last executing test programs: 4m10.753103377s ago: executing program 4 (id=556): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00'}) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x800, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}}, 0x20008080) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448dd, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x240, 0x182) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "ac"}]}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000cc0)={0x324, r5, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x88, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xc, 0x3, "e5fcaad57a7981f7"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "c34136cc632518a1f4a0fac0b7a76273061d9fa40aa08ec6bda93eeeb0d6"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x104, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "0808184ac7b895a31939754774e3b4d3b0ec59fdae"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_NODE_ID={0xa4, 0x3, "1ecacce5bd0931000841e84ef1358a60c5b6fda4a176a354d83bf8d1ba4dc2bd5c052f9a0888369af140e2ddf989abc0f7d4b3b34339a537edfcddfb17affc467a028f708f53469723d57049003c2bcce7e1faf3d30dcc606ae21d55848fe242e19c4cdb824887aa0cdaee41e4f667582a90eec5097e7a8e6269ad6217117b4b10ef09fbbe5edaff82547f578b9f9ee1d34b01ecc2077a65863b1745aaed75ee"}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xf8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xff, @loopback, 0x8d6}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xfc94, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'pim6reg1\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c6a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x1, @mcast1, 0x3}}}}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'dvmrp1\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x101}]}]}, 0x324}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f0000000900)={{0x80}, 'port0\x00', 0x52, 0xb, 0x3, 0x8000007, 0x3, 0x0, 0x8000083, 0x0, 0x6}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x16, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000400000000000000000000001d2d83fb500000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) read$FUSE(0xffffffffffffffff, &(0x7f0000001680)={0x2020}, 0x2020) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f00000001c0)={0x800100, 0x3, 0x22, 0xe1d9, 0x1101, 0xff}) 4m9.118245939s ago: executing program 4 (id=560): socket$inet6(0xa, 0x80002, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth1_to_bridge\x00', 0x0}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={@local, 0x0, r1}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4400046, r1}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000540)={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, r5}) (fail_nth: 5) 4m8.001710172s ago: executing program 4 (id=563): mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x2000001, 0x13, 0xffffffffffffffff, 0x517a3000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="080086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff020000000000000000000000000001042088be"], 0xfdef) (fail_nth: 13) 4m7.009158718s ago: executing program 4 (id=569): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) read$FUSE(r1, &(0x7f0000000240)={0x2020}, 0x2020) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000100)=0x4) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r2) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd9f, 0x1}) r8 = syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000000)='x', 0x1}, {&(0x7f00000001c0)='\x00\x00\x00\x00', 0x4}], 0x2) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR2(r5, 0xc02464bb, &(0x7f0000000080)={0x3, r7, 0x1fc, 0x0, 0x4, 0x800008, 0x0, 0x4, 0x4000}) 4m5.022469672s ago: executing program 4 (id=576): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x84) close_range(0xffffffffffffffff, r0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f00000001c0)) preadv(0xffffffffffffffff, &(0x7f00000031c0)=[{&(0x7f0000005e40)=""/4102, 0x1006}], 0x1, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x149802, 0x0) r3 = dup(r2) read$FUSE(r3, &(0x7f0000001900)={0x2020}, 0x2020) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000010000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='contention_end\x00', r6, 0x0, 0x3}, 0x18) syz_open_dev$sg(&(0x7f00000002c0), 0x5d7000000000000, 0x2402) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='sched_switch\x00', r7, 0x0, 0x36}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r8 = getpid() sched_setscheduler(r8, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) chroot(&(0x7f0000000340)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 4m1.944156722s ago: executing program 4 (id=579): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x80) pipe2(&(0x7f0000001440), 0x80000) (async) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000002d00090027bd7000000000000400000008001a80"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r2, 0x0, r0, 0x0, 0x6, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@private2, @in=@remote}}, {{@in=@private}, 0x0, @in6=@initdev}}, &(0x7f00000001c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240), &(0x7f00000002c0)=0xc) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) (async) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r4 = dup(r3) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r2}}) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$NFNL_MSG_CTHELPER_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x14, 0x1, 0x9, 0x101, 0x0, 0x0, {0x0, 0x0, 0x30a}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x10) socket(0x10, 0x3, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 3m46.857995359s ago: executing program 32 (id=579): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x80) pipe2(&(0x7f0000001440), 0x80000) (async) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000002d00090027bd7000000000000400000008001a80"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r2, 0x0, r0, 0x0, 0x6, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@private2, @in=@remote}}, {{@in=@private}, 0x0, @in6=@initdev}}, &(0x7f00000001c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240), &(0x7f00000002c0)=0xc) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) (async) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r4 = dup(r3) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r2}}) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$NFNL_MSG_CTHELPER_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x14, 0x1, 0x9, 0x101, 0x0, 0x0, {0x0, 0x0, 0x30a}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x10) socket(0x10, 0x3, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 2m52.01150082s ago: executing program 3 (id=786): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r1 = epoll_create1(0x0) r2 = socket$kcm(0x11, 0x2, 0x0) sendmsg$sock(r2, &(0x7f00000000c0)={&(0x7f0000000100)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41, 0x2}, 0x2}}, 0x80, 0x0, 0x0, &(0x7f0000000300)=[@mark={{0x14, 0x1, 0x24, 0x4}}], 0x18}, 0x40010) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x5}}, 0x20) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=ANY=[@ANYBLOB="84000000100005000004855a9ffbf21304000000", @ANYRES32=r5, @ANYBLOB="1546010000000000540012800c0001006d6163766c616e004400028006000200010000000800010001000000080003000300000008000700050000000800010010"], 0x84}}, 0x20008040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r8, r7, &(0x7f0000000140)=0x800200064, 0x21c) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') statx(r10, 0x0, 0x7000, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100), 0x13f, 0x9}}, 0x20) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 2m48.113065086s ago: executing program 3 (id=800): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000100)={0xf0f02a, 0x3}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x4, &(0x7f0000000280)=[{0x9, 0x0, 0xa, 0xf794}, {0x6, 0x80, 0x0, 0x6}, {0x800, 0xf9, 0x5, 0x6}, {0x821, 0xf7, 0x0, 0xffffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x20004, r1, 0x80000}) r4 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315f9b10102030109026100010000000009040001"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYRES16=r6, @ANYRES16=r5, @ANYRESDEC=r3], 0x4c}}, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x5, 0x3, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "9dfc47318ccc3455"}}, 0x48}}, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000140)=0x6) r9 = syz_open_dev$vbi(&(0x7f00000002c0), 0x3, 0x2) openat2(r3, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_G_FMT(r9, 0xc0d05604, &(0x7f0000000100)={0x7, @raw_data="8a93a9bca2e7a34fd42cad7a27db2244182edb88bfb1f531061fff7f8e2167ccf1cb11a2bc849e7071c7dc5809a0e1e7a322fb50414f35f9a64a7a24e6eac6339fe77f834b71d14670185f2b582edd96ac12667b94ce5d1dab41c7702b0dd2df2800fe8ca0eb607aace9f42c6f82b97820cb0686ff8279996467f64732144e6d8a36e8848dcbc0be0fe8c515128a63995eba99cf70e5db63cb5a10703d334e05c4fcbf9910e795abe501acb4bc4ae4b30c5e2679214f982efdb31aed3ae4392d31b7177aee45dd8c"}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 2m44.633693606s ago: executing program 3 (id=809): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xbcb5, 0x3f00, 0x5, 0x1000}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, {0x0, r8}}) inotify_init1(0x80000) io_uring_enter(r5, 0x3516, 0x3e44, 0x8, 0x0, 0x0) 2m42.822706919s ago: executing program 3 (id=811): r0 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000140)={0x3, 0x2, 0x4, 0x0, 0x12}) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000002c0)={0x2, @sdr={0x1303052d, 0x1002}}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/netstat\x00') socket$key(0xf, 0x3, 0x2) close_range(r1, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r2 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000040)='&}%%:\x00', &(0x7f0000000080)='./file0\x00', r4) r5 = fanotify_init(0x20, 0x101000) fanotify_mark(r5, 0x39, 0x1a, r4, 0x0) r6 = fanotify_init(0x0, 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(r6, 0x455, 0x8000003, r7, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) bind$alg(r2, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r8 = accept4(r2, 0x0, 0x0, 0x0) recvmmsg(r8, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000340)=""/140, 0x8c}], 0x1}, 0x3}], 0x1, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x0, 0x29, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4040810) ioctl$sock_SIOCDELDLCI(r8, 0x8981, &(0x7f0000000000)={'bridge0\x00', 0xe}) 2m41.60536095s ago: executing program 3 (id=814): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e21, 0xffffffff, @empty, 0x4}, 0xf) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000000)) socket$kcm(0x29, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) pwritev2(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x86) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x100001, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x3c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0x2}, @TCA_FQ_PLIMIT={0x8, 0x1, 0xd5}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x20040040) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$inet(r6, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) 2m39.801569969s ago: executing program 3 (id=821): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000340), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) recvmmsg(r4, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r4, 0x1, 0x4b, 0x0, 0x0) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x123, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, 0x0, 0x0) fchmod(0xffffffffffffffff, 0x32) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x8, 0x1fc07f0, 0x81, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r6, 0x1276, 0x20000000) r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x400000, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000780)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000e00)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000f9dbdf250200000008000100", @ANYRES32=r8, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x40841}, 0x20000800) 2m24.267999523s ago: executing program 33 (id=821): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000340), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) recvmmsg(r4, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r4, 0x1, 0x4b, 0x0, 0x0) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x123, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, 0x0, 0x0) fchmod(0xffffffffffffffff, 0x32) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x8, 0x1fc07f0, 0x81, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r6, 0x1276, 0x20000000) r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x400000, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000780)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000e00)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000f9dbdf250200000008000100", @ANYRES32=r8, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x40841}, 0x20000800) 2m2.922116053s ago: executing program 5 (id=894): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00'}) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x800, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}}, 0x20008080) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448dd, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x240, 0x182) r5 = syz_genetlink_get_family_id$tipc2(0x0, r0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "ac"}]}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000cc0)={0x324, r5, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x88, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xc, 0x3, "e5fcaad57a7981f7"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "c34136cc632518a1f4a0fac0b7a76273061d9fa40aa08ec6bda93eeeb0d6"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x104, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "0808184ac7b895a31939754774e3b4d3b0ec59fdae"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_NODE_ID={0xa4, 0x3, "1ecacce5bd0931000841e84ef1358a60c5b6fda4a176a354d83bf8d1ba4dc2bd5c052f9a0888369af140e2ddf989abc0f7d4b3b34339a537edfcddfb17affc467a028f708f53469723d57049003c2bcce7e1faf3d30dcc606ae21d55848fe242e19c4cdb824887aa0cdaee41e4f667582a90eec5097e7a8e6269ad6217117b4b10ef09fbbe5edaff82547f578b9f9ee1d34b01ecc2077a65863b1745aaed75ee"}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xf8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xff, @loopback, 0x8d6}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xfc94, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'pim6reg1\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c6a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x1, @mcast1, 0x3}}}}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'dvmrp1\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x101}]}]}, 0x324}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f0000000900)={{0x80}, 'port0\x00', 0x52, 0xb, 0x3, 0x8000007, 0x3, 0x0, 0x8000083, 0x0, 0x6}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x16, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000400000000000000000000001d2d83fb500000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) read$FUSE(0xffffffffffffffff, &(0x7f0000001680)={0x2020}, 0x2020) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f00000001c0)={0x800100, 0x3, 0x22, 0xe1d9, 0x1101, 0xff}) 2m2.319737279s ago: executing program 5 (id=897): epoll_create1(0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000101401002cbd7000fedb00000000010400"/32], 0x20}, 0x1, 0x0, 0x0, 0x24044836}, 0xc094) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000440)={0xf, {"a2e3ad21e08eeb661b5d350987f70e06d038e7ff7fc6e5539b0d750e8b089b3f363b68090890e0878f0e1ac6e7049b3b48959b649a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07410936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63da1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e6409000000000000002fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec1109110900d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e1505f6bf39ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97912507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000010000008000bea37ce0d0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f6435f7590000008271a1f5f8528f227eabc1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b649f07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076a882e8020f06c47f8156832369c33076da865d258734dd73583df292892448839ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059ec01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c27155005e797b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02c67141a360c3ace48aee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7fdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e44e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333b25bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475fb7807fb33b72685ec37a2d3f7664fe2f0459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b6cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5dd40b0000000000005f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128060000008261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b6c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb00600000000000000dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69cce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r4 = fsopen(&(0x7f00000000c0)='nfsd\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x200000000000000) r5 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfec9, 0x8, 0x2, 0x11f}, &(0x7f0000000040), &(0x7f0000000280)=0x0) r7 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r8 = syz_io_uring_setup(0x79c1, &(0x7f00000000c0)={0x0, 0x7592, 0x2000, 0x0, 0x27b, 0x0, r5}, &(0x7f0000000340)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r6, &(0x7f0000000300)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x28, 0x4004, @fd=r7, 0x10, 0x0, 0x0, 0x0, 0x1, {0x0, r10}}) r11 = openat$comedi(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/comedi2\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r11, 0x40946400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 2m1.281463128s ago: executing program 5 (id=900): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0xb, 0xfffff034}, {0x20, 0x81, 0x0, 0xfffff024}, {0x6}]}, 0x10) r2 = socket(0x1d, 0x2, 0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r3, 0x400454a4, 0xfffffffffffffffc) ioctl$sock_rose_SIOCADDRT(r2, 0x890b, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0xe, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000400)={0x1d, r4, 0x80000000000002, {0x3, 0x0, 0x1}}, 0x18) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f00000001c0)={0x320d, 0x2, "b02aef66515c5c40ef2daf8b78d158928db815a2e5c6f0ce99beacec47178fd3658c6896f028f7013e716b7793c736c8c18181933d51f0d1122c79e041c16c43beddbcf36075cb94480ce7359b61bba68c6a366e2f94f111810276b7d17b290f669ea87cb913c3bd60ec61c276ad59e790c9331f362ff9ed6d44d58ef7c043432e96ee5ed2eb9ab0d0204c42ad54cdf3693a538a4d525d7c92c0fcbe523b3b516bb0afa98a30b224191256f6912dee8eeab107e698795881d640ace57f5b3616bf7cc99ab2d71dd9f6ebb85e3408d63d8d0dccada7a2acd0c835a1f523747b098deb567974d22c95141d5a721dea3d61577a3b5afdd84a0221e2bf96df0c4694"}) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r2) sendmmsg(r0, &(0x7f0000001c00), 0x400000000000159, 0x40840) 2m0.659370078s ago: executing program 5 (id=904): pipe(0x0) close(0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='hfs\x00', 0x8000, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan0\x00'}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1, 0x0, 0x0, 0x700}}], 0x1, 0x20008000) socket$tipc(0x1e, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "60000100", "9de66ebc3914c06f0f109088d190e700", "000e3102", "f8dde5bf3eba23db"}, 0x28) 2m0.234132007s ago: executing program 5 (id=905): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$ptmx(0xffffffffffffff9c, 0x0, 0x20d00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) exit(0x9) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x2c020400) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x5885, 0x100, 0x0, 0xffeffc03}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r0, 0x32, &(0x7f00000000c0)=@un=@abs={0x1, 0x0, 0x4e20}}) unshare(0x400) io_uring_enter(r3, 0x351e, 0x483, 0x0, 0x0, 0x0) fallocate(r2, 0x10, 0xfffffffffffff351, 0x20000000000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) msgsnd(0x0, &(0x7f00000017c0)={0x3, "ccc038e6c1811bb93fb0fff199a17ff1d35bea8fa76c6fb3427a59f08c72c3d8cca2e18a4322791fd8b85da1b744a3b55718a0995c42fd13e67a6bf56d90dd0b93965cfd2bf2a9f519a4976f97bffd5620c77df50c8e16f43c130be1d141e8669e0c5fec20b09de2820969f0c1c8fd56a287183a431cbe0f236e2ab0b31298f44fe6a4f3b00a423134db5401084cf825e1712beb998c2766ff4e94f62daea89091093343b684154185d8751a8b0408b7b3b67a7ca64f0b17f0d11d60c8d6160948f09a7c39ae17e580edbe71ac500bf1585ae80eecd86c334e551756ad8a1a6588e9ed315a3cd88380effc5751ed448dda7ffd426a7fcbe488f57fc900e5c50cbaf36df64e943a9b2d17643b8bce34f730d06bc3c6603ccf13d4053a9127058433514b081f6d7e7b2dd20d653f3ac64f8da442b0f8e3e69791400ab667153ac6279663070aad353e5fb0b1d5006f41d78dc2d9646420cef9e55080112538004eb10975677cab1d56bfaeed2ee9680cd8edc9be87b14cf5014c46ec33b6e279e7d16132d396648f2fce87e42b072bab826351605885e05542c787d65c9e1bf66a31e3c796fdf4f48a7b05b5f66be510f7cdd8a35ee84219f3c9f338205c2588ac6e91df1a38896a8dddb2a4f9f665e94c94f7b01dbe1ed7063dd2b565c0f63e6029faa1b5074b49f26b68685a4a6268292a01c7989f9b790a538f18fd1f14d30554161f540aeebb1767e3cc68de35d3e024b4d07a382a42bd81d5d3278947fe13244fcd087f6ebab0f9ae22cf090480279b8bc5b112994a54625add85b947e96dfe42e4ea3834350efa5e3548c9b5240a11484cf84ce175483c8bd78fb47c050e97c6a89ae67fda0da9e54219b3a52ad4a99b991cd4eb5e5fd0199f79a1ac40d97bce5402a92a6bcdb9a9e7a3775a97d1ff71fb8f15937775a9397d51bbe5363f18c04f8c4a2ed56fe75ef76d1b9c721631aed9d42513e9319e87e78738544bae042cc4c40e86249cfc32e4fae85a7b2b3486cc2337f6998efc0762570c8e59383339eb6127014f0ce192d4beb2b81b20d155e53b412fb24941005e9609f2f2fa335e45"}, 0x30b, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) r6 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r6, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e1d, 0x280000, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c0000002b0000000000000718"], 0x30}, 0x4000010) 1m56.444777516s ago: executing program 5 (id=916): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2e000400010003", 0x7) socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r2 = dup2(r1, r1) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r3, &(0x7f0000007700), 0x318, 0xfc0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000380)={{0x1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x4}, 0x0, 0x0, 0x0, 0x8, 0x8, 0x6, 0x100000000005, 0x697b, 0x4, 0x5}) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x189, 0x100) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x8010}, 0x40400c0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = socket$inet6_sctp(0xa, 0x2, 0x84) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000180)={0x6, [0xe7ee, 0x6, 0x1, 0x2, 0x7, 0x3]}, &(0x7f0000000240)=0x10) setsockopt$sock_int(r5, 0x1, 0x4, 0x0, 0x0) 1m41.083941818s ago: executing program 34 (id=916): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2e000400010003", 0x7) socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r2 = dup2(r1, r1) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r3, &(0x7f0000007700), 0x318, 0xfc0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000380)={{0x1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x4}, 0x0, 0x0, 0x0, 0x8, 0x8, 0x6, 0x100000000005, 0x697b, 0x4, 0x5}) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x189, 0x100) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x8010}, 0x40400c0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = socket$inet6_sctp(0xa, 0x2, 0x84) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000180)={0x6, [0xe7ee, 0x6, 0x1, 0x2, 0x7, 0x3]}, &(0x7f0000000240)=0x10) setsockopt$sock_int(r5, 0x1, 0x4, 0x0, 0x0) 42.728752048s ago: executing program 7 (id=1103): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x38, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) stat(0x0, 0x0) setxattr$system_posix_acl(0x0, 0x0, &(0x7f0000019600)=ANY=[@ANYBLOB="02000000010003000000000002", @ANYRES16, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x64, 0x1) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x1a, 0x0, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.1GB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000100)=0x2, 0x12) r2 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r2, &(0x7f0000000380)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) r3 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r3, 0x2) close(r3) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000080)={0x8, &(0x7f0000000000)=[{0x9, 0x3, 0x7, 0x2c7}, {0x4, 0x0, 0x9, 0x1ddb}, {0x1000, 0xfe, 0x6, 0x8}, {0x3, 0x9, 0x2, 0x5}, {0x6, 0x1, 0x0, 0x200}, {0x4, 0xf7, 0xbf, 0x80000001}, {0xf55, 0x5, 0xdd, 0x92e}, {0xfffd, 0xc0, 0xc, 0x4}]}, 0x10) socket$kcm(0x2, 0x200000000000001, 0x106) prctl$PR_SET_MM(0x23, 0x1, &(0x7f000011e000/0x2000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = inotify_init1(0x800) inotify_add_watch(r4, &(0x7f00000003c0)='./file0\x00', 0x600037c) umount2(&(0x7f0000000080)='./file0\x00', 0xb) 40.904743123s ago: executing program 7 (id=1107): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x38, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) stat(0x0, 0x0) setxattr$system_posix_acl(0x0, 0x0, &(0x7f0000019600)=ANY=[@ANYBLOB="02000000010003000000000002", @ANYRES16, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x64, 0x1) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x1a, 0x0, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.1GB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000100)=0x2, 0x12) r2 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r2, &(0x7f0000000380)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) r3 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r3, 0x2) close(r3) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000080)={0x8, &(0x7f0000000000)=[{0x9, 0x3, 0x7, 0x2c7}, {0x4, 0x0, 0x9, 0x1ddb}, {0x1000, 0xfe, 0x6, 0x8}, {0x3, 0x9, 0x2, 0x5}, {0x6, 0x1, 0x0, 0x200}, {0x4, 0xf7, 0xbf, 0x80000001}, {0xf55, 0x5, 0xdd, 0x92e}, {0xfffd, 0xc0, 0xc, 0x4}]}, 0x10) socket$kcm(0x2, 0x200000000000001, 0x106) prctl$PR_SET_MM(0x23, 0x1, &(0x7f000011e000/0x2000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = inotify_init1(0x800) inotify_add_watch(r4, &(0x7f00000003c0)='./file0\x00', 0x600037c) umount2(&(0x7f0000000080)='./file0\x00', 0xb) 39.243754135s ago: executing program 7 (id=1109): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x38, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) stat(0x0, 0x0) setxattr$system_posix_acl(0x0, 0x0, &(0x7f0000019600)=ANY=[@ANYBLOB="02000000010003000000000002", @ANYRES16, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x64, 0x1) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x1a, 0x0, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.1GB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000100)=0x2, 0x12) r2 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r2, &(0x7f0000000380)=""/102392, 0x18ff8) socket$inet6_udp(0xa, 0x2, 0x0) r3 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r3, 0x2) close(r3) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000080)={0x8, &(0x7f0000000000)=[{0x9, 0x3, 0x7, 0x2c7}, {0x4, 0x0, 0x9, 0x1ddb}, {0x1000, 0xfe, 0x6, 0x8}, {0x3, 0x9, 0x2, 0x5}, {0x6, 0x1, 0x0, 0x200}, {0x4, 0xf7, 0xbf, 0x80000001}, {0xf55, 0x5, 0xdd, 0x92e}, {0xfffd, 0xc0, 0xc, 0x4}]}, 0x10) socket$kcm(0x2, 0x200000000000001, 0x106) prctl$PR_SET_MM(0x23, 0x1, &(0x7f000011e000/0x2000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = inotify_init1(0x800) inotify_add_watch(r4, &(0x7f00000003c0)='./file0\x00', 0x600037c) umount2(&(0x7f0000000080)='./file0\x00', 0xb) 38.404217826s ago: executing program 7 (id=1111): timerfd_create(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f00000001c0)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r4 = accept4$unix(r2, 0x0, 0x0, 0x0) recvmsg(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000005c0)=""/161, 0xa1}, {&(0x7f0000000680)=""/174, 0xae}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000000740)=""/117, 0x75}, {&(0x7f0000000540)=""/32, 0x20}], 0x5}, 0x10000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) readv(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000000)=""/38, 0x26}], 0x1) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x2, 0x0) write$uinput_user_dev(r6, &(0x7f0000000080)={'syz0\x00', {}, 0x14, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xd, 0x0, 0x0, 0xe3e, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8, 0xffffffff, 0x1, 0xa0d, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0xe, 0x0, 0x80000, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x4c6, 0x2, 0x0, 0x476f], [0x0, 0x7c, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffe, 0x2, 0x0, 0x0, 0x9, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x800], [0x2, 0x0, 0x6, 0x0, 0x0, 0x100, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x5, 0xfffffff8, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffffffd, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0x0, 0x0, 0x4, 0x0, 0x8001, 0x80, 0x0, 0x7fe, 0x0, 0x6, 0x6, 0x0, 0x0, 0x0, 0x4000, 0xfffffff8, 0x2, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x11) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002100)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000002300)={0x2020}, 0xfcdd) read$FUSE(r7, &(0x7f0000004480)={0x2020}, 0x2020) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0200000004000000040000000720000000040000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000100"], 0x50) 34.212916961s ago: executing program 7 (id=1123): syz_emit_vhci(&(0x7f0000001800)=ANY=[], 0xf) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00', r0}, 0x18) setsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x5, &(0x7f0000000140)=0x9, 0x4) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', 0x0, &(0x7f00000000c0)=ANY=[], 0x24, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) add_key(0x0, &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)="ed0e15c6af26165c6cb448f7da5f", 0xe, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x7c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe004681000000078a", 0x1e) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 33.855861779s ago: executing program 7 (id=1124): r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20088004, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1f}}, 0x7}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000080), 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0800000004000000040000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYRES64=0x0, @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f0800", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r4 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0eN\xa6>Fb\xa5|g\xacv\xfa\xf9\xfd\xa7So\x1f\xe2@\xcc\xca\x06\xb3{D\xb1\xd4\xd4\xf1\xb3`\xf0\x1aB\xab\xe2a\xd7\xac\xc5,U\x88f6b\xae9e*7\xd9\xf4\xc4\x1d\xde\x92\x1e\xfcC\a\xcb\xe0\x9d\x95\x02#\xdbj\xcdg\x13\x90\xac\xb8\x83\xa3%RMz\xe6\xc8\xc2F%\xb8\x13\xc1\v\xd5*v5\x8a\xd8\x12\x93\xaaN\xf4\x10\x19Jx\xbc\xc4', 0x0) fallocate(r4, 0x21, 0x800657, 0x40000b7) r5 = fcntl$dupfd(r3, 0x0, r3) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r5, 0x4004550c, &(0x7f0000000380)) ioctl$IOCTL_START_ACCEL_DEV(r5, 0x40096102, &(0x7f0000000140)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) io_cancel(0x0, 0xfffffffffffffffc, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000c00)=ANY=[@ANYBLOB="61128c00000000006113860000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf670000000000001500fdff0fff52e84407000009300000240600000ee60000bf050000000000001c63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070400000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f2686ee970d6482a2e71a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387bfa1bc9b49da28724ba9cd79fbee8f97af876d0e30c19555ffdd7d73815b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f42407107000cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08124d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cb003841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e75414c91fce6c86287945bd8d258442760000ff010000000000000000000000300807f2f3906c1d45d05ba9df828d35376fed399fa311ff63a34f0c0b82b4f2825e729eb9b7f4c9ab3be5bc011ff29904bbc424880247fabe7325a6e8d139e99d2b2fbf7e84fca3b21c78840b858ce900a4eb9c2b8b9b7fb664d2aeac991ca09b1afc0ef7aed4541a2f7275130a9fa3853481c81e919c000000000000000000000000b1e0e4b55e0d5d8c657b4853fc18ec43be33e5f971cceda04d95c87489910ce692ee55c536d1671bffd4c9b98efb741b13f0ab26ac191c74"], &(0x7f0000000100)='GPL\x00'}, 0x48) r6 = socket(0x25, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) sendmsg$nl_route_sched(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x40840}, 0x4000000) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r7, r7, 0x2f}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r10 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r9, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r10, 0x4) r11 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000580)=r9, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000500)={r11, r8, 0x4, r8}, 0x10) syz_init_net_socket$bt_sco(0x9, 0x5, 0x2) 18.539408031s ago: executing program 35 (id=1124): r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20088004, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1f}}, 0x7}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000080), 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0800000004000000040000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYRES64=0x0, @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f0800", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r4 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0eN\xa6>Fb\xa5|g\xacv\xfa\xf9\xfd\xa7So\x1f\xe2@\xcc\xca\x06\xb3{D\xb1\xd4\xd4\xf1\xb3`\xf0\x1aB\xab\xe2a\xd7\xac\xc5,U\x88f6b\xae9e*7\xd9\xf4\xc4\x1d\xde\x92\x1e\xfcC\a\xcb\xe0\x9d\x95\x02#\xdbj\xcdg\x13\x90\xac\xb8\x83\xa3%RMz\xe6\xc8\xc2F%\xb8\x13\xc1\v\xd5*v5\x8a\xd8\x12\x93\xaaN\xf4\x10\x19Jx\xbc\xc4', 0x0) fallocate(r4, 0x21, 0x800657, 0x40000b7) r5 = fcntl$dupfd(r3, 0x0, r3) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r5, 0x4004550c, &(0x7f0000000380)) ioctl$IOCTL_START_ACCEL_DEV(r5, 0x40096102, &(0x7f0000000140)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) io_cancel(0x0, 0xfffffffffffffffc, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000c00)=ANY=[@ANYBLOB="61128c00000000006113860000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf670000000000001500fdff0fff52e84407000009300000240600000ee60000bf050000000000001c63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070400000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f2686ee970d6482a2e71a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387bfa1bc9b49da28724ba9cd79fbee8f97af876d0e30c19555ffdd7d73815b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f42407107000cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08124d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cb003841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e75414c91fce6c86287945bd8d258442760000ff010000000000000000000000300807f2f3906c1d45d05ba9df828d35376fed399fa311ff63a34f0c0b82b4f2825e729eb9b7f4c9ab3be5bc011ff29904bbc424880247fabe7325a6e8d139e99d2b2fbf7e84fca3b21c78840b858ce900a4eb9c2b8b9b7fb664d2aeac991ca09b1afc0ef7aed4541a2f7275130a9fa3853481c81e919c000000000000000000000000b1e0e4b55e0d5d8c657b4853fc18ec43be33e5f971cceda04d95c87489910ce692ee55c536d1671bffd4c9b98efb741b13f0ab26ac191c74"], &(0x7f0000000100)='GPL\x00'}, 0x48) r6 = socket(0x25, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) sendmsg$nl_route_sched(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x40840}, 0x4000000) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r7, r7, 0x2f}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r10 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r9, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r10, 0x4) r11 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000580)=r9, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000500)={r11, r8, 0x4, r8}, 0x10) syz_init_net_socket$bt_sco(0x9, 0x5, 0x2) 8.312734557s ago: executing program 2 (id=1192): setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000180)={0x111, 0x5, 0x800}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ptrace(0x8, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x200400) syz_open_dev$vbi(0x0, 0x0, 0x2) r2 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="1e27d7c2a7fc74f1b70400000800000085000000950000009500000000000007e1f5fc88398533a2a31170f794f9a500eb5fc7274b03022706806f80b4c2a395d29108f976a4b7ea42a1dd5f0befeba63c581d819f26cf5cbb7bf3479a1dcc1f78646b87f3b8bebdc5b22357066a29c86aeb238b0fa923a40000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10) preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r2, 0x4004510d, &(0x7f0000000000)) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) gettid() r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r5, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x200001}, {{0x0, 0x0, 0x0}, 0x200}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}, 0x409}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/130, 0x82}, {&(0x7f0000001a00)=""/4109, 0x100d}, {&(0x7f0000006080)=""/4085, 0xff5}, {&(0x7f0000000340)=""/113, 0x71}, {0x0}, {&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000003c0)=""/100, 0x64}, {0x0}], 0x8}, 0x4db}, {{0x0, 0x0, 0x0}, 0x2}], 0x7, 0x20000, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x39, 0x0, @thr={0x0, &(0x7f00000007c0)="8700ce0bc89e8283082ccc47363814fc9bcc0e7522b190110bc257698a1f9d0981016b437d04d98d5c0f4b5dcf4c3565673606dc2d1f6e1382cddb7d0c788767f677caeaa1f8a7a37bdb7f7dc7ef27350a1f4a3a2e9e0db56a16da4a05f80fbc4678648b84"}}, 0x0) sendfile(r7, r6, &(0x7f0000002080)=0x64, 0x21c) 8.282303784s ago: executing program 0 (id=1193): socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff, 0x1}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000280)={r1, r1, 0x5, 0x0, 0x0, 0x48, 0x1, 0x5, 0x3ff, 0x8, 0x42580ee71228cd0d, 0x0, 'syz1\x00'}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mount$bind(0x0, 0x0, 0x0, 0x400, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r3, 0x40096101, &(0x7f0000000800)={{}, 0xfe}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000011c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000801) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003400000100e140005"], 0x80}, 0x1, 0x0, 0x0, 0x4000010}, 0x4) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 6.970401645s ago: executing program 1 (id=1195): openat$dir(0xffffffffffffff9c, 0x0, 0x10000, 0x6b) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) syz_open_dev$sndctrl(0x0, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000040), 0x0, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file2'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@nfs_export_off}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x1c2) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 6.923351763s ago: executing program 6 (id=1196): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 6.721120691s ago: executing program 6 (id=1197): openat$dir(0xffffffffffffff9c, 0x0, 0x10000, 0x6b) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) syz_open_dev$sndctrl(0x0, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000040), 0x0, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file2'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@nfs_export_off}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x1c2) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 5.956873803s ago: executing program 2 (id=1198): socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8080, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfec8d000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r6, &(0x7f0000000180)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r6, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000550001000000000000c4000007008209", @ANYRES32=r8, @ANYBLOB="20000100", @ANYRES32=r8, @ANYBLOB="00000000e000030000000000000000000000000008"], 0x38}}, 0x0) r9 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r9) execve(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000140)={0x4200, 0x3, 0x5}, 0x10) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='cifs\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) syz_pidfd_open(0x0, 0x0) r11 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r11, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 5.784039414s ago: executing program 0 (id=1199): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48000000060a09040000000000000000020000031c00048018400180080001006c6f67000c00028008000640000000080900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x70}, 0x1, 0x0, 0x0, 0x200088d1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000019380)=ANY=[@ANYRESDEC=r0, @ANYBLOB="789c2f3e890a3b2f0ed5f88562564f6c1860a6928fb677244ad9d667de4e87603bbb743c02d02f36ad3ad34b9d7c69229c896388a9a56743287ef693a35c68bb9672b27e465363b5d1445440c5cb8af777e476ac699fd0fe7475a2e6a3e896f05b2b1899e2878d1e84a6b7a0b615a23b07fd3295f40c9a4a40e6aac83e5806be4ad0f627318d14f1c280d508ee0bf4cb0e3257ed4ceb5a8c32fb235b36bd6e7c4e83c8e1f1e8f3d9e3c94bcd80a5dd83840ce8c4525505ce4e8d81b481d4fccf2f22a62c07e94146f59b0a2c950c3d5323d1cc93aa7a217c5ae0f2e2db1f5de5ec70c7d8bc76a5f4ae669899ca09475b200520a9d8a81c", @ANYRESOCT=0x0, @ANYRES32=r0, @ANYBLOB="6b40d4c362a2824c27c98f88f8831a9d4a5ed41be78298e75faa8790ce04ff02e3a3017f83b9cbe9f594c5cb4b381308b0ef1e085d3b3591449f687c4dfd942a85b02e972fde85"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000019100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYRES32=r1], 0x528}, 0x1, 0x0, 0x0, 0x4000}, 0xc000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xb, 0x9, 0xfffffffc}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'c6xdigio\x00', [0xb02f, 0x7ff, 0xe2, 0x3, 0x88d3, 0x8d, 0x1007, 0x1, 0x1002, 0xffffffff, 0x200, 0x7, 0x10000009, 0x1, 0x5, 0x401, 0x8, 0x3, 0x9, 0x8e, 0x8, 0x4003, 0x7, 0xa, 0x5, 0x1, 0xb0c4, 0x8, 0xff, 0x400002, 0x4000001]}) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r5, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, &(0x7f0000019080)={0xc0000000}) request_key(&(0x7f0000000140)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000380)='/dev/ttyS3\x00', 0xffffffffffffffff) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000900)={'bridge0\x00', @random="000000000100"}) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_getattr(0x0, &(0x7f00000190c0)={0x38}, 0x38, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) socket$inet6(0xa, 0x2, 0x3a) 4.999944754s ago: executing program 2 (id=1200): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 4.825414795s ago: executing program 2 (id=1201): sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1, 0x0, 0x0, 0x700}}], 0x1, 0x20008000) socket(0xa, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "60000100", "9de66ebc3914c06f0f109088d190e700", "000e3102", "f8dde5bf3eba23db"}, 0x28) 4.115768474s ago: executing program 0 (id=1202): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274000000"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000000)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0xeeee0000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f0000000800)=""/87, &(0x7f0000000780)=""/96}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TIOCVHANGUP(r4, 0x5437, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) 3.971608924s ago: executing program 6 (id=1203): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x40300, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) mount$binderfs(0x0, 0x0, 0x0, 0x80086, &(0x7f0000000100)=ANY=[@ANYBLOB='max=']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c8, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0xffffffffffffffff, 0x0, 0x80000004000000, 0x200000000e], 0x80a0000, 0x2018d3}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000300)=ANY=[@ANYRESDEC=r0, @ANYRES16=r1, @ANYRES64=r0]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r5, &(0x7f0000000180), 0x3ef, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x69b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.934936985s ago: executing program 1 (id=1204): syz_emit_ethernet(0x7a, &(0x7f0000000340)=ANY=[@ANYBLOB="aa88aaaae90209fd01dd390300002b00fc0206000000003200000000000000010420880b000000000004080086dd08ff9d052b147e4cf7eb2513ee9148980dfded42a283c4923364bf835685a872fef5509b0715954c3f1b8e0ff53c56b45f82b34b80a54d07a67fb021804ccb9df881dc8d059fb3606adc75cc5af8f9894817a3ff6b8404ae1eb4efb422a6fc9916d6b08d3628b71b1131401938afe726137fec94e2c97fd2555c964fd7940827b519c567f20060d3e7bce2cf8b4ea61e8345"], 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8080, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfec8d000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r6, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000550001000000000000c4000007008209", @ANYRES32=r7, @ANYBLOB=' \x00\t\x00', @ANYRES32=r7, @ANYBLOB="00000000e000030000000000000000000000000008"], 0x38}}, 0x0) r8 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r8) execve(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000140)={0x4200, 0x3, 0x5}, 0x10) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='cifs\x00', 0xfffff000, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) syz_pidfd_open(0x0, 0x0) r10 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r10, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 3.8675863s ago: executing program 0 (id=1205): setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000180)={0x111, 0x5, 0x800}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ptrace(0x8, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x200400) syz_open_dev$vbi(0x0, 0x0, 0x2) r2 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="1e27d7c2a7fc74f1b70400000800000085000000950000009500000000000007e1f5fc88398533a2a31170f794f9a500eb5fc7274b03022706806f80b4c2a395d29108f976a4b7ea42a1dd5f0befeba63c581d819f26cf5cbb7bf3479a1dcc1f78646b87f3b8bebdc5b22357066a29c86aeb238b0fa923a40000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10) preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r2, 0x4004510d, &(0x7f0000000000)) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) gettid() r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r5, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x200001}, {{0x0, 0x0, 0x0}, 0x200}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}, 0x409}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/130, 0x82}, {&(0x7f0000001a00)=""/4109, 0x100d}, {&(0x7f0000006080)=""/4085, 0xff5}, {&(0x7f0000000340)=""/113, 0x71}, {0x0}, {&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000003c0)=""/100, 0x64}, {0x0}], 0x8}, 0x4db}, {{0x0, 0x0, 0x0}, 0x2}], 0x7, 0x20000, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x39, 0x0, @thr={0x0, &(0x7f00000007c0)="8700ce0bc89e8283082ccc47363814fc9bcc0e7522b190110bc257698a1f9d0981016b437d04d98d5c0f4b5dcf4c3565673606dc2d1f6e1382cddb7d0c788767f677caeaa1f8a7a37bdb7f7dc7ef27350a1f4a3a2e9e0db56a16da4a05f80fbc4678648b84"}}, 0x0) sendfile(r7, r6, &(0x7f0000002080)=0x64, 0x21c) 3.862941259s ago: executing program 2 (id=1206): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) syz_io_uring_setup(0x891, &(0x7f0000000140)={0x0, 0x8c36, 0x80, 0x2, 0xbfdffdfc}, &(0x7f0000000000)=0x0, 0x0) gettid() setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000340), 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) readv(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) rt_sigaction(0x36, &(0x7f0000000440)={0x0, 0x28000003, &(0x7f0000000400)="c462392e2d51c90000c4621d2984c690821748c4a27d197e822e0f0f9c6bca000000aac462a128dd0fec859400000043dfed460f2d68903e7a08660f3803e1", {[0x6]}}, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x4f, 0x0, 0x1, 0x70bd25, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x4}]}, 0x20}}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x40810) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000040)={0x0, 0x7, 0x1, 0xfffffffd, 0x5, 0x9, "3000000502000000000000000400", 0x0, 0x0, 0x4a, 0x8, 0x0, 0x4, 0xe}) syz_io_uring_submit(r0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) pidfd_getfd(r5, r5, 0x0) 2.893578909s ago: executing program 6 (id=1207): r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f00000000c0)={{}, {0x77359400}}, 0x0) clock_settime(0x0, &(0x7f0000003c80)={0x77359400}) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{}, {0x77359400}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0x20, &(0x7f0000000400)={&(0x7f0000000280)=""/141, 0x8d, 0x0, &(0x7f00000003c0)=""/33, 0x21}}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) r7 = msgget$private(0x0, 0x0) msgsnd(r7, &(0x7f0000000340)=ANY=[@ANYBLOB='\v\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0) msgctl$IPC_RMID(r7, 0x0) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r8, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r8, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c000000700000022deb6a00fddbdff3ad8ea140", @ANYRES32=r9, @ANYBLOB="edfe01800000048000000100020000000c00018052ff0100280002000c0001800800010003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40804}, 0x4) 2.769584318s ago: executing program 1 (id=1208): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x4}, 0x50) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x22800, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{0x1, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000002c0)}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x18, 0x20, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x8f}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@btf_id={0x18, 0x5, 0x3, 0x0, 0x4}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x180, 0x0) socket(0x2, 0x80805, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r4, &(0x7f0000007700), 0x318, 0xfc0, 0x0) msgctl$IPC_SET(0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) 1.962890102s ago: executing program 6 (id=1209): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001380)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {}, {}, {0x5, 0xb}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="010000000400000004000000"], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0xf1) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000380), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x92) mknodat(r6, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./bus\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./bus\x00', 0x0) chdir(&(0x7f0000000080)='./bus\x00') renameat2(r7, &(0x7f00000001c0)='./file0\x00', r7, &(0x7f0000000200)='./bus/file0\x00', 0x0) open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) 1.629492894s ago: executing program 1 (id=1210): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a3100000000050001000700"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 1.464331405s ago: executing program 1 (id=1211): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000004700), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000004780)={0xa10000, 0x200, 0x5, 0xffffffffffffffff, 0x0, &(0x7f0000004740)={0x980927, 0xf3f, '\x00', @value64=0x56b}}) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x800) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRES16, @ANYBLOB="010029bd72007b3f0b8ebd073359b8bc9eb000002b1443dca93df5"], 0x30}, 0x1, 0x0, 0x0, 0x20000855}, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000040000000001, 0xffffffffffffffff}) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.302971949s ago: executing program 8 (id=1166): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) io_uring_setup(0x4822, &(0x7f0000000180)={0x0, 0x0, 0x40}) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0), 0x80000, 0x0) ioctl$RTC_WKALM_SET(r4, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x15, 0x1a, 0x12, 0x0, 0x4, 0xe80, 0x5, 0x40}}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES8=r5], 0x20}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='gretap0\x00', 0x10) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800e00010069703665727370616e00000030000280140006002001000000000000000000000000000214000700fc02000000000000000000000000000004001200"], 0x64}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="28000000100001000100"/20, @ANYRES32=0x0, @ANYBLOB="200400f5b09a3965b2f800fac56f247e5dba214d7bbd87dcc2478e23a1f2b99beae6c45d3748072cfc15f815199bafaa89f78192ef39a6c0a77ee051028c07bc4535d8b5b004bcf45962920a40c7f43248a275ba6cc5b52026461b7fa2dd7438d7ecb5b8a118"], 0x28}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xae, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8003}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), &(0x7f0000000040)=@tcp6=r2}, 0x20) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000540)) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/75, 0x0}) r9 = dup(r8) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r9}) syz_emit_ethernet(0x3a, &(0x7f00000001c0)=ANY=[], 0x0) 974.564247ms ago: executing program 6 (id=1212): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x5, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0500000004000000040000000900000000000000", @ANYRES32=0x1, @ANYBLOB="ff00000000000000000000000000000000000000cbba15d4f7fbca531e80aff71edee693429b7f556b298bbf2a250f847f623281d42699755f1a82019323334d84ff1006aeaeca4a21c065133d86b3d2104bea612ad62b8410771dcca09b25f8939b42ad4c75eca826743f09beca59d618d6ca07fb800a96135592b57862c09523f4ba1f00c23ddb420db5aa66b3beccbe135fa389aff8532063c69004f93548c68e4a78c4a3e061725b17ba9479638e4a422643937f3ae603cde2c5e2", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='sys_exit\x00', r1, 0x0, 0x4000000000000004}, 0x18) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000001600)) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, 0x0) setresgid(0xee00, 0x0, 0xee00) getresgid(&(0x7f0000000080)=0x0, &(0x7f0000000340), &(0x7f0000000380)) setgid(r3) r4 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r5) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r6 = syz_open_procfs(r4, &(0x7f0000000400)='ns\x00') readlinkat(r6, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000440)=""/163, 0xa3) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x14, &(0x7f0000000140), 0x106, 0x9}}, 0x20) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000400)) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) 970.10433ms ago: executing program 0 (id=1213): r0 = syz_open_procfs(0x0, 0x0) memfd_create(0x0, 0x7) r1 = openat$comedi(0xffffff9c, &(0x7f0000000440)='/dev/comedi0\x00', 0x101001, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000200)={0x0, 0x0}) get_robust_list(r2, &(0x7f00000003c0)=&(0x7f0000000380)={&(0x7f00000002c0)={&(0x7f0000000040)}, 0x0, &(0x7f0000000340)={&(0x7f0000000300)}}, &(0x7f0000000400)=0x18) syz_emit_ethernet(0x56, &(0x7f0000001180)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb000d0000000012020000f0de2f00fff4d255a1108322a8754f9cd05431e1e6"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) setresuid(r4, r4, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = mq_open(&(0x7f0000000080)='$@\x00', 0x40, 0xb2, 0x0) fcntl$setlease(r6, 0x400, 0x100000000000000) mq_open(&(0x7f0000000140)='$@\x00', 0x1, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000f751ae40510410341eef0102030109022401000000000904000002a80f60000905040200000000000905820200000077a2d4b0a7315afdf6015e55356e46ebbe5fef63fae63e99226acf72df0a87bea58cafe9d87ff5"], 0x0) open$dir(&(0x7f0000000480)='./file0\x00', 0x800, 0x54) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x20000000, 0x3, 0x5, 0x2f, 0x7, 0x7, 0x5, 0xffe, 0x1, 0x0, 0x7ff, 0x1003, 0x4, 0xffff, 0xffff, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x3, 0x10, 0x0, 0x8, 0xe2dc, 0x746f, 0x8, 0x5, 0x3, 0xfffffff9, 0x4, 0x8049]}) 964.068497ms ago: executing program 2 (id=1214): openat$dir(0xffffffffffffff9c, 0x0, 0x10000, 0x6b) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) syz_open_dev$sndctrl(0x0, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000040), 0x0, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file2'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@nfs_export_off}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x1c2) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 555.543825ms ago: executing program 8 (id=1215): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274000000"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000000)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0xeeee0000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f0000000800)=""/87, &(0x7f0000000780)=""/96}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TIOCVHANGUP(r4, 0x5437, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) 349.526573ms ago: executing program 1 (id=1216): socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff, 0x1}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000280)={r1, r1, 0x5, 0x0, 0x0, 0x48, 0x1, 0x5, 0x3ff, 0x8, 0x42580ee71228cd0d, 0x0, 'syz1\x00'}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mount$bind(0x0, 0x0, 0x0, 0x400, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r3, 0x40096101, &(0x7f0000000800)={{}, 0xfe}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000011c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000801) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003400000100e140005"], 0x80}, 0x1, 0x0, 0x0, 0x4000010}, 0x4) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 0s ago: executing program 0 (id=1217): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="1400000010000100feff0000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011"], 0x84}, 0x1, 0x0, 0x0, 0x24004050}, 0x20000044) kernel console output (not intermixed with test programs): a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 348.222176][ T5875] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 348.245973][ T5875] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 348.267296][ T5875] usb 4-1: media controller created [ 348.275813][ T9153] can0 (unregistered): slcan off ttyS3. [ 348.293360][ T5875] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 348.477797][ T9169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.491236][ T9169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.619521][ T5875] DVB: Unable to find symbol tda10046_attach() [ 348.629397][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 348.629410][ T30] audit: type=1400 audit(1760874370.477:1071): avc: denied { create } for pid=9149 comm="syz.1.799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 349.078095][ T5875] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 349.087061][ T30] audit: type=1400 audit(1760874370.477:1072): avc: denied { setopt } for pid=9149 comm="syz.1.799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 349.106535][ T5875] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 349.159461][ T9179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 349.212544][ T9179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.303467][ T5944] waltop 0003:172F:0034.0003: unknown main item tag 0x0 [ 349.327894][ T5944] waltop 0003:172F:0034.0003: item fetching failed at offset 4/5 [ 349.338646][ T5944] waltop 0003:172F:0034.0003: probe with driver waltop failed with error -22 [ 349.818883][ T9189] fuse: Unknown parameter 'user_i00000000000000000000' [ 350.813722][ T5875] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 350.852653][ T5875] usb 4-1: USB disconnect, device number 11 [ 350.952853][ T9203] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.961572][ T9203] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.927503][ T5875] usb 2-1: USB disconnect, device number 14 [ 354.090247][ T9237] netlink: 20 bytes leftover after parsing attributes in process `syz.3.814'. [ 354.428922][ T30] audit: type=1400 audit(1760874376.147:1073): avc: denied { ioctl } for pid=9239 comm="syz.2.816" path="socket:[24603]" dev="sockfs" ino=24603 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 354.492273][ T9243] ieee802154 phy0 wpan0: encryption failed: -22 [ 354.780538][ T9249] fuse: Unknown parameter 'user_id00000000000000000000' [ 355.734770][ T30] audit: type=1400 audit(1760874377.577:1074): avc: denied { getopt } for pid=9257 comm="syz.2.819" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 355.973427][ T30] audit: type=1400 audit(1760874377.787:1075): avc: denied { read } for pid=9264 comm="syz.3.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 356.325279][ T30] audit: type=1400 audit(1760874377.897:1076): avc: denied { setopt } for pid=9264 comm="syz.3.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 356.469735][ T30] audit: type=1400 audit(1760874377.897:1077): avc: denied { write } for pid=9264 comm="syz.3.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 356.772034][ T9280] netlink: 20 bytes leftover after parsing attributes in process `syz.2.823'. [ 358.466299][ T3000] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.508874][ T3000] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.621347][ T3000] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.691390][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 358.719450][ T3000] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.840511][ T30] audit: type=1400 audit(1760874380.677:1078): avc: denied { map } for pid=9294 comm="syz.0.828" path="socket:[23904]" dev="sockfs" ino=23904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 359.056371][ T30] audit: type=1400 audit(1760874380.677:1079): avc: denied { listen } for pid=9294 comm="syz.0.828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 359.081056][ T24] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 359.090383][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.112392][ T24] usb 6-1: Product: syz [ 359.250230][ T24] usb 6-1: Manufacturer: syz [ 359.257010][ T24] usb 6-1: SerialNumber: syz [ 360.893890][ T5831] Bluetooth: hci5: command 0x0406 tx timeout [ 361.461737][ T5820] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 361.622155][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 361.693913][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 361.726138][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 361.751457][ T24] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 361.849807][ T24] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 362.039873][ T24] usb 6-1: USB disconnect, device number 4 [ 362.115395][ T5820] usb 3-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 362.137911][ T5820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.174268][ T30] audit: type=1326 audit(1760874384.017:1080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.197533][ T5820] usb 3-1: Product: syz [ 362.197555][ T5820] usb 3-1: Manufacturer: syz [ 362.197568][ T5820] usb 3-1: SerialNumber: syz [ 362.215797][ T5820] usb 3-1: config 0 descriptor?? [ 362.261101][ T5820] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 362.306627][ T5820] pctv452e: pctv452e_power_ctrl: 1 [ 362.306627][ T5820] [ 362.306673][ T5820] usb 3-1: selecting invalid altsetting 3 [ 362.306688][ T5820] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 362.306688][ T5820] [ 362.306985][ T5820] dvb-usb: bulk message failed: -22 (5/0) [ 362.312458][ T5820] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 362.313578][ T5820] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 362.313626][ T5820] usb 3-1: media controller created [ 362.314283][ T5820] dvb-usb: bulk message failed: -22 (8/0) [ 362.314325][ T5820] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 362.314412][ T5820] dvb-usb: MAC address reading failed. [ 362.393141][ T30] audit: type=1326 audit(1760874384.017:1081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393172][ T30] audit: type=1326 audit(1760874384.017:1082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393194][ T30] audit: type=1326 audit(1760874384.017:1083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393216][ T30] audit: type=1326 audit(1760874384.017:1084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393238][ T30] audit: type=1326 audit(1760874384.017:1085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393259][ T30] audit: type=1326 audit(1760874384.017:1086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393282][ T30] audit: type=1326 audit(1760874384.017:1087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9321 comm="syz.5.833" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 362.393306][ T30] audit: type=1400 audit(1760874384.107:1088): avc: denied { remove_name } for pid=9326 comm="syz.0.834" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 362.393327][ T30] audit: type=1400 audit(1760874384.107:1089): avc: denied { unlink } for pid=9326 comm="syz.0.834" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 362.411524][ T5820] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 362.612902][ T9316] netlink: 24 bytes leftover after parsing attributes in process `syz.2.830'. [ 362.627364][ T9316] veth1_macvtap: left promiscuous mode [ 362.627390][ T9316] macsec0: entered allmulticast mode [ 363.029458][ T5820] DVB: Unable to find symbol stb0899_attach() [ 363.029476][ T5820] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 363.131597][ T5820] rc_core: IR keymap rc-tt-1500 not found [ 363.131619][ T5820] Registered IR keymap rc-empty [ 363.132652][ T5820] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 363.134224][ T5820] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input53 [ 363.491628][ T5820] dvb-usb: schedule remote query interval to 100 msecs. [ 363.491644][ T5820] pctv452e: pctv452e_power_ctrl: 0 [ 363.491644][ T5820] [ 363.491651][ T5820] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 363.493417][ T5820] usb 3-1: USB disconnect, device number 15 [ 363.603231][ T5820] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 363.860628][ C1] vkms_vblank_simulate: vblank timer overrun [ 364.482160][ T9327] tty tty3: ldisc open failed (-12), clearing slot 2 [ 364.654728][ T9345] input: syz0 as /devices/virtual/input/input54 [ 364.661341][ T9345] input: failed to attach handler leds to device input54, error: -6 [ 364.791350][ T5820] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 365.141767][ T5820] usb 6-1: Invalid ep0 maxpacket: 32 [ 365.239253][ T9352] loop2: detected capacity change from 0 to 7 [ 365.262266][ T9352] Dev loop2: unable to read RDB block 7 [ 365.271390][ T5820] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 365.287132][ T9352] loop2: unable to read partition table [ 365.331872][ T9352] loop2: partition table beyond EOD, truncated [ 365.346230][ T9352] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 365.461374][ T5820] usb 6-1: Invalid ep0 maxpacket: 32 [ 365.541587][ T5820] usb usb6-port1: attempt power cycle [ 365.911362][ T5820] usb 6-1: new low-speed USB device number 7 using dummy_hcd [ 365.981881][ T5820] usb 6-1: Invalid ep0 maxpacket: 32 [ 366.117495][ T9365] can0: slcan on ttyS3. [ 366.141498][ T5820] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 366.502017][ T5820] usb 6-1: Invalid ep0 maxpacket: 32 [ 366.507914][ T5820] usb usb6-port1: unable to enumerate USB device [ 366.812026][ T9364] can0 (unregistered): slcan off ttyS3. [ 369.066758][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 369.066786][ T30] audit: type=1326 audit(1760874390.917:1101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 369.265678][ T30] audit: type=1326 audit(1760874391.057:1102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 369.369443][ T9398] FAULT_INJECTION: forcing a failure. [ 369.369443][ T9398] name failslab, interval 1, probability 0, space 0, times 0 [ 369.383694][ T9398] CPU: 0 UID: 0 PID: 9398 Comm: syz.0.850 Not tainted syzkaller #0 PREEMPT(full) [ 369.383717][ T9398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 369.383728][ T9398] Call Trace: [ 369.383734][ T9398] [ 369.383741][ T9398] dump_stack_lvl+0x16c/0x1f0 [ 369.383780][ T9398] should_fail_ex+0x512/0x640 [ 369.383801][ T9398] ? __kmalloc_node_track_caller_noprof+0xcb/0x8a0 [ 369.383834][ T9398] should_failslab+0xc2/0x120 [ 369.383861][ T9398] __kmalloc_node_track_caller_noprof+0xde/0x8a0 [ 369.383885][ T9398] ? smb3_parse_devname+0xfd/0x480 [ 369.383917][ T9398] ? kstrndup+0x6d/0x160 [ 369.383936][ T9398] kstrndup+0x6d/0x160 [ 369.383958][ T9398] smb3_parse_devname+0xfd/0x480 [ 369.383987][ T9398] smb3_fs_context_parse_param+0x33eb/0xa170 [ 369.384019][ T9398] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 369.384050][ T9398] ? __pfx_selinux_fs_context_parse_param+0x10/0x10 [ 369.384082][ T9398] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 369.384112][ T9398] ? vfs_parse_fs_param+0x20b/0x3c0 [ 369.384137][ T9398] vfs_parse_fs_param+0x20b/0x3c0 [ 369.384164][ T9398] __do_sys_fsconfig+0x930/0xbe0 [ 369.384185][ T9398] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 369.384202][ T9398] ? __pfx_sched_clock_cpu+0x10/0x10 [ 369.384226][ T9398] ? __pfx___rdmsr_safe_on_cpu+0x10/0x10 [ 369.384251][ T9398] do_syscall_64+0xcd/0xfa0 [ 369.384276][ T9398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.384294][ T9398] RIP: 0033:0x7f212a98efc9 [ 369.384308][ T9398] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 369.384324][ T9398] RSP: 002b:00007f2128bd5038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 369.384339][ T9398] RAX: ffffffffffffffda RBX: 00007f212abe6090 RCX: 00007f212a98efc9 [ 369.384349][ T9398] RDX: 0000200000000400 RSI: 0000000000000001 RDI: 0000000000000005 [ 369.384359][ T9398] RBP: 00007f2128bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 369.384369][ T9398] R10: 0000200000001bc0 R11: 0000000000000246 R12: 0000000000000001 [ 369.384379][ T9398] R13: 00007f212abe6128 R14: 00007f212abe6090 R15: 00007ffd27c40368 [ 369.384405][ T9398] [ 369.385200][ T9398] CIFS: VFS: Unable to allocate memory for devname [ 369.826960][ T9400] netlink: 16 bytes leftover after parsing attributes in process `syz.2.849'. [ 370.061704][ T30] audit: type=1326 audit(1760874391.057:1103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 370.157584][ T9400] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 370.199534][ T30] audit: type=1326 audit(1760874391.057:1104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 370.450573][ T30] audit: type=1326 audit(1760874391.057:1105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 370.579573][ T30] audit: type=1326 audit(1760874391.057:1106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 370.631208][ T9414] ieee802154 phy0 wpan0: encryption failed: -22 [ 370.690900][ T30] audit: type=1326 audit(1760874391.057:1107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 370.810867][ T9417] netlink: 16 bytes leftover after parsing attributes in process `syz.2.853'. [ 371.101429][ T30] audit: type=1326 audit(1760874391.057:1108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 371.241424][ T30] audit: type=1326 audit(1760874391.057:1109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 371.264736][ C1] vkms_vblank_simulate: vblank timer overrun [ 371.347204][ T9410] netlink: 20 bytes leftover after parsing attributes in process `syz.0.851'. [ 371.427414][ T30] audit: type=1326 audit(1760874391.967:1110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9386 comm="syz.5.848" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca29d8efc9 code=0x7ffc0000 [ 371.450730][ C1] vkms_vblank_simulate: vblank timer overrun [ 371.688794][ T9433] can0: slcan on ttyS3. [ 373.150388][ T9442] can0 (unregistered): slcan off ttyS3. [ 373.163052][ T5831] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 373.175225][ T5831] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 373.193429][ T5831] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 373.211955][ T5831] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 373.219597][ T5831] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 373.957131][ T9459] chnl_net:caif_netlink_parms(): no params data found [ 374.163839][ T9480] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 374.182011][ T9480] ./file0: Can't lookup blockdev [ 375.182682][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 375.182703][ T30] audit: type=1326 audit(1760874397.037:1130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 375.216409][ T30] audit: type=1326 audit(1760874397.037:1131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 375.241430][ T10] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 375.262373][ T30] audit: type=1326 audit(1760874397.037:1132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 375.285768][ C1] vkms_vblank_simulate: vblank timer overrun [ 375.295640][ T5821] Bluetooth: hci6: command tx timeout [ 375.431383][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 375.446777][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 375.499941][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.541013][ T10] usb 1-1: config 0 descriptor?? [ 375.782116][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 375.814418][ T10] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 375.845116][ T10] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 375.926455][ T30] audit: type=1326 audit(1760874397.037:1133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.008650][ T30] audit: type=1326 audit(1760874397.037:1134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.033787][ T9459] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.060024][ T9459] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.087852][ T9459] bridge_slave_0: entered allmulticast mode [ 376.100492][ T30] audit: type=1326 audit(1760874397.067:1135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.161496][ T30] audit: type=1326 audit(1760874397.067:1136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.161550][ T9459] bridge_slave_0: entered promiscuous mode [ 376.212468][ T30] audit: type=1326 audit(1760874397.067:1137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.261918][ T30] audit: type=1326 audit(1760874397.167:1138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.338568][ T30] audit: type=1326 audit(1760874397.687:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9482 comm="syz.2.865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x7ffc0000 [ 376.362618][ T9459] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.369915][ T9459] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.378004][ T9459] bridge_slave_1: entered allmulticast mode [ 376.381202][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 376.385364][ T9459] bridge_slave_1: entered promiscuous mode [ 376.454682][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 376.484411][ T9459] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.515440][ T9459] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.526197][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 376.539312][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 376.557255][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 376.631151][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 376.641520][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 376.654565][ T9491] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 376.665237][ T9491] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 376.764090][ T9459] team0: Port device team_slave_0 added [ 376.771068][ T9459] team0: Port device team_slave_1 added [ 377.371915][ T5821] Bluetooth: hci6: command tx timeout [ 378.260157][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.276590][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.995216][ T9459] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 379.050314][ T9459] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.076388][ C0] vkms_vblank_simulate: vblank timer overrun [ 379.082599][ T9459] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 379.096789][ T9459] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 379.104962][ T9459] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.131149][ C0] vkms_vblank_simulate: vblank timer overrun [ 379.140331][ T9459] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 379.205809][ T9506] can0: slcan on ttyS3. [ 379.451360][ T5821] Bluetooth: hci6: command tx timeout [ 379.600026][ T5937] IPVS: starting estimator thread 0... [ 380.482141][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 380.482160][ T30] audit: type=1400 audit(1760874401.327:1142): avc: denied { bind } for pid=9508 comm="syz.1.871" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 380.941449][ T9512] IPVS: using max 47 ests per chain, 112800 per kthread [ 381.333429][ T9505] can0 (unregistered): slcan off ttyS3. [ 381.369200][ T9459] hsr_slave_0: entered promiscuous mode [ 381.380248][ T9521] ieee802154 phy0 wpan0: encryption failed: -22 [ 381.427833][ T9459] hsr_slave_1: entered promiscuous mode [ 381.458970][ T9459] debugfs: 'hsr0' already exists in 'hsr' [ 381.477396][ T9459] Cannot create hsr debugfs directory [ 381.569256][ T5821] Bluetooth: hci6: command tx timeout [ 381.579901][ T9517] netlink: 20 bytes leftover after parsing attributes in process `syz.1.873'. [ 382.968472][ T9459] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 383.144630][ T9459] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 383.328522][ T9459] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 383.500659][ T9459] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 383.741417][ T5875] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 383.991514][ T5875] usb 6-1: device descriptor read/64, error -71 [ 384.428736][ T5875] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 384.731406][ T5875] usb 6-1: device descriptor read/64, error -71 [ 384.825961][ T30] audit: type=1326 audit(1760874406.647:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 384.870289][ T5875] usb usb6-port1: attempt power cycle [ 384.906123][ T9459] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.963975][ T30] audit: type=1326 audit(1760874406.647:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.043455][ T30] audit: type=1326 audit(1760874406.647:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.090843][ T9459] 8021q: adding VLAN 0 to HW filter on device team0 [ 385.146401][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.153532][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 385.203026][ T30] audit: type=1326 audit(1760874406.647:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.269245][ T5875] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 385.294957][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.302139][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 385.333491][ T5875] usb 6-1: device descriptor read/8, error -71 [ 385.387728][ T30] audit: type=1326 audit(1760874406.647:1147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.452343][ T5944] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 385.512863][ T30] audit: type=1326 audit(1760874406.647:1148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.611905][ T5875] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 385.651673][ T5944] usb 3-1: Using ep0 maxpacket: 32 [ 385.661168][ T5875] usb 6-1: device descriptor read/8, error -71 [ 385.681541][ T30] audit: type=1326 audit(1760874406.647:1149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.697976][ T5944] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 385.771306][ T5944] usb 3-1: config 0 has no interface number 0 [ 385.777466][ T5944] usb 3-1: config 0 interface 12 has no altsetting 0 [ 385.822898][ T30] audit: type=1326 audit(1760874406.647:1150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.847276][ T5875] usb usb6-port1: unable to enumerate USB device [ 385.848797][ T5944] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 385.901387][ T30] audit: type=1326 audit(1760874407.117:1151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 385.921701][ T5944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.952409][ T9591] can0: slcan on ttyS3. [ 386.030238][ T5944] usb 3-1: Product: syz [ 386.044410][ T5944] usb 3-1: Manufacturer: syz [ 386.055001][ T5944] usb 3-1: SerialNumber: syz [ 386.307846][ T5944] usb 3-1: config 0 descriptor?? [ 386.411384][ T30] audit: type=1326 audit(1760874407.117:1152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 386.450117][ T30] audit: type=1326 audit(1760874407.137:1153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 386.626200][ T9459] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 386.655293][ T30] audit: type=1326 audit(1760874407.137:1154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 386.724298][ T9589] can0 (unregistered): slcan off ttyS3. [ 386.859713][ T30] audit: type=1326 audit(1760874407.137:1155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1374b8d810 code=0x7ffc0000 [ 387.014019][ T30] audit: type=1326 audit(1760874407.137:1156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 387.231634][ T30] audit: type=1326 audit(1760874407.137:1157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9564 comm="syz.1.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 388.315397][ T9459] veth0_vlan: entered promiscuous mode [ 388.461855][ T9620] QAT: Stopping all acceleration devices. [ 388.473586][ T9620] netlink: 16 bytes leftover after parsing attributes in process `syz.0.888'. [ 388.826320][ T9459] veth1_vlan: entered promiscuous mode [ 388.981569][ T5944] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 389.033504][ T9459] veth0_macvtap: entered promiscuous mode [ 389.151419][ T5944] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 389.193864][ T9459] veth1_macvtap: entered promiscuous mode [ 389.213839][ T5944] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 389.249834][ T9459] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 389.395083][ T9459] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 389.414438][ T5944] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 389.569678][ T36] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.626876][ T36] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.656499][ T36] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.786557][ T36] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.809553][ T5944] usb 3-1: USB disconnect, device number 16 [ 389.883197][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 389.907464][ T9604] warn_alloc: 1 callbacks suppressed [ 389.907477][ T9604] syz.1.886: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 389.915028][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 390.201486][ T9604] ,cpuset=/,mems_allowed=0-1 [ 390.231377][ T9604] CPU: 0 UID: 0 PID: 9604 Comm: syz.1.886 Not tainted syzkaller #0 PREEMPT(full) [ 390.231405][ T9604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 390.231415][ T9604] Call Trace: [ 390.231421][ T9604] [ 390.231427][ T9604] dump_stack_lvl+0x16c/0x1f0 [ 390.231456][ T9604] warn_alloc+0x248/0x3a0 [ 390.231479][ T9604] ? __pfx_warn_alloc+0x10/0x10 [ 390.231507][ T9604] ? hash_netport4_resize+0x1d8/0x1c50 [ 390.231520][ T9604] ? __vmalloc_node_noprof+0xad/0xf0 [ 390.231542][ T9604] __vmalloc_node_range_noprof+0xfe2/0x1480 [ 390.231565][ T9604] ? hash_netport4_resize+0x1d8/0x1c50 [ 390.231590][ T9604] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 390.231611][ T9604] ? ___kmalloc_large_node+0xed/0x160 [ 390.231631][ T9604] __kvmalloc_node_noprof+0x431/0x9c0 [ 390.231647][ T9604] ? hash_netport4_resize+0x1d8/0x1c50 [ 390.231658][ T9604] ? trace_kmalloc+0x2b/0xd0 [ 390.231673][ T9604] ? __kmalloc_noprof+0x34f/0x880 [ 390.231684][ T9604] ? hash_netport4_resize+0x1d8/0x1c50 [ 390.231699][ T9604] ? hash_netport4_resize+0x1d8/0x1c50 [ 390.231710][ T9604] hash_netport4_resize+0x1d8/0x1c50 [ 390.231722][ T9604] ? __pfx_hash_netport4_add+0x10/0x10 [ 390.231734][ T9604] ? __pfx_hash_netport4_uadt+0x10/0x10 [ 390.231751][ T9604] ? __pfx___mutex_lock+0x10/0x10 [ 390.231773][ T9604] ? __pfx_hash_netport4_resize+0x10/0x10 [ 390.231788][ T9604] call_ad.constprop.0+0x36d/0x940 [ 390.231801][ T9604] ? __pfx_hash_netport4_resize+0x10/0x10 [ 390.231814][ T9604] ? __pfx_call_ad.constprop.0+0x10/0x10 [ 390.231825][ T9604] ? __pfx___nla_validate_parse+0x10/0x10 [ 390.231850][ T9604] ? __nla_parse+0x40/0x60 [ 390.231868][ T9604] ip_set_ad.constprop.0.isra.0+0x3ce/0x870 [ 390.231885][ T9604] ? __pfx_ip_set_ad.constprop.0.isra.0+0x10/0x10 [ 390.231899][ T9604] ? rcu_iw_handler+0xc0/0x150 [ 390.231929][ T9604] ? find_held_lock+0x2b/0x80 [ 390.231944][ T9604] nfnetlink_rcv_msg+0x9fc/0x1200 [ 390.231961][ T9604] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 390.231975][ T9604] ? __lock_acquire+0x622/0x1c90 [ 390.232001][ T9604] ? avc_has_perm_noaudit+0x149/0x3b0 [ 390.232018][ T9604] netlink_rcv_skb+0x158/0x420 [ 390.232034][ T9604] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 390.232046][ T9604] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 390.232069][ T9604] ? ns_capable+0xd7/0x110 [ 390.232087][ T9604] nfnetlink_rcv+0x1b3/0x430 [ 390.232098][ T9604] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 390.232109][ T9604] ? netlink_deliver_tap+0x1ae/0xd30 [ 390.232127][ T9604] netlink_unicast+0x5aa/0x870 [ 390.232144][ T9604] ? __pfx_netlink_unicast+0x10/0x10 [ 390.232165][ T9604] netlink_sendmsg+0x8c8/0xdd0 [ 390.232183][ T9604] ? __pfx_netlink_sendmsg+0x10/0x10 [ 390.232204][ T9604] ____sys_sendmsg+0xa98/0xc70 [ 390.232223][ T9604] ? copy_msghdr_from_user+0x10a/0x160 [ 390.232237][ T9604] ? __pfx_____sys_sendmsg+0x10/0x10 [ 390.232262][ T9604] ___sys_sendmsg+0x134/0x1d0 [ 390.232274][ T9604] ? futex_private_hash_put+0x176/0x300 [ 390.232290][ T9604] ? __pfx____sys_sendmsg+0x10/0x10 [ 390.232302][ T9604] ? __lock_acquire+0x622/0x1c90 [ 390.232337][ T9604] __sys_sendmsg+0x16d/0x220 [ 390.232351][ T9604] ? __pfx___sys_sendmsg+0x10/0x10 [ 390.232365][ T9604] ? __x64_sys_futex+0x1e0/0x4c0 [ 390.232389][ T9604] do_syscall_64+0xcd/0xfa0 [ 390.232404][ T9604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.232416][ T9604] RIP: 0033:0x7f1374b8efc9 [ 390.232426][ T9604] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 390.232438][ T9604] RSP: 002b:00007f13759c8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 390.232449][ T9604] RAX: ffffffffffffffda RBX: 00007f1374de5fa0 RCX: 00007f1374b8efc9 [ 390.232456][ T9604] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000006 [ 390.232463][ T9604] RBP: 00007f1374c11f91 R08: 0000000000000000 R09: 0000000000000000 [ 390.232469][ T9604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 390.232476][ T9604] R13: 00007f1374de6038 R14: 00007f1374de5fa0 R15: 00007ffe898540e8 [ 390.232491][ T9604] [ 390.232495][ T9604] Mem-Info: [ 390.676504][ T9604] active_anon:17847 inactive_anon:4081 isolated_anon:0 [ 390.676504][ T9604] active_file:1900 inactive_file:45005 isolated_file:0 [ 390.676504][ T9604] unevictable:768 dirty:217 writeback:0 [ 390.676504][ T9604] slab_reclaimable:12609 slab_unreclaimable:110168 [ 390.676504][ T9604] mapped:48985 shmem:7097 pagetables:1468 [ 390.676504][ T9604] sec_pagetables:0 bounce:0 [ 390.676504][ T9604] kernel_misc_reclaimable:0 [ 390.676504][ T9604] free:894609 free_pcp:14922 free_cma:0 [ 390.751642][ T9604] Node 0 active_anon:64688kB inactive_anon:16324kB active_file:7532kB inactive_file:179820kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:192408kB dirty:868kB writeback:0kB shmem:23316kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:13048kB pagetables:5444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 390.784141][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.791973][ T3017] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 390.799764][ T3017] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 390.931430][ T9604] Node 1 active_anon:5000kB inactive_anon:0kB active_file:68kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:3532kB dirty:0kB writeback:0kB shmem:5072kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:336kB pagetables:428kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 390.961918][ C1] vkms_vblank_simulate: vblank timer overrun [ 390.978803][ T9604] Node 0 DMA free:10176kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:364kB local_pcp:136kB free_cma:0kB [ 391.012614][ C1] vkms_vblank_simulate: vblank timer overrun [ 391.030032][ T9604] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 391.053880][ T9604] Node 0 DMA32 free:42268kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:61188kB inactive_anon:16324kB active_file:7532kB inactive_file:179820kB unevictable:1536kB writepending:868kB zspages:0kB present:3129332kB managed:2541312kB mlocked:0kB bounce:0kB free_pcp:10620kB local_pcp:4732kB free_cma:0kB [ 391.087428][ C1] vkms_vblank_simulate: vblank timer overrun [ 391.127161][ T9604] lowmem_reserve[]: 0 0 1 1 1 [ 391.140330][ T9604] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 391.181803][ C1] vkms_vblank_simulate: vblank timer overrun [ 391.242001][ T9604] lowmem_reserve[]: 0 0 0 0 0 [ 391.247039][ T9604] Node 1 Normal free:3503128kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4100kB inactive_anon:0kB active_file:68kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:56840kB local_pcp:19372kB free_cma:0kB [ 391.279738][ C1] vkms_vblank_simulate: vblank timer overrun [ 391.302120][ T9644] overlay: ./file0 is not a directory [ 392.139846][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 392.139871][ T30] audit: type=1804 audit(1760874413.177:1172): pid=9644 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.5.893" name="file0" dev="hugetlbfs" ino=26083 res=1 errno=0 [ 392.348409][ T9604] lowmem_reserve[]: 0 0 0 0 0 [ 392.353285][ T9604] Node 0 DMA: 6*4kB (UM) 6*8kB (UME) 1*16kB (E) 1*32kB (E) 2*64kB (ME) 2*128kB (ME) 2*256kB (UE) 2*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 1*4096kB (M) = 10232kB [ 392.369603][ T9604] Node 0 DMA32: 8*4kB (UME) 252*8kB (UME) 446*16kB (UME) 332*32kB (UME) 146*64kB (UME) 63*128kB (UME) 21*256kB (ME) 4*512kB (M) 4*1024kB (M) 1*2048kB (U) 0*4096kB = 50784kB [ 392.387027][ T9604] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 392.399308][ T9604] Node 1 Normal: 4*4kB (UME) 6*8kB (UME) 3*16kB (UME) 1*32kB (M) 2*64kB (UM) 2*128kB (UE) 0*256kB 1*512kB (E) 1*1024kB (M) 3*2048kB (UME) 851*4096kB (M) = 3493904kB [ 392.434961][ T9604] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 392.448082][ T9604] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 392.457931][ T9604] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 392.469893][ T9604] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 392.480974][ T9604] 53390 total pagecache pages [ 392.486319][ T9604] 37 pages in swap cache [ 392.491428][ T9604] Free swap = 124848kB [ 392.497352][ T9604] Total swap = 124996kB [ 392.502217][ T9604] 2097051 pages RAM [ 392.507163][ T9604] 0 pages HighMem/MovableOnly [ 392.512188][ T9604] 429697 pages reserved [ 392.516435][ T9604] 0 pages cma reserved [ 392.853823][ T9651] netlink: 'syz.2.895': attribute type 1 has an invalid length. [ 393.230922][ T9658] netlink: 16 bytes leftover after parsing attributes in process `syz.5.897'. [ 393.243837][ T9651] 8021q: adding VLAN 0 to HW filter on device bond1 [ 394.283153][ T9653] bond1: (slave geneve2): making interface the new active one [ 394.320555][ T9667] ieee802154 phy0 wpan0: encryption failed: -22 [ 394.372141][ T9653] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 394.408678][ T30] audit: type=1400 audit(1760874416.247:1173): avc: denied { ioctl } for pid=9668 comm="syz.5.900" path="socket:[25522]" dev="sockfs" ino=25522 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 394.461201][ T9664] netlink: 20 bytes leftover after parsing attributes in process `syz.0.898'. [ 394.524863][ T9669] netlink: 20 bytes leftover after parsing attributes in process `syz.1.899'. [ 394.570922][ T9669] ieee802154 phy0 wpan0: encryption failed: -22 [ 394.873001][ T5875] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 394.916330][ T9682] netlink: 20 bytes leftover after parsing attributes in process `syz.0.903'. [ 395.042969][ T5875] usb 7-1: Using ep0 maxpacket: 8 [ 395.052555][ T5875] usb 7-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 395.068395][ T5875] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.082386][ T9684] ieee802154 phy0 wpan0: encryption failed: -22 [ 395.120859][ T5875] usb 7-1: Product: syz [ 395.138264][ T5875] usb 7-1: Manufacturer: syz [ 395.156561][ T5875] usb 7-1: SerialNumber: syz [ 395.227403][ T5875] usb 7-1: config 0 descriptor?? [ 395.253246][ T5875] cdc_ether 7-1:0.0: skipping garbage [ 395.291138][ T5875] cdc_ether 7-1:0.0: skipping garbage [ 395.315189][ T5875] cdc_ether 7-1:0.0: skipping garbage [ 395.341003][ T5875] usb 7-1: bad CDC descriptors [ 395.353377][ T5875] usb 7-1: unsupported MDLM descriptors [ 395.365919][ T5875] cdc_acm 7-1:0.0: skipping garbage [ 395.380171][ T5875] cdc_acm 7-1:0.0: skipping garbage [ 395.394839][ T5875] cdc_acm 7-1:0.0: skipping garbage [ 395.412387][ T30] audit: type=1400 audit(1760874417.267:1174): avc: denied { module_request } for pid=9685 comm="syz.5.905" kmod=6E65742D70662D31362D70726F746F2D31362D66616D696C792D04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 396.331528][ T30] audit: type=1400 audit(1760874418.167:1175): avc: denied { create } for pid=9699 comm="syz.2.906" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 396.461609][ T30] audit: type=1400 audit(1760874418.207:1176): avc: denied { read } for pid=9699 comm="syz.2.906" name="file5" dev="tmpfs" ino=1021 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 396.618798][ T9702] 9pnet_fd: Insufficient options for proto=fd [ 396.643095][ T30] audit: type=1400 audit(1760874418.207:1177): avc: denied { create } for pid=9699 comm="syz.2.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 397.546989][ T30] audit: type=1400 audit(1760874418.207:1178): avc: denied { bind } for pid=9699 comm="syz.2.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 397.861336][ T30] audit: type=1326 audit(1760874419.527:1179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9672 comm="syz.6.901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa9af58efc9 code=0x7fc00000 [ 398.075156][ T5902] usb 7-1: USB disconnect, device number 2 [ 401.212616][ T9730] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 402.061352][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.916'. [ 402.073153][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.916'. [ 402.082205][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.916'. [ 402.091431][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.5.916'. [ 402.134332][ T9723] vlan2: entered allmulticast mode [ 402.162217][ T9723] bond0: entered allmulticast mode [ 402.202330][ T9723] bond_slave_0: entered allmulticast mode [ 402.715229][ T9723] bond_slave_1: entered allmulticast mode [ 403.459453][ T9756] can0: slcan on ttyS3. [ 403.664725][ T9760] fuse: Unknown parameter '0x0000000000000004' [ 404.134620][ T9755] can0 (unregistered): slcan off ttyS3. [ 404.308266][ T9768] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 404.354395][ T30] audit: type=1400 audit(1760874426.177:1180): avc: denied { open } for pid=9769 comm="syz.1.926" path="/dev/ptyq6" dev="devtmpfs" ino=125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 404.411178][ T9768] SELinux: failed to load policy [ 404.504510][ T30] audit: type=1400 audit(1760874426.207:1181): avc: denied { ioctl } for pid=9769 comm="syz.1.926" path="/dev/ptyq6" dev="devtmpfs" ino=125 ioctlcmd=0x4b40 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 404.899997][ T9786] netlink: 'syz.1.929': attribute type 4 has an invalid length. [ 404.979146][ T9786] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.929'. [ 407.255429][ T9823] fuse: Unknown parameter 'fd0x0000000000000004' [ 407.788868][ T9842] SELinux: Context system_u:object_r:syslogd_var_lib_t:s0 is not valid (left unmapped). [ 407.799063][ T30] audit: type=1400 audit(1760874429.637:1182): avc: denied { relabelfrom } for pid=9835 comm="syz.6.939" name="NETLINK" dev="sockfs" ino=26417 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 408.375160][ T30] audit: type=1400 audit(1760874429.717:1183): avc: denied { relabelto } for pid=9835 comm="syz.6.939" name="NETLINK" dev="sockfs" ino=26417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netlink_generic_socket permissive=1 trawcon="system_u:object_r:syslogd_var_lib_t:s0" [ 410.323033][ T9882] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 410.341487][ T9882] SELinux: failed to load policy [ 410.361393][ T5875] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 410.522998][ T5875] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 410.532324][ T5875] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.608413][ T5875] usb 3-1: config 0 descriptor?? [ 410.879469][ T9887] can0: slcan on ttyS3. [ 411.048557][ T5875] usb 3-1: Cannot set MAC address [ 411.067924][ T5875] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 411.134893][ T5875] usb 3-1: USB disconnect, device number 17 [ 411.187170][ T9894] netlink: 8 bytes leftover after parsing attributes in process `syz.1.946'. [ 411.196134][ T6638] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 411.219639][ T9894] netlink: 8 bytes leftover after parsing attributes in process `syz.1.946'. [ 411.459705][ T9896] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 411.484753][ T9896] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 411.820285][ T6638] usb 7-1: Using ep0 maxpacket: 16 [ 411.842908][ T6638] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 411.850988][ T6638] usb 7-1: config 0 has no interface number 0 [ 411.860035][ T6638] usb 7-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 411.869374][ T6638] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.882848][ T6638] usb 7-1: Product: syz [ 411.890117][ T6638] usb 7-1: Manufacturer: syz [ 411.943457][ T6638] usb 7-1: SerialNumber: syz [ 411.967746][ T6638] usb 7-1: config 0 descriptor?? [ 411.989568][ T6638] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 411.993732][ T9886] can0 (unregistered): slcan off ttyS3. [ 412.191585][ T30] audit: type=1400 audit(1760874434.047:1184): avc: denied { write } for pid=9890 comm="syz.6.945" path="socket:[26483]" dev="sockfs" ino=26483 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 412.969733][ T6638] gspca_spca1528: reg_w err -110 [ 413.072501][ T9912] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 413.090955][ T9912] ./file0: Can't lookup blockdev [ 413.841389][ T6638] spca1528 7-1:0.1: probe with driver spca1528 failed with error -110 [ 414.623168][ T5875] usb 7-1: USB disconnect, device number 3 [ 414.897685][ T9924] ip6gretap0: entered promiscuous mode [ 414.917196][ T9924] vlan2: entered promiscuous mode [ 415.381453][ T24] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 415.450174][ T5831] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 415.467565][ T5831] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 415.477938][ T5831] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 415.486228][ T5831] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 415.495729][ T5831] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 415.554930][ T24] usb 7-1: config 1 has an invalid descriptor of length 22, skipping remainder of the config [ 415.585087][ T24] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 415.630765][ T24] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 415.650485][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 415.704228][ T24] usb 7-1: SerialNumber: syz [ 416.070139][ T24] usb 7-1: 0:2 : does not exist [ 416.182550][ T9932] chnl_net:caif_netlink_parms(): no params data found [ 416.232736][ T24] usb 7-1: unit 5 not found! [ 416.326858][ T24] usb 7-1: USB disconnect, device number 4 [ 416.411562][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 416.497506][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 416.675588][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 416.729064][ T9] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 416.794300][ T9] usb 3-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 416.824489][ T9956] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 416.861325][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 416.865213][ T9956] SELinux: failed to load policy [ 416.899006][ T9932] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.931790][ T9932] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.941574][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.967180][ T9932] bridge_slave_0: entered allmulticast mode [ 417.006291][ T9] usbtmc 3-1:16.0: bulk endpoints not found [ 417.059493][ T9932] bridge_slave_0: entered promiscuous mode [ 417.351136][ T9932] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.519870][ T9932] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.533115][ T5821] Bluetooth: hci7: command tx timeout [ 417.610768][ T9932] bridge_slave_1: entered allmulticast mode [ 417.862756][ T9932] bridge_slave_1: entered promiscuous mode [ 418.023853][ T9971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.037230][ T9971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.210652][ T9969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 418.259158][ T9932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.295376][ T9969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.303981][ T9969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.316635][ T9932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.524334][ T9932] team0: Port device team_slave_0 added [ 418.648826][ T9932] team0: Port device team_slave_1 added [ 418.785284][ T9932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 418.801617][ T9932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.865633][ T9932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 418.904113][ T9932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 418.924674][ T9932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.995518][ T9932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.278773][ T9932] hsr_slave_0: entered promiscuous mode [ 419.304353][ T9932] hsr_slave_1: entered promiscuous mode [ 419.356182][ T9] usb 3-1: USB disconnect, device number 18 [ 419.381555][ T9979] overlay: ./file0 is not a directory [ 419.611966][ T5821] Bluetooth: hci7: command tx timeout [ 420.323211][ T9932] debugfs: 'hsr0' already exists in 'hsr' [ 420.328979][ T9932] Cannot create hsr debugfs directory [ 420.547872][ T9976] warn_alloc: 1 callbacks suppressed [ 420.547890][ T9976] syz.0.959: vmalloc error: size 10485760, failed to allocated page array size 20480, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 420.557191][ T9988] netlink: 64 bytes leftover after parsing attributes in process `syz.1.962'. [ 420.631415][ T9976] ,cpuset=/,mems_allowed=0-1 [ 420.636087][ T9976] CPU: 1 UID: 0 PID: 9976 Comm: syz.0.959 Not tainted syzkaller #0 PREEMPT(full) [ 420.636108][ T9976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 420.636119][ T9976] Call Trace: [ 420.636125][ T9976] [ 420.636131][ T9976] dump_stack_lvl+0x16c/0x1f0 [ 420.636159][ T9976] warn_alloc+0x248/0x3a0 [ 420.636188][ T9976] ? __pfx_warn_alloc+0x10/0x10 [ 420.636219][ T9976] ? hash_netport4_resize+0x1d8/0x1c50 [ 420.636238][ T9976] ? __vmalloc_node_noprof+0xad/0xf0 [ 420.636272][ T9976] __vmalloc_node_range_noprof+0xfe2/0x1480 [ 420.636311][ T9976] ? hash_netport4_resize+0x1d8/0x1c50 [ 420.636337][ T9976] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 420.636372][ T9976] ? ___kmalloc_large_node+0xed/0x160 [ 420.636405][ T9976] __kvmalloc_node_noprof+0x431/0x9c0 [ 420.636430][ T9976] ? hash_netport4_resize+0x1d8/0x1c50 [ 420.636448][ T9976] ? trace_kmalloc+0x2b/0xd0 [ 420.636480][ T9976] ? __kmalloc_noprof+0x34f/0x880 [ 420.636501][ T9976] ? hash_netport4_resize+0x1d8/0x1c50 [ 420.636526][ T9976] ? hash_netport4_resize+0x1d8/0x1c50 [ 420.636544][ T9976] hash_netport4_resize+0x1d8/0x1c50 [ 420.636565][ T9976] ? __pfx_hash_netport4_add+0x10/0x10 [ 420.636584][ T9976] ? __pfx_hash_netport4_uadt+0x10/0x10 [ 420.636612][ T9976] ? __pfx___mutex_lock+0x10/0x10 [ 420.636648][ T9976] ? __pfx_hash_netport4_resize+0x10/0x10 [ 420.636673][ T9976] call_ad.constprop.0+0x36d/0x940 [ 420.636693][ T9976] ? __pfx_hash_netport4_resize+0x10/0x10 [ 420.636715][ T9976] ? __pfx_call_ad.constprop.0+0x10/0x10 [ 420.636733][ T9976] ? __pfx___nla_validate_parse+0x10/0x10 [ 420.636774][ T9976] ? __nla_parse+0x40/0x60 [ 420.636805][ T9976] ip_set_ad.constprop.0.isra.0+0x3ce/0x870 [ 420.636831][ T9976] ? __pfx_ip_set_ad.constprop.0.isra.0+0x10/0x10 [ 420.636853][ T9976] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 420.636874][ T9976] ? lockdep_hardirqs_on+0x7c/0x110 [ 420.636919][ T9976] ? find_held_lock+0x2b/0x80 [ 420.636944][ T9976] nfnetlink_rcv_msg+0x9fc/0x1200 [ 420.636974][ T9976] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 420.636997][ T9976] ? __lock_acquire+0x622/0x1c90 [ 420.637043][ T9976] ? avc_has_perm_noaudit+0x149/0x3b0 [ 420.637071][ T9976] netlink_rcv_skb+0x158/0x420 [ 420.637096][ T9976] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 420.637117][ T9976] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 420.637155][ T9976] ? ns_capable+0xd7/0x110 [ 420.637192][ T9976] nfnetlink_rcv+0x1b3/0x430 [ 420.637210][ T9976] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 420.637227][ T9976] ? netlink_deliver_tap+0x1ae/0xd30 [ 420.637256][ T9976] netlink_unicast+0x5aa/0x870 [ 420.637285][ T9976] ? __pfx_netlink_unicast+0x10/0x10 [ 420.637321][ T9976] netlink_sendmsg+0x8c8/0xdd0 [ 420.637351][ T9976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 420.637387][ T9976] ____sys_sendmsg+0xa98/0xc70 [ 420.637417][ T9976] ? copy_msghdr_from_user+0x10a/0x160 [ 420.637440][ T9976] ? __pfx_____sys_sendmsg+0x10/0x10 [ 420.637481][ T9976] ___sys_sendmsg+0x134/0x1d0 [ 420.637501][ T9976] ? futex_private_hash_put+0x176/0x300 [ 420.637525][ T9976] ? __pfx____sys_sendmsg+0x10/0x10 [ 420.637545][ T9976] ? __lock_acquire+0x622/0x1c90 [ 420.637602][ T9976] __sys_sendmsg+0x16d/0x220 [ 420.637626][ T9976] ? __pfx___sys_sendmsg+0x10/0x10 [ 420.637647][ T9976] ? __x64_sys_futex+0x1e0/0x4c0 [ 420.637688][ T9976] do_syscall_64+0xcd/0xfa0 [ 420.637714][ T9976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.637732][ T9976] RIP: 0033:0x7f212a98efc9 [ 420.637747][ T9976] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.637763][ T9976] RSP: 002b:00007f2128bd5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 420.637779][ T9976] RAX: ffffffffffffffda RBX: 00007f212abe6090 RCX: 00007f212a98efc9 [ 420.637790][ T9976] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000007 [ 420.637800][ T9976] RBP: 00007f212aa11f91 R08: 0000000000000000 R09: 0000000000000000 [ 420.637810][ T9976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 420.637819][ T9976] R13: 00007f212abe6128 R14: 00007f212abe6090 R15: 00007ffd27c40368 [ 420.637843][ T9976] [ 420.637850][ T9976] Mem-Info: [ 421.117696][ T9976] active_anon:6476 inactive_anon:8197 isolated_anon:0 [ 421.117696][ T9976] active_file:4824 inactive_file:13320 isolated_file:0 [ 421.117696][ T9976] unevictable:768 dirty:274 writeback:0 [ 421.117696][ T9976] slab_reclaimable:9747 slab_unreclaimable:116409 [ 421.117696][ T9976] mapped:48021 shmem:3579 pagetables:1589 [ 421.117696][ T9976] sec_pagetables:0 bounce:0 [ 421.117696][ T9976] kernel_misc_reclaimable:0 [ 421.117696][ T9976] free:553402 free_pcp:23680 free_cma:0 [ 421.171610][ T9976] Node 0 active_anon:23444kB inactive_anon:32788kB active_file:8156kB inactive_file:52692kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:169124kB dirty:1004kB writeback:0kB shmem:12760kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:12884kB pagetables:5172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 421.204008][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.222618][ T9990] netlink: 20 bytes leftover after parsing attributes in process `syz.1.963'. [ 421.236716][ T9976] Node 1 active_anon:2460kB inactive_anon:0kB active_file:11140kB inactive_file:588kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:22960kB dirty:92kB writeback:0kB shmem:1556kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:848kB pagetables:1184kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 421.345480][ T9994] ieee802154 phy0 wpan0: encryption failed: -22 [ 421.357875][ T9976] Node 0 DMA free:10172kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:128kB free_cma:0kB [ 421.388124][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.429389][ T9976] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 421.435404][ T9932] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 421.442606][ T9976] Node 0 DMA32 free:57888kB boost:8192kB min:42284kB low:50804kB high:59324kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23588kB inactive_anon:32320kB active_file:8156kB inactive_file:52692kB unevictable:1536kB writepending:1008kB zspages:0kB present:3129332kB managed:2541312kB mlocked:0kB bounce:0kB free_pcp:1064kB local_pcp:792kB free_cma:0kB [ 421.554544][ T9996] netlink: 20 bytes leftover after parsing attributes in process `syz.2.965'. [ 421.569058][ T9932] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 421.601493][ T9932] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 421.625351][ T9997] ieee802154 phy0 wpan0: encryption failed: -22 [ 421.671469][ T9976] lowmem_reserve[]: 0 0 1 1 1 [ 421.682052][ T9976] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 421.715952][ T9932] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 421.723243][ T5821] Bluetooth: hci7: command tx timeout [ 421.728809][ T9976] lowmem_reserve[]: 0 0 0 0 0 [ 421.758091][ T9976] Node 1 Normal free:2099308kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:2596kB inactive_anon:0kB active_file:11140kB inactive_file:592kB unevictable:1536kB writepending:92kB zspages:3804kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:97260kB local_pcp:56856kB free_cma:0kB [ 421.791377][ C0] vkms_vblank_simulate: vblank timer overrun [ 422.031318][ T9976] lowmem_reserve[]: 0 0 0 0 0 [ 422.036354][ T9976] Node 0 DMA: 5*4kB (UME) 3*8kB (ME) 3*16kB (UME) 1*32kB (E) 1*64kB (E) 2*128kB (UE) 2*256kB (ME) 2*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 1*4096kB (M) = 10172kB [ 422.065869][ T9976] Node 0 DMA32: 1379*4kB (ME) 669*8kB (ME) 266*16kB (UME) 249*32kB (ME) 125*64kB (ME) 56*128kB (UME) 30*256kB (ME) 11*512kB (UM) 1*1024kB (U) 0*2048kB 0*4096kB = 52596kB [ 422.083497][ T9976] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 422.095813][ T9976] Node 1 Normal: 2*4kB (ME) 1*8kB (E) 2*16kB (UE) 2*32kB (UE) 1*64kB (M) 2*128kB (ME) 2*256kB (UE) 0*512kB 2*1024kB (UM) 3*2048kB (UME) 509*4096kB (M) = 2094000kB [ 422.114395][ T9976] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 422.258424][ T9976] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 422.285458][ T9932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 422.297439][ T9976] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 422.318865][ T9976] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 422.387473][ T9976] 21353 total pagecache pages [ 422.428414][ T9932] 8021q: adding VLAN 0 to HW filter on device team0 [ 422.453781][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.460904][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 422.491706][ T9976] 111 pages in swap cache [ 422.533672][ T9976] Free swap = 108356kB [ 422.559595][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.566706][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 422.611489][ T9976] Total swap = 124996kB [ 422.656477][ T9976] 2097051 pages RAM [ 422.660319][ T9976] 0 pages HighMem/MovableOnly [ 422.746521][ T9932] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 422.773056][ T9932] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 422.773074][ T9976] 429697 pages reserved [ 423.641569][ T9976] 0 pages cma reserved [ 423.771776][ T5821] Bluetooth: hci7: command tx timeout [ 424.126766][T10014] overlayfs: failed to decode file handle (len=5, type=251, flags=0, err=-22) [ 424.137315][T10014] ./file0: Can't lookup blockdev [ 424.184442][T10013] netlink: 20 bytes leftover after parsing attributes in process `syz.0.967'. [ 424.381393][ T5902] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 425.423341][ T5902] usb 2-1: Using ep0 maxpacket: 32 [ 425.635754][ T5902] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 425.652294][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.687713][T10030] netlink: 'syz.2.969': attribute type 8 has an invalid length. [ 425.775739][ T5902] usb 2-1: config 0 descriptor?? [ 425.828380][ T5902] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 425.952893][ T9932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 426.742827][ T5836] udevd[5836]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 426.941070][T10050] ip6gretap0: entered promiscuous mode [ 426.960905][T10050] vlan2: entered promiscuous mode [ 427.153283][ T9932] veth0_vlan: entered promiscuous mode [ 427.215679][ T9932] veth1_vlan: entered promiscuous mode [ 427.281711][ T6638] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 427.301010][ T9932] veth0_macvtap: entered promiscuous mode [ 427.332144][ T9932] veth1_macvtap: entered promiscuous mode [ 427.407999][ T9932] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 427.451113][ T9932] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 427.469729][ T30] audit: type=1400 audit(1760874449.317:1185): avc: denied { read write } for pid=10058 comm="syz.0.975" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 427.541970][ T6638] usb 3-1: config 1 has an invalid descriptor of length 22, skipping remainder of the config [ 427.558659][ T6638] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 427.599383][ T50] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.611436][ T30] audit: type=1400 audit(1760874449.317:1186): avc: denied { ioctl open } for pid=10058 comm="syz.0.975" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 427.637956][ T6638] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 427.655679][ T6638] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 427.674213][ T50] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.684261][ T6638] usb 3-1: SerialNumber: syz [ 427.697051][ T50] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.756848][ T50] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.962466][ T6638] usb 3-1: 0:2 : does not exist [ 428.056443][ T6638] usb 3-1: USB disconnect, device number 19 [ 428.138929][ T3017] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 428.193221][ T3017] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 428.205470][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 428.232559][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 428.271946][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 428.407752][ T30] audit: type=1400 audit(1760874450.257:1187): avc: denied { mounton } for pid=9932 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 429.611830][ T30] audit: type=1400 audit(1760874451.177:1188): avc: denied { setopt } for pid=10087 comm="syz.6.982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 430.089236][ T6638] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 430.271843][ T6638] usb 3-1: Using ep0 maxpacket: 8 [ 430.387266][ T6638] usb 3-1: unable to get BOS descriptor or descriptor too short [ 430.437743][ T6638] usb 3-1: config 3 has an invalid interface number: 83 but max is 0 [ 430.728464][ T6638] usb 3-1: config 3 has no interface number 0 [ 430.747851][ T6638] usb 3-1: config 3 interface 83 altsetting 7 endpoint 0xE has invalid wMaxPacketSize 0 [ 430.849956][ T6638] usb 3-1: config 3 interface 83 has no altsetting 0 [ 430.883286][ T6638] usb 3-1: New USB device found, idVendor=0403, idProduct=e0f5, bcdDevice= 1.d6 [ 430.956721][T10074] warn_alloc: 1 callbacks suppressed [ 430.956738][T10074] syz.7.950: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 430.968044][ T6638] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.984853][T10074] ,cpuset=/,mems_allowed=0-1 [ 431.042638][T10074] CPU: 0 UID: 0 PID: 10074 Comm: syz.7.950 Not tainted syzkaller #0 PREEMPT(full) [ 431.042665][T10074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 431.042675][T10074] Call Trace: [ 431.042681][T10074] [ 431.042689][T10074] dump_stack_lvl+0x16c/0x1f0 [ 431.042718][T10074] warn_alloc+0x248/0x3a0 [ 431.042742][T10074] ? __pfx_warn_alloc+0x10/0x10 [ 431.042774][T10074] ? hash_netport4_resize+0x1d8/0x1c50 [ 431.042795][T10074] ? __vmalloc_node_noprof+0xad/0xf0 [ 431.042828][T10074] __vmalloc_node_range_noprof+0xfe2/0x1480 [ 431.042866][T10074] ? hash_netport4_resize+0x1d8/0x1c50 [ 431.042892][T10074] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 431.042926][T10074] ? ___kmalloc_large_node+0xed/0x160 [ 431.042960][T10074] __kvmalloc_node_noprof+0x431/0x9c0 [ 431.042985][T10074] ? hash_netport4_resize+0x1d8/0x1c50 [ 431.043004][T10074] ? trace_kmalloc+0x2b/0xd0 [ 431.043028][T10074] ? __kmalloc_noprof+0x34f/0x880 [ 431.043046][T10074] ? hash_netport4_resize+0x1d8/0x1c50 [ 431.043071][T10074] ? hash_netport4_resize+0x1d8/0x1c50 [ 431.043089][T10074] hash_netport4_resize+0x1d8/0x1c50 [ 431.043107][T10074] ? __pfx_hash_netport4_add+0x10/0x10 [ 431.043127][T10074] ? __pfx_hash_netport4_uadt+0x10/0x10 [ 431.043154][T10074] ? __pfx___mutex_lock+0x10/0x10 [ 431.043189][T10074] ? __pfx_hash_netport4_resize+0x10/0x10 [ 431.043214][T10074] call_ad.constprop.0+0x36d/0x940 [ 431.043234][T10074] ? __pfx_hash_netport4_resize+0x10/0x10 [ 431.043256][T10074] ? __pfx_call_ad.constprop.0+0x10/0x10 [ 431.043274][T10074] ? __pfx___nla_validate_parse+0x10/0x10 [ 431.043315][T10074] ? __nla_parse+0x40/0x60 [ 431.043352][T10074] ip_set_ad.constprop.0.isra.0+0x3ce/0x870 [ 431.043379][T10074] ? __pfx_ip_set_ad.constprop.0.isra.0+0x10/0x10 [ 431.043401][T10074] ? rcu_iw_handler+0xc0/0x150 [ 431.043453][T10074] ? find_held_lock+0x2b/0x80 [ 431.043478][T10074] nfnetlink_rcv_msg+0x9fc/0x1200 [ 431.043507][T10074] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 431.043530][T10074] ? __lock_acquire+0x622/0x1c90 [ 431.043577][T10074] ? avc_has_perm_noaudit+0x149/0x3b0 [ 431.043605][T10074] netlink_rcv_skb+0x158/0x420 [ 431.043631][T10074] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 431.043651][T10074] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 431.043689][T10074] ? ns_capable+0xd7/0x110 [ 431.043719][T10074] nfnetlink_rcv+0x1b3/0x430 [ 431.043738][T10074] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 431.043755][T10074] ? netlink_deliver_tap+0x1ae/0xd30 [ 431.043784][T10074] netlink_unicast+0x5aa/0x870 [ 431.043813][T10074] ? __pfx_netlink_unicast+0x10/0x10 [ 431.043849][T10074] netlink_sendmsg+0x8c8/0xdd0 [ 431.043879][T10074] ? __pfx_netlink_sendmsg+0x10/0x10 [ 431.043915][T10074] ____sys_sendmsg+0xa98/0xc70 [ 431.043944][T10074] ? copy_msghdr_from_user+0x10a/0x160 [ 431.043966][T10074] ? __pfx_____sys_sendmsg+0x10/0x10 [ 431.044000][T10074] ? __pfx_futex_wake_mark+0x10/0x10 [ 431.044033][T10074] ___sys_sendmsg+0x134/0x1d0 [ 431.044053][T10074] ? futex_private_hash_put+0x176/0x300 [ 431.044076][T10074] ? __pfx____sys_sendmsg+0x10/0x10 [ 431.044096][T10074] ? __lock_acquire+0x622/0x1c90 [ 431.044153][T10074] __sys_sendmsg+0x16d/0x220 [ 431.044176][T10074] ? __pfx___sys_sendmsg+0x10/0x10 [ 431.044197][T10074] ? __x64_sys_futex+0x1e0/0x4c0 [ 431.044238][T10074] do_syscall_64+0xcd/0xfa0 [ 431.044263][T10074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.044282][T10074] RIP: 0033:0x7fa218b8efc9 [ 431.044298][T10074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 431.044314][T10074] RSP: 002b:00007fa219a64038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 431.044332][T10074] RAX: ffffffffffffffda RBX: 00007fa218de5fa0 RCX: 00007fa218b8efc9 [ 431.044348][T10074] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000006 [ 431.044359][T10074] RBP: 00007fa218c11f91 R08: 0000000000000000 R09: 0000000000000000 [ 431.044370][T10074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 431.044381][T10074] R13: 00007fa218de6038 R14: 00007fa218de5fa0 R15: 00007fff55e75fa8 [ 431.044407][T10074] [ 431.051066][T10074] Mem-Info: [ 431.217476][ T6638] usb 3-1: Product: syz [ 431.462347][T10074] active_anon:23721 inactive_anon:4969 isolated_anon:0 [ 431.462347][T10074] active_file:7170 inactive_file:12209 isolated_file:0 [ 431.462347][T10074] unevictable:768 dirty:351 writeback:0 [ 431.462347][T10074] slab_reclaimable:9903 slab_unreclaimable:119235 [ 431.462347][T10074] mapped:59795 shmem:18422 pagetables:1691 [ 431.462347][T10074] sec_pagetables:0 bounce:0 [ 431.462347][T10074] kernel_misc_reclaimable:0 [ 431.462347][T10074] free:390244 free_pcp:13783 free_cma:0 [ 431.611499][ T5831] Bluetooth: hci5: command 0x0406 tx timeout [ 431.642606][T10074] Node 0 active_anon:27444kB inactive_anon:19420kB active_file:8344kB inactive_file:48204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:207268kB dirty:1356kB writeback:0kB shmem:10480kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:12880kB pagetables:5084kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 431.826123][T10074] Node 1 active_anon:71512kB inactive_anon:0kB active_file:20420kB inactive_file:632kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:31996kB dirty:56kB writeback:0kB shmem:66616kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:1108kB pagetables:1756kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 431.880454][T10074] Node 0 DMA free:10172kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:236kB local_pcp:128kB free_cma:0kB [ 431.981431][T10074] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 432.001445][T10074] Node 0 [ 432.001452][ T30] audit: type=1400 audit(1760874453.817:1189): avc: denied { write } for pid=10109 comm="syz.6.989" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 432.092902][T10074] DMA32 free:41972kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27980kB inactive_anon:18964kB active_file:8344kB inactive_file:46568kB unevictable:1536kB writepending:1364kB zspages:0kB present:3129332kB managed:2541312kB mlocked:0kB bounce:0kB free_pcp:10752kB local_pcp:932kB free_cma:0kB [ 432.207036][T10112] netlink: 20 bytes leftover after parsing attributes in process `syz.6.990'. [ 432.353625][T10074] lowmem_reserve[]: 0 0 1 1 1 [ 432.360796][T10074] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 432.411354][ T6638] usb 3-1: Manufacturer: syz [ 432.416390][ T6638] usb 3-1: SerialNumber: syz [ 432.456317][T10114] ieee802154 phy0 wpan0: encryption failed: -22 [ 432.561316][T10074] lowmem_reserve[]: 0 0 0 0 0 [ 432.651409][T10074] Node 1 Normal free:1350544kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:82944kB inactive_anon:0kB active_file:20420kB inactive_file:632kB unevictable:1536kB writepending:56kB zspages:5840kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:38068kB local_pcp:19196kB free_cma:0kB [ 432.708717][ T6638] ftdi_sio 3-1:3.83: FTDI USB Serial Device converter detected [ 432.723257][T10074] lowmem_reserve[]: 0 0 0 0 0 [ 432.738100][ T6638] usb 3-1: Detected SIO [ 432.757133][ T6638] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 14 [ 432.788715][ T6638] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 432.831360][T10074] Node 0 DMA: 5*4kB (UME) 3*8kB (ME) 3*16kB (UME) 1*32kB (E) 1*64kB (E) 2*128kB (UE) 2*256kB (ME) 2*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 1*4096kB (M) = 10172kB [ 433.012589][ T6638] usb 3-1: USB disconnect, device number 20 [ 433.051666][T10074] Node 0 DMA32: 806*4kB (UME) 797*8kB (UME) 347*16kB (UME) 336*32kB (UME) 153*64kB (UME) 62*128kB (UME) 29*256kB (ME) 4*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 53104kB [ 433.206967][ T6638] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 433.207494][ T6638] ftdi_sio 3-1:3.83: device disconnected [ 433.208854][T10074] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 433.277828][T10074] Node 1 Normal: 3*4kB (UME) 2*8kB (ME) 2*16kB (UM) 0*32kB 2*64kB (UM) 1*128kB (U) 0*256kB 3*512kB (UME) 1*1024kB (E) 1*2048kB (M) 316*4096kB (M) = 1299260kB [ 433.277986][T10074] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 433.278002][T10074] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 433.278017][T10074] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 433.278032][T10074] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 433.278046][T10074] 46444 total pagecache pages [ 433.278053][T10074] 159 pages in swap cache [ 433.278060][T10074] Free swap = 100728kB [ 433.278067][T10074] Total swap = 124996kB [ 433.278075][T10074] 2097051 pages RAM [ 433.278082][T10074] 0 pages HighMem/MovableOnly [ 433.278089][T10074] 429697 pages reserved [ 433.278095][T10074] 0 pages cma reserved [ 436.016699][T10144] vlan2: entered promiscuous mode [ 436.321342][ T5875] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 436.503395][ T9] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 436.514655][ T5875] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.525966][ T5875] usb 8-1: New USB device found, idVendor=056a, idProduct=0043, bcdDevice= 0.00 [ 436.601488][ T5875] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.634711][ T5875] usb 8-1: config 0 descriptor?? [ 436.729227][ T9] usb 7-1: config 1 has an invalid descriptor of length 22, skipping remainder of the config [ 436.801294][ T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 436.913480][ T9] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 436.973259][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 437.079820][T10149] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.120648][T10149] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.142015][ T9] usb 7-1: SerialNumber: syz [ 437.245942][ T5875] usbhid 8-1:0.0: can't add hid device: -71 [ 437.299905][ T5875] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 437.335915][ T5875] usb 8-1: USB disconnect, device number 2 [ 437.538071][ T9] usb 7-1: 0:2 : does not exist [ 437.553957][ T9] usb 7-1: unit 5 not found! [ 437.645264][T10162] can0: slcan on ttyS3. [ 437.748223][ T9] usb 7-1: USB disconnect, device number 5 [ 437.898281][T10165] can0 (unregistered): slcan off ttyS3. [ 437.954387][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 438.083049][T10173] ieee802154 phy0 wpan0: encryption failed: -22 [ 438.911310][ T30] audit: type=1400 audit(1760874460.747:1190): avc: denied { create } for pid=10183 comm="syz.2.1007" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 439.042949][T10188] sctp: [Deprecated]: syz.2.1007 (pid 10188) Use of int in maxseg socket option. [ 439.042949][T10188] Use struct sctp_assoc_value instead [ 439.105924][ T30] audit: type=1400 audit(1760874460.747:1191): avc: denied { ioctl } for pid=10183 comm="syz.2.1007" path="socket:[27639]" dev="sockfs" ino=27639 ioctlcmd=0x4943 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 439.419822][ T30] audit: type=1400 audit(1760874461.267:1192): avc: denied { read } for pid=10190 comm="syz.6.1008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 439.498212][T10197] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1010'. [ 439.694154][ T5902] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 439.695235][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.717156][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.876516][ T10] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 439.909630][ T5902] dvb_usb_az6027 2-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 439.943017][ T10] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 439.966729][ T5902] usb 2-1: USB disconnect, device number 15 [ 440.066661][ T10] usb 1-1: USB disconnect, device number 14 [ 441.281146][ T30] audit: type=1400 audit(1760874463.047:1193): avc: denied { getopt } for pid=10208 comm="syz.1.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 441.941370][ T24] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 442.341329][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 443.014056][ T24] usb 7-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 443.058815][ T24] usb 7-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 443.106011][ T24] usb 7-1: Product: syz [ 443.126807][ T24] usb 7-1: Manufacturer: syz [ 443.145615][ T24] usb 7-1: SerialNumber: syz [ 443.163990][ T24] usb 7-1: config 0 descriptor?? [ 443.270547][T10238] netlink: zone id is out of range [ 443.444425][ T30] audit: type=1400 audit(1760874465.277:1194): avc: denied { create } for pid=10230 comm="syz.7.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 443.860429][ T24] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 443.988643][ T30] audit: type=1400 audit(1760874465.347:1195): avc: denied { write } for pid=10230 comm="syz.7.1019" path="socket:[28633]" dev="sockfs" ino=28633 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 444.213013][ T24] gspca_zc3xx: reg_r err -71 [ 444.217712][ T24] gspca_zc3xx 7-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 444.290926][T10248] ieee802154 phy0 wpan0: encryption failed: -22 [ 444.437814][ T24] usb 7-1: USB disconnect, device number 6 [ 444.451623][ T30] audit: type=1400 audit(1760874465.877:1196): avc: denied { accept } for pid=10230 comm="syz.7.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 444.572244][ T30] audit: type=1400 audit(1760874466.027:1197): avc: denied { getopt } for pid=10228 comm="syz.1.1017" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 445.419039][T10256] can0: slcan on ttyS3. [ 446.333083][T10255] can0 (unregistered): slcan off ttyS3. [ 446.441630][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 446.460595][T10259] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1023'. [ 446.703803][T10259] geneve2: entered promiscuous mode [ 446.715944][ T30] audit: type=1326 audit(1760874468.557:1198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10275 comm="syz.0.1026" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x0 [ 446.764576][ T9] usb 8-1: device descriptor read/64, error -71 [ 446.832635][T10286] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1028'. [ 447.105048][ T9] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 447.412294][ T9] usb 8-1: device descriptor read/64, error -71 [ 447.522212][ T9] usb usb8-port1: attempt power cycle [ 447.767804][T10303] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1030'. [ 447.921345][ T9] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 448.048899][ T9] usb 8-1: device descriptor read/8, error -71 [ 448.101509][T10303] ieee802154 phy0 wpan0: encryption failed: -22 [ 448.311323][ T9] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 448.346711][ T9] usb 8-1: device descriptor read/8, error -71 [ 448.542058][ T9] usb usb8-port1: unable to enumerate USB device [ 448.664228][T10319] QAT: Stopping all acceleration devices. [ 448.682905][T10319] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1034'. [ 449.102946][ T30] audit: type=1400 audit(1760874470.937:1199): avc: denied { read write } for pid=10320 comm="syz.0.1036" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 449.669921][ T30] audit: type=1400 audit(1760874470.937:1200): avc: denied { open } for pid=10320 comm="syz.0.1036" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 450.981321][ T30] audit: type=1326 audit(1760874472.807:1201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 451.759104][ T30] audit: type=1326 audit(1760874472.807:1202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 451.830811][ T30] audit: type=1326 audit(1760874472.817:1203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 451.856751][ T30] audit: type=1326 audit(1760874472.817:1204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 452.057655][ T30] audit: type=1326 audit(1760874472.817:1205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 452.097304][T10360] can0: slcan on ttyS3. [ 452.532034][ T30] audit: type=1326 audit(1760874472.817:1206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 452.704046][ T30] audit: type=1326 audit(1760874472.817:1207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 452.829143][ T30] audit: type=1326 audit(1760874473.607:1208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10341 comm="syz.0.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 452.853608][T10359] can0 (unregistered): slcan off ttyS3. [ 453.793302][T10392] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 453.819975][T10392] SELinux: failed to load policy [ 453.908990][T10395] QAT: Stopping all acceleration devices. [ 453.937248][T10395] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1050'. [ 455.111444][ T5902] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 455.366598][T10414] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=24832 sclass=netlink_route_socket pid=10414 comm=syz.2.1056 [ 455.381532][ T5902] usb 2-1: Using ep0 maxpacket: 16 [ 455.389183][ T5902] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 455.410112][ T5902] usb 2-1: config 0 has no interface number 0 [ 455.438389][ T5902] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 455.798917][ T5902] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 455.838438][ T5902] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 455.856301][ T5902] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 455.893337][ T5902] usb 2-1: Product: syz [ 455.898149][ T5902] usb 2-1: SerialNumber: syz [ 455.925159][ T5902] usb 2-1: config 0 descriptor?? [ 455.936847][ T5902] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 455.958619][ T5902] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input55 [ 456.160966][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.169503][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.176617][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.183776][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.190915][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.198108][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.205255][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.212451][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.220467][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.227590][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 456.234893][ T5902] usb 2-1: USB disconnect, device number 16 [ 456.240791][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 456.372378][ T5902] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 456.560661][T10428] batadv1: entered promiscuous mode [ 457.033973][T10435] overlay: ./file0 is not a directory [ 458.343263][T10444] input: syz0 as /devices/virtual/input/input56 [ 458.364087][T10444] input: failed to attach handler leds to device input56, error: -6 [ 458.551347][ T5944] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 458.741479][ T5944] usb 3-1: Using ep0 maxpacket: 16 [ 458.785641][ T5944] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 458.825682][ T5944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.851687][ T5944] usb 3-1: Product: syz [ 458.873663][ T5944] usb 3-1: Manufacturer: syz [ 458.901368][ T5944] usb 3-1: SerialNumber: syz [ 458.919896][ T5944] usb 3-1: config 0 descriptor?? [ 458.957042][ T5944] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 459.011504][ T5944] usb 3-1: Detected FT232H [ 459.123813][T10377] Set syz1 is full, maxelem 65536 reached [ 459.161785][ T5944] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 459.320994][T10449] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1065'. [ 460.421005][T10443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.577588][ T5944] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 460.642997][T10443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.687237][T10468] ./file0: Can't lookup blockdev [ 462.171570][ T48] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 462.891773][ T48] usb 7-1: Using ep0 maxpacket: 32 [ 462.908652][ T48] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 462.962615][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.021819][ T48] usb 7-1: config 0 descriptor?? [ 463.102235][T10474] ieee802154 phy0 wpan0: encryption failed: -22 [ 463.476452][ T48] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 463.501509][ T9] usb 3-1: USB disconnect, device number 21 [ 463.531072][ T9] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 463.552445][ T9] ftdi_sio 3-1:0.0: device disconnected [ 463.597556][ T48] usb 7-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 463.712784][ T48] usb 7-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 466.445175][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 466.445188][ T30] audit: type=1400 audit(1760874488.287:1226): avc: denied { accept } for pid=10510 comm="syz.1.1081" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 466.538997][T10515] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 466.714933][T10519] syz_tun: entered allmulticast mode [ 466.785248][T10519] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 466.794113][T10519] mroute: pending queue full, dropping entries [ 466.918198][T10521] can0: slcan on ttyS3. [ 466.952777][T10518] syz_tun: left allmulticast mode [ 467.476750][ T9271] warn_alloc: 1 callbacks suppressed [ 467.476763][ T9271] syz.3.821: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 467.614190][ T9271] CPU: 1 UID: 0 PID: 9271 Comm: syz.3.821 Not tainted syzkaller #0 PREEMPT(full) [ 467.614214][ T9271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 467.614222][ T9271] Call Trace: [ 467.614227][ T9271] [ 467.614231][ T9271] dump_stack_lvl+0x16c/0x1f0 [ 467.614251][ T9271] warn_alloc+0x248/0x3a0 [ 467.614267][ T9271] ? __pfx_warn_alloc+0x10/0x10 [ 467.614286][ T9271] ? relay_open_buf.part.0+0x194/0xc40 [ 467.614303][ T9271] ? __vmalloc_node_noprof+0xad/0xf0 [ 467.614324][ T9271] __vmalloc_node_range_noprof+0xfe2/0x1480 [ 467.614348][ T9271] ? relay_open_buf.part.0+0x194/0xc40 [ 467.614368][ T9271] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 467.614389][ T9271] ? ___kmalloc_large_node+0xed/0x160 [ 467.614409][ T9271] __kvmalloc_node_noprof+0x431/0x9c0 [ 467.614425][ T9271] ? relay_open_buf.part.0+0x194/0xc40 [ 467.614441][ T9271] ? trace_kmalloc+0x2b/0xd0 [ 467.614456][ T9271] ? __kmalloc_noprof+0x34f/0x880 [ 467.614466][ T9271] ? relay_open_buf.part.0+0x194/0xc40 [ 467.614482][ T9271] ? relay_open_buf.part.0+0xf9/0xc40 [ 467.614500][ T9271] ? relay_open_buf.part.0+0x194/0xc40 [ 467.614515][ T9271] relay_open_buf.part.0+0x194/0xc40 [ 467.614536][ T9271] relay_open+0x653/0xad0 [ 467.614552][ T9271] ? debugfs_create_file_full+0x41/0x60 [ 467.614571][ T9271] do_blk_trace_setup+0x4c5/0xb00 [ 467.614588][ T9271] blk_trace_setup+0xed/0x1b0 [ 467.614602][ T9271] ? __pfx_blk_trace_setup+0x10/0x10 [ 467.614622][ T9271] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 467.614642][ T9271] sg_ioctl+0x7d7/0x2880 [ 467.614662][ T9271] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 467.614682][ T9271] ? __pfx_sg_ioctl+0x10/0x10 [ 467.614701][ T9271] ? hook_file_ioctl_common+0x145/0x410 [ 467.614717][ T9271] ? selinux_file_ioctl+0x180/0x270 [ 467.614732][ T9271] ? selinux_file_ioctl+0xb4/0x270 [ 467.614748][ T9271] ? __pfx_sg_ioctl+0x10/0x10 [ 467.614766][ T9271] __x64_sys_ioctl+0x18e/0x210 [ 467.614780][ T9271] do_syscall_64+0xcd/0xfa0 [ 467.614795][ T9271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.614807][ T9271] RIP: 0033:0x7fed7dd8efc9 [ 467.614817][ T9271] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.614828][ T9271] RSP: 002b:00007fed7bbb2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 467.614840][ T9271] RAX: ffffffffffffffda RBX: 00007fed7dfe6270 RCX: 00007fed7dd8efc9 [ 467.614847][ T9271] RDX: 0000200000000b40 RSI: 00000000c0481273 RDI: 0000000000000009 [ 467.614853][ T9271] RBP: 00007fed7de11f91 R08: 0000000000000000 R09: 0000000000000000 [ 467.614860][ T9271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 467.614866][ T9271] R13: 00007fed7dfe6308 R14: 00007fed7dfe6270 R15: 00007ffe13c64ce8 [ 467.614881][ T9271] [ 467.614887][ T9271] Mem-Info: [ 467.953787][T10537] ./file0: Can't lookup blockdev [ 467.969383][T10520] can0 (unregistered): slcan off ttyS3. [ 468.757267][ T9271] active_anon:1822 inactive_anon:2909 isolated_anon:0 [ 468.757267][ T9271] active_file:10630 inactive_file:2413 isolated_file:0 [ 468.757267][ T9271] unevictable:768 dirty:494 writeback:0 [ 468.757267][ T9271] slab_reclaimable:9993 slab_unreclaimable:120871 [ 468.757267][ T9271] mapped:47990 shmem:1168 pagetables:3927 [ 468.757267][ T9271] sec_pagetables:0 bounce:0 [ 468.757267][ T9271] kernel_misc_reclaimable:0 [ 468.757267][ T9271] free:78183 free_pcp:31226 free_cma:0 [ 468.802721][ T9271] Node 0 active_anon:1860kB inactive_anon:11636kB active_file:7992kB inactive_file:8968kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:166832kB dirty:1520kB writeback:0kB shmem:3096kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12816kB pagetables:5120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 468.835433][ T9271] Node 1 active_anon:5428kB inactive_anon:0kB active_file:34528kB inactive_file:684kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:25128kB dirty:456kB writeback:0kB shmem:1576kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:1204kB pagetables:10588kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 469.024569][ T9271] Node 0 DMA free:10132kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:236kB local_pcp:108kB free_cma:0kB [ 469.055851][ T6638] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 469.168739][T10549] QAT: Stopping all acceleration devices. [ 469.223518][T10549] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1091'. [ 469.366796][ T9271] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 469.452898][ T6638] usb 3-1: Using ep0 maxpacket: 32 [ 469.682154][ T30] audit: type=1400 audit(1760874491.307:1227): avc: denied { connect } for pid=10531 comm="syz.1.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 469.707989][ T9271] Node 0 DMA32 free:96796kB boost:76696kB min:110788kB low:119308kB high:127828kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1860kB inactive_anon:11380kB active_file:7992kB inactive_file:8968kB unevictable:1536kB writepending:1528kB zspages:0kB present:3129332kB managed:2541312kB mlocked:0kB bounce:0kB free_pcp:1740kB local_pcp:740kB free_cma:0kB [ 469.937657][ T6638] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 469.948599][ T6638] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.958925][ T6638] usb 3-1: config 0 descriptor?? [ 469.971372][ T9271] lowmem_reserve[]: 0 0 1 1 1 [ 469.998351][ T9271] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 470.062619][ T9271] lowmem_reserve[]: 0 0 0 0 0 [ 470.104390][ T9271] Node 1 Normal free:213524kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:5676kB inactive_anon:0kB active_file:34528kB inactive_file:684kB unevictable:1536kB writepending:456kB zspages:9708kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:112824kB local_pcp:35508kB free_cma:0kB [ 470.322209][ T6638] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 470.345104][ T9271] lowmem_reserve[]: 0 0 0 0 0 [ 470.363126][ T9271] Node 0 DMA: 5*4kB (UME) 4*8kB (UME) 2*16kB (ME) 2*32kB (UE) 2*64kB (UE) 1*128kB (E) 2*256kB (ME) 2*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 1*4096kB (M) = 10132kB [ 470.403641][T10561] XFS (nullb0): Invalid superblock magic number [ 470.456602][ T9271] Node 0 DMA32: 1596*4kB (UME) 1240*8kB (UME) 752*16kB (UME) 630*32kB (UME) 298*64kB (UME) 135*128kB (UME) 53*256kB (UME) 2*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 99440kB [ 470.486858][ T9271] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 470.522321][ T9271] Node 1 Normal: 778*4kB (ME) 416*8kB (UM) 291*16kB (UME) 139*32kB (UME) 115*64kB (UM) 66*128kB (UM) 37*256kB (UME) 15*512kB (UME) 3*1024kB (M) 1*2048kB (U) 39*4096kB (M) = 213368kB [ 470.540872][ T9271] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 470.550829][ T9271] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 470.562706][ T9271] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 470.609941][ T9271] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 470.642609][ T9271] 14695 total pagecache pages [ 470.651637][ T9271] 484 pages in swap cache [ 470.706536][ T9271] Free swap = 77972kB [ 470.810971][ T9271] Total swap = 124996kB [ 470.851729][ T9271] 2097051 pages RAM [ 470.896465][ T9271] 0 pages HighMem/MovableOnly [ 470.938387][ T9271] 429697 pages reserved [ 471.046368][ T9271] 0 pages cma reserved [ 471.104947][ T30] audit: type=1400 audit(1760874492.957:1228): avc: denied { setopt } for pid=10582 comm="syz.0.1097" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 471.125659][T10585] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1097'. [ 471.724062][ T30] audit: type=1400 audit(1760874493.577:1229): avc: denied { setopt } for pid=10590 comm="syz.7.1099" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 471.848891][T10592] veth1_to_hsr: entered promiscuous mode [ 472.014585][T10590] veth1_to_hsr: left promiscuous mode [ 472.147543][T10600] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 472.611405][T10600] SELinux: failed to load policy [ 473.430699][T10621] ./file0: Can't lookup blockdev [ 473.812253][ T777] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 474.201335][ T777] usb 2-1: Using ep0 maxpacket: 32 [ 474.430884][ T777] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 474.617317][ T30] audit: type=1326 audit(1760874496.357:1230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10618 comm="syz.2.1105" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3f3a18efc9 code=0x0 [ 474.826044][ T777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.969239][ T777] usb 2-1: config 0 descriptor?? [ 476.136772][ T777] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 477.759019][T10657] input: syz0 as /devices/virtual/input/input57 [ 477.766246][T10657] input: failed to attach handler leds to device input57, error: -6 [ 477.886999][ T30] audit: type=1326 audit(1760874499.687:1231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 478.368644][ T30] audit: type=1326 audit(1760874499.687:1232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 478.979575][ T30] audit: type=1326 audit(1760874499.687:1233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 479.003170][ T30] audit: type=1326 audit(1760874499.687:1234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 479.501559][ T30] audit: type=1326 audit(1760874499.687:1235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 479.602740][T10675] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 479.634070][ T30] audit: type=1326 audit(1760874499.707:1236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 479.652257][T10675] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 480.006221][T10675] random: crng reseeded on system resumption [ 480.021361][ T30] audit: type=1326 audit(1760874499.707:1237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 480.059328][ T30] audit: type=1326 audit(1760874500.017:1238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 480.091945][T10681] Device name cannot be null; rc = [-22] [ 480.108675][ T30] audit: type=1326 audit(1760874500.187:1239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 480.212301][ T30] audit: type=1326 audit(1760874500.187:1240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10653 comm="syz.1.1112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x7ffc0000 [ 480.458148][T10693] SQUASHFS error: Failed to read block 0x0: -5 [ 480.632233][T10693] unable to read squashfs_super_block [ 483.637273][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 483.637288][ T30] audit: type=1326 audit(1760874505.487:1248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10717 comm="syz.6.1129" exe="/root/syz-executor" sig=31 arch=c000003e syscall=39 compat=0 ip=0x7fa9af585e67 code=0x0 [ 483.827572][T10727] ieee802154 phy0 wpan0: encryption failed: -22 [ 485.633336][T10753] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1138'. [ 486.180437][T10767] ieee802154 phy0 wpan0: encryption failed: -22 [ 488.025163][T10789] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 488.040780][T10789] ./file0: Can't lookup blockdev [ 489.491756][T10802] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1147'. [ 492.376961][T10825] ieee802154 phy0 wpan0: encryption failed: -22 [ 492.386396][T10816] QAT: Stopping all acceleration devices. [ 492.503367][T10816] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1152'. [ 492.807853][ T30] audit: type=1400 audit(1760874514.617:1249): avc: denied { name_bind } for pid=10817 comm="syz.0.1153" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 493.170484][ T30] audit: type=1400 audit(1760874514.617:1250): avc: denied { mount } for pid=10817 comm="syz.0.1153" name="/" dev="pstore" ino=4166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 495.731733][T10867] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1163'. [ 497.686325][ T5834] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 497.711607][ T5834] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 497.720505][ T5834] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 497.728736][ T5834] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 497.736171][ T5834] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 497.851404][ T24] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 498.213317][ T5831] Bluetooth: hci6: command 0x0406 tx timeout [ 498.225177][ T24] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 498.270095][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.321271][ T24] usb 1-1: Product: syz [ 498.325474][ T24] usb 1-1: Manufacturer: syz [ 498.341483][ T24] usb 1-1: SerialNumber: syz [ 498.372038][ T24] usb 1-1: config 0 descriptor?? [ 498.625908][ T5821] Bluetooth: hci3: unknown advertising packet type: 0x17 [ 498.625971][ T5821] Bluetooth: hci3: Dropping invalid advertising data [ 498.641111][ T5821] Bluetooth: hci3: Malformed LE Event: 0x02 [ 498.665546][T10884] xt_time: unknown flags 0xc [ 498.697183][T10886] chnl_net:caif_netlink_parms(): no params data found [ 498.708089][ T24] usb-storage 1-1:0.0: USB Mass Storage device detected [ 498.870628][ T24] usb 1-1: USB disconnect, device number 15 [ 498.955727][ T30] audit: type=1400 audit(1760874520.797:1251): avc: denied { read } for pid=10899 comm="syz.2.1172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 499.771407][ T5821] Bluetooth: hci8: command tx timeout [ 500.067597][ T30] audit: type=1326 audit(1760874521.777:1252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 500.272516][ T30] audit: type=1326 audit(1760874521.777:1253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 500.333880][ T30] audit: type=1326 audit(1760874521.777:1254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 500.378414][T10886] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.409000][T10886] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.421817][ T30] audit: type=1326 audit(1760874521.787:1255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 500.476987][T10886] bridge_slave_0: entered allmulticast mode [ 500.497547][T10886] bridge_slave_0: entered promiscuous mode [ 500.560578][T10886] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.596319][ T30] audit: type=1326 audit(1760874521.787:1256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 500.915742][T10886] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.971838][T10886] bridge_slave_1: entered allmulticast mode [ 500.979157][T10886] bridge_slave_1: entered promiscuous mode [ 501.059958][ T30] audit: type=1326 audit(1760874521.787:1257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 501.083526][ C1] vkms_vblank_simulate: vblank timer overrun [ 501.145700][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.152324][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.403406][T10886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 501.477052][ T30] audit: type=1326 audit(1760874521.787:1258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 501.493180][T10886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 501.500568][ C1] vkms_vblank_simulate: vblank timer overrun [ 501.697252][ T30] audit: type=1326 audit(1760874521.787:1259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=149 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 501.720739][ C1] vkms_vblank_simulate: vblank timer overrun [ 501.842373][T10932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1178'. [ 501.851384][ T5821] Bluetooth: hci8: command tx timeout [ 501.915789][ T30] audit: type=1326 audit(1760874521.867:1260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10910 comm="syz.0.1173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f212a98efc9 code=0x7ffc0000 [ 501.994617][T10937] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1178'. [ 502.123210][T10886] team0: Port device team_slave_0 added [ 502.137639][T10886] team0: Port device team_slave_1 added [ 502.538374][T10947] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 502.555739][T10947] ./file0: Can't lookup blockdev [ 503.939791][ T5821] Bluetooth: hci8: command tx timeout [ 504.214027][ T5875] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 504.316114][T10886] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 504.347771][T10886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 504.373662][ C1] vkms_vblank_simulate: vblank timer overrun [ 504.427302][ T5875] usb 1-1: Using ep0 maxpacket: 32 [ 504.447253][ T5875] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 504.510083][T10886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 504.561316][ T5875] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.602345][ T5875] usb 1-1: config 0 descriptor?? [ 504.760660][T10886] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 504.826134][T10886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 504.831317][ T5875] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 504.852199][ C1] vkms_vblank_simulate: vblank timer overrun [ 504.891417][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 504.891436][ T30] audit: type=1400 audit(1760874526.737:1278): avc: denied { create } for pid=10959 comm="syz.1.1183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 504.942512][T10886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 505.012243][ T30] audit: type=1400 audit(1760874526.867:1279): avc: denied { create } for pid=10961 comm="syz.2.1184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 505.056269][ T30] audit: type=1400 audit(1760874526.907:1280): avc: denied { ioctl } for pid=10961 comm="syz.2.1184" path="socket:[31195]" dev="sockfs" ino=31195 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 505.145553][ T30] audit: type=1400 audit(1760874526.937:1281): avc: denied { connect } for pid=10959 comm="syz.1.1183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 505.514761][T10886] hsr_slave_0: entered promiscuous mode [ 505.523795][T10886] hsr_slave_1: entered promiscuous mode [ 505.531988][T10886] debugfs: 'hsr0' already exists in 'hsr' [ 505.537900][T10886] Cannot create hsr debugfs directory [ 505.614531][T10970] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1185'. [ 506.011351][ T5821] Bluetooth: hci8: command tx timeout [ 506.159370][T10977] tty tty2: ldisc open failed (-12), clearing slot 1 [ 506.688351][T10983] input: syz0 as /devices/virtual/input/input58 [ 506.694963][T10983] input: failed to attach handler leds to device input58, error: -6 [ 507.464744][ T30] audit: type=1400 audit(1760874529.317:1282): avc: denied { getopt } for pid=10999 comm="syz.6.1194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 507.489429][T11002] QAT: Stopping all acceleration devices. [ 507.549882][T11002] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1193'. [ 508.040001][T10886] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 508.070399][T10886] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 508.163441][T10886] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 508.443307][T10886] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 508.803843][ T30] audit: type=1326 audit(1760874530.657:1283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11013 comm="syz.1.1195" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1374b8efc9 code=0x0 [ 509.019971][T10886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.071771][T10886] 8021q: adding VLAN 0 to HW filter on device team0 [ 509.132545][ T3000] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.139733][ T3000] bridge0: port 1(bridge_slave_0) entered forwarding state [ 509.155290][ T30] audit: type=1326 audit(1760874531.007:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11023 comm="syz.6.1197" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa9af58efc9 code=0x0 [ 509.335927][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.343138][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 509.394159][T10886] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 509.425243][T10886] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 509.833449][T11032] process 'syz.2.1198' launched './file0' with NULL argv: empty string added [ 509.865583][T11032] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 509.892962][T11032] CIFS mount error: No usable UNC path provided in device string! [ 509.892962][T11032] [ 509.904208][T11032] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 510.130885][ T30] audit: type=1400 audit(1760874531.677:1285): avc: denied { bind } for pid=11029 comm="syz.2.1198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 510.207209][ T30] audit: type=1400 audit(1760874531.697:1286): avc: denied { execute_no_trans } for pid=11029 comm="syz.2.1198" path="/248/file0" dev="tmpfs" ino=1382 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 510.325033][T10886] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 510.422433][T11041] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.429632][T11041] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.547203][T11041] bridge_slave_1: left allmulticast mode [ 510.571520][T11041] bridge_slave_1: left promiscuous mode [ 510.580072][T11041] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.716486][T11041] bridge_slave_0: left allmulticast mode [ 510.754268][T11041] bridge_slave_0: left promiscuous mode [ 510.773683][T11041] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.388546][T10886] veth0_vlan: entered promiscuous mode [ 511.448869][T10886] veth1_vlan: entered promiscuous mode [ 511.625366][T10886] veth0_macvtap: entered promiscuous mode [ 511.645984][T10886] veth1_macvtap: entered promiscuous mode [ 511.723045][T10886] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 511.872035][T10886] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 511.893949][ T69] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.907483][T11063] devpts: Bad value for 'max' [ 511.922425][ T69] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.518311][T11063] bond1: entered allmulticast mode [ 512.528006][T11063] 8021q: adding VLAN 0 to HW filter on device bond1 [ 512.628740][ T13] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.674056][ T13] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.633132][T11078] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1208'. [ 513.749000][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 513.785024][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 513.984362][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 513.992831][T11086] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1210'. [ 514.002251][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.472101][T11091] netlink: 68 bytes leftover after parsing attributes in process `syz.8.1166'. [ 515.133352][ T30] audit: type=1326 audit(2000000002.470:1287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11098 comm="syz.2.1214" exe="/root/syz-executor" sig=31 arch=c000003e syscall=39 compat=0 ip=0x7f3f3a185e67 code=0x0 [ 515.178850][T11102] ucma_write: process 222 (syz.6.1212) changed security contexts after opening file descriptor, this is not allowed. [ 515.322299][ T30] audit: type=1400 audit(2000000002.510:1288): avc: denied { mounton } for pid=11099 comm="syz.6.1212" path="/proc/222/task" dev="proc" ino=32883 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 515.475605][T11112] QAT: Stopping all acceleration devices. [ 515.488502][T11112] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1216'. [ 515.719056][T11117] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1217'. [ 515.851640][ T31] INFO: task syz.3.821:9272 blocked for more than 143 seconds. [ 515.859443][ T31] Not tainted syzkaller #0 [ 515.865121][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 515.875426][ T31] task:syz.3.821 state:D stack:29096 pid:9272 tgid:9264 ppid:5811 task_flags:0x400040 flags:0x00080002 [ 515.971293][ T31] Call Trace: [ 516.162832][ T31] [ 516.165795][ T31] __schedule+0x1190/0x5de0 [ 516.205831][ T31] ? look_up_lock_class+0x59/0x150 [ 516.211014][ T31] ? __pfx___schedule+0x10/0x10 [ 516.251401][ T31] ? find_held_lock+0x2b/0x80 [ 516.256144][ T31] ? schedule+0x2d7/0x3a0 [ 516.260634][ T31] ? blk_trace_remove+0x1f/0x40 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 516.295279][ T31] schedule+0xe7/0x3a0 [ 516.299384][ T31] schedule_preempt_disabled+0x13/0x30 [ 516.321328][ T31] __mutex_lock+0x818/0x1060 [ 516.331565][ T31] ? find_held_lock+0x2b/0x80 [ 516.336257][ T31] ? blk_trace_remove+0x1f/0x40 [ 516.385002][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 516.390083][ T31] ? tomoyo_path_number_perm+0x18d/0x580 [ 516.431298][ T31] ? blk_trace_remove+0x1f/0x40 [ 516.451299][ T31] blk_trace_remove+0x1f/0x40 [ 516.456025][ T31] sg_ioctl+0x9c9/0x2880 [ 516.460271][ T31] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 516.493457][ T31] ? __pfx_sg_ioctl+0x10/0x10 [ 516.498179][ T31] ? hook_file_ioctl_common+0x145/0x410 [ 516.517996][ T31] ? selinux_file_ioctl+0x180/0x270 [ 516.535919][ T31] ? selinux_file_ioctl+0xb4/0x270 [ 516.553385][ T31] ? __pfx_sg_ioctl+0x10/0x10 [ 516.558103][ T31] __x64_sys_ioctl+0x18e/0x210 [ 516.581302][ T31] do_syscall_64+0xcd/0xfa0 [ 516.591431][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.597333][ T31] RIP: 0033:0x7fed7dd8efc9 [ 516.623790][ T31] RSP: 002b:00007fed7b78f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 516.657687][ T31] RAX: ffffffffffffffda RBX: 00007fed7dfe6360 RCX: 00007fed7dd8efc9 [ 516.681371][ T31] RDX: 0000000020000000 RSI: 0000000000001276 RDI: 0000000000000009 [ 516.689355][ T31] RBP: 00007fed7de11f91 R08: 0000000000000000 R09: 0000000000000000 [ 516.724085][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 516.761365][ T31] R13: 00007fed7dfe63f8 R14: 00007fed7dfe6360 R15: 00007ffe13c64ce8 [ 516.769362][ T31] [ 516.802952][ T31] [ 516.802952][ T31] Showing all locks held in the system: [ 516.810679][ T31] 1 lock held by khungtaskd/31: [ 516.844380][ T31] #0: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 516.881366][ T31] 6 locks held by kworker/1:1/48: [ 516.901428][ T31] #0: ffff888020aa8548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 516.944027][ T31] #1: ffffc90000b97d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 516.981389][ T31] #2: ffff88802983e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 516.990280][ T31] #3: ffff88807cf56198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.021288][ T31] #4: ffff88807aa3e160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.030613][ T31] #5: ffffffff8e2771d0 (umhelper_sem){++++}-{4:4}, at: usermodehelper_read_trylock+0xa9/0x250 [ 517.064133][ T31] 5 locks held by kworker/0:2/777: [ 517.081923][ T31] #0: ffff888020aa8548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 517.092837][ T31] #1: ffffc900032a7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 517.111341][ T31] #2: ffff888144376198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 517.120233][ T31] #3: ffff88802553d198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.147724][ T31] #4: ffff888055fe0160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.157736][ T31] 2 locks held by getty/5575: [ 517.166530][ T31] #0: ffff888035cd10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 517.176764][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 517.190368][ T31] 5 locks held by kworker/0:4/5875: [ 517.201760][ T31] #0: ffff888020aa8548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 517.217674][ T31] #1: ffffc9000411fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 517.229327][ T31] #2: ffff888144b20198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 517.238483][ T31] #3: ffff888025c12198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.272501][ T31] #4: ffff888025c14160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.301512][ T31] 5 locks held by kworker/1:7/6638: [ 517.322678][ T31] #0: ffff888020aa8548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 517.421358][ T31] #1: ffffc9000bff7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 517.439292][ T31] #2: ffff88814438e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 517.448349][ T31] #3: ffff88801b7b5198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.461369][ T31] #4: ffff888055d41160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 517.472917][ T31] 2 locks held by syz.3.821/9271: [ 517.478326][ T31] 1 lock held by syz.3.821/9272: [ 517.483659][ T31] #0: ffff888142b1d7a8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 [ 517.494835][ T31] 2 locks held by syz.5.916/9726: [ 517.501313][ T31] #0: ffff888141747ee8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd7/0x1b0 [ 517.531935][ T31] #1: ffffffff8e444428 (relay_channels_mutex){+.+.}-{4:4}, at: relay_open+0x395/0xad0 [ 517.551352][ T31] 1 lock held by syz.5.916/9731: [ 517.558512][ T31] #0: ffff888141747ee8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_startstop+0x7f/0x480 [ 517.571515][ T31] 1 lock held by syz.7.1124/10706: [ 517.576861][ T31] #0: ffff88802983e198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 [ 517.585909][ T31] 1 lock held by syz.6.1212/11101: [ 517.591029][ T31] #0: ffffffff8e3cf9f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 517.612985][ T31] 1 lock held by syz.8.1215/11105: [ 517.618156][ T31] #0: ffffffff8e3cf9f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 517.651305][ T31] 1 lock held by syz.8.1215/11106: [ 517.656441][ T31] #0: ffffffff9afbcb58 (nfnl_subsys_ipset){+.+.}-{4:4}, at: call_ad.constprop.0+0x24d/0x940 [ 517.678919][ T31] 2 locks held by vhost-11106/11107: [ 517.684449][ T31] #0: ffff88804b2118e8 (&vtsk->exit_mutex){+.+.}-{4:4}, at: vhost_task_fn+0x2e8/0x460 [ 517.701291][ T31] #1: ffff88804df48e80 (&worker->mutex){+.+.}-{4:4}, at: vhost_worker_killed+0x55/0x3d0 [ 517.722852][ T31] [ 517.725657][ T31] ============================================= [ 517.725657][ T31] [ 517.772296][ T31] NMI backtrace for cpu 1 [ 517.772316][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 517.772337][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 517.772347][ T31] Call Trace: [ 517.772353][ T31] [ 517.772360][ T31] dump_stack_lvl+0x116/0x1f0 [ 517.772388][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 517.772413][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 517.772434][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 517.772456][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 517.772485][ T31] watchdog+0xf3f/0x1170 [ 517.772506][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.772523][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.772537][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 517.772560][ T31] ? __kthread_parkme+0x19e/0x250 [ 517.772579][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.772602][ T31] kthread+0x3c5/0x780 [ 517.772626][ T31] ? __pfx_kthread+0x10/0x10 [ 517.772649][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.772666][ T31] ? __pfx_kthread+0x10/0x10 [ 517.772690][ T31] ret_from_fork+0x675/0x7d0 [ 517.772711][ T31] ? __pfx_kthread+0x10/0x10 [ 517.772733][ T31] ret_from_fork_asm+0x1a/0x30 [ 517.772768][ T31] [ 517.772774][ T31] Sending NMI from CPU 1 to CPUs 0: [ 517.904181][ C0] NMI backtrace for cpu 0 [ 517.904195][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 517.904211][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 517.904220][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 517.904242][ C0] Code: 67 74 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 75 23 00 fb f4 3c 0a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 517.904255][ C0] RSP: 0018:ffffffff8e007df8 EFLAGS: 000002c6 [ 517.904266][ C0] RAX: 000000000275d343 RBX: 0000000000000000 RCX: ffffffff8b66b2a9 [ 517.904275][ C0] RDX: 0000000000000000 RSI: ffffffff8db032f7 RDI: ffffffff8bf1dec0 [ 517.904283][ C0] RBP: fffffbfff1c12f40 R08: 0000000000000001 R09: ffffed1017086655 [ 517.904291][ C0] R10: ffff8880b84332ab R11: 0000000000000001 R12: 0000000000000000 [ 517.904299][ C0] R13: ffffffff8e097a00 R14: ffffffff908313d0 R15: 0000000000000000 [ 517.904307][ C0] FS: 0000000000000000(0000) GS:ffff8881249d8000(0000) knlGS:0000000000000000 [ 517.904321][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 517.904329][ C0] CR2: 00007ff4cdcf16b0 CR3: 000000000e182000 CR4: 00000000003526f0 [ 517.904338][ C0] Call Trace: [ 517.904343][ C0] [ 517.904347][ C0] default_idle+0x13/0x20 [ 517.904365][ C0] default_idle_call+0x6c/0xb0 [ 517.904382][ C0] do_idle+0x38d/0x500 [ 517.904397][ C0] ? __pfx_do_idle+0x10/0x10 [ 517.904408][ C0] ? trace_sched_exit_tp+0x2f/0x120 [ 517.904429][ C0] cpu_startup_entry+0x4f/0x60 [ 517.904441][ C0] rest_init+0x16b/0x2b0 [ 517.904451][ C0] ? acpi_subsystem_init+0x133/0x180 [ 517.904465][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 517.904481][ C0] start_kernel+0x3f6/0x4e0 [ 517.904495][ C0] x86_64_start_reservations+0x18/0x30 [ 517.904510][ C0] x86_64_start_kernel+0x130/0x190 [ 517.904523][ C0] common_startup_64+0x13e/0x148 [ 517.904547][ C0] [ 518.190800][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 518.197689][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 518.206808][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 518.216868][ T31] Call Trace: [ 518.220240][ T31] [ 518.223169][ T31] dump_stack_lvl+0x3d/0x1f0 [ 518.227779][ T31] vpanic+0x640/0x6f0 [ 518.231789][ T31] panic+0xca/0xd0 [ 518.235507][ T31] ? __pfx_panic+0x10/0x10 [ 518.239921][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 518.245283][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 518.251450][ T31] ? watchdog+0xe48/0x1170 [ 518.255895][ T31] ? watchdog+0xe3b/0x1170 [ 518.260475][ T31] watchdog+0xe59/0x1170 [ 518.264717][ T31] ? rcu_is_watching+0x12/0xc0 [ 518.269472][ T31] ? __pfx_watchdog+0x10/0x10 [ 518.274131][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 518.279351][ T31] ? __kthread_parkme+0x19e/0x250 [ 518.284391][ T31] ? __pfx_watchdog+0x10/0x10 [ 518.289058][ T31] kthread+0x3c5/0x780 [ 518.293124][ T31] ? __pfx_kthread+0x10/0x10 [ 518.297721][ T31] ? rcu_is_watching+0x12/0xc0 [ 518.302489][ T31] ? __pfx_kthread+0x10/0x10 [ 518.307077][ T31] ret_from_fork+0x675/0x7d0 [ 518.311656][ T31] ? __pfx_kthread+0x10/0x10 [ 518.316233][ T31] ret_from_fork_asm+0x1a/0x30 [ 518.321011][ T31] [ 518.324267][ T31] Kernel Offset: disabled [ 518.328598][ T31] Rebooting in 86400 seconds..