last executing test programs: 14.176835255s ago: executing program 1 (id=2669): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe(&(0x7f0000000000)) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/address_bits', 0x80, 0x80) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd2(0x0, 0x80800) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000040)={0xffffffffffffffff, 0x300000000000000, 0x0, r5}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) epoll_create1(0x80000) 12.752521966s ago: executing program 1 (id=2672): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$nullb(0xffffffffffffff9c, 0x0, 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) getpid() syz_usb_connect(0x6, 0x63, &(0x7f0000000540)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902510011040800070904880400f7f98a060724060000d2cf0524001c620d240f01000000000200050002090403080353ee970509050810200009090c05f6ce740000000000000f0300040609fe09050d00000402070eec32319e86e1a0923deb6449e03f9aa6603c260ad68e2734f7b91a46a2196270e99100b939d904f58158fa891b3fcf862e1984569f07805cd77cbb771e9db1f5a9cecebadd88c31afc697b826b27b31f655c746714c4cd3039a01944e8875f55cdc21a3f7edc61406450bc7ffbd7bc19490ebfe3849bf447a7751b8abf1448b511ecfa16585d2136a7aa77b4e820190d3c83d3280faf728c58154338cdac0ca5940abca16afa0e14d635a68e004e0f44649a09631639bb22e03bce46cb4d1e53bf341434574a71fb"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newtaction={0xa4, 0x30, 0x301, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x8c, 0x1, 0x0, 0x0, {{0x7}, {0x64, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xffffffff}}, @TCA_CT_LABELS_MASK={0x14, 0x8, "8e707ff50d2f36de21ae662b5beb468c"}, @TCA_CT_ACTION={0x6}, @TCA_CT_ZONE={0x6, 0x4, 0x3}, @TCA_CT_ZONE={0x6, 0x4, 0x401}, @TCA_CT_NAT_IPV4_MAX={0x8, 0xa, @multicast1}, @TCA_CT_LABELS_MASK={0x14, 0x8, "2c25b52f7680b6536380db690fa7b2fb"}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000300)={0x6a, {{0x2, 0x4e22, @broadcast}}}, 0x88) sched_setaffinity(0x0, 0x0, 0x0) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r6, &(0x7f0000000040)={0x23, 0x0, 0x0, 0x1}, 0x10) ioctl$SIOCPNENABLEPIPE(r6, 0x89ed, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x60, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x0, @default, 0x8001, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}, @NL80211_ATTR_BEACON_TAIL={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) 9.715233724s ago: executing program 1 (id=2684): futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0xff, 0x0, 0x9}}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0xffffffff, 0x0, 0x0, 0x4, 0x2, 0x1}}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00'}) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount$9p_xen(0x0, &(0x7f0000000300)='.\x00', 0x0, 0x44000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="400000001400b5952cbd7000ffdbdf250a180000", @ANYRESOCT, @ANYRES32=r3], 0x40}, 0x1, 0x0, 0x0, 0x2000c015}, 0x40844) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, 0x0, 0x0) bind$unix(r6, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000280), 0x109101, 0x0) syslog(0x3, 0xffffffffffffffff, 0x1000000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000040)='E\xe1\x85\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setpriority(0x0, 0x0, 0x2a14b58) 9.656711209s ago: executing program 0 (id=2685): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = memfd_create(&(0x7f0000000480)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00'/675, 0x3) fcntl$addseals(r4, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r4, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x2710, &(0x7f0000000600)=""/102389, &(0x7f0000000000)=0x18ff5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='consume_skb\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r8, &(0x7f0000004440)={&(0x7f0000000ec0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x2}}, 0x10, 0x0}, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22) sendto$inet6(0xffffffffffffffff, &(0x7f00000010c0)="fc297476eb4592ff519d1e122e759ac1038e79813a8b5022b00bf0058ad9386a4655783290a023639ff1334db179a10bdb7a38dddc32eff181c0317b9a7397bab6774953efe4208c5f091342c3c94db3da641b2131a23ef61d9bc6e0e566d17adb589427281d9f0c456b51088f289a9fc146f02b2b9ce1d2265cffa8c95dc490361809f26201deb5a060a57838a1b35b4a31ee5b373ea3a1d62d9171cc7976d14f46f749560007fbd37ef3b09eda4a2492b3d6f2637661269db5368978f4f8ff967c7ab6dc0c4f1e5742fde8cf4d75eb4c9dad01588ecda54ca44daafc39b53b5de3fe5161b007bb6e4cf8f9b0004acd86335c897a398e85e4e9dba0f1c8befdc5be0b39a8cb5415acc34911ebfe04439f41d37fde97c0b6c17dfaf295b09b31ef2603af97a86a9557d4d8dcdae602e1a7a7940d7575847b8b092bba3b16139d247a20c11c6e71b4f48d1bde2b9ecfbf74cebd0f8798cea4a354f6821e8a364f4f82c481158111e220a36acc36719e4b5a2dfc326efcd2bf9803c532020013a45fd25f8cfa682c8b3e83ff881db060b11a5c88e6a84c041f2495d38c2acebad3ca9404bf692b1ba3280dd721dd6da13e9965b3db6b828f742be59d822a9b431310c4ae18f8757b441407a2208040129ccd3fdfdc0dd0c28e4d165dd340c7fb641aa641cf3d2d7d3b941cab5f8c1a207fbe57a2c44142b289bda1a118b798470d51f0afc45bdf5ce9198b329ecc58ba9123c4f646c8a2e00c00c90700493501e625062e7c56e2ad957a9a98c1f4b981bc89d35bd6e337341e8680f27925b0e9c2554358e1326859c5bc63a508286d98b6eb9764ef3359b85045714d810a485bcce8e944a9541a971f42c16624f7b84b39dec804fe0c65a4c2ed11a9f5a66fdce4a0d3608cd3915f72b0cb5076aba30bee1e97af3cbfea5aad4b70fe99fcb56a172964b077cbc9d8632837d8975677819438e6b63562a722383eeeeebd87afe87d972e8cdbf90a8fd5df7ced2daac43a055a00efd9b4d947a1a114b06c7d44d149b5d63242ddeb8663eef38f9575f42346960901790ee0cf5468258e77d802eb6fc6b5a1f8c5493e8507b05240f301bddac027e2123bbc05f99e4f15ab93c458510d9d7bd35217c0374ffdb1d74dbe214e84d307860b2388f939c84495faaaf5dfa08824bd86eaf3a36b7e7aa2796f7e6ff6b2ccd31bc0ed3dae970497d1e76b5e74f6d10dba886f65148f8338800e8bfb0ebc68224014d1599d3cb3fbd593e93a5fe2779ca777fbfb96c5ed83dca951848b34e1d601580dea7bdc858c8dbf4130693f59ccab319e4e3a664f2a38cc74dfe5e7733710996e7bb81fb9f6218cc7d017fd67cbb6738a43dca9bb242e26fa42aa9360fad8ccca27d8a5afef2dbe6999d7b98dea41e1648624a09dcd1ddef6eba53dbdda8ee20aaaf9c17fb96330c7eddb9bc86ba52a84f76240466ce57a4185d57a910c7b55bd696ba5337ddc3715cd9f6e40da87b6011a01416f95eca6612590ec7a88a415a50e4eacd1f29e49233cf4c6a345b3895f1c16e427d1af1a29b336434c66003873b0440d97313bc17ccf5fa57727b278aa06c9e136d0f08b788e226b3c99af9b946f2e1b8fcd6e81f5b1013c39bf05eeaa4cf336fea7b55750730ebbb85ad3dc95817b893f1234c56ca6c7e416143e5a1dca4e21e5aefa25752cc7cd2e8d266482e4c087e8597294985dc82990c851a8b9b03d1e43b1af6dc6a5981cfb74305a357854859f61930b0b9b160b20348c373e7bf2291c5a9338ac883187f64dd49b8eb0f6233a998287f51f4f55b588a4674633e1d159d631e5c500d491d02a13c762c3e550fdce1bcdf7d9b362558a160a2a9de658d2de42163c6fce8e48f5b4cf58a32fb1aeedd9bdef17fcc22f58742a789302dd4247e6c190ba45f63fb12683ddc742a45c00d49b8af069d73b11af3ebe7b61974e8a33f89c3df742b8b2e4b8724856de8dca9548dc852c9e3f8eb170d2e46de0f3dc8b8fd07a8509c244e3", 0x595, 0x20000080, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @remote, 0x3}, 0x1c) 8.712001698s ago: executing program 0 (id=2686): r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000240)={0x24, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}, 0x0) 6.912134173s ago: executing program 1 (id=2691): read$msr(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x905, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x815, 0xfe, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$peekuser(0x3, r1, 0x388) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x0, 0x3, 0x3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000001a40)=""/102392, 0x18ff8) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0xa, "18"}, @global=@item_4={0x3, 0x1, 0x2}]}}, 0x0}, 0x0) 6.748604176s ago: executing program 2 (id=2693): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xfe, &(0x7f0000000100)={@multicast, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xf0, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x35, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x33}, {[@cipso={0x86, 0x71, 0x0, [{0x0, 0xc, "e256b28c04000000fb52"}, {0x0, 0x9, "789607675ca638"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x6, 0x7, "cfa11cab1a"}, {0x0, 0x10, "c600"/14}, {0x0, 0xa, "6580a5e97612fe86"}, {0x0, 0x12, "73bc2300ad9d19a30000000000000000"}, {0x0, 0xc, "c8f46976e79e56c7a95e"}]}, @timestamp_addr={0x44, 0x4c, 0x2b, 0x1, 0x2, [{@rand_addr=0x64010101, 0x3}, {@remote, 0xf}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x40}, {@private=0xa010102, 0xad}, {@loopback, 0x4}, {@empty, 0x6}, {@private=0xa010101, 0x4}, {@private=0xa010100, 0x91}, {@empty, 0x8}]}]}}}}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x1010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r4, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000580)={0x1328, 0x12, 0x8, 0x70bd26, 0x25dfdbfb, {0x23, 0xfc, 0x4, 0x7, {0x4e20, 0x4e24, [0x5, 0x7, 0x76, 0x3], [0x8, 0x7fffffff, 0x7, 0x3], 0x0, [0x3fd, 0xd]}, 0x6, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "c6ff36a12b8f9b9c6d6d0b372d5d0a29ebb35777b6b567455ad11c3df976c98393b22acd5f7d7e833ceb10a0d19988c314add38333c5e5b6a6d283f2051da1391ac77915d193299c105be567af88d33829df8b69be975fd1bc1a85de9fc69d70ab0470a45d7a6ce97e4e9c851dbec73f99e6f10a586ae8221160acdf94f8d02b64834e7479d635d0e09d8cac31e728182315963844d69c2e0f8de0efbdeab044f466d759b262c52d1fb29cd7d3144cc7c6d20bc1e60570221dea173dca01b428356cb9dd5ccc0925d2697b9768ac6e77dc392c4c42cc115c05b99c13aa34686ce7d648c96a8e7662bd9643938f7a95f5fc137f6a566ce8250807084aa6539011750186dce419ed921bf76b2d6a9473b7da11d6e8b7679fd294796d2eccdba02c3caec086fba40e31de7bffe07e72bf71d9dbe80ee506208c42fb497edbb6027381de10c41ab9b2871243621d030a64342c0834667aa2a72de81edf11878cdcc559326b8c2559ab31b08a9ed64b68be0cac43e2524ea06498e64dc9c9fe38d423538af7754b56304a486c1fbd81b975c85be4e8195ac0dca3320a4f6ac9948b739215feac6fd119357402b7caf2591d061480f7b0e90d4581fd97fd8736dd37442fd9fa59fc574cd6b6c4a72a3a6ddf0c5594922641b7028b444ac96e4a8087e0623686d27b87534a0548295b5de2043ebe8133faef406aa70547ca0c507e3afe94cdb3c38d4cd775c796fa63dcd35591b595d51498c90c8697a0d4f6d840fd80685b708b27e212139adffb26526f09e9f4090194010b991f22348e659ddcc7a7141754181e2553ce326d2a858bc254e92cc376c59a84dd2f6b8727d8abe2302b3463aa60f5163f159af3550c6e91b5c778b1aa21428c9e0602ccc8974d15ec52bfd71042d0cd24a183f6ed9b6387fce9d0260e2a3a300dd61dcb5e24da23f3908fd5fab9ac835cedff1871fff39dccb5521e7fbc43cea3d54ff9e056908fcac90b8424552a55f6c3d09a1c1b46fd1cd02a21e353c4e4795e3663a43c230b994390a4090cfd7788e228d1f6fb567398abf5f86fcaa817b663d7e637e7450d26f9a596dae65db46d8a59a11f9d219c4501d1a08f9ac9fe6ef560dfd4c46591fc8afe6e7331e1a1eedfef12373da247b7d9ba94a8b357383f18cd37f2a55bbadbf1bf3cd26c23776e57b565c71ddf32d2c3ba9382ab85064b5bd63ab7d0d81cd3c9ebb3a05bde8817f926d7b4916d1e990a3c0b4b61c795e9d38e082122e80ebdf2763837a5c551bd7d8102ad460a0c87c52da8e5f649f159669ccd75c85265fa7dc7e0eb28e4ecb81f1980e9612f3f581f99c43b755c54b1440cde29f88bcf6226e7beaba416efff5360eecf2cbe4f9c760ceed773f58eeedd119a631a541a206f5b21962faaf42fc2ca562025f599d3f52878bd64ccda1bbbed783cc090e2e62bc1f3a5de9cc24d2a658eb0294063143a799c46c3f3a2366a215729567a59e174daccfa8bf215d525b9070a0f32449d511f9095b4e8e42c3329b98182bd2a271a104067233aab834560f69250875ff99a72f337c1ac8e1e739f7f72179b1a3167916e560ff75c7c12f2d09e94a42dae885fc0c83824eb0eae99fbcd8dd26a9f0266ad967244daa984b38a2f7392f2f8b1fb78cd38b15f70e0b110674a23d1b39bdd82c0041c9cbf8bd3c652008aa64f27413ea686adc21b23a7415894445f6a8c834325318b9b694c3761eb98894197dbd791dfed30b5f5022028861c42aaa15b4e1d30a740192f71d3ff35c6a25004f196694cd060b7cb4d8e297bfb49e92a63ca23326ae729c71ad35e772f5d5c97394940b0e9ac40989d2346e540b90a2c20bf9df17119ea6606053d726f5397290b95be1fbe706b740c895d432e1acb882ef5289c922c71c7550520b5d7f556d51d137f0b103bf00e5a2b98ddd85eae589e314dda94761a187815be1d94b4e11b03072009200e6652dcf1c6940425a0b8acf7d2f1a9da13cafec1d13870d48a4359970e60edab84f277bba52f8a2e6ee3b8eecee5f0b01fb62546782d477df6956d2f5f2d450b67f895c68b972b1c5e703adae199840ec4bb41fb5bd3c6b3dd69a797cea5edc7746ef8545984d3a747330e140f37a53eee327704ce6f9028c970cf0334137a989a80cc3f48c7882c9ccecbd2829231bc18d7e4cd778baa3aa109c32805988ebe986ed4f8fd5703ffc0837ff7f4e5c6d8ab94f88bf373a48f5581380e9611e7ff07c777a06858c68a7406852d2cedc9b2a02d3e62a98339c7edc0b1a6b38d696d472cb4ce41e045b9dc819610b85da7d2881b74e9dbc21e3b73e9d23b7810cd36ac853acf3e1598ed9555f5cf01acfb36e38c0be3fcd5c748c3f2d73d8c87da8e0647f4b84253f69afca4539afe329a992eca526d4df6b7ea280856ab2590927fcf9356a5b890c961af5d26dc866e24a28779ea65641f3b59cae6cffba219bd701d73543cc8e8a53052e0d0542d41eac771f8228284cd16c6a0f82f87e147e905afcfe3876c199361dc644d51c4382f16582553929149522e7cc30f0978083ff3d83c7e26260ccf09a52d8c074d37232928e4a536e496e044979b5a11d6e1167cceaeb4211110b54f31b1cf563f3e52012f799b76d62ffb178e669def7afd4d807eedbb67dda4cc23f2508bd4d91d74923562001245713ea25115cad7c1a109e76a253fbbcf1c7b296893a8702de92ab89cb38a7842ad692f17a1ebb4eebf1c67aaef1569272af092d1f2e800da1fb34b555c4c146e1a494c7019b7d3a50f6d8ba789f5eb4b26556543c63aa385b906ac9747a815c34c44aa7cb26546e5a67d8bf4636bb1fa6845dc1177dda1ec4cf3d03b1c35257539bd2f74ac77deb51bed6fbae8b4c7b20efb84a958e7fe6cd2f808bcd4155cb5b39689f64a93ac7e0a43970fedebdf29bd66b19fb79ef1a2fd1604ae1937daf9ecc0ad734dc55bad3afe98982039ffbab73d2878a6af69487c2005ae45b38390a2397ebf00b4046ab9d6ec81fbb8e43e5e5b97e65a381f81acb9665862bb33f287df6e2cb678906c67dc0d00095bfd6a4871fe25d00cbfbc887ab57b63b1322e73acd1aaa0a23e8114e8327f1354f2d10838dd369ccf18a1b772bc94e852bfed61f2dd5382989b8d438cfb780a2a8ef4b3d425cd07296f304de1f6a61c73d1ad6a62c84f1501b2b453efb331d217e62a5b39da00728167f3e0dc601700476887c1b109cee8b46a29c7dafa172fd578796bd4b9d4c846761150b41c390d5602be69f8238d00030c8efe51c79c127aceec7f1546e71d26191ba3adcb10f95350fe651631976eb2410a606e3478035600c39f1c128d43a2f39d97026f90baa2bdccd17ede21a82d90b13181cfd492cc1f9c230315e30c51783c99d02e12d58e4a2d918dd75bf564b127c19f92a2d689e140c191859bb8bdc5c8909104f1a63f3f944b8d099980e1e3a0d30448633084c343e4c2dd827af7e27cd31518ab1a8a2a21cc20c744d38c4a15ef38f0aa50503063b985e42dde5672b901d6c15e781d70ff3256253b98deeb113a354b1be5d842ee2893ca5cf7852e9bdf0b8b67bb4a5994938b517bec266f270f4886502d6a6f92775482fbb7e88e8add13305764434392c3b844d28b9bec857fdb5ca62ff8a12813cf3ceac8a489c695aae90e44273d1a312a92f84c640cc0982ea22e7cab4db9444128a975109e8dfe30a950ad28cc3980cf90bf0522570e8a07bc58458255ccc755273608a69963a93a3ea4e9ee82d333acfa5f77b9cf838030df1cfeb4b80794422c8ffae707af3ec54eacdab082ce006e04d361136b00c62829242ba5f9f7d27305af48ea2a5fc1d8b28d17b314657c6382de367e619b53c0961464fec8897d6406217df20ef6cf559053668442b84327b19aa66fc3d9950fd7cbb97687b871307bf547579b738befb0aecd1807b69afa3d6bff35064384118b9fbbae1c62cc71c1ee4b04c8279accdc6fa3ec57d18454a805945276d216d88b3a81f238f666e9854cfcfbcc3a677582791900a50b8adc1e51ec7a59ddb549dcbb262b5199540c2a047ab457ed9cf946a276e4320f6b4d10105de0396668f948d82525a2380e39a358067c33a7c3a740c9ae4740bec5ebe3283a143598b470d7501eb7db01e97994188691d473304b41d96f4eb31d1ec6da9b413bf2671d723e5203da7422eb13fc487554b0030336b9e4c7e972ca75b094addcd99b5ce191ac445a3750386991468f2fafbafb6c82d26ba3ae2c5a1755bffc862f1ad09661f767dc47c50449c9c369586c37536b99007e0af80ad2467acafcd62bf76e77d453e133905beb79787cb862e1b2da589dbca529e6d0e88294b5957a9519b75f8a762dbfd35011566882865c060b77a9d8360357f2f26b4c8b241d2ae70c066fb29168515cefce9f543815d61b1638e841b098067fbfe424a688162be9db67352249730de677aa64ee49c7f9ec6a16799951ac1c68b865f0530c2ef4f202b2831f4d6fc1506f548e01d5abccc4dbca439e7f1b785cd20c2b7b71e07c92516ca1d27abe85bd08f75f466f4fabe0c8f098c7c2eb7bcf14f4f17bd2026acc623b0abf8efe661cb53a209de69c54763c44961f359533dd0a83e563f1be48ff333a2c4b9ed01f5bb6c19c43e4bae38dde5896e40dd2185f16c5734e9c257dc36dfe7c95be2c2303efdc454b2a13e6008ab9462a626b9547f5d84efb56b336c37c059aefb121a4f26f4d4c89b53287898be80df0dedcb2018b9439070329f620e0a18680a3f07adeab639cc8806c74c65b98f620615e8158128ac8ddc0384bdd5e9b4973e06b4622e18c56e594d31af41175331291ed5f64b7fbff0cf3dd196fbf80ef04d3d39e545f1e4e759f082ac02d692805986670675cfa30ad52c22625a190131f5aa547c9f527185680ec94d37fee65e875f0a3b8cd73456f57cc30e54631eae09fe8111d07222e95d4d87e9e7425e24a893c45a7db7b2503c521b1890ef1b56e70544d0edef4fd797b774f1c7263856d250e1fd379d48776de25f5d5f5fccad43610ac8c8201d9709612792dc670343579861596ce648cd9f907ec815c6c4af36fbca2e5805e69958b8663f1bfe9886d5b54cfd14d86a30c863c62a25921490557bb247706d55dfc715b952d734b3b87feade884b0f1de66c457976c34d36c4a0194eedc448c0345952219feb8b73906190a51160b64200b7b0e6934ab7000aa3f51c0b0760e6482934fe425e7685926082bc591bfacaa7393caf036c69c1cb96eeac35f35fb4f69c329dd3d5d8ad2c3b7602506ae19cda06dacd5703ab510af5b82d71b6231618e3650b99afcbfca3b8dbb51c983f8763ac4c8cb8051f7452fb94b8cb5fc6a7dfbaf92e58c5351903589e8b01f1b0a6f6f5af80aa1891436002caacc28cad81af7c68a05bdc68dc38dc0b1e0c180737dac7201dedc69d130c334e0a2cbd0ee0273764e7d29c6f38c7f88a299ac6965c25b53d385962ceb35273d7bb08593e9ca87c669c940faef0657d76f1b3a3d7923fa22ee1e032cf0e1f9b422b1d861f63d0879aa5822257bfeceb596dce4b5928759f8cbe6960353a7eb27befdc16458eed63e0298f41cb960de87f2524c44af1668ab896fc4c76ee9fd16820a70f45b742bdf08904bcfbcbc7d17ef43d5e9fdd80fa10f063bd8a7fdb32ffe83079304ff617488a0e6e56ec7a29cbbe78f17613e556c50c0781becc39d0e2c10b0e8d16e1542ee89f8e979fcde962ab2e9af2d17cfbdd5b7861d6770eadbd0b2a6473360f05befcc8a"}, @INET_DIAG_REQ_BYTECODE={0xd4, 0x1, "62999b0f4871c4f66f4ceeb16e6375d1cfe8e4ae085185f0a053024b1bb9007a877e47f5f2c79427d78b1b7c61fdd4d5b178a166df3ed3a3f0f7fab2595a355d4e2a5a1b60a9adbc3fbf3dc4c33d6884fb9d3c16e9ba0c9b1ce57361265a7fcab8803deecf370f662cb48e706e6d8b577c5d431e2712df5bbda57f8cc00240f7904b4807657412a0a4f11666beb89aac695922a1ac87c341b7e31002f6e7aaff06bb61d3c239827674c51e3b07be1206cc8761ed426d32ba0dbef311ae17bd81158f6cb4107a70ddbc4c57e51807f45d"}, @INET_DIAG_REQ_BYTECODE={0xd5, 0x1, "a55076a7e17412cbc9d4bdcf5c924501e032254f9505326bc95989e7e4ff96dbf99a131510ef2b284b00d760bf14d4cd9c305f063fa09e582ec7ebc5cbfd9e7fc27d916c0bb8edfc1fc79b52e05ae8cc1a5070f14a477bd5058d2f84e8c4f1a25979b42bddabb1ebe584f5cc8210d53936de44790b30b285050185180275122733b379064d005284ef48457c10b9c35bbceb7785b6a4245b3b2296886f3f6145858d8ff3a81bf0f7102504e5c3067a7be665f2e991b4b3fe7df07d2334138f2cdedce19fe11dbe9527b5e7a6d3469cce76"}, @INET_DIAG_REQ_BYTECODE={0xff, 0x1, "aa0a5cd867b19edc3be4db989a411c0abc55efea8119e9463b39195111129afcd5d6bb4279e85a8a4e7d08d2d905b8c49ff947aaaf0db3e48f5a15153d16ca71294ed344b12bd1be2409717ef40c5183495a0c2f73e5bc0e38ea00d6ebbd0ea25a27ce076a65bf7649553c17457506433b141656022709530ad083f6ac58cf56fc282f7784244e702bbba4495a6b472611ffb776dfb1ff94af7811ffd1924e968cbc972a3cffe30030280368d46908dca355689b21284be6d61ea3ff68b8bc64c856be31292a190a484c5c3e7ad1d25d24d5c2a0dd7e6107f66d5c19ab6f0a18c4cdc19da54ca2444e1ed65dec9cea0fe95bcc1ad73e95bc3ce81e"}, @INET_DIAG_REQ_BYTECODE={0x2a, 0x1, "19235223bdbc00a96993c8b845fa4c7b75c3dc155681d5eca21090270ab08a9613d14c2ea041"}]}, 0x1328}, 0x1, 0x0, 0x0, 0x4}, 0x400) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) move_pages(r1, 0x4, &(0x7f0000003040)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f000001d000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000235000/0x2000)=nil], &(0x7f0000003080)=[0xfff, 0x0], &(0x7f00000030c0)=[0x0, 0x0, 0x0], 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r5, 0x3312, 0x10001) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r5, 0x0) recvmmsg$unix(r5, &(0x7f0000002f40)=[{{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000000340)=[{&(0x7f0000000280)=""/43, 0x2b}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/117, 0x75}], 0x3, &(0x7f0000000380)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd0}}, {{&(0x7f00000028c0)=@abs, 0x6e, &(0x7f0000002940)=[{&(0x7f0000000500)=""/27, 0x1b}], 0x1, &(0x7f0000002980)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{0x0, 0x0, &(0x7f0000002dc0)=[{&(0x7f0000002a00)=""/140, 0x8c}, {&(0x7f0000002ac0)=""/48, 0x30}, {&(0x7f0000002b00)=""/173, 0xad}, {&(0x7f0000002bc0)=""/244, 0xf4}, {&(0x7f0000002cc0)=""/35, 0x23}, {&(0x7f0000002d00)=""/60, 0x3c}, {&(0x7f0000002d40)=""/94, 0x5e}], 0x7, &(0x7f0000002e40)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe8}}], 0x3, 0x40, &(0x7f0000003000)={0x77359400}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000003100), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @remote, 0x5}, {0xa, 0x0, 0x6, @dev={0xfe, 0x80, '\x00', 0x1f}}}}, 0x48) 6.519191452s ago: executing program 3 (id=2695): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x4, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000002080)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xb, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x4044841) sendmsg$nl_route(r3, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000080), 0x0, 0x0) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f00000000c0)={0x0, 0xc, 0x4, 0xfffffffffffffffe}) openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet(0xa, 0x801, 0x84) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020}, 0x2084) openat$autofs(0xffffffffffffff9c, 0x0, 0x20040, 0x0) syz_open_dev$sndmidi(&(0x7f0000003640), 0x2, 0x20042) writev(0xffffffffffffffff, &(0x7f0000002280), 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8dff) ioctl$FIONREAD(r5, 0x541b, 0xfffffffffffffffe) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000006000000060000000500000000000000", @ANYRES32, @ANYBLOB="00000000820000000000000000000000ff000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SURVEY(r6, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010025bd7000070000000010000008080300", @ANYRES32=r8, @ANYBLOB="0c0099000800000074000000"], 0x28}, 0x1, 0x0, 0x0, 0x8841}, 0x20000000) 6.28840931s ago: executing program 4 (id=2696): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000200)={0x80000013}) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) 6.021664669s ago: executing program 0 (id=2697): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = memfd_create(&(0x7f0000000480)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00'/675, 0x3) fcntl$addseals(r4, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r4, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x2710, &(0x7f0000000600)=""/102389, &(0x7f0000000000)=0x18ff5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='consume_skb\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r8, &(0x7f0000004440)={&(0x7f0000000ec0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x2}}, 0x10, 0x0}, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22) sendto$inet6(0xffffffffffffffff, &(0x7f00000010c0)="fc297476eb4592ff519d1e122e759ac1038e79813a8b5022b00bf0058ad9386a4655783290a023639ff1334db179a10bdb7a38dddc32eff181c0317b9a7397bab6774953efe4208c5f091342c3c94db3da641b2131a23ef61d9bc6e0e566d17adb589427281d9f0c456b51088f289a9fc146f02b2b9ce1d2265cffa8c95dc490361809f26201deb5a060a57838a1b35b4a31ee5b373ea3a1d62d9171cc7976d14f46f749560007fbd37ef3b09eda4a2492b3d6f2637661269db5368978f4f8ff967c7ab6dc0c4f1e5742fde8cf4d75eb4c9dad01588ecda54ca44daafc39b53b5de3fe5161b007bb6e4cf8f9b0004acd86335c897a398e85e4e9dba0f1c8befdc5be0b39a8cb5415acc34911ebfe04439f41d37fde97c0b6c17dfaf295b09b31ef2603af97a86a9557d4d8dcdae602e1a7a7940d7575847b8b092bba3b16139d247a20c11c6e71b4f48d1bde2b9ecfbf74cebd0f8798cea4a354f6821e8a364f4f82c481158111e220a36acc36719e4b5a2dfc326efcd2bf9803c532020013a45fd25f8cfa682c8b3e83ff881db060b11a5c88e6a84c041f2495d38c2acebad3ca9404bf692b1ba3280dd721dd6da13e9965b3db6b828f742be59d822a9b431310c4ae18f8757b441407a2208040129ccd3fdfdc0dd0c28e4d165dd340c7fb641aa641cf3d2d7d3b941cab5f8c1a207fbe57a2c44142b289bda1a118b798470d51f0afc45bdf5ce9198b329ecc58ba9123c4f646c8a2e00c00c90700493501e625062e7c56e2ad957a9a98c1f4b981bc89d35bd6e337341e8680f27925b0e9c2554358e1326859c5bc63a508286d98b6eb9764ef3359b85045714d810a485bcce8e944a9541a971f42c16624f7b84b39dec804fe0c65a4c2ed11a9f5a66fdce4a0d3608cd3915f72b0cb5076aba30bee1e97af3cbfea5aad4b70fe99fcb56a172964b077cbc9d8632837d8975677819438e6b63562a722383eeeeebd87afe87d972e8cdbf90a8fd5df7ced2daac43a055a00efd9b4d947a1a114b06c7d44d149b5d63242ddeb8663eef38f9575f42346960901790ee0cf5468258e77d802eb6fc6b5a1f8c5493e8507b05240f301bddac027e2123bbc05f99e4f15ab93c458510d9d7bd35217c0374ffdb1d74dbe214e84d307860b2388f939c84495faaaf5dfa08824bd86eaf3a36b7e7aa2796f7e6ff6b2ccd31bc0ed3dae970497d1e76b5e74f6d10dba886f65148f8338800e8bfb0ebc68224014d1599d3cb3fbd593e93a5fe2779ca777fbfb96c5ed83dca951848b34e1d601580dea7bdc858c8dbf4130693f59ccab319e4e3a664f2a38cc74dfe5e7733710996e7bb81fb9f6218cc7d017fd67cbb6738a43dca9bb242e26fa42aa9360fad8ccca27d8a5afef2dbe6999d7b98dea41e1648624a09dcd1ddef6eba53dbdda8ee20aaaf9c17fb96330c7eddb9bc86ba52a84f76240466ce57a4185d57a910c7b55bd696ba5337ddc3715cd9f6e40da87b6011a01416f95eca6612590ec7a88a415a50e4eacd1f29e49233cf4c6a345b3895f1c16e427d1af1a29b336434c66003873b0440d97313bc17ccf5fa57727b278aa06c9e136d0f08b788e226b3c99af9b946f2e1b8fcd6e81f5b1013c39bf05eeaa4cf336fea7b55750730ebbb85ad3dc95817b893f1234c56ca6c7e416143e5a1dca4e21e5aefa25752cc7cd2e8d266482e4c087e8597294985dc82990c851a8b9b03d1e43b1af6dc6a5981cfb74305a357854859f61930b0b9b160b20348c373e7bf2291c5a9338ac883187f64dd49b8eb0f6233a998287f51f4f55b588a4674633e1d159d631e5c500d491d02a13c762c3e550fdce1bcdf7d9b362558a160a2a9de658d2de42163c6fce8e48f5b4cf58a32fb1aeedd9bdef17fcc22f58742a789302dd4247e6c190ba45f63fb12683ddc742a45c00d49b8af069d73b11af3ebe7b61974e8a33f89c3df742b8b2e4b8724856de8dca9548dc852c9e3f8eb170d2e46de0f3dc8b8fd07a8509c244e3", 0x595, 0x20000080, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @remote, 0x3}, 0x1c) 5.816814959s ago: executing program 2 (id=2698): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000ac0)={0x73622a85, 0x0, 0xfffffffffffffffd}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000240)=@userptr={0x6, 0x3, 0x4, 0x1, 0x3, {0x0, 0x2710}, {0x2, 0x2, 0x5, 0x8f, 0x62, 0x4, "3dd1dc87"}, 0x4, 0x2, {&(0x7f00000001c0)}, 0xe, 0x0, r2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xb, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x6000003, 0x42031, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 4.312414696s ago: executing program 0 (id=2699): r0 = socket(0x11, 0x1, 0x0) ioctl$SIOCSIFMTU(r0, 0x541b, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x44021, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x0, 0xfa, @scatter={0x4, 0x0, &(0x7f0000000a80)=[{0x0}, {&(0x7f00000006c0)=""/235, 0xeb}, {&(0x7f00000008c0)=""/132, 0x84}, {&(0x7f0000000980)=""/221, 0xdd}]}, 0x0, 0x0, 0x0, 0x0, 0x800001, 0x0}) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) copy_file_range(r0, &(0x7f0000000240), 0xffffffffffffffff, 0x0, 0x101, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000006, 0x10, r3, 0xcf032000) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r3, 0x8, 0x0, 0xff9e, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8cd9df7287d7cbb, 0x0, 0x0, 0x10, 0x4}, 0x94) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9c4790256c99bb2, 0x6, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000015000200071b1750bd030100000000009500000000000000bc26080000000000bf67000000000000070300000fff0700670200000300000016060a000ee600f0bf050000000000000f650000000000006507f4ff0200000007"], &(0x7f0000000100)='GPL\x00'}, 0x94) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000040)) getdents64(r5, &(0x7f0000000ac0)=""/4068, 0xfe4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x25dfdbfe, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x9}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x7, 0x5, 0x1}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x6c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500150002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) init_module(0x0, 0xa10, 0x0) 4.311369426s ago: executing program 3 (id=2700): r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000001800), 0x2, 0x0) write$selinux_load(r1, &(0x7f0000001840)={0xf97cff8c, 0x8}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r3 = dup3(r2, r0, 0x0) connect$pppl2tp(r1, &(0x7f00000005c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e20, @loopback}, 0x4, 0x0, 0x1, 0x2}}, 0x2e) r4 = msgget$private(0x0, 0x0) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000400)) ioctl$BLKTRACESETUP(r3, 0xc0481273, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1a, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x9c}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @tracing=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) msgsnd(r4, &(0x7f00000000c0)=ANY=[], 0x0, 0x0) msgctl$IPC_RMID(r4, 0x0) ioctl$MON_IOCG_STATS(r3, 0xc0109207, &(0x7f00000001c0)) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x2, 0x0, {0x0, 0x0, 0x0, r7, {0x7, 0x6}, {0xffff, 0xffff}, {0xfff3, 0xffe0}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8, 0xb, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x2000400c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) msgctl$IPC_INFO(r4, 0x3, &(0x7f0000000300)=""/212) connect$bt_rfcomm(r3, &(0x7f0000000600)={0x1f, @none, 0x8}, 0xa) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001880)={r8}, 0xc) r9 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r9, 0x47f6, 0x0, 0x2, 0x0, 0x300) 4.118230557s ago: executing program 4 (id=2701): socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0xc) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) socket$inet6(0xa, 0x2, 0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000070041f30cc004b700002000"/32], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0x7) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0xe7) rmdir(&(0x7f0000000380)='./file0/../file0\x00') socket(0x10, 0x80002, 0x0) 4.011065487s ago: executing program 2 (id=2702): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = dup(r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r3, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @tick=0x1, {0x7}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x1, @time={0x10, 0x7c}, {}, {}, @raw32}, {0x3, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"272be5806cd46d7b9ff797a0"}}, {0x0, 0x0, 0x0, 0x0, @time={0x8000, 0x1}, {}, {0x0, 0x4}, @time=@time={0x6, 0xfffffff7}}], 0x70) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x1}, @IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x7, 0x9c}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 3.880347661s ago: executing program 1 (id=2703): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000000)={0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="002324000000240c46a468c1"], 0x0}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') fstat(r1, &(0x7f0000002440)) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)) 3.268890147s ago: executing program 2 (id=2704): mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) rmdir(&(0x7f0000000380)='./file0/../file0\x00') 3.220401202s ago: executing program 0 (id=2705): r0 = syz_usb_connect(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYRES64], 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd00000000000000000000003a131374a3371cb3e2a9bb4d798b91cefa444501f40b7c9589e8c0bb6c82123d2b45ce905d0903b32ecf30e828c71a07a83f3275f3d661d1af0ffbd5d7f0"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0xfeffff, 0x680, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) syz_usb_control_io(r0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="540000000206050000000000000000000a00000005000100070000000900020073797a3000000002000d000300686173683a6e6574000000000500050002000000050004000000000041fe96a9d923d5835da5f6fcf7be04aa02eb2716575d7004ff60095cc265f1023b6501fa3375d8c05891efabc94b75586f40a524c8b3e765863a4f0ce3da17eca67841aa06583dc198242dd6798656a69cd85dd247b48759d121efdee44277c24ebcd144d56dab58b821bb406eee9307e5964c73ddfdc2a2274ec6024805888219987c201d07e6b600"/220], 0x54}}, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 'queue0\x00', 0x1}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$sg(0x0, 0x6f5e, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = msgget(0x0, 0x40) msgctl$MSG_INFO(r5, 0xc, &(0x7f00000000c0)=""/173) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1000080, 0x0) r6 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) r7 = syz_usb_connect(0x3, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="1232ebad1122900d26e5854c44e4cd5ee51ba1f54f7ffbda00949dadec32d3e90897faae00000000436755ddb253e2d34dd30eb6f7080093906cc1772a012221"], 0x0) syz_usb_control_io$hid(r7, &(0x7f0000001ec0)={0x24, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0081000000000000000c"], 0x0, 0x0}, 0x0) syz_usb_control_io(r6, &(0x7f0000001380)={0x2c, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000840)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000202000000070000000000000803000000030000000000001201000000000027923d08ce1a65bc9cd63469c6d4772f8395e837e4bafb7882c2f4643f57685205442b2a687bd66d34c90476fc52c938180977bd8420d7406691c8120039c7f9306fd9b7a563cebddc0cbd308cd5e7617e5c4d3dc516a84404ac21ba0ef8a1434c45c8d571fd8f93c366e02a7400e9d237f08304f6db6905c57316ad4f1c2109c2d953d100811815b50eb810b00a21071000bf9d0341b1c6ad426cc7b1fac49d264b524cb6ef134de5ca1394e1a683c1ed81dee3f2fd98035f02814d53f274ba4535ca634b6abe95e886f9985717e1a89f0186eb259a052c33676c622b933143cb979aa5bf9a861d4d6bcd0e423396c54a849b"], 0x0, 0x3e}, 0x28) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000267400000000000000000400f73500000200"], 0x24) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="18e700005fa3e2b94be257fa71d2df0f1e3d5e3bfcbff4aeebfb4471ce1d3dc528c03267b448b38f6567958cc1cca4262e852e9c1192afd0e92391e05b1357a2cd0744a9c5fad3e57be40fb57fc4443dfd4bc686812faab73a8343f267b6dfc4b73492b77921ce5b164ade58338fd1", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r9, 0x58}, 0x10) 3.216545187s ago: executing program 2 (id=2706): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="40000000100005df00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e6400000000040002800a000100"], 0x40}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x497, &(0x7f0000000480)={0x0, 0xbf99, 0x0, 0x4, 0x34}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xd9, 0xe6, 0x1e, 0x10, 0x4cb, 0x11b, 0x23c5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xb1, [{{0x9, 0x4, 0x47, 0x0, 0x0, 0x19, 0xae, 0x7e, 0x2}}]}}]}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_RENAMEAT={0x23, 0x14, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)='./file0\x00'}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x4f) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="c00000000906010300000000000000000a0000093400078005000700680000000c001b400000000000000008060005404e23000006001d40000100000a0011000000000000000000080009400000000424000780140017006970766c616e310000000000000000000c00194000000000000002002c000780060004404e2100001800018014000240ff020000000000000000007f0000000c000780086a90a0f96bca015000020073797a310000000008000940000000085a73e53cb0fcd03a230b8f0a5d65f0a18f44ab9a7a4607e9c7d8"], 0xc0}, 0x1, 0x0, 0x0, 0x8811}, 0x8c0) 3.151708681s ago: executing program 3 (id=2707): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_PROTECT={0x5, 0x8, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, 0x0, &(0x7f0000000100)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, r1, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}}, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0xfc, 0x2, 0x4}) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405668, &(0x7f00000001c0)={0x0, 0x1e, 0x2, 0x80000}) 2.498870386s ago: executing program 4 (id=2708): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x2, 0x4}, 0x4) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1c) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001aa40)=""/102400, 0x19000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x121404, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000180)={0xc0}) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r3, 0xf507, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x15, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000002c0)={@private2}, 0x0) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x41) r5 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.216069731s ago: executing program 3 (id=2709): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = dup(r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x1}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (fail_nth: 2) 1.831029059s ago: executing program 3 (id=2710): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = userfaultfd(0x80001) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$sock_bt_hci(r5, 0x400448ca, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x100000) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, '.\x00'}}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) connect$nfc_llcp(r7, &(0x7f00000000c0)={0x27, r8, 0xffffffffffffffff, 0x3, 0x6, 0xe, "154319e60fae76677774ff62cb52ff4689378bd4dd64378ce15159dc9570050a855699577846a63396dfc19acd80afce21b431edbac43a6cb15810c407db1a", 0x28}, 0x60) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) sendto$inet6(r0, &(0x7f00000010c0)="fc297476eb4592ff519d1e122e759ac1038e79813a8b5022b00bf0058ad9386a4655783290a023639ff1334db179a10bdb7a38dddc32eff181c0317b9a7397bab6774953efe4208c5f091342c3c94db3da641b2131a23ef61d9bc6e0e566d17adb589427281d9f0c456b51088f289a9fc146f02b2b9ce1d2265cffa8c95dc490361809f26201deb5a060a57838a1b35b4a31ee5b373ea3a1d62d9171cc7976d14f46f749560007fbd37ef3b09eda4a2492b3d6f2637661269db5368978f4f8ff967c7ab6dc0c4f1e5742fde8cf4d75eb4c9dad01588ecda54ca44daafc39b53b5de3fe5161b007bb6e4cf8f9b0004acd86335c897a398e85e4e9dba0f1c8befdc5be0b39a8cb5415acc34911ebfe04439f41d37fde97c0b6c17dfaf295b09b31ef2603af97a86a9557d4d8dcdae602e1a7a7940d7575847b8b092bba3b16139d247a20c11c6e71b4f48d1bde2b9ecfbf74cebd0f8798cea4a354f6821e8a364f4f82c481158111e220a36acc36719e4b5a2dfc326efcd2bf9803c532020013a45fd25f8cfa682c8b3e83ff881db060b11a5c88e6a84c041f2495d38c2acebad3ca9404bf692b1ba3280dd721dd6da13e9965b3db6b828f742be59d822a9b431310c4ae18f8757b441407a2208040129ccd3fdfdc0dd0c28e4d165dd340c7fb641aa641cf3d2d7d3b941cab5f8c1a207fbe57a2c44142b289bda1a118b798470d51f0afc45bdf5ce9198b329ecc58ba9123c4f646c8a2e00c00c90700493501e625062e7c56e2ad957a9a98c1f4b981bc89d35bd6e337341e8680f27925b0e9c2554358e1326859c5bc63a508286d98b6eb9764ef3359b85045714d810a485bcce8e944a9541a971f42c16624f7b84b39dec804fe0c65a4c2ed11a9f5a66fdce4a0d3608cd3915f72b0cb5076aba30bee1e97af3cbfea5aad4b70fe99fcb56a172964b077cbc9d8632837d8975677819438e6b63562a722383eeeeebd87afe87d972e8cdbf90a8fd5df7ced2daac43a055a00efd9b4d947a1a114b06c7d44d149b5d63242ddeb8663eef38f9575f42346960901790ee0cf5468258e77d802eb6fc6b5a1f8c5493e8507b05240f301bddac027e2123bbc05f99e4f15ab93c458510d9d7bd35217c0374ffdb1d74dbe214e84d307860b2388f939c84495faaaf5dfa08824bd86eaf3a36b7e7aa2796f7e6ff6b2ccd31bc0ed3dae970497d1e76b5e74f6d10dba886f65148f8338800e8bfb0ebc68224014d1599d3cb3fbd593e93a5fe2779ca777fbfb96c5ed83dca951848b34e1d601580dea7bdc858c8dbf4130693f59ccab319e4e3a664f2a38cc74dfe5e7733710996e7bb81fb9f6218cc7d017fd67cbb6738a43dca9bb242e26fa42aa9360fad8ccca27d8a5afef2dbe6999d7b98dea41e1648624a09dcd1ddef6eba53dbdda8ee20aaaf9c17fb96330c7eddb9bc86ba52a84f76240466ce57a4185d57a910c7b55bd696ba5337ddc3715cd9f6e40da87b6011a01416f95eca6612590ec7a88a415a50e4eacd1f29e49233cf4c6a345b3895f1c16e427d1af1a29b336434c66003873b0440d97313bc17ccf5fa57727b278aa06c9e136d0f08b788e226b3c99af9b946f2e1b8fcd6e81f5b1013c39bf05eeaa4cf336fea7b55750730ebbb85ad3dc95817b893f1234c56ca6c7e416143e5a1dca4e21e5aefa25752cc7cd2e8d266482e4c087e8597294985dc82990c851a8b9b03d1e43b1af6dc6a5981cfb74305a357854859f61930b0b9b160b20348c373e7bf2291c5a9338ac883187f64dd49b8eb0f6233a998287f51f4f55b588a4674633e1d159d631e5c500d491d02a13c762c3e550fdce1bcdf7d9b362558a160a2a9de658d2de42163c6fce8e48f5b4cf58a32fb1aeedd9bdef17fcc22f58742a789302dd4247e6c190ba45f63fb12683ddc742a45c00d49b8af069d73b11af3ebe7b61974e8a33f89c3df742b8b2e4b8724856de8dca9548dc852c9e3f8eb170d2e46de0f3dc8b8fd07a8509c244e3", 0x595, 0x20000080, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @remote, 0x3}, 0x1c) 1.447733659s ago: executing program 4 (id=2711): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b3", 0x14}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a", 0x6c}], 0x3}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0xff0f}, 0x0) 1.376623129s ago: executing program 4 (id=2712): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) chdir(&(0x7f0000000140)='./file0\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000200)={0x80000013}) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) 924.534254ms ago: executing program 3 (id=2713): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0xfffffff9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$bind(0x0, 0x0, 0x0, 0x185099, 0x0) r3 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) open(&(0x7f0000000100)='.\x00', 0x591002, 0x50f) socket$nl_netfilter(0x10, 0x3, 0xc) 600.623962ms ago: executing program 4 (id=2714): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x8, 0x40, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r2, 0x0) mbind(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x800000000000056, 0x3) r3 = syz_open_dev$media(&(0x7f0000000000), 0x8000009, 0x8800) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000000280)={0x0, 0x8, 0x0, &(0x7f0000001d40), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001680)) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000040)=0xffffffffffffffff) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) r5 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000001c0)={0x0, r5}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000000)={0x0, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xa, &(0x7f0000000080)={0x8, 0x20008b}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) 332.677635ms ago: executing program 1 (id=2715): chmod(&(0x7f0000000040)='.\x00', 0x35e) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) r1 = syz_open_dev$media(&(0x7f0000000000), 0x8000009, 0x8800) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, 0x0) r2 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card3/oss_mixer\x00', 0x0, 0x0) setuid(0xee01) utime(&(0x7f0000000200)='.\x00', 0x0) 2.959296ms ago: executing program 0 (id=2716): socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) socket$inet6(0xa, 0x1, 0xfffffff9) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000380)='cachefiles_read\x00', r0, 0x0, 0x10000000000000}, 0xfffffffffffffe73) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x4, &(0x7f00000002c0)={@local={0xac, 0x2, 0x44, 0xa}, @private=0x5000000}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r1, 0x0, 0x1011) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x10, 0x803, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0}, 0x68) brk(0x200000ffa000) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f00000000c0)={&(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x2000, 0x2}) syz_genetlink_get_family_id$ethtool(0x0, r4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, @dev, @dev={0xfe, 0x80, '\x00', 0x15}, 0x80, 0x0, 0x1, 0x1}}) syslog(0x4, &(0x7f0000000140)=""/179, 0xb3) connect$unix(0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 2 (id=2717): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) syz_io_uring_setup(0x200450a, &(0x7f0000000900)={0x0, 0x256c, 0x4000, 0x2, 0x1ec}, 0x0, &(0x7f0000000480)) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f00000003c0), 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r4, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff005597c8ef039a5be42200", 0x38}, 0x60) listen(r4, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) kernel console output (not intermixed with test programs): 12: collection stack underflow [ 795.503263][ T24] pantherlord 0003:0F30:0111.0012: item 0 0 0 12 parsing failed [ 795.518616][ T24] pantherlord 0003:0F30:0111.0012: parse failed [ 795.530099][ T24] pantherlord 0003:0F30:0111.0012: probe with driver pantherlord failed with error -22 [ 795.560823][ T5588] usb 1-1: Using ep0 maxpacket: 8 [ 795.576668][ T5588] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 795.592098][ T975] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 795.593424][ T5588] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 795.613642][ T5588] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 795.613650][ T975] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 795.614720][ T975] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 795.623776][ T5588] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 795.652070][ T5588] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 795.663753][ T975] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 795.665166][ T5588] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 795.682622][ T5588] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 795.709049][ T975] usb 2-1: SerialNumber: syz [ 796.125039][T14395] fuse: Unknown parameter 'grouÿÿÿÿÿÿÿÿ' [ 796.141008][ T30] audit: type=1400 audit(2000000066.360:900): avc: denied { unmount } for pid=5854 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 796.163839][ T5588] usb 1-1: usb_control_msg returned -32 [ 796.172424][T14394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 796.200390][ T5588] usbtmc 1-1:16.0: can't read capabilities [ 796.265066][ T5588] usb 3-1: USB disconnect, device number 81 [ 796.279549][ T975] usb 2-1: 0:2 : does not exist [ 796.282987][ T30] audit: type=1400 audit(2000000066.700:901): avc: denied { watch watch_reads } for pid=14399 comm="syz.4.2229" path="/450" dev="tmpfs" ino=2359 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 796.322899][ T975] usb 2-1: unit 5: unexpected type 0x0d [ 796.328252][ T9] usb 1-1: USB disconnect, device number 87 [ 796.356284][ T975] usb 2-1: USB disconnect, device number 74 [ 796.473979][T14402] lo speed is unknown, defaulting to 1000 [ 796.560327][ T5964] usb 5-1: new full-speed USB device number 78 using dummy_hcd [ 796.575639][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 796.575653][ T30] audit: type=1400 audit(2000000067.000:903): avc: denied { ioctl } for pid=14405 comm="syz.3.2231" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x7201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 796.613916][ T30] audit: type=1400 audit(2000000067.000:904): avc: denied { execute } for pid=14405 comm="syz.3.2231" path="/selinux/enforce" dev="selinuxfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 796.841191][ T5964] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 796.850374][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.858418][ T5964] usb 5-1: Product: syz [ 796.862708][ T5964] usb 5-1: Manufacturer: syz [ 796.867300][ T5964] usb 5-1: SerialNumber: syz [ 797.155375][T14414] sp0: Synchronizing with TNC [ 797.330726][ T30] audit: type=1400 audit(2000000067.660:905): avc: denied { create } for pid=14410 comm="syz.3.2232" name="#38" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 797.342073][ T5964] usb 5-1: config 0 descriptor?? [ 797.351980][ T30] audit: type=1400 audit(2000000067.660:906): avc: denied { link } for pid=14410 comm="syz.3.2232" name="#38" dev="tmpfs" ino=2395 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 797.401032][ T30] audit: type=1400 audit(2000000067.670:907): avc: denied { rename } for pid=14410 comm="syz.3.2232" name="#39" dev="tmpfs" ino=2395 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 797.539916][T14410] [U] è` [ 797.717251][ T5964] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 797.907566][ T30] audit: type=1400 audit(2000000068.330:908): avc: denied { bind } for pid=14425 comm="syz.1.2237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 798.450459][ T24] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 798.624974][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 798.654719][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 798.693784][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 798.747243][ T24] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 798.770031][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.800339][ T24] usb 3-1: Product: syz [ 798.812356][ T24] usb 3-1: Manufacturer: syz [ 798.827810][ T24] usb 3-1: SerialNumber: syz [ 798.871321][ T24] usb 3-1: config 0 descriptor?? [ 798.879128][ T24] iguanair 3-1:0.0: probe with driver iguanair failed with error -12 [ 798.943288][T14438] kvm: kvm [14434]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x200000000080 [ 799.030411][ T5588] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 799.124519][T14441] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2240'. [ 799.210480][T14431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 799.282031][T14431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 799.290562][ T5588] usb 1-1: Using ep0 maxpacket: 16 [ 799.358324][ T5588] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 799.382982][T14431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 799.398549][T14431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 799.406326][T14442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 799.415013][T14442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 799.424000][ T43] usb 3-1: USB disconnect, device number 82 [ 799.427335][ T5588] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 799.441098][ T5588] usb 1-1: Product: syz [ 799.445806][ T5588] usb 1-1: Manufacturer: syz [ 799.451531][ T5588] usb 1-1: SerialNumber: syz [ 799.465498][ T5588] usb 1-1: config 0 descriptor?? [ 799.571885][ T30] audit: type=1400 audit(2000000070.000:909): avc: denied { mount } for pid=14443 comm="syz.3.2241" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 799.783546][ T5964] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 799.797459][ T5964] usb 5-1: USB disconnect, device number 78 [ 801.012756][ T30] audit: type=1400 audit(2000000070.840:910): avc: denied { name_bind } for pid=14447 comm="syz.1.2242" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 801.055777][T14460] sp0: Synchronizing with TNC [ 801.109234][T14455] [U] è` [ 801.389694][T14471] FAULT_INJECTION: forcing a failure. [ 801.389694][T14471] name failslab, interval 1, probability 0, space 0, times 0 [ 801.403852][ T30] audit: type=1400 audit(2000000071.810:911): avc: denied { execute } for pid=14470 comm="syz.4.2246" path="/451/file0/bus" dev="tmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 801.403881][T14471] CPU: 0 UID: 0 PID: 14471 Comm: syz.4.2246 Not tainted syzkaller #0 PREEMPT(full) [ 801.403899][T14471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 801.403908][T14471] Call Trace: [ 801.403914][T14471] [ 801.403920][T14471] dump_stack_lvl+0x16c/0x1f0 [ 801.403944][T14471] should_fail_ex+0x512/0x640 [ 801.403965][T14471] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 801.403984][T14471] should_failslab+0xc2/0x120 [ 801.404002][T14471] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 801.404018][T14471] ? security_file_alloc+0x34/0x2b0 [ 801.404044][T14471] security_file_alloc+0x34/0x2b0 [ 801.404072][T14471] init_file+0x93/0x4c0 [ 801.404093][T14471] alloc_empty_file+0x73/0x1e0 [ 801.404113][T14471] path_openat+0xda/0x2cb0 [ 801.404129][T14471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.404153][T14471] ? __pfx_path_openat+0x10/0x10 [ 801.404177][T14471] do_filp_open+0x20b/0x470 [ 801.404194][T14471] ? __pfx_do_filp_open+0x10/0x10 [ 801.404230][T14471] ? alloc_fd+0x471/0x7d0 [ 801.404253][T14471] do_sys_openat2+0x11b/0x1d0 [ 801.404273][T14471] ? __pfx_do_sys_openat2+0x10/0x10 [ 801.404292][T14471] ? find_held_lock+0x2b/0x80 [ 801.404311][T14471] ? handle_mm_fault+0x2ab/0xd10 [ 801.404339][T14471] __x64_sys_openat+0x174/0x210 [ 801.404360][T14471] ? __pfx___x64_sys_openat+0x10/0x10 [ 801.404381][T14471] ? do_user_addr_fault+0x843/0x1370 [ 801.404404][T14471] do_syscall_64+0xcd/0x4e0 [ 801.404426][T14471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.404440][T14471] RIP: 0033:0x7f0572f8d710 [ 801.404453][T14471] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44 [ 801.404466][T14471] RSP: 002b:00007f0573e20ef0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 801.404481][T14471] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f0572f8d710 [ 801.404491][T14471] RDX: 0000000000000002 RSI: 00007f0573011c6c RDI: 00000000ffffff9c [ 801.404500][T14471] RBP: 00007f0573011c6c R08: 0000000000000000 R09: 0000000000000000 [ 801.404508][T14471] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 801.404517][T14471] R13: 0000000000000036 R14: 0000200000001180 R15: 00007ffc3a4c3cd8 [ 801.404538][T14471] [ 801.570312][ T9] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 801.655273][ T5964] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 801.687639][ T30] audit: type=1800 audit(2000000071.810:912): pid=14471 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2246" name="bus" dev="tmpfs" ino=2 res=0 errno=0 [ 801.820405][ T5964] usb 3-1: Using ep0 maxpacket: 8 [ 801.826862][ T5964] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 801.835119][ T5964] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 801.845194][ T5964] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 801.855101][ T5964] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 801.865066][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 801.876972][ T9] usb 2-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 801.900263][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.908318][ T5964] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 801.922443][ T5964] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 801.932212][ T9] usb 2-1: config 0 descriptor?? [ 801.941503][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 802.158369][ T5964] usb 3-1: usb_control_msg returned -32 [ 802.961738][ T5964] usbtmc 3-1:16.0: can't read capabilities [ 802.995752][T14469] fuse: Unknown parameter 'group_iÿÿÿÿÿÿÿÿ' [ 803.304366][T14468] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 803.544953][T14480] lo speed is unknown, defaulting to 1000 [ 803.581243][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 803.587248][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 803.980359][ T5964] usb 3-1: USB disconnect, device number 83 [ 804.164457][ T9] usb 2-1: USB disconnect, device number 75 [ 804.329022][T14493] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 804.337606][T14493] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 804.346178][T14493] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 804.582488][ T5588] speedtch 1-1:0.0: speedtch_bind: data interface not found! [ 804.649533][ T5588] speedtch 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 804.896913][T14501] fuse: Bad value for 'fd' [ 805.436732][ T43] usb 1-1: USB disconnect, device number 88 [ 806.801004][ T43] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 807.250331][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 807.261499][ T43] usb 1-1: config 0 has an invalid interface number: 174 but max is 0 [ 807.276067][ T43] usb 1-1: config 0 has no interface number 0 [ 807.287686][ T43] usb 1-1: config 0 interface 174 has no altsetting 0 [ 807.298227][ T43] usb 1-1: New USB device found, idVendor=06cd, idProduct=010c, bcdDevice=77.76 [ 807.311716][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.319894][ T43] usb 1-1: Product: syz [ 807.325300][ T43] usb 1-1: Manufacturer: syz [ 807.329946][ T43] usb 1-1: SerialNumber: syz [ 807.369156][ T43] usb 1-1: config 0 descriptor?? [ 807.525951][ T30] audit: type=1400 audit(2000000077.850:913): avc: denied { bind } for pid=14503 comm="syz.1.2254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 807.567511][ T43] keyspan 1-1:0.174: Keyspan 1 port adapter converter detected [ 807.606555][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 84 [ 807.635584][ T30] audit: type=1400 audit(2000000077.850:914): avc: denied { listen } for pid=14503 comm="syz.1.2254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 807.663634][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 81 [ 807.680329][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 82 [ 807.691995][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 1 [ 807.726319][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 2 [ 807.763592][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 83 [ 807.779542][ T43] keyspan 1-1:0.174: found no endpoint descriptor for endpoint 3 [ 807.817983][ T43] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 807.860435][ T43] usb 1-1: USB disconnect, device number 89 [ 807.894951][ T43] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 807.939258][ T43] keyspan 1-1:0.174: device disconnected [ 808.786221][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.794506][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.127898][T14540] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2265'. [ 809.440099][ T30] audit: type=1400 audit(2000000079.860:915): avc: denied { setopt } for pid=14539 comm="syz.2.2265" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 809.807016][T14549] netlink: 'syz.3.2268': attribute type 2 has an invalid length. [ 809.885497][T14550] fuse: Bad value for 'fd' [ 809.910721][ T24] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 810.243306][T14549] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=14549 comm=syz.3.2268 [ 810.420338][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 810.427790][ T24] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 810.451586][ T24] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 810.478119][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 810.562901][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 810.572904][ T24] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 810.585902][ T24] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 810.598832][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.618817][ T30] audit: type=1400 audit(2000000081.040:916): avc: denied { append } for pid=14560 comm="syz.0.2273" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 810.782502][ T9] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 810.816206][T14568] overlayfs: missing 'lowerdir' [ 810.824322][T14544] fuse: Unknown parameter 'group_iÿÿÿÿÿÿÿÿ' [ 810.834347][T14543] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 810.848576][ T24] usb 5-1: usb_control_msg returned -32 [ 810.902274][ T24] usbtmc 5-1:16.0: can't read capabilities [ 811.010063][ T24] usb 5-1: USB disconnect, device number 79 [ 811.030391][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 811.037159][ T9] usb 4-1: config 0 has an invalid interface number: 118 but max is 0 [ 811.047568][ T9] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 811.092183][ T9] usb 4-1: config 0 has no interface number 0 [ 811.112113][ T9] usb 4-1: config 0 interface 118 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 811.145781][ T9] usb 4-1: New USB device found, idVendor=0711, idProduct=0179, bcdDevice=d8.42 [ 811.159337][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.227235][ T9] usb 4-1: Product: syz [ 811.248135][ T9] usb 4-1: Manufacturer: syz [ 811.261849][ T9] usb 4-1: SerialNumber: syz [ 811.278074][ T9] usb 4-1: config 0 descriptor?? [ 811.511009][T14556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.620605][ T5964] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 811.620700][T14556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.855399][ T9] usb 4-1: USB disconnect, device number 91 [ 811.890717][ T5964] usb 2-1: Using ep0 maxpacket: 8 [ 811.897677][ T5964] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 811.909985][T14583] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2277'. [ 811.919366][ T5964] usb 2-1: config 0 has no interface number 0 [ 811.930122][ T5964] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 811.954644][ T5964] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.982911][ T5964] usb 2-1: Product: syz [ 812.004650][ T5964] usb 2-1: Manufacturer: syz [ 812.009531][ T5964] usb 2-1: SerialNumber: syz [ 812.016352][ T5964] usb 2-1: config 0 descriptor?? [ 812.027020][T14583] syzkaller0: entered promiscuous mode [ 812.032789][T14583] syzkaller0: entered allmulticast mode [ 812.578318][ T30] audit: type=1400 audit(2000000083.000:917): avc: denied { getopt } for pid=14589 comm="syz.3.2279" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 813.709109][T14601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 813.727021][T14601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 814.280928][ T5964] uvcvideo 2-1:0.31: probe with driver uvcvideo failed with error -22 [ 814.302000][ T5964] usb 2-1: USB disconnect, device number 76 [ 814.396378][T14607] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2282'. [ 815.060805][T14611] fuse: Bad value for 'fd' [ 815.796890][T14615] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 815.808421][T14615] netlink: 'syz.3.2284': attribute type 10 has an invalid length. [ 815.816317][T14615] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2284'. [ 817.220384][ T5964] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 817.291863][T14631] kvm: kvm [14629]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x200000000080 [ 817.403118][ T5964] usb 4-1: Using ep0 maxpacket: 8 [ 817.424340][ T5964] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 817.445430][ T5964] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 817.480375][ T5964] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 817.498742][ T5964] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 817.508746][ T5964] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 817.524226][ T5964] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 817.533323][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 817.841097][T14646] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14646 comm=syz.2.2292 [ 818.617701][T14628] fuse: Unknown parameter 'group_iÿÿÿÿÿÿÿÿ' [ 818.627023][T14624] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 818.716050][T14647] ubi: mtd0 is already attached to ubi31 [ 818.765921][ T5964] usb 4-1: usb_control_msg returned -32 [ 818.771540][ T5964] usbtmc 4-1:16.0: can't read capabilities [ 818.798768][ T24] usb 4-1: USB disconnect, device number 92 [ 819.760550][T14661] fuse: Invalid rootmode [ 820.882466][ T30] audit: type=1400 audit(2000000090.900:918): avc: denied { write } for pid=14662 comm="syz.2.2296" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 821.028865][T14666] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 822.104545][T14677] trusted_key: encrypted_key: keylen parameter is missing [ 822.574384][T14677] trusted_key: encrypted_key: insufficient parameters specified [ 822.941808][ T30] audit: type=1400 audit(2000000093.370:919): avc: denied { create } for pid=14683 comm="syz.4.2303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 822.967714][ T30] audit: type=1400 audit(2000000093.390:920): avc: denied { getopt } for pid=14683 comm="syz.4.2303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 822.994637][ T5588] usb 3-1: new low-speed USB device number 84 using dummy_hcd [ 823.002862][T14684] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2303'. [ 823.269635][ T5588] usb 3-1: Invalid ep0 maxpacket: 16 [ 823.663187][T14692] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2304'. [ 824.170305][ T5588] usb 3-1: new low-speed USB device number 85 using dummy_hcd [ 824.242414][ T30] audit: type=1326 audit(2000000094.670:921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14693 comm="syz.4.2305" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0572f8eec9 code=0x0 [ 824.403650][T14701] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=4243739199 (8487478398 ns) > initial count (2409167910 ns). Using initial count to start timer. [ 824.430519][ T5588] usb 3-1: Invalid ep0 maxpacket: 16 [ 824.436015][ T5588] usb usb3-port1: attempt power cycle [ 824.542218][T14704] fuse: Invalid rootmode [ 824.830382][ T5588] usb 3-1: new low-speed USB device number 86 using dummy_hcd [ 824.961716][ T5588] usb 3-1: Invalid ep0 maxpacket: 16 [ 825.183948][ T5588] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 825.394614][ T5588] usb 3-1: Invalid ep0 maxpacket: 16 [ 825.400137][ T5588] usb usb3-port1: unable to enumerate USB device [ 825.530385][ T30] audit: type=1400 audit(2000000095.950:922): avc: denied { ioctl } for pid=14708 comm="syz.1.2310" path="socket:[50303]" dev="sockfs" ino=50303 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 826.140529][ T10] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 827.651738][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 827.666068][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 827.693088][ T10] usb 4-1: can't read configurations, error -71 [ 827.880324][ T24] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 828.018422][T14748] ubi: mtd0 is already attached to ubi31 [ 828.451517][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 828.502186][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 828.537579][ T24] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 828.546898][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 828.554952][ T24] usb 1-1: SerialNumber: syz [ 828.842770][ T24] usb 1-1: 0:2 : does not exist [ 828.847732][ T24] usb 1-1: unit 5: unexpected type 0x0e [ 828.857415][ T24] usb 1-1: USB disconnect, device number 90 [ 828.923810][T14753] fuse: Invalid rootmode [ 828.940924][ T5922] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 829.422653][ T5922] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 829.432848][ T5922] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 829.443237][ T5922] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 829.452379][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 829.460432][ T5922] usb 5-1: SerialNumber: syz [ 829.788106][ T5922] usb 5-1: 0:2 : does not exist [ 829.794753][ T5922] usb 5-1: unit 5: unexpected type 0x0e [ 829.812784][ T5922] usb 5-1: USB disconnect, device number 80 [ 830.290498][ T10] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 830.594462][T14763] bridge0: port 4(team0) entered blocking state [ 830.601399][T14763] bridge0: port 4(team0) entered disabled state [ 830.608307][T14763] team0: entered allmulticast mode [ 830.613493][T14763] team_slave_0: entered allmulticast mode [ 830.619268][T14763] team_slave_1: entered allmulticast mode [ 830.634706][T14763] team0: entered promiscuous mode [ 830.639768][T14763] team_slave_0: entered promiscuous mode [ 830.646389][T14763] team_slave_1: entered promiscuous mode [ 830.655016][T14763] bridge0: port 4(team0) entered blocking state [ 830.661366][T14763] bridge0: port 4(team0) entered forwarding state [ 830.980334][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 830.993598][ T10] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 831.012114][ T10] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 831.023442][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 831.879243][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 832.036196][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 832.126744][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 832.192029][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.950558][T14778] Bluetooth: hci5: Frame reassembly failed (-84) [ 832.970631][ T12] Bluetooth: hci5: Frame reassembly failed (-84) [ 832.978754][ T30] audit: type=1400 audit(2000000103.360:923): avc: denied { name_bind } for pid=14772 comm="syz.0.2325" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 833.000333][ C1] vkms_vblank_simulate: vblank timer overrun [ 833.030374][ T10] usb 4-1: usb_control_msg returned -71 [ 833.047958][ T10] usbtmc 4-1:16.0: can't read capabilities [ 833.068700][ T30] audit: type=1400 audit(2000000103.380:924): avc: denied { connect } for pid=14772 comm="syz.0.2325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 833.092650][ T30] audit: type=1400 audit(2000000103.390:925): avc: denied { map } for pid=14772 comm="syz.0.2325" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 833.115583][ C1] vkms_vblank_simulate: vblank timer overrun [ 833.126659][ T30] audit: type=1400 audit(2000000103.390:926): avc: denied { execute } for pid=14772 comm="syz.0.2325" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 833.149912][ C1] vkms_vblank_simulate: vblank timer overrun [ 833.321643][T14787] input: syz1 as /devices/virtual/input/input52 [ 833.766879][ T10] usb 4-1: USB disconnect, device number 95 [ 833.820453][ T5922] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 834.031369][ T5922] usb 3-1: Using ep0 maxpacket: 8 [ 834.052593][ T5922] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 834.211708][T14798] fuse: Bad value for 'rootmode' [ 834.985824][ T5922] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 834.996384][T14781] Bluetooth: hci5: command 0x1003 tx timeout [ 835.008804][ T5922] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 835.041022][ T5863] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 835.155123][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.166084][ T5922] usb 3-1: Product: syz [ 835.171958][ T5922] usb 3-1: Manufacturer: syz [ 835.176738][ T5922] usb 3-1: SerialNumber: syz [ 835.188724][ T5922] usb 3-1: config 0 descriptor?? [ 835.527117][T14805] ubi: mtd0 is already attached to ubi31 [ 836.160679][T14807] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2333'. [ 836.177453][T14807] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=14807 comm=syz.4.2333 [ 836.623369][ T5922] usb 3-1: USB disconnect, device number 88 [ 836.747992][ T30] audit: type=1400 audit(2000000107.170:927): avc: denied { read write } for pid=14812 comm="syz.4.2337" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 836.761981][T14815] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14815 comm=syz.3.2335 [ 836.855669][ T30] audit: type=1400 audit(2000000107.170:928): avc: denied { open } for pid=14812 comm="syz.4.2337" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 839.064473][ T5922] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 839.220307][ T5922] usb 1-1: Using ep0 maxpacket: 8 [ 839.226918][ T5922] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 839.715365][T14842] fuse: Bad value for 'rootmode' [ 839.920314][ T5922] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 839.930056][ T5922] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 839.943483][ T5922] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 839.953963][ T5922] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 839.971326][ T5922] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 840.084654][ T5922] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.140175][ T5922] usb 1-1: usb_control_msg returned -71 [ 841.151013][ T5922] usbtmc 1-1:16.0: can't read capabilities [ 841.192601][ T5922] usb 1-1: USB disconnect, device number 91 [ 841.243388][ T5588] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 841.613609][T14871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2350'. [ 841.622603][ T5588] usb 5-1: Using ep0 maxpacket: 32 [ 841.633637][ T5588] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 841.651135][ T5588] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.664486][ T5588] usb 5-1: config 0 descriptor?? [ 841.680576][ T5588] as10x_usb: device has been detected [ 841.690113][ T5588] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 841.818979][ T5588] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 841.849479][ T30] audit: type=1400 audit(2000000112.270:929): avc: denied { firmware_load } for pid=5588 comm="kworker/0:3" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 841.851699][ T5588] as10x_usb: error during firmware upload part1 [ 841.961841][T14878] sd 0:0:1:0: device reset [ 842.395204][ T5588] Registered device nBox DVB-T Dongle [ 842.449778][ T30] audit: type=1400 audit(2000000112.370:930): avc: denied { read } for pid=14874 comm="syz.2.2353" name="sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 844.246916][T14889] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2356'. [ 844.718774][ T5922] usb 5-1: USB disconnect, device number 81 [ 844.756216][T14881] [U] ç [ 844.956552][ T5922] Unregistered device nBox DVB-T Dongle [ 844.963487][ T5922] as10x_usb: device has been disconnected [ 845.053021][T14902] ubi: mtd0 is already attached to ubi31 [ 845.507346][ T30] audit: type=1400 audit(2000000115.930:931): avc: denied { write } for pid=14896 comm="syz.3.2358" path="socket:[50792]" dev="sockfs" ino=50792 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 845.772303][T14909] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14909 comm=syz.0.2359 [ 847.348715][ T5588] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 847.398694][T14929] FAULT_INJECTION: forcing a failure. [ 847.398694][T14929] name failslab, interval 1, probability 0, space 0, times 0 [ 847.420827][T14929] CPU: 1 UID: 0 PID: 14929 Comm: syz.1.2364 Not tainted syzkaller #0 PREEMPT(full) [ 847.420853][T14929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 847.420864][T14929] Call Trace: [ 847.420870][T14929] [ 847.420879][T14929] dump_stack_lvl+0x16c/0x1f0 [ 847.420906][T14929] should_fail_ex+0x512/0x640 [ 847.420929][T14929] ? fs_reclaim_acquire+0xae/0x150 [ 847.420954][T14929] ? tomoyo_encode2+0x100/0x3e0 [ 847.420979][T14929] should_failslab+0xc2/0x120 [ 847.421000][T14929] __kmalloc_noprof+0xd2/0x510 [ 847.421026][T14929] tomoyo_encode2+0x100/0x3e0 [ 847.421055][T14929] tomoyo_encode+0x29/0x50 [ 847.421080][T14929] tomoyo_realpath_from_path+0x18f/0x6e0 [ 847.421109][T14929] ? tomoyo_profile+0x47/0x60 [ 847.421129][T14929] tomoyo_path_number_perm+0x245/0x580 [ 847.421150][T14929] ? tomoyo_path_number_perm+0x237/0x580 [ 847.421174][T14929] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 847.421204][T14929] ? find_held_lock+0x2b/0x80 [ 847.421250][T14929] ? find_held_lock+0x2b/0x80 [ 847.421271][T14929] ? hook_file_ioctl_common+0x145/0x410 [ 847.421295][T14929] ? __fget_files+0x20e/0x3c0 [ 847.421320][T14929] security_file_ioctl+0x9b/0x240 [ 847.421347][T14929] __x64_sys_ioctl+0xb7/0x210 [ 847.421376][T14929] do_syscall_64+0xcd/0x4e0 [ 847.421402][T14929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.421419][T14929] RIP: 0033:0x7fdec738eec9 [ 847.421434][T14929] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 847.421450][T14929] RSP: 002b:00007fdec8254038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 847.421467][T14929] RAX: ffffffffffffffda RBX: 00007fdec75e5fa0 RCX: 00007fdec738eec9 [ 847.421478][T14929] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 847.421488][T14929] RBP: 00007fdec8254090 R08: 0000000000000000 R09: 0000000000000000 [ 847.421499][T14929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 847.421509][T14929] R13: 00007fdec75e6038 R14: 00007fdec75e5fa0 R15: 00007ffc51c79168 [ 847.421534][T14929] [ 847.421552][T14929] ERROR: Out of memory at tomoyo_realpath_from_path. [ 847.656598][ T5588] usb 1-1: Using ep0 maxpacket: 8 [ 847.676083][ T5588] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 847.697778][ T5588] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 847.728336][ T5588] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 847.748577][ T5588] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 847.767503][ T5588] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 847.813005][ T5588] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 847.839967][ T5588] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.117353][ T5588] usb 1-1: usb_control_msg returned -32 [ 848.144574][T14922] fuse: Bad value for 'user_id' [ 848.158797][T14922] fuse: Bad value for 'user_id' [ 848.187421][T14921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 848.207819][ T5588] usbtmc 1-1:16.0: can't read capabilities [ 848.264442][ T5588] usb 1-1: USB disconnect, device number 92 [ 849.989927][T14959] netlink: 188 bytes leftover after parsing attributes in process `syz.4.2372'. [ 850.122749][T14954] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2370'. [ 850.162567][ T5588] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 851.001847][ T5588] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 851.022901][ T5588] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 851.037429][ T5588] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 851.048737][ T5588] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 851.071940][ T5588] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 851.083295][ T5588] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 851.094857][ T5588] usb 1-1: Manufacturer: syz [ 851.105389][ T5588] usb 1-1: config 0 descriptor?? [ 851.178014][ T5922] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 851.217917][ T30] audit: type=1400 audit(2000000121.640:932): avc: denied { bind } for pid=14973 comm="syz.4.2376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 851.310790][ T10] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 851.323978][ T9] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 851.343480][ T5922] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 851.351623][ T5922] usb 2-1: config 0 has no interface number 0 [ 851.357728][ T5922] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 851.368746][ T5922] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 851.378886][ T5922] usb 2-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 851.387934][ T5922] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.397637][ T5922] usb 2-1: config 0 descriptor?? [ 851.460409][ T10] usb 4-1: device descriptor read/64, error -71 [ 851.480316][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 851.486664][ T9] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 851.494944][ T9] usb 3-1: config 0 has no interface number 0 [ 851.501443][ T9] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 851.512441][ T9] usb 3-1: config 0 interface 85 has no altsetting 0 [ 851.523526][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 851.532722][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.542820][ T5588] appleir 0003:05AC:8243.0013: unknown main item tag 0x0 [ 851.550496][ T9] usb 3-1: Product: syz [ 851.554659][ T9] usb 3-1: Manufacturer: syz [ 851.559226][ T9] usb 3-1: SerialNumber: syz [ 851.568522][ T5588] appleir 0003:05AC:8243.0013: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 851.581443][ T9] usb 3-1: config 0 descriptor?? [ 851.723024][ T10] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 851.808726][ T5922] usbhid 2-1:0.1: can't add hid device: -71 [ 851.815051][ T5922] usbhid 2-1:0.1: probe with driver usbhid failed with error -71 [ 851.824722][ T5922] usb 2-1: USB disconnect, device number 77 [ 851.870535][ T10] usb 4-1: device descriptor read/64, error -71 [ 851.888376][T14978] ip6erspan0: entered allmulticast mode [ 851.992356][ T10] usb usb4-port1: attempt power cycle [ 852.126354][ T5922] usb 1-1: USB disconnect, device number 93 [ 852.299472][ T9] appletouch 3-1:0.85: Geyser mode initialized. [ 852.419664][ T9] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input53 [ 852.465122][ T9] usb 3-1: USB disconnect, device number 89 [ 852.504063][ T9] appletouch 3-1:0.85: input: appletouch disconnected [ 852.754649][T14991] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2382'. [ 853.126778][T14993] netlink: 188 bytes leftover after parsing attributes in process `syz.0.2383'. [ 853.160399][ T5588] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 853.168057][ T5964] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 853.520430][ T5964] usb 2-1: device descriptor read/64, error -71 [ 853.583128][ T5588] usb 5-1: config index 0 descriptor too short (expected 164, got 36) [ 853.644198][ T5588] usb 5-1: config 0 has an invalid interface number: 49 but max is 0 [ 853.667629][ T5588] usb 5-1: config 0 has no interface number 0 [ 853.673978][ T5588] usb 5-1: config 0 interface 49 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 853.684746][ T5588] usb 5-1: New USB device found, idVendor=0004, idProduct=0284, bcdDevice=2d.ad [ 853.693816][ T5588] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 853.802207][ T5588] usb 5-1: config 0 descriptor?? [ 853.818082][T14983] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 854.330304][ T5964] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 854.410605][ T10] usb 3-1: new full-speed USB device number 90 using dummy_hcd [ 854.423359][ T30] audit: type=1400 audit(2000000124.850:933): avc: denied { connect } for pid=14982 comm="syz.4.2379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 854.443193][ C1] vkms_vblank_simulate: vblank timer overrun [ 854.470340][ T5964] usb 2-1: device descriptor read/64, error -71 [ 854.581197][ T5964] usb usb2-port1: attempt power cycle [ 854.594360][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 854.607620][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 61, changing to 4 [ 854.619186][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid maxpacket 28271, setting to 1023 [ 854.636650][ T10] usb 3-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 854.646355][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.808946][ T10] usb 3-1: Product: syz [ 854.928558][ T30] audit: type=1326 audit(2000000125.350:934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15012 comm="syz.3.2389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c1bf8eec9 code=0x7ffc0000 [ 854.960093][ T10] usb 3-1: Manufacturer: syz [ 854.967669][ T10] usb 3-1: SerialNumber: syz [ 854.973603][ T30] audit: type=1326 audit(2000000125.350:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15012 comm="syz.3.2389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c1bf8eec9 code=0x7ffc0000 [ 854.974329][ T10] usb 3-1: config 0 descriptor?? [ 854.996960][ C1] vkms_vblank_simulate: vblank timer overrun [ 855.018305][ T30] audit: type=1400 audit(2000000125.440:936): avc: denied { read write } for pid=15017 comm="syz.0.2390" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 855.042567][ T10] usb 3-1: no audio or video endpoints found [ 855.042833][ C1] vkms_vblank_simulate: vblank timer overrun [ 855.059058][ T30] audit: type=1400 audit(2000000125.440:937): avc: denied { open } for pid=15017 comm="syz.0.2390" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 855.070509][ T5964] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 855.124483][ T30] audit: type=1400 audit(2000000125.530:938): avc: denied { execute_no_trans } for pid=15017 comm="syz.0.2390" path="/457/file0" dev="tmpfs" ino=2436 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 855.147930][ C1] vkms_vblank_simulate: vblank timer overrun [ 855.156128][ T5964] usb 2-1: device descriptor read/8, error -71 [ 855.304580][ T10] usb 3-1: USB disconnect, device number 90 [ 855.400648][ T5964] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 855.442205][ T5964] usb 2-1: device descriptor read/8, error -71 [ 855.519830][ T43] usb 5-1: USB disconnect, device number 82 [ 855.559709][ T5964] usb usb2-port1: unable to enumerate USB device [ 855.738467][ T30] audit: type=1400 audit(2000000126.162:939): avc: denied { getopt } for pid=15026 comm="syz.1.2393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 855.758384][ C1] vkms_vblank_simulate: vblank timer overrun [ 855.907550][T15031] netlink: 188 bytes leftover after parsing attributes in process `syz.0.2395'. [ 856.172063][T15040] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2396'. [ 856.520786][ T43] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 856.570395][ T5922] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 856.650708][ T975] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 856.671846][ T43] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 856.681324][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.691283][ T43] usb 5-1: config 0 descriptor?? [ 856.698906][ T43] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 856.721769][ T5922] usb 2-1: Using ep0 maxpacket: 32 [ 856.737661][ T5922] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 856.749042][ T5922] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 856.752028][T15044] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2399'. [ 856.772528][ T5922] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 856.784111][ T5922] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 856.794328][ T5922] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 856.864346][ T975] usb 1-1: Using ep0 maxpacket: 8 [ 856.876085][ T975] usb 1-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 856.895458][ T975] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 856.917015][ T5922] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 856.926644][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.934703][ T975] usb 1-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 856.944130][ T5922] usb 2-1: Product: syz [ 856.948344][ T5922] usb 2-1: Manufacturer: syz [ 856.953265][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.961667][ T5922] usb 2-1: SerialNumber: syz [ 857.075998][ T975] usb 1-1: config 0 descriptor?? [ 857.082222][ T5922] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 857.092238][ T5922] imon 2-1:155.0: unable to initialize intf0, err -90 [ 857.109885][ T975] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 857.117972][ T5922] imon:imon_probe: failed to initialize context! [ 857.134896][ T5922] imon 2-1:155.0: unable to register, err -19 [ 857.275106][T15032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 857.283819][T15032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 857.343282][ T43] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 857.358820][ T43] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 857.649770][ T43] usb 5-1: USB disconnect, device number 83 [ 858.135569][T15061] binder: 15060:15061 ioctl c0306201 200000000500 returned -14 [ 859.462722][ T5964] usb 1-1: USB disconnect, device number 94 [ 859.483415][ T10] usb 2-1: USB disconnect, device number 82 [ 859.520122][ T30] audit: type=1400 audit(2000000129.942:940): avc: denied { mount } for pid=15076 comm="syz.3.2408" name="/" dev="ramfs" ino=51416 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 859.542379][ C1] vkms_vblank_simulate: vblank timer overrun [ 859.570824][T15078] binder: 15074:15078 ioctl c0306201 200000000640 returned -22 [ 859.756361][T15082] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15082 comm=syz.4.2410 [ 860.695210][T15089] sp0: Synchronizing with TNC [ 861.036183][T15084] [U] è` [ 861.273833][T15100] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2412'. [ 861.625693][ T30] audit: type=1400 audit(2000000132.052:941): avc: denied { create } for pid=15107 comm="syz.0.2418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 861.945238][ T30] audit: type=1400 audit(2000000132.362:942): avc: denied { read } for pid=15107 comm="syz.0.2418" name="file0" dev="fuse" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 861.990436][ T5964] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 862.147032][ T30] audit: type=1400 audit(2000000132.362:943): avc: denied { open } for pid=15107 comm="syz.0.2418" path="/462/file0/file0" dev="fuse" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 862.173307][ T30] audit: type=1400 audit(2000000132.602:944): avc: denied { ioctl } for pid=15107 comm="syz.0.2418" path="/462/file0/file0" dev="fuse" ino=2 ioctlcmd=0x92b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 862.197626][ C1] vkms_vblank_simulate: vblank timer overrun [ 862.240556][ T5964] usb 4-1: device descriptor read/64, error -71 [ 862.273414][T15108] md2: using deprecated bitmap file support [ 862.281585][T15108] md2: error: bitmap file must be a regular file [ 862.530399][ T5964] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 862.670331][ T5964] usb 4-1: device descriptor read/64, error -71 [ 862.922187][ T5964] usb usb4-port1: attempt power cycle [ 862.938697][ T30] audit: type=1400 audit(2000000133.302:945): avc: denied { create } for pid=15118 comm="syz.1.2420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 862.959745][ C1] vkms_vblank_simulate: vblank timer overrun [ 863.080700][ T30] audit: type=1400 audit(2000000133.312:946): avc: denied { write } for pid=15118 comm="syz.1.2420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 863.420444][ T5964] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 863.683044][ T5964] usb 4-1: device descriptor read/8, error -71 [ 863.691908][ T30] audit: type=1400 audit(2000000134.102:947): avc: denied { write } for pid=15126 comm="syz.4.2423" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 863.773841][T15129] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15129 comm=syz.1.2422 [ 864.196289][T15131] FAULT_INJECTION: forcing a failure. [ 864.196289][T15131] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 864.209444][T15131] CPU: 0 UID: 0 PID: 15131 Comm: syz.0.2421 Not tainted syzkaller #0 PREEMPT(full) [ 864.209460][T15131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 864.209466][T15131] Call Trace: [ 864.209470][T15131] [ 864.209474][T15131] dump_stack_lvl+0x16c/0x1f0 [ 864.209493][T15131] should_fail_ex+0x512/0x640 [ 864.209509][T15131] _copy_from_user+0x2e/0xd0 [ 864.209525][T15131] usbdev_ioctl+0x14cb/0x4070 [ 864.209539][T15131] ? __pfx_usbdev_ioctl+0x10/0x10 [ 864.209554][T15131] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 864.209568][T15131] ? do_vfs_ioctl+0x128/0x14f0 [ 864.209586][T15131] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 864.209608][T15131] ? hook_file_ioctl_common+0x145/0x410 [ 864.209623][T15131] ? selinux_file_ioctl+0x180/0x270 [ 864.209637][T15131] ? selinux_file_ioctl+0xb4/0x270 [ 864.209653][T15131] ? __pfx_usbdev_ioctl+0x10/0x10 [ 864.209665][T15131] __x64_sys_ioctl+0x18e/0x210 [ 864.209682][T15131] do_syscall_64+0xcd/0x4e0 [ 864.209698][T15131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.209708][T15131] RIP: 0033:0x7f5b1e38eec9 [ 864.209717][T15131] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 864.209728][T15131] RSP: 002b:00007f5b1f1a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 864.209738][T15131] RAX: ffffffffffffffda RBX: 00007f5b1e5e5fa0 RCX: 00007f5b1e38eec9 [ 864.209745][T15131] RDX: 0000200000000040 RSI: 00000000c0105500 RDI: 0000000000000003 [ 864.209751][T15131] RBP: 00007f5b1f1a7090 R08: 0000000000000000 R09: 0000000000000000 [ 864.209757][T15131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.209763][T15131] R13: 00007f5b1e5e6038 R14: 00007f5b1e5e5fa0 R15: 00007fff7300f6d8 [ 864.209777][T15131] [ 864.392698][ T5964] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 864.420971][ T5964] usb 4-1: device descriptor read/8, error -71 [ 864.537248][ T5964] usb usb4-port1: unable to enumerate USB device [ 864.949714][T15148] ubi: mtd0 is already attached to ubi31 [ 864.982050][ T43] usb 1-1: new low-speed USB device number 95 using dummy_hcd [ 865.142471][ T43] usb 1-1: device descriptor read/64, error -71 [ 865.651065][ T43] usb 1-1: new low-speed USB device number 96 using dummy_hcd [ 865.780382][ T43] usb 1-1: device descriptor read/64, error -71 [ 865.890895][ T43] usb usb1-port1: attempt power cycle [ 866.447970][ T43] usb 1-1: new low-speed USB device number 97 using dummy_hcd [ 866.503043][ T43] usb 1-1: device descriptor read/8, error -71 [ 866.740501][ T43] usb 1-1: new low-speed USB device number 98 using dummy_hcd [ 867.828011][ T43] usb 1-1: device descriptor read/8, error -71 [ 867.986624][ T43] usb usb1-port1: unable to enumerate USB device [ 868.018736][T15172] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2433'. [ 868.099740][T15174] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15174 comm=syz.2.2436 [ 869.308115][T15189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2439'. [ 869.329317][T15189] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15189 comm=syz.1.2439 [ 869.637269][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.643747][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.122598][T15190] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2440'. [ 870.243821][T15201] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2443'. [ 871.236709][T15210] pimreg: entered allmulticast mode [ 871.267086][T15212] pimreg: left allmulticast mode [ 871.774270][ T30] audit: type=1400 audit(2000000142.202:948): avc: denied { read } for pid=15213 comm="syz.3.2446" path="socket:[51619]" dev="sockfs" ino=51619 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 872.087263][T15220] ubi: mtd0 is already attached to ubi31 [ 872.915018][T15227] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15227 comm=syz.3.2448 [ 873.911691][T15231] sp0: Synchronizing with TNC [ 874.038665][T15224] [U] è` [ 874.703227][T15244] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2452'. [ 874.724450][T15244] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15244 comm=syz.1.2452 [ 875.825311][T15249] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2453'. [ 876.234932][T15262] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 876.243285][T15262] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 876.251935][T15262] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 876.782490][ T30] audit: type=1400 audit(2000000147.212:949): avc: denied { read } for pid=15261 comm="syz.4.2457" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 876.790500][T15270] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2457'. [ 877.203715][ T9] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 877.211317][ T5964] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 877.362044][ T9] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 877.373648][ T5964] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 877.387324][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 877.406386][ T5964] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 877.417285][ T9] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 877.430357][ T5964] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 877.443482][ T9] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 877.466144][ T5964] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 877.478517][ T9] usb 1-1: Manufacturer: syz [ 877.502515][ T9] usb 1-1: config 0 descriptor?? [ 877.508878][ T5964] usb 3-1: Manufacturer: syz [ 877.533442][ T5964] usb 3-1: config 0 descriptor?? [ 877.640282][ T9] rc_core: IR keymap rc-hauppauge not found [ 877.657111][ T9] Registered IR keymap rc-empty [ 877.673512][ T5964] rc_core: IR keymap rc-hauppauge not found [ 877.683577][ T9] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 877.709264][ T5964] Registered IR keymap rc-empty [ 877.721007][ T5964] rc rc1: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc1 [ 877.731950][ T9] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input54 [ 877.743364][ T5964] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc1/input55 [ 877.757683][ C0] igorplugusb 1-1:0.0: Error: urb status = -32 [ 877.786672][ C0] igorplugusb 3-1:0.0: Error: urb status = -32 [ 877.803037][ T5964] usb 3-1: USB disconnect, device number 91 [ 877.812120][ T24] usb 1-1: USB disconnect, device number 99 [ 878.256225][ T5964] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 878.310876][ T43] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 878.441736][ T5964] usb 5-1: Using ep0 maxpacket: 32 [ 878.560337][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 878.671677][T15294] ubi: mtd0 is already attached to ubi31 [ 879.480591][T15296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2466'. [ 879.556529][ T43] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 879.564953][ T43] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 879.575045][ T43] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 879.694935][ T5964] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 879.706650][ T5964] usb 5-1: config 0 has no interface number 0 [ 879.712915][ T43] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 879.712941][ T43] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 879.712979][ T43] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 879.712999][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.753711][T15295] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15295 comm=syz.0.2466 [ 879.766635][ T5964] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 879.777824][ T5964] usb 5-1: config 0 interface 85 has no altsetting 0 [ 879.788301][ T5964] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 879.798417][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.806753][ T5964] usb 5-1: Product: syz [ 879.834755][ T5964] usb 5-1: Manufacturer: syz [ 879.847294][ T5964] usb 5-1: SerialNumber: syz [ 879.986945][ T43] usb 2-1: usb_control_msg returned -32 [ 880.070422][T15287] fuse: Bad value for 'fd' [ 880.077684][ T5964] usb 5-1: config 0 descriptor?? [ 880.085960][T15286] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 880.114045][ T43] usbtmc 2-1:16.0: can't read capabilities [ 880.139627][ T43] usb 2-1: USB disconnect, device number 83 [ 880.978859][T15314] netlink: 92 bytes leftover after parsing attributes in process `syz.0.2470'. [ 881.437828][ T5964] appletouch 5-1:0.85: Geyser mode initialized. [ 881.449727][ T5964] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input56 [ 881.532125][ T30] audit: type=1400 audit(2000000151.892:950): avc: denied { bind } for pid=15306 comm="syz.3.2469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 881.587495][ T30] audit: type=1400 audit(2000000151.892:951): avc: denied { connect } for pid=15306 comm="syz.3.2469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 881.669042][ T5964] usb 5-1: USB disconnect, device number 84 [ 881.718117][ T5964] appletouch 5-1:0.85: input: appletouch disconnected [ 881.751343][ T30] audit: type=1400 audit(2000000152.172:952): avc: denied { read write } for pid=15324 comm="syz.0.2474" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 881.785649][ T30] audit: type=1400 audit(2000000152.172:953): avc: denied { open } for pid=15324 comm="syz.0.2474" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 882.380286][T12795] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 882.494020][ T9] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 882.600540][T12795] usb 2-1: Using ep0 maxpacket: 8 [ 882.610622][T12795] usb 2-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 882.623108][T12795] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 882.636527][T12795] usb 2-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 882.653882][T12795] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.662033][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 882.669633][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 882.682448][T12795] usb 2-1: config 0 descriptor?? [ 882.690241][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 882.699590][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.709109][T12795] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 882.720848][ T9] usb 1-1: config 0 descriptor?? [ 882.728732][ T9] hub 1-1:0.0: bad descriptor, ignoring hub [ 882.735906][ T9] hub 1-1:0.0: probe with driver hub failed with error -5 [ 882.744796][ T9] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 883.059147][T15351] ubi: mtd0 is already attached to ubi31 [ 883.416010][ T975] usb 1-1: USB disconnect, device number 100 [ 883.597048][T15356] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2484'. [ 884.539598][ T30] audit: type=1400 audit(2000000154.962:954): avc: denied { lock } for pid=15366 comm="syz.3.2488" path="socket:[52787]" dev="sockfs" ino=52787 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 884.610324][ T975] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 884.664631][ T9] usb 2-1: USB disconnect, device number 84 [ 884.770705][ T975] usb 5-1: Using ep0 maxpacket: 32 [ 884.781578][ T975] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 884.800780][ T975] usb 5-1: config 0 has no interface number 0 [ 884.807244][ T30] audit: type=1400 audit(2000000155.232:955): avc: denied { connect } for pid=15374 comm="syz.1.2490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 884.820379][ T975] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 884.847583][ T975] usb 5-1: config 0 interface 85 has no altsetting 0 [ 884.869555][ T975] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 884.889902][ T975] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.898564][ T975] usb 5-1: Product: syz [ 884.904368][ T975] usb 5-1: Manufacturer: syz [ 884.909042][ T975] usb 5-1: SerialNumber: syz [ 884.915890][ T975] usb 5-1: config 0 descriptor?? [ 885.130530][T12795] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 885.280287][T12795] usb 4-1: Using ep0 maxpacket: 8 [ 885.286676][T12795] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 885.296677][T12795] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 885.307991][T12795] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 885.317908][T12795] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 885.327857][T12795] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 885.340936][T12795] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 885.350008][T12795] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.533361][ T975] appletouch 5-1:0.85: Geyser mode initialized. [ 885.542948][ T975] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input57 [ 885.554319][ T24] usb 1-1: new full-speed USB device number 101 using dummy_hcd [ 885.586231][T12795] usb 4-1: usb_control_msg returned -32 [ 885.591944][T12795] usbtmc 4-1:16.0: can't read capabilities [ 885.647265][T15378] fuse: Bad value for 'fd' [ 885.745441][T15388] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 885.753841][T15388] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 885.762364][T15388] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 886.107008][ T43] usb 5-1: USB disconnect, device number 85 [ 886.113829][ T24] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 886.160556][T15377] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 886.176613][ T43] appletouch 5-1:0.85: input: appletouch disconnected [ 886.183916][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 886.194203][T12795] usb 4-1: USB disconnect, device number 103 [ 886.217173][ T24] usb 1-1: New USB device found, idVendor=172f, idProduct=0032, bcdDevice= 0.00 [ 886.226620][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.392542][ T24] usb 1-1: config 0 descriptor?? [ 886.485496][T15395] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 886.493883][T15395] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 886.502404][T15395] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 886.941813][ T30] audit: type=1400 audit(2000000157.372:956): avc: denied { getopt } for pid=15399 comm="syz.4.2498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 886.967886][ T30] audit: type=1400 audit(2000000157.372:957): avc: denied { create } for pid=15399 comm="syz.4.2498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 887.167794][T15401] netlink: 'syz.4.2498': attribute type 10 has an invalid length. [ 887.185193][T15401] team0: Port device dummy0 added [ 887.191155][T15401] netlink: 'syz.4.2498': attribute type 10 has an invalid length. [ 887.372653][T15383] input: syz1 as /devices/virtual/input/input58 [ 887.379617][ T24] waltop 0003:172F:0032.0014: unknown main item tag 0x7 [ 887.401942][T15401] team0: Port device dummy0 removed [ 887.408814][T15401] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 887.422024][ T24] waltop 0003:172F:0032.0014: hidraw0: USB HID v0.00 Device [HID 172f:0032] on usb-dummy_hcd.0-1/input0 [ 887.456302][ T24] usb 1-1: USB disconnect, device number 101 [ 888.310338][T15417] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2501'. [ 888.428809][T15416] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15416 comm=syz.3.2501 [ 888.508733][T15413] evm: overlay not supported [ 888.790313][ T43] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 889.045374][ T43] usb 5-1: Using ep0 maxpacket: 8 [ 889.149762][ T43] usb 5-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 889.160516][ T43] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 889.180410][ T43] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 889.274577][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.298449][ T43] usb 5-1: config 0 descriptor?? [ 889.333391][ T43] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 889.678683][T15433] fuse: Bad value for 'group_id' [ 889.683762][T15433] fuse: Bad value for 'group_id' [ 890.100877][T15439] netlink: 188 bytes leftover after parsing attributes in process `syz.0.2509'. [ 891.245017][T12795] usb 5-1: USB disconnect, device number 86 [ 891.393254][T15451] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 894.253846][ T30] audit: type=1400 audit(2000000164.672:958): avc: denied { accept } for pid=15488 comm="syz.3.2521" lport=57606 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 895.024963][T15505] FAULT_INJECTION: forcing a failure. [ 895.024963][T15505] name failslab, interval 1, probability 0, space 0, times 0 [ 895.652735][T15505] CPU: 0 UID: 0 PID: 15505 Comm: syz.4.2527 Not tainted syzkaller #0 PREEMPT(full) [ 895.652763][T15505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 895.652773][T15505] Call Trace: [ 895.652780][T15505] [ 895.652788][T15505] dump_stack_lvl+0x16c/0x1f0 [ 895.652815][T15505] should_fail_ex+0x512/0x640 [ 895.652842][T15505] should_failslab+0xc2/0x120 [ 895.652862][T15505] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 895.652882][T15505] ? skb_clone+0x190/0x3f0 [ 895.652907][T15505] skb_clone+0x190/0x3f0 [ 895.652929][T15505] netlink_deliver_tap+0xabd/0xd30 [ 895.652958][T15505] netlink_unicast+0x64c/0x870 [ 895.652985][T15505] ? __pfx_netlink_unicast+0x10/0x10 [ 895.653018][T15505] netlink_sendmsg+0x8d1/0xdd0 [ 895.653046][T15505] ? __pfx_netlink_sendmsg+0x10/0x10 [ 895.653079][T15505] ____sys_sendmsg+0xa98/0xc70 [ 895.653111][T15505] ? copy_msghdr_from_user+0x10a/0x160 [ 895.653133][T15505] ? __pfx_____sys_sendmsg+0x10/0x10 [ 895.653174][T15505] ___sys_sendmsg+0x134/0x1d0 [ 895.653198][T15505] ? __pfx____sys_sendmsg+0x10/0x10 [ 895.653258][T15505] __sys_sendmsg+0x16d/0x220 [ 895.653281][T15505] ? __pfx___sys_sendmsg+0x10/0x10 [ 895.653324][T15505] do_syscall_64+0xcd/0x4e0 [ 895.653350][T15505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.653368][T15505] RIP: 0033:0x7f0572f8eec9 [ 895.653383][T15505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 895.653399][T15505] RSP: 002b:00007f0573e23038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 895.653417][T15505] RAX: ffffffffffffffda RBX: 00007f05731e5fa0 RCX: 00007f0572f8eec9 [ 895.653429][T15505] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 895.653439][T15505] RBP: 00007f0573e23090 R08: 0000000000000000 R09: 0000000000000000 [ 895.653450][T15505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 895.653461][T15505] R13: 00007f05731e6038 R14: 00007f05731e5fa0 R15: 00007ffc3a4c3cd8 [ 895.653485][T15505] [ 897.280006][T15524] fuse: Bad value for 'fd' [ 897.991616][T15527] FAULT_INJECTION: forcing a failure. [ 897.991616][T15527] name failslab, interval 1, probability 0, space 0, times 0 [ 898.077442][T15527] CPU: 0 UID: 0 PID: 15527 Comm: syz.2.2533 Not tainted syzkaller #0 PREEMPT(full) [ 898.077468][T15527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 898.077479][T15527] Call Trace: [ 898.077485][T15527] [ 898.077493][T15527] dump_stack_lvl+0x16c/0x1f0 [ 898.077522][T15527] should_fail_ex+0x512/0x640 [ 898.077544][T15527] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 898.077573][T15527] should_failslab+0xc2/0x120 [ 898.077594][T15527] __kmalloc_cache_noprof+0x6a/0x3e0 [ 898.077619][T15527] ? rcu_is_watching+0x12/0xc0 [ 898.077641][T15527] ? call_usermodehelper_setup+0xaf/0x360 [ 898.077665][T15527] ? __pfx_free_modprobe_argv+0x10/0x10 [ 898.077685][T15527] call_usermodehelper_setup+0xaf/0x360 [ 898.077711][T15527] __request_module+0x3bd/0x690 [ 898.077731][T15527] ? __pfx___request_module+0x10/0x10 [ 898.077760][T15527] ? cap_capable+0xb3/0x250 [ 898.077785][T15527] ? dev_load+0x1de/0x240 [ 898.077808][T15527] dev_load+0x1ff/0x240 [ 898.077826][T15527] dev_ioctl+0x4e4/0x10e0 [ 898.077848][T15527] sock_do_ioctl+0x19d/0x280 [ 898.077875][T15527] ? __pfx_sock_do_ioctl+0x10/0x10 [ 898.077907][T15527] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 898.077941][T15527] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 898.077973][T15527] sock_ioctl+0x227/0x6b0 [ 898.077990][T15527] ? __pfx_sock_ioctl+0x10/0x10 [ 898.078005][T15527] ? hook_file_ioctl_common+0x145/0x410 [ 898.078030][T15527] ? selinux_file_ioctl+0x180/0x270 [ 898.078054][T15527] ? selinux_file_ioctl+0xb4/0x270 [ 898.078080][T15527] ? __pfx_sock_ioctl+0x10/0x10 [ 898.078098][T15527] __x64_sys_ioctl+0x18e/0x210 [ 898.078126][T15527] do_syscall_64+0xcd/0x4e0 [ 898.078152][T15527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 898.078170][T15527] RIP: 0033:0x7f582a78eec9 [ 898.078184][T15527] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 898.078201][T15527] RSP: 002b:00007f582b56b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 898.078218][T15527] RAX: ffffffffffffffda RBX: 00007f582a9e5fa0 RCX: 00007f582a78eec9 [ 898.078230][T15527] RDX: 0000200000000100 RSI: 0000000000008933 RDI: 0000000000000003 [ 898.078241][T15527] RBP: 00007f582b56b090 R08: 0000000000000000 R09: 0000000000000000 [ 898.078252][T15527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 898.078262][T15527] R13: 00007f582a9e6038 R14: 00007f582a9e5fa0 R15: 00007ffe7594cae8 [ 898.078287][T15527] [ 899.119928][ T5964] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 899.220336][ T30] audit: type=1400 audit(2000000169.632:959): avc: denied { bind } for pid=15536 comm="syz.4.2535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 899.273174][ T5964] usb 3-1: Using ep0 maxpacket: 8 [ 899.280993][ T30] audit: type=1400 audit(2000000169.632:960): avc: denied { name_bind } for pid=15536 comm="syz.4.2535" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 899.302169][ T30] audit: type=1400 audit(2000000169.632:961): avc: denied { node_bind } for pid=15536 comm="syz.4.2535" saddr=172.20.20.170 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 899.325001][ T5964] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 899.334031][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.392197][ T5964] pvrusb2: Hardware description: Terratec Grabster AV400 [ 899.408952][ T5964] pvrusb2: ********** [ 899.419016][ T5964] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 899.490314][ T5964] pvrusb2: Important functionality might not be entirely working. [ 899.510474][ T30] audit: type=1400 audit(2000000169.932:962): avc: denied { mount } for pid=15520 comm="syz.1.2531" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 899.549394][ T5964] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 899.577522][ T5964] pvrusb2: ********** [ 899.612415][ T30] audit: type=1400 audit(2000000169.992:963): avc: denied { mounton } for pid=15520 comm="syz.1.2531" path="/515/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 899.659927][ T2334] pvrusb2: Invalid write control endpoint [ 899.673388][T15525] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2531'. [ 899.913828][T15540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 899.952456][ T2334] pvrusb2: Invalid write control endpoint [ 899.959446][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 899.972353][T15540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 900.006437][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 900.032321][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 900.062866][ T5964] usb 3-1: USB disconnect, device number 92 [ 900.093817][ T2334] pvrusb2: Device being rendered inoperable [ 900.126141][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 900.152554][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 900.176674][ T2334] pvrusb2: Attached sub-driver cx25840 [ 900.190668][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 900.279828][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 900.352250][ T30] audit: type=1400 audit(2000000170.782:964): avc: denied { write } for pid=15552 comm="syz.4.2539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 900.426667][ T30] audit: type=1400 audit(2000000170.852:965): avc: denied { unmount } for pid=5860 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 901.126234][T15569] overlayfs: failed to resolve './file1': -2 [ 901.139414][T15569] sp0: Synchronizing with TNC [ 901.273364][ T9] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 901.300591][T15567] [U] è` [ 901.332697][T15579] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2545'. [ 901.544472][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 901.570599][ T9] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 901.579777][ T9] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 901.646470][ T9] usb 4-1: config 0 has no interface number 0 [ 901.661228][ T9] usb 4-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 901.699070][ T9] usb 4-1: config 0 interface 133 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 901.718575][ T9] usb 4-1: config 0 interface 133 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 901.808657][ T9] usb 4-1: config 0 interface 133 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 901.820414][ T9] usb 4-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 901.845481][ T9] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 901.951314][T15587] fuse: Unknown parameter '00000000000000000000006' [ 902.398267][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.411173][ T9] usb 4-1: Product: syz [ 902.415409][ T9] usb 4-1: Manufacturer: syz [ 902.436179][ T9] usb 4-1: SerialNumber: syz [ 902.447322][ T9] usb 4-1: config 0 descriptor?? [ 902.460260][T15566] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 902.467460][T15566] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 902.900397][ T24] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 903.024565][ T9] usb 4-1: probing VID:PID(0424:012C) [ 903.031466][ T9] usb 4-1: vub300 testing BULK OUT EndPoint(0) 0B [ 903.037908][ T9] usb 4-1: vub300 testing UNKNOWN EndPoint(1) 8F [ 903.049480][ T9] usb 4-1: vub300 ignoring EndPoint(1) 8F [ 903.066213][ T9] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 903.162162][ T24] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 903.203747][ T9] vub300 4-1:0.133: probe with driver vub300 failed with error -22 [ 903.214470][ T9] usb 4-1: USB disconnect, device number 104 [ 903.244494][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.274679][ T24] usb 5-1: config 0 descriptor?? [ 903.526318][T15594] lo speed is unknown, defaulting to 1000 [ 903.739083][ T30] audit: type=1400 audit(2000000174.162:966): avc: denied { listen } for pid=15588 comm="syz.4.2549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 903.739361][ T24] appleir 0003:05AC:8241.0015: item fetching failed at offset 3/5 [ 903.770780][ T24] appleir 0003:05AC:8241.0015: parse failed [ 903.776755][ T24] appleir 0003:05AC:8241.0015: probe with driver appleir failed with error -22 [ 904.220822][ T24] usb 5-1: USB disconnect, device number 87 [ 904.660897][T15615] siw: device registration error -23 [ 904.840095][ T30] audit: type=1400 audit(2000000175.082:967): avc: denied { setopt } for pid=15607 comm="syz.3.2554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 905.043231][ T30] audit: type=1400 audit(2000000175.092:968): avc: denied { connect } for pid=15607 comm="syz.3.2554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 905.065444][ T30] audit: type=1400 audit(2000000175.102:969): avc: denied { listen } for pid=15607 comm="syz.3.2554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 905.137219][ T30] audit: type=1400 audit(2000000175.112:970): avc: denied { setattr } for pid=15607 comm="syz.3.2554" name="virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 905.359308][ T30] audit: type=1400 audit(2000000175.592:971): avc: denied { setopt } for pid=15618 comm="syz.4.2556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 905.824709][T15627] overlayfs: failed to resolve './file1': -2 [ 906.132423][T15625] sp0: Synchronizing with TNC [ 906.245341][T15620] [U] è` [ 906.646229][ T30] audit: type=1400 audit(2000000177.062:972): avc: denied { mount } for pid=15634 comm="syz.3.2561" name="/" dev="ocfs2_dlmfs" ino=53587 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 906.649639][T15639] o2cb: This node has not been configured. [ 906.673229][T15639] o2cb: Cluster check failed. Fix errors before retrying. [ 906.686112][T15639] (syz.3.2561,15639,0):user_dlm_register:674 ERROR: status = -22 [ 906.694004][T15639] (syz.3.2561,15639,0):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "bus" [ 906.715455][ T30] audit: type=1400 audit(2000000177.072:973): avc: denied { ioctl } for pid=15634 comm="syz.3.2561" path="socket:[53586]" dev="sockfs" ino=53586 ioctlcmd=0xf504 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 906.819913][ T30] audit: type=1400 audit(2000000177.072:974): avc: denied { add_name } for pid=15634 comm="syz.3.2561" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 906.881585][ T975] usb 1-1: new full-speed USB device number 102 using dummy_hcd [ 906.940609][ T30] audit: type=1400 audit(2000000177.072:975): avc: denied { create } for pid=15634 comm="syz.3.2561" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 907.026710][ T30] audit: type=1400 audit(2000000177.072:976): avc: denied { associate } for pid=15634 comm="syz.3.2561" name="bus" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 907.092118][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 907.103271][ T975] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 907.120443][ T975] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 907.140585][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.140663][ T5964] usb 4-1: new low-speed USB device number 105 using dummy_hcd [ 907.160919][ T975] usb 1-1: config 0 descriptor?? [ 907.929395][ T5964] usb 4-1: config 0 has an invalid interface number: 207 but max is 0 [ 907.940064][ T5964] usb 4-1: config 0 has no interface number 0 [ 907.947112][ T5964] usb 4-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=da.df [ 907.957474][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.968858][ T5964] usb 4-1: config 0 descriptor?? [ 907.979966][ T5964] usb 4-1: selecting invalid altsetting 3 [ 907.986934][ T5964] comedi comedi4: could not set alternate setting 3 in high speed [ 908.001343][ T5964] usbdux 4-1:0.207: driver 'usbdux' failed to auto-configure device. [ 908.013293][ T5964] usbdux 4-1:0.207: probe with driver usbdux failed with error -22 [ 908.171353][ T975] elan 0003:04F3:0755.0016: failed to start in urb: -90 [ 908.181946][ T975] elan 0003:04F3:0755.0016: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.0-1/input0 [ 908.222337][ T5588] usb 4-1: USB disconnect, device number 105 [ 908.243111][T15656] tipc: Enabled bearer , priority 0 [ 908.252490][T15656] syzkaller0: entered promiscuous mode [ 908.257959][T15656] syzkaller0: entered allmulticast mode [ 908.277477][T15654] tipc: Resetting bearer [ 908.283299][ T5964] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 908.315746][T15654] tipc: Disabling bearer [ 908.480328][ T5964] usb 5-1: Using ep0 maxpacket: 8 [ 908.612219][ T5964] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 908.622063][ T5964] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 908.634640][ T5964] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 908.644490][ T5964] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 908.654457][ T5964] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 908.667485][ T5964] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 908.676905][ T5964] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.739343][T15663] netlink: 'syz.2.2568': attribute type 12 has an invalid length. [ 908.889900][ T5964] usb 5-1: usb_control_msg returned -32 [ 908.895667][ T5964] usbtmc 5-1:16.0: can't read capabilities [ 908.909255][T15651] fuse: Invalid rootmode [ 908.916693][T15650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 908.968412][ T975] usb 5-1: USB disconnect, device number 88 [ 908.992905][ T5964] usb 1-1: USB disconnect, device number 102 [ 909.498239][T15674] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2570'. [ 909.511495][T15674] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15674 comm=syz.0.2570 [ 910.354015][T15680] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 910.418917][T15682] netlink: 'syz.3.2574': attribute type 21 has an invalid length. [ 910.428000][T15682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2574'. [ 910.578802][ T30] audit: type=1400 audit(2000000181.002:977): avc: denied { mounton } for pid=15686 comm="syz.4.2575" path="/syzcgroup/net/syz4/devices.allow" dev="cgroup" ino=220 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 910.755448][T15696] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2577'. [ 912.271881][ T30] audit: type=1400 audit(2000000182.272:978): avc: denied { getopt } for pid=15703 comm="syz.1.2579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 912.764672][T15714] : renamed from bridge_slave_0 (while UP) [ 914.287437][T15734] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2585'. [ 914.338960][ T30] audit: type=1400 audit(2000000184.712:979): avc: denied { watch watch_reads } for pid=15730 comm="syz.4.2585" path="/516/blkio.bfq.io_service_bytes_recursive" dev="tmpfs" ino=2714 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 914.365334][ C1] vkms_vblank_simulate: vblank timer overrun [ 914.492690][T15737] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2584'. [ 914.514363][T15737] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=12310 sclass=netlink_xfrm_socket pid=15737 comm=syz.3.2584 [ 914.890330][ T975] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 915.051194][ T975] usb 2-1: Using ep0 maxpacket: 8 [ 915.102410][ T975] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 915.151648][ T975] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 915.381875][ T975] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 915.405126][ T975] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 915.421587][ T975] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 915.439516][ T975] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 915.455359][ T975] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.513123][ T30] audit: type=1400 audit(2000000185.932:980): avc: denied { watch_mount } for pid=15746 comm="syz.0.2590" path="/493/file1" dev="tmpfs" ino=2626 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 915.722433][T15735] fuse: Bad value for 'rootmode' [ 915.727653][T15731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 915.747833][ T975] usb 2-1: usb_control_msg returned -32 [ 915.760742][ T975] usbtmc 2-1:16.0: can't read capabilities [ 915.828405][ T975] usb 2-1: USB disconnect, device number 85 [ 915.975445][ T30] audit: type=1400 audit(2000000186.402:981): avc: denied { ioctl } for pid=15748 comm="syz.2.2591" path="mnt:[4026532796]" dev="nsfs" ino=4026532796 ioctlcmd=0xb703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 916.044677][ T30] audit: type=1400 audit(2000000186.472:982): avc: denied { map } for pid=15748 comm="syz.2.2591" path="socket:[53746]" dev="sockfs" ino=53746 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 916.094007][ T30] audit: type=1400 audit(2000000186.492:983): avc: denied { read } for pid=15748 comm="syz.2.2591" path="socket:[53746]" dev="sockfs" ino=53746 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 916.840347][T12795] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 917.140880][T12795] usb 5-1: Using ep0 maxpacket: 32 [ 917.174411][T12795] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 917.185212][T12795] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 917.234866][T12795] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 917.261254][ T5964] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 917.269044][T12795] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 917.286231][T12795] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 917.310995][T12795] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 917.332502][T12795] usb 5-1: New USB device found, idVendor=04e7, idProduct=6651, bcdDevice=ba.8a [ 917.410371][ T5964] usb 1-1: device descriptor read/64, error -71 [ 917.428871][T12795] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.440331][T12795] usb 5-1: Product: syz [ 917.448986][T12795] usb 5-1: Manufacturer: syz [ 917.453631][T12795] usb 5-1: SerialNumber: syz [ 917.459479][T12795] usb 5-1: config 0 descriptor?? [ 917.465976][T12795] usb 5-1: bad CDC descriptors [ 917.483118][T12795] cdc_acm 5-1:0.0: Zero length descriptor references [ 917.489919][T12795] cdc_acm 5-1:0.0: probe with driver cdc_acm failed with error -22 [ 917.719349][ T5964] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 917.887320][ T30] audit: type=1400 audit(2000000188.312:984): avc: denied { read } for pid=15771 comm="syz.2.2596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 917.941468][ T5964] usb 1-1: device descriptor read/64, error -71 [ 918.064702][ T5964] usb usb1-port1: attempt power cycle [ 919.040346][ T5964] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 919.088792][ T5964] usb 1-1: device descriptor read/8, error -71 [ 919.350435][ T5964] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 919.435697][T12795] usb 5-1: USB disconnect, device number 89 [ 919.462265][ T5964] usb 1-1: device descriptor read/8, error -71 [ 919.485840][ T30] audit: type=1400 audit(2000000189.912:985): avc: denied { read } for pid=15800 comm="syz.4.2604" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 919.620304][ T5964] usb usb1-port1: unable to enumerate USB device [ 919.627853][ T30] audit: type=1400 audit(2000000189.942:986): avc: denied { open } for pid=15800 comm="syz.4.2604" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 920.725670][T15788] syz.3.2599 (15788): drop_caches: 2 [ 920.831484][T15812] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 920.842885][T15812] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 921.415437][T15822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 921.780644][T15822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 921.870537][T12795] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 922.001360][ T30] audit: type=1400 audit(2000000192.422:987): avc: denied { setopt } for pid=15827 comm="syz.0.2613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 922.231055][T15833] veth1_to_hsr: mtu less than device minimum [ 923.038380][T15837] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15837 comm=syz.3.2614 [ 923.390990][T15843] FAULT_INJECTION: forcing a failure. [ 923.390990][T15843] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 923.404132][T15843] CPU: 1 UID: 0 PID: 15843 Comm: syz.0.2616 Not tainted syzkaller #0 PREEMPT(full) [ 923.404155][T15843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 923.404166][T15843] Call Trace: [ 923.404173][T15843] [ 923.404181][T15843] dump_stack_lvl+0x16c/0x1f0 [ 923.404208][T15843] should_fail_ex+0x512/0x640 [ 923.404235][T15843] _copy_from_user+0x2e/0xd0 [ 923.404261][T15843] copy_msghdr_from_user+0x98/0x160 [ 923.404291][T15843] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 923.404317][T15843] ? __pfx__kstrtoull+0x10/0x10 [ 923.404341][T15843] ___sys_sendmsg+0xfe/0x1d0 [ 923.404364][T15843] ? __pfx____sys_sendmsg+0x10/0x10 [ 923.404396][T15843] ? find_held_lock+0x2b/0x80 [ 923.404438][T15843] __sys_sendmmsg+0x200/0x420 [ 923.404463][T15843] ? __pfx___sys_sendmmsg+0x10/0x10 [ 923.404505][T15843] ? fput+0x9b/0xd0 [ 923.404527][T15843] ? ksys_write+0x1ac/0x250 [ 923.404552][T15843] __x64_sys_sendmmsg+0x9c/0x100 [ 923.404573][T15843] ? lockdep_hardirqs_on+0x7c/0x110 [ 923.404595][T15843] do_syscall_64+0xcd/0x4e0 [ 923.404619][T15843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.404636][T15843] RIP: 0033:0x7f5b1e38eec9 [ 923.404651][T15843] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 923.404668][T15843] RSP: 002b:00007f5b1f165038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 923.404685][T15843] RAX: ffffffffffffffda RBX: 00007f5b1e5e6180 RCX: 00007f5b1e38eec9 [ 923.404696][T15843] RDX: 0000000000000001 RSI: 0000200000000c40 RDI: 0000000000000003 [ 923.404707][T15843] RBP: 00007f5b1f165090 R08: 0000000000000000 R09: 0000000000000000 [ 923.404717][T15843] R10: 0000000020004004 R11: 0000000000000246 R12: 0000000000000001 [ 923.404728][T15843] R13: 00007f5b1e5e6218 R14: 00007f5b1e5e6180 R15: 00007fff7300f6d8 [ 923.404752][T15843] [ 923.593298][ C1] vkms_vblank_simulate: vblank timer overrun [ 924.033276][ T24] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 924.170252][T12795] usb 3-1: device descriptor read/64, error -71 [ 924.261308][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 924.297566][ T24] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 924.323941][ T24] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 924.350000][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 924.363635][ T43] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 924.393297][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 924.425372][ T24] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 924.457306][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 924.500664][ T24] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 924.528079][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.550742][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 924.563502][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 924.587725][ T24] usb 2-1: config 0 descriptor?? [ 924.618061][ T43] usb 4-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 924.652881][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.702753][ T43] usb 4-1: config 0 descriptor?? [ 924.748790][ T43] dvb-usb: found a 'TeVii S662' in warm state. [ 924.771714][ T43] dw2102: su3000_power_ctrl: 1, initialized 0 [ 924.793777][ T43] dvb-usb: bulk message failed: -22 (2/0) [ 924.883425][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 924.913166][ T24] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 86 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 924.925217][T15850] dvb-usb: bulk message failed: -22 (5/0) [ 924.931262][T15850] dw2102: i2c transfer failed. [ 924.940264][T12795] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 924.941666][ T43] dvbdev: DVB: registering new adapter (TeVii S662) [ 924.955685][ T30] audit: type=1400 audit(2000000195.382:988): avc: denied { read } for pid=15846 comm="syz.3.2617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 924.985558][ T43] usb 4-1: media controller created [ 925.000035][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.022723][ T43] dw2102: i2c transfer failed. [ 925.035915][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.042945][ T43] dw2102: i2c transfer failed. [ 925.047733][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.056264][ T43] dw2102: i2c transfer failed. [ 925.061360][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.067185][ T43] dw2102: i2c transfer failed. [ 925.074334][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.081140][T12795] usb 3-1: device descriptor read/64, error -71 [ 925.190579][T12795] usb usb3-port1: attempt power cycle [ 925.229403][ T43] dw2102: i2c transfer failed. [ 925.234310][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 925.240100][ T43] dw2102: i2c transfer failed. [ 925.422608][T15865] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2623'. [ 925.457267][ T43] dvb-usb: MAC address: 02:02:02:02:02:02 [ 925.928862][T15865] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 926.023352][T12795] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 926.029198][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 926.058534][T12795] usb 3-1: device descriptor read/8, error -71 [ 926.059758][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 926.080689][ T43] dw2102: command 0x0e transfer failed. [ 926.088297][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 926.094635][ T43] dw2102: command 0x0e transfer failed. [ 926.310287][T12795] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 926.427777][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 926.483303][ T43] dw2102: command 0x0e transfer failed. [ 926.549424][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 926.615675][ T43] dw2102: command 0x0e transfer failed. [ 926.678334][ T43] dvb-usb: bulk message failed: -22 (1/0) [ 926.691732][ T43] dw2102: command 0x51 transfer failed. [ 926.703726][ T43] dvb-usb: bulk message failed: -22 (5/0) [ 926.720710][ T43] dw2102: i2c probe for address 0x68 failed. [ 926.744841][ T43] dvb-usb: bulk message failed: -22 (5/0) [ 926.757870][T12795] usb 3-1: device descriptor read/8, error -71 [ 926.926844][T12795] usb usb3-port1: unable to enumerate USB device [ 927.045779][ T24] usb 2-1: USB disconnect, device number 86 [ 927.657971][ T43] dw2102: i2c probe for address 0x69 failed. [ 927.664510][ T24] usblp0: removed [ 927.669561][ T43] dvb-usb: bulk message failed: -22 (5/0) [ 927.677215][ T43] dw2102: i2c probe for address 0x6a failed. [ 927.683419][ T43] dw2102: probing for demodulator failed. Is the external power switched on? [ 927.692194][ T43] dvb-usb: no frontend was attached by 'TeVii S662' [ 927.752512][T15880] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2627'. [ 928.030267][ T43] rc_core: IR keymap rc-tt-1500 not found [ 928.036018][ T43] Registered IR keymap rc-empty [ 928.071101][ T43] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 928.076488][ T30] audit: type=1400 audit(2000000198.492:989): avc: denied { append } for pid=15889 comm="syz.1.2629" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 928.091563][ T43] input: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input59 [ 928.132105][ T43] dvb-usb: schedule remote query interval to 250 msecs. [ 928.139055][ T43] dw2102: su3000_power_ctrl: 0, initialized 1 [ 928.145317][ T43] dvb-usb: TeVii S662 successfully initialized and connected. [ 928.155426][ T43] usb 4-1: USB disconnect, device number 106 [ 929.012499][ T43] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 929.211140][T15909] sp0: Synchronizing with TNC [ 929.596036][T15913] overlayfs: overlapping lowerdir path [ 929.627912][T15902] [U] è` [ 929.801171][ T43] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 929.963274][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 930.769575][ T43] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 930.780293][ T43] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 930.789326][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.808440][ T43] usb 4-1: config 0 descriptor?? [ 930.910607][ T30] audit: type=1400 audit(2000000201.322:990): avc: denied { read } for pid=15928 comm="syz.4.2640" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 931.090780][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.097179][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.170482][ T43] usb 2-1: new full-speed USB device number 87 using dummy_hcd [ 931.469584][T15939] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15939 comm=syz.4.2642 [ 931.556478][ T43] usb 2-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=cb.d7 [ 931.565803][ T43] usb 2-1: New USB device strings: Mfr=1, Product=18, SerialNumber=3 [ 931.579480][ T43] usb 2-1: Product: syz [ 931.586037][ T43] usb 2-1: Manufacturer: syz [ 931.592236][ T43] usb 2-1: SerialNumber: syz [ 931.601278][ T43] usb 2-1: config 0 descriptor?? [ 931.609032][ T43] dvb-usb: found a 'Pinnacle PCTV 310e' in cold state, will try to load a firmware [ 931.619444][ T43] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 931.860289][ T30] audit: type=1400 audit(2000000202.282:991): avc: denied { bind } for pid=15945 comm="syz.0.2645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 932.055196][ T43] usb 2-1: USB disconnect, device number 87 [ 932.331786][T15960] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2646'. [ 932.766381][T15964] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2647'. [ 934.383733][T12795] usb 4-1: USB disconnect, device number 107 [ 934.584577][T15977] sp0: Synchronizing with TNC [ 935.069705][T15972] [U] è` [ 935.073984][ T30] audit: type=1400 audit(2000000205.492:992): avc: denied { setopt } for pid=15982 comm="syz.0.2651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 935.148186][T15983] netlink: 'syz.0.2651': attribute type 1 has an invalid length. [ 935.157601][T15983] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 935.164792][T15983] IPv6: NLM_F_CREATE should be set when creating new route [ 935.171977][T15983] IPv6: NLM_F_CREATE should be set when creating new route [ 935.181458][T15983] ieee802154 phy0 wpan0: encryption failed: -22 [ 935.455207][T15988] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2650'. [ 937.767508][ T30] audit: type=1326 audit(2000000208.192:993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.795861][ T24] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 937.796997][ T30] audit: type=1326 audit(2000000208.192:994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.834057][ T30] audit: type=1326 audit(2000000208.192:995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.857423][ C0] vkms_vblank_simulate: vblank timer overrun [ 937.873728][ T30] audit: type=1326 audit(2000000208.192:996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.897620][ T30] audit: type=1326 audit(2000000208.192:997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.921014][ C0] vkms_vblank_simulate: vblank timer overrun [ 937.928249][ T30] audit: type=1326 audit(2000000208.192:998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.951627][ C0] vkms_vblank_simulate: vblank timer overrun [ 937.958041][ T30] audit: type=1326 audit(2000000208.192:999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 937.982484][ T30] audit: type=1326 audit(2000000208.192:1000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 938.005948][ C0] vkms_vblank_simulate: vblank timer overrun [ 938.012393][ T30] audit: type=1326 audit(2000000208.192:1001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16009 comm="syz.2.2658" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f582a78eec9 code=0x7ffc0000 [ 938.035870][ C0] vkms_vblank_simulate: vblank timer overrun [ 938.055120][ T24] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 938.080271][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 938.088279][ T24] usb 4-1: Product: syz [ 938.093733][ T24] usb 4-1: Manufacturer: syz [ 938.098387][ T24] usb 4-1: SerialNumber: syz [ 938.184610][T16017] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2659'. [ 938.218133][ T24] usb 4-1: config 0 descriptor?? [ 938.613755][ T24] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 939.456225][T16032] input: syz1 as /devices/virtual/input/input60 [ 939.634396][T16030] lo speed is unknown, defaulting to 1000 [ 940.007365][T16041] overlayfs: failed to resolve './file1': -2 [ 940.445849][T16042] Falling back ldisc for ttyprintk. [ 941.018442][T16052] syz.4.2665 uses obsolete (PF_INET,SOCK_PACKET) [ 941.275823][T16056] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2666'. [ 941.307884][T16058] bpf: Bad value for 'mode' [ 942.066453][ T24] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 942.573447][T12795] usb 4-1: USB disconnect, device number 108 [ 942.708874][ T30] kauditd_printk_skb: 164 callbacks suppressed [ 942.708890][ T30] audit: type=1400 audit(2000000213.132:1166): avc: denied { append } for pid=16072 comm="syz.3.2671" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 942.711304][T16074] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2671'. [ 942.739551][ C0] vkms_vblank_simulate: vblank timer overrun [ 943.111822][T16078] ubi: mtd0 is already attached to ubi31 [ 943.891134][T16087] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2674'. [ 943.905466][ T30] audit: type=1400 audit(2000000214.312:1167): avc: denied { write } for pid=16082 comm="syz.2.2674" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 944.176212][T16091] overlayfs: failed to resolve './file1': -2 [ 944.281983][T16094] sp0: Synchronizing with TNC [ 944.666938][T16081] [U] è` [ 945.516935][T16121] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 945.526678][T16121] block device autoloading is deprecated and will be removed. [ 945.585127][ T30] audit: type=1400 audit(2000000216.012:1168): avc: denied { append } for pid=16120 comm="syz.3.2682" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 945.608001][ C0] vkms_vblank_simulate: vblank timer overrun [ 946.145421][T16136] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2684'. [ 947.330640][ T24] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 947.403601][T16148] overlayfs: failed to resolve './file1': -2 [ 947.442368][T16148] sp0: Synchronizing with TNC [ 947.720451][T12795] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 947.840654][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 947.858915][T16142] [U] è` [ 947.880668][T12795] usb 5-1: Using ep0 maxpacket: 8 [ 947.889813][T12795] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 947.899238][T12795] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 947.914395][T12795] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 947.924413][T12795] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 947.936584][T12795] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 947.949795][T12795] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 947.961248][T12795] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.963082][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 947.984699][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 947.994685][ T24] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 948.003909][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 948.569193][T12795] usb 5-1: usb_control_msg returned -32 [ 948.603004][T16145] fuse: Unknown parameter 'user_i00000000000000000000' [ 948.613637][T16144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 948.631892][ T24] usb 1-1: config 0 descriptor?? [ 948.638815][T12795] usbtmc 5-1:16.0: can't read capabilities [ 948.639679][ T24] hub 1-1:0.0: USB hub found [ 948.788844][T12795] usb 5-1: USB disconnect, device number 90 [ 948.836650][T16162] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2692'. [ 949.047711][ T24] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 949.065920][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 949.072006][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 949.080428][ T9] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 949.089332][T16169] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2694'. [ 949.102072][ T24] usb 1-1: USB disconnect, device number 107 [ 949.240430][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 949.284486][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 949.295532][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 949.309473][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 949.322928][ T9] usb 2-1: New USB device found, idVendor=28bd, idProduct=0905, bcdDevice= 0.00 [ 949.338848][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.358111][ T9] usb 2-1: config 0 descriptor?? [ 950.604978][T16187] binder: BINDER_SET_CONTEXT_MGR already set [ 950.611052][T16187] binder: 16186:16187 ioctl 4018620d 200000000ac0 returned -16 [ 950.621324][T16187] binder: 16186:16187 ioctl c0306201 2000000003c0 returned -14 [ 950.801756][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 950.815663][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 950.920522][ T9] usb 2-1: USB disconnect, device number 88 [ 951.022390][ T30] audit: type=1400 audit(2000000221.442:1169): avc: denied { remount } for pid=16188 comm="syz.0.2699" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 951.266798][ T30] audit: type=1400 audit(2000000221.642:1170): avc: denied { module_load } for pid=16188 comm="syz.0.2699" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 951.497985][T16187] syz.2.2698 (16187): drop_caches: 2 [ 951.778829][T16198] bridge0: entered promiscuous mode [ 951.892624][T16198] macvlan3: entered promiscuous mode [ 951.934743][T16200] overlayfs: failed to resolve './file1': -2 [ 952.192392][T16200] sp0: Synchronizing with TNC [ 952.460470][ T24] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 952.477135][T16194] [U] è` [ 953.094296][ T5964] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 953.101956][ T9] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 953.130718][ T24] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 953.140669][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 953.151225][ T24] usb 2-1: config 0 has no interface number 0 [ 953.157646][ T24] usb 2-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 953.172166][ T24] usb 2-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 953.183318][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.204684][ T24] usb 2-1: config 0 descriptor?? [ 953.214376][ T24] usbhid 2-1:0.1: couldn't find an input interrupt endpoint [ 953.260999][ T9] usb 1-1: device descriptor read/64, error -71 [ 953.280656][ T5964] usb 3-1: Using ep0 maxpacket: 16 [ 953.294546][ T5964] usb 3-1: config 0 has an invalid interface number: 71 but max is 0 [ 953.302771][ T5964] usb 3-1: config 0 has no interface number 0 [ 953.311682][ T5964] usb 3-1: New USB device found, idVendor=04cb, idProduct=011b, bcdDevice=23.c5 [ 953.325443][ T5964] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.334012][ T5964] usb 3-1: Product: syz [ 953.338176][ T5964] usb 3-1: Manufacturer: syz [ 953.342883][ T5964] usb 3-1: SerialNumber: syz [ 953.349634][ T5964] usb 3-1: config 0 descriptor?? [ 953.437583][T16222] FAULT_INJECTION: forcing a failure. [ 953.437583][T16222] name failslab, interval 1, probability 0, space 0, times 0 [ 953.452827][T16222] CPU: 0 UID: 0 PID: 16222 Comm: syz.3.2709 Not tainted syzkaller #0 PREEMPT(full) [ 953.452853][T16222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 953.452860][T16222] Call Trace: [ 953.452869][T16222] [ 953.452874][T16222] dump_stack_lvl+0x16c/0x1f0 [ 953.452892][T16222] should_fail_ex+0x512/0x640 [ 953.452906][T16222] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 953.452924][T16222] should_failslab+0xc2/0x120 [ 953.452937][T16222] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 953.452948][T16222] ? __alloc_skb+0x2b2/0x380 [ 953.452962][T16222] __alloc_skb+0x2b2/0x380 [ 953.452974][T16222] ? __pfx___alloc_skb+0x10/0x10 [ 953.452987][T16222] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 953.453004][T16222] netlink_alloc_large_skb+0x69/0x130 [ 953.453019][T16222] netlink_sendmsg+0x6a1/0xdd0 [ 953.453036][T16222] ? __pfx_netlink_sendmsg+0x10/0x10 [ 953.453055][T16222] ____sys_sendmsg+0xa98/0xc70 [ 953.453071][T16222] ? copy_msghdr_from_user+0x10a/0x160 [ 953.453088][T16222] ? __pfx_____sys_sendmsg+0x10/0x10 [ 953.453110][T16222] ___sys_sendmsg+0x134/0x1d0 [ 953.453124][T16222] ? __pfx____sys_sendmsg+0x10/0x10 [ 953.453154][T16222] __sys_sendmsg+0x16d/0x220 [ 953.453169][T16222] ? __pfx___sys_sendmsg+0x10/0x10 [ 953.453192][T16222] do_syscall_64+0xcd/0x4e0 [ 953.453208][T16222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 953.453219][T16222] RIP: 0033:0x7f5c1bf8eec9 [ 953.453228][T16222] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 953.453238][T16222] RSP: 002b:00007f5c1ced4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 953.453249][T16222] RAX: ffffffffffffffda RBX: 00007f5c1c1e5fa0 RCX: 00007f5c1bf8eec9 [ 953.453256][T16222] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000004 [ 953.453262][T16222] RBP: 00007f5c1ced4090 R08: 0000000000000000 R09: 0000000000000000 [ 953.453269][T16222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 953.453275][T16222] R13: 00007f5c1c1e6038 R14: 00007f5c1c1e5fa0 R15: 00007ffd9ba21d38 [ 953.453289][T16222] [ 953.666675][ C0] vkms_vblank_simulate: vblank timer overrun [ 953.762669][ T9] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 953.811885][T16224] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1545 sclass=netlink_route_socket pid=16224 comm=syz.2.2706 [ 953.935838][T16226] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 953.944055][T16226] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 953.952488][T16226] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 953.980329][ T9] usb 1-1: device descriptor read/64, error -71 [ 954.101082][ T9] usb usb1-port1: attempt power cycle [ 954.460424][ T9] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 954.501259][ T9] usb 1-1: device descriptor read/8, error -71 [ 954.844224][ T9] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 954.891090][ T9] usb 1-1: device descriptor read/8, error -71 [ 954.901402][ T30] audit: type=1400 audit(2000000225.332:1171): avc: denied { mount } for pid=16234 comm="syz.3.2713" name="/" dev="hugetlbfs" ino=57205 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 955.040686][ T9] usb usb1-port1: unable to enumerate USB device [ 955.114410][ T30] audit: type=1400 audit(2000000225.542:1172): avc: denied { append } for pid=16237 comm="syz.4.2714" name="sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 955.138588][ C0] vkms_vblank_simulate: vblank timer overrun [ 955.157332][ T30] audit: type=1400 audit(2000000225.542:1173): avc: denied { map } for pid=16237 comm="syz.4.2714" path="/dev/sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 955.284036][ T5985] usb 2-1: USB disconnect, device number 89 [ 955.296216][ T30] audit: type=1400 audit(2000000225.542:1174): avc: denied { execute } for pid=16237 comm="syz.4.2714" path="/dev/sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 955.694854][ T5964] gspca_main: finepix-2.14.0 probing 04cb:011b [ 955.700349][T16243] ================================================================== [ 955.706347][ T5964] usb 3-1: USB disconnect, device number 97 [ 955.709064][T16243] BUG: KASAN: slab-use-after-free in sysfs_remove_file_ns+0x63/0x70 [ 955.722880][T16243] Read of size 8 at addr ffff888076388830 by task syz.1.2715/16243 [ 955.730741][T16243] [ 955.733040][T16243] CPU: 1 UID: 0 PID: 16243 Comm: syz.1.2715 Not tainted syzkaller #0 PREEMPT(full) [ 955.733055][T16243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 955.733063][T16243] Call Trace: [ 955.733068][T16243] [ 955.733074][T16243] dump_stack_lvl+0x116/0x1f0 [ 955.733092][T16243] print_report+0xcd/0x630 [ 955.733105][T16243] ? __virt_addr_valid+0x81/0x610 [ 955.733120][T16243] ? __phys_addr+0xe8/0x180 [ 955.733134][T16243] ? sysfs_remove_file_ns+0x63/0x70 [ 955.733147][T16243] kasan_report+0xe0/0x110 [ 955.733159][T16243] ? sysfs_remove_file_ns+0x63/0x70 [ 955.733171][T16243] sysfs_remove_file_ns+0x63/0x70 [ 955.733183][T16243] driver_remove_file+0x4a/0x60 [ 955.733198][T16243] bus_remove_driver+0x224/0x2c0 [ 955.733210][T16243] driver_unregister+0x76/0xb0 [ 955.733224][T16243] comedi_device_detach_locked+0x12f/0xa50 [ 955.733240][T16243] do_devconfig_ioctl+0x555/0x710 [ 955.733257][T16243] ? __mutex_lock+0x1c5/0x1060 [ 955.733271][T16243] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 955.733290][T16243] ? find_held_lock+0x2b/0x80 [ 955.733304][T16243] comedi_unlocked_ioctl+0x165d/0x2f00 [ 955.733316][T16243] ? __print_lock_name+0x64/0xe0 [ 955.733328][T16243] ? finish_task_switch.isra.0+0x21c/0xc10 [ 955.733342][T16243] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 955.733354][T16243] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 955.733367][T16243] ? do_vfs_ioctl+0x128/0x14f0 [ 955.733382][T16243] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 955.733397][T16243] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 955.733415][T16243] ? hook_file_ioctl_common+0x145/0x410 [ 955.733428][T16243] ? selinux_file_ioctl+0x180/0x270 [ 955.733442][T16243] ? selinux_file_ioctl+0xb4/0x270 [ 955.733457][T16243] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 955.733467][T16243] __x64_sys_ioctl+0x18e/0x210 [ 955.733483][T16243] do_syscall_64+0xcd/0x4e0 [ 955.733497][T16243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 955.733509][T16243] RIP: 0033:0x7fdec738eec9 [ 955.733518][T16243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 955.733529][T16243] RSP: 002b:00007fdec8233038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 955.733539][T16243] RAX: ffffffffffffffda RBX: 00007fdec75e6090 RCX: 00007fdec738eec9 [ 955.733546][T16243] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000006 [ 955.733552][T16243] RBP: 00007fdec7411f91 R08: 0000000000000000 R09: 0000000000000000 [ 955.733558][T16243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 955.733564][T16243] R13: 00007fdec75e6128 R14: 00007fdec75e6090 R15: 00007ffc51c79168 [ 955.733574][T16243] [ 955.733578][T16243] [ 955.995539][T16243] Allocated by task 15812: [ 955.999930][T16243] kasan_save_stack+0x33/0x60 [ 956.004588][T16243] kasan_save_track+0x14/0x30 [ 956.009241][T16243] __kasan_kmalloc+0xaa/0xb0 [ 956.013805][T16243] __kmalloc_noprof+0x223/0x510 [ 956.018631][T16243] __list_lru_init+0xe8/0x4c0 [ 956.023284][T16243] alloc_super+0x904/0xbd0 [ 956.027676][T16243] sget_fc+0x116/0xc20 [ 956.031729][T16243] get_tree_nodev+0x28/0x190 [ 956.036293][T16243] vfs_get_tree+0x8e/0x340 [ 956.040690][T16243] path_mount+0x1513/0x2000 [ 956.045185][T16243] __x64_sys_mount+0x28d/0x310 [ 956.049925][T16243] do_syscall_64+0xcd/0x4e0 [ 956.054411][T16243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.060283][T16243] [ 956.062582][T16243] Freed by task 5850: [ 956.066621][T16243] kasan_save_stack+0x33/0x60 [ 956.071276][T16243] kasan_save_track+0x14/0x30 [ 956.075939][T16243] kasan_save_free_info+0x3b/0x60 [ 956.080943][T16243] __kasan_slab_free+0x60/0x70 [ 956.085681][T16243] kfree+0x2b4/0x4d0 [ 956.089555][T16243] list_lru_destroy+0x152/0x700 [ 956.094377][T16243] deactivate_locked_super+0xe1/0x1a0 [ 956.099723][T16243] deactivate_super+0xde/0x100 [ 956.104459][T16243] cleanup_mnt+0x225/0x450 [ 956.108848][T16243] task_work_run+0x150/0x240 [ 956.113427][T16243] exit_to_user_mode_loop+0xeb/0x110 [ 956.118702][T16243] do_syscall_64+0x41c/0x4e0 [ 956.123271][T16243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.129141][T16243] [ 956.131455][T16243] The buggy address belongs to the object at ffff888076388800 [ 956.131455][T16243] which belongs to the cache kmalloc-256 of size 256 [ 956.145481][T16243] The buggy address is located 48 bytes inside of [ 956.145481][T16243] freed 256-byte region [ffff888076388800, ffff888076388900) [ 956.159161][T16243] [ 956.161461][T16243] The buggy address belongs to the physical page: [ 956.167845][T16243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888076389000 pfn:0x76388 [ 956.177887][T16243] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 956.186356][T16243] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 956.194836][T16243] page_type: f5(slab) [ 956.198794][T16243] raw: 00fff00000000240 ffff88801b841b40 ffffea0000c15210 ffffea0000a4c210 [ 956.207350][T16243] raw: ffff888076389000 0000000000100007 00000000f5000000 0000000000000000 [ 956.215918][T16243] head: 00fff00000000240 ffff88801b841b40 ffffea0000c15210 ffffea0000a4c210 [ 956.224569][T16243] head: ffff888076389000 0000000000100007 00000000f5000000 0000000000000000 [ 956.233214][T16243] head: 00fff00000000001 ffffea0001d8e201 00000000ffffffff 00000000ffffffff [ 956.241863][T16243] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 956.250504][T16243] page dumped because: kasan: bad access detected [ 956.256894][T16243] page_owner tracks the page as allocated [ 956.262589][T16243] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5860, tgid 5860 (syz-executor), ts 73269640168, free_ts 73221781032 [ 956.283924][T16243] post_alloc_hook+0x1c0/0x230 [ 956.288852][T16243] get_page_from_freelist+0x132b/0x38e0 [ 956.294379][T16243] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 956.300250][T16243] alloc_pages_mpol+0x1fb/0x550 [ 956.305077][T16243] new_slab+0x247/0x330 [ 956.309212][T16243] ___slab_alloc+0xcf2/0x1750 [ 956.313870][T16243] __slab_alloc.constprop.0+0x56/0xb0 [ 956.319228][T16243] __kmalloc_cache_noprof+0xfb/0x3e0 [ 956.324511][T16243] vlan_vid_add+0x2ee/0x750 [ 956.328991][T16243] bond_vlan_rx_add_vid+0x160/0x320 [ 956.334172][T16243] vlan_add_rx_filter_info+0x146/0x1e0 [ 956.339607][T16243] vlan_vid_add+0x470/0x750 [ 956.344085][T16243] vlan_device_event+0x1a39/0x2620 [ 956.349172][T16243] notifier_call_chain+0xb9/0x410 [ 956.354177][T16243] call_netdevice_notifiers_info+0xbe/0x140 [ 956.360051][T16243] __dev_notify_flags+0x12c/0x2e0 [ 956.365051][T16243] page last free pid 23 tgid 23 stack trace: [ 956.371000][T16243] __free_frozen_pages+0x7d5/0x10f0 [ 956.376180][T16243] rcu_core+0x79c/0x1530 [ 956.380397][T16243] handle_softirqs+0x219/0x8e0 [ 956.385141][T16243] run_ksoftirqd+0x3a/0x60 [ 956.389535][T16243] smpboot_thread_fn+0x3f7/0xae0 [ 956.394452][T16243] kthread+0x3c2/0x780 [ 956.398497][T16243] ret_from_fork+0x56a/0x730 [ 956.403063][T16243] ret_from_fork_asm+0x1a/0x30 [ 956.407805][T16243] [ 956.410101][T16243] Memory state around the buggy address: [ 956.415713][T16243] ffff888076388700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 956.423748][T16243] ffff888076388780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 956.431788][T16243] >ffff888076388800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 956.439818][T16243] ^ [ 956.445419][T16243] ffff888076388880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 956.453454][T16243] ffff888076388900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 956.461486][T16243] ================================================================== [ 956.598292][T16243] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 956.605508][T16243] CPU: 1 UID: 0 PID: 16243 Comm: syz.1.2715 Not tainted syzkaller #0 PREEMPT(full) [ 956.614872][T16243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 956.624922][T16243] Call Trace: [ 956.628192][T16243] [ 956.631115][T16243] dump_stack_lvl+0x3d/0x1f0 [ 956.635710][T16243] vpanic+0x6e8/0x7a0 [ 956.639687][T16243] ? __pfx_vpanic+0x10/0x10 [ 956.644186][T16243] ? __pfx_vprintk_emit+0x10/0x10 [ 956.649199][T16243] ? sysfs_remove_file_ns+0x63/0x70 [ 956.654378][T16243] panic+0xca/0xd0 [ 956.658076][T16243] ? __pfx_panic+0x10/0x10 [ 956.662554][T16243] ? sysfs_remove_file_ns+0x63/0x70 [ 956.667728][T16243] ? preempt_schedule_common+0x44/0xc0 [ 956.673172][T16243] ? preempt_schedule_thunk+0x16/0x30 [ 956.678528][T16243] check_panic_on_warn+0xab/0xb0 [ 956.683447][T16243] end_report+0x107/0x170 [ 956.687759][T16243] kasan_report+0xee/0x110 [ 956.692154][T16243] ? sysfs_remove_file_ns+0x63/0x70 [ 956.697334][T16243] sysfs_remove_file_ns+0x63/0x70 [ 956.702336][T16243] driver_remove_file+0x4a/0x60 [ 956.707169][T16243] bus_remove_driver+0x224/0x2c0 [ 956.712083][T16243] driver_unregister+0x76/0xb0 [ 956.716828][T16243] comedi_device_detach_locked+0x12f/0xa50 [ 956.722618][T16243] do_devconfig_ioctl+0x555/0x710 [ 956.727625][T16243] ? __mutex_lock+0x1c5/0x1060 [ 956.732368][T16243] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 956.737907][T16243] ? find_held_lock+0x2b/0x80 [ 956.742571][T16243] comedi_unlocked_ioctl+0x165d/0x2f00 [ 956.748008][T16243] ? __print_lock_name+0x64/0xe0 [ 956.752923][T16243] ? finish_task_switch.isra.0+0x21c/0xc10 [ 956.758710][T16243] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 956.764509][T16243] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 956.770385][T16243] ? do_vfs_ioctl+0x128/0x14f0 [ 956.775139][T16243] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 956.780144][T16243] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 956.786984][T16243] ? hook_file_ioctl_common+0x145/0x410 [ 956.792511][T16243] ? selinux_file_ioctl+0x180/0x270 [ 956.797689][T16243] ? selinux_file_ioctl+0xb4/0x270 [ 956.802781][T16243] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 956.808564][T16243] __x64_sys_ioctl+0x18e/0x210 [ 956.813310][T16243] do_syscall_64+0xcd/0x4e0 [ 956.817795][T16243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.823662][T16243] RIP: 0033:0x7fdec738eec9 [ 956.828057][T16243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 956.847640][T16243] RSP: 002b:00007fdec8233038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 956.856031][T16243] RAX: ffffffffffffffda RBX: 00007fdec75e6090 RCX: 00007fdec738eec9 [ 956.863990][T16243] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000006 [ 956.871942][T16243] RBP: 00007fdec7411f91 R08: 0000000000000000 R09: 0000000000000000 [ 956.879887][T16243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 956.887840][T16243] R13: 00007fdec75e6128 R14: 00007fdec75e6090 R15: 00007ffc51c79168 [ 956.895793][T16243] [ 956.899010][T16243] Kernel Offset: disabled [ 956.903307][T16243] Rebooting in 86400 seconds..