last executing test programs: 17m1.759901931s ago: executing program 0 (id=1957): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0xb}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='inet_sk_error_report\x00', r3}, 0x18) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 17m0.707751868s ago: executing program 0 (id=1962): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="2007000072003303060000000400000007000000", @ANYRES32=0x0, @ANYBLOB="08000100feffff7f"], 0x20}}, 0x20000010) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='ns\x00') socket$netlink(0x10, 0x3, 0x2) r2 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x10, 0x0, 0x3, 0x80}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) setresuid(r5, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x10, 0x2004, @fd_index, 0x4, 0x0, 0x0, 0x1, 0x1, {0x3}}) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) getdents(r1, &(0x7f0000000080)=""/70, 0x46) getdents(r1, &(0x7f0000000040)=""/36, 0x24) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002abd7000ffdbdf257c00000008000300", @ANYRES32=r7, @ANYBLOB="0a00060008021100000100000a00060008021100000100000a00060008021100000179000a00060008021100000000000a0006000802110000000000113d01000000010000001452470905039a37525c738de800cbd7c33f6ba48dbd36044f108cc2535e1f5959c851451c7dbb01d2b82913a2d730424762a67412f7115fd91896fbc2c40e228aaadea40aaa0320711d52cc9fa06f532363f755d2cef7e22c920f50a095f320811ba5da3f9145bcb7076426000800009572fe540e44c8e10d4101edf0958ac53361e719bed1bd78d590fb5da468f45fd0bff3896d017d24ac378f03768d13982b52af1940783c859bce3449ced3352b987b6a"], 0x58}, 0x1, 0x0, 0x0, 0x40080}, 0x54) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) 16m59.899748157s ago: executing program 0 (id=1965): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, 0x0, &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x8, 0xb, 0x2}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000f0000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000680)={{r0}, &(0x7f0000000200), &(0x7f0000000640)='%pB \x00'}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x286ca06bbee933dc, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000050, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) prlimit64(0x0, 0x6, &(0x7f0000000040), 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/file0\x00', &(0x7f00000001c0), 0x100) open(0x0, 0x24042, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003040)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r4 = getuid() newfstatat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f0000001500), 0x4000) setresuid(r4, r3, r4) io_uring_enter(0xffffffffffffffff, 0x627, 0x4c1, 0x43, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000380)={0x22140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) 16m58.483254804s ago: executing program 0 (id=1968): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) socket(0x21, 0x1, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f00000000c0)='./bus\x00') sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r4 = creat(&(0x7f0000000580)='./bus\x00', 0x0) r5 = fanotify_init(0xf00, 0x1) fanotify_mark(r5, 0x105, 0x4000996f, r4, 0x0) fallocate(r3, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r3, 0xffffd000) setns(r1, 0x24020000) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff00c}]}, 0x10) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r6, 0x4018aee3, &(0x7f00000000c0)) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) bpf$PROG_LOAD(0x5, 0x0, 0x0) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 16m53.816028617s ago: executing program 0 (id=1983): connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @multicast, 'ip6gre0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) ioctl$COMEDI_BUFCONFIG(0xffffffffffffffff, 0x8020640d, &(0x7f0000000040)={0x1, 0x3, 0x10}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) write(r3, &(0x7f0000000040)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r3, &(0x7f00000005c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000004c0)=""/89, 0x59}, {&(0x7f0000000180)=""/223, 0xdf}, {&(0x7f0000001bc0)=""/4110, 0x100e}, {&(0x7f00000007c0)=""/234, 0xea}, {&(0x7f0000000700)=""/139, 0x8b}, {&(0x7f0000000340)=""/78, 0x4e}, {&(0x7f0000000280)=""/168, 0xa8}, {&(0x7f00000003c0)=""/146, 0x92}, {&(0x7f0000000080)=""/136, 0x88}], 0x9}, 0x10001}], 0x1, 0x0, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x21041004}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x4, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x850}, 0x0) unshare(0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_open_procfs(0x0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) 16m51.878779322s ago: executing program 0 (id=1989): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='io\x00') preadv(r5, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/44, 0x2c}], 0x1, 0x0, 0x0) 16m48.532810534s ago: executing program 32 (id=1989): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='io\x00') preadv(r5, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/44, 0x2c}], 0x1, 0x0, 0x0) 16m41.344010425s ago: executing program 2 (id=2013): r0 = syz_open_dev$audion(&(0x7f0000000000), 0x401, 0x200000) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x0, 0x1, 0x1, 0x4, 0x4}, &(0x7f0000000080)=0x20) (async) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x0, 0x1, 0x1, 0x4, 0x4}, &(0x7f0000000080)=0x20) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000000c0)={'veth1\x00', {0x2, 0x4e23, @multicast2}}) (async) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000000c0)={'veth1\x00', {0x2, 0x4e23, @multicast2}}) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000100)={'netpci0\x00', {0x2, 0x4e21, @multicast2}}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, '\\*-+\x19]'}, {0x20, '),^-}/^:'}, {}, {0x20, '\x1e^-+$\'!}['}, {0x20, 'veth1\x00'}, {0x20, '!.,,*-!+\b+\xdd{'}, {0x20, 'veth1\x00'}, {0x20, '/selinux/mls\x00'}], 0xa, "ed5c171473d6111d79e20d7236a94bd8e430ee368e93bf236797a6d27d3bd08fb642bc1e9ba70d33357845d573c45f4aff378eb9c81c3531444291"}, 0x8a) (async) write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, '\\*-+\x19]'}, {0x20, '),^-}/^:'}, {}, {0x20, '\x1e^-+$\'!}['}, {0x20, 'veth1\x00'}, {0x20, '!.,,*-!+\b+\xdd{'}, {0x20, 'veth1\x00'}, {0x20, '/selinux/mls\x00'}], 0xa, "ed5c171473d6111d79e20d7236a94bd8e430ee368e93bf236797a6d27d3bd08fb642bc1e9ba70d33357845d573c45f4aff378eb9c81c3531444291"}, 0x8a) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000240)={0x4, 0x0, [{0x80000000, 0x7f, 0x6, 0x1, 0x4, 0x2, 0x2}, {0x80000000, 0x2, 0x0, 0x5, 0x0, 0x5, 0x5}, {0x2, 0x78f4, 0x1, 0x5, 0x1, 0x8, 0x2}, {0xa, 0xff, 0x0, 0x6, 0x9, 0x1, 0xa}]}) (async) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000240)={0x4, 0x0, [{0x80000000, 0x7f, 0x6, 0x1, 0x4, 0x2, 0x2}, {0x80000000, 0x2, 0x0, 0x5, 0x0, 0x5, 0x5}, {0x2, 0x78f4, 0x1, 0x5, 0x1, 0x8, 0x2}, {0xa, 0xff, 0x0, 0x6, 0x9, 0x1, 0xa}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x10003, 0x5, 0x6000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x10003, 0x5, 0x6000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000380)={0xc, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000400)={0x28, 0x3, 0x0, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f00000003c0)}) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect(r4, &(0x7f0000000440)=@x25={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x1}}, 0x80) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r6) (async) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r6) getsockopt$sock_buf(r4, 0x1, 0x1c, &(0x7f0000000500)=""/164, &(0x7f00000005c0)=0xa4) r7 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000600), 0x46000, 0x0) ioctl$TIOCGISO7816(r7, 0x80285442, &(0x7f0000000640)) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r5, 0x8040942d, &(0x7f0000000680)) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(0xffffffffffffffff, 0x4068aea3, &(0x7f00000006c0)) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000740)={0x38, "dc84b5c197cbbf681f23e73d0a6eed8d50dc0f62de1f5d6dd366dd1994c9bf2b4531c18fee53ad4c92708f51b0e177e31fd82204ca2d94e7"}) prlimit64(0x0, 0xa, &(0x7f0000000780)={0xee, 0x6}, &(0x7f00000007c0)) (async) prlimit64(0x0, 0xa, &(0x7f0000000780)={0xee, 0x6}, &(0x7f00000007c0)) getsockname(r0, &(0x7f0000000800)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000880)=0x80) fadvise64(r6, 0x7fffffff, 0xfb, 0x0) (async) fadvise64(r6, 0x7fffffff, 0xfb, 0x0) getrlimit(0x7, &(0x7f00000008c0)) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000900)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$TIOCGRS485(r6, 0x542e, &(0x7f0000000b40)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x1c, &(0x7f0000000b80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6a15}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ldst={0x2, 0x0, 0x1, 0x1, 0x4, 0x30, 0xffffffffffffffff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfff}, @ldst={0x2, 0x1, 0x4, 0x1, 0xa, 0x0, 0x10}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x4}]}, &(0x7f0000000c80)='syzkaller\x00', 0xd, 0xcf, &(0x7f0000000cc0)=""/207, 0x40f00, 0x3, '\x00', r8, 0x0, r1, 0x8, &(0x7f0000000dc0)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000000e00)={0x2, 0x10, 0x8, 0x6}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000e40), &(0x7f0000000e80)=[{0x1, 0x4, 0x4}], 0x10, 0x9}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x1c, &(0x7f0000000b80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6a15}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ldst={0x2, 0x0, 0x1, 0x1, 0x4, 0x30, 0xffffffffffffffff}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfff}, @ldst={0x2, 0x1, 0x4, 0x1, 0xa, 0x0, 0x10}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x4}]}, &(0x7f0000000c80)='syzkaller\x00', 0xd, 0xcf, &(0x7f0000000cc0)=""/207, 0x40f00, 0x3, '\x00', r8, 0x0, r1, 0x8, &(0x7f0000000dc0)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000000e00)={0x2, 0x10, 0x8, 0x6}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000e40), &(0x7f0000000e80)=[{0x1, 0x4, 0x4}], 0x10, 0x9}, 0x94) 16m41.343288079s ago: executing program 2 (id=2014): openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000000)='\x00', 0x1}, {0x0}], 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000000, 0x810, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) bind$l2tp6(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x110b, 0x8000000000002}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0xffffffffffffff9a, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x20029}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x25}}, &(0x7f00000002c0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r8, &(0x7f00000021c0)={0x2020}, 0x2020) 16m40.394509227s ago: executing program 2 (id=2017): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='clear_refs\x00') r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80000) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000002c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f00000003c0)=[@op={0x18}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x18}, @assoc={0x18, 0x117, 0x4, 0x5}, @assoc={0x18}, @iv={0x30, 0x117, 0x2, 0x16, "5c65695791743f460575fa707516e02c9bba0dd6fdf2"}, @iv={0x30, 0x117, 0x2, 0x17, "f99b366d0367c9ed22a130dccaea3bfee044d51cc4d94b"}], 0xd8}], 0x1, 0x40800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0x0, 0x0, 0x1000000}}, &(0x7f0000000300)='syzkaller\x00'}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={0x14, 0x15, 0x301, 0x0, 0x25dfdbfc, {0x5}}, 0x14}}, 0x0) 16m39.380235218s ago: executing program 2 (id=2022): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000e5cf01406e0510401c20000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x0, 0xc, 0x1, '.'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001440)=ANY=[@ANYBLOB="371502000000479e"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, &(0x7f00000003c0)={0x14, &(0x7f00000002c0)={0x0, 0x5, 0xeb, {0xeb, 0x2, "58f12f9b623afc57f4de208cb5c907623a08251d2694a366983c2fb41f4bb40c3530d024b209b568477c07eda0d4ffc34b64873918dd981e6c10e5f5eb3e0cfa71a131a1f91ca9df3faab34f0e283f3769103717c68a8b3285745c8a0699c583c37d84487fc38d538dee26a279382252335c9207f218bc99e6a716c35374e71f14038d28808cdf7c111492ffc3985b1127f9b8a9f5fcd05836e2704b129b23994cdb03df510f18ea14d851ad1106c2b21343ee5cdcebbb99e054633f74d019fd3bde909aa361f9dc8ad6dfb9cd105cb3161bd0ce1258ad2221e4f8e98290b808d39d3d22136e81e8d7"}}, &(0x7f0000000680)={0x0, 0x3, 0x79, @string={0x79, 0x3, "05317ef322f82f4710342b3d806e9f2866be65149fae18f90b26ed552b017f48dffc9c5629d3f92afe7ce4abf2ac060ef8d05eaa07d3a22251a76aba560cbfe92c825381d044ac4081493f85d7ecc123d56962d821c98bfc7e8292b4c7abab005c3d4960e80c9200a5d944953cafba413c375ec3686c3b"}}}, &(0x7f0000000900)={0x44, &(0x7f0000000700)={0x0, 0x17, 0x8d, "a05f7810c09c6c26e8407ab3810404d1dfb46653412ce343355f109c92032153b1113b15609d8fc407b85e18dafa92750a172ebbb882c2ede1f0acd7e7230e9851ab18d412bd6c0e45cf572dded25ce74edca64e04e260fe23b31ba15190344447e2be9c8bdd834280deee71f9a7f490fdc00eec73e0c540d76177813c82f4773c30062e97a369cc4941f0bc86"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x4d}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000007c0)={0x20, 0x81, 0x1, 'A'}, &(0x7f0000000980)=ANY=[@ANYBLOB="208203000000557558d526ec23d17036e73415ebe44f0000000000002100"], &(0x7f0000000840)={0x20, 0x83, 0x1, "0f"}, &(0x7f0000000880)={0x20, 0x84, 0x2, "6fbb"}, &(0x7f00000008c0)={0x20, 0x85, 0x3, "6caffe"}}) r1 = socket$isdn(0x22, 0x2, 0x25) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x180000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=""/176, 0xa) socket$inet(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) recvfrom$inet(0xffffffffffffffff, &(0x7f00000000c0)=""/232, 0xe8, 0x2, 0x0, 0x0) read$proc_mixer(0xffffffffffffffff, &(0x7f0000000580)=""/109, 0x6d) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'veth1\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0x35, {0x7, @ah_ip4_spec={@rand_addr=0x64010100, @rand_addr=0x64010100, 0x401, 0x8}, @tcp_ip4_spec={@rand_addr=0x64010102, @broadcast, 0x4e20, 0x4e24}, 0x2, 0x3, 0x9, 0x4, 0xfffffffffffffffe}}}) bind$isdn(r1, &(0x7f0000000200)={0x22, 0xfa, 0x8, 0x23, 0x5}, 0x6) 16m35.850148777s ago: executing program 2 (id=2036): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0xb}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='inet_sk_error_report\x00', r3}, 0x18) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 16m34.673917008s ago: executing program 2 (id=2041): listen(0xffffffffffffffff, 0x7) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3d}}}, 0x0, 0x0, 0x11, 0x0, "a1c1dd75a68473ba07d945c3b03e10950cd4b347113e55eb4285bf274bca67efbff2fdf98328de9434031348589bf28046d14810000000e3ffffff00"}, 0xd8) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=@base={0x21, 0x0, 0x0, 0x100000, 0x400, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2000000, 0x0, 0x200000000000000}, 0x48) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='sessionid\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4f, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@bridge_delvlan={0x28, 0x56, 0x1, 0x0, 0x0, {}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x0, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8}}}]}, 0x28}}, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r1, 0x8008f512, &(0x7f0000000000)) syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2"], 0x0) 16m18.606342851s ago: executing program 33 (id=2041): listen(0xffffffffffffffff, 0x7) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3d}}}, 0x0, 0x0, 0x11, 0x0, "a1c1dd75a68473ba07d945c3b03e10950cd4b347113e55eb4285bf274bca67efbff2fdf98328de9434031348589bf28046d14810000000e3ffffff00"}, 0xd8) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=@base={0x21, 0x0, 0x0, 0x100000, 0x400, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2000000, 0x0, 0x200000000000000}, 0x48) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='sessionid\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4f, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@bridge_delvlan={0x28, 0x56, 0x1, 0x0, 0x0, {}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x0, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8}}}]}, 0x28}}, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r1, 0x8008f512, &(0x7f0000000000)) syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2"], 0x0) 5m4.408471285s ago: executing program 1 (id=4398): openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi3\x00', 0x82900, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='net_prio.prioidx\x00', 0x26e1, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, 0x0, 0x0) fchmod(0xffffffffffffffff, 0x32) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000004c00)=""/102392, 0x18ff8) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x103201, 0x0) write$P9_RSTATu(r2, &(0x7f0000000080)={0x265, 0x2, 0xafd, {{0x54f, 0x124, 0x28, 0x1f00, {}, 0x0, 0x0, 0xc, 0x401, 0xffffffffffffff7d, '\nnodev{evo\x03\xd3\x8b\x92\x00'/27, 0x28, 'pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18x\x99\xa9\x16c\x88\x14\xe5p\x81\x03\xb4\x94\xe1\x00\x00\x00\x00\x00\x00\x00\x00', 0x2, '\b\x00', 0xac, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4@\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x009\x86Ac\x1dD\xf4\xa3\x9b\x11\x91\x93z(\x0e\x8d\x88\x9f\xc2 \xd1\x15\xac\x8e/\x18K\x9aau\x8d&w*\xb0\xf2\x04M\x8e\xf0&=\xdd\x97\xd3\xc4\'\xb3\xa52\xef\xab\x1d\x1c\xe3,\xa7\xc1\xfc#\x1a\xf4\x84\b\xe0+%P(\xb7\xc9\xbb\x859oM\x8a\xf0\xeb\x95\xfc\x0e\xcc\x99\xf7\x80\xe2'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0xfd85) openat$kvm(0xffffffffffffff9c, 0x0, 0x400000, 0x0) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f00000002c0)={{0x4, 0x524}, 0x8}, 0x10) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socket$inet_smc(0x2b, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 5m2.744453983s ago: executing program 1 (id=4405): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x4010, 0xffffffffffffffff, 0xee31b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) listen(r4, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x2, 0x0, "00629a7d82000000000000000000f7ffffff00"}) r6 = ioctl$TIOCGPTPEER(r5, 0x5441, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000280)=0xff) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r8 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0xc000}, 0x10) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000680)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r9, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r10, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r9, 0x3ba0, &(0x7f0000000800)={0x48, 0x3, r11, 0x0, 0x1004000, 0x1000, &(0x7f0000ffc000)}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(0xffffffffffffffff, 0x3b8b, &(0x7f00000000c0)={0x10, 0x1, r11}) 5m1.771117841s ago: executing program 1 (id=4408): syz_usb_connect(0x3, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0xcb, 0x6f, 0xcf, 0x20, 0x13d8, 0x20, 0xf731, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x24, 0xe4, 0xd5}}]}}]}}, 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x766, 0x204, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x89, 0x20, 0x1, [{{0x9, 0x4, 0x0, 0x7, 0x1, 0x3, 0x1, 0x0, 0x2, {0x9, 0x21, 0x101, 0x5, 0x1, {0x22, 0xc3c}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x0, 0xf9}}}}}]}}]}}, &(0x7f00000000c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0xc, 0x10, 0x96, 0x20, 0xff}, 0x5, &(0x7f0000000080)={0x5, 0xf, 0x5}}) (async) r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @hyper}, 0x10) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000008c0)={&(0x7f0000001040)='virtio_transport_alloc_pkt\x00', r1, 0x0, 0x6}, 0x18) (async, rerun: 32) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000100)=0xfffffffffffffffe, 0x112) (async, rerun: 32) lsm_set_self_attr(0x65, &(0x7f0000000100)={0x65, 0x0, 0x20}, 0x20, 0x0) 5m0.336441607s ago: executing program 1 (id=4420): mkdir(&(0x7f00000002c0)='./file0\x00', 0x2) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0/../file0/../file0\x00', 0x80101) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000100), 0x2022c0, 0x0) chroot(&(0x7f0000000780)='./file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0\x00') 5m0.280655742s ago: executing program 1 (id=4421): memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @dev}) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, 0x0, &(0x7f0000000040)='c:::\x00', 0x0) r4 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0xb5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x84}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) timerfd_create(0x9, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') tkill(r4, 0xb) close(r2) close_range(r2, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) 5m0.064010341s ago: executing program 1 (id=4424): clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000001c0)=[{{&(0x7f0000000000)=@ax25={{}, [@remote, @bcast, @rose, @remote, @netrom, @null, @netrom, @netrom]}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/43, 0x2b}, {&(0x7f00000000c0)=""/105, 0x69}], 0x2, &(0x7f0000000180)=""/19, 0x13}, 0x3}], 0x1, 0x12000, &(0x7f0000000240)={r0, r1+10000000}) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000001740)={0x11, 0xf, &(0x7f0000001700)="3fbccfcd0d928a729223602c8085da"}) 4m59.375652793s ago: executing program 34 (id=4424): clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f00000001c0)=[{{&(0x7f0000000000)=@ax25={{}, [@remote, @bcast, @rose, @remote, @netrom, @null, @netrom, @netrom]}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/43, 0x2b}, {&(0x7f00000000c0)=""/105, 0x69}], 0x2, &(0x7f0000000180)=""/19, 0x13}, 0x3}], 0x1, 0x12000, &(0x7f0000000240)={r0, r1+10000000}) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000001740)={0x11, 0xf, &(0x7f0000001700)="3fbccfcd0d928a729223602c8085da"}) 3m43.024481112s ago: executing program 5 (id=4710): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808c000281c0040000000000000000118110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe00000000b6090000002000a80700000050000058bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff550000000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000005d9800000000000056000000a80000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x11, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m42.837877431s ago: executing program 5 (id=4713): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x33}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xda3d}, 0x94) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x3f}}, {@smackfsdef={'smackfsdef', 0x3d, 'rfdno'}}, {@subj_role={'subj_role', 0x3d, 'trans=fd,'}}, {@smackfshat={'smackfshat', 0x3d, '('}}, {@euid_lt={'euid<', r3}}, {@fsname={'fsname', 0x3d, '\xc0[%^&-\'!@'}}]}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000071000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="0c000180080001000300010020"], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x20040884}, 0x40000) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) fsconfig$FSCONFIG_SET_BINARY(r2, 0x2, &(0x7f0000000040)='GPL\x00', &(0x7f00000000c0)="f0e330e49f02", 0x6) 3m42.275941367s ago: executing program 5 (id=4714): capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000000)={0x79, 0x0, 0x52f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="08000000003a000090000040"]) 3m41.814556736s ago: executing program 5 (id=4717): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x2010, 0x0) 3m41.692110833s ago: executing program 5 (id=4719): mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x2}, 0x94) sched_setscheduler(0x0, 0x3, &(0x7f0000000180)=0x507) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x1010, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) shmget(0x3, 0x2000, 0x78000000, &(0x7f000030f000/0x2000)=nil) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000000c0), 0x0, 0x0) recvmmsg(r2, &(0x7f0000001e00)=[{{&(0x7f0000000240)=@tipc=@name, 0x0, &(0x7f0000000940)=[{&(0x7f0000000400)=""/119}, {&(0x7f0000000580)=""/224}, {&(0x7f0000000a00)=""/4096}, {&(0x7f0000000680)=""/165}, {&(0x7f0000000740)=""/137}, {&(0x7f00000001c0)}, {&(0x7f0000000800)=""/93}, {&(0x7f0000000880)=""/184}]}, 0x1ff}, {{0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000001a00)=""/101}, {&(0x7f0000001a80)=""/212}, {&(0x7f0000000480)=""/29}, {&(0x7f0000001b80)=""/44}, {&(0x7f0000001bc0)=""/230}, {&(0x7f0000001cc0)=""/178}]}, 0x2}], 0x4000000000001e6, 0x40, 0x0) sched_setscheduler(r1, 0x5, &(0x7f0000000000)=0x6) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r4}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000004180)={0x2020}, 0x19f4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e25}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x12002) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r8, 0xc01864c6, &(0x7f00000003c0)={0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r9) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x34, r11, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x6a}, @val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1374}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x20044000) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x18) 3m38.001865286s ago: executing program 5 (id=4728): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) utime(0x0, 0xfffffffffffffffc) 3m37.666729111s ago: executing program 35 (id=4728): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) utime(0x0, 0xfffffffffffffffc) 43.774355621s ago: executing program 8 (id=5313): openat$ipvs(0xffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pselect6(0x40, &(0x7f0000000080)={0x3, 0x5, 0xf, 0x5, 0x1000, 0x7, 0x0, 0x80}, &(0x7f0000000580)={0x38, 0xd, 0xffff, 0x7, 0x3ff, 0x9, 0x2b27a4b1, 0x1}, 0x0, 0x0, 0x0) r0 = syz_usb_connect$uac1(0x0, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206"], 0x0) syz_usb_control_io(r0, &(0x7f0000001bc0)={0x2c, 0x0, &(0x7f0000000980)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x407}}, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDMKTONE(r1, 0x4b30, 0x3ae5) syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc22e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x5, {0x5, 0x22, "00f400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00030400feff03031208"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001640)={0x44, 0x0, 0x0, 0x0, &(0x7f0000001500)={0x20, 0x81, 0x1, "92"}, 0x0, 0x0, 0x0, 0x0}) 40.752811254s ago: executing program 8 (id=5321): r0 = gettid() mknod(&(0x7f0000000180)='./file0\x00', 0x1ffa, 0x0) acct(&(0x7f0000000140)='./file0\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) unshare(0x22020400) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r1, 0x8010671f, &(0x7f0000000240)={&(0x7f0000000200)}) flistxattr(r3, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000005fc0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYRES8=r1, @ANYRES32=0x0, @ANYRES16=r0], 0x44}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x123481, 0x127) open$dir(0x0, 0x101000, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000001c0)) r6 = syz_open_procfs(r4, &(0x7f0000000040)='net/snmp6\x00') preadv(r6, &(0x7f0000000000)=[{&(0x7f0000001240)=""/4103, 0x1007}], 0x1, 0x15f, 0x0) 39.624587784s ago: executing program 8 (id=5322): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYRES16, @ANYBLOB="0500", @ANYBLOB="3d000e0080000000ffffffffffff080211"], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d2", 0x1, 0xfffffffffffffffe) sendmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@rights={{0x10}}], 0x10, 0x40000}, 0x4000) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 39.414516374s ago: executing program 8 (id=5323): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x5c, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x34, 0x8, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x20}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x5c}, 0x1, 0x700000000000000}, 0x40) 38.953867121s ago: executing program 8 (id=5325): r0 = socket(0x10, 0x803, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x20, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x24040089}, 0x48080) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x400040, 0x120) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000002380)={{0x0, 0x1}, 0x0, 0x8000, 0x4, {0x0, 0x1}, 0x5, 0x800}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) r5 = socket(0x10, 0x803, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="00000806000003"], 0xfdef) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xe032, 0xffffffffffffffff, 0x80000000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000440)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) ptrace(0x10, 0x1) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff7ffb}]}) close_range(r8, 0xffffffffffffffff, 0x0) 38.295896725s ago: executing program 8 (id=5328): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) socket(0x2, 0x80805, 0x0) (async) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) (async) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0x0, 0x20, 0x8f, 0x2, 0x10, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x28}, 0xe) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'macsec0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x37, 0x1, 0x1}}) (async) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'macsec0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x37, 0x1, 0x1}}) close(r2) (async) close(r2) sendmmsg$inet_sctp(r1, &(0x7f00000001c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="30000000020000008400000001000000000000000450da6f09a9ddd9bbbd72d357b8d4a2070020295c938ab5401b3d808ea07ce6e5ad8ab4bae48cbb728057cd5ce151ba78b2df3590d236986d609628f9725a58f0590d4c4e654ed8d9f9df2576ec697c28d80e28b2ea096591320e49c560dbd502bbf3c696e5e290eff768c1833c4b56dc28e446548ea0030f12f59d99c3873315330c3b37997b2aedc630c696ecca783ff237b766c2c768bb4c888a70cc2a65674da4aabd85e996c8b54762506f68eeb2386ea3b0e362818b2fb7ccce122713f49732adf3da402272e5"], 0x30}], 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{r0}, &(0x7f0000000000), &(0x7f0000000040)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000003a26dc96c2064c04a7a05145314a25395f47e3e4d07f783b5d615a9e5cc1e117dfd3482d82fdb4ab74c8498fa526e4562bd2514b1980d63802c8d34bd317235395481e13c69d312714e4ad992d12882b2cab99117c507fca0a4ae2ae2d2017940f3c03df76c171f17386000000007f476a30babf6c887ed9e220d1be744fbb1c1d38946ca8ed4badb59834f51a3f55b828b8e9fe31e7d13db936704ef9e2e330ca335e78fa08d0aa71917358e728c441a621bef2749513fcc39e84ee1a52c6f8882f628f7bef14837088bab64e8753c25771a6439cc80f3d85230abbf2a329d4842a6098c41e9e3ae7a48a8cf86618909a23fc84dd985b0d0918d01e55adb8aee4a7f40858a1ff949653888b59e441c41a93ab4f5ee17cff9c1bd6f5536ef00900990000787d67b8e61a44088da9b0249e06e201d55ecb196f98bb8726ff3d0afca57f1c4ed09aa35d9012cfe285bf18ca8fff4f84a5205785d6d9eb50e63627c35982da17d37c983b173f49913c07c97d47a09db2e61d586a3a9e3c814ce4cf8037212c3e"], 0x48) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cdbb00000000000400000058e9ffff0400000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYRES32, @ANYBLOB="7720fc246ea3213a34d3cd9b1e6b9816496e14f4940603be72b8c22983b6ecf249b63b7fca50d97f992f976f3d359555a7a4302dde484abd5c7b0354d58a21fb5e576d9c", @ANYRES64=0x0], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$rtc(0xffffffffffffff9c, &(0x7f0000000240), 0x16080, 0x0) 23.261230668s ago: executing program 36 (id=5328): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) socket(0x2, 0x80805, 0x0) (async) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) (async) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0x0, 0x20, 0x8f, 0x2, 0x10, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x28}, 0xe) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'macsec0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x37, 0x1, 0x1}}) (async) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'macsec0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x37, 0x1, 0x1}}) close(r2) (async) close(r2) sendmmsg$inet_sctp(r1, &(0x7f00000001c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="30000000020000008400000001000000000000000450da6f09a9ddd9bbbd72d357b8d4a2070020295c938ab5401b3d808ea07ce6e5ad8ab4bae48cbb728057cd5ce151ba78b2df3590d236986d609628f9725a58f0590d4c4e654ed8d9f9df2576ec697c28d80e28b2ea096591320e49c560dbd502bbf3c696e5e290eff768c1833c4b56dc28e446548ea0030f12f59d99c3873315330c3b37997b2aedc630c696ecca783ff237b766c2c768bb4c888a70cc2a65674da4aabd85e996c8b54762506f68eeb2386ea3b0e362818b2fb7ccce122713f49732adf3da402272e5"], 0x30}], 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{r0}, &(0x7f0000000000), &(0x7f0000000040)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000003a26dc96c2064c04a7a05145314a25395f47e3e4d07f783b5d615a9e5cc1e117dfd3482d82fdb4ab74c8498fa526e4562bd2514b1980d63802c8d34bd317235395481e13c69d312714e4ad992d12882b2cab99117c507fca0a4ae2ae2d2017940f3c03df76c171f17386000000007f476a30babf6c887ed9e220d1be744fbb1c1d38946ca8ed4badb59834f51a3f55b828b8e9fe31e7d13db936704ef9e2e330ca335e78fa08d0aa71917358e728c441a621bef2749513fcc39e84ee1a52c6f8882f628f7bef14837088bab64e8753c25771a6439cc80f3d85230abbf2a329d4842a6098c41e9e3ae7a48a8cf86618909a23fc84dd985b0d0918d01e55adb8aee4a7f40858a1ff949653888b59e441c41a93ab4f5ee17cff9c1bd6f5536ef00900990000787d67b8e61a44088da9b0249e06e201d55ecb196f98bb8726ff3d0afca57f1c4ed09aa35d9012cfe285bf18ca8fff4f84a5205785d6d9eb50e63627c35982da17d37c983b173f49913c07c97d47a09db2e61d586a3a9e3c814ce4cf8037212c3e"], 0x48) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cdbb00000000000400000058e9ffff0400000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYRES32, @ANYBLOB="7720fc246ea3213a34d3cd9b1e6b9816496e14f4940603be72b8c22983b6ecf249b63b7fca50d97f992f976f3d359555a7a4302dde484abd5c7b0354d58a21fb5e576d9c", @ANYRES64=0x0], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$rtc(0xffffffffffffff9c, &(0x7f0000000240), 0x16080, 0x0) 11.509189751s ago: executing program 4 (id=5394): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008e88052086800095d8b601020301090212000100000000090401"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000640)={0x2c, &(0x7f00000003c0)={0x40, 0x8, 0x5, "645934fed7"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x93, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0x10, 0xd, [{{0x9, 0x4, 0x0, 0xb8, 0x1, 0x3, 0x1, 0x1, 0x5, {0x9, 0x21, 0x955, 0x1, 0x1, {0x22, 0x601}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x2, 0x6, 0x5}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x200, 0xc, 0x3, 0x1, 0x8, 0x4}, 0x38, &(0x7f0000000140)={0x5, 0xf, 0x38, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xf, 0x8, 0x5, 0xaa}, @ss_container_id={0x14, 0x10, 0x4, 0x5f, "4cde9b0e2afa2b2f696352394b4ab443"}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0xf, 0xe, 0x8}, @wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0xf9, 0x8, 0xb, 0xbf}, @ptm_cap={0x3}]}, 0x4, [{0x5a, &(0x7f0000000180)=@string={0x5a, 0x3, "d2fbbf9f50718b6280eb629dc998f008f14bbb5499e58e74cb73d899f47869b201664ffd66ec9b0a6b803c206c514d840e4b56adf7209b85dcb487f439c2367d4e81c52b57736f6b135b259611381064351601a18e2613df"}}, {0xdd, &(0x7f0000000200)=@string={0xdd, 0x3, "b0d5dde694a0d21022926d74df7c318f1fa653ab096f70012bcfd09ff791d807a30a4f80aaee5b67c606ad7ef5c3299dff73f18bec556f7522c4de37544ec3dcd6967e121e43b31abd6b8c74f36bae017f5568de1f1ae2caff893e381e3bd1e5caee2d432ea15fbf8c4e02df532905e58a8399a093d25151d9664fb388b40d840dae18f1486c05dce80054ad049edab4a4825275d018ae3daec0e76ef85d289748bfa2efc2d4a225a24e8fbc35272516c8b440e847e94dfb034f7b8be22da86a6e822a6e0fc0dc681f977b3dbda5b7d4489f6c807cab9a6982391d"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x41e}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x820}}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MON_GET(r2, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000680)={0x94, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'ip6erspan0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'team0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'eth', 0x3a, 'vxcan1\x00'}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x8004}, 0x40) 8.876204828s ago: executing program 6 (id=5401): r0 = syz_usb_connect(0x2, 0x24, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000003c0)={0x14, &(0x7f00000002c0)={0x0, 0x5, 0xeb, {0xeb, 0x2, "58f12f9b623afc57f4de208cb5c907623a08251d2694a366983c2fb41f4bb40c3530d024b209b568477c07eda0d4ffc34b64873918dd981e6c10e5f5eb3e0cfa71a131a1f91ca9df3faab34f0e283f3769103717c68a8b3285745c8a0699c583c37d84487fc38d538dee26a279382252335c9207f218bc99e6a716c35374e71f14038d28808cdf7c111492ffc3985b1127f9b8a9f5fcd05836e2704b129b23994cdb03df510f18ea14d851ad1106c2b21343ee5cdcebbb99e054633f74d019fd3bde909aa361f9dc8ad6dfb9cd105cb3161bd0ce1258ad2221e4f8e98290b808d39d3d22136e81e8d7"}}, &(0x7f0000000680)={0x0, 0x3, 0x79, @string={0x79, 0x3, "05317ef322f82f4710342b3d806e9f2866be65149fae18f90b26ed552b017f48dffc9c5629d3f92afe7ce4abf2ac060ef8d05eaa07d3a22251a76aba560cbfe92c825381d044ac4081493f85d7ecc123d56962d821c98bfc7e8292b4c7abab005c3d4960e80c9200a5d944953cafba413c375ec3686c3b"}}}, 0x0) r1 = socket$isdn(0x22, 0x2, 0x25) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=""/176, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) recvfrom$inet(0xffffffffffffffff, &(0x7f00000000c0)=""/232, 0xe8, 0x2, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000400)='net/rt_acct\x00') read$proc_mixer(r4, &(0x7f0000000580)=""/109, 0x6d) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'veth1\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0x35, {0x7, @ah_ip4_spec={@rand_addr=0x64010100, @rand_addr=0x64010100, 0x401, 0x8}, @tcp_ip4_spec={@rand_addr=0x64010102, @broadcast, 0x4e20, 0x4e24}, 0x2, 0x3, 0x9, 0x4, 0xfffffffffffffffe}}}) bind$isdn(r1, &(0x7f0000000200)={0x22, 0xfa, 0x8, 0x23, 0x5}, 0x6) 8.486183636s ago: executing program 7 (id=5402): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53", 0x3e}], 0x3}], 0x1, 0x40800) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x8882, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x5a, 0x1, 0x0, 0x0, {}, [@nested={0x8, 0x3, 0x0, 0x1, [@typed={0x4}]}]}, 0x1c}}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) getpid() bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) r7 = creat(&(0x7f0000000100)='./bus\x00', 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) splice(r6, 0x0, r7, 0x0, 0x10000000000016, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0x7040, 0x0) 8.259711321s ago: executing program 4 (id=5403): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = semget$private(0x0, 0x207, 0x0) socket$inet6(0xa, 0x3, 0x5) semctl$GETALL(r3, 0x0, 0xd, 0xfffffffffffffffe) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x208) r5 = accept4(r4, 0x0, 0x0, 0x80000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000180), 0x8) semop(r3, &(0x7f0000000240)=[{0x0, 0xe65b, 0x1800}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001", @ANYBLOB="c2dd06244641ba27ad711907ab6a313a63626475ae36d56f75964123a1f2b82e856b9bbb9e9aa38a2412c1e8a89b78e8ed657e2e39a524124464faf8f904ce4e60b73e5c64fb2a193772e19f8bd7b395bbfe018160ccb1507e5ba7538090ee365d965a9c8d9d76e4505c4f2f49ba236a1f527bd765c43c85b2e1df7b1120ae660e3fffee0f25f496a60fc40aeb7f0dc55720d40c2b8d943771342fe6d6536550608a45427311c736f101d165"], 0x64}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000cc0006"], 0x138}}, 0x4) r8 = syz_usb_connect(0x2, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000001300)=ANY=[@ANYBLOB="0015f700000004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r8, 0x0, &(0x7f00000009c0)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="a7334dab8176423640310d009b59d13292911eabe6776ee91bbffc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7.53250139s ago: executing program 7 (id=5404): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0xe886c5ffc5249171, 0x4, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) syz_usb_connect(0x1, 0x80, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000ce0ab50801222c01e03f0000000109021b0001400000010904"], 0x0) 7.435187709s ago: executing program 6 (id=5406): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x2c, r4, 0x5, 0x0, 0x0, {{0x6, 0x0, 0x8cff}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x2c}}, 0x0) 7.304423788s ago: executing program 6 (id=5407): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x3, 0x0) sched_setattr(0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}, 0x1c) syz_emit_vhci(0x0, 0x7) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x7, 0x0, 0x0, 0x0, 0x4}, 0x94) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b05, &(0x7f00000004c0)={'wlan0\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r3, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 6.566856884s ago: executing program 3 (id=5410): r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000180)='lp\x00', 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[@ANYBLOB="780000001000190026bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="02250000400100001400030076657468315f766972745f776966690008002800", @ANYRES32], 0x78}}, 0x18002) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) (async) write$tcp_congestion(r0, &(0x7f0000000180)='lp\x00', 0x3) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[@ANYBLOB="780000001000190026bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="02250000400100001400030076657468315f766972745f776966690008002800", @ANYRES32], 0x78}}, 0x18002) (async) 6.506316794s ago: executing program 3 (id=5411): r0 = socket$kcm(0x10, 0x2, 0x0) (async) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)={0x34, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x800) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x26e1, 0x0) close(r3) (async) ioctl$SIOCSIFHWADDR(r3, 0x8b15, &(0x7f0000000000)={'wlan1\x00', @random="e51d0f00"}) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000040)) 6.432815242s ago: executing program 6 (id=5412): bpf$BPF_BTF_LOAD(0x25, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="9f1a4af560b0f19942fcfdeb01001800000000000000000000000000000002000000"], 0x0, 0x1a}, 0x28) r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00dbdf2500"/15, @ANYRES32=0x0, @ANYRESHEX=r0], 0x3c}, 0x1, 0x0, 0x0, 0x20004002}, 0x4040000) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000000c0)=0x2f5, 0x4) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0x2, 0x7, 0xfffffff8, 0xd, 0x10, 0x2, 0x8}, &(0x7f0000000100)=0x9c) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000040)={0x2c, &(0x7f0000000080)={0x20, 0x23, 0x1f, {0x1f, 0xa, "a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3027c59ccb7"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x4) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) sendmsg$inet(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000440)="a1de5997d82bde785d2cc2514c366dd23cff9be14f88cdaf3682aba57efa4ab6fc92f21e449c55bf336c2906732accb287a56f6fec29d80197a2de151c7ebb3a00709a87f90ea7cbef47ed0a06062a64e974067142057b4e8f8e576e9f9b1e4bc652199a93a6389bf86c7f880f22bc57768158489dcb915c27bc1d948a32752aa5c8c75c40e5e8c4bf9438bae99f9b4391b6814c178d8d6fd747c90c3150a4069de15149987aa2fb8969e83722990c65e422f28f4315d51cfac61f1d1e5af24fc6ce9cec1043b6f2624852a26816b14c2e8e25f9dfeb6e54eda72ad08237f161820413f1f50aa1e4", 0xe8}, {&(0x7f0000000540)="a2de8fd8dbe8c53ef115c518fe271b617fd6a9c9a7b41b896a38608fdadf88b18475e5f78eb4d803feb59e7d5d55da96f7f65f813690a29933badf605e9cac66c389e288196a46a6dc55d569177a1009ce4f6b81c69156d39498c5024da27fe35420c217dde71dc48cc38c463c16aa6d89cb7f26cdd5a3816bf79456b763fa23f29683aadae00f", 0x87}, {&(0x7f00000006c0)="54672d84eee2b46a8a6111ee6ad90e385f8cde3069259c5f38f080b3c9dbe09b22331b7043f94f51831a7dd749b67ebf1c87f760f69822050c0a309e77cc083fe7292295216c77b1b81f4fcbec8ad376957783fab3dd9eb4b36839f5fe9c629541df1fcc0eb6f8c1859f732dcfc26b81d89165bd52f4445ed55c2ce0f7e663946c97b9caefd7bad92877fb2023a29ec7f30f8e31d1257d7895876276a4d06660f1cd77a51714fc606b4f8d562153c0d1f3caac526c93e09e55dc27f60f17ce413dc891d8bec041866bff63bf07befde3e04c830af47cd95152da86214d234798b132b617fc0599d0afabb8bb40b59cb7a205", 0xf2}, {&(0x7f00000007c0)="fcb9bf385263cd7085d0f3c4438d3a0ea0a1ece039a76cd32edf7748149a9aaef555de363de9b65edac538106124800f7f421b1a73f0f14d50d4ee42ed23625e4e00557be704f2ddbbf8843a6a1786b86438be2357d083b71260af7883218f15a97b9a6d1095d12335279f07f29e40184767d129dd0d02bd5adc477d069fb304c8a0975dc9302aaf1cdaf80f4769ad865e269503dcf90e31417ede37672123b227fa54e68e5b1d13b2e5b49d10095551ef43d76be44d311291e1a917e430bff7ba7d1212b77d1b7b1b32ac4048b7547d3c16188fb75f2b0a", 0xd8}, {&(0x7f00000008c0)="e3214a3260619ed15e47e729fdf8d3c3fcde749f6c7453821afa8ea2abb85ca7288c113fc8817b7ec73e5f90bf3e6a3b34ff5b7fffcff319406ee30666a440b05323df39a0d1298474faa4ed13af84b5e1608faba37d45c15ffcce4089f3728b3b5e04a364639f0432f75a0eb6d91461357f03ced0e71a807c49bca77349b28ddaf2cd12a9aafabc69fd38e01f9205b516a6071071c91306fc7effffaa316d872be5220865b5a6a0c1aa90d7dd9df6ff7b9977e3ad541a23b2dba17ae02ddbf68006a85f46a963329f337a71da3a8066075afd438f2ad8b2", 0xd8}], 0x5, &(0x7f0000000a40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev={0xac, 0x14, 0x14, 0x2c}, @local}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xd0}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}], 0x50}, 0x4000040) r7 = socket$nl_rdma(0x10, 0x3, 0x14) connect$pppoe(0xffffffffffffffff, &(0x7f0000000200)={0x18, 0x0, {0x2, @empty, 'syzkaller0\x00'}}, 0x1e) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073797a3100000000080041007369770014003300626f6e6430"], 0x38}, 0x1, 0x0, 0x0, 0x8801}, 0x20000000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x7d, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000240)={0x2, 0x1000}, 0x4) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40890) syz_open_dev$tty20(0xc, 0x4, 0x0) r8 = socket(0x1e, 0x4, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0x1}}], 0x1, 0x9200000000000000) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, &(0x7f0000000640)=0x2d) 6.317839156s ago: executing program 9 (id=5413): ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) userfaultfd(0x80001) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d032, 0xffffffffffffffff, 0x0) openat$khugepaged_scan(0xffffffffffffff9c, 0x0, 0x1, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x800, 0x5, 0x255}, &(0x7f00000002c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r6 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x4000, 0x100, 0x8}, 0x18) statx(r6, &(0x7f0000000280)='./file0\x00', 0x1000, 0x200, &(0x7f0000000300)) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0xf400) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000080)=ANY=[], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x100000}, 0x10}, 0x94) 5.596845654s ago: executing program 3 (id=5414): socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00', @mcast2, 0x8, 0x3c80, 0x85, 0x400, 0x3, 0x60}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) syz_open_dev$media(0x0, 0x80000006, 0xd01840) socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x202, @private2={0xfc, 0x2, '\x00', 0xff}, 0x4ac2d78a}}, 0x0, 0x0, 0x34, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000040)="1400000052004f030e789e7e27286d000a4149f3", 0x14) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 5.44510325s ago: executing program 9 (id=5415): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1805000000000000"], &(0x7f0000000300)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xd, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x60}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x18}, {0x3, 0x3, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x8, 0xfff8, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x20}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.451084644s ago: executing program 4 (id=5416): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x5) dup(r1) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000000)={0x4, 0x0, 0x10, 0x20, 0x155, &(0x7f00000007c0)="387ed7626d850509a2d6c1aa38f15cd0c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88731b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d461d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a541620000000000000004549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8ddbf5e20d60441304000000cbf881caf811852806175d638909f6234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44504901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab828313501e80d899e9252f99d3a266639438ac5252d9bccff4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d01000100df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60bafd013139929ccfec965c0c769785a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a9013923167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642447bc2195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0xdc, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000100100"/24], 0x18}, 0x0) fchdir(r0) 4.339954399s ago: executing program 9 (id=5417): socket$pppl2tp(0x18, 0x1, 0x1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) syz_init_net_socket$rose(0xb, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYBLOB="080002007f00"], 0x50}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000340)={'pimreg\x00', {0x2, 0x4e23, @empty=0x7f000000}}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="940000000001050500000000000000000a0000003c0002802c00018014000300ff010000efff0000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020000000000000000000000000001"], 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x58}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, &(0x7f0000000300)) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6}) r5 = openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) preadv(r5, 0x0, 0x0, 0x9065, 0x4) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$bind(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x75679573b9fb79a7, 0x0) r6 = socket$inet(0x2, 0xa, 0x1) connect$inet(r6, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r6, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="2000000072003303060000000400000007000000", @ANYRES32=0x0, @ANYBLOB="92efbfb27b5f7abb1adaedf9de283c93d8337e4eb5565f6ee8ef9b064d06a637231629b2e9492a894575baa3eb947508569e253020fb252d296ae54ece96ede10e40a733ad568bdb4dfe2cd232511a78e1749335c0833123abdd96c4587e6d44454845d712"], 0x20}}, 0x20000010) 3.981955005s ago: executing program 7 (id=5418): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r1, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) r2 = getpid() r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r4 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r4, &(0x7f0000001b80)=[{&(0x7f0000000440)=""/87, 0x57}, {&(0x7f0000000500)=""/101, 0x65}], 0x2, 0x0, 0x400) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='clear_refs\x00') r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000000)={r7, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f00000001c0)={r7, @in6={{0xa, 0x4e20, 0x3, @private2, 0xffffffff}}}, 0x90) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000040)={r7, 0x200}, 0x8) writev(r5, &(0x7f0000000140)=[{&(0x7f00000000c0)='2', 0x1}], 0x1) 3.860278201s ago: executing program 9 (id=5419): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_NEWRULE={0x8c, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x60, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x4000000}}, 0xb4}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 3.717336091s ago: executing program 4 (id=5420): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='memory.stat\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) shutdown(0xffffffffffffffff, 0x0) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) r0 = semget$private(0x0, 0x7, 0x180) semctl$SETVAL(r0, 0x0, 0x10, &(0x7f0000000040)) mkdir(0x0, 0x3eb) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, 0x0, 0x1) listxattr(&(0x7f0000001cc0)='./bus\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newspdinfo={0x1c, 0x24, 0x1, 0x70bd29, 0x25dfdbfd, 0x4, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}}, 0x0) mknodat$loop(r1, &(0x7f00000002c0)='./file1\x00', 0x6000, 0x0) 3.5836348s ago: executing program 7 (id=5421): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, 0x0, 0x5, 0x7ff, r0) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, r0) r2 = add_key(&(0x7f0000000080)='.dead\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="931cf2654f90ad356d9f187a9d4a9879d782369c576ce81d6d0fe6e328ab22f2956068c828c01e12f02871f760f93203b322f4e4c8459bffdc8043f3d5b49cc96f70c06df01672ddd32728ed196d9b215397ee5fe8f463256fd590ae72eaed22adea54934b92bab7a504b2d8f8e0010afb7a53176c3044cdfe2861aba8bc12c145900a5632ac7717d0ffc428891d477104aa6ff2e966825e235879f683d1733d68c25eb70d019d32b1a7b9c99affd1c600185e2f2b699dc2c124b584722dde37a0980f0b4b16", 0xc6, r1) r3 = add_key(&(0x7f0000000280)='logon\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)="1925233dbdcc596780f319eb3b4b171a11c5bf1fb255abb896c3ead48f1cf61ea473036fde82ab070485a2e266fb6dfbfd0d165b7428886928b17ca4d0845958ec4aa2861d09a14af0d2b3d7df060a9374e87ecb93281ca1e22c5197fe9d26f83deb9195537a234ee2574bf17b2aa261b4658625275d3161f83dea1becce3a610baa71ad0b4eb28372fab8219d0fa952eae7934c9976", 0x96, r2) keyctl$link(0x8, r3, r1) syz_open_dev$vim2m(&(0x7f00000003c0), 0x8000000000000000, 0x2) keyctl$clear(0x7, r2) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @desc2}, &(0x7f0000000480)={0x0, "337605fbc0b5ff95905d1b04b6b1596e9b9b38fc2f23e9c1d1a709b986185ddaacabdbe0163e4d8536e40dadea24e4c1350f0eca10fbe730e5a12585fa8e3f65", 0x37}, 0x48, r0) keyctl$link(0x8, r4, 0xffffffffffffffff) keyctl$negate(0xd, r0, 0xc72, r3) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000640)={'lo\x00', &(0x7f0000000500)=@ethtool_dump={0x3e, 0x80000001, 0x1c00000, 0xf1, "e5e031c724881bb9123368e4a37b47164d4f7993dadde5c1f03825e0403b480dd4130aea21661c617e3293b97a978b604884335a6281135a53b0261b41bdbf5419b516d25dcad17973db34b366a5bd97a702dd9629bcc26a5523644390a509bab30f536aac6705089be6a42cf33df2d4540d1d34f3ff49eb012030727cbe35e4b988940961e64461c6a514a3cc4001ee691c6a69212f8b904302470927649cae01e72ef2b3d4289c99c9880bc48292b1f219dc20ad1566af30dea0206f30b5ee1868bc86e1e0faab596fbe6cf7fe38af579b9192eda195baca871a16118bd678de516f6b77420f2a5e49949face5be4bd9"}}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000680)='rxrpc\x00', &(0x7f00000006c0)=@chain={'key_or_keyring:', r2}) keyctl$invalidate(0x15, r2) r5 = request_key(&(0x7f0000000700)='encrypted\x00', &(0x7f0000000740)={'syz', 0x3}, &(0x7f0000000780)=':\x00', r2) add_key$fscrypt_v1(&(0x7f00000007c0), &(0x7f0000000800)={'fscrypt:', @desc1}, &(0x7f0000000840)={0x0, "dbdc7471f75b4d0eccf4c55f96dafde04b53c1afaf993bff64b862b506698699fd361621893dbbcc6a75293f5bc6f383f618abb90dbe92083a2e20e63873ac95", 0x1e}, 0x48, 0xfffffffffffffffa) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000900)={0x11c, 0x0, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK={0xc0, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x30e}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9a}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xff}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x4008890}, 0x10) r6 = socket(0x0, 0x3, 0x6) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000ac0), 0x2, 0x0) keyctl$revoke(0x3, r0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000b40)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4, 0x1, 0xfc, 0x0, 0x7, 0x8}, &(0x7f0000000b80)=0x20) getsockopt$EBT_SO_GET_INIT_ENTRIES(r6, 0x0, 0x83, &(0x7f0000000d00)={'filter\x00', 0x0, 0x3, 0xa8, [0x10001, 0x6, 0x1, 0x4, 0x1, 0x9], 0x5, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}], &(0x7f0000000c40)=""/168}, &(0x7f0000000d80)=0x78) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, &(0x7f0000000dc0)={0x3b, 0x24, 0x9, 0x4, 0x9, 0x2, 0x5, 0x0, 0x1}) r7 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) ioctl$USBDEVFS_SETINTERFACE(r7, 0x80085504, &(0x7f0000000e40)={0x401}) keyctl$set_timeout(0xf, r1, 0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000e80), 0x20800, 0x0) preadv(r6, &(0x7f00000021c0)=[{&(0x7f0000000ec0)=""/182, 0xb6}, {&(0x7f0000000f80)=""/133, 0x85}, {&(0x7f0000001040)=""/72, 0x48}, {&(0x7f00000010c0)=""/216, 0xd8}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x5, 0x7ff, 0x3dcd) add_key$user(&(0x7f0000002240), &(0x7f0000002280)={'syz', 0x1}, &(0x7f00000022c0)="cb50fc844201504dfc45603e2480a3f1e06456fbe1bafc2e2b89eba9d3e9", 0x1e, r5) 3.53938947s ago: executing program 9 (id=5422): sched_setscheduler(0x0, 0x5, &(0x7f0000000100)=0x7) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$xdp(0x2c, 0x3, 0x0) r2 = syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679a, 0x400, 0x2000006, 0x3ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, r1, 0x80, &(0x7f0000000180)=@ax25={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x7}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a40), 0x40400, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_usb_connect(0x4, 0xfffffdae, &(0x7f0000001200)=ANY=[@ANYBLOB="1201000228480720d2199010d95c0102030109026c0703000000ff0904b60001ffffff0409050d100002057f0707250101010008090466f30f7ba32a03072406000018e405240002000d240f0140000000060003000008241c0d0003ff0f072414ff0003002a2413095bcfe36a66c8b26de0e16d0f071e0c2f043e9ca65feb2e433eecda457908af7fcf460ac70a2804240200e7047b017197df0fd5645574d4583ed9ee3196325c845d7cfafb9f5d944a08ecb4e980392d16341de7f4ac6b10544b203bb1ee104460ed0abfe4b24f8ae12818cdef542de5925a2945c77fba9c8560331895de3b27cc22444f4e0db317a85112b692582400f3c5a6c1ddc74d47ee57a8e03b0ee0c77cb0ce1591180febca573402139f5bc7cdfed5e4e2bd1048ca11d6b3e21c1ff6b4ba6025cb553889aaa7854fc4b2535eb762a5c8bd6aaa4aaa964ab165d7731626aa7d528461d3d6d289282f9c6f285013c8955c482efb0fed3a0f7a6f025604090359f20ec9a3b8c82404f2014d702e594e0905080020000805040905800008001d98070c11a295ed788e8e8925a8ad09050502ff03010efd85055230231d1de4af0d85998554425e83899528f1815b5c11fefc1350e22e7077391ebf8704fbed3308844ec8f78f61b05d590ddce022c3a278ccce0161a37a01d037f3614e0ab57a21a74714449abe9701994cdc2c5a88c9cb2fb05a7255202ff91986e213057d49efb1917e9c2ab5e55dc1efe18775e314310b6e6aa6494ab1bee00abe09050d010800040108072501011306000905000c0004101005b622fd1a103b00a24fcb5344283060b29d0b85bd93c8c14f0c32989a918f553fddbdd830206f5f79476549a558d436fb5aba68ee74bded581af88ea73343c33726896123e72a73fa6e0f4691382a2a84ff166523a42e13d225379f2118c8aeb5024f4662ade4ef04f8f0b2f7a5b2615b8be942808bd478c182224a595dce143689ea0da4b4b0f52e3f111b22ef30a41f1916fdf74660743abce6b857cf790d2f6b4047fd6dacba38bb78f7090503044000000de3090500002000500235090503106000090081072501851a5cc11d0dce1344fe49e0b86632c4dfef105fb8018493b8f3d8a1807c277b0f09050e01ff0381020209050901ff035205059211657028efef3da697719d901b9ea10b498ddcfc5ef0c3828d34dfe37dfe65623077de856bdafab110ff2a6b2a2f4fb77ca4b5ba59fbfc392b7b81a4e12f47fb0dffb359c01085c91ea51d0310d358e0848895253314d2b5f339f1ac36ef9b194cacef54c35337c8ab4c1fc4d1da71b0fdb341e4d88bbbfd92dd168a672caf20dbf523e56e63f47f71cf1c93826d6bd43d09050a0a000206021509050f00ff030206020725018004020007250103e500800905090c2000070ac1072501800604000905000120007504cb120cffd74e105e4a0e40059bbd440d1ce6a00725010003ef00090507100004c4f6087f21912b73106cf47f9b633b98672d6a703811db6e55df15067be24ffce9bbae014a2c2e52296e818a6711609384b8f52f92a99d80ba5a4893f2ad97ff232af98b2db84d3e55d574df1f8bda984f292e7177068ba67328924e31dd817fabcbae8900d9c806b34ca379defbe7bbc04f6976f8b873de41ba8641243519c5bae90508282e9c0904d80409faab83101d03baaf382a70992a319fb61aec1ddc96881b9b8933fd3634d5efb22a00240600007872002400080000240f01620b0000ff0380009200241362f50b6997685bf5d6448b212e1d51e38bf410ae2e4ec45fe164901b8991d39bfae0a10300000000000000d5d04b4c5d0f42a752bb9bebc831e97d51e626b1f758706c80d8653b04e87baa0a5b9b7cb97d5e205151080e0ee282c369b415f258483be5d788f62fb3afe979c6e203ecd05fbbfdce1a5fdbb0f730e76077f90024020200241308dd713617b38d9983e5a0ca9f9e85e1c02bbe4aea6296a1857787414c3ad04029c1da39a193a65cddda55d40f7109b05eb13b8a899bbe328f111bf583562aaae24696448910c1dfb0cfeb4ba3b122dc6b3b3fc3266eb906e7d4ccce9a965c6c24f99b13d7903c3ae8c3c3d15e1f862a295a7b210857386ea0ed8859ca21362c9b3a1c723efd3166bcc1d9fa0be90c65b6ed3f6ecf5d80696e5b5de227fb9b053bcec74bc50f47df1d6123710a4428aba6adca893c06d2b0baf62267d9d34875df373d00240a0807030709050d044000060708072501000ecb03450e770e4e5b665c1c6e007787a28c045a3e3686c59408cec61b079f032622c36f409c1b9017960cb9f9d54da1954f6b7861118b7e95fa161faf26b8139352f4537069735b09050410200008920007250100090400072501820e2373090500001000044902072501010102000011b0dd181c8bb63784a07dfc4e23c5d8436430e612d8ec7b6ccf9dfad183df993c7dbb23f217fd5a5e26e700fea2c05a1223a443fc9bc3d70334a3ae96f5d79e7e0905020008004004bc09050c1000021007006c08b3ed0d19a589ef523a97c0b518b33fb81b7bf614bf3c75bf29ad026b86781dede71c415781880e55653421a2f9deb92d255871d62de86f4dbcb032071589f055f5a74a2336250712ed578e08d1a1c6ce151f6d4522b7e79ca9e1793df7dfc5d6a59364a5bbfca9ec19b80725010009040009050c000800f50000ea21f2fbf37f2e89cf8b5eaa2aa61864260ef91161f0ba3eda9925a9089e6f1d4e0977ced206f4f1dbdf95906a9f3088809d1adb2b4888d1b31ddb53e53916905e085873a67f14ef3c530f1fdfdfa3527a60ff1083d658c3850f205973eaff9dd9a65dafcc811b2baefa2a1ad935b5261e01a47302adafba4fdfeaf9332f1b660cdc95a01f468d10f74e98351cad7841603230a54be769a0b2f0990c4a7916cf3f03a1cf3d811d63e897d571ad9383f05fe9047276382c7f18ff0cce77cc1a91b7bcce9c562c0722eb8320e5ccc544ecf7e717ff028be7939cc19a03a8e21e6c5c5a55440caa1d0bbe105621bbfaee4446d57000bbf2f64770cf58f72d01fa8cfc0436fdd9e3dc3b5a532a719f1612c8d995bf211cebd28c58c02d0e1dc81a36751f4436772a15673d6bf4c0949893972ad1dc7e3ddef69008683b877c10a25f09050504400001010e18003a7550d703424e14d3fbe2be7ae1df706dc77fd70821090505004000030902090509101000058104"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r7, 0x4048ae9b, &(0x7f0000000300)={0x70001, 0x0, [0x40000000000, 0x64f, 0x6, 0x6, 0xfffffffffffffffc, 0x4ffff, 0x29]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f0000000040)={0x1000, 0x14000}) sched_setattr(0x0, 0x0, 0x0) r8 = syz_open_dev$sndctrl(0x0, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f00000000c0)=0x2) r9 = openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) r10 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDCTL_DSP_GETOSPACE(r9, 0x8010500c, &(0x7f0000000040)) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r10, 0x4112, 0x0) ioctl$SNDCTL_DSP_POST(r9, 0x5008, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) 3.42138304s ago: executing program 4 (id=5423): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x203}, 0x94) r3 = syz_open_dev$sndctrl(0x0, 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x0, @fd, 0x0, 0x20000000, 0x801e, 0x0, 0x1, {0x1}}) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r4 = syz_open_dev$video(&(0x7f00000002c0), 0x20000000005, 0x8100) ioctl$VIDIOC_CROPCAP(r4, 0xc02c563a, &(0x7f0000000000)={0x9, {0x7f, 0xe7, 0xfffffff8, 0xfffff000}, {0x2, 0x3, 0xffffbfff, 0xfff}, {0x40, 0x5}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000280)={{0x7, 0x0, 0x0, 0xf07, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x4, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffef7bfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0xffffffffffffffff, 0x40, 0x0, 0xfffffffffffffffd, 0x7fffffff, 0xb, 0x6, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xb, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x1000000000, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0xfff, 0x2, 0x0, 0x100, 0x81, 0xfffffffffffffffd, 0x5a744889, 0x0, 0x0, 0x2, 0x100000000000, 0x0, 0x3, 0x2, 0x0, 0x7, 0xc0c0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r2) sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r5, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {0xf000000}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x20000010) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYRESHEX, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB="2c3b467e3cb9601e4af8", @ANYRESDEC=0x0, @ANYBLOB="1af47fbf6bfc87b297d78f6a4d8606c5fd0139c4e8ad4328901d8b79db6d68c1b795af6d523177d80eabe898c506483839c4870f338a7224adf1473f64e2ed3a624d41d73031e2669bf30ffc9d30b91c7493c047b2d510b16a9b8398e67ad83d82c72b5c6e772cb2b350e673aa14aa34e71c5345d489352d6f5abc07332f3c75b9a1fa3ea0058603048809c5"]) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 2.776493308s ago: executing program 3 (id=5424): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) eventfd(0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x4, 0x541102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6(0xa, 0x1, 0x8010000000000084) syz_open_dev$usbfs(0x0, 0x77, 0x101301) mkdir(0x0, 0x0) chdir(0x0) gettid() sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xdc}}, 0x8000) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002200)='/proc/vmallocinfo\x00', 0x0, 0x0) lseek(r1, 0xe, 0x1) close(0xffffffffffffffff) 2.376057648s ago: executing program 3 (id=5425): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0xfea000, 0x2000402) pwritev2(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)="780f", 0x2}], 0x1, 0xfffffff9, 0x0, 0x0) lseek(r0, 0x5, 0x3) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000300)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$TIOCSPTLCK(r3, 0x40045431, &(0x7f0000000000)) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000200)=0x1b) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x3) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') openat2(r5, &(0x7f0000000080)='./cgroup/../file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x10}, 0x18) ppoll(&(0x7f0000000100)=[{r3, 0xcc}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETSF2(r4, 0x402c542d, &(0x7f0000000040)={0x8, 0x2, 0xfffffffb, 0xe, 0x0, "14083a9e613314635ee1f09dffbacac1475bbe", 0x9, 0x74}) dup(r2) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)={0x28, 0x140a, 0x20, 0x70bd2b, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x28}}, 0x400c0c0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000000c0)={0x0, 0xfffffffc, 0x0, &(0x7f0000000240)=""/75, 0x0}) r7 = dup(r6) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x0, r7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1000001) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000000)={0xc, 0x0}) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f00000000c0)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x3, r8, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x80000000}) 2.332982235s ago: executing program 6 (id=5426): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000000380)={0x0, 0x1, 0xbe}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000040)={0x32b, @time={0x6, 0x7}, 0xff, {0x0, 0x7f}, 0x0, 0x2}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0x20000000005) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) r6 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) recvmmsg(r6, &(0x7f0000003c40)=[{{0x0, 0x0, 0x0}, 0x400}], 0x1, 0x10142, 0x0) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=0x0, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e"], 0x6c}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x4924b68, 0x0) ioctl$KVM_CAP_X86_NOTIFY_VMEXIT(r7, 0x4068aea3, &(0x7f0000000300)={0xdb, 0x0, 0x8c1}) 1.444074754s ago: executing program 7 (id=5427): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r4}, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x880}, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) r6 = open(0x0, 0x6c143, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cd00000000000004000000850000000500000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r9, r10, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r9}, &(0x7f00000006c0), &(0x7f0000000700)=r8}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) sendmsg$unix(r7, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="e68700", 0x3}], 0x1, 0x0, 0x0, 0x44190}, 0x2004c001) setsockopt$inet_tcp_TLS_TX(r6, 0x6, 0x1, &(0x7f0000000380)=@ccm_128={{0x304}, "cd0f9bcdc8292bb9", "a884b8acbab5d8416c9479d9ec75f9c5", "09011ee8", "4284ef20778207a0"}, 0x28) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) socket$nl_route(0x10, 0x3, 0x0) 348.45499ms ago: executing program 7 (id=5428): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0xe886c5ffc5249171, 0x4, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) syz_usb_connect(0x1, 0x80, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000ce0ab50801222c01e03f0000000109021b0001400000010904"], 0x0) 258.994009ms ago: executing program 4 (id=5429): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010037"], 0x1c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r2}, 0x18) connect$can_j1939(r0, &(0x7f0000000080)={0x1d, r2, 0x0, {0x0, 0xf0, 0x2}, 0x1}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) r3 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200080, 0x0) r4 = socket$key(0xf, 0x3, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x0, 0x4, 0x80000c1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32=r4, @ANYRES32, @ANYBLOB="ac21fc3ebf016d7b00"/18, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"'], 0x50) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f0000000180)={'c6xdigio\x00', [0x4, 0x10, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x7ff, 0xffd, 0x7ffe, 0x400, 0x3, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000140)={0x4000000, 0xffb8, 0x0, 0x0, 0x80000040}) 79.367662ms ago: executing program 6 (id=5430): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3d}}], 0x2c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000208400789eedf5e508766e14aa000000002000000000000000840000000800000020"], 0x38, 0x4855}, 0x24000052) 76.689892ms ago: executing program 3 (id=5431): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYRES16, @ANYBLOB="0500", @ANYBLOB="3d000e0080000000ffffffffffff080211"], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a", 0x2, 0xfffffffffffffffe) sendmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x40000}, 0x4000) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 9 (id=5432): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x1, &(0x7f0000000140)={0xa, 0x7}, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x4, 0x7, 0xfe}]}) (async, rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x3}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x7, 0xffffff80, 0x5, 0x6dd3, 0x9d50}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) (async, rerun: 32) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x121a02, 0x0) writev(r2, &(0x7f0000000640)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) (async) socket(0x14, 0x2, 0xfffffffc) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) (async) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x71) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095", @ANYRES16], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) (async) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0x400017e) r4 = creat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x104) r5 = fanotify_init(0xf00, 0x40000) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4000009}, 0x801) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) fanotify_mark(r5, 0x105, 0x4000997d, r4, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ff9}]}) close_range(r6, 0xffffffffffffffff, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) (async, rerun: 32) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="15000000", @ANYRES16=r7, @ANYBLOB="310428bd7000fdffffff16000000"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000828bd7000fddbdf2512000000080009000300000008001c155600005e100f610d0008000900030000000800080007000000080009000800000008004700feffffff"], 0x44}, 0x1, 0x0, 0x0, 0x44805}, 0x4885) kernel console output (not intermixed with test programs): reconnect [ 1512.322224][ T5858] usb 9-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1512.345066][ T5858] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1512.346240][ T24] usb 7-1: USB disconnect, device number 81 [ 1512.354248][ T5858] usb 9-1: Product: syz [ 1512.379577][ T5858] usb 9-1: Manufacturer: syz [ 1512.388077][ T5858] usb 9-1: SerialNumber: syz [ 1512.607903][ T5858] usb 9-1: config 0 descriptor?? [ 1512.621721][ T5858] smsc75xx v1.0.0 [ 1513.598927][T12958] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1513.787277][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1513.806158][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1513.818960][T12958] usb 8-1: Using ep0 maxpacket: 16 [ 1513.825353][T12958] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1513.836621][T12958] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1513.846738][T12958] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1513.860559][T12958] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1513.869748][T12958] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1513.880388][T12958] usb 8-1: config 0 descriptor?? [ 1513.918950][T19647] usb 7-1: new full-speed USB device number 82 using dummy_hcd [ 1514.016859][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 1514.035870][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 1514.046127][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1514.056604][ T5858] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 1514.066928][ T5858] smsc75xx 9-1:0.184: probe with driver smsc75xx failed with error -32 [ 1514.091859][T19647] usb 7-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1514.102278][T19647] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1514.113329][T19647] usb 7-1: config 0 descriptor?? [ 1514.295746][T12958] shield 0003:0955:7214.002F: unknown main item tag 0x0 [ 1514.309041][T12958] shield 0003:0955:7214.002F: unknown main item tag 0x0 [ 1514.316260][T12958] shield 0003:0955:7214.002F: unknown main item tag 0x0 [ 1514.329090][T12958] shield 0003:0955:7214.002F: unknown main item tag 0x0 [ 1514.336203][T12958] shield 0003:0955:7214.002F: unknown main item tag 0x0 [ 1514.488076][T12958] input: HID 0955:7214 Haptics as /devices/virtual/input/input53 [ 1514.498275][T32372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1514.520000][T32372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1514.541518][T12958] shield 0003:0955:7214.002F: Registered Thunderstrike controller [ 1514.552545][T12958] shield 0003:0955:7214.002F: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.7-1/input0 [ 1514.678461][ T30] audit: type=1800 audit(2000000438.540:1905): pid=32372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.7.4972" name="file0" dev="overlay" ino=586 res=0 errno=0 [ 1514.710012][T21487] usb 8-1: USB disconnect, device number 18 [ 1514.741654][T12958] shield 0003:0955:7214.002F: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1514.762013][T12958] shield 0003:0955:7214.002F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1514.779498][T12958] shield 0003:0955:7214.002F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1514.796444][T12958] shield 0003:0955:7214.002F: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1514.942563][T19647] pegasus 7-1:0.0: probe with driver pegasus failed with error -32 [ 1515.667338][T21487] usb 9-1: USB disconnect, device number 13 [ 1515.834237][T32439] netlink: 'syz.3.4980': attribute type 10 has an invalid length. [ 1515.853502][T32439] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4980'. [ 1515.863157][T32439] dummy0: entered promiscuous mode [ 1515.868792][T32439] bridge0: port 3(dummy0) entered blocking state [ 1515.877561][T32463] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4983'. [ 1515.887161][T32439] bridge0: port 3(dummy0) entered disabled state [ 1515.896026][T32439] dummy0: entered allmulticast mode [ 1515.908768][T32439] bridge0: port 3(dummy0) entered blocking state [ 1515.915185][T32439] bridge0: port 3(dummy0) entered forwarding state [ 1516.251151][T32470] netlink: 20 bytes leftover after parsing attributes in process `syz.7.4985'. [ 1516.739696][T21487] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 1516.841550][T32389] delete_channel: no stack [ 1516.855409][T32480] netlink: 'syz.3.4988': attribute type 10 has an invalid length. [ 1516.870172][T12958] usb 7-1: USB disconnect, device number 82 [ 1516.909463][T21487] usb 8-1: Using ep0 maxpacket: 32 [ 1516.924148][ T30] audit: type=1400 audit(2000000440.720:1906): avc: denied { bind } for pid=32479 comm="syz.3.4988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1516.958378][T32480] bridge0: port 3(dummy0) entered disabled state [ 1516.974254][T32480] dummy0: left allmulticast mode [ 1517.003865][T32480] dummy0: left promiscuous mode [ 1517.035046][T21487] usb 8-1: config 0 has an invalid interface number: 58 but max is 0 [ 1517.041663][T32480] bridge0: port 3(dummy0) entered disabled state [ 1517.075993][T21487] usb 8-1: config 0 has no interface number 0 [ 1517.082798][T21487] usb 8-1: config 0 interface 58 has no altsetting 0 [ 1517.092737][T21487] usb 8-1: New USB device found, idVendor=0711, idProduct=0902, bcdDevice=43.1b [ 1517.102255][T21487] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1517.111073][T21487] usb 8-1: Product: syz [ 1517.115530][T21487] usb 8-1: Manufacturer: syz [ 1517.120667][T21487] usb 8-1: SerialNumber: syz [ 1517.143856][T21487] usb 8-1: config 0 descriptor?? [ 1517.151786][T21487] sisusb 8-1:0.58: Invalid USB2VGA device [ 1517.157522][T21487] sisusb 8-1:0.58: probe with driver sisusb failed with error -22 [ 1517.331770][T32480] team0: Port device dummy0 added [ 1517.964667][T21487] usb 8-1: USB disconnect, device number 19 [ 1518.717075][ T30] audit: type=1400 audit(2000000442.030:1907): avc: denied { shutdown } for pid=32516 comm="syz.8.4992" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1518.754076][ T30] audit: type=1400 audit(2000000442.190:1908): avc: denied { read } for pid=32516 comm="syz.8.4992" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1520.052758][T32539] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4997'. [ 1520.771272][T32535] lo speed is unknown, defaulting to 1000 [ 1521.736350][T19647] usb 7-1: new full-speed USB device number 83 using dummy_hcd [ 1521.952919][T19647] usb 7-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1521.962157][T19647] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1521.988055][T19647] usb 7-1: config 0 descriptor?? [ 1522.811826][T19647] pegasus 7-1:0.0: probe with driver pegasus failed with error -32 [ 1522.908990][T12960] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1523.204051][T12960] usb 5-1: Using ep0 maxpacket: 32 [ 1523.343806][T12960] usb 5-1: config 0 has an invalid interface number: 58 but max is 0 [ 1523.355888][T12960] usb 5-1: config 0 has no interface number 0 [ 1523.362594][T12960] usb 5-1: config 0 interface 58 has no altsetting 0 [ 1523.677370][T12960] usb 5-1: New USB device found, idVendor=0711, idProduct=0902, bcdDevice=43.1b [ 1523.695514][T12960] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1523.707798][T12960] usb 5-1: Product: syz [ 1523.792654][T12960] usb 5-1: Manufacturer: syz [ 1523.797638][T12960] usb 5-1: SerialNumber: syz [ 1523.805738][T12960] usb 5-1: config 0 descriptor?? [ 1523.901769][T12960] sisusb 5-1:0.58: Invalid USB2VGA device [ 1523.912318][T12960] sisusb 5-1:0.58: probe with driver sisusb failed with error -22 [ 1524.183710][T21487] usb 5-1: USB disconnect, device number 94 [ 1524.722858][T32634] delete_channel: no stack [ 1524.728519][T19647] usb 7-1: USB disconnect, device number 83 [ 1525.008935][ T30] audit: type=1400 audit(2000000448.870:1909): avc: denied { write } for pid=32649 comm="syz.3.5011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1525.068711][T32666] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5011'. [ 1525.969459][ T30] audit: type=1400 audit(2000000449.790:1910): avc: denied { write } for pid=32687 comm="syz.8.5015" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1526.420583][T32699] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5017'. [ 1526.449200][T32699] netlink: 176 bytes leftover after parsing attributes in process `syz.3.5017'. [ 1526.476583][ T30] audit: type=1400 audit(2000000450.330:1911): avc: denied { name_connect } for pid=32692 comm="syz.3.5017" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1528.162725][ T30] audit: type=1400 audit(2000000452.010:1912): avc: denied { write } for pid=32712 comm="syz.8.5021" name="sg0" dev="devtmpfs" ino=776 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1528.731584][ T30] audit: type=1400 audit(2000000452.590:1913): avc: denied { unmount } for pid=13544 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1529.886950][T32730] overlayfs: missing 'lowerdir' [ 1529.940716][T32730] overlayfs: missing 'lowerdir' [ 1530.219020][T12958] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1530.378154][T12958] usb 4-1: Using ep0 maxpacket: 16 [ 1530.385997][T12958] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 1530.397120][T12958] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1530.408000][T12958] usb 4-1: config 0 has no interface number 0 [ 1530.417241][T12958] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice=81.28 [ 1530.427262][T12958] usb 4-1: New USB device strings: Mfr=0, Product=27, SerialNumber=3 [ 1530.442874][T12958] usb 4-1: Product: syz [ 1530.447130][T12958] usb 4-1: SerialNumber: syz [ 1530.483675][T12958] usb 4-1: config 0 descriptor?? [ 1530.504000][T12958] usb 4-1: Found UVC 0.00 device syz (046d:08f3) [ 1530.628924][T12958] usb 4-1: No valid video chain found. [ 1530.777557][ T30] audit: type=1400 audit(2000000454.640:1914): avc: denied { setopt } for pid=32729 comm="syz.3.5026" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1531.085604][T21487] usb 4-1: USB disconnect, device number 6 [ 1531.178963][T12960] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1531.459839][T12960] usb 9-1: no configurations [ 1531.465288][T12960] usb 9-1: can't read configurations, error -22 [ 1531.758925][T12960] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1531.950347][T12960] usb 9-1: no configurations [ 1531.955106][T12960] usb 9-1: can't read configurations, error -22 [ 1531.962026][T12960] usb usb9-port1: attempt power cycle [ 1532.197805][ T315] qnx4: no qnx4 filesystem (no root dir). [ 1532.206818][ T30] audit: type=1400 audit(2000000456.060:1915): avc: denied { mounton } for pid=311 comm="syz.3.5032" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 1532.307981][ T317] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5033'. [ 1532.328890][T12960] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1532.330101][ T317] openvswitch: netlink: nsh attribute has 2338 unknown bytes. [ 1532.344977][ T317] openvswitch: netlink: Actions may not be safe on all matching packets [ 1532.390006][T12960] usb 9-1: no configurations [ 1532.396857][T12960] usb 9-1: can't read configurations, error -22 [ 1532.481948][ T322] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5035'. [ 1532.539460][T12960] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1532.615587][T12960] usb 9-1: no configurations [ 1532.620338][T12960] usb 9-1: can't read configurations, error -22 [ 1532.627928][T12960] usb usb9-port1: unable to enumerate USB device [ 1532.675617][ T30] audit: type=1400 audit(2000000456.520:1916): avc: denied { bind } for pid=321 comm="syz.7.5035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1532.771667][ T30] audit: type=1400 audit(2000000456.590:1917): avc: denied { setopt } for pid=321 comm="syz.7.5035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1534.154725][T11599] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1534.424460][T11599] usb 4-1: Using ep0 maxpacket: 8 [ 1534.434959][T11599] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1534.460219][T11599] usb 4-1: New USB device found, idVendor=056a, idProduct=00ec, bcdDevice= 0.00 [ 1534.470188][T11599] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.493971][T11599] usb 4-1: config 0 descriptor?? [ 1534.569032][T21487] usb 7-1: new high-speed USB device number 84 using dummy_hcd [ 1534.827434][ T30] audit: type=1400 audit(2000000458.600:1918): avc: denied { getopt } for pid=362 comm="syz.4.5041" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1534.882398][T21487] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1534.894417][T21487] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1534.916665][T21487] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 1535.009747][T21487] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1535.069363][T21487] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 1535.103215][ T363] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1535.153373][T21487] usb 7-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 1535.163432][T21487] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1535.174715][T21487] usb 7-1: Product: syz [ 1535.189841][T21487] usb 7-1: Manufacturer: syz [ 1535.194620][T21487] usb 7-1: SerialNumber: syz [ 1535.207986][T11599] wacom 0003:056A:00EC.0030: unknown main item tag 0x3 [ 1535.248187][T21487] usb 7-1: config 0 descriptor?? [ 1535.254941][ T355] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1535.276426][ C1] usb 7-1: NFC: Urb failure (status -71) [ 1535.291966][T21487] usb 7-1: NFC: Unable to get FW version [ 1535.308437][T21487] pn533_usb 7-1:0.0: probe with driver pn533_usb failed with error -90 [ 1535.475932][ T355] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 1535.519718][T21487] usb 7-1: USB disconnect, device number 84 [ 1537.134146][ T30] audit: type=1400 audit(2000000460.730:1919): avc: denied { create } for pid=389 comm="syz.6.5045" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1537.160160][ T30] audit: type=1400 audit(2000000460.740:1920): avc: denied { write } for pid=389 comm="syz.6.5045" path="socket:[101296]" dev="sockfs" ino=101296 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1537.968385][T12958] usb 4-1: USB disconnect, device number 7 [ 1538.452891][ T428] netlink: 296 bytes leftover after parsing attributes in process `syz.7.5050'. [ 1538.466612][ T30] audit: type=1400 audit(2000000462.320:1921): avc: denied { nlmsg_read } for pid=420 comm="syz.7.5050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1538.803909][ T30] audit: type=1400 audit(2000000462.420:1922): avc: denied { ioctl } for pid=424 comm="syz.6.5052" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=101847 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1539.400512][ T30] audit: type=1400 audit(2000000462.710:1923): avc: denied { watch watch_reads } for pid=425 comm="syz.3.5051" path="/379" dev="tmpfs" ino=2016 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1539.423424][ C1] vkms_vblank_simulate: vblank timer overrun [ 1540.416890][T21487] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1540.447413][ T451] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5055'. [ 1540.516080][ T30] audit: type=1400 audit(2000000464.370:1924): avc: denied { mount } for pid=453 comm="syz.7.5058" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1540.550498][T21487] usb 4-1: device descriptor read/64, error -71 [ 1541.338615][ T30] audit: type=1400 audit(2000000464.580:1925): avc: denied { mounton } for pid=453 comm="syz.7.5058" path="/124/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 1541.440670][T21487] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1541.449450][ T30] audit: type=1400 audit(2000000464.780:1926): avc: denied { getopt } for pid=457 comm="syz.8.5059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1541.492449][ T464] netlink: 40 bytes leftover after parsing attributes in process `syz.6.5060'. [ 1541.627538][ T468] netlink: 48 bytes leftover after parsing attributes in process `syz.8.5061'. [ 1541.732333][ T464] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=36 sclass=netlink_tcpdiag_socket pid=464 comm=syz.6.5060 [ 1541.761256][ T30] audit: type=1400 audit(2000000465.610:1927): avc: denied { mounton } for pid=453 comm="syz.7.5058" path="/" dev="pstore" ino=3380 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=dir permissive=1 [ 1541.932321][ T471] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1541.943395][ T471] overlayfs: maximum fs stacking depth exceeded [ 1542.729771][T21487] usb 4-1: device descriptor read/64, error -71 [ 1542.953042][T21487] usb usb4-port1: attempt power cycle [ 1542.999143][ T30] audit: type=1400 audit(2000000466.860:1928): avc: denied { unmount } for pid=28308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 1543.073676][ T30] audit: type=1400 audit(2000000466.910:1929): avc: denied { unmount } for pid=28308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1543.191102][ T433] delete_channel: no stack [ 1543.204027][ T30] audit: type=1400 audit(2000000466.930:1930): avc: denied { ioctl } for pid=476 comm="syz.8.5062" path="socket:[101992]" dev="sockfs" ino=101992 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1543.229351][ C0] vkms_vblank_simulate: vblank timer overrun [ 1543.269014][ T30] audit: type=1400 audit(2000000466.930:1931): avc: denied { create } for pid=476 comm="syz.8.5062" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=irda_socket permissive=1 [ 1544.029763][ T30] audit: type=1400 audit(2000000467.870:1932): avc: denied { getopt } for pid=500 comm="syz.8.5066" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1544.339002][ T30] audit: type=1400 audit(2000000468.180:1933): avc: denied { mount } for pid=505 comm="syz.3.5067" name="/" dev="autofs" ino=102019 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1544.438277][ T30] audit: type=1400 audit(2000000468.260:1934): avc: denied { unmount } for pid=18966 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1544.986639][ T30] audit: type=1400 audit(2000000468.840:1935): avc: denied { accept } for pid=519 comm="syz.7.5071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1545.269520][T19647] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1545.408867][T12960] usb 7-1: new high-speed USB device number 85 using dummy_hcd [ 1545.461658][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.879570][T19647] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1546.212699][T19647] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1546.226413][T19647] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1546.237079][T19647] usb 4-1: config 0 descriptor?? [ 1546.346776][T12960] usb 7-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=26.50 [ 1546.452509][T12960] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.460716][T12960] usb 7-1: Product: syz [ 1546.464983][T12960] usb 7-1: Manufacturer: syz [ 1546.470131][T12960] usb 7-1: SerialNumber: syz [ 1546.498532][ T541] random: crng reseeded on system resumption [ 1546.524122][ T30] audit: type=1400 audit(2000000470.340:1936): avc: denied { lock } for pid=534 comm="syz.4.5073" path="socket:[102516]" dev="sockfs" ino=102516 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1546.552685][T12960] usb 7-1: config 0 descriptor?? [ 1546.589888][T12960] usb 7-1: Waiting for MOTU Microbook II to boot up... [ 1546.600249][ T30] audit: type=1400 audit(2000000470.360:1937): avc: denied { read write } for pid=534 comm="syz.4.5073" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1546.602154][T12960] usb 7-1: failed setting the sample rate for Motu MicroBook II: -22 [ 1546.638942][T12960] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1546.655192][T19647] lenovo 0003:17EF:6047.0031: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.3-1/input0 [ 1547.591366][ T521] netlink: 'syz.3.5070': attribute type 10 has an invalid length. [ 1547.600570][ T521] netlink: 'syz.3.5070': attribute type 10 has an invalid length. [ 1547.782259][T19647] lenovo 0003:17EF:6047.0031: Fn-lock setting failed: -71 [ 1547.791456][T19647] lenovo 0003:17EF:6047.0031: Sensitivity setting failed: -71 [ 1547.913024][T19647] usb 4-1: USB disconnect, device number 11 [ 1549.013561][T11599] usb 7-1: USB disconnect, device number 85 [ 1549.342198][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1549.342232][ T30] audit: type=1326 audit(2000000473.130:1939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1549.884071][ T30] audit: type=1326 audit(2000000473.130:1940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=106 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1549.908351][ T30] audit: type=1326 audit(2000000473.140:1941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1549.939317][T19647] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1549.949495][ T30] audit: type=1326 audit(2000000473.140:1942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.003434][ T30] audit: type=1326 audit(2000000473.140:1943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.029723][ T30] audit: type=1326 audit(2000000473.140:1944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.138421][ T622] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=622 comm=syz.8.5078 [ 1550.180506][ T30] audit: type=1326 audit(2000000473.140:1945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.209326][T19647] usb 4-1: Using ep0 maxpacket: 32 [ 1550.214568][ T30] audit: type=1326 audit(2000000473.140:1946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.240002][ T30] audit: type=1326 audit(2000000473.140:1947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1550.264219][ T30] audit: type=1326 audit(2000000473.150:1948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=598 comm="syz.3.5080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7d0778d550 code=0x7ffc0000 [ 1550.288296][T19647] usb 4-1: config 0 has an invalid interface number: 155 but max is 0 [ 1550.357210][T19647] usb 4-1: config 0 has no interface number 0 [ 1550.375577][T19647] usb 4-1: New USB device found, idVendor=05ac, idProduct=0274, bcdDevice=a7.4c [ 1550.642199][T19647] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1550.873754][T19647] usb 4-1: Product: syz [ 1550.877946][T19647] usb 4-1: Manufacturer: syz [ 1550.889058][T19647] usb 4-1: SerialNumber: syz [ 1550.921547][T19647] usb 4-1: config 0 descriptor?? [ 1552.222225][T19647] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.155/input/input54 [ 1552.581861][T19647] usb 4-1: USB disconnect, device number 12 [ 1552.896427][ T665] netlink: 'syz.3.5088': attribute type 4 has an invalid length. [ 1553.841542][ T678] netlink: 'syz.4.5092': attribute type 4 has an invalid length. [ 1553.899633][T21487] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1554.053634][ T683] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5093'. [ 1554.138166][T21487] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1554.199488][T21487] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1554.232490][T21487] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 1554.248056][T21487] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1554.359475][T21487] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 1554.437788][T21487] usb 4-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 1554.477724][T21487] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1554.486208][T21487] usb 4-1: Product: syz [ 1554.490833][T21487] usb 4-1: Manufacturer: syz [ 1554.495497][T21487] usb 4-1: SerialNumber: syz [ 1554.529456][T21487] usb 4-1: config 0 descriptor?? [ 1554.536202][ T668] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1554.555703][ C1] usb 4-1: NFC: Urb failure (status -71) [ 1554.571857][T21487] usb 4-1: NFC: Unable to get FW version [ 1554.587229][T21487] pn533_usb 4-1:0.0: probe with driver pn533_usb failed with error -90 [ 1554.770626][ T668] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 1554.853440][T12962] usb 4-1: USB disconnect, device number 13 [ 1556.550580][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 1556.550597][ T30] audit: type=1400 audit(2000000480.000:1987): avc: denied { map } for pid=717 comm="syz.6.5099" path="socket:[102716]" dev="sockfs" ino=102716 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1556.584340][ T722] tmpfs: Bad value for 'mpol' [ 1556.600641][ T30] audit: type=1400 audit(2000000480.450:1988): avc: denied { write } for pid=720 comm="syz.8.5100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1556.630357][ T30] audit: type=1400 audit(2000000480.450:1989): avc: denied { ioctl } for pid=720 comm="syz.8.5100" path="socket:[102727]" dev="sockfs" ino=102727 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1556.673916][ T30] audit: type=1400 audit(2000000480.540:1990): avc: denied { unmount } for pid=16600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1557.324069][ T30] audit: type=1400 audit(2000000481.190:1991): avc: denied { read write } for pid=738 comm="syz.4.5104" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1557.349315][ T30] audit: type=1400 audit(2000000481.190:1992): avc: denied { ioctl open } for pid=738 comm="syz.4.5104" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1557.676473][ T30] audit: type=1400 audit(2000000481.540:1993): avc: denied { bind } for pid=744 comm="syz.4.5107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1557.718720][ T30] audit: type=1400 audit(2000000481.570:1994): avc: denied { map } for pid=742 comm="syz.7.5106" path="socket:[102385]" dev="sockfs" ino=102385 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1557.749205][ T30] audit: type=1400 audit(2000000481.570:1995): avc: denied { read } for pid=742 comm="syz.7.5106" path="socket:[102385]" dev="sockfs" ino=102385 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1558.461551][ T30] audit: type=1400 audit(2000000482.310:1996): avc: denied { ioctl } for pid=747 comm="syz.3.5108" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1558.586096][ T778] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5114'. [ 1560.419283][T12962] usb 7-1: new high-speed USB device number 86 using dummy_hcd [ 1560.561475][T12962] usb 7-1: device descriptor read/64, error -71 [ 1560.630936][ T808] FAULT_INJECTION: forcing a failure. [ 1560.630936][ T808] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1560.644759][ T808] CPU: 1 UID: 0 PID: 808 Comm: syz.8.5119 Not tainted syzkaller #0 PREEMPT(full) [ 1560.644776][ T808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1560.644782][ T808] Call Trace: [ 1560.644788][ T808] [ 1560.644794][ T808] dump_stack_lvl+0x16c/0x1f0 [ 1560.644812][ T808] should_fail_ex+0x512/0x640 [ 1560.644828][ T808] should_fail_alloc_page+0xe7/0x130 [ 1560.644843][ T808] prepare_alloc_pages+0x3c2/0x610 [ 1560.644858][ T808] ? rcu_is_watching+0x12/0xc0 [ 1560.644874][ T808] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 1560.644894][ T808] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1560.644905][ T808] ? smp_call_function_many_cond+0x1239/0x1600 [ 1560.644920][ T808] ? lockdep_hardirqs_on+0x7c/0x110 [ 1560.644932][ T808] ? smp_call_function_many_cond+0x457/0x1600 [ 1560.644950][ T808] ? __lock_acquire+0x62e/0x1ce0 [ 1560.644970][ T808] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1560.644985][ T808] ? policy_nodemask+0xea/0x4e0 [ 1560.644999][ T808] alloc_pages_mpol+0x1fb/0x550 [ 1560.645013][ T808] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1560.645030][ T808] folio_alloc_mpol_noprof+0x36/0x2f0 [ 1560.645046][ T808] vma_alloc_folio_noprof+0xed/0x1e0 [ 1560.645061][ T808] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1560.645076][ T808] ? rcu_read_unlock+0x2d/0xb0 [ 1560.645090][ T808] do_wp_page+0x1136/0x4f00 [ 1560.645108][ T808] ? __pfx_do_wp_page+0x10/0x10 [ 1560.645127][ T808] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1560.645139][ T808] ? ___pte_offset_map+0x2ad/0x4f0 [ 1560.645155][ T808] __handle_mm_fault+0x1b2d/0x2a50 [ 1560.645176][ T808] ? __pfx___handle_mm_fault+0x10/0x10 [ 1560.645194][ T808] ? __pte_offset_map_lock+0x174/0x310 [ 1560.645217][ T808] ? find_held_lock+0x2b/0x80 [ 1560.645236][ T808] ? follow_page_pte.constprop.0+0x5cf/0x1390 [ 1560.645254][ T808] handle_mm_fault+0x589/0xd10 [ 1560.645274][ T808] __get_user_pages+0x551/0x34a0 [ 1560.645293][ T808] ? down_read_killable+0x220/0x4b0 [ 1560.645308][ T808] ? __lock_acquire+0x62e/0x1ce0 [ 1560.645324][ T808] ? __pfx___get_user_pages+0x10/0x10 [ 1560.645340][ T808] ? __lock_acquire+0x62e/0x1ce0 [ 1560.645358][ T808] __gup_longterm_locked+0xa92/0x17e0 [ 1560.645377][ T808] ? try_get_folio+0x1d2/0x730 [ 1560.645390][ T808] ? __pfx___gup_longterm_locked+0x10/0x10 [ 1560.645406][ T808] ? try_get_folio+0x255/0x730 [ 1560.645420][ T808] ? sanity_check_pinned_pages+0x58a/0x11d0 [ 1560.645438][ T808] gup_fast_fallback+0xf78/0x23f0 [ 1560.645463][ T808] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1560.645479][ T808] ? is_bpf_text_address+0x8a/0x1a0 [ 1560.645491][ T808] ? bpf_ksym_find+0x127/0x1c0 [ 1560.645506][ T808] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1560.645522][ T808] ? is_bpf_text_address+0x94/0x1a0 [ 1560.645536][ T808] pin_user_pages_fast+0xa7/0xf0 [ 1560.645551][ T808] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 1560.645570][ T808] iov_iter_extract_pages+0x3a2/0x1ed0 [ 1560.645588][ T808] ? __pfx_stack_trace_save+0x10/0x10 [ 1560.645603][ T808] ? stack_depot_save_flags+0x29/0x9c0 [ 1560.645616][ T808] ? find_held_lock+0x2b/0x80 [ 1560.645629][ T808] ? __pfx_iov_iter_extract_pages+0x10/0x10 [ 1560.645644][ T808] ? sock_kmalloc+0x111/0x170 [ 1560.645658][ T808] ? kasan_save_stack+0x42/0x60 [ 1560.645669][ T808] ? kasan_save_stack+0x33/0x60 [ 1560.645682][ T808] ? kasan_save_track+0x14/0x30 [ 1560.645697][ T808] ? __kasan_kmalloc+0xaa/0xb0 [ 1560.645711][ T808] ? __kmalloc_noprof+0x223/0x510 [ 1560.645727][ T808] ? sock_kmalloc+0x111/0x170 [ 1560.645744][ T808] ? af_alg_alloc_areq+0xbc/0x2e0 [ 1560.645756][ T808] ? skcipher_recvmsg+0x32b/0x1030 [ 1560.645768][ T808] ? sock_recvmsg+0x1f6/0x250 [ 1560.645781][ T808] ? ____sys_recvmsg+0x218/0x6b0 [ 1560.645794][ T808] ? ___sys_recvmsg+0x114/0x1a0 [ 1560.645805][ T808] ? __sys_recvmsg+0x16a/0x220 [ 1560.645815][ T808] ? do_syscall_64+0xcd/0x4c0 [ 1560.645827][ T808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.645844][ T808] extract_iter_to_sg+0xf6e/0x20c0 [ 1560.645862][ T808] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1560.645884][ T808] af_alg_get_rsgl+0x2b8/0x7f0 [ 1560.645901][ T808] skcipher_recvmsg+0x38c/0x1030 [ 1560.645919][ T808] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1560.645937][ T808] sock_recvmsg+0x1f6/0x250 [ 1560.645952][ T808] ____sys_recvmsg+0x218/0x6b0 [ 1560.645970][ T808] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1560.645990][ T808] ? __lock_acquire+0x62e/0x1ce0 [ 1560.646009][ T808] ___sys_recvmsg+0x114/0x1a0 [ 1560.646021][ T808] ? __pfx____sys_recvmsg+0x10/0x10 [ 1560.646045][ T808] __sys_recvmsg+0x16a/0x220 [ 1560.646058][ T808] ? __pfx___sys_recvmsg+0x10/0x10 [ 1560.646080][ T808] do_syscall_64+0xcd/0x4c0 [ 1560.646093][ T808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.646104][ T808] RIP: 0033:0x7f1eff58ebe9 [ 1560.646114][ T808] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1560.646125][ T808] RSP: 002b:00007f1f00426038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1560.646136][ T808] RAX: ffffffffffffffda RBX: 00007f1eff7c5fa0 RCX: 00007f1eff58ebe9 [ 1560.646143][ T808] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 1560.646150][ T808] RBP: 00007f1f00426090 R08: 0000000000000000 R09: 0000000000000000 [ 1560.646156][ T808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1560.646163][ T808] R13: 00007f1eff7c6038 R14: 00007f1eff7c5fa0 R15: 00007ffc4723f9f8 [ 1560.646177][ T808] [ 1561.365441][T12962] usb 7-1: new high-speed USB device number 87 using dummy_hcd [ 1561.640614][T12962] usb 7-1: device descriptor read/64, error -71 [ 1561.857966][T12962] usb usb7-port1: attempt power cycle [ 1562.091387][T19647] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1562.438936][T12962] usb 7-1: new high-speed USB device number 88 using dummy_hcd [ 1562.498886][T19647] usb 9-1: Using ep0 maxpacket: 32 [ 1562.522481][T12962] usb 7-1: device descriptor read/8, error -71 [ 1562.539688][T19647] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1562.559306][T19647] usb 9-1: config 0 has no interface number 0 [ 1562.565538][T19647] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1562.578046][T19647] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1562.589003][T19647] usb 9-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1562.598087][T19647] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1562.608135][T19647] usb 9-1: config 0 descriptor?? [ 1562.788891][T12962] usb 7-1: new high-speed USB device number 89 using dummy_hcd [ 1562.858192][ T846] tipc: Enabled bearer , priority 0 [ 1562.880784][ T846] syzkaller0: entered promiscuous mode [ 1562.886300][ T846] syzkaller0: entered allmulticast mode [ 1562.979396][ T846] tipc: Resetting bearer [ 1563.043823][T12962] usb 7-1: device not accepting address 89, error -71 [ 1563.060837][ T845] tipc: Resetting bearer [ 1563.073527][T12962] usb usb7-port1: unable to enumerate USB device [ 1563.090020][T19647] uclogic 0003:28BD:0094.0032: failed retrieving string descriptor #100: -71 [ 1563.128111][ T845] tipc: Disabling bearer [ 1563.150411][T19647] uclogic 0003:28BD:0094.0032: failed retrieving pen parameters: -71 [ 1563.170329][ T858] tipc: Enabled bearer , priority 0 [ 1563.181926][T19647] uclogic 0003:28BD:0094.0032: pen probing failed: -71 [ 1563.193163][ T867] syzkaller0: entered promiscuous mode [ 1563.198631][ T867] syzkaller0: entered allmulticast mode [ 1563.338895][T19647] uclogic 0003:28BD:0094.0032: failed probing parameters: -71 [ 1563.905665][ T858] FAULT_INJECTION: forcing a failure. [ 1563.905665][ T858] name failslab, interval 1, probability 0, space 0, times 0 [ 1563.926939][T19647] uclogic 0003:28BD:0094.0032: probe with driver uclogic failed with error -71 [ 1563.944600][T19647] usb 9-1: USB disconnect, device number 18 [ 1563.971543][ T858] CPU: 0 UID: 0 PID: 858 Comm: syz.7.5130 Not tainted syzkaller #0 PREEMPT(full) [ 1563.971570][ T858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1563.971580][ T858] Call Trace: [ 1563.971586][ T858] [ 1563.971591][ T858] dump_stack_lvl+0x16c/0x1f0 [ 1563.971609][ T858] should_fail_ex+0x512/0x640 [ 1563.971622][ T858] ? fs_reclaim_acquire+0xae/0x150 [ 1563.971641][ T858] ? tomoyo_encode2+0x100/0x3e0 [ 1563.971657][ T858] should_failslab+0xc2/0x120 [ 1563.971670][ T858] __kmalloc_noprof+0xd2/0x510 [ 1563.971685][ T858] tomoyo_encode2+0x100/0x3e0 [ 1563.971703][ T858] tomoyo_encode+0x29/0x50 [ 1563.971718][ T858] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1563.971736][ T858] ? tomoyo_profile+0x47/0x60 [ 1563.971749][ T858] tomoyo_path_number_perm+0x245/0x580 [ 1563.971762][ T858] ? tomoyo_path_number_perm+0x237/0x580 [ 1563.971777][ T858] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1563.971792][ T858] ? find_held_lock+0x2b/0x80 [ 1563.971818][ T858] ? find_held_lock+0x2b/0x80 [ 1563.971831][ T858] ? hook_file_ioctl_common+0x145/0x410 [ 1563.971845][ T858] ? __fget_files+0x20e/0x3c0 [ 1563.971861][ T858] security_file_ioctl+0x9b/0x240 [ 1563.971877][ T858] __x64_sys_ioctl+0xb7/0x210 [ 1563.971895][ T858] do_syscall_64+0xcd/0x4c0 [ 1563.971909][ T858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.971921][ T858] RIP: 0033:0x7fa8bfd8ebe9 [ 1563.971931][ T858] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1563.971942][ T858] RSP: 002b:00007fa8c0bb4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1563.971953][ T858] RAX: ffffffffffffffda RBX: 00007fa8bffc6090 RCX: 00007fa8bfd8ebe9 [ 1563.971960][ T858] RDX: 0000200000002280 RSI: 0000000000008922 RDI: 0000000000000005 [ 1563.971967][ T858] RBP: 00007fa8c0bb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1563.971973][ T858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1563.971980][ T858] R13: 00007fa8bffc6128 R14: 00007fa8bffc6090 R15: 00007ffc0ad3d098 [ 1563.971994][ T858] [ 1564.176704][ C0] vkms_vblank_simulate: vblank timer overrun [ 1564.184288][ T858] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1564.191909][ T858] tipc: Resetting bearer [ 1564.206250][ T851] tipc: Resetting bearer [ 1564.339503][T11599] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 1564.403739][ T851] tipc: Disabling bearer [ 1564.629861][T11599] usb 7-1: device descriptor read/64, error -71 [ 1564.879131][T11599] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 1564.897619][ T904] kvm_intel: kvm [902]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x2 [ 1565.049061][T11599] usb 7-1: device descriptor read/64, error -71 [ 1565.159865][T11599] usb usb7-port1: attempt power cycle [ 1565.259009][T21487] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1565.620771][ T5920] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1565.628365][T11599] usb 7-1: new high-speed USB device number 92 using dummy_hcd [ 1565.649752][T21487] usb 5-1: Using ep0 maxpacket: 32 [ 1565.655309][T11599] usb 7-1: device descriptor read/8, error -71 [ 1565.663858][T21487] usb 5-1: config 0 has an invalid interface number: 58 but max is 0 [ 1565.677299][T21487] usb 5-1: config 0 has no interface number 0 [ 1565.684497][T21487] usb 5-1: config 0 interface 58 has no altsetting 0 [ 1565.694990][T21487] usb 5-1: New USB device found, idVendor=0711, idProduct=0902, bcdDevice=43.1b [ 1565.705042][T21487] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1565.792216][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1566.049777][ T24] usb 9-1: new full-speed USB device number 19 using dummy_hcd [ 1566.699373][T21487] usb 5-1: Product: syz [ 1566.703712][ T5920] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1566.718439][T21487] usb 5-1: Manufacturer: syz [ 1566.724219][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1566.732862][T21487] usb 5-1: SerialNumber: syz [ 1566.744416][T21487] usb 5-1: config 0 descriptor?? [ 1566.762598][ T5920] usb 4-1: config 0 descriptor?? [ 1566.770398][T21487] sisusb 5-1:0.58: Invalid USB2VGA device [ 1566.776116][T21487] sisusb 5-1:0.58: probe with driver sisusb failed with error -22 [ 1566.819824][T11599] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 1566.840239][T11599] usb 7-1: device descriptor read/8, error -71 [ 1566.852339][ T24] usb 9-1: config 0 has an invalid interface number: 49 but max is 0 [ 1566.860816][ T24] usb 9-1: config 0 has no interface number 0 [ 1566.872697][ T24] usb 9-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1566.899596][ T24] usb 9-1: config 0 interface 49 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1566.919422][ T24] usb 9-1: config 0 interface 49 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1566.949192][T11599] usb usb7-port1: unable to enumerate USB device [ 1566.956957][ T24] usb 9-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1566.992476][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.049506][ T24] usb 9-1: Product: syz [ 1567.100584][ T24] usb 9-1: Manufacturer: syz [ 1567.120425][ T24] usb 9-1: SerialNumber: syz [ 1567.221638][ T24] usb 9-1: config 0 descriptor?? [ 1567.389024][ T943] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 1567.554489][T11599] usb 5-1: USB disconnect, device number 95 [ 1567.783909][ T5920] keytouch 0003:0926:3333.0033: fixing up Keytouch IEC report descriptor [ 1567.833326][ T5920] input: HID 0926:3333 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0926:3333.0033/input/input55 [ 1567.859941][ T24] usb 9-1: USB disconnect, device number 19 [ 1568.329380][ T5920] keytouch 0003:0926:3333.0033: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.3-1/input0 [ 1568.988562][ T1026] FAULT_INJECTION: forcing a failure. [ 1568.988562][ T1026] name failslab, interval 1, probability 0, space 0, times 0 [ 1569.099546][ T1026] CPU: 0 UID: 0 PID: 1026 Comm: syz.4.5153 Not tainted syzkaller #0 PREEMPT(full) [ 1569.099569][ T1026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1569.099576][ T1026] Call Trace: [ 1569.099580][ T1026] [ 1569.099586][ T1026] dump_stack_lvl+0x16c/0x1f0 [ 1569.099609][ T1026] should_fail_ex+0x512/0x640 [ 1569.099629][ T1026] ? fs_reclaim_acquire+0xae/0x150 [ 1569.099652][ T1026] ? tomoyo_encode2+0x100/0x3e0 [ 1569.099674][ T1026] should_failslab+0xc2/0x120 [ 1569.099690][ T1026] __kmalloc_noprof+0xd2/0x510 [ 1569.099702][ T1026] ? d_absolute_path+0x136/0x1a0 [ 1569.099721][ T1026] tomoyo_encode2+0x100/0x3e0 [ 1569.099739][ T1026] tomoyo_encode+0x29/0x50 [ 1569.099760][ T1026] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1569.099792][ T1026] tomoyo_path_number_perm+0x245/0x580 [ 1569.099812][ T1026] ? tomoyo_path_number_perm+0x237/0x580 [ 1569.099832][ T1026] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1569.099848][ T1026] ? find_held_lock+0x2b/0x80 [ 1569.099874][ T1026] ? find_held_lock+0x2b/0x80 [ 1569.099886][ T1026] ? hook_file_ioctl_common+0x145/0x410 [ 1569.099910][ T1026] ? __fget_files+0x20e/0x3c0 [ 1569.099934][ T1026] security_file_ioctl+0x9b/0x240 [ 1569.099959][ T1026] __x64_sys_ioctl+0xb7/0x210 [ 1569.099984][ T1026] do_syscall_64+0xcd/0x4c0 [ 1569.099998][ T1026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1569.100010][ T1026] RIP: 0033:0x7f9339f8ebe9 [ 1569.100019][ T1026] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1569.100030][ T1026] RSP: 002b:00007f933ae03038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1569.100043][ T1026] RAX: ffffffffffffffda RBX: 00007f933a1c5fa0 RCX: 00007f9339f8ebe9 [ 1569.100054][ T1026] RDX: 0000200000000080 RSI: 0000000000004b4c RDI: 0000000000000006 [ 1569.100065][ T1026] RBP: 00007f933ae03090 R08: 0000000000000000 R09: 0000000000000000 [ 1569.100075][ T1026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1569.100090][ T1026] R13: 00007f933a1c6038 R14: 00007f933a1c5fa0 R15: 00007ffd761d0c88 [ 1569.100116][ T1026] [ 1569.100397][ T1026] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1569.160677][ T30] audit: type=1400 audit(2000000492.940:1997): avc: denied { ioctl } for pid=1013 comm="syz.7.5151" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1569.383352][T19647] usb 4-1: USB disconnect, device number 14 [ 1569.600321][ T5920] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1569.889466][ T5920] usb 9-1: Using ep0 maxpacket: 32 [ 1569.896373][ T5920] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1569.910934][ T5920] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1569.924160][ T5920] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1569.933359][ T5920] usb 9-1: Product: syz [ 1569.939730][ T5920] usb 9-1: Manufacturer: syz [ 1569.948659][ T5920] usb 9-1: SerialNumber: syz [ 1570.007179][ T5920] usb 9-1: config 0 descriptor?? [ 1570.014943][ T1020] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1570.263194][T19647] usb 9-1: USB disconnect, device number 20 [ 1570.999137][T19647] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1571.125039][ T30] audit: type=1400 audit(2000000494.990:1998): avc: denied { read } for pid=1096 comm="syz.6.5159" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1571.186519][ T1097] sit2: entered allmulticast mode [ 1571.207468][T19647] usb 9-1: too many configurations: 33, using maximum allowed: 8 [ 1571.229368][ T30] audit: type=1400 audit(2000000494.990:1999): avc: denied { open } for pid=1096 comm="syz.6.5159" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1571.260210][ T30] audit: type=1400 audit(2000000495.060:2000): avc: denied { mount } for pid=1096 comm="syz.6.5159" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1571.286059][T19647] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1571.294263][T19647] usb 9-1: can't read configurations, error -61 [ 1571.428995][T19647] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1571.780224][T19647] usb 9-1: too many configurations: 33, using maximum allowed: 8 [ 1571.799773][T19647] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 1571.807371][T19647] usb 9-1: can't read configurations, error -61 [ 1571.850822][T19647] usb usb9-port1: attempt power cycle [ 1571.951061][ T30] audit: type=1400 audit(2000000495.800:2001): avc: denied { bind } for pid=1111 comm="syz.4.5163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1572.042457][ T30] audit: type=1400 audit(2000000495.910:2002): avc: denied { write } for pid=1111 comm="syz.4.5163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1572.357272][ T1120] lo speed is unknown, defaulting to 1000 [ 1572.959574][T11599] usb 7-1: new high-speed USB device number 94 using dummy_hcd [ 1573.187270][T11599] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1573.248947][T12962] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1573.255619][T11599] usb 7-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1573.276096][T11599] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1573.287807][T11599] usb 7-1: config 0 descriptor?? [ 1573.481835][T12962] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1573.496618][T12962] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1573.514204][T12962] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1573.523628][T12962] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1573.545686][ T1166] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1573.577074][T12962] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1573.717882][T11599] lenovo 0003:17EF:6047.0034: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.6-1/input0 [ 1573.749978][ T1198] ptrace attach of "./syz-executor exec"[18966] was attempted by "./syz-executor exec"[1198] [ 1573.776429][ T1166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5169'. [ 1573.818477][ T1166] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5169'. [ 1573.880514][ T7078] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1573.894471][ T7082] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1573.934675][T12962] usb 5-1: USB disconnect, device number 96 [ 1574.020178][ T7082] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1574.116839][ T7082] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1574.427880][ T1159] netlink: 'syz.6.5168': attribute type 10 has an invalid length. [ 1574.471083][ T1159] netlink: 'syz.6.5168': attribute type 10 has an invalid length. [ 1574.542136][ T1220] siw: device registration error -23 [ 1574.643668][T11599] lenovo 0003:17EF:6047.0034: Fn-lock setting failed: -71 [ 1574.653104][T11599] lenovo 0003:17EF:6047.0034: Sensitivity setting failed: -71 [ 1574.664406][T11599] usb 7-1: USB disconnect, device number 94 [ 1575.526942][ T1248] netlink: 'syz.3.5174': attribute type 5 has an invalid length. [ 1576.172962][ T30] audit: type=1400 audit(2000000500.040:2003): avc: denied { accept } for pid=1270 comm="syz.7.5180" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 1576.950320][ T1293] FAULT_INJECTION: forcing a failure. [ 1576.950320][ T1293] name failslab, interval 1, probability 0, space 0, times 0 [ 1576.966360][ T1293] CPU: 1 UID: 0 PID: 1293 Comm: syz.6.5183 Not tainted syzkaller #0 PREEMPT(full) [ 1576.966385][ T1293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1576.966395][ T1293] Call Trace: [ 1576.966401][ T1293] [ 1576.966408][ T1293] dump_stack_lvl+0x16c/0x1f0 [ 1576.966432][ T1293] should_fail_ex+0x512/0x640 [ 1576.966451][ T1293] ? fs_reclaim_acquire+0xae/0x150 [ 1576.966476][ T1293] ? tomoyo_encode2+0x100/0x3e0 [ 1576.966499][ T1293] should_failslab+0xc2/0x120 [ 1576.966518][ T1293] __kmalloc_noprof+0xd2/0x510 [ 1576.966542][ T1293] tomoyo_encode2+0x100/0x3e0 [ 1576.966570][ T1293] tomoyo_encode+0x29/0x50 [ 1576.966593][ T1293] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1576.966621][ T1293] ? tomoyo_profile+0x47/0x60 [ 1576.966640][ T1293] tomoyo_path_number_perm+0x245/0x580 [ 1576.966660][ T1293] ? tomoyo_path_number_perm+0x237/0x580 [ 1576.966683][ T1293] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1576.966706][ T1293] ? find_held_lock+0x2b/0x80 [ 1576.966749][ T1293] ? find_held_lock+0x2b/0x80 [ 1576.966768][ T1293] ? hook_file_ioctl_common+0x145/0x410 [ 1576.966791][ T1293] ? __fget_files+0x20e/0x3c0 [ 1576.966815][ T1293] security_file_ioctl+0x9b/0x240 [ 1576.966841][ T1293] __x64_sys_ioctl+0xb7/0x210 [ 1576.966867][ T1293] do_syscall_64+0xcd/0x4c0 [ 1576.966889][ T1293] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1576.966906][ T1293] RIP: 0033:0x7f501b78ebe9 [ 1576.966920][ T1293] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1576.966936][ T1293] RSP: 002b:00007f501c5aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1576.966952][ T1293] RAX: ffffffffffffffda RBX: 00007f501b9c6090 RCX: 00007f501b78ebe9 [ 1576.966963][ T1293] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 1576.966973][ T1293] RBP: 00007f501c5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 1576.966983][ T1293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1576.966993][ T1293] R13: 00007f501b9c6128 R14: 00007f501b9c6090 R15: 00007fff2afd04d8 [ 1576.967017][ T1293] [ 1576.967249][ T1293] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1577.078888][T12962] usb 9-1: new full-speed USB device number 24 using dummy_hcd [ 1577.354045][T12962] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1577.364900][T12962] usb 9-1: config 0 has no interfaces? [ 1577.388948][T12962] usb 9-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1577.408098][T12962] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1577.435170][T12962] usb 9-1: config 0 descriptor?? [ 1577.438393][ T30] audit: type=1400 audit(2000000501.300:2004): avc: denied { connect } for pid=1303 comm="syz.6.5185" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1577.657217][ T30] audit: type=1400 audit(2000000501.520:2005): avc: denied { ioctl } for pid=1310 comm="syz.4.5186" path="socket:[104408]" dev="sockfs" ino=104408 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1577.884536][ T30] audit: type=1400 audit(2000000501.750:2006): avc: denied { setopt } for pid=1320 comm="syz.4.5188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1578.084429][ T1322] block device autoloading is deprecated and will be removed. [ 1578.762920][ T30] audit: type=1400 audit(2000000502.620:2007): avc: denied { append } for pid=1330 comm="syz.6.5189" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1578.998120][ T30] audit: type=1400 audit(2000000502.660:2008): avc: denied { map } for pid=1330 comm="syz.6.5189" path="socket:[103348]" dev="sockfs" ino=103348 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 1579.029094][ T30] audit: type=1400 audit(2000000502.710:2009): avc: denied { write } for pid=1330 comm="syz.6.5189" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1579.270297][ T24] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1579.431359][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 1579.517021][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1579.552228][ T24] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1579.594657][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1579.656683][ T24] usb 4-1: config 0 descriptor?? [ 1579.816207][T22130] bond0: (slave syz_tun): Releasing backup interface [ 1579.887433][ T24] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1579.973959][T27935] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1579.985351][T27935] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1579.996755][T27935] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1580.008178][T27935] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1580.018357][T27935] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1580.042382][ T30] audit: type=1400 audit(2000000503.900:2010): avc: denied { mounton } for pid=1361 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1580.085210][ T1361] lo speed is unknown, defaulting to 1000 [ 1580.153195][ T1337] netlink: 'syz.3.5190': attribute type 1 has an invalid length. [ 1580.179995][ T1337] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5190'. [ 1580.190856][ T1337] nbd: illegal input index 65544 [ 1580.282134][ T7080] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1580.351282][ T24] usb 4-1: USB disconnect, device number 15 [ 1580.399652][ T1329] delete_channel: no stack [ 1580.421684][T11599] usb 9-1: USB disconnect, device number 24 [ 1580.584630][ T7080] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1581.064869][ T7080] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1581.264899][ T30] audit: type=1400 audit(2000000505.130:2011): avc: denied { bind } for pid=1445 comm="syz.4.5201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1581.371476][ T7080] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.100335][T27935] Bluetooth: hci4: command tx timeout [ 1582.201839][ T7080] bridge_slave_1: left allmulticast mode [ 1582.209430][ T7080] bridge_slave_1: left promiscuous mode [ 1582.215191][ T7080] bridge0: port 2(bridge_slave_1) entered disabled state [ 1582.231976][ T7080] bridge_slave_0: left allmulticast mode [ 1582.250595][ T7080] bridge0: port 1(bridge_slave_0) entered disabled state [ 1582.290247][ T30] audit: type=1400 audit(2000000506.150:2012): avc: denied { setopt } for pid=1532 comm="syz.8.5203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1582.357398][ T1540] netlink: 'syz.8.5203': attribute type 10 has an invalid length. [ 1582.418115][ T30] audit: type=1400 audit(2000000506.150:2013): avc: denied { read } for pid=1532 comm="syz.8.5203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1583.335957][ T30] audit: type=1400 audit(2000000506.460:2014): avc: denied { bind } for pid=1543 comm="syz.4.5204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1583.812927][ T30] audit: type=1400 audit(2000000506.460:2015): avc: denied { name_bind } for pid=1543 comm="syz.4.5204" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1583.871943][ T30] audit: type=1400 audit(2000000506.460:2016): avc: denied { node_bind } for pid=1543 comm="syz.4.5204" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1584.181066][T27935] Bluetooth: hci4: command tx timeout [ 1585.054034][ T7080] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1585.067020][ T7080] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1585.080803][ T7080] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1585.116528][ T7080] bond0 (unregistering): (slave team0): Releasing backup interface [ 1585.127188][ T7080] bond0 (unregistering): Released all slaves [ 1585.180648][ T1361] chnl_net:caif_netlink_parms(): no params data found [ 1585.337442][ T1540] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1585.369049][ T7080] tipc: Left network mode [ 1585.399546][ T24] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1585.497629][ T1638] FAULT_INJECTION: forcing a failure. [ 1585.497629][ T1638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1585.512371][ T1638] CPU: 1 UID: 0 PID: 1638 Comm: syz.3.5211 Not tainted syzkaller #0 PREEMPT(full) [ 1585.512394][ T1638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1585.512404][ T1638] Call Trace: [ 1585.512410][ T1638] [ 1585.512418][ T1638] dump_stack_lvl+0x16c/0x1f0 [ 1585.512443][ T1638] should_fail_ex+0x512/0x640 [ 1585.512468][ T1638] _copy_from_user+0x2e/0xd0 [ 1585.512494][ T1638] copy_msghdr_from_user+0x98/0x160 [ 1585.512513][ T1638] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1585.512537][ T1638] ? __lock_acquire+0x62e/0x1ce0 [ 1585.512569][ T1638] ___sys_recvmsg+0xdb/0x1a0 [ 1585.512588][ T1638] ? __pfx____sys_recvmsg+0x10/0x10 [ 1585.512610][ T1638] ? find_held_lock+0x2b/0x80 [ 1585.512646][ T1638] do_recvmmsg+0x2fe/0x750 [ 1585.512671][ T1638] ? __pfx_do_recvmmsg+0x10/0x10 [ 1585.512696][ T1638] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 1585.512725][ T1638] ? __fget_files+0x20e/0x3c0 [ 1585.512752][ T1638] __x64_sys_recvmmsg+0x22a/0x280 [ 1585.512773][ T1638] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1585.512800][ T1638] do_syscall_64+0xcd/0x4c0 [ 1585.512822][ T1638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1585.512841][ T1638] RIP: 0033:0x7f7d0778ebe9 [ 1585.512856][ T1638] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1585.512873][ T1638] RSP: 002b:00007f7d059f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1585.512890][ T1638] RAX: ffffffffffffffda RBX: 00007f7d079c5fa0 RCX: 00007f7d0778ebe9 [ 1585.512902][ T1638] RDX: 000000000400023c RSI: 00002000000055c0 RDI: 0000000000000004 [ 1585.512913][ T1638] RBP: 00007f7d059f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1585.512923][ T1638] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000001 [ 1585.512934][ T1638] R13: 00007f7d079c6038 R14: 00007f7d079c5fa0 R15: 00007ffd0ad1b2b8 [ 1585.512958][ T1638] [ 1585.524669][ T1361] bridge0: port 1(bridge_slave_0) entered blocking state [ 1585.551558][ T24] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1585.603448][ T1361] bridge0: port 1(bridge_slave_0) entered disabled state [ 1585.630959][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1585.634929][ T1361] bridge_slave_0: entered allmulticast mode [ 1585.637309][ T24] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1585.660355][ T1361] bridge_slave_0: entered promiscuous mode [ 1585.672811][ T24] usb 5-1: config 1 has no interface number 1 [ 1585.681534][ T1361] bridge0: port 2(bridge_slave_1) entered blocking state [ 1585.723755][ T24] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1585.731531][ T1361] bridge0: port 2(bridge_slave_1) entered disabled state [ 1585.749440][ T24] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1585.789426][ T1361] bridge_slave_1: entered allmulticast mode [ 1585.817786][ T1361] bridge_slave_1: entered promiscuous mode [ 1585.818594][ T24] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1585.834135][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1585.852576][ T24] usb 5-1: Product: syz [ 1585.856774][ T24] usb 5-1: Manufacturer: syz [ 1585.872830][T11599] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 1585.894143][ T24] usb 5-1: SerialNumber: syz [ 1585.958640][ T1361] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1585.972160][ T1361] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1586.025787][ T1361] team0: Port device team_slave_0 added [ 1586.035544][T11599] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1586.047620][T11599] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1586.050963][ T1361] team0: Port device team_slave_1 added [ 1586.076495][T11599] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 1586.086532][T11599] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1586.095419][T11599] usb 4-1: SerialNumber: syz [ 1586.121515][T11599] usb 4-1: 0:2 : does not exist [ 1586.138155][ T7080] hsr_slave_0: left promiscuous mode [ 1586.148546][ T7080] hsr_slave_1: left promiscuous mode [ 1586.161438][ T7080] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1586.175068][ T7080] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1586.183979][ T7080] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1586.192573][ T7080] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1586.200385][ T5920] usb 9-1: new full-speed USB device number 25 using dummy_hcd [ 1586.237002][ T7080] veth1_macvtap: left promiscuous mode [ 1586.244333][ T7080] veth0_macvtap: left promiscuous mode [ 1586.260714][ T7080] veth1_vlan: left promiscuous mode [ 1586.420369][T27935] Bluetooth: hci4: command tx timeout [ 1586.793506][T11599] usb 4-1: USB disconnect, device number 16 [ 1586.863515][ T5920] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1586.873582][ T5920] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1586.884620][ T5920] usb 9-1: Product: syz [ 1586.889596][ T5920] usb 9-1: Manufacturer: syz [ 1586.894229][ T5920] usb 9-1: SerialNumber: syz [ 1586.901825][ T5920] usb 9-1: config 0 descriptor?? [ 1587.123968][ T5920] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1587.877240][ T5920] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1587.892648][ T5920] usb 9-1: USB disconnect, device number 25 [ 1587.935372][ T24] usb 5-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 1587.947737][ T7080] team0 (unregistering): Port device team_slave_1 removed [ 1587.970289][ T24] usb 5-1: MIDIStreaming interface descriptor not found [ 1588.153884][ T24] usb 5-1: USB disconnect, device number 97 [ 1588.235544][ T7080] team0 (unregistering): Port device team_slave_0 removed [ 1588.498942][T27935] Bluetooth: hci4: command tx timeout [ 1590.678931][ T30] audit: type=1400 audit(2000000514.520:2017): avc: denied { watch_mount } for pid=1849 comm="syz.8.5227" path="/89" dev="tmpfs" ino=483 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1590.899997][ T1361] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1590.906963][ T1361] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1591.001103][ T1361] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1591.024983][ T1361] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1591.032234][ T1361] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1591.090085][ T1361] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1591.164935][ T1886] openvswitch: netlink: VXLAN extension message has 16 unknown bytes. [ 1591.351293][ T1361] hsr_slave_0: entered promiscuous mode [ 1591.378139][ T1361] hsr_slave_1: entered promiscuous mode [ 1591.461711][ T1361] debugfs: 'hsr0' already exists in 'hsr' [ 1591.468305][ T1361] Cannot create hsr debugfs directory [ 1591.853638][ T1919] delete_channel: no stack [ 1592.798883][T19647] usb 5-1: new full-speed USB device number 98 using dummy_hcd [ 1592.939199][T19647] usb 5-1: device descriptor read/64, error -71 [ 1593.066093][ T2017] netlink: 'syz.3.5235': attribute type 10 has an invalid length. [ 1593.199566][T19647] usb 5-1: new full-speed USB device number 99 using dummy_hcd [ 1593.384053][ T2017] team0: Device hsr_slave_0 failed to register rx_handler [ 1593.478918][T19647] usb 5-1: device descriptor read/64, error -71 [ 1593.520030][ T1361] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1593.599349][T19647] usb usb5-port1: attempt power cycle [ 1593.643680][ T1361] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1593.681213][ T1361] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1593.692074][ T1361] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1593.846109][ T30] audit: type=1326 audit(2000000517.700:2018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1593.936908][ T30] audit: type=1326 audit(2000000517.700:2019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.029769][T19647] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 1594.047750][ T30] audit: type=1326 audit(2000000517.700:2020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.049853][ T1361] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1594.082032][T19647] usb 5-1: device descriptor read/8, error -71 [ 1594.155340][ T30] audit: type=1326 audit(2000000517.700:2021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.164362][ T1361] 8021q: adding VLAN 0 to HW filter on device team0 [ 1594.222153][ T7078] bridge0: port 1(bridge_slave_0) entered blocking state [ 1594.229392][ T7078] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1594.241964][ T30] audit: type=1326 audit(2000000517.700:2022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.267126][ T30] audit: type=1326 audit(2000000517.700:2023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.292327][ T30] audit: type=1326 audit(2000000517.700:2024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.302847][ T7080] bridge0: port 2(bridge_slave_1) entered blocking state [ 1594.322830][ T7080] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1594.367519][ T30] audit: type=1326 audit(2000000517.700:2025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.391678][T19647] usb 5-1: new full-speed USB device number 101 using dummy_hcd [ 1594.467552][ T30] audit: type=1326 audit(2000000517.710:2026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2015 comm="syz.3.5235" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7fc00000 [ 1594.494291][T19647] usb 5-1: device descriptor read/8, error -71 [ 1594.599831][ T24] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 1594.612850][T19647] usb usb5-port1: unable to enumerate USB device [ 1594.783406][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1594.832517][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1594.923576][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1594.994999][ T24] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1595.075777][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1595.130885][ T24] usb 9-1: config 0 descriptor?? [ 1595.615729][ T2075] input: syz1 as /devices/virtual/input/input56 [ 1595.666875][ T1361] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1595.713958][ T2082] bdev: Unknown parameter '/dev/comedi3' [ 1597.176136][ T24] usbhid 9-1:0.0: can't add hid device: -71 [ 1597.235476][ T24] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1597.310056][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 1597.310068][ T30] audit: type=1400 audit(2000000521.180:2084): avc: denied { bind } for pid=2107 comm="syz.3.5246" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1597.408933][ T24] usb 9-1: USB disconnect, device number 26 [ 1597.710328][ T2092] comedi comedi3: reset error (fatal) [ 1597.734392][ T1361] veth0_vlan: entered promiscuous mode [ 1597.928251][ T1361] veth1_vlan: entered promiscuous mode [ 1598.011508][ T1361] veth0_macvtap: entered promiscuous mode [ 1598.042337][ T1361] veth1_macvtap: entered promiscuous mode [ 1598.165792][ T1361] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1598.229932][ T1361] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1598.267441][ T7088] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1598.296797][ T7088] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1598.314248][ T7088] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1598.336511][ T7088] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1598.390265][ T2149] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5251'. [ 1598.767924][ T2149] geneve2: entered promiscuous mode [ 1598.977770][ T7082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1598.993015][ T7082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1599.078146][ T24] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1599.288650][T16743] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1599.298080][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1599.308474][ T24] usb 4-1: config 0 has no interfaces? [ 1599.318583][T16743] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1599.328699][ T24] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1599.379514][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1599.427356][ T24] usb 4-1: config 0 descriptor?? [ 1600.468686][T27935] Bluetooth: hci2: unexpected event 0x09 length: 6 > 3 [ 1601.875149][ T2234] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5264'. [ 1601.924949][ T2238] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5265'. [ 1601.963148][ T30] audit: type=1400 audit(2000000525.830:2085): avc: denied { write } for pid=2232 comm="syz.6.5264" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1602.507813][ T2234] team0 (unregistering): Port device team_slave_0 removed [ 1602.528327][ T2234] team0 (unregistering): Port device team_slave_1 removed [ 1602.657468][ T2214] delete_channel: no stack [ 1602.667564][T19647] usb 4-1: USB disconnect, device number 17 [ 1602.731824][ T2284] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5267'. [ 1602.746891][ T2276] netlink: 'syz.8.5266': attribute type 32 has an invalid length. [ 1602.816746][ T2284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5267'. [ 1602.855441][ T2284] netlink: 'syz.3.5267': attribute type 18 has an invalid length. [ 1602.884288][ T73] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1602.884339][ T73] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1602.884573][ T73] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1602.884604][ T73] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1602.884710][ T2284] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5267'. [ 1602.884730][ T2284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5267'. [ 1602.884754][ T2284] netlink: 'syz.3.5267': attribute type 18 has an invalid length. [ 1602.981052][ T2296] comedi comedi3: driver 'ni_daq_700' does not support attach using comedi_config [ 1603.855154][T21487] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 1603.905004][ T51] Bluetooth: hci2: command 0x0405 tx timeout [ 1603.946661][ T30] audit: type=1400 audit(2000000527.800:2086): avc: denied { wake_alarm } for pid=2301 comm="syz.3.5271" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1604.178694][T21487] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 1604.207774][T21487] usb 9-1: config 0 has no interface number 0 [ 1604.287890][T21487] usb 9-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=87.f7 [ 1604.308615][T21487] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.370529][T21487] usb 9-1: Product: syz [ 1604.374719][T21487] usb 9-1: Manufacturer: syz [ 1604.380662][T21487] usb 9-1: SerialNumber: syz [ 1604.387332][T21487] usb 9-1: config 0 descriptor?? [ 1604.398428][T21487] ttusb_dec_send_command: command bulk message failed: error -22 [ 1604.418211][T21487] ttusb-dec 9-1:0.50: probe with driver ttusb-dec failed with error -22 [ 1604.674509][T21487] usb 9-1: USB disconnect, device number 27 [ 1605.018869][T21487] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 1605.219644][T21487] usb 9-1: Using ep0 maxpacket: 8 [ 1605.226040][T21487] usb 9-1: config index 0 descriptor too short (expected 14610, got 18) [ 1605.238749][T21487] usb 9-1: config 5 has too many interfaces: 53, using maximum allowed: 32 [ 1605.252042][T21487] usb 9-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 1605.272603][T21487] usb 9-1: config 5 has 0 interfaces, different from the descriptor's value: 53 [ 1605.285141][T21487] usb 9-1: New USB device found, idVendor=f82a, idProduct=0000, bcdDevice=be.68 [ 1605.295691][T21487] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.306285][T21487] usb 9-1: Product: syz [ 1605.326385][T21487] usb 9-1: Manufacturer: syz [ 1605.333009][T21487] usb 9-1: SerialNumber: syz [ 1605.721751][T21487] usb 9-1: USB disconnect, device number 28 [ 1606.093864][ T2370] FAULT_INJECTION: forcing a failure. [ 1606.093864][ T2370] name failslab, interval 1, probability 0, space 0, times 0 [ 1606.095135][ T2371] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5280'. [ 1606.107262][ T2370] CPU: 1 UID: 0 PID: 2370 Comm: syz.3.5281 Not tainted syzkaller #0 PREEMPT(full) [ 1606.107283][ T2370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1606.107293][ T2370] Call Trace: [ 1606.107300][ T2370] [ 1606.107306][ T2370] dump_stack_lvl+0x16c/0x1f0 [ 1606.107329][ T2370] should_fail_ex+0x512/0x640 [ 1606.107347][ T2370] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 1606.107373][ T2370] should_failslab+0xc2/0x120 [ 1606.107391][ T2370] __kmalloc_cache_noprof+0x6a/0x3e0 [ 1606.107414][ T2370] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1aa/0x290 [ 1606.107438][ T2370] ? genl_start+0x1e8/0x980 [ 1606.107462][ T2370] genl_start+0x1e8/0x980 [ 1606.107485][ T2370] __netlink_dump_start+0x60b/0x990 [ 1606.107507][ T2370] genl_family_rcv_msg_dumpit+0x1e2/0x2e0 [ 1606.107531][ T2370] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 1606.107558][ T2370] ? __pfx_genl_get_cmd+0x10/0x10 [ 1606.107576][ T2370] ? __pfx_genl_start+0x10/0x10 [ 1606.107593][ T2370] ? __pfx_genl_dumpit+0x10/0x10 [ 1606.107612][ T2370] ? __pfx_genl_done+0x10/0x10 [ 1606.107635][ T2370] ? __radix_tree_lookup+0x21f/0x2c0 [ 1606.107661][ T2370] genl_rcv_msg+0x46e/0x800 [ 1606.107685][ T2370] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1606.107706][ T2370] ? __pfx_netdev_nl_qstats_get_dumpit+0x10/0x10 [ 1606.107735][ T2370] netlink_rcv_skb+0x155/0x420 [ 1606.107753][ T2370] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1606.107775][ T2370] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1606.107803][ T2370] ? netlink_deliver_tap+0x1ae/0xd30 [ 1606.107824][ T2370] genl_rcv+0x28/0x40 [ 1606.107842][ T2370] netlink_unicast+0x5aa/0x870 [ 1606.107863][ T2370] ? __pfx_netlink_unicast+0x10/0x10 [ 1606.107890][ T2370] netlink_sendmsg+0x8d1/0xdd0 [ 1606.107912][ T2370] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1606.107939][ T2370] ____sys_sendmsg+0xa98/0xc70 [ 1606.107961][ T2370] ? copy_msghdr_from_user+0x10a/0x160 [ 1606.107978][ T2370] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1606.108002][ T2370] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1606.108018][ T2370] ? lockdep_hardirqs_on+0x7c/0x110 [ 1606.108035][ T2370] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1606.108054][ T2370] ___sys_sendmsg+0x134/0x1d0 [ 1606.108072][ T2370] ? __pfx____sys_sendmsg+0x10/0x10 [ 1606.108118][ T2370] __sys_sendmsg+0x16d/0x220 [ 1606.108136][ T2370] ? __pfx___sys_sendmsg+0x10/0x10 [ 1606.108168][ T2370] do_syscall_64+0xcd/0x4c0 [ 1606.108188][ T2370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1606.108203][ T2370] RIP: 0033:0x7f7d0778ebe9 [ 1606.108217][ T2370] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1606.108232][ T2370] RSP: 002b:00007f7d059f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1606.108248][ T2370] RAX: ffffffffffffffda RBX: 00007f7d079c5fa0 RCX: 00007f7d0778ebe9 [ 1606.108258][ T2370] RDX: 6b7e369c4a37b0ea RSI: 0000200000000200 RDI: 0000000000000009 [ 1606.108268][ T2370] RBP: 00007f7d059f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1606.108277][ T2370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1606.108287][ T2370] R13: 00007f7d079c6038 R14: 00007f7d079c5fa0 R15: 00007ffd0ad1b2b8 [ 1606.108309][ T2370] [ 1606.432144][ T2371] netlink: 20 bytes leftover after parsing attributes in process `syz.7.5280'. [ 1606.649627][ T30] audit: type=1400 audit(2000000530.450:2087): avc: denied { connect } for pid=2367 comm="syz.7.5280" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1606.904793][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.029889][ T24] usb 7-1: new full-speed USB device number 95 using dummy_hcd [ 1607.039398][T21487] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 1607.202639][ T24] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1608.520587][T21487] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1608.529938][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1608.548476][T21487] usb 9-1: config 0 has no interface number 0 [ 1608.559853][ T24] usb 7-1: Product: syz [ 1608.564043][ T24] usb 7-1: Manufacturer: syz [ 1608.592536][T21487] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1608.617899][ T24] usb 7-1: SerialNumber: syz [ 1608.641155][ T24] usb 7-1: config 0 descriptor?? [ 1608.646501][T21487] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1608.654144][ T30] audit: type=1400 audit(2000000532.510:2088): avc: denied { ioctl } for pid=2394 comm="syz.3.5287" path="socket:[107068]" dev="sockfs" ino=107068 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1608.660964][T21487] usb 9-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1608.699701][T21487] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1608.717083][T21487] usb 9-1: config 0 descriptor?? [ 1608.843256][ T30] audit: type=1400 audit(2000000532.710:2089): avc: denied { map } for pid=2401 comm="syz.3.5290" path="/dev/vmci" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1608.866079][ C0] vkms_vblank_simulate: vblank timer overrun [ 1608.903310][ T30] audit: type=1400 audit(2000000532.710:2090): avc: denied { create } for pid=2401 comm="syz.3.5290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 1608.909841][ T24] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1609.011170][ T30] audit: type=1400 audit(2000000532.800:2091): avc: denied { read } for pid=2413 comm="syz.3.5293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1609.095369][ T2418] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5294'. [ 1609.104676][ T2418] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5294'. [ 1609.305296][T21487] prodikeys 0003:041E:2801.0035: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.8-1/input1 [ 1609.473049][ T2419] netlink: 200 bytes leftover after parsing attributes in process `syz.7.5295'. [ 1609.488423][T21487] hid_prodikeys: hid-prodikeys: failed to find output report [ 1609.488423][T21487] [ 1609.520835][T21487] usb 9-1: USB disconnect, device number 29 [ 1609.909604][ T5920] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1610.049906][ T24] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1610.125969][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1610.154973][ T24] usb 7-1: USB disconnect, device number 95 [ 1610.171050][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1610.203934][ T5920] usb 4-1: New USB device found, idVendor=046d, idProduct=c294, bcdDevice= 0.00 [ 1610.218775][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1610.232207][ T5920] usb 4-1: config 0 descriptor?? [ 1610.687348][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.707344][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.715078][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.738098][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.769323][T19647] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1610.777196][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.789937][ T30] audit: type=1400 audit(2000000534.660:2092): avc: denied { map } for pid=2487 comm="syz.6.5302" path="/dev/vcs1" dev="devtmpfs" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 1610.814745][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.835887][ T5920] logitech 0003:046D:C294.0036: unknown main item tag 0x0 [ 1610.853061][ T30] audit: type=1400 audit(2000000534.660:2093): avc: denied { execute } for pid=2487 comm="syz.6.5302" path="/dev/vcs1" dev="devtmpfs" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 1610.908921][T19647] usb 5-1: device descriptor read/64, error -71 [ 1611.251733][ T5920] logitech 0003:046D:C294.0036: hidraw0: USB HID v0.00 Device [HID 046d:c294] on usb-dummy_hcd.3-1/input0 [ 1611.267774][ T5920] logitech 0003:046D:C294.0036: no inputs found [ 1611.278957][T19647] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1611.306898][ T5920] usb 4-1: USB disconnect, device number 18 [ 1611.323458][ T30] audit: type=1400 audit(2000000534.930:2094): avc: denied { remount } for pid=2448 comm="syz.3.5297" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1611.468906][T19647] usb 5-1: device descriptor read/64, error -71 [ 1611.579209][T19647] usb usb5-port1: attempt power cycle [ 1611.712669][ T30] audit: type=1400 audit(2000000535.570:2095): avc: denied { listen } for pid=2512 comm="syz.8.5303" lport=52189 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1612.318895][T19647] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1612.450998][T19647] usb 5-1: device descriptor read/8, error -71 [ 1612.714199][T19647] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1612.795218][T19647] usb 5-1: device descriptor read/8, error -71 [ 1612.804508][ T2525] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1612.822392][ T30] audit: type=1400 audit(2000000536.620:2096): avc: denied { accept } for pid=2512 comm="syz.8.5303" lport=52189 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1613.461897][ T30] audit: type=1400 audit(2000000536.720:2097): avc: denied { execute } for pid=2520 comm="syz.7.5305" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=107908 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1613.559131][T19647] usb usb5-port1: unable to enumerate USB device [ 1613.670718][ T2542] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5306'. [ 1613.680133][ T2542] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5306'. [ 1614.409033][T12960] usb 7-1: new full-speed USB device number 96 using dummy_hcd [ 1614.658196][T12960] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1614.698934][T19647] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 1614.802850][T12960] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1614.816033][T12960] usb 7-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 1614.827662][T12960] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1614.855320][T12960] usb 7-1: config 0 descriptor?? [ 1614.870243][T12960] qmi_wwan 7-1:0.0: probe with driver qmi_wwan failed with error -22 [ 1614.968815][T19647] usb 9-1: Using ep0 maxpacket: 16 [ 1615.013601][T19647] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.267719][T12960] usb 7-1: USB disconnect, device number 96 [ 1615.379035][T19647] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1615.524599][T19647] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1615.577123][T19647] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.586765][T19647] usb 9-1: Product: syz [ 1615.640351][T19647] usb 9-1: Manufacturer: syz [ 1615.658868][T19647] usb 9-1: SerialNumber: syz [ 1616.096076][T19647] usb 9-1: 0:2 : does not exist [ 1616.300661][ T2577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1616.349320][ T2577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1616.586305][T19647] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1616.665178][T19647] usb 9-1: USB disconnect, device number 30 [ 1619.080181][ T2661] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5320'. [ 1619.212466][ T30] audit: type=1400 audit(2000000543.070:2098): avc: denied { mounton } for pid=2706 comm="syz.8.5325" path="/107/file1/file0" dev="autofs" ino=108171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 1619.237527][ T30] audit: type=1400 audit(2000000543.080:2099): avc: denied { read } for pid=2706 comm="syz.8.5325" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1619.323953][ T2719] ptrace attach of "./syz-executor exec"[30380] was attempted by ""[2719] [ 1619.579314][T21487] usb 7-1: new full-speed USB device number 97 using dummy_hcd [ 1619.617280][ T30] audit: type=1400 audit(2000000543.080:2100): avc: denied { open } for pid=2706 comm="syz.8.5325" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1619.691640][ T2711] delete_channel: no stack [ 1619.709810][ T30] audit: type=1400 audit(2000000543.080:2101): avc: denied { ioctl } for pid=2706 comm="syz.8.5325" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1619.772955][T21487] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1619.781793][T21487] usb 7-1: not running at top speed; connect to a high speed hub [ 1619.810231][T21487] usb 7-1: config 2 has an invalid interface number: 212 but max is 1 [ 1619.825388][T21487] usb 7-1: config 2 has an invalid interface number: 226 but max is 1 [ 1619.834666][T21487] usb 7-1: config 2 has an invalid descriptor of length 187, skipping remainder of the config [ 1619.845648][T21487] usb 7-1: config 2 has no interface number 0 [ 1619.852374][T21487] usb 7-1: config 2 has no interface number 1 [ 1619.858588][T21487] usb 7-1: config 2 interface 212 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1619.877232][T21487] usb 7-1: config 2 interface 226 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1619.907249][T21487] usb 7-1: config 2 interface 212 has no altsetting 0 [ 1619.924471][T21487] usb 7-1: New USB device found, idVendor=0738, idProduct=4540, bcdDevice=c6.ce [ 1619.933802][T21487] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.945946][T21487] usb 7-1: Product: syz [ 1619.954958][T21487] usb 7-1: Manufacturer: syz [ 1619.963826][T21487] usb 7-1: SerialNumber: syz [ 1619.985878][ T2749] lo speed is unknown, defaulting to 1000 [ 1620.071131][ T30] audit: type=1400 audit(2000000543.940:2102): avc: denied { setopt } for pid=2742 comm="syz.4.5329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1620.071301][ T2749] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5329'. [ 1620.179725][T12962] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 1620.361828][T12962] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1620.382358][ T2782] netlink: 'syz.7.5331': attribute type 16 has an invalid length. [ 1620.402772][T12962] usb 4-1: not running at top speed; connect to a high speed hub [ 1620.403969][ T2782] netlink: 48 bytes leftover after parsing attributes in process `syz.7.5331'. [ 1620.432302][T12962] usb 4-1: config 1 has an invalid interface number: 138 but max is 0 [ 1620.457076][T12962] usb 4-1: config 1 has no interface number 0 [ 1620.475790][T12962] usb 4-1: config 1 interface 138 has no altsetting 0 [ 1620.477050][ T2782] bridge0: port 1(bridge_slave_0) entered disabled state [ 1620.600009][T12962] usb 4-1: New USB device found, idVendor=0cb8, idProduct=c90b, bcdDevice= d.ae [ 1620.610050][T12962] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.619495][T12962] usb 4-1: Product: syz [ 1620.623695][T12962] usb 4-1: Manufacturer: syz [ 1620.628336][T12962] usb 4-1: SerialNumber: syz [ 1620.950917][T12962] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1621.035665][T12962] usb 4-1: USB disconnect, device number 19 [ 1621.578552][ T2816] delete_channel: no stack [ 1621.633152][T21487] usb 7-1: USB disconnect, device number 97 [ 1621.979272][ T2842] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5334'. [ 1622.233041][ T2847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5335'. [ 1622.242298][ T2847] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5335'. [ 1622.269354][ T2847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5335'. [ 1622.531439][ T30] audit: type=1400 audit(2000000546.400:2103): avc: denied { setopt } for pid=2850 comm="syz.6.5336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1622.592022][ T2854] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5337'. [ 1622.677108][ T2863] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5337'. [ 1622.687471][ T30] audit: type=1400 audit(2000000546.550:2104): avc: denied { listen } for pid=2858 comm="syz.3.5339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1623.635603][ T30] audit: type=1400 audit(2000000546.670:2105): avc: denied { ioctl } for pid=2853 comm="syz.4.5337" path="socket:[108246]" dev="sockfs" ino=108246 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1623.926170][ T2873] bridge0: port 2(bridge_slave_1) entered disabled state [ 1623.934397][ T2873] bridge0: port 1(bridge_slave_0) entered disabled state [ 1623.948110][ T2873] bridge0: entered allmulticast mode [ 1624.479688][ T5920] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1624.730147][ T5920] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1624.768355][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1624.810725][ T5920] usb 5-1: Product: syz [ 1624.815084][ T5920] usb 5-1: Manufacturer: syz [ 1624.877663][ T5920] usb 5-1: SerialNumber: syz [ 1624.914136][ T5920] usb 5-1: config 0 descriptor?? [ 1624.929228][ T2891] delete_channel: no stack [ 1625.144105][ T5920] hso 5-1:0.0: Failed to find BULK IN ep [ 1625.221967][ T2908] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5347'. [ 1625.230374][ T5920] usb-storage 5-1:0.0: USB Mass Storage device detected [ 1625.231505][ T2908] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5347'. [ 1625.319171][ T2908] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5347'. [ 1625.632303][ T30] audit: type=1400 audit(2000000549.500:2106): avc: denied { block_suspend } for pid=2915 comm="syz.3.5348" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1625.900004][ T5920] usb 5-1: USB disconnect, device number 106 [ 1625.918876][T12958] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1626.099679][T12958] usb 4-1: Using ep0 maxpacket: 8 [ 1626.352065][T12958] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1626.363403][T12958] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1626.376402][T12958] usb 4-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 1626.386999][T12958] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1627.026599][ T2945] pim6reg: entered allmulticast mode [ 1627.038525][ T2945] pim6reg: left allmulticast mode [ 1627.078552][ T30] audit: type=1326 audit(2000000550.880:2107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.203664][ T30] audit: type=1326 audit(2000000550.880:2108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.228009][ T30] audit: type=1326 audit(2000000550.880:2109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.257765][ T30] audit: type=1326 audit(2000000550.880:2110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.314565][ T30] audit: type=1326 audit(2000000550.880:2111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.373911][ T30] audit: type=1326 audit(2000000550.880:2112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.410572][T12960] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1627.441785][ T30] audit: type=1326 audit(2000000550.880:2113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.467180][ T30] audit: type=1326 audit(2000000550.880:2114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.494776][ T30] audit: type=1326 audit(2000000550.880:2115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2915 comm="syz.3.5348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7d0778ebe9 code=0x7ffc0000 [ 1627.578898][T12960] usb 5-1: Using ep0 maxpacket: 8 [ 1627.585632][T12960] usb 5-1: config 0 has an invalid interface number: 33 but max is 1 [ 1627.593945][T12960] usb 5-1: config 0 has no interface number 1 [ 1627.604963][T12960] usb 5-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 1627.677702][T12960] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1627.814758][T12960] usb 5-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 1627.825971][T12960] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.834730][T12960] usb 5-1: Product: syz [ 1627.841289][T12960] usb 5-1: Manufacturer: syz [ 1627.846008][T12960] usb 5-1: SerialNumber: syz [ 1627.857960][T12960] usb 5-1: config 0 descriptor?? [ 1627.878918][T12960] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 1628.313039][ T2959] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=262 sclass=netlink_route_socket pid=2959 comm=syz.4.5352 [ 1629.396840][T12958] usb 4-1: string descriptor 0 read error: -71 [ 1629.420349][T12958] hub 4-1:32.0: USB hub found [ 1629.453410][T12958] hub 4-1:32.0: config failed, can't read hub descriptor (err -22) [ 1629.669311][ T5920] usb 7-1: new high-speed USB device number 98 using dummy_hcd [ 1629.712463][T12958] usb 4-1: reset high-speed USB device number 20 using dummy_hcd [ 1629.732222][T12958] usb 4-1: device reset changed ep0 maxpacket size! [ 1629.766234][T12958] usb 4-1: USB disconnect, device number 20 [ 1629.819751][ T5920] usb 7-1: Using ep0 maxpacket: 32 [ 1629.826808][ T5920] usb 7-1: config 0 has an invalid interface number: 58 but max is 0 [ 1629.839842][ T5920] usb 7-1: config 0 has no interface number 0 [ 1629.846069][ T5920] usb 7-1: config 0 interface 58 has no altsetting 0 [ 1629.861239][ T5920] usb 7-1: New USB device found, idVendor=0711, idProduct=0902, bcdDevice=43.1b [ 1629.871481][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1629.881825][ T5920] usb 7-1: Product: syz [ 1629.886041][ T5920] usb 7-1: Manufacturer: syz [ 1629.891825][ T5920] usb 7-1: SerialNumber: syz [ 1629.919460][ T5920] usb 7-1: config 0 descriptor?? [ 1629.932185][ T5920] sisusb 7-1:0.58: Invalid USB2VGA device [ 1629.938089][ T5920] sisusb 7-1:0.58: probe with driver sisusb failed with error -22 [ 1630.047372][ T3004] netlink: 'syz.7.5357': attribute type 10 has an invalid length. [ 1630.062887][ T3004] team0: Device hsr_slave_0 failed to register rx_handler [ 1630.173349][T12958] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1630.207730][ T2338] pvrusb2: Invalid write control endpoint [ 1630.242787][T12960] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 1630.307611][ T2338] usb 5-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 1630.319639][ T3013] IPv6: NLM_F_CREATE should be specified when creating new route [ 1630.368966][T12960] usb 5-1: USB disconnect, device number 107 [ 1630.442698][ T2338] usb 5-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 1630.521416][T12958] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1630.650844][T12958] usb 4-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 1630.704365][T12958] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1630.747750][T12958] usb 4-1: Product: syz [ 1630.772132][T12958] usb 4-1: Manufacturer: syz [ 1630.910789][T12958] usb 4-1: SerialNumber: syz [ 1630.919755][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 1630.919771][ T30] audit: type=1326 audit(2000000554.730:2132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1630.950712][T12958] usb 4-1: config 0 descriptor?? [ 1630.969273][ T30] audit: type=1326 audit(2000000554.730:2133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1630.998675][ T30] audit: type=1326 audit(2000000554.730:2134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.038911][ T30] audit: type=1326 audit(2000000554.730:2135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.064845][ T30] audit: type=1326 audit(2000000554.730:2136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.066657][ T944] usb 7-1: USB disconnect, device number 98 [ 1631.088412][ T30] audit: type=1326 audit(2000000554.730:2137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.088466][ T30] audit: type=1326 audit(2000000554.730:2138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.088506][ T30] audit: type=1326 audit(2000000554.730:2139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.088543][ T30] audit: type=1326 audit(2000000554.730:2140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.088579][ T30] audit: type=1326 audit(2000000554.740:2141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3003 comm="syz.7.5357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8bfd8ebe9 code=0x7fc00000 [ 1631.210103][ T5858] usb 4-1: USB disconnect, device number 21 [ 1631.565354][ T3039] delete_channel: no stack [ 1631.873436][ T3043] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1635.842000][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1635.891222][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1635.903420][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1635.918352][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1635.930534][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1636.821589][ T7088] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1637.101478][ T3107] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1637.125979][ T3090] lo speed is unknown, defaulting to 1000 [ 1637.225453][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 1637.225470][ T30] audit: type=1400 audit(2000000561.089:2199): avc: denied { append } for pid=3119 comm="syz.6.5372" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1637.261202][ T30] audit: type=1400 audit(2000000561.119:2200): avc: denied { open } for pid=3119 comm="syz.6.5372" path="/21/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1637.285926][ T7088] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1637.543393][ T3129] sctp: [Deprecated]: syz.7.5374 (pid 3129) Use of int in max_burst socket option deprecated. [ 1637.543393][ T3129] Use struct sctp_assoc_value instead [ 1638.022885][T27935] Bluetooth: hci2: command tx timeout [ 1638.282612][ T30] audit: type=1400 audit(2000000562.149:2201): avc: denied { unmount } for pid=1361 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1638.333795][ T3114] delete_channel: no stack [ 1638.377683][ T7088] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1639.497466][ T7088] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1639.637526][ T3239] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5379'. [ 1639.893421][ T3090] chnl_net:caif_netlink_parms(): no params data found [ 1640.438994][T27935] Bluetooth: hci2: command tx timeout [ 1640.670024][ T3262] overlayfs: failed lookup in lower (newroot/519, name='bus', err=-40): overlapping layers [ 1641.047060][ T7088] bridge_slave_1: left allmulticast mode [ 1641.063355][ T7088] bridge_slave_1: left promiscuous mode [ 1641.080399][ T7088] bridge0: port 2(bridge_slave_1) entered disabled state [ 1641.204416][ T7088] bridge_slave_0: left allmulticast mode [ 1641.210877][ T7088] bridge_slave_0: left promiscuous mode [ 1641.218196][ T7088] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.642436][ T51] Bluetooth: hci2: command tx timeout [ 1642.907080][ T7088] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1642.947314][ T7088] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.966549][ T7088] bond0 (unregistering): (slave team0): Releasing backup interface [ 1643.107306][ T7088] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1643.231789][ T30] audit: type=1400 audit(2000000567.099:2202): avc: denied { listen } for pid=3321 comm="syz.4.5386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1643.817049][ T3325] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1643.953220][ T7088] bond0 (unregistering): Released all slaves [ 1643.993214][ T3330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5387'. [ 1644.246400][ T3090] bridge0: port 1(bridge_slave_0) entered blocking state [ 1644.291730][ T3090] bridge0: port 1(bridge_slave_0) entered disabled state [ 1644.302909][ T3090] bridge_slave_0: entered allmulticast mode [ 1644.385913][ T3090] bridge_slave_0: entered promiscuous mode [ 1644.449031][ T5858] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1644.659346][ T51] Bluetooth: hci2: command tx timeout [ 1644.819198][ T3090] bridge0: port 2(bridge_slave_1) entered blocking state [ 1644.836466][ T3090] bridge0: port 2(bridge_slave_1) entered disabled state [ 1644.851946][ T3374] delete_channel: no stack [ 1644.862079][ T3090] bridge_slave_1: entered allmulticast mode [ 1644.872590][ T3090] bridge_slave_1: entered promiscuous mode [ 1644.900830][ T5858] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1644.913132][ T5858] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 31, changing to 7 [ 1644.928060][ T5858] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1644.947308][ T5858] usb 4-1: string descriptor 0 read error: -22 [ 1644.955460][ T5858] usb 4-1: New USB device found, idVendor=2013, idProduct=0251, bcdDevice=e8.6e [ 1644.965487][ T5858] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1644.987339][ T5858] usb 4-1: config 0 descriptor?? [ 1645.001631][ T5858] em28xx 4-1:0.0: New device @ 480 Mbps (2013:0251, interface 0, class 0) [ 1645.015199][ T5858] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1645.042999][ T3090] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1645.103666][ T7088] hsr_slave_0: left promiscuous mode [ 1645.114047][ T7088] hsr_slave_1: left promiscuous mode [ 1645.121572][ T7088] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1645.130596][ T7088] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1645.146563][ T7088] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1645.155733][ T7088] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1645.180725][ T7088] veth1_macvtap: left promiscuous mode [ 1645.186280][ T7088] veth0_macvtap: left promiscuous mode [ 1645.187999][ T3408] netlink: 'syz.7.5391': attribute type 21 has an invalid length. [ 1645.192030][ T7088] veth1_vlan: left promiscuous mode [ 1645.206487][ T7088] veth0_vlan: left promiscuous mode [ 1645.959434][T12962] usb 7-1: new low-speed USB device number 99 using dummy_hcd [ 1646.163385][ T5858] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1646.172428][ T5858] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1646.199394][T12962] usb 7-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 1646.211156][ T5858] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 1646.230505][T12962] usb 7-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 1646.240665][ T5858] em28xx 4-1:0.0: No AC97 audio processor [ 1646.262086][T12962] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1646.295092][T12962] usb 7-1: probing VID:PID(2201:012C) [ 1646.301675][T12962] usb 7-1: Could not find two sets of bulk-in/out endpoint pairs [ 1646.323667][T12962] vub300 7-1:64.0: probe with driver vub300 failed with error -22 [ 1646.455899][ T7088] team0 (unregistering): Port device team_slave_1 removed [ 1646.508666][ T7088] team0 (unregistering): Port device team_slave_0 removed [ 1646.514916][ T24] usb 7-1: USB disconnect, device number 99 [ 1647.290131][ T3090] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1647.746373][ T3090] team0: Port device team_slave_0 added [ 1647.785184][ T7090] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1647.819728][ T3491] netlink: 92 bytes leftover after parsing attributes in process `syz.7.5396'. [ 1647.846778][ T3090] team0: Port device team_slave_1 added [ 1647.866901][ T7080] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1647.887875][ T7080] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1648.008404][ T7080] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1648.045577][ T3090] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1648.055937][ T3090] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1648.086317][ T3090] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1648.127192][ T3090] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1648.152269][ T3090] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1648.244913][ T3090] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1648.528431][ T3090] hsr_slave_0: entered promiscuous mode [ 1648.563755][ T3090] hsr_slave_1: entered promiscuous mode [ 1648.583490][ T3090] debugfs: 'hsr0' already exists in 'hsr' [ 1648.613686][ T3090] Cannot create hsr debugfs directory [ 1648.968342][ T3090] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1648.982741][ T3090] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1648.994578][ T3090] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1649.016177][ T3090] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1649.184915][ T3090] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1649.237891][ T3090] 8021q: adding VLAN 0 to HW filter on device team0 [ 1649.265627][ T7088] bridge0: port 1(bridge_slave_0) entered blocking state [ 1649.272752][ T7088] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1649.296266][ T7088] bridge0: port 2(bridge_slave_1) entered blocking state [ 1649.303394][ T7088] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1649.630265][ T3643] delete_channel: no stack [ 1650.242013][ T3662] netlink: 200 bytes leftover after parsing attributes in process `syz.4.5403'. [ 1650.260697][ T30] audit: type=1400 audit(2000000574.089:2203): avc: denied { setopt } for pid=3657 comm="syz.4.5403" lport=53941 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1650.603478][ T24] usb 4-1: USB disconnect, device number 22 [ 1650.613067][ T24] em28xx 4-1:0.0: Disconnecting em28xx [ 1650.617588][ T3090] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1650.634951][ T24] em28xx 4-1:0.0: Freeing device [ 1650.739711][ T3684] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5405'. [ 1651.107536][ T3090] veth0_vlan: entered promiscuous mode [ 1651.116499][ T30] audit: type=1400 audit(2000000574.979:2204): avc: denied { write } for pid=3699 comm="syz.3.5408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1651.121559][ T3090] veth1_vlan: entered promiscuous mode [ 1651.135966][ C1] vkms_vblank_simulate: vblank timer overrun [ 1651.242697][ T3090] veth0_macvtap: entered promiscuous mode [ 1651.253344][ T30] audit: type=1400 audit(2000000575.119:2205): avc: denied { connect } for pid=3699 comm="syz.3.5408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1651.255596][ T3090] veth1_macvtap: entered promiscuous mode [ 1651.301660][ T3090] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1651.313794][ T3090] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1651.326968][ T7078] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.345606][ T7078] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.359995][T13205] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.373681][T13205] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.528423][ T3738] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5410'. [ 1651.539246][ T7078] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1651.547066][ T7078] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1651.565548][ T3738] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5410'. [ 1651.580823][ T7078] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1651.588687][ T7078] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1651.662088][ T3746] smc: net device bond0 applied user defined pnetid SYZ2 [ 1651.678574][ T3749] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5411'. [ 1651.723334][ T3748] netlink: 184 bytes leftover after parsing attributes in process `syz.9.5369'. [ 1651.878273][ T3749] smc: removing net device bond0 with user defined pnetid SYZ2 [ 1651.973191][ T3749] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1651.989513][T21487] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 1652.001656][ T3749] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1652.365527][ T3749] bond0 (unregistering): (slave team0): Releasing backup interface [ 1652.378166][ T3749] bond0 (unregistering): (slave syz_tun): Releasing backup interface [ 1652.392890][ T3749] bond0 (unregistering): Released all slaves [ 1652.454162][T21487] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1652.466925][T21487] usb 7-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1652.490421][T21487] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.506366][T21487] usb 7-1: config 0 descriptor?? [ 1653.652965][T21487] lenovo 0003:17EF:6047.0037: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.6-1/input0 [ 1653.880400][ T3820] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5417'. [ 1654.164470][ T3822] mkiss: ax0: crc mode is auto. [ 1654.518455][ T3753] netlink: 'syz.6.5412': attribute type 10 has an invalid length. [ 1654.529814][ T3753] netlink: 'syz.6.5412': attribute type 10 has an invalid length. [ 1654.557628][ T3753] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1654.648620][ T30] audit: type=1400 audit(2000000578.509:2206): avc: denied { write } for pid=3838 comm="syz.7.5421" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 1654.667704][ C1] vkms_vblank_simulate: vblank timer overrun [ 1654.721011][ T3753] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1654.754316][ T30] audit: type=1400 audit(2000000578.539:2207): avc: denied { create } for pid=3839 comm="syz.4.5420" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1655.032256][T21487] lenovo 0003:17EF:6047.0037: Fn-lock setting failed: -71 [ 1655.037428][ T30] audit: type=1400 audit(2000000578.549:2208): avc: denied { unlink } for pid=16600 comm="syz-executor" name="file1" dev="tmpfs" ino=2855 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1655.116809][T21487] lenovo 0003:17EF:6047.0037: Sensitivity setting failed: -71 [ 1655.742482][ T3848] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1655.749037][ T3848] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1655.749954][T21487] usb 7-1: USB disconnect, device number 100 [ 1655.757125][ T3848] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1655.924970][ T3848] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1656.510411][ T3848] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1656.529914][ T3848] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1656.564537][ T3848] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1657.239339][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 1657.798803][ T51] Bluetooth: hci4: command 0x0c1a tx timeout [ 1658.091896][ T3905] comedi comedi3: c6xdigio: I/O port conflict (0x4,3) [ 1658.140252][ T3905] ------------[ cut here ]------------ [ 1658.146225][ T3905] kernfs: can not remove 'bind', no directory [ 1658.166626][ T3905] WARNING: CPU: 1 PID: 3905 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xff/0x110 [ 1658.177080][ T3905] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1658.181904][ T3905] CPU: 1 UID: 0 PID: 3905 Comm: syz.4.5429 Not tainted syzkaller #0 PREEMPT(full) [ 1658.191841][ T3905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1658.202426][ T3905] RIP: 0010:kernfs_remove_by_name_ns+0xff/0x110 [ 1658.208671][ T3905] Code: 48 89 df 31 db e8 61 a2 ff ff 48 89 ef e8 e9 a4 35 ff eb b1 e8 62 2d 5a ff 90 48 c7 c7 40 5f c3 8b 4c 89 e6 e8 e2 d0 18 ff 90 <0f> 0b 90 90 eb b4 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 1658.229100][ T3905] RSP: 0018:ffffc90003947940 EFLAGS: 00010282 [ 1658.235201][ T3905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000ee7a000 [ 1658.236050][ T30] audit: type=1400 audit(2000000582.099:2209): avc: denied { write } for pid=5833 comm="syz-executor" path="pipe:[4833]" dev="pipefs" ino=4833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 1658.243856][ T3905] RDX: 0000000000080000 RSI: ffffffff817a3365 RDI: 0000000000000001 [ 1658.275692][ T3905] RBP: ffffffff8f500700 R08: 0000000000000001 R09: 0000000000000000 [ 1658.284454][ T3905] R10: 0000000000000001 R11: 000000000004f4e0 R12: ffffffff8c426b40 [ 1658.293062][ T3905] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880314ba000 [ 1658.301941][ T3905] FS: 00007f933ade26c0(0000) GS:ffff8881247b8000(0000) knlGS:0000000000000000 [ 1658.311520][ T3905] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1658.318106][ T3905] CR2: 00007f1537ca1d58 CR3: 000000005bb77000 CR4: 00000000003526f0 [ 1658.326704][ T3905] Call Trace: [ 1658.330516][ T3905] [ 1658.333448][ T3905] driver_remove_file+0x4a/0x60 [ 1658.338308][ T3905] bus_remove_driver+0x224/0x2c0 [ 1658.344706][ T3905] driver_unregister+0x76/0xb0 [ 1658.350148][ T3905] comedi_device_detach_locked+0x12f/0xa50 [ 1658.355968][ T3905] comedi_device_detach+0x67/0xb0 [ 1658.361565][ T3905] comedi_device_attach+0x43d/0x900 [ 1658.366772][ T3905] do_devconfig_ioctl+0x1b1/0x710 [ 1658.372412][ T3905] ? __mutex_lock+0x1c5/0x1060 [ 1658.377352][ T3905] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 1658.383232][ T3905] ? find_held_lock+0x2b/0x80 [ 1658.387925][ T3905] comedi_unlocked_ioctl+0x165d/0x2f00 [ 1658.393452][ T3905] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1658.399332][ T3905] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1658.405230][ T3905] ? do_vfs_ioctl+0x128/0x14f0 [ 1658.410625][ T3905] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1658.415666][ T3905] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1658.423104][ T3905] ? hook_file_ioctl_common+0x145/0x410 [ 1658.428661][ T3905] ? selinux_file_ioctl+0x180/0x270 [ 1658.434479][ T3905] ? selinux_file_ioctl+0xb4/0x270 [ 1658.440256][ T3905] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1658.446085][ T3905] __x64_sys_ioctl+0x18b/0x210 [ 1658.451521][ T3905] do_syscall_64+0xcd/0x4c0 [ 1658.456044][ T3905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1658.462573][ T3905] RIP: 0033:0x7f9339f8ebe9 [ 1658.466995][ T3905] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1658.487129][ T3905] RSP: 002b:00007f933ade2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1658.495976][ T3905] RAX: ffffffffffffffda RBX: 00007f933a1c6090 RCX: 00007f9339f8ebe9 [ 1658.504447][ T3905] RDX: 0000200000000180 RSI: 0000000040946400 RDI: 0000000000000005 [ 1658.512855][ T3905] RBP: 00007f933a011e19 R08: 0000000000000000 R09: 0000000000000000 [ 1658.521160][ T3905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1658.529464][ T3905] R13: 00007f933a1c6128 R14: 00007f933a1c6090 R15: 00007ffd761d0c88 [ 1658.537428][ T3905] [ 1658.540789][ T3905] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1658.548041][ T3905] CPU: 1 UID: 0 PID: 3905 Comm: syz.4.5429 Not tainted syzkaller #0 PREEMPT(full) [ 1658.557298][ T3905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1658.567324][ T3905] Call Trace: [ 1658.570577][ T3905] [ 1658.573481][ T3905] dump_stack_lvl+0x3d/0x1f0 [ 1658.578051][ T3905] vpanic+0x6e8/0x7a0 [ 1658.582013][ T3905] ? __pfx_vpanic+0x10/0x10 [ 1658.586502][ T3905] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1658.592106][ T3905] panic+0xca/0xd0 [ 1658.595806][ T3905] ? __pfx_panic+0x10/0x10 [ 1658.600206][ T3905] check_panic_on_warn+0xab/0xb0 [ 1658.605124][ T3905] __warn+0xf6/0x3c0 [ 1658.608997][ T3905] ? preempt_schedule_notrace+0x62/0xe0 [ 1658.614519][ T3905] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1658.620135][ T3905] report_bug+0x3c3/0x580 [ 1658.624438][ T3905] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1658.630049][ T3905] handle_bug+0x184/0x210 [ 1658.634376][ T3905] exc_invalid_op+0x17/0x50 [ 1658.638868][ T3905] asm_exc_invalid_op+0x1a/0x20 [ 1658.643703][ T3905] RIP: 0010:kernfs_remove_by_name_ns+0xff/0x110 [ 1658.649931][ T3905] Code: 48 89 df 31 db e8 61 a2 ff ff 48 89 ef e8 e9 a4 35 ff eb b1 e8 62 2d 5a ff 90 48 c7 c7 40 5f c3 8b 4c 89 e6 e8 e2 d0 18 ff 90 <0f> 0b 90 90 eb b4 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 1658.669514][ T3905] RSP: 0018:ffffc90003947940 EFLAGS: 00010282 [ 1658.675550][ T3905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000ee7a000 [ 1658.683510][ T3905] RDX: 0000000000080000 RSI: ffffffff817a3365 RDI: 0000000000000001 [ 1658.691465][ T3905] RBP: ffffffff8f500700 R08: 0000000000000001 R09: 0000000000000000 [ 1658.699416][ T3905] R10: 0000000000000001 R11: 000000000004f4e0 R12: ffffffff8c426b40 [ 1658.707364][ T3905] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880314ba000 [ 1658.715315][ T3905] ? __warn_printk+0x1a5/0x350 [ 1658.720076][ T3905] driver_remove_file+0x4a/0x60 [ 1658.724904][ T3905] bus_remove_driver+0x224/0x2c0 [ 1658.729815][ T3905] driver_unregister+0x76/0xb0 [ 1658.734558][ T3905] comedi_device_detach_locked+0x12f/0xa50 [ 1658.740342][ T3905] comedi_device_detach+0x67/0xb0 [ 1658.745346][ T3905] comedi_device_attach+0x43d/0x900 [ 1658.750523][ T3905] do_devconfig_ioctl+0x1b1/0x710 [ 1658.755524][ T3905] ? __mutex_lock+0x1c5/0x1060 [ 1658.760263][ T3905] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 1658.765885][ T3905] ? find_held_lock+0x2b/0x80 [ 1658.770540][ T3905] comedi_unlocked_ioctl+0x165d/0x2f00 [ 1658.775990][ T3905] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1658.781777][ T3905] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1658.787645][ T3905] ? do_vfs_ioctl+0x128/0x14f0 [ 1658.792396][ T3905] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1658.797399][ T3905] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1658.804229][ T3905] ? hook_file_ioctl_common+0x145/0x410 [ 1658.809760][ T3905] ? selinux_file_ioctl+0x180/0x270 [ 1658.814941][ T3905] ? selinux_file_ioctl+0xb4/0x270 [ 1658.820039][ T3905] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1658.825826][ T3905] __x64_sys_ioctl+0x18b/0x210 [ 1658.830569][ T3905] do_syscall_64+0xcd/0x4c0 [ 1658.835066][ T3905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1658.840928][ T3905] RIP: 0033:0x7f9339f8ebe9 [ 1658.845316][ T3905] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1658.864894][ T3905] RSP: 002b:00007f933ade2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1658.873285][ T3905] RAX: ffffffffffffffda RBX: 00007f933a1c6090 RCX: 00007f9339f8ebe9 [ 1658.881236][ T3905] RDX: 0000200000000180 RSI: 0000000040946400 RDI: 0000000000000005 [ 1658.889180][ T3905] RBP: 00007f933a011e19 R08: 0000000000000000 R09: 0000000000000000 [ 1658.897121][ T3905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1658.905065][ T3905] R13: 00007f933a1c6128 R14: 00007f933a1c6090 R15: 00007ffd761d0c88 [ 1658.913021][ T3905] [ 1658.916241][ T3905] Kernel Offset: disabled [ 1658.920542][ T3905] Rebooting in 86400 seconds..