.552921][ T5847] usb 5-1: config 0 descriptor?? [ 369.576064][ T5847] ati_remote 5-1:0.0: ati_remote_probe: Unexpected endpoint_in [ 371.583027][T12015] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1841'. [ 371.719234][ T5861] usb 5-1: USB disconnect, device number 33 [ 372.092526][ T47] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 372.284001][ T47] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 372.747644][ T30] audit: type=1400 audit(2000000148.016:82825): avc: denied { create } for pid=12020 comm="syz.5.1844" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 372.749869][T12021] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 372.768517][ C1] vkms_vblank_simulate: vblank timer overrun [ 372.805601][ T30] audit: type=1400 audit(2000000148.556:82826): avc: denied { mounton } for pid=12020 comm="syz.5.1844" path="/23/file0" dev="tmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 372.832883][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 372.844746][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 372.855892][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 372.864047][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 372.873204][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 372.920960][T12030] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1846'. [ 372.940376][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 372.950566][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 372.964885][T12029] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 372.991642][T12029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1846'. [ 373.007490][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.018952][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.029827][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 373.039324][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.052644][T12029] kvm: pic: level sensitive irq not supported [ 373.052941][T12029] kvm: pic: non byte read [ 373.053108][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.074591][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 373.084787][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.097119][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.107347][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 373.124120][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.251698][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 373.496022][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.545230][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 373.585270][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.596610][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.603792][ T9] usb 2-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=7a.ac [ 373.606725][ T47] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 373.646643][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 373.663657][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 373.663966][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.716395][ T47] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 373.723985][ T9] usb 2-1: Product: syz [ 373.776156][ T9] usb 2-1: Manufacturer: syz [ 373.791026][ T9] usb 2-1: SerialNumber: syz [ 373.814870][ T9] usb 2-1: config 0 descriptor?? [ 373.825070][ T47] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 373.838743][ T9] usb 2-1: interface 1 not found [ 373.849070][ T47] usb 1-1: Product: syz [ 373.857969][ T47] usb 1-1: Manufacturer: syz [ 373.862904][ T47] usb 1-1: SerialNumber: syz [ 373.909273][ T47] usb 1-1: config 0 descriptor?? [ 373.930238][ T47] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 374.082647][ T30] audit: type=1400 audit(2000000149.886:82827): avc: denied { ioctl } for pid=12045 comm="syz.4.1850" path="socket:[31904]" dev="sockfs" ino=31904 ioctlcmd=0x8937 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 374.181007][T12027] netlink: 'syz.1.1845': attribute type 12 has an invalid length. [ 374.311468][ T47] usb 1-1: USB disconnect, device number 33 [ 374.339970][ T30] audit: type=1400 audit(2000000150.146:82828): avc: denied { read } for pid=12016 comm="syz.0.1842" name="btrfs-control" dev="devtmpfs" ino=1311 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 374.383033][ T47] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 374.452428][ T30] audit: type=1400 audit(2000000150.146:82829): avc: denied { open } for pid=12016 comm="syz.0.1842" path="/dev/btrfs-control" dev="devtmpfs" ino=1311 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 374.467072][ T24] usb 2-1: USB disconnect, device number 36 [ 374.511964][T12050] 9pnet_fd: Insufficient options for proto=fd [ 374.522211][ T30] audit: type=1400 audit(2000000150.146:82830): avc: denied { ioctl } for pid=12016 comm="syz.0.1842" path="/dev/btrfs-control" dev="devtmpfs" ino=1311 ioctlcmd=0x1260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 374.548544][ T30] audit: type=1400 audit(2000000150.226:82831): avc: denied { name_connect } for pid=12026 comm="syz.1.1845" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 374.569060][ T30] audit: type=1400 audit(2000000150.246:82832): avc: denied { getopt } for pid=12026 comm="syz.1.1845" lport=36250 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 374.593605][ T30] audit: type=1400 audit(2000000150.256:82833): avc: denied { append } for pid=12026 comm="syz.1.1845" name="sg0" dev="devtmpfs" ino=750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 374.664213][ T30] audit: type=1400 audit(2000000150.476:82834): avc: denied { unlink } for pid=10890 comm="syz-executor" name="file0" dev="tmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 374.768380][T12055] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1853'. [ 374.808511][ T30] audit: type=1400 audit(2000000150.616:82835): avc: denied { unmount } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 376.003300][ T972] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 376.211035][T12069] vlan2: entered promiscuous mode [ 376.216188][T12069] veth0_virt_wifi: entered promiscuous mode [ 376.223328][T12069] vlan2: entered allmulticast mode [ 376.228481][T12069] veth0_virt_wifi: entered allmulticast mode [ 376.830782][ T972] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 376.892239][ T972] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 384, setting to 64 [ 376.903960][T12064] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1854'. [ 376.918734][T12076] lo speed is unknown, defaulting to 1000 [ 376.925337][T12076] lo speed is unknown, defaulting to 1000 [ 376.991424][ T972] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 377.143067][ T30] audit: type=1400 audit(2000000152.816:82836): avc: denied { connect } for pid=12078 comm="syz.0.1859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 377.191696][T12076] lo speed is unknown, defaulting to 1000 [ 377.332402][ T972] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.342687][T12076] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 377.356970][ T972] usb 6-1: Product: syz [ 377.362579][ T972] usb 6-1: Manufacturer: syz [ 377.367254][ T972] usb 6-1: SerialNumber: syz [ 377.376963][T12076] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 377.435130][ T972] usb 6-1: config 0 descriptor?? [ 377.446302][T12076] lo speed is unknown, defaulting to 1000 [ 377.474317][T12061] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 377.504264][T12076] lo speed is unknown, defaulting to 1000 [ 377.515031][T12084] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 377.515330][T12076] lo speed is unknown, defaulting to 1000 [ 377.528817][ T5847] IPVS: starting estimator thread 0... [ 377.540138][T12076] lo speed is unknown, defaulting to 1000 [ 377.619002][T12076] lo speed is unknown, defaulting to 1000 [ 377.622263][T12091] IPVS: using max 44 ests per chain, 105600 per kthread [ 377.625461][ T972] rc_core: IR keymap rc-streamzap not found [ 377.641635][ T972] Registered IR keymap rc-empty [ 377.648089][ T972] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 377.667146][ T972] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input25 [ 378.085184][T12104] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1856'. [ 378.261867][T12109] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1866'. [ 378.285192][ T47] usb 6-1: USB disconnect, device number 9 [ 378.337159][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.982214][ T9] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 379.331595][ T47] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 379.575211][ T9] usb 5-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=cb.d7 [ 379.593129][ T47] usb 1-1: Using ep0 maxpacket: 32 [ 379.604143][ T47] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 379.616138][ T9] usb 5-1: New USB device strings: Mfr=1, Product=18, SerialNumber=3 [ 379.624658][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.626422][ T47] usb 1-1: config 0 descriptor?? [ 379.734025][ T9] usb 5-1: Product: syz [ 379.793104][ T9] usb 5-1: Manufacturer: syz [ 380.157435][ T47] as10x_usb: device has been detected [ 380.170886][ T47] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 380.264960][T12131] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1874'. [ 380.304542][ T9] usb 5-1: SerialNumber: syz [ 380.305471][T12112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.396726][ T47] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 380.396900][ T9] usb 5-1: config 0 descriptor?? [ 380.454135][T12112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.613144][ T9] dvb-usb: found a 'Pinnacle PCTV 310e' in cold state, will try to load a firmware [ 380.638256][ T9] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 380.738828][ T30] audit: type=1400 audit(2000000156.546:82837): avc: denied { firmware_load } for pid=47 comm="kworker/1:1" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=271 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 380.741685][ T47] as10x_usb: error during firmware upload part1 [ 380.772643][ T47] Registered device nBox DVB-T Dongle [ 381.335556][ T3075] usb 5-1: USB disconnect, device number 34 [ 381.356338][ T47] usb 1-1: USB disconnect, device number 34 [ 381.431631][ T47] Unregistered device nBox DVB-T Dongle [ 381.434430][ T47] as10x_usb: device has been disconnected [ 381.846497][ T30] audit: type=1400 audit(2000000157.656:82838): avc: denied { create } for pid=12140 comm="syz.1.1879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 381.972666][ T47] usb 1-1: new full-speed USB device number 35 using dummy_hcd [ 381.997990][T12152] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1881'. [ 382.223473][ T47] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 382.246738][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 382.282146][ T47] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 382.305259][ T47] usb 1-1: config 0 has no interface number 0 [ 382.314367][ T47] usb 1-1: config 0 has no interface number 1 [ 382.335725][ T47] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 382.345445][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.400219][T12158] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.407760][T12158] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.437241][T12158] bridge0: entered allmulticast mode [ 382.438166][ T47] usb 1-1: config 0 descriptor?? [ 382.466507][ T47] usb 1-1: unknown number of interfaces: 2 [ 382.505613][T12159] bridge_slave_1: left allmulticast mode [ 382.521578][T12159] bridge_slave_1: left promiscuous mode [ 382.527196][ T5847] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 382.544732][T12159] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.575459][T12159] bridge_slave_0: left allmulticast mode [ 382.581127][T12159] bridge_slave_0: left promiscuous mode [ 382.587718][T12159] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.673540][ T5847] usb 5-1: Using ep0 maxpacket: 32 [ 382.702746][ T5847] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 382.721638][ T5847] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 382.756581][ T9] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 383.302151][ T5847] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 383.313801][ T5847] usb 5-1: Product: syz [ 383.318405][ T5847] usb 5-1: Manufacturer: syz [ 383.323441][ T5847] usb 5-1: SerialNumber: syz [ 383.330325][ T5847] usb 5-1: config 0 descriptor?? [ 383.336434][T12154] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 383.353311][ T5847] hub 5-1:0.0: bad descriptor, ignoring hub [ 383.359553][ T5847] hub 5-1:0.0: probe with driver hub failed with error -5 [ 383.366412][T12143] lo speed is unknown, defaulting to 1000 [ 383.444156][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 383.502980][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 383.522745][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 383.544117][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 383.631830][ T30] audit: type=1400 audit(2000000159.436:82839): avc: denied { wake_alarm } for pid=12172 comm="syz.5.1888" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 383.637217][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.653173][ C1] vkms_vblank_simulate: vblank timer overrun [ 383.920659][ T9] usb 2-1: Product: syz [ 383.942367][ T9] usb 2-1: Manufacturer: syz [ 383.947203][ T9] usb 2-1: SerialNumber: syz [ 384.006603][ T10] usb 1-1: USB disconnect, device number 35 [ 384.103357][ T5847] usb 5-1: USB disconnect, device number 35 [ 384.322387][ T24] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 384.482440][ T24] usb 4-1: device descriptor read/64, error -71 [ 384.752701][ T24] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 384.986905][ T24] usb 4-1: device descriptor read/64, error -71 [ 385.406999][ T24] usb usb4-port1: attempt power cycle [ 385.462476][T12191] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1893'. [ 385.596814][T12195] option changes via remount are deprecated (pid=12192 comm=syz.4.1894) [ 386.276953][ T30] audit: type=1400 audit(2000000161.396:82840): avc: denied { remount } for pid=12192 comm="syz.4.1894" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 386.300841][ T9] usb 2-1: cannot find UAC_HEADER [ 386.320273][ T9] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 386.333571][ T24] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 386.435626][ T24] usb 4-1: device descriptor read/8, error -71 [ 386.469467][ T9] usb 2-1: USB disconnect, device number 37 [ 386.564093][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 386.638064][T12204] option changes via remount are deprecated (pid=12197 comm=syz.4.1895) [ 386.732380][ T24] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 387.252507][ T24] usb 4-1: device descriptor read/8, error -71 [ 387.388374][ T24] usb usb4-port1: unable to enumerate USB device [ 387.992484][ T9] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 388.158971][ T9] usb 2-1: device descriptor read/64, error -71 [ 388.194514][ T30] audit: type=1400 audit(2000000163.996:82841): avc: denied { write } for pid=12218 comm="syz.3.1903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 388.247029][ T30] audit: type=1400 audit(2000000164.056:82842): avc: denied { getopt } for pid=12219 comm="syz.0.1904" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 388.582266][ T9] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 389.612307][ T9] usb 2-1: device descriptor read/64, error -71 [ 389.733084][ T9] usb usb2-port1: attempt power cycle [ 389.752653][T12247] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1908'. [ 390.130323][T12257] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 390.146584][T12257] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 392.780544][T12295] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1919'. [ 392.790275][T12295] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1919'. [ 392.890710][T12295] delete_channel: no stack [ 393.032154][ T5861] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 393.187864][T12300] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input26 [ 393.242297][ T5861] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 393.242431][ T9] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 393.250489][ T5861] usb 1-1: config 0 has no interface number 0 [ 393.270308][T12302] vlan2: entered promiscuous mode [ 393.289319][T12302] veth0_virt_wifi: entered promiscuous mode [ 393.312287][T12302] vlan2: entered allmulticast mode [ 393.317489][T12302] veth0_virt_wifi: entered allmulticast mode [ 393.324184][ T5861] usb 1-1: config 0 interface 126 has no altsetting 0 [ 393.341310][ T5861] usb 1-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 393.379932][ T5861] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.398783][ T5861] usb 1-1: Product: syz [ 393.402397][ T9] usb 2-1: device descriptor read/64, error -71 [ 393.416578][ T5861] usb 1-1: Manufacturer: syz [ 393.441445][ T5861] usb 1-1: SerialNumber: syz [ 393.464727][ T5861] usb 1-1: config 0 descriptor?? [ 393.695553][ T5847] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 393.779690][ T3075] usb 1-1: USB disconnect, device number 36 [ 393.843593][ T9] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 393.908391][T12316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1926'. [ 393.935470][ T5847] usb 6-1: config 1 interface 0 has no altsetting 0 [ 393.949135][ T5847] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 393.968334][ T5847] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.977821][ T9] usb 2-1: device descriptor read/64, error -71 [ 393.992264][ T5847] usb 6-1: Product: syz [ 393.999716][ T5847] usb 6-1: Manufacturer: syz [ 394.006716][ T5847] usb 6-1: SerialNumber: syz [ 394.093732][ T9] usb usb2-port1: attempt power cycle [ 394.128631][T12299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.722557][ T9] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 394.742829][ T9] usb 2-1: device descriptor read/8, error -71 [ 395.028101][ T9] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 395.812439][ T5847] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 395.824502][ T9] usb 2-1: device descriptor read/8, error -71 [ 395.831212][ T30] audit: type=1400 audit(2000000171.636:82843): avc: denied { unmount } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 395.918457][T12334] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1931'. [ 395.936867][ T9] usb usb2-port1: unable to enumerate USB device [ 397.213393][T12348] dlm: no local IP address has been set [ 397.219152][T12348] dlm: cannot start dlm midcomms -107 [ 397.290378][ T9] usb 6-1: USB disconnect, device number 10 [ 397.339651][ T9] usblp0: removed [ 397.499057][ T30] audit: type=1400 audit(2000000173.306:82844): avc: denied { connect } for pid=12353 comm="syz.3.1938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 397.556222][ T30] audit: type=1400 audit(2000000173.366:82845): avc: denied { write } for pid=12353 comm="syz.3.1938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 397.776709][T12363] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 397.777795][ T30] audit: type=1400 audit(2000000173.586:82846): avc: denied { read write } for pid=12365 comm="syz.0.1941" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 397.783240][T12363] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 397.802431][T12363] vhci_hcd vhci_hcd.0: Device attached [ 397.887549][ T30] audit: type=1400 audit(2000000173.636:82847): avc: denied { create } for pid=12365 comm="syz.0.1941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 397.907925][ T30] audit: type=1400 audit(2000000173.636:82848): avc: denied { open } for pid=12365 comm="syz.0.1941" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 397.963588][ T30] audit: type=1400 audit(2000000173.746:82849): avc: denied { bind } for pid=12365 comm="syz.0.1941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 398.062662][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 398.092181][ T47] usb 44-1: SetAddress Request (2) to port 0 [ 398.098226][ T47] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 398.192188][ T5863] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 398.202541][ T9] usb 6-1: device descriptor read/64, error -71 [ 398.374567][ T5863] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 398.391915][ T5863] usb 2-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 398.429571][ T5863] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.462265][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 398.478359][ T5863] usb 2-1: config 0 descriptor?? [ 398.968845][ T9] usb 6-1: device descriptor read/64, error -71 [ 399.552688][ T9] usb usb6-port1: attempt power cycle [ 399.635901][T12385] lo speed is unknown, defaulting to 1000 [ 399.716154][ T5863] hid (null): unknown global tag 0xd [ 399.737385][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x0 [ 399.759270][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x0 [ 399.772678][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x0 [ 399.793896][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x0 [ 399.802048][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x0 [ 399.809779][ T5863] elecom 0003:056E:00E6.000A: unknown main item tag 0x4 [ 399.817467][ T5863] elecom 0003:056E:00E6.000A: unknown global tag 0xd [ 399.988973][ T5863] elecom 0003:056E:00E6.000A: item 0 4 1 13 parsing failed [ 400.042764][ T9] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 400.092927][ T5863] elecom 0003:056E:00E6.000A: probe with driver elecom failed with error -22 [ 400.123858][ T9] usb 6-1: device descriptor read/8, error -71 [ 400.133044][ T5863] usb 2-1: USB disconnect, device number 45 [ 400.382762][ T3075] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 400.476180][ T5847] usb 4-1: new full-speed USB device number 39 using dummy_hcd [ 400.484429][ T9] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 400.512843][ T9] usb 6-1: device descriptor read/8, error -71 [ 400.530601][T12400] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 400.635971][ T9] usb usb6-port1: unable to enumerate USB device [ 401.093677][ T5847] usb 4-1: config 7 has an invalid interface number: 101 but max is 0 [ 401.102209][ T5847] usb 4-1: config 7 has no interface number 0 [ 401.110581][ T5847] usb 4-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 401.128481][T12364] vhci_hcd: connection reset by peer [ 401.146226][ T53] vhci_hcd: stop threads [ 401.149206][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.158993][ T53] vhci_hcd: release socket [ 401.164724][ T3075] usb 1-1: Using ep0 maxpacket: 8 [ 401.170340][ T53] vhci_hcd: disconnect device [ 401.175180][ T5847] usb 4-1: Product: syz [ 401.175198][ T5847] usb 4-1: Manufacturer: syz [ 401.175212][ T5847] usb 4-1: SerialNumber: syz [ 401.191114][ T3075] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 401.249495][ T3075] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x16, changing to 0x6 [ 401.268233][ T3075] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 401.282188][ T3075] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 401.293407][ T3075] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 401.315909][ T3075] usb 1-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 401.327944][ T3075] usb 1-1: New USB device strings: Mfr=80, Product=2, SerialNumber=3 [ 401.338409][ T3075] usb 1-1: Product: syz [ 401.343863][ T3075] usb 1-1: Manufacturer: syz [ 401.348708][ T3075] usb 1-1: SerialNumber: syz [ 401.390033][ T3075] usb 1-1: config 0 descriptor?? [ 401.598630][ T3075] ati_remote 1-1:0.0: ati_remote_probe: Unexpected endpoint_in [ 401.817865][ T9] usb 1-1: USB disconnect, device number 37 [ 402.159143][ T5847] as10x_usb: device has been detected [ 402.195313][ T5847] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 402.238489][ T5847] usb 4-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 402.755888][ T5847] as10x_usb: error during firmware upload part1 [ 403.206518][ T5847] Registered device Elgato EyeTV DTT Deluxe [ 403.216285][ T47] usb 44-1: device descriptor read/8, error -110 [ 403.250833][ T30] audit: type=1326 audit(2000000179.016:82850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12424 comm="syz.4.1956" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26f838e969 code=0x7ffc0000 [ 403.340907][T12435] 9pnet_fd: Insufficient options for proto=fd [ 403.351779][ T30] audit: type=1326 audit(2000000179.026:82851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12424 comm="syz.4.1956" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26f838e969 code=0x7ffc0000 [ 403.399485][ T5847] usb 4-1: USB disconnect, device number 39 [ 403.425012][ T5847] Unregistered device Elgato EyeTV DTT Deluxe [ 403.436328][ T30] audit: type=1326 audit(2000000179.246:82852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12424 comm="syz.4.1956" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26f838e969 code=0x7ffc0000 [ 403.469964][ T5847] as10x_usb: device has been disconnected [ 403.475795][ T30] audit: type=1326 audit(2000000179.246:82853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12424 comm="syz.4.1956" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26f838e969 code=0x7ffc0000 [ 403.624788][ T47] usb usb44-port1: attempt power cycle [ 403.642930][T12435] ALSA: seq fatal error: cannot create timer (-22) [ 403.894547][T12442] block device autoloading is deprecated and will be removed. [ 403.922203][ T9] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 403.986048][ T3075] lo speed is unknown, defaulting to 1000 [ 404.013015][ T5861] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 404.142340][ T5861] usb 4-1: device descriptor read/64, error -71 [ 404.172197][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 404.193736][ T9] usb 6-1: New USB device found, idVendor=056a, idProduct=0333, bcdDevice= 0.00 [ 404.232680][ T47] usb usb44-port1: unable to enumerate USB device [ 404.275375][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.340948][ T9] usb 6-1: config 0 descriptor?? [ 404.392365][ T5861] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 404.552998][ T5861] usb 4-1: device descriptor read/64, error -71 [ 404.581696][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 404.594845][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 404.614965][ T9] usb 6-1: USB disconnect, device number 15 [ 404.662429][ T5861] usb usb4-port1: attempt power cycle [ 404.682004][T12455] netlink: 'syz.1.1966': attribute type 1 has an invalid length. [ 404.715558][T12455] 8021q: adding VLAN 0 to HW filter on device bond2 [ 404.760103][T12455] bond2: (slave veth5): Enslaving as an active interface with a down link [ 404.825589][T12459] 9pnet_fd: Insufficient options for proto=fd [ 404.889341][T12455] vlan2: entered allmulticast mode [ 404.895008][T12455] bond2: entered allmulticast mode [ 404.912323][ T47] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 405.012182][ T5861] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 405.059724][T12462] mmap: syz.1.1969 (12462): VmData 37597184 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 405.082230][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 405.099072][ T5861] usb 4-1: device descriptor read/8, error -71 [ 405.105628][ T47] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 405.129742][ T47] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 405.685800][ T47] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 405.699296][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.722333][ T47] usb 5-1: Product: syz [ 405.730705][ T47] usb 5-1: Manufacturer: syz [ 405.746739][ T47] usb 5-1: SerialNumber: syz [ 405.807107][ T5861] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 405.967410][ T5861] usb 4-1: device descriptor read/8, error -71 [ 406.622356][ T5860] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 406.862344][ T5861] usb usb4-port1: unable to enumerate USB device [ 406.913468][ T5860] usb 2-1: device descriptor read/64, error -71 [ 407.084177][T12495] Cannot find add_set index 0 as target [ 407.232177][ T5860] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 407.362703][ T30] audit: type=1400 audit(2000000183.166:82854): avc: denied { setopt } for pid=12496 comm="syz.0.1976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 407.372171][ T5860] usb 2-1: device descriptor read/64, error -71 [ 407.492441][ T5860] usb usb2-port1: attempt power cycle [ 407.862287][ T5860] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 407.872418][ T47] usb 5-1: cannot find UAC_HEADER [ 407.905576][ T5860] usb 2-1: device descriptor read/8, error -71 [ 407.945320][ T47] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 408.018862][ T47] usb 5-1: USB disconnect, device number 36 [ 408.299396][ T9805] udevd[9805]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 408.412243][ T5860] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 408.443027][ T5860] usb 2-1: device descriptor read/8, error -71 [ 408.509635][T12518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1983'. [ 408.552767][ T5860] usb usb2-port1: unable to enumerate USB device [ 408.612180][ T47] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 408.702202][ T5959] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 409.282288][ T47] usb 5-1: Using ep0 maxpacket: 32 [ 409.293520][ T47] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 409.316493][ T47] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 409.333683][ T47] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 409.352186][ T47] usb 5-1: Product: syz [ 409.356795][ T47] usb 5-1: Manufacturer: syz [ 409.363715][ T5959] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 409.373290][ T47] usb 5-1: SerialNumber: syz [ 409.379841][ T47] usb 5-1: config 0 descriptor?? [ 409.386507][ T5959] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.482542][T12505] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 409.505804][ T5959] usb 6-1: config 0 descriptor?? [ 409.521840][ T47] hub 5-1:0.0: bad descriptor, ignoring hub [ 409.544672][ T47] hub 5-1:0.0: probe with driver hub failed with error -5 [ 409.678560][ T30] audit: type=1400 audit(2000000185.486:82855): avc: denied { create } for pid=12535 comm="syz.3.1989" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 409.808578][T12543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.821297][T12543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.629096][ T9] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 410.732749][ T5959] usb 6-1: Cannot read MAC address [ 410.737960][ T5959] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 410.784833][ T5959] usb 6-1: USB disconnect, device number 16 [ 410.822228][T12551] Cannot find add_set index 0 as target [ 410.830954][T12542] [ 410.833275][T12542] ====================================================== [ 410.840264][T12542] WARNING: possible circular locking dependency detected [ 410.847250][T12542] 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 Not tainted [ 410.854326][T12542] ------------------------------------------------------ [ 410.861313][T12542] syz.0.1988/12542 is trying to acquire lock: [ 410.867347][T12542] ffff88805959d140 (&sbi->pipe_mutex){+.+.}-{4:4}, at: autofs_notify_daemon+0x4a6/0xd60 [ 410.877055][T12542] [ 410.877055][T12542] but task is already holding lock: [ 410.882673][T12545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1988'. [ 410.884386][T12542] ffff88802f0f8088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x510 [ 410.902520][T12542] [ 410.902520][T12542] which lock already depends on the new lock. [ 410.902520][T12542] [ 410.912895][T12542] [ 410.912895][T12542] the existing dependency chain (in reverse order) is: [ 410.921877][T12542] [ 410.921877][T12542] -> #2 (&of->mutex){+.+.}-{4:4}: [ 410.929056][T12542] __mutex_lock+0x199/0xb90 [ 410.934055][T12542] kernfs_fop_write_iter+0x28f/0x510 [ 410.939836][T12542] iter_file_splice_write+0x91c/0x1150 [ 410.945804][T12542] do_splice+0x1475/0x1fc0 [ 410.950719][T12542] __do_splice+0x32a/0x360 [ 410.955633][T12542] __x64_sys_splice+0x187/0x250 [ 410.960982][T12542] do_syscall_64+0xcd/0x260 [ 410.965980][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.972366][T12542] [ 410.972366][T12542] -> #1 (&pipe->mutex){+.+.}-{4:4}: [ 410.979716][T12542] __mutex_lock+0x199/0xb90 [ 410.984737][T12542] anon_pipe_write+0x15d/0x1a70 [ 410.990077][T12542] __kernel_write_iter+0x71d/0xa90 [ 410.995686][T12542] __kernel_write+0xf5/0x140 [ 411.000795][T12542] autofs_notify_daemon+0x4db/0xd60 [ 411.006509][T12542] autofs_wait+0x10ca/0x1a70 [ 411.011621][T12542] autofs_mount_wait+0x132/0x380 [ 411.017083][T12542] autofs_d_automount+0x390/0x7f0 [ 411.022609][T12542] __traverse_mounts+0x192/0x790 [ 411.028040][T12542] step_into+0x5aa/0x2270 [ 411.032873][T12542] path_openat+0x749/0x2d40 [ 411.037879][T12542] do_filp_open+0x20b/0x470 [ 411.042885][T12542] do_sys_openat2+0x11b/0x1d0 [ 411.048064][T12542] __x64_sys_openat+0x174/0x210 [ 411.053422][T12542] do_syscall_64+0xcd/0x260 [ 411.058421][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.064811][T12542] [ 411.064811][T12542] -> #0 (&sbi->pipe_mutex){+.+.}-{4:4}: [ 411.072508][T12542] __lock_acquire+0x1173/0x1ba0 [ 411.077854][T12542] lock_acquire+0x179/0x350 [ 411.082853][T12542] __mutex_lock+0x199/0xb90 [ 411.087851][T12542] autofs_notify_daemon+0x4a6/0xd60 [ 411.093541][T12542] autofs_wait+0x10ca/0x1a70 [ 411.098627][T12542] autofs_mount_wait+0x132/0x380 [ 411.104066][T12542] autofs_d_automount+0x390/0x7f0 [ 411.109586][T12542] __traverse_mounts+0x192/0x790 [ 411.115017][T12542] step_into+0x5aa/0x2270 [ 411.119840][T12542] walk_component+0xfc/0x5b0 [ 411.124930][T12542] path_lookupat+0x17e/0x780 [ 411.130017][T12542] filename_lookup+0x224/0x5f0 [ 411.135278][T12542] kern_path+0x35/0x50 [ 411.139844][T12542] lookup_bdev+0xd8/0x280 [ 411.144672][T12542] resume_store+0x1d6/0x460 [ 411.149668][T12542] kobj_attr_store+0x55/0x80 [ 411.154753][T12542] sysfs_kf_write+0xef/0x150 [ 411.160429][T12542] kernfs_fop_write_iter+0x351/0x510 [ 411.166215][T12542] vfs_write+0x5ba/0x1180 [ 411.171045][T12542] ksys_write+0x12a/0x240 [ 411.175872][T12542] do_syscall_64+0xcd/0x260 [ 411.180870][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.187261][T12542] [ 411.187261][T12542] other info that might help us debug this: [ 411.187261][T12542] [ 411.197463][T12542] Chain exists of: [ 411.197463][T12542] &sbi->pipe_mutex --> &pipe->mutex --> &of->mutex [ 411.197463][T12542] [ 411.209855][T12542] Possible unsafe locking scenario: [ 411.209855][T12542] [ 411.217277][T12542] CPU0 CPU1 [ 411.222611][T12542] ---- ---- [ 411.227944][T12542] lock(&of->mutex); [ 411.231897][T12542] lock(&pipe->mutex); [ 411.238541][T12542] lock(&of->mutex); [ 411.245010][T12542] lock(&sbi->pipe_mutex); [ 411.249483][T12542] [ 411.249483][T12542] *** DEADLOCK *** [ 411.249483][T12542] [ 411.257597][T12542] 4 locks held by syz.0.1988/12542: [ 411.262763][T12542] #0: ffff88807cda2b78 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 [ 411.271784][T12542] #1: ffff888031a06420 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 [ 411.280717][T12542] #2: ffff88802f0f8088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x510 [ 411.290434][T12542] #3: ffff888140ac8788 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2b2/0x510 [ 411.300412][T12542] [ 411.300412][T12542] stack backtrace: [ 411.306270][T12542] CPU: 0 UID: 0 PID: 12542 Comm: syz.0.1988 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) [ 411.306285][T12542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 411.306292][T12542] Call Trace: [ 411.306297][T12542] [ 411.306302][T12542] dump_stack_lvl+0x116/0x1f0 [ 411.306316][T12542] print_circular_bug+0x275/0x350 [ 411.306333][T12542] check_noncircular+0x14c/0x170 [ 411.306350][T12542] __lock_acquire+0x1173/0x1ba0 [ 411.306368][T12542] lock_acquire+0x179/0x350 [ 411.306384][T12542] ? autofs_notify_daemon+0x4a6/0xd60 [ 411.306395][T12542] ? __pfx___might_resched+0x10/0x10 [ 411.306411][T12542] __mutex_lock+0x199/0xb90 [ 411.306424][T12542] ? autofs_notify_daemon+0x4a6/0xd60 [ 411.306433][T12542] ? autofs_notify_daemon+0x45a/0xd60 [ 411.306442][T12542] ? autofs_notify_daemon+0x4a6/0xd60 [ 411.306452][T12542] ? __pfx___mutex_lock+0x10/0x10 [ 411.306464][T12542] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 411.306475][T12542] ? lockdep_hardirqs_on+0x7c/0x110 [ 411.306487][T12542] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 411.306500][T12542] ? from_kgid_munged+0xab/0x130 [ 411.306513][T12542] ? autofs_notify_daemon+0x4a6/0xd60 [ 411.306522][T12542] autofs_notify_daemon+0x4a6/0xd60 [ 411.306532][T12542] ? __pfx_autofs_notify_daemon+0x10/0x10 [ 411.306549][T12542] ? sysfs_kf_write+0xef/0x150 [ 411.306563][T12542] ? kernfs_fop_write_iter+0x351/0x510 [ 411.306577][T12542] ? vfs_write+0x5ba/0x1180 [ 411.306597][T12542] ? lockdep_init_map_type+0x5c/0x280 [ 411.306614][T12542] ? lockdep_init_map_type+0x5c/0x280 [ 411.306631][T12542] autofs_wait+0x10ca/0x1a70 [ 411.306641][T12542] ? __pfx_autofs_wait+0x10/0x10 [ 411.306650][T12542] ? __pfx_path_check_mount+0x10/0x10 [ 411.306662][T12542] ? find_held_lock+0x2b/0x80 [ 411.306674][T12542] ? path_has_submounts+0xcb/0x120 [ 411.306688][T12542] ? do_raw_spin_unlock+0x172/0x230 [ 411.306699][T12542] ? find_held_lock+0x2b/0x80 [ 411.306711][T12542] autofs_mount_wait+0x132/0x380 [ 411.306728][T12542] autofs_d_automount+0x390/0x7f0 [ 411.306745][T12542] __traverse_mounts+0x192/0x790 [ 411.306759][T12542] step_into+0x5aa/0x2270 [ 411.306774][T12542] ? __pfx_step_into+0x10/0x10 [ 411.306794][T12542] ? __pfx___up_read+0x10/0x10 [ 411.306804][T12542] ? walk_component+0x35e/0x5b0 [ 411.306818][T12542] ? lookup_fast+0x156/0x610 [ 411.306832][T12542] walk_component+0xfc/0x5b0 [ 411.306847][T12542] path_lookupat+0x17e/0x780 [ 411.306863][T12542] filename_lookup+0x224/0x5f0 [ 411.306879][T12542] ? __pfx_filename_lookup+0x10/0x10 [ 411.306899][T12542] ? getname_kernel+0x52/0x370 [ 411.306910][T12542] ? __asan_memcpy+0x3c/0x60 [ 411.306925][T12542] kern_path+0x35/0x50 [ 411.306940][T12542] lookup_bdev+0xd8/0x280 [ 411.306953][T12542] ? __pfx_lookup_bdev+0x10/0x10 [ 411.306963][T12542] ? resume_store+0x1b8/0x460 [ 411.306974][T12542] ? __asan_memcpy+0x3c/0x60 [ 411.306989][T12542] resume_store+0x1d6/0x460 [ 411.307000][T12542] ? __pfx_resume_store+0x10/0x10 [ 411.307012][T12542] ? find_held_lock+0x2b/0x80 [ 411.307025][T12542] ? __pfx_resume_store+0x10/0x10 [ 411.307035][T12542] kobj_attr_store+0x55/0x80 [ 411.307048][T12542] ? __pfx_kobj_attr_store+0x10/0x10 [ 411.307061][T12542] sysfs_kf_write+0xef/0x150 [ 411.307076][T12542] kernfs_fop_write_iter+0x351/0x510 [ 411.307090][T12542] ? __pfx_sysfs_kf_write+0x10/0x10 [ 411.307105][T12542] vfs_write+0x5ba/0x1180 [ 411.307120][T12542] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 411.307135][T12542] ? __pfx___mutex_lock+0x10/0x10 [ 411.307146][T12542] ? __pfx_vfs_write+0x10/0x10 [ 411.307165][T12542] ksys_write+0x12a/0x240 [ 411.307180][T12542] ? __pfx_ksys_write+0x10/0x10 [ 411.307195][T12542] ? rcu_is_watching+0x12/0xc0 [ 411.307209][T12542] do_syscall_64+0xcd/0x260 [ 411.307222][T12542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.307233][T12542] RIP: 0033:0x7f9cce98e969 [ 411.307242][T12542] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.307253][T12542] RSP: 002b:00007f9ccf893038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 411.307263][T12542] RAX: ffffffffffffffda RBX: 00007f9ccebb6160 RCX: 00007f9cce98e969 [ 411.307270][T12542] RDX: 0000000000000012 RSI: 00002000000000c0 RDI: 0000000000000007 [ 411.307277][T12542] RBP: 00007f9ccea10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 411.307283][T12542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 411.307289][T12542] R13: 0000000000000000 R14: 00007f9ccebb6160 R15: 00007fffee754ca8 [ 411.307299][T12542] [ 411.792939][T12542] PM: Image not found (code -22) [ 411.834010][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 411.844113][ T9] usb 2-1: config 0 has no interfaces? [ 411.849557][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 411.858611][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.862276][ T5860] usb 5-1: USB disconnect, device number 37 [ 411.873084][ T9] usb 2-1: config 0 descriptor?? [ 412.082457][T12528] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1986'. [ 412.093453][ T5860] usb 2-1: USB disconnect, device number 50