last executing test programs: 3.478390444s ago: executing program 1 (id=64): r0 = socket$igmp6(0xa, 0x3, 0x87) (async) r1 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source', &(0x7f0000000180)=':..:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='ceph\x00', 0x0) (async) futex_waitv(&(0x7f00000006c0)=[{0x7, 0x0, 0x2, 0xca9a3b}], 0x1, 0x0, 0x0, 0x1) (async) syz_usb_connect$uac3(0x2, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8e4, 0x17f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0xa, 0xb0, 0xf, {0x8, 0xb, 0x0, 0x2, 0x1, 0x26, 0x30, 0x9e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x120, 0x4, 0xa, 0x14, {0xa, 0x25, 0x25, 0x1ff, 0x50, 0xff6f}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x6, 0xe2, 0x1, {0xa, 0x25, 0x25, 0x2, 0xd, 0x1}}}}}}}}]}}, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000100)={0x100, 0x6, 0x9, 0x3, 0x8, 0x7}) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='ceph\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0) 2.402234581s ago: executing program 0 (id=72): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$inet_udp(0x2, 0x2, 0x0) mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x5) socket(0x28, 0xc6b32aae47b40933, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fchdir(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000200)=@file={0x1, './file1\x00'}, 0x6e, 0x0}}], 0x2, 0x4000000) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r2, 0x0, 0x17, &(0x7f0000000180)=0x80, 0x4) setsockopt$inet_int(r2, 0x0, 0x7, &(0x7f0000000000)=0x40, 0x4) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000840)={0x2, 0x0, @ioapic={0x8000000, 0x5, 0x800, 0x3, 0x0, [{0xf0, 0x8, 0x6, '\x00', 0xe}, {0x9, 0x4, 0x9, '\x00', 0x2}, {0x8, 0x8e, 0x9, '\x00', 0x3}, {0x8, 0x1, 0x19, '\x00', 0x9}, {0x5, 0x7, 0xa8, '\x00', 0x3a}, {0x1, 0x29, 0xff, '\x00', 0x76}, {0x2, 0x5, 0x18, '\x00', 0x4}, {0x8, 0x3, 0xa8, '\x00', 0xfb}, {0x3, 0x47, 0xc, '\x00', 0x2}, {0x7, 0x4b, 0x5, '\x00', 0xa}, {0x3, 0x2, 0x86, '\x00', 0x7}, {0x1, 0x5, 0x7, '\x00', 0x1}, {0x4, 0xaf, 0x0, '\x00', 0xb1}, {0x80, 0x8d, 0x7b, '\x00', 0x6}, {0x5, 0x3, 0x8, '\x00', 0x14}, {0xc, 0x9, 0x9, '\x00', 0x9}, {0x5, 0x1, 0x5, '\x00', 0x1}, {0x8, 0xfd, 0x80, '\x00', 0x9}, {0x3, 0x8, 0xb7, '\x00', 0x7}, {0x5, 0x7, 0x7, '\x00', 0x2}, {0x4, 0x41, 0x3, '\x00', 0xa}, {0x3, 0x2, 0x3, '\x00', 0xb}, {0x0, 0x3, 0x6, '\x00', 0x7}, {0x8, 0x2, 0x9, '\x00', 0x5}]}}) recvmmsg(r2, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000004740)={0x2c, 0x18, 0x229, 0x0, 0x25dfdbff, {0x2}, [@typed={0x8, 0x800, 0x0, 0x0, @u32=0x4}, @typed={0x8, 0x1e, 0x0, 0x0, @fd}, @nested={0x8, 0x5, 0x0, 0x1, [@typed={0x4, 0x23, 0x0, 0x0, @binary}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x41800}, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xb, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7d, 0x76, 0x1, 0x0, 0x0, 0x8, 0x10, 0xc, 0x8, 0x0, '\x00', 0x0, 0x7f}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x5, 0x81, 0x7fc00000}]}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x0, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x3, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x1ff, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0x100000b, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0x1, 0xa, 0x0, 0x71, 0x2, 0x6, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x4007, 0x7, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xf, 0x2bf, 0x5, 0x1000, 0xfffffffc, 0x0, 0x0, 0x7, 0x5, 0x2f, 0x3, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0xfff, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x4, 0x1, 0x2, 0x2, 0x20009, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x4, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x40000100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1006, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8005, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x5, 0x0, 0x1003, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x1, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x0, 0x1, 0x10080, 0x6, 0x5, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0xa114}, {r5}], 0x20000000000000dc, 0x0, 0x0, 0xe) 2.356705632s ago: executing program 1 (id=73): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xa8}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x2f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0x8e4}}]}) 1.811623805s ago: executing program 1 (id=79): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a004e220000000500002d003a2d003a0040ffffe000000102000000200002000a00000000000000ff0100000000fffffffffffffff000019c0000000d0001007564703a"], 0x6c}, 0x1, 0x0, 0x0, 0x20008014}, 0x20040084) 1.803183765s ago: executing program 1 (id=80): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000002080), 0xe) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone3(&(0x7f0000000180)={0x42907480, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x3a00}, 0x58) 1.754317367s ago: executing program 1 (id=81): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x408c0}, 0x60804) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) read$FUSE(r1, &(0x7f0000000800)={0x2020}, 0x2020) sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x44044) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[], 0xd0060) socket$inet6_udplite(0xa, 0x2, 0x88) (async) sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x408c0}, 0x60804) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) (async) read$FUSE(r1, &(0x7f0000000800)={0x2020}, 0x2020) (async) sendmsg$BATADV_CMD_SET_VLAN(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000000}, 0x44044) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[], 0xd0060) (async) 1.754121767s ago: executing program 1 (id=82): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/reserved_size', 0x202, 0x46) copy_file_range(r2, 0x0, r2, &(0x7f0000000100)=0x20008a, 0x400000000000002, 0x0) syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b3400000000000000000000092403000000000000092405009917211cfd0924030500000004000724050401"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d000101008032"], 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) socket$xdp(0x2c, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r3, &(0x7f00000047c0)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r5, 0xd}, 0x80, &(0x7f0000004c40)=[{&(0x7f0000000300)='C', 0x1}], 0x1}}], 0x1, 0x20000081) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.506384883s ago: executing program 0 (id=83): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x5453, 0x0) (async) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000080)=""/221) (async) read(r1, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000580)={0x3, &(0x7f0000000680)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}, {0x2c, 0x2, 0x1, 0x3}, {0x6, 0xd5, 0x9, 0x5}]}) ioctl$XFS_IOC_FSGROWFSRT(r0, 0x40105870, 0x0) 1.486647163s ago: executing program 0 (id=84): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioperm(0x3, 0x4, 0x100000a) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) recvmsg(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100002, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000036000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000180)="440f01c80f3235000100000f30bf2eafaff3460f0936360f01c9b8010000000f01c1b866400fd1900000000000470f06660f094d0fc7681d48b806000000000000000f23c00f21f835000000000f23f8", 0x50}], 0x1, 0x74, &(0x7f0000000040)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1120008a}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) 1.379207286s ago: executing program 0 (id=86): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) signalfd4(r0, &(0x7f0000000000), 0x8, 0x0) r1 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) lseek(r3, 0x0, 0x1) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001900)=ANY=[@ANYBLOB="280000005e000dc90ac21dc24e627958b0eae7e5d733e6e221"], 0x28}], 0x1}, 0x40) 1.282377728s ago: executing program 0 (id=87): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xf, 0x80) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000040)=0xd) (async, rerun: 32) syz_usb_connect(0x3, 0xb6, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003cf7e8f4040201f7200f2010203010902a400018104004f0904500b05a97a37020a24010a0306020102092403050703020496062404029cfe09050b004000800000072501af82a7ce1932dc70000464040507250103"], &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x0, 0x0}]}) (rerun: 32) 782.765541ms ago: executing program 2 (id=88): r0 = socket(0x10, 0x803, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet(0x2, 0x2, 0x1) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = openat$kvm(0x0, &(0x7f00000002c0), 0xa600, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000040)={0x1, 0x0, [{0x6, 0x9, 0x1, 0x3, 0x3, 0xffffffa2, 0x6}]}) (async) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x14, 0x3, 0x2, 0x401, 0x0, 0x0, {0x0, 0x0, 0x7}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x40448c1) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) (async) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x81, 0x6, @remote}, 0x14) sendmmsg$sock(r4, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}, 0x1000000}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@txtime={{0x18, 0x1, 0x3d, 0x4c}}], 0x18}}], 0x2, 0x0) (async) preadv(r3, &(0x7f0000000340)=[{&(0x7f0000000540)=""/245, 0xf5}], 0x1, 0x40000004, 0x5) socket$nl_xfrm(0x10, 0x3, 0x6) (async) unshare(0x62040200) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x2, 0x0, 0x0, 0x7fc00120}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r8, 0xc0502100, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r8, 0x40082104, &(0x7f0000000240)={0x0, 0x1, r8, 0x6}) (async, rerun: 32) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async, rerun: 32) recvmsg$unix(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x118}, 0x180) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) 733.690052ms ago: executing program 2 (id=89): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a004e220000000500002d003a2d003a0040ffffe000000102000000200002000a00000000000000ff0100000000f0ffffffffffffff00019c0000000d0001007564703a"], 0x6c}, 0x1, 0x0, 0x0, 0x20008014}, 0x20040084) 654.380064ms ago: executing program 2 (id=90): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000002080), 0xe) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone3(&(0x7f0000000180)={0x42907480, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x3f00}, 0x58) 653.794904ms ago: executing program 2 (id=91): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/packet\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0xfffff7ff8) (async) socket$nl_route(0x10, 0x3, 0x0) (async) prctl$PR_SET_SECUREBITS(0x1c, 0x15) unshare(0x0) setuid(0xee00) (async) r2 = add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d3230303130313030303030305a170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010201010106082a85030701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a8503070101030203410002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x110, 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000040)={r2}, &(0x7f0000000080)={'enc=', 'oaep', ' hash=', {'streebog256-generic\x00'}}, 0x0, 0x0) (async) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) quotactl$Q_SETINFO(0xffffffff80000601, &(0x7f0000000000)=@nullb, 0x0, &(0x7f0000000580)={0x0, 0xce, 0x0, 0x2}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) futex_waitv(&(0x7f0000000180)=[{0x0, &(0x7f0000000000), 0x2}, {0x3, &(0x7f0000000040)=0x3, 0x2}], 0x2, 0x0, 0x0, 0x0) futex(&(0x7f0000000140)=0x2, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0) (async) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000040)={@remote, 0x0}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched_retired(r4, &(0x7f0000001f00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001ec0)={&(0x7f00000000c0)=@deltfilter={0x1dd8, 0x2d, 0x20, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x7, 0x2}, {0x5, 0x1}, {0xa, 0xfff2}}, [@f_tcindex={{0xc}, {0x82c, 0x2, [@TCA_TCINDEX_POLICE={0x828, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x585fbc23, 0xdbc6, 0x3893, 0x9fb, 0x2, 0x4, 0x1, 0x6, 0x7ff, 0x8b, 0x1, 0x9, 0x2, 0x7, 0x91, 0x6, 0x7, 0x645, 0x4, 0x3, 0xfe, 0x0, 0x4a2, 0x5, 0x595, 0xfffffffa, 0xf2, 0x92f, 0x8, 0x7, 0xfffffffa, 0x9f57, 0x56e, 0x80, 0x9, 0x4ee5, 0x4863924f, 0x8, 0x6, 0x0, 0x7f, 0x0, 0x8, 0x6, 0x494, 0x5, 0x4, 0x9, 0xc, 0x2, 0x0, 0x8, 0xc4, 0x80000001, 0xffffffff, 0x4, 0x0, 0x1ff, 0x7ff, 0x7, 0xa03, 0x70, 0xa, 0x7, 0x0, 0xfffffff9, 0x9, 0x7, 0xfff, 0x7, 0xff, 0xfffffff9, 0xe, 0x4, 0x3, 0xe, 0xff, 0x9, 0x1, 0x2, 0xfffffffe, 0x4, 0x5, 0xfffffb69, 0x5, 0xb2, 0x81, 0x1, 0x0, 0x44, 0x1, 0xfff, 0x400, 0x8, 0x4, 0x698, 0x7, 0x9, 0x0, 0x7, 0x5, 0x26, 0x1ff, 0x0, 0x7, 0xffff, 0x80000000, 0xfff, 0x80000001, 0x1, 0x6, 0x3, 0x7, 0x6, 0x9, 0xa906, 0x0, 0x3, 0x3, 0x0, 0x623f5a02, 0x3, 0x80000000, 0x71f779fe, 0x967, 0x26ca1d16, 0x5, 0xe2, 0x1, 0x5, 0xdc, 0x2, 0xfa2, 0x6, 0x81, 0x8, 0xc6f, 0x977a, 0x8001, 0xa7f8, 0x8, 0x7, 0x9, 0x4f0, 0x0, 0x1, 0x1, 0xf9, 0x1, 0x7, 0x7fff, 0x200, 0xfb0b, 0x7f, 0x3, 0x7ff00000, 0x7, 0x7fff, 0x5, 0x6, 0x0, 0x1, 0x5, 0x5, 0x1, 0x7ff, 0xe000000, 0x101, 0x8, 0x6f, 0x1, 0x64fb, 0x0, 0x9, 0x8c, 0x7fffffff, 0xff, 0x1, 0x4, 0x40, 0x7ff, 0x9, 0x10001, 0x891, 0xf, 0x9, 0x4, 0x3ff, 0xffff, 0xfffffffa, 0x6, 0xb00, 0xfffffff7, 0x9, 0x4, 0x1, 0x6, 0x9, 0x0, 0x76f, 0xbc3997a, 0xeb, 0x10, 0x248, 0x5, 0x60, 0x3, 0x7, 0x7fff, 0x0, 0x3, 0x81, 0x4, 0x3, 0x7, 0x0, 0x1, 0x0, 0x0, 0x176, 0x80, 0x3b, 0x5, 0x49b316e3, 0x6, 0x5, 0x5, 0x6, 0x7, 0xf, 0x3, 0xffff, 0x2, 0xfa4e, 0x4, 0x100, 0x3ac8, 0x6, 0xc, 0x8, 0x67, 0x8929, 0x6, 0xfff, 0x5, 0x2, 0x6, 0x9, 0xa, 0x1, 0x1, 0x0, 0x4a4682c4, 0x6, 0x9, 0xbff8]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x3}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x1, 0x4, 0x10000, 0x9, 0x721, 0x101, 0x688, 0x9, 0x6, 0x8, 0x776, 0xffff, 0x0, 0x4, 0x8, 0x4, 0x7, 0x7, 0x9, 0x80, 0x5, 0x1490, 0xc40d, 0x3, 0x1000, 0x4, 0x9, 0x7fffffff, 0x4, 0x4, 0x9, 0x3, 0x8, 0x79, 0x8, 0x0, 0xcb, 0x5a15, 0x2, 0x9b1, 0x0, 0x2, 0x78ef, 0x4, 0xac5, 0xb2c2, 0xd1, 0xffff, 0x7, 0xfffffff3, 0x9, 0x2, 0xff12, 0x2, 0xd61, 0x0, 0x80000000, 0x2, 0x3, 0x0, 0xffff, 0x9, 0x9, 0x0, 0x8a9, 0x3, 0x7fffffff, 0xc46d, 0x9, 0x3, 0x3, 0xe, 0xbd4d, 0x8, 0x7ff, 0x8, 0x5, 0x5, 0xffffaac7, 0x0, 0xffffffc0, 0x8, 0x1, 0x80, 0x9, 0x2, 0x800, 0xa, 0x9, 0x0, 0xfffffe01, 0x0, 0x3, 0x2, 0x6, 0x2, 0xb66, 0xe537, 0x10000, 0xa302, 0x0, 0xb80, 0xb, 0x10, 0xffffffff, 0x7, 0x6, 0x101, 0x1, 0x4, 0xf, 0xd2, 0xffffffff, 0x6, 0x9f4, 0x1, 0x9, 0x5095, 0x7, 0x9, 0x8001, 0x1, 0x5, 0x2, 0x6298621a, 0xff, 0x6, 0x6, 0x1d, 0x1, 0x10000, 0x5, 0x3, 0x7, 0x7, 0xf, 0x9, 0x5, 0x1, 0x101, 0x5, 0x80000001, 0x40, 0x80000001, 0x8, 0xee9, 0xd, 0x8, 0x1000, 0x97, 0x0, 0x4000000, 0x2, 0x9, 0x539, 0x8, 0x3, 0x8, 0x5, 0x101, 0x8000, 0x6, 0x2, 0xd, 0x9, 0x7fffffff, 0x1, 0x7, 0x5, 0x2a, 0x5, 0x9, 0xa0000000, 0x6, 0x401, 0xc3, 0x4, 0xe, 0x73, 0x7, 0x3, 0x100, 0x5d, 0x8, 0x26, 0x6, 0x3, 0x8000, 0x3, 0xe1, 0x3, 0x401, 0x9, 0x3, 0x3, 0x380, 0x4146, 0xe, 0x1, 0x9372, 0x5, 0x1, 0x9, 0xca1b, 0x7, 0x5, 0x6, 0x5, 0x7, 0x4, 0xffff8001, 0x8000, 0x1, 0x9, 0x0, 0xfffffffd, 0x3, 0x9, 0x2, 0x7fff, 0x7f, 0x979, 0xa, 0x1, 0x2e, 0x282c, 0x5, 0x1, 0x3, 0x7fffffff, 0x0, 0x7f, 0xfffffff7, 0x5e, 0x5c3, 0x8, 0x7fffffff, 0xd46, 0x2, 0x3, 0x20000, 0xeb5, 0x3, 0xd85, 0x2651e03e, 0x2, 0x0, 0x4, 0x7, 0x7, 0x4, 0x0, 0x1efe, 0x6, 0x5]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}]}]}}, @f_rsvp6={{0xa}, {0x20, 0x2, [@TCA_RSVP_CLASSID={0x8, 0x1, {0xfff1, 0xffe0}}, @TCA_RSVP_SRC={0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}]}}, @f_rsvp6={{0xa}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}}, @f_rsvp={{0x9}, {0x48c, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0xffff, 0x6, 0x8}, {0x9, 0x3, 0x757}, 0x2e, 0xcf, 0xfa}}, @TCA_RSVP_ACT={0x468, 0x6, [@m_ife={0x98, 0x12, 0x0, 0x0, {{0x8}, {0x10, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa}]}, {0x64, 0x6, "601b36f4e15ac1443675989f26b4fea19b481410619f8840ef93d0e867badd7a6e3388f3c9645d74fc2c8ad9c5c5f7f2e91674d943d2c55f6785297160ee9408d907c7342a2b7dcee71d23c24984d3f047bb620b6d12e81e4fdd1e4c66f79ed5"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_ife={0xf8, 0x1, 0x0, 0x0, {{0x8}, {0x5c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x2, 0xd, 0x3, 0x9, 0x6}}}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x200, 0x613, 0x8, 0x5, 0x6}}}, @TCA_IFE_SMAC={0xa, 0x4, @remote}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x1000}, @IFE_META_PRIO={0x8, 0x3, @val=0x4}]}]}, {0x77, 0x6, "9e175f1c681105174a2849b5d85e478b3e73a610e8158ac198bfdbd9cc9143ade3fb63276b8c7e2e8cdd80bec6c1c17461ccb006df7d82f29ca23bfa4142068880de70a99e73a63df29e6948bd5b0291ee7ce9d368d3e23c8777d027a5469c200b26aa9fa12b68be3488b1826486d2e1f79fe7"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_vlan={0x11c, 0x1f, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x4}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x4}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}]}, {0xd5, 0x6, "c14dbe1d65e496d8694d86912ca32ec0d90d6b0728299b7bc1d57210c04029e7b04bebf034690d4e5b1f93c83ef2db66a9c997ba0920cf0694c748992cb62a0797c996c59055ab4bc066346572ac58c3dbb80b10689347adb491bce9b968a1caeb174807d3571b82ac3fd3dc43c4cfdd4a9291c3badb1382e23ffba5cd7d20d10ab9a99b1e4d5fad7e32f3a1b7a27a8a6fb0e7f39e27ff111638168587c603240ed5b45c8898e6267f9010aba6bc97da830b6b47a8bdab9dd38dd48dac45f0af1eda2e4e5617ff26be7845614592ca478f"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbmod={0x74, 0x12, 0x0, 0x0, {{0xb}, {0x10, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @local}]}, {0x39, 0x6, "6b6948d4c378138698e25ed1e13cbd6c96551fc193b04cc0aa6331cf790699647dc58e3ee028f7733159f3c4e2eb5512d770bd80a2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x144, 0x8, 0x0, 0x0, {{0x8}, {0x44, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0xc, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x4, 0x3, @void}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x30d266f9, 0x0, 0x20000000, 0xfffffff8, 0x96}, 0x1}}, @TCA_IFE_METALST={0x18, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_PRIO={0x8, 0x3, @val=0x10}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}]}, {0xdc, 0x6, "6820434b649c16d46ab290388e021041cef7e8938c2a681acf6013b093ad9dca57464d146097eb57da02d121b54d4c45a97628e2497d2119e7cdf906c1ce269339f478eb0e502cd2c65799dd3b482e43b4ec605ca5e3b83df8541d177b8ee498bd7b9e0740a272378a239d1ca565461787bba0d4c5f6cd2f81e6b507285ef8005ef3c0aa23ea7f635040b3210f6539e3368f3e12e6671aac4ad74edf50e734325278d660486fb3c39e402b30de6d228f1bac09da13fa27b55d5f44a06222b6d986f993d798548a03ecbb1d483747340e09e9c9b8e3fd679a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x4}}}}]}]}}, @f_rsvp={{0x9}, {0x1070, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0x5, 0x3, 0x8000}, {0x80000001, 0x80000001, 0x2}, 0x1d, 0x8, 0x80}}, @TCA_RSVP_POLICE={0x10, 0x5, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}]}, @TCA_RSVP_SRC={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x43}}, @TCA_RSVP_POLICE={0xc18, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x6, 0x6, 0x1000, 0x12c, 0x4, 0x8, 0xaec, 0x5, 0x2d9, 0x1eb9, 0x48, 0xc099, 0x8, 0x4, 0x80, 0x6dd, 0xc, 0xb, 0x80, 0x4, 0x4, 0x9, 0xbc4, 0x7, 0x4, 0x4, 0x8, 0x5, 0x6, 0x1, 0x5, 0x5ef, 0xe29d2e8a, 0xfff, 0x2, 0x10001, 0x80000000, 0x6, 0x8, 0x9, 0x10001, 0xc, 0x1, 0x101, 0xa3f, 0x10, 0x3, 0x8, 0x6, 0x8, 0x4, 0x2, 0x7, 0x8, 0x3, 0x9, 0x8f42, 0x8, 0x7, 0xf, 0x6, 0xa, 0xfffffffd, 0x6, 0x0, 0x6, 0x400, 0x0, 0xf92, 0xdf9c, 0x9, 0x9, 0x8000, 0x100, 0x81, 0xffff, 0xfffffffd, 0xffffffff, 0x80, 0x9, 0x8e, 0x5611, 0x6, 0x8, 0x9, 0x2, 0x5, 0x8, 0x0, 0x2, 0xfffffff8, 0xfffffff7, 0x17e8, 0x6, 0x7fffffff, 0x3, 0x10000, 0x4, 0x800, 0x4, 0x3ff, 0x8, 0x6, 0xffff, 0x3, 0x1, 0xe, 0x5, 0x8, 0x0, 0xdf98, 0x6, 0xffff, 0x17, 0x2, 0x7, 0x0, 0xa943ed7, 0x7f, 0x0, 0x6c0, 0x1, 0x1ff, 0xffff, 0x50, 0x5bf, 0x80, 0x432, 0x4, 0xbc6, 0x9, 0xff, 0x1c01, 0x7, 0x8, 0x0, 0x81, 0x2, 0x1, 0x1, 0x40, 0x7, 0x8, 0x8000, 0x5, 0x8, 0x8, 0xffff, 0x8, 0x8, 0x8, 0x0, 0x401, 0x2, 0x1, 0x0, 0x4, 0x6, 0x2, 0x1ff, 0x7, 0xebd, 0x5, 0x101, 0xffff51aa, 0x2, 0x4, 0xd, 0xc8, 0x9, 0x5, 0x2, 0x629, 0x0, 0x2, 0x6, 0x60, 0x9, 0x30000000, 0x3, 0x9, 0x7, 0x5, 0x302, 0x8, 0x9, 0xff, 0xfffffeff, 0xff, 0x4, 0xe, 0x9, 0x5, 0x7, 0xf454, 0x1, 0x7, 0x0, 0x8, 0x1ff, 0x7, 0x3, 0x7, 0xff, 0x2, 0x936d, 0x81, 0x6, 0x1, 0x67, 0x489, 0x5, 0x7ff, 0x2, 0x5, 0x8000, 0x80000001, 0x2, 0xb, 0x0, 0x1, 0x5, 0x0, 0x0, 0x6, 0x6, 0x6, 0x3, 0x8, 0xc, 0x163e, 0x0, 0x2, 0x21bb, 0x2, 0x6, 0x5, 0x3ce, 0x8, 0x5, 0x2, 0x3, 0x7, 0x5, 0x4, 0x4, 0x1000, 0x8, 0x0, 0x55, 0x1, 0xac9b, 0x0, 0x8, 0x1]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9f, 0x8, 0x743, 0x5, 0x4, 0x2, 0x2, 0x400, 0x4, 0xa2, 0x2, 0x4, 0x9, 0x1, 0x6, 0x3761, 0x9, 0x7, 0x399e, 0x10000, 0x6, 0x0, 0x8, 0x61c9, 0xe, 0x4, 0x7, 0x9a3, 0x9, 0x6, 0x6, 0x1, 0x5, 0xc1e9, 0x1000000, 0x95, 0x826, 0x4, 0x8, 0x7392, 0x9, 0x8001, 0x1, 0xe2d, 0xffffffff, 0xc14, 0x3, 0xfffffffd, 0xa, 0x0, 0x7f, 0x3, 0xeb, 0x400, 0xf2, 0x10001, 0xfffffffc, 0x7, 0x4, 0x3, 0x5, 0xdde, 0xd, 0x7, 0x7, 0x1cf, 0x3, 0x3, 0x81, 0xffff, 0x2, 0xa, 0x7104, 0x8, 0xc, 0x100, 0x5, 0x0, 0x0, 0x27, 0x3, 0x2000, 0x401, 0x5, 0x9, 0x8, 0x454e, 0x7, 0x7ff, 0x8001, 0xc10b, 0x6, 0xfff, 0x80000000, 0x7f, 0x8, 0x8, 0x0, 0x9, 0xf, 0x9, 0x1, 0x6, 0x1, 0x8001, 0x1, 0x4, 0x6, 0x2, 0x6, 0x0, 0x3, 0x8, 0x9, 0x8000, 0x0, 0x7fffffff, 0x2, 0x1, 0x5, 0x29, 0x6, 0xc1a9, 0x9, 0x5, 0x9, 0x5, 0x40, 0x6b, 0x7, 0xfffffe00, 0x8, 0x5, 0x5, 0xea7a, 0x1ff, 0x9, 0x9, 0x4, 0x1, 0xbe, 0x3, 0x80000000, 0x40000, 0x80000001, 0x7, 0x7, 0x6, 0x5, 0x17dd, 0x8000, 0x764, 0x1, 0x10, 0x2, 0x4, 0x643b, 0x2, 0x8001, 0x8, 0xd, 0xff, 0xb, 0x55, 0x5, 0xffffff75, 0x10000, 0xfffffffa, 0x4, 0x70, 0xc, 0x3686, 0xffffffff, 0x4, 0xc6d, 0x0, 0x3, 0x1ff, 0xf97, 0xc9, 0x4, 0x0, 0x6, 0x6, 0x10, 0x9, 0x4d55a50a, 0xffffffff, 0xd65, 0x2, 0x7, 0x4, 0x8, 0x1000, 0x1, 0x4, 0x0, 0x6, 0x2, 0x4, 0xc, 0xdb, 0x3, 0x9, 0x4238, 0xbae00000, 0x3, 0xfff, 0xd7, 0xbbd8, 0xa258, 0x5, 0x3, 0x1, 0x7f, 0x7, 0x68e, 0x80000001, 0x9, 0x7, 0x0, 0x6, 0x7fff, 0x0, 0x400, 0x3, 0x9, 0xa, 0x0, 0x0, 0x2e68, 0x6, 0x5, 0x0, 0x6, 0x8, 0x0, 0xf, 0x1, 0x2, 0x8, 0x6, 0x2, 0x53b, 0x4, 0x100, 0x1585, 0xa, 0x6, 0x4, 0x2fb2, 0xd2f4, 0xd9, 0x6, 0x8001, 0x3]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x45a, 0x7fff, 0xf, 0x4, 0xffff, 0x3, 0x1, 0x8, 0x80000000, 0x4, 0x6, 0x10000, 0xfffffff9, 0x9, 0x7, 0x6, 0x800, 0xff, 0x7fff, 0xb, 0x5, 0xf0b3, 0xaf5d, 0x6, 0x0, 0x7ee, 0xffffffff, 0x5, 0x7, 0x8, 0x800, 0x3, 0x1, 0x4, 0xfffffff8, 0x24e7, 0x0, 0xbb, 0x10, 0xd7b0, 0x6, 0x6, 0x80, 0xff, 0x0, 0x0, 0x7fffffff, 0x1, 0x1281, 0x5, 0x5a, 0x0, 0x9, 0x2, 0xf, 0x26b1, 0x91ca, 0x6, 0x40, 0x9, 0x59e3, 0xa, 0x2, 0x6, 0x4, 0x7, 0x400, 0x20000000, 0x1, 0x38d, 0x2, 0x8, 0x6, 0x3, 0x9, 0x9, 0x5e4c, 0x5, 0x896, 0xc, 0x37, 0x4, 0x0, 0x7f, 0x8a, 0x9, 0x3, 0x4, 0x1ff, 0x3ff, 0x7, 0x0, 0x3, 0x5, 0x1, 0x3, 0xffffff7f, 0x4, 0xbef3, 0x7ff, 0x2, 0x200, 0x1, 0x9, 0x54, 0x9, 0x101, 0x1, 0xf9a5, 0x2, 0x1, 0x2, 0x2, 0xed9, 0x15, 0xffffff80, 0x6a4b, 0x9, 0x6, 0xe81c04bc, 0x9, 0xfffffffb, 0xfd13, 0x3, 0xb2, 0xfffffffe, 0x9, 0x2, 0x9, 0x7, 0x8, 0x0, 0x6, 0x80000000, 0x1000, 0x1, 0x10, 0xbbca, 0x21, 0x2, 0x957e, 0x2, 0x7, 0x6, 0x6, 0x5, 0x7, 0x4, 0x5, 0xa, 0x80, 0x8, 0x8, 0x2, 0x3, 0x2, 0xfffffffe, 0x7, 0xd09c, 0x0, 0x4, 0xa, 0x7fff, 0x6, 0x27, 0x3, 0x4, 0xfffffffe, 0x1, 0xfffffffc, 0x1, 0x6, 0xe49, 0x9, 0x2, 0x7ff, 0x81, 0x6, 0x200, 0x64, 0xfffffffe, 0x8, 0x10000, 0x8, 0x2, 0x6, 0x8001, 0x9, 0x7fffffff, 0x2, 0xc9, 0x82, 0x2, 0x400, 0x3, 0x7, 0x883a, 0x9, 0x1, 0x0, 0x9, 0x1, 0x9, 0x0, 0x4, 0x5, 0x7, 0x3, 0x2, 0x40, 0x6, 0x48000, 0xfffffff9, 0x7, 0x3, 0x1, 0x7, 0xfffffff9, 0x0, 0x0, 0x5, 0x5, 0x7, 0x5, 0x1ad, 0x7, 0x6, 0x80000001, 0x0, 0x3, 0x5a, 0x8, 0x8, 0x0, 0x8, 0x0, 0x8, 0xd0, 0xfffff879, 0x3, 0x8, 0x0, 0x7, 0x2, 0x1, 0xebc, 0x2, 0xe5b2, 0x4, 0x1, 0x1, 0x8, 0xfffffff9, 0x5, 0x3, 0x3]}]}, @TCA_RSVP_POLICE={0x41c, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x48, 0x4, 0x10, 0xd, 0x10000, 0x4, 0x4, 0x1, 0x6, 0x2, 0x0, 0x5, 0x3, 0x8, 0x7fffffff, 0x9, 0x9, 0x6, 0x4, 0x96f3, 0xed, 0xdb8a, 0x24, 0x6, 0x8, 0x80000001, 0x0, 0xcd, 0x3, 0x9, 0x3, 0x6, 0x10, 0x3, 0x5, 0x60, 0x7f, 0x4, 0x0, 0x6, 0x6, 0x8, 0x0, 0x618, 0xe, 0x4570, 0x2, 0x4, 0x1ff, 0x1, 0x81, 0x7, 0x7, 0x67, 0x2, 0x31b, 0x80000001, 0x0, 0x4, 0x42a, 0x9, 0x3, 0x3, 0x8, 0x6, 0x50000000, 0x1, 0x8000000, 0x1, 0x0, 0x101, 0x6, 0xfffffff7, 0x7, 0x5, 0xe69, 0x80000000, 0xfff, 0x2, 0x8, 0x6, 0xfffffffd, 0x6, 0x4cd, 0x9, 0x100, 0x47, 0xf, 0x7, 0x6, 0x7, 0x8, 0xfffff800, 0xa2d3d7e, 0x4, 0x5bea, 0x80000000, 0x6, 0x9, 0x9, 0x40, 0xfffffff9, 0x3, 0x1000, 0x0, 0x3, 0xf, 0x8, 0x3, 0x8001, 0x3, 0x912, 0x3ff, 0x5, 0x9, 0x2, 0x1, 0xe0000000, 0x6, 0x6, 0xfffffff9, 0x101, 0x1, 0x3, 0x9854, 0x1, 0x9, 0x6, 0x1, 0x4, 0x1, 0x2, 0x8, 0x7, 0x8, 0x6, 0x251, 0x2, 0x1, 0x64, 0x70, 0x800, 0x2, 0x2, 0x80000000, 0x6, 0x1, 0x7, 0x4, 0xd, 0x3, 0x8, 0x2, 0x8, 0x9, 0xfffffffb, 0x7, 0x1, 0x7ff, 0x9, 0x4, 0x2, 0x0, 0x2, 0x9, 0x3, 0xfffff179, 0x6, 0x3ff, 0x0, 0xa43, 0xf3a, 0x5, 0x10, 0x8, 0xe, 0xfffffbff, 0x3, 0x5, 0xc29, 0x3d, 0x3c, 0x55000000, 0x9c, 0x200, 0x3, 0x6, 0x24bc, 0x3, 0xffff, 0x93, 0x8, 0x1000, 0x80b, 0x0, 0x30, 0x3, 0x7, 0x6, 0x10, 0x80000000, 0xfeb, 0x0, 0x6, 0xfffff859, 0x2a5, 0x9, 0x1, 0x8, 0x3d820852, 0x6cf5, 0x8001, 0x1, 0x1, 0x6, 0x3414, 0x7f, 0x7f, 0x7f, 0x7ff, 0xfffffff8, 0x6, 0xffff, 0x101, 0xa132, 0x200, 0x3, 0x8, 0x80000001, 0x2, 0x1214, 0x80000, 0xdb, 0x2, 0x3, 0xa379, 0x7, 0x7, 0x9, 0xfffffffb, 0x1, 0x6, 0x8, 0x6, 0x7fff, 0x10, 0x3, 0x3f77, 0xfffffffb, 0x77aa5ff3, 0xfffffffc, 0x80000001, 0x8, 0x4, 0x5, 0x7]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3}]}]}}, @f_tcindex={{0xc}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x1dd8}, 0x1, 0x0, 0x0, 0x80}, 0x20040085) 653.738894ms ago: executing program 2 (id=92): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="28000000100001e903000000fedbdf250a0000000400"], 0x28}, 0x1, 0x0, 0x0, 0x20000804}, 0x400c804) 653.426624ms ago: executing program 2 (id=93): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) clock_nanosleep(0x2, 0x0, &(0x7f0000000500)={0x77359400}, 0x0) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r2, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) sendmsg$TCPDIAG_GETSOCK(r0, 0x0, 0x20004010) 381.749931ms ago: executing program 3 (id=100): r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x77a882, 0x155) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000000c0)={{0x80a0000, 0xffe, 0xb, 0xc7, 0x8f, 0x5, 0x4, 0x3, 0x5, 0x9, 0x81, 0x80}, {0x100000, 0xffff1000, 0x14, 0x40, 0x6, 0xa, 0x47, 0x1, 0x8, 0x3, 0x0, 0x3}, {0x41000, 0xffe, 0xf, 0x8, 0x3, 0x1, 0x1, 0xce, 0x3, 0x0, 0xf8, 0x1}, {0xeeee0000, 0x106002, 0x9, 0x5, 0x1, 0x3, 0x4, 0x7, 0x4, 0xe1, 0x6, 0x81}, {0x1, 0xdddd1000, 0x3, 0x7f, 0x2, 0x72, 0x7, 0xff, 0x4, 0x0, 0x9}, {0xe000, 0x80a0000, 0x8, 0xa0, 0x6, 0x5, 0x84, 0x8b, 0x81, 0x4, 0x6, 0xd7}, {0x7000, 0x6a004, 0xb, 0x3d, 0x2, 0x2, 0x0, 0x7, 0x55, 0x3, 0x10, 0x2}, {0xe000, 0xfec04ff8, 0x8, 0x8, 0xc, 0x0, 0x9, 0x8, 0xb6, 0x70, 0x55, 0x4}, {0x200000, 0xfffe}, {0x10103ffc, 0x3}, 0x22, 0x0, 0xeeef0000, 0x400200, 0x0, 0x4000, 0x1, [0x5, 0x35e, 0x40, 0x3ff]}) write$selinux_create(r0, 0x0, 0x0) 377.713541ms ago: executing program 3 (id=101): mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x158) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="54010000100001002dbd700000000000fe8000000000000000000000000000bbac1e010100000000000000000000000000000000000000000000000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000fe800000000000007f0000000000002c00000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000020000000000000000000000000000000000000800000000000200000000000008000000000000000200000000000000000000000a000100cd0000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c0017000000000025bd7000000000000000000028bd7000aa0e0000"], 0x154}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1c5) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) ioprio_set$pid(0x1, 0xffffffffffffffff, 0x6003) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x42, 0xc0) sendmsg$SOCK_DIAG_BY_FAMILY(r1, &(0x7f0000000780)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000740)={&(0x7f0000000600)={0x128, 0x14, 0x400, 0x70bd2a, 0x25dfdbfb, {0x18, 0x9}, [@INET_DIAG_REQ_BYTECODE={0x39, 0x1, "229e0dee9407c11a69c429af75d24b606e21c1611dc0db947e11313917784908aba4f3ab6079f70b72726179ec80d3abea90d04e14"}, @INET_DIAG_REQ_BYTECODE={0x82, 0x1, "05ea1c35cc0c502d614adf321e0b9d616dd1bd205d2d6f78df985aa52c767127c2143e76a76d46d030a651925020e5abcbb1e1bdf95a45f228bb3ddde91a841f00e18916a4edda4081f2a8e5b44954b8c7bbd078b07f7ea6b800abf393e06d2205f66662c81e835d89e24983b535e9d4bbcd0c5093bd30db985c01bf2a30"}, @INET_DIAG_REQ_BYTECODE={0x54, 0x1, "007905e58d964569902703b4ebb28831b7d37226b205eaec827d6a115cde28a80671f9a7d6d28d3c9f76dbc3a4570e31c541f62998d329d4fc7c241b948836172db96a69fc047031a7fc1534f8b73fbd"}]}, 0x128}, 0x1, 0x0, 0x0, 0x20008810}, 0x20000000) write$P9_RREADLINK(r1, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) chdir(&(0x7f0000000000)='./file0\x00') r2 = syz_open_dev$loop(&(0x7f0000000000), 0x10001, 0x24800) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x100) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) 271.197213ms ago: executing program 3 (id=102): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000200)={@local, 0x800, 0x0, 0x1, 0x1}, 0x20) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$UHID_CREATE2(r3, 0x0, 0x3000000) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x23) connect$inet6(r2, &(0x7f0000000700)={0xa, 0x4e20, 0x380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000300)={@dev={0xfe, 0x80, '\x00', 0x2d}, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0xfffe}, &(0x7f0000000040)=0x20) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000080)="2c80fce256052b06f8148e045f9b2dec", 0x10) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000b80)="d7d42f9134461c21d42a97f0ebd55245", 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8982, &(0x7f0000000000)={0x8, 'wg2\x00', {'wg2\x00'}, 0x2}) 222.927244ms ago: executing program 3 (id=103): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="300000001000012026bd700000000000100000000c00000000000000000200000d002e"], 0x30}], 0x1}, 0x0) 170.381196ms ago: executing program 3 (id=104): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000480240000000000", @ANYRES32=0x0, @ANYBLOB="1f0404bf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) 170.233165ms ago: executing program 3 (id=105): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x109) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt/trace_marker\x00', 0x1, 0x5a) r0 = socket$inet6(0xa, 0x80001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_names\x00') r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00020700000007"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRESHEX, @ANYRES64=r1], 0x0) sendto$inet6(r0, &(0x7f00000001c0)="244642396efa1811db3d98767a18d91e4a83c7aad8ab9a35b07d119c22c9c25fd5232c20aa269f841f629afc288e2cccb14081e408a4a83b7e9eb2467e01cc776530d270396be173be143c0f02ba1775ffb317c967cfae0e40b300da6e2f2c8a5d790c9a5f972d6e61e2a0f462106d2bf38ff5c3927663a221ef2f4387f4e8c5a307de6886de4451c872ab4a674a7f8eb1a1299092c4d20d8976580f150487a440979cadbbe173298c801a09a888302d286e9e7b275a0070978b21d8c9", 0xbd, 0x44025, 0x0, 0x0) 0s ago: executing program 0 (id=106): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0xca02}) r1 = socket$netlink(0x10, 0x3, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/4, 0x4}], 0x3bc, 0x0, 0x0) (async) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/4, 0x4}], 0x3bc, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000000)) (async) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000000)={0x0, 0xffff, 0x0, 0x0, 0x0}) syz_open_procfs(r2, &(0x7f0000000080)='net/nf_conntrack_expect\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.81' (ED25519) to the list of known hosts. [ 20.709144][ T36] audit: type=1400 audit(1791253581.219:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.710327][ T286] cgroup: Unknown subsys name 'net' [ 20.731812][ T36] audit: type=1400 audit(1791253581.219:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.759032][ T36] audit: type=1400 audit(1791253581.249:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.759155][ T286] cgroup: Unknown subsys name 'devices' [ 20.881924][ T286] cgroup: Unknown subsys name 'hugetlb' [ 20.887549][ T286] cgroup: Unknown subsys name 'rlimit' [ 20.979499][ T36] audit: type=1400 audit(1791253581.489:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.002760][ T36] audit: type=1400 audit(1791253581.489:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.027670][ T36] audit: type=1400 audit(1791253581.489:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.033775][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.059613][ T36] audit: type=1400 audit(1791253581.569:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.085018][ T36] audit: type=1400 audit(1791253581.569:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.100388][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.110676][ T36] audit: type=1400 audit(1791253581.609:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.144696][ T36] audit: type=1400 audit(1791253581.609:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.944066][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.951141][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.958174][ T294] bridge_slave_0: entered allmulticast mode [ 21.964508][ T294] bridge_slave_0: entered promiscuous mode [ 21.974046][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.981128][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.988205][ T294] bridge_slave_1: entered allmulticast mode [ 21.994410][ T294] bridge_slave_1: entered promiscuous mode [ 22.019560][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.026660][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.033746][ T295] bridge_slave_0: entered allmulticast mode [ 22.039861][ T295] bridge_slave_0: entered promiscuous mode [ 22.047441][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.054490][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.061569][ T296] bridge_slave_0: entered allmulticast mode [ 22.067696][ T296] bridge_slave_0: entered promiscuous mode [ 22.076803][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.083884][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.090959][ T296] bridge_slave_1: entered allmulticast mode [ 22.097082][ T296] bridge_slave_1: entered promiscuous mode [ 22.103191][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.110227][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.117277][ T295] bridge_slave_1: entered allmulticast mode [ 22.123571][ T295] bridge_slave_1: entered promiscuous mode [ 22.149494][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.156554][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.163624][ T293] bridge_slave_0: entered allmulticast mode [ 22.169917][ T293] bridge_slave_0: entered promiscuous mode [ 22.179013][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.186198][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.193278][ T293] bridge_slave_1: entered allmulticast mode [ 22.199427][ T293] bridge_slave_1: entered promiscuous mode [ 22.340007][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.347055][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.354387][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.361430][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.380108][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.387151][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.394430][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.401464][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.416245][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.423311][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.430607][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.437629][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.454767][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.461826][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.469080][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.476110][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.511832][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.519065][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.526763][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.534398][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.541808][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.549058][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.556705][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.564154][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.581196][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.588218][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.595729][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.602751][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.612654][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.619699][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.638483][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.645554][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.657081][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.664181][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.676559][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.683616][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.692905][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.699965][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.708331][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.715397][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.765036][ T293] veth0_vlan: entered promiscuous mode [ 22.773901][ T295] veth0_vlan: entered promiscuous mode [ 22.784969][ T296] veth0_vlan: entered promiscuous mode [ 22.802909][ T296] veth1_macvtap: entered promiscuous mode [ 22.813952][ T295] veth1_macvtap: entered promiscuous mode [ 22.821749][ T293] veth1_macvtap: entered promiscuous mode [ 22.831290][ T294] veth0_vlan: entered promiscuous mode [ 22.856621][ T294] veth1_macvtap: entered promiscuous mode [ 22.891787][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.931344][ T313] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.142934][ T332] fuse: Bad value for 'user_id' [ 23.154266][ T332] fuse: Bad value for 'user_id' [ 23.250385][ T337] capability: warning: `syz.2.6' uses deprecated v2 capabilities in a way that may be insecure [ 23.274570][ T337] netlink: 'syz.2.6': attribute type 27 has an invalid length. [ 23.387220][ T339] netlink: 'syz.2.7': attribute type 27 has an invalid length. [ 23.447896][ T342] netlink: 'syz.1.8': attribute type 27 has an invalid length. [ 23.636342][ T392] netlink: 'syz.2.14': attribute type 27 has an invalid length. [ 23.737484][ T404] netlink: 'syz.2.19': attribute type 27 has an invalid length. [ 23.741298][ T402] input: syz1 as /devices/virtual/input/input4 [ 23.844482][ T421] netlink: 'syz.1.24': attribute type 27 has an invalid length. [ 24.023794][ T441] Zero length message leads to an empty skb [ 24.031172][ T441] process 'syz.1.32' launched './file1' with NULL argv: empty string added [ 24.054697][ T443] netlink: 'syz.1.33': attribute type 27 has an invalid length. [ 24.083594][ T450] mmap: syz.1.35 (450) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 24.219948][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 24.291244][ T459] tap0: tun_chr_ioctl cmd 1074025678 [ 24.296558][ T459] tap0: group set to 823 [ 24.350106][ T10] usb 4-1: device descriptor read/64, error -71 [ 24.403909][ T472] netlink: 'syz.1.44': attribute type 27 has an invalid length. [ 24.491829][ T474] netlink: 'syz.1.45': attribute type 27 has an invalid length. [ 24.606469][ T502] netlink: 'syz.0.53': attribute type 27 has an invalid length. [ 24.620010][ T10] usb 4-1: device descriptor read/64, error -71 [ 24.737380][ T515] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.899989][ T10] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 24.959985][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.029973][ T10] usb 4-1: device descriptor read/64, error -71 [ 25.080155][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 25.111200][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 25.119625][ T31] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 154, changing to 7 [ 25.138151][ T31] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 25.151703][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.159732][ T31] usb 1-1: Product: syz [ 25.164518][ T31] usb 1-1: Manufacturer: syz [ 25.169025][ T535] x_tables: unsorted underflow at hook 3 [ 25.169128][ T31] usb 1-1: SerialNumber: syz [ 25.272669][ T9] usb 2-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 25.281790][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.289776][ T9] usb 2-1: Product: syz [ 25.294054][ T9] usb 2-1: Manufacturer: syz [ 25.298663][ T9] usb 2-1: SerialNumber: syz [ 25.310132][ T10] usb 4-1: device descriptor read/64, error -71 [ 25.384475][ T513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.394188][ T513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.405985][ T31] usb 1-1: BAAD GENERIC IO: no channels? [ 25.413620][ T31] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 25.425106][ T430] udevd[430]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.426049][ T31] usb 1-1: USB disconnect, device number 2 [ 25.441198][ T10] usb usb4-port1: attempt power cycle [ 25.507544][ T9] usb 2-1: Can't get UAC3 power state for id 10 [ 25.514971][ T9] usb 2-1: BAAD SPEAKERPHONE c_chmask mismatch [ 25.523875][ T9] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 25.534336][ T9] usb 2-1: USB disconnect, device number 2 [ 25.544682][ T430] udevd[430]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.790366][ T10] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 25.811053][ T10] usb 4-1: device descriptor read/8, error -71 [ 25.951201][ T10] usb 4-1: device descriptor read/8, error -71 [ 25.975976][ T36] kauditd_printk_skb: 108 callbacks suppressed [ 25.975992][ T36] audit: type=1326 audit(1791253586.489:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=547 comm="syz.0.72" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4d8619e199 code=0x0 [ 26.015522][ T550] futex_wake_op: syz.1.73 tries to shift op by 144; fix this program [ 26.079455][ T36] audit: type=1400 audit(1791253586.589:183): avc: denied { create } for pid=552 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.099560][ T36] audit: type=1400 audit(1791253586.619:184): avc: denied { write } for pid=552 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 26.130757][ T36] audit: type=1400 audit(1791253586.639:185): avc: denied { create } for pid=552 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.150517][ T36] audit: type=1400 audit(1791253586.639:186): avc: denied { setopt } for pid=552 comm="syz.2.74" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.170529][ T36] audit: type=1400 audit(1791253586.649:187): avc: denied { mount } for pid=559 comm="syz.2.75" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.192463][ T36] audit: type=1400 audit(1791253586.649:188): avc: denied { setattr } for pid=559 comm="syz.2.75" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 26.214238][ T10] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 26.241129][ T10] usb 4-1: device descriptor read/8, error -71 [ 26.253909][ T36] audit: type=1400 audit(1791253586.769:189): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.286564][ T36] audit: type=1400 audit(1791253586.799:190): avc: denied { mount } for pid=563 comm="syz.2.77" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 26.311729][ T36] audit: type=1400 audit(1791253586.809:191): avc: denied { mount } for pid=563 comm="syz.2.77" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.371319][ T10] usb 4-1: device descriptor read/8, error -71 [ 26.480049][ T10] usb usb4-port1: unable to enumerate USB device [ 26.574304][ T573] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.670236][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.819946][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 26.828639][ T31] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 26.837883][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 26.845658][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.854149][ T31] usb 3-1: Product: syz [ 26.858530][ T31] usb 3-1: Manufacturer: syz [ 26.863882][ T31] usb 3-1: SerialNumber: syz [ 26.992998][ T589] netlink: 12 bytes leftover after parsing attributes in process `syz.0.86'. [ 27.002881][ T10] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 27.002879][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.002920][ T45] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 27.033345][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.042186][ T45] usb 2-1: config 0 descriptor?? [ 27.049756][ T594] netlink: 108 bytes leftover after parsing attributes in process `syz.3.85'. [ 27.266743][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 27.272848][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 27.280718][ T585] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 27.289748][ T45] usb 2-1: USB disconnect, device number 3 [ 27.441277][ T585] usb 1-1: unable to get BOS descriptor or descriptor too short [ 27.449649][ T585] usb 1-1: config 129 has an invalid interface number: 80 but max is 0 [ 27.458374][ T585] usb 1-1: config 129 has an invalid interface number: 5 but max is 0 [ 27.466811][ T585] usb 1-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 27.476934][ T585] usb 1-1: config 129 has no interface number 0 [ 27.483260][ T585] usb 1-1: config 129 has no interface number 1 [ 27.489672][ T585] usb 1-1: config 129 interface 80 altsetting 11 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 27.502932][ T585] usb 1-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 27.513823][ T585] usb 1-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 27.526977][ T585] usb 1-1: config 129 interface 80 has no altsetting 0 [ 27.533848][ T585] usb 1-1: config 129 interface 5 has no altsetting 0 [ 27.542538][ T585] usb 1-1: string descriptor 0 read error: -22 [ 27.548713][ T585] usb 1-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 27.557820][ T585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.568306][ T585] usb 1-1: MIDIStreaming interface descriptor not found [ 27.592761][ T31] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 27.617075][ T31] usb 3-1: USB disconnect, device number 2 [ 27.644882][ T328] udevd[328]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 27.692233][ T615] netlink: 8 bytes leftover after parsing attributes in process `syz.2.92'. [ 27.729935][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 27.767297][ T593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.775842][ T593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.783867][ T593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.792491][ T593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.800652][ T593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.809330][ T593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.817380][ T593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.825929][ T593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.836414][ T593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.845287][ T593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.854991][ T9] usb 1-1: USB disconnect, device number 3 [ 27.880996][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.896472][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 27.905825][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.916581][ T10] usb 2-1: config 0 descriptor?? [ 28.323684][ T578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.332742][ T578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.410068][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 28.541916][ T578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.550512][ T578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.561105][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.572055][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.581856][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 28.591172][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.599664][ T9] usb 4-1: config 0 descriptor?? [ 28.750672][ T10] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 28.758432][ T10] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input5 [ 28.779370][ C0] ------------[ cut here ]------------ [ 28.784867][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 28.793433][ C0] index 9883 is out of range for type 'const int[34]' [ 28.800178][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7 [ 28.800196][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 28.800207][ C0] Call Trace: [ 28.800212][ C0] [ 28.800218][ C0] __dump_stack+0x21/0x30 [ 28.800245][ C0] dump_stack_lvl+0x140/0x1c0 [ 28.800263][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.800280][ C0] ? start_kernel+0x462/0x4bb [ 28.800293][ C0] dump_stack+0x19/0x20 [ 28.800308][ C0] ubsan_epilogue+0xe/0x40 [ 28.800318][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 28.800337][ C0] aiptek_irq+0x208d/0x2a00 [ 28.800355][ C0] ? _raw_spin_unlock+0x45/0x60 [ 28.800368][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 28.800381][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 28.800395][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 28.800406][ C0] dummy_timer+0xa3f/0x4900 [ 28.800424][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 28.800437][ C0] ? timerqueue_del+0xd7/0x130 [ 28.800454][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 28.800471][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 28.800484][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 28.800503][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 28.800519][ C0] ? read_tsc+0xd/0x20 [ 28.800535][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 28.800550][ C0] hrtimer_run_softirq+0x159/0x560 [ 28.800561][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 28.800578][ C0] handle_softirqs+0x1aa/0x620 [ 28.800591][ C0] __irq_exit_rcu+0x47/0xb0 [ 28.800603][ C0] irq_exit_rcu+0xd/0x30 [ 28.800614][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 28.800630][ C0] [ 28.800634][ C0] [ 28.800638][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 28.800655][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 28.800673][ C0] Code: cc cc cc cc cc cc cc b8 eb ac 2f 8e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d c3 e7 41 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 28.800683][ C0] RSP: 0018:ffffffff87407da0 EFLAGS: 000002c2 [ 28.800700][ C0] RAX: ffff8881f6e00000 RBX: ffffffff874156c0 RCX: ffffffff85a5753d [ 28.800709][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002d99c [ 28.800717][ C0] RBP: ffffffff87407da0 R08: ffff8881f6e395eb R09: 1ffff1103edc72bd [ 28.800726][ C0] R10: dffffc0000000000 R11: ffffed103edc72be R12: 0000000000000000 [ 28.800734][ C0] R13: 1ffffffff0e82ad8 R14: dffffc0000000000 R15: ffffffff87ececa8 [ 28.800744][ C0] ? ct_kernel_exit+0x7d/0xb0 [ 28.800761][ C0] default_idle+0x17/0x30 [ 28.800771][ C0] arch_cpu_idle+0xd/0x20 [ 28.800781][ C0] default_idle_call+0x3e/0x80 [ 28.800791][ C0] do_idle+0x2fc/0x570 [ 28.800810][ C0] ? idle_inject_timer_fn+0x80/0x80 [ 28.800825][ C0] cpu_startup_entry+0x47/0x60 [ 28.800839][ C0] rest_init+0x10b/0x130 [ 28.800850][ C0] ? __cfi_x86_late_time_init+0x10/0x10 [ 28.800864][ C0] start_kernel+0x462/0x4bb [ 28.800875][ C0] x86_64_start_reservations+0x2e/0x30 [ 28.800888][ C0] x86_64_start_kernel+0x6a/0x7b [ 28.800901][ C0] common_startup_64+0x13b/0x157 [ 28.800920][ C0] [ 28.800924][ C0] ---[ end trace ]--- [ 29.111103][ C0] ================================================================== [ 29.119152][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 [ 29.126694][ C0] Read of size 4 at addr ffffffff8670f54c by task swapper/0/0 [ 29.134134][ C0] [ 29.136448][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7 [ 29.136467][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 29.136475][ C0] Call Trace: [ 29.136480][ C0] [ 29.136485][ C0] __dump_stack+0x21/0x30 [ 29.136506][ C0] dump_stack_lvl+0x140/0x1c0 [ 29.136522][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.136541][ C0] ? __cfi__printk+0x10/0x10 [ 29.136568][ C0] print_address_description+0x71/0x210 [ 29.136595][ C0] print_report+0x4a/0x70 [ 29.136611][ C0] kasan_report+0x162/0x1a0 [ 29.136626][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 29.136645][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 29.136661][ C0] __asan_report_load4_noabort+0x18/0x20 [ 29.136673][ C0] aiptek_irq+0x20ab/0x2a00 [ 29.136690][ C0] ? _raw_spin_unlock+0x45/0x60 [ 29.136703][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 29.136717][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 29.136731][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 29.136743][ C0] dummy_timer+0xa3f/0x4900 [ 29.136761][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.136774][ C0] ? timerqueue_del+0xd7/0x130 [ 29.136791][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 29.136809][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.136824][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 29.136843][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 29.136859][ C0] ? read_tsc+0xd/0x20 [ 29.136875][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 29.136891][ C0] hrtimer_run_softirq+0x159/0x560 [ 29.136902][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 29.136919][ C0] handle_softirqs+0x1aa/0x620 [ 29.136932][ C0] __irq_exit_rcu+0x47/0xb0 [ 29.136944][ C0] irq_exit_rcu+0xd/0x30 [ 29.136955][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 29.136971][ C0] [ 29.136975][ C0] [ 29.136979][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 29.136996][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 29.137014][ C0] Code: cc cc cc cc cc cc cc b8 eb ac 2f 8e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d c3 e7 41 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 29.137024][ C0] RSP: 0018:ffffffff87407da0 EFLAGS: 000002c2 [ 29.137035][ C0] RAX: ffff8881f6e00000 RBX: ffffffff874156c0 RCX: ffffffff85a5753d [ 29.137045][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002d99c [ 29.137053][ C0] RBP: ffffffff87407da0 R08: ffff8881f6e395eb R09: 1ffff1103edc72bd [ 29.137062][ C0] R10: dffffc0000000000 R11: ffffed103edc72be R12: 0000000000000000 [ 29.137071][ C0] R13: 1ffffffff0e82ad8 R14: dffffc0000000000 R15: ffffffff87ececa8 [ 29.137081][ C0] ? ct_kernel_exit+0x7d/0xb0 [ 29.137098][ C0] default_idle+0x17/0x30 [ 29.137108][ C0] arch_cpu_idle+0xd/0x20 [ 29.137118][ C0] default_idle_call+0x3e/0x80 [ 29.137128][ C0] do_idle+0x2fc/0x570 [ 29.137141][ C0] ? idle_inject_timer_fn+0x80/0x80 [ 29.137156][ C0] cpu_startup_entry+0x47/0x60 [ 29.137169][ C0] rest_init+0x10b/0x130 [ 29.137180][ C0] ? __cfi_x86_late_time_init+0x10/0x10 [ 29.137194][ C0] start_kernel+0x462/0x4bb [ 29.137205][ C0] x86_64_start_reservations+0x2e/0x30 [ 29.137218][ C0] x86_64_start_kernel+0x6a/0x7b [ 29.137230][ C0] common_startup_64+0x13b/0x157 [ 29.137248][ C0] [ 29.137253][ C0] [ 29.461087][ C0] The buggy address belongs to the variable: [ 29.467039][ C0] dummy_id+0x6c/0x80 [ 29.471008][ C0] [ 29.473313][ C0] The buggy address belongs to the physical page: [ 29.479727][ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x670f [ 29.488385][ C0] flags: 0x4000(reserved|zone=0) [ 29.493312][ C0] raw: 0000000000004000 ffffea000019c3c8 ffffea000019c3c8 0000000000000000 [ 29.501877][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 29.509745][ T655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.510439][ C0] page dumped because: kasan: bad access detected [ 29.510468][ C0] page_owner info is not present (never set?) [ 29.510477][ C0] [ 29.519047][ T655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.525252][ C0] Memory state around the buggy address: [ 29.525273][ C0] ffffffff8670f400: 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9 00 00 00 06 [ 29.554957][ C0] ffffffff8670f480: f9 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9 00 00 00 00 [ 29.563001][ C0] >ffffffff8670f500: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00 [ 29.571042][ C0] ^ [ 29.577442][ C0] ffffffff8670f580: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 [ 29.585494][ C0] ffffffff8670f600: 00 00 00 02 f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 [ 29.593533][ C0] ================================================================== [ 29.601568][ C0] Disabling lock debugging due to kernel taint [ 29.607699][ C0] ------------[ cut here ]------------ [ 29.613150][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 29.621729][ C0] index 9884 is out of range for type 'const int[34]' [ 29.628467][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0 3cc70382b65b9d7164db2b4c9185747e14a17ef7 [ 29.628487][ C0] Tainted: [B]=BAD_PAGE [ 29.628491][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 29.628499][ C0] Call Trace: [ 29.628504][ C0] [ 29.628509][ C0] __dump_stack+0x21/0x30 [ 29.628530][ C0] dump_stack_lvl+0x140/0x1c0 [ 29.628546][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.628563][ C0] ? input_event_dispose+0x2f5/0x6d0 [ 29.628576][ C0] dump_stack+0x19/0x20 [ 29.628591][ C0] ubsan_epilogue+0xe/0x40 [ 29.628602][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 29.628620][ C0] aiptek_irq+0x1f3c/0x2a00 [ 29.628638][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 29.628651][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 29.628665][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 29.628677][ C0] dummy_timer+0xa3f/0x4900 [ 29.628695][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.628707][ C0] ? timerqueue_del+0xd7/0x130 [ 29.628725][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 29.628743][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 29.628758][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 29.628776][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 29.628793][ C0] ? read_tsc+0xd/0x20 [ 29.628809][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 29.628824][ C0] hrtimer_run_softirq+0x159/0x560 [ 29.628835][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 29.628853][ C0] handle_softirqs+0x1aa/0x620 [ 29.628866][ C0] __irq_exit_rcu+0x47/0xb0 [ 29.628877][ C0] irq_exit_rcu+0xd/0x30 [ 29.628888][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 29.628904][ C0] [ 29.628908][ C0] [ 29.628912][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 29.628928][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 29.628946][ C0] Code: cc cc cc cc cc cc cc b8 eb ac 2f 8e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d c3 e7 41 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 29.628956][ C0] RSP: 0018:ffffffff87407da0 EFLAGS: 000002c2 [ 29.628968][ C0] RAX: ffff8881f6e00000 RBX: ffffffff874156c0 RCX: ffffffff85a5753d [ 29.628977][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000002d99c [ 29.628985][ C0] RBP: ffffffff87407da0 R08: ffff8881f6e395eb R09: 1ffff1103edc72bd [ 29.628994][ C0] R10: dffffc0000000000 R11: ffffed103edc72be R12: 0000000000000000 [ 29.629002][ C0] R13: 1ffffffff0e82ad8 R14: dffffc0000000000 R15: ffffffff87ececa8 [ 29.629012][ C0] ? ct_kernel_exit+0x7d/0xb0 [ 29.629029][ C0] default_idle+0x17/0x30 [ 29.629039][ C0] arch_cpu_idle+0xd/0x20 [ 29.629049][ C0] default_idle_call+0x3e/0x80 [ 29.629059][ C0] do_idle+0x2fc/0x570 [ 29.629072][ C0] ? idle_inject_timer_fn+0x80/0x80 [ 29.629086][ C0] cpu_startup_entry+0x47/0x60 [ 29.629099][ C0] rest_init+0x10b/0x130 [ 29.629109][ C0] ? __cfi_x86_late_time_init+0x10/0x10 [ 29.629124][ C0] start_kernel+0x462/0x4bb [ 29.629135][ C0] x86_64_start_reservations+0x2e/0x30 [ 29.629147][ C0] x86_64_start_kernel+0x6a/0x7b [ 29.629159][ C0] common_startup_64+0x13b/0x157 [ 29.629177][ C0] [ 29.629181][ C0] ---[ end trace ]--- [ 29.954946][ T9] pyra 0003:1E7D:2CF6.0002: unknown main item tag 0x0 [ 29.961820][ T9] pyra 0003:1E7D:2CF6.0002: unknown main item tag 0x0 [ 29.969427][ T31] usb 2-1: USB disconnect, device number 4 [ 29.969528][ C0] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 29.984089][ T9] pyra 0003:1E7D:2CF6.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.3-1/input0 [ 30.154780][ T9] usb 4-1: USB disconnect, device number 6