last executing test programs: 5m39.814390476s ago: executing program 3 (id=1292): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f00000003c0)}, 0x20) socket(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x20, 0x13, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x31184c9bc76892e0}, {0x85, 0x0, 0x0, 0x85}}}, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf51c}, 0x94) socket$inet6(0xa, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@var={0x1, 0x0, 0x0, 0xe, 0x2, 0x1}]}, {0x0, [0x5f]}}, 0x0, 0x2b, 0x0, 0x5}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = io_uring_setup(0x1d48, &(0x7f0000000340)={0x0, 0xb140, 0x1000, 0x6, 0x196}) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000060000000500000000", @ANYBLOB, @ANYRES32=0x0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r6, 0x4) close_range(r1, r6, 0x0) 5m35.256396427s ago: executing program 3 (id=1300): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000005480)={0x14, 0x2c, 0x107, 0x70bd2b, 0x25dfdbfb, {0x2, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x10000004}, 0xc010) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'pimreg1\x00', {0x1}, 0x26}) r4 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x98, 0x2d8, 0x98, 0x138, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) mount(0x0, 0x0, 0x0, 0x60078, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00fb15", @ANYRES16=r6, @ANYBLOB="10002dbd700000400000490000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030000"], 0x3c}, 0x1, 0x0, 0x0, 0x25}, 0x24004000) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) add_key$user(&(0x7f0000000180), &(0x7f0000000780)={'syz', 0x0}, 0x0, 0x0, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') 5m33.562726708s ago: executing program 3 (id=1304): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f00000003c0)}, 0x20) socket(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x20, 0x13, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x31184c9bc76892e0}, {0x85, 0x0, 0x0, 0x85}}}, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf51c}, 0x94) socket$inet6(0xa, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@var={0x1, 0x0, 0x0, 0xe, 0x2, 0x1}]}, {0x0, [0x5f]}}, 0x0, 0x2b, 0x0, 0x5}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = io_uring_setup(0x1d48, &(0x7f0000000340)={0x0, 0xb140, 0x1000, 0x6, 0x196}) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010", @ANYBLOB, @ANYRES32=0x0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r6, 0x4) close_range(r1, r6, 0x0) 5m32.28661586s ago: executing program 3 (id=1309): mkdir(&(0x7f0000001a80)='./file0\x00', 0xb33328a401cad7d9) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs, &(0x7f0000000100)=0x6e, 0x81800) getpeername$unix(r0, &(0x7f0000000140)=@abs, &(0x7f00000001c0)=0x6e) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) 5m32.062208267s ago: executing program 3 (id=1312): sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) io_setup(0x5, &(0x7f0000000e80)=0x0) io_pgetevents(r0, 0x1, 0x1, &(0x7f00000000c0)=[{}], 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0xa) openat$random(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) io_submit(r0, 0x1, &(0x7f0000001580)=[0x0]) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0xfffffffffffffffd) r4 = openat$binfmt_format(0xffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x3454, &(0x7f00000003c0)={0x0, 0x0, 0x40, 0x0, 0xa7}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) mmap(&(0x7f0000a82000/0x3000)=nil, 0x3000, 0x300000a, 0xa3b749903f41249d, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) write$binfmt_format(r4, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r6 = io_uring_setup(0xbbc, &(0x7f0000000280)={0x0, 0xd54b, 0x2, 0x4, 0x345}) io_uring_enter(r6, 0x100000, 0x2, 0xf, &(0x7f0000000000), 0x18) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, r7) socket$netlink(0x10, 0x3, 0x14) 5m29.342346359s ago: executing program 3 (id=1315): syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES64=0x0], 0x0) 5m29.096289065s ago: executing program 32 (id=1315): syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES64=0x0], 0x0) 4m59.460308909s ago: executing program 5 (id=1400): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x9fd, 0x84, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x6) io_setup(0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0xa, 0x3, 0xff) syz_open_dev$I2C(&(0x7f0000000000), 0x1800, 0x189802) syz_emit_ethernet(0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000000000)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0x6a, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$packet(0x11, 0x2, 0x300) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0x10}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x4c014) 4m58.622850734s ago: executing program 5 (id=1406): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@volatile}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x3a}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4m58.547013271s ago: executing program 5 (id=1407): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x20, 0x2, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x404}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x20}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x200}], 0x18}, 0x28000054) sendmsg$nl_route_sched_retired(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000006740)=@newtfilter={0x210, 0x2c, 0x800, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xf776df0cd9b86403}, {0x4, 0xffe0}, {0x2, 0x6}}, [@f_rsvp={{0x9}, {0x1e0, 0x2, [@TCA_RSVP_ACT={0x1dc, 0x6, [@m_skbmod={0x58, 0xc, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x8001}]}, {0x21, 0x6, "90a977e2cb334172f712bc5b2c7a97e2ebd4fba26a42d64f6b8bb5f72f"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_sample={0x150, 0x4, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x1, 0x101, 0x3, 0x5, 0x401}}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x81, 0x1ad5, 0x8, 0x4, 0x2}}]}, {0xf1, 0x6, "7b56df0f2ce0da026f7ac8f12cedb07ff3aedc9cd1470194aee2fd85aa2d5cc78209fa445dcb043df745200c343b5f76e527d904b58eef5d4aa878832b35ab0902134ca1f774e5e5f8c18eec2247197a814ccc5e13d4099a2fba0be73e0bb2302a5ca448bd58e5455e6fc681be0d3093abcfdd47e2df598332a4c2d47bacece5e4ae1e9c68faf7e9a41910ad8fbb0f7b07942415e9a428c7ca04abdbb691313f52c6f81fcae4663a616e1f09ce8f98de4163b2e8ebe81da6643c0542de870fa7335b42bdaa0b3b9491077756183a928d5d9aa484a0528adfa8e75cbdf726d6b0777e49f9c021d5f8bbd72da89b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_sample={0x30, 0x10, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x210}}, 0x0) recvmmsg(r3, &(0x7f0000001200)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/217, 0xd9}, {&(0x7f0000000340)=""/121, 0x79}, {&(0x7f0000000600)=""/134, 0x86}, {&(0x7f0000000480)=""/18, 0x12}, {&(0x7f00000002c0)=""/21, 0x15}], 0x5}, 0x4}], 0x2, 0x60, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r4 = epoll_create(0x101) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000040)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x28, r7, 0x4c1dad3e3d6a7499, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x0, 0x1, 0x4}) 4m58.034924435s ago: executing program 5 (id=1410): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') read$FUSE(r2, &(0x7f0000000b00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000a00)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) sendmsg$kcm(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f00000001c0)="d68450a362bfd2b5a1b3f53927840151689f21324b800ba5450ba2111abe14480e0356355586201c9819191dda5b939ab152f226937ef0fb29b612ee1789d64e6b5f9d005a76b89ca67920eebef24b136d90b4852f600ee97464c312e1a6c947e95dc29e5432dd86d3b909c9bb70e3d0768e4a63edc5040c996f347f90410bc734c373152bf1851f9f1658c0f86f61b353da5f1663c8674d00d6ba7b8b4a559038b73a942a1b2e2130e6b1eca735dbd03d351ad33817be92bf783f83b6476ffde5d2275d7adfc737fdb749201b1942683068a9442a25b7a564b2a80ce0045a3bfb14517ca00068f2", 0xe8}, {&(0x7f00000002c0)="c070b368cdeb789c8e3cf8b16bd7cf97a6219ab06ea3f0a5939d79844f617110c10fb6d5b5b0dc75b473c7d3c02a09b4d205af536d581d67f19556e00f9a04a701b219810fd45e77cd4cccf8a117ca9edd8ca704aa9d34b0a8caa03b7e92814fdbab394e0cf28732dcd090099689ce271b9bc6ba8238df2e89ecdf63afe53d849500fe8956637aeb0b3f22155554c3c74a0488c88a780a4ef1be6da4264edadc53a1aa1480246a22f68fefdb839a03021feea8d01b3a0944d6c1a0289480dc4255d4763a862bee0b351b0d58ddde851f761cb83ad7da519e03cc3b95ddd52db6029a4287b0cdce510572f2321ad37d3423c45615e82d65e6d6be85f43c18", 0xfe}, {&(0x7f0000000000)="64f6870d4ec9beb656deb0783fb27d4fe973a6797c51fbf4013fb92892ea73c015e3e9", 0x23}, {&(0x7f0000000540)="02485946dc146f0a6d2569214deba36308bcbbdf1601cb308c5e20f21448444e09ae5191", 0x24}, {&(0x7f0000000580)="17ae664d7d3071b51a0d5eedc6f29e3ebb2343ede5ebded0cc26608299e92be2185b216b08212590422a949ca346ab4a7e074f9f9d17232159117a0af885a8ba874e9e541546975ab9af4192603eae6f6ee1a1a698237adc6b31e170af69cddc60c8f4dc78f97fdfc16a7d6c488c82fcbbf2c0123abc3dacee8e7336d08a9df944ee24fc9ebe24e3ed8c5f68f8942c97e84edbe70089b16625b58cc9d1482e4c0aad4643a60abb7441e47cf7f812d2312c3e2c92", 0xb4}], 0x5, &(0x7f0000001a40)=ANY=[@ANYBLOB="e800000000000000ff0000000600000016596db986c0c4885ee9d284ffe05ff19e2485c543e4ae9624340bbfd178a1d26e290784e1cf3a77827d28217ddacbb82a883fab8a7d534da733e273857ab3743c6d637b2d0f5d95caaaaeba842327b3d71e19b64b1be952a94a579e32c96dd56245dd9e548ece7560c3d906e84a9df2d96ad740bdd10205f79d5c6f6370b4fe500dfef30b7040894ba7d1ea0720ad618801b8d5251bf5d187fc0d8a0255780d4c6e49ab43c1ae8d13fb81ab2d1c4f2c3c742d2b86ec07119e3b0e76de155024d68e87cdbcf41cdb787b539a806fda7ddaef00000000000000010000000000002900000000040000f05f335364b08a01bbb51773fa6df89608295d4ff158262e269738736cd27bacd6334b2dd56342447207633eeac7bb53d15528ead0a83fb1aecfbe79f62b62de667e68bbddbf9c1e364d9af170a19da7a657d4086c8e35af9d8b7df46f5b3b515700dbefdf5493b7e3392366b8d7af9d158197a063eb887cd81b4c20885f32c3d6a403c192bf30c86ce546ab8911c6c5b4e0967729c706a3b3d1beb90ab61a57550a18438c252b61350ac2b27d73702ea041ff0000003c50be49389c385b01bc375bc8d67ee847db35033074c3002840119c5039543589148ed4ed95946bd71014aa4da77c4f50162e0000000004000000762b9ef0de4d2e558273d9423af6281b2e05691c4fdb4e108b2dc02cbd57d201daec872a676dec978722633bd5f7d11d3ac8ead705f09114a5bbf8547767c8f35e6891a0ee33017b9a0eddaec1ec7464b498c07a25898ecc239f3b2f27718b57fac6b4594fbb66700343ebda63c2b8d0e9b1549d18ae7700"/624], 0x270}, 0x810) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x6}, 0x28) ioctl(0xffffffffffffffff, 0xb8, &(0x7f0000000000)="15e0185428227964d1") r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x40300, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x5, 0xc9}}}, 0x6) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000340)={0x1fe, 0x0, 0x30000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000200)={[0x8000000000000001, 0x9, 0xfffffffffffffffd, 0x85, 0x2, 0x0, 0x4002004c8, 0x1004, 0x45c5, 0x20000c595, 0xffffffffffffbff9, 0xffffffffffffffff, 0x4, 0x0, 0x80000004000000, 0x4], 0x100000, 0x2010d3}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'veth1_virt_wifi\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r4, r9, 0x25, 0x4, @val=@tcx}, 0x1c) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r11, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, 0x0, 0x0, 0x400000000000000, 0x1fffffffd}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m54.805805529s ago: executing program 5 (id=1424): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) dup3(0xffffffffffffffff, r0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f00000034c0)={0x2020}, 0xcac) (fail_nth: 4) 4m52.473243841s ago: executing program 5 (id=1434): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x3a}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000540)}, {&(0x7f0000001400)="12b5ca8883a72c61be64d1809e4e551c8fcc795bacbc79d1a786c09a1861dfb427e430bee5b00ac73434620f11a914ef7cf7658efc365a26b43990993f60d4ffeb9cc31d7d5fc06ba7c3a4d828f40fca355cff79686f12971618904dc7d09e85e7a5f9194c4cae7983ee20f6c522b89ecc73c43438aad7dd15ff4738f5e4e1b7713142e7ff6cfc1b6cf7baba9ebf3b471cd0a72011fef02b46e280ad7a8c42d24bfb2ffe1518bc0fea207ec37a9e388c9dea8124df3f50a75f03df8d30d7b3b73e274042a52c058e1d85ef3b420b4dfce815cff6265e625a61b6fca9699edaadd192a3ae60c765260d1cbfb21f0cc30d8128b3783867b85873de07b02635d5573f9e578094a3ce6efbf44818daef38e14005a360909d226d7e13a86f6c83b6aaf615b6a2642d17bc2c56b8b0f8209e20ec1e0f58b0486493e511ab0a45b44a87340a9052ef5fba93c83753f1b101a744407f54d052188087c1cf43de80fd7bd5f3ce8585b5499959e6c3f5e17ae837d7c5627abb604947ad9906d641658f01464f48244182de8d5a8d037403ad4a964e2124177771a84806cda0682d58743928d2d16d83fd8b706a9669ac7605e8d857ac586dc2eda90715951c21bd116ade52f03cd61f3874aaefa77da678450228eb476d84bf175564a215e1683ced4bb9adba5daed835c6b38b61b213834aca56b86259784addb8601d26a42ad637ee296cd4382aaa7c1eaa5cbfa3a7177390bc646916aeb885d2dd43fc5b2dbbd2d184ba6cc6a439b95b5d814a8582405635b5c6bdb41c24af7a10bbd264eb2308a800a09705ac7856a7ac993cb4d88fea4cd1d5cf9e82e10c4badb996f4c0d5fd5866baf90a07d8777f793feb9250e22dd5190aa26c2a31412f1b41e0a65d0e435a9c5ebbf5205f6c6a117ce1fb16e8eb797e7d3eb5d62178dc0441941e9cb464814982ebe54195d73113efc971799121683f6e85d24ad6f21023868327b67446a36ebffda572b90f9b228a03b612e7e0ca09aac6b5710fc90f51c0efefb69b5d26ba9a1d8954832b1370d099d09c07fb2893d57d617ec0d626f1f96ee1608e0f8d9ca1b491578d639ac74b3ea568a474707ac756555d0ae9cdc609609e30d7ef2648fb8baa5854e58b60fac9ec9670c620ce6dcf3bbcca971cb5bf37462febde30e3865960627ceb15a11dd891160a2fcbb682c94a7de4e00fff20774364ffc4bfa31173261f1684dbbaa9addf0d9bc43539a7c09c6b98769aecf8529402bc66e37f0f20580e8e5f59ec48979957552fe17b897dcb4ed1a8d0fdf68d8c065c9d3501b387cf08c681326fcd79e7104eb50bc58a0140b594ad57b8d4be0c50f98e9c3e323d0a57001f8c6a094a7908315c7d7b33227861d2035649bb91daf77776e11159f3ebf7f3ed576adfc364f363e6f474dbbe3500c62c74193e7102fdf57b345066a6ebe47b4b469187631b586676e8e449fa215444366baf5d675f637a0f52c36a042d74957e94bd6d87061675da18128f69106970a9492d76dc312884bb7fcd88ca7e13f2914ba817724bc97ab634e845dfd1ab40344c33c7c202674ef959378abaf3f4fa038a6bbec31f5bd88f81240d2722dfa5e8621eb604db9ae06d49f0a56d64d525f3d41b367ed4d459f21baa3dc43c7cbe096f15bead83bc5ffe2f82128f2943a479556a39ab661bf0a86e0ad0520ab015112eeb06c13abc0da61cc6bf9508182d142696a4670fef7dcfa7a7e09f673c992f3acd4bafa7874c8bf9dc362943d7cd3c14d32bb7a8c3e3f1f55f500eca0c6fd0f199fefe601857e5307660c000cbd8f83f64e2afeb931f5dbba2d538f1c1d78c6ecd14af198f9e0ae4a8e2ef6cda63e059f5b3137946434418fd8920753c3ea5d054ad5d3da2749c94b23018be9495831a1ac647783823ac4f554bea483ee919824516f8d3d9d90753d69dd6375f0edafc98716d2aa7dbbf73208ee017fddec8c994cb5df3f74bfed87db0b88076c430495ce8a39b4b61003bb6c0e12a2f6d41a994537dadc0b389d5a1049e26b968d4aa8ded4fc38dec2ab5b14b5d0d0e24b37875e17d1066e0b04c807ef6712034f0cbd899e5cfd68143e0c3865c00a18fc7001fe9386acb55614fb7c739aef69bf21b8364e407fdb62e068359017714809d3a0b61b8bd046119f2a8e71f17908da23fbe13e50eafce63abba77a07695782fb01423efffe421bc9bede0df8ff1e163f677178eb84aec1c8517ca5a503fddba2a15878d0bf1bd255671f17417692a950fb0181150a08868107071661984c0099d588cc9456eb457fcb5fc37cec48a30aa0aa83251394fc1ec9cd0be2b7b95798a59ffd1d0a4b62e82de24bc54ad7c7385371bd27469d2631167e6c021f01f0e5ebf3819cb1f07e1cec4813ef51cc0b8e9c1069e472876e8721b81d64967edb507724fefb6128745623f6c3e520812ae1f373901d9e8f662d45aa7a1d51709960f82dc7580af43ca338631eb32259564e3379dbe0dc3bd700c8c7b04b66cff0b07d930e7a166fce6b0191283451c8dd50774b6c8d3adadd024c3faf1cf2ca2bc8d45804da21b56eb296a4f80b9a3a99fc6557b32de7db3c9637c8d481b29211c304127bf1504d6e5f9bc410d321d7cf28d55cc2f51eee3b284a67fbb8186391b2e0eae792aa8", 0x75b}, {0x0}, {&(0x7f0000000680)="cc18101d6bec7dadde1d231d7be01e1a3ebe", 0x12}, {&(0x7f00000006c0)="2219a8d1a15d2cc1d9f7e487ed6138173c17bebef35e5c7319", 0x19}, {0x0}], 0x6}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4m52.172900186s ago: executing program 33 (id=1434): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x3a}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000540)}, {&(0x7f0000001400)="12b5ca8883a72c61be64d1809e4e551c8fcc795bacbc79d1a786c09a1861dfb427e430bee5b00ac73434620f11a914ef7cf7658efc365a26b43990993f60d4ffeb9cc31d7d5fc06ba7c3a4d828f40fca355cff79686f12971618904dc7d09e85e7a5f9194c4cae7983ee20f6c522b89ecc73c43438aad7dd15ff4738f5e4e1b7713142e7ff6cfc1b6cf7baba9ebf3b471cd0a72011fef02b46e280ad7a8c42d24bfb2ffe1518bc0fea207ec37a9e388c9dea8124df3f50a75f03df8d30d7b3b73e274042a52c058e1d85ef3b420b4dfce815cff6265e625a61b6fca9699edaadd192a3ae60c765260d1cbfb21f0cc30d8128b3783867b85873de07b02635d5573f9e578094a3ce6efbf44818daef38e14005a360909d226d7e13a86f6c83b6aaf615b6a2642d17bc2c56b8b0f8209e20ec1e0f58b0486493e511ab0a45b44a87340a9052ef5fba93c83753f1b101a744407f54d052188087c1cf43de80fd7bd5f3ce8585b5499959e6c3f5e17ae837d7c5627abb604947ad9906d641658f01464f48244182de8d5a8d037403ad4a964e2124177771a84806cda0682d58743928d2d16d83fd8b706a9669ac7605e8d857ac586dc2eda90715951c21bd116ade52f03cd61f3874aaefa77da678450228eb476d84bf175564a215e1683ced4bb9adba5daed835c6b38b61b213834aca56b86259784addb8601d26a42ad637ee296cd4382aaa7c1eaa5cbfa3a7177390bc646916aeb885d2dd43fc5b2dbbd2d184ba6cc6a439b95b5d814a8582405635b5c6bdb41c24af7a10bbd264eb2308a800a09705ac7856a7ac993cb4d88fea4cd1d5cf9e82e10c4badb996f4c0d5fd5866baf90a07d8777f793feb9250e22dd5190aa26c2a31412f1b41e0a65d0e435a9c5ebbf5205f6c6a117ce1fb16e8eb797e7d3eb5d62178dc0441941e9cb464814982ebe54195d73113efc971799121683f6e85d24ad6f21023868327b67446a36ebffda572b90f9b228a03b612e7e0ca09aac6b5710fc90f51c0efefb69b5d26ba9a1d8954832b1370d099d09c07fb2893d57d617ec0d626f1f96ee1608e0f8d9ca1b491578d639ac74b3ea568a474707ac756555d0ae9cdc609609e30d7ef2648fb8baa5854e58b60fac9ec9670c620ce6dcf3bbcca971cb5bf37462febde30e3865960627ceb15a11dd891160a2fcbb682c94a7de4e00fff20774364ffc4bfa31173261f1684dbbaa9addf0d9bc43539a7c09c6b98769aecf8529402bc66e37f0f20580e8e5f59ec48979957552fe17b897dcb4ed1a8d0fdf68d8c065c9d3501b387cf08c681326fcd79e7104eb50bc58a0140b594ad57b8d4be0c50f98e9c3e323d0a57001f8c6a094a7908315c7d7b33227861d2035649bb91daf77776e11159f3ebf7f3ed576adfc364f363e6f474dbbe3500c62c74193e7102fdf57b345066a6ebe47b4b469187631b586676e8e449fa215444366baf5d675f637a0f52c36a042d74957e94bd6d87061675da18128f69106970a9492d76dc312884bb7fcd88ca7e13f2914ba817724bc97ab634e845dfd1ab40344c33c7c202674ef959378abaf3f4fa038a6bbec31f5bd88f81240d2722dfa5e8621eb604db9ae06d49f0a56d64d525f3d41b367ed4d459f21baa3dc43c7cbe096f15bead83bc5ffe2f82128f2943a479556a39ab661bf0a86e0ad0520ab015112eeb06c13abc0da61cc6bf9508182d142696a4670fef7dcfa7a7e09f673c992f3acd4bafa7874c8bf9dc362943d7cd3c14d32bb7a8c3e3f1f55f500eca0c6fd0f199fefe601857e5307660c000cbd8f83f64e2afeb931f5dbba2d538f1c1d78c6ecd14af198f9e0ae4a8e2ef6cda63e059f5b3137946434418fd8920753c3ea5d054ad5d3da2749c94b23018be9495831a1ac647783823ac4f554bea483ee919824516f8d3d9d90753d69dd6375f0edafc98716d2aa7dbbf73208ee017fddec8c994cb5df3f74bfed87db0b88076c430495ce8a39b4b61003bb6c0e12a2f6d41a994537dadc0b389d5a1049e26b968d4aa8ded4fc38dec2ab5b14b5d0d0e24b37875e17d1066e0b04c807ef6712034f0cbd899e5cfd68143e0c3865c00a18fc7001fe9386acb55614fb7c739aef69bf21b8364e407fdb62e068359017714809d3a0b61b8bd046119f2a8e71f17908da23fbe13e50eafce63abba77a07695782fb01423efffe421bc9bede0df8ff1e163f677178eb84aec1c8517ca5a503fddba2a15878d0bf1bd255671f17417692a950fb0181150a08868107071661984c0099d588cc9456eb457fcb5fc37cec48a30aa0aa83251394fc1ec9cd0be2b7b95798a59ffd1d0a4b62e82de24bc54ad7c7385371bd27469d2631167e6c021f01f0e5ebf3819cb1f07e1cec4813ef51cc0b8e9c1069e472876e8721b81d64967edb507724fefb6128745623f6c3e520812ae1f373901d9e8f662d45aa7a1d51709960f82dc7580af43ca338631eb32259564e3379dbe0dc3bd700c8c7b04b66cff0b07d930e7a166fce6b0191283451c8dd50774b6c8d3adadd024c3faf1cf2ca2bc8d45804da21b56eb296a4f80b9a3a99fc6557b32de7db3c9637c8d481b29211c304127bf1504d6e5f9bc410d321d7cf28d55cc2f51eee3b284a67fbb8186391b2e0eae792aa8", 0x75b}, {0x0}, {&(0x7f0000000680)="cc18101d6bec7dadde1d231d7be01e1a3ebe", 0x12}, {&(0x7f00000006c0)="2219a8d1a15d2cc1d9f7e487ed6138173c17bebef35e5c7319", 0x19}, {0x0}], 0x6}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2m49.489681534s ago: executing program 0 (id=1820): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x16) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) memfd_create(0x0, 0xe) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x5800) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x140, 0x82) r6 = fanotify_init(0x81, 0x40000) fanotify_mark(r6, 0x105, 0x40001032, r5, 0x0) read$FUSE(r6, &(0x7f0000002300)={0x2020}, 0x2020) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x1110000, 0x1000}, 0x20) writev(r2, &(0x7f0000000200), 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) fsopen(0x0, 0x0) socket$key(0xf, 0x3, 0x2) 2m45.929026815s ago: executing program 0 (id=1827): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @empty}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x50}}, 0x44) (fail_nth: 8) 2m44.755133335s ago: executing program 0 (id=1833): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0xf000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000002c0)={0x60, 0x0, 0x405, 0x70bd29, 0x25ffdc01, {0x1, 0x0, 0x300}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0xc10}, 0x44084) 2m44.102339965s ago: executing program 0 (id=1835): fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3) (async) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1000000, 0x10, 0xffffffffffffffff, 0x4008000) (async) r3 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r3, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="1401000022ac1a6231905fe2409947447591edf8de4cebc76d798c45939a2832245886f6ae5ec84f609436f26927b0574b778451a9561629ac05a9e882fad5e00ed3be7d6995b6cbcdb175c5d712fa4ff71496423f81957960f94eedc0f777f3", @ANYRES16=r2, @ANYBLOB="0100000000000000000019000000"], 0x14}}, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) (async) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) (async) r5 = fanotify_init(0xf00, 0x0) fanotify_mark(r5, 0x105, 0x5000003a, r4, 0x0) (async) open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(r6, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) (async) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) prctl$PR_MCE_KILL(0x4e, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r7 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) 2m43.87544765s ago: executing program 0 (id=1836): openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000040)='!,\x00') mremap(&(0x7f0000ff1000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000300)={0x50, r2, 0x607, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x15}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x50}}, 0x40000) (fail_nth: 1) 2m43.360391402s ago: executing program 0 (id=1838): r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$SIOCX25GFACILITIES(r0, 0x89e2, &(0x7f0000000000)) r1 = getpgrp(0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r2, r4, 0x25, 0x0, @void}, 0x10) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000004c0)='hpfs\x00', 0xc4, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5, r2, 0x4}, 0x10) sched_setaffinity(r1, 0x0, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000100)={0x9, 0x80000100008b}, 0x0) ptrace$cont(0x18, r1, 0x2, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="58d171a5725065a6aecd862ff263bcc29317005e6863151a94b240ebb8872aa65e1050ab958e53a4cbbbc4d47b3255631e7da54a1a39c073d5806e968cd50110e013a2b79efeff7ba93865cfbe2b32a5b5bead106866414f192d1bd2c26ced6cf39226db2163b3953798af23f62f6c299d4aa085902322a6c47f35666498c05c907114c1fac7b050788b6d4756cc3907cf8ce99e34e7a686ac13ef79a319573fce7d05aa822d19bb1925a3632a1d7d35ddd04ddec9d7c70c99d8db0032fa4363fbdcc58380", @ANYRES16=r6, @ANYBLOB="00082dbd700002dcdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x10000000) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000440)=0xe) ioctl$TIOCVHANGUP(r8, 0x5437, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(0xffffffffffffffff, 0xc034564b, 0x0) getrlimit(0x5, &(0x7f0000000080)) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r9, &(0x7f0000000d40)='<', 0xffdc, 0x24040005, 0x0, 0x0) 2m27.975006185s ago: executing program 34 (id=1838): r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$SIOCX25GFACILITIES(r0, 0x89e2, &(0x7f0000000000)) r1 = getpgrp(0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r2, r4, 0x25, 0x0, @void}, 0x10) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000004c0)='hpfs\x00', 0xc4, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5, r2, 0x4}, 0x10) sched_setaffinity(r1, 0x0, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000100)={0x9, 0x80000100008b}, 0x0) ptrace$cont(0x18, r1, 0x2, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="58d171a5725065a6aecd862ff263bcc29317005e6863151a94b240ebb8872aa65e1050ab958e53a4cbbbc4d47b3255631e7da54a1a39c073d5806e968cd50110e013a2b79efeff7ba93865cfbe2b32a5b5bead106866414f192d1bd2c26ced6cf39226db2163b3953798af23f62f6c299d4aa085902322a6c47f35666498c05c907114c1fac7b050788b6d4756cc3907cf8ce99e34e7a686ac13ef79a319573fce7d05aa822d19bb1925a3632a1d7d35ddd04ddec9d7c70c99d8db0032fa4363fbdcc58380", @ANYRES16=r6, @ANYBLOB="00082dbd700002dcdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x10000000) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000440)=0xe) ioctl$TIOCVHANGUP(r8, 0x5437, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(0xffffffffffffffff, 0xc034564b, 0x0) getrlimit(0x5, &(0x7f0000000080)) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r9, &(0x7f0000000d40)='<', 0xffdc, 0x24040005, 0x0, 0x0) 13.091785345s ago: executing program 1 (id=2196): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = semget$private(0x0, 0x1, 0x10) semctl$GETZCNT(r2, 0x2, 0xf, 0x0) semop(r2, &(0x7f0000000000)=[{0x3, 0xa, 0x1800}, {0x2, 0xff, 0x1800}], 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000fbfbdf25270000000e0001006e655f64657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r6, &(0x7f0000000300)=[{&(0x7f0000000180)=""/88, 0x58}], 0x1, 0x5, 0xfff5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) openat$kvm(0xffffffffffffff9c, 0x0, 0x2f8642, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 9.815373742s ago: executing program 2 (id=2203): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) lstat(0x0, 0x0) prlimit64(r1, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4084, 0xff4}], 0x1, 0xf73, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000020601081500000000000000070004040900020073797a3100000000b557bf15baa15c1536929d5e38bb8caacce855c3eb1e9a449a441fb94964b44b"], 0x20}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$igmp6(0xa, 0x3, 0x2) socket$kcm(0x2, 0xa, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x8440, 0xc0) fcntl$lock(r6, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x3fd4, 0x1000}) 9.804586125s ago: executing program 7 (id=2204): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 9.71988525s ago: executing program 1 (id=2206): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000040)=0x1ff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000500)="0f090f20d835200000000f22d8b9800000c00f3235000800000f30c4c15e5c653bb9800000c00f3235000800000f30b9010a00000f32f4b95e0a0000b80a57ffffbaffffffff0f30660fc77119c4e30d7df900", 0x53}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.679582728s ago: executing program 7 (id=2208): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@volatile}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x3a}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000540)}, {&(0x7f0000001400)="12b5ca8883a72c61be64d1809e4e551c8fcc795bacbc79d1a786c09a1861dfb427e430bee5b00ac73434620f11a914ef7cf7658efc365a26b43990993f60d4ffeb9cc31d7d5fc06ba7c3a4d828f40fca355cff79686f12971618904dc7d09e85e7a5f9194c4cae7983ee20f6c522b89ecc73c43438aad7dd15ff4738f5e4e1b7713142e7ff6cfc1b6cf7baba9ebf3b471cd0a72011fef02b46e280ad7a8c42d24bfb2ffe1518bc0fea207ec37a9e388c9dea8124df3f50a75f03df8d30d7b3b73e274042a52c058e1d85ef3b420b4dfce815cff6265e625a61b6fca9699edaadd192a3ae60c765260d1cbfb21f0cc30d8128b3783867b85873de07b02635d5573f9e578094a3ce6efbf44818daef38e14005a360909d226d7e13a86f6c83b6aaf615b6a2642d17bc2c56b8b0f8209e20ec1e0f58b0486493e511ab0a45b44a87340a9052ef5fba93c83753f1b101a744407f54d052188087c1cf43de80fd7bd5f3ce8585b5499959e6c3f5e17ae837d7c5627abb604947ad9906d641658f01464f48244182de8d5a8d037403ad4a964e2124177771a84806cda0682d58743928d2d16d83fd8b706a9669ac7605e8d857ac586dc2eda90715951c21bd116ade52f03cd61f3874aaefa77da678450228eb476d84bf175564a215e1683ced4bb9adba5daed835c6b38b61b213834aca56b86259784addb8601d26a42ad637ee296cd4382aaa7c1eaa5cbfa3a7177390bc646916aeb885d2dd43fc5b2dbbd2d184ba6cc6a439b95b5d814a8582405635b5c6bdb41c24af7a10bbd264eb2308a800a09705ac7856a7ac993cb4d88fea4cd1d5cf9e82e10c4badb996f4c0d5fd5866baf90a07d8777f793feb9250e22dd5190aa26c2a31412f1b41e0a65d0e435a9c5ebbf5205f6c6a117ce1fb16e8eb797e7d3eb5d62178dc0441941e9cb464814982ebe54195d73113efc971799121683f6e85d24ad6f21023868327b67446a36ebffda572b90f9b228a03b612e7e0ca09aac6b5710fc90f51c0efefb69b5d26ba9a1d8954832b1370d099d09c07fb2893d57d617ec0d626f1f96ee1608e0f8d9ca1b491578d639ac74b3ea568a474707ac756555d0ae9cdc609609e30d7ef2648fb8baa5854e58b60fac9ec9670c620ce6dcf3bbcca971cb5bf37462febde30e3865960627ceb15a11dd891160a2fcbb682c94a7de4e00fff20774364ffc4bfa31173261f1684dbbaa9addf0d9bc43539a7c09c6b98769aecf8529402bc66e37f0f20580e8e5f59ec48979957552fe17b897dcb4ed1a8d0fdf68d8c065c9d3501b387cf08c681326fcd79e7104eb50bc58a0140b594ad57b8d4be0c50f98e9c3e323d0a57001f8c6a094a7908315c7d7b33227861d2035649bb91daf77776e11159f3ebf7f3ed576adfc364f363e6f474dbbe3500c62c74193e7102fdf57b345066a6ebe47b4b469187631b586676e8e449fa215444366baf5d675f637a0f52c36a042d74957e94bd6d87061675da18128f69106970a9492d76dc312884bb7fcd88ca7e13f2914ba817724bc97ab634e845dfd1ab40344c33c7c202674ef959378abaf3f4fa038a6bbec31f5bd88f81240d2722dfa5e8621eb604db9ae06d49f0a56d64d525f3d41b367ed4d459f21baa3dc43c7cbe096f15bead83bc5ffe2f82128f2943a479556a39ab661bf0a86e0ad0520ab015112eeb06c13abc0da61cc6bf9508182d142696a4670fef7dcfa7a7e09f673c992f3acd4bafa7874c8bf9dc362943d7cd3c14d32bb7a8c3e3f1f55f500eca0c6fd0f199fefe601857e5307660c000cbd8f83f64e2afeb931f5dbba2d538f1c1d78c6ecd14af198f9e0ae4a8e2ef6cda63e059f5b3137946434418fd8920753c3ea5d054ad5d3da2749c94b23018be9495831a1ac647783823ac4f554bea483ee919824516f8d3d9d90753d69dd6375f0edafc98716d2aa7dbbf73208ee017fddec8c994cb5df3f74bfed87db0b88076c430495ce8a39b4b61003bb6c0e12a2f6d41a994537dadc0b389d5a1049e26b968d4aa8ded4fc38dec2ab5b14b5d0d0e24b37875e17d1066e0b04c807ef6712034f0cbd899e5cfd68143e0c3865c00a18fc7001fe9386acb55614fb7c739aef69bf21b8364e407fdb62e068359017714809d3a0b61b8bd046119f2a8e71f17908da23fbe13e50eafce63abba77a07695782fb01423efffe421bc9bede0df8ff1e163f677178eb84aec1c8517ca5a503fddba2a15878d0bf1bd255671f17417692a950fb0181150a08868107071661984c0099d588cc9456eb457fcb5fc37cec48a30aa0aa83251394fc1ec9cd0be2b7b95798a59ffd1d0a4b62e82de24bc54ad7c7385371bd27469d2631167e6c021f01f0e5ebf3819cb1f07e1cec4813ef51cc0b8e9c1069e472876e8721b81d64967edb507724fefb6128745623f6c3e520812ae1f373901d9e8f662d45aa7a1d51709960f82dc7580af43ca338631eb32259564e3379dbe0dc3bd700c8c7b04b66cff0b07d930e7a166fce6b0191283451c8dd50774b6c8d3adadd024c3faf1cf2ca2bc8d45804da21b56eb296a4f80b9a3a99fc6557b32de7db3c9637c8d481b29211c304127bf1504d6e5f9bc410d321d7cf28d55cc2f51eee3b2", 0x74d}, {0x0}, {&(0x7f0000000680)="cc18101d6bec7dadde1d231d7be01e1a3ebed2", 0x13}, {0x0}], 0x5}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.788774512s ago: executing program 4 (id=2209): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b70400000000000085000000330000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r0}, &(0x7f0000000280), &(0x7f0000000340)=r1}, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[], 0x0) 7.665083168s ago: executing program 2 (id=2210): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="a000000000010504000000000001802c000180140003000000000000000000000000000000000014000400ff01000000000000000000000000000106000340000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400200100000000000000000000000000020c00028005000100000000000800074000010000100005800a000100512e39333100"/160], 0xa0}}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x8001, 0x40200) ioctl$MON_IOCQ_URB_LEN(r2, 0x9201) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) syslog(0xa, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="cb000000e100000071100a000000000006000000000000009500000000000000", @ANYRES64=r2, @ANYRES16=r2, @ANYRES64=r2, @ANYRES64=r1], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = syz_open_dev$video4linux(&(0x7f0000002300), 0xfffffffffffffffc, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0205648, &(0x7f0000000340)={0x0, 0x0, {0x100, 0x0, 0x2019, 0x8, 0xc, 0x1, 0x0, 0x5}}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r6, 0x400454d9, &(0x7f0000000100)={'veth0_to_team\x00', 0x400}) ioctl$TUNSETQUEUE(r6, 0x400454d9, &(0x7f0000000440)={'veth1\x00', 0x600}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000010400000000fdffffff00000000", @ANYRES32=0x0, @ANYRES8=r5], 0x44}, 0x1, 0x0, 0x0, 0x20040861}, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x2, 0x2) ioctl$VIDIOC_ENUMINPUT(r4, 0xc050561a, &(0x7f0000000100)={0xf50d, "6d5635b2ec2784534312a3528a8d16ea213a8c4518a878dbe06a93ae3b69e2db", 0x1, 0x2, 0x3, 0x80008, 0x2040c03, 0x2}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r10, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSPASS(r10, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f00000001c0)=[{0x40, 0x9, 0x0, 0x6}, {0x7, 0x4, 0xff, 0x8}]}) write$ppp(r10, &(0x7f00000004c0)="5af959", 0x3) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="0c009900ff0800004f000000ba50f1f403bc2949d5a664951d3e89c2c9be52e9be096d25bcc03bbf98d95586a9755b653a8b2287120ca2e51e683919a99fbb055729f735397ba9bda78c7af493ccc1d526ce9539a1474b2ef4153767c88fad0f8034451ea39479e820d1448419e9360bed37396175b90ef712872c318b9fbb25d40b33ebc7f1723e7d35217eb5c5e06ad28e6ddb20c79260df36ed8b90e29048737a84f047628ea5622cf411b7a38fa99c06eb6865caede391f317cd1df04434a071e6d0e77362e453bd1365098ef5e37d58cbfc100a2327e5ea4791bae1ee5a13b2512fc123b557099eed0d09623f98a5c9bc81275b091dca0ceed40107aeffed725f766bceeaed83747c83cb7fc45ae3a9462398bc542e34da0038a66ad82e2b50db5e8580f43a3aecd1fe40d93f812b387ea0593ceef412bf5944309cd8c68b51e2b40231f455d915168c3115df5ba648bcfe54ac2d6f347f3f8216910201d9297870c0291a0af9ea4f856e1e1d962c0268960a7c5f2c2a30d7d2e263015735bf7a9786cc5421b044eee8ea00a14d4d59624f69a6e50264359179e59b20709ee1db430027e5d364c47e38725d5981dad4f02ec6ccb01466d0b86f365277f762f1cd0ac4b5dee109ee518b16187919f5f1687259581beec32d7a384ddc461750e6b76e3c127b3a33c1735426c310faa33230bb27486e0095a416872f678948e5fde23624d0eb22d250020e7742270cad9a727b585f2144e3cc101c04aaf3d67b15f7ce56260000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40080c0}, 0x20008000) 7.632522146s ago: executing program 6 (id=2211): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvtap0\x00', 0x0}) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000000e0c0)=""/102400, 0x19000) keyctl$clear(0x3, 0xfffffffffffffffd) mkdir(&(0x7f0000000200)='./file0\x00', 0x56) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='devtmpfs\x00', 0x10, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000016c0)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1, 0x8000009}, 0x28) fcntl$setlease(r4, 0x400, 0x1) ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000280)={0x2e, &(0x7f0000000080)=[{0x1d, '\x00', @st={0x4, [{0x2, @uvalue=0x5}, {0x1, @uvalue=0x4}, {0x3}, {0x3, @svalue=0x40004000000}]}, 0x5}, {0x8, '\x00', @buffer={"c4a31076fc6cbf522789141bf36f9baddfafec36f841350d0dafec57db7bd01f", 0x20}}, {0x3d, '\x00', @st={0x4, [{0x3, @svalue=0xfffffffffffffff1}, {0x0, @uvalue=0x3}, {0x3, @uvalue=0x40000000}, {0x1, @svalue}]}, 0x5}, {0x3, '\x00', @st={0x4, [{0x1, @uvalue=0x932c}, {0x0, @svalue=0x2}, {0x2, @svalue=0x10000}, {0x2, @uvalue=0x4}]}, 0x5}, {0x2a, '\x00', @data=0x9c, 0xa69f}, {0x23, '\x00', @buffer={"bb63b02668abfabb3de03a2aad7ea3cf75a29823055ba632bf1321c9766a2003", 0x20}, 0x6}]}) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f00000000c0)={0x93f4, 0x9eb, 0x5bd}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000140)=""/4078, 0xfee}], 0x1, 0xf2, 0x207fff) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r6, 0xc0845658, &(0x7f0000000140)={0x0, @bt={0x5, 0x5, 0x0, 0x3, 0x5, 0x1ff, 0x9, 0x8, 0xdc, 0x0, 0x40, 0xfffffeff, 0x6793, 0x401, 0x0, 0x8, {0x80000001, 0x800}, 0xfd, 0x5}}) open$dir(&(0x7f0000001140)='./file0\x00', 0x149800, 0x0) epoll_create1(0x0) 7.608557577s ago: executing program 7 (id=2212): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) lstat(0x0, 0x0) prlimit64(r1, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4084, 0xff4}], 0x1, 0xf73, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000020601081500000000000000070004040900020073797a3100000000b557bf15baa15c1536929d5e38bb8caacce855c3eb1e9a449a441fb94964b44b"], 0x20}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x3fd4, 0x1000}) 6.969098517s ago: executing program 1 (id=2213): sched_setscheduler(0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYBLOB="b46ae6580fa0baedd557967b1809beaf53be985eb37c71a64f1c8d15fcbc5ce83e7c1566a560c4cd570cc7c85f5d239105c0f465c3755dc087860848dd893326d12af4035907a03f7df684331382f6fe3833bfde7331133ca643f5697732bd659e54831ac91d899d3555765f6aa765f3ff1b1aedb239494187c8e0935f39ee0acc0446e8e5abe1e657dabda1309de7d8ccf05cc95ec456508dfab47bd7fb6079bd1ba82eff5397d4dbb97e52dd656b738b73d6f79945b07b43f6e6ba802d9a5b5c24acad648e9c97483a45b8178c0481409d13a225c1ae5cf67b4bb296f01534784246f089bf03376a0af6d1be", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000ffffb703000008000000b70400000000000085000000010000009559b4703cc9e322c15921f7a834ceb48776cdef70fe8c"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 6.683263501s ago: executing program 7 (id=2214): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x3) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r3) r4 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000001100000000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r6, r5, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000f80)={{r6}, &(0x7f0000000f00), &(0x7f0000000f40)=r3}, 0x20) recvfrom(r4, 0x0, 0xb, 0x40, 0x0, 0x0) setsockopt$inet_udp_int(r2, 0x11, 0x1, &(0x7f0000000000)=0x2, 0x4) r7 = memfd_create(&(0x7f00000004c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x02Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\xff\xec\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92\xf3H\xf9\x7f\x102\x83\x9b\xdaR\a\xfeU\xc8\xc3\xa76\xe7%\x0eyx\x15\n\xe3l\x98\xcf\xbaU6\xf9\xb5S21Bk\xad\xe60P\xa2c)\xca\xc4`_\x15\xc4\t\xaa\xc4e\x12\x103\xf9\xc4\xba\x86[N\xb27BD\xab`\xae\x1c&\xdb\ns\x8c\x92\xe0\xa52\b\x8bj\x01X\xfa\xf2\x8b\xe1\xf9\n\xc4Ux\xa9\x1b\xc6\xad\xb4\xf0\xba+\x91/&\x81\xba\xa5\x8em0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ptrace$poke(0x4, r1, &(0x7f0000000000), 0xffffffff) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$binderfs(0x0, &(0x7f00000023c0)='./binderfs\x00', &(0x7f0000002400), 0x2004000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00"/14, @ANYBLOB="00003b2b92af3fa0a8aadf8eba6493f7", @ANYRES32=0x0], 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r5) waitid(0x1, r1, &(0x7f0000000340), 0x8, &(0x7f00000003c0)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) 6.491152127s ago: executing program 1 (id=2216): r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c00009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb09587", 0x4b}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001100)={&(0x7f00000007c0)=ANY=[@ANYBLOB="a0010000100001000000000000000000fe8800000000000000000000000001010000000000000000000000000000000100000000080000000a00000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff07000000000000000000000800000000000200000000000000000000000000000200000000000000000000000a000100cd000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c0017000000000000000000000000002abd700028bd7000000000004c001400636d6163286165732900"/340], 0x1a0}}, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000040)) 5.616538961s ago: executing program 4 (id=2217): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x543, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="300000001a00010029bd70000000000081000000000000000000000014000200fc00"], 0x30}}, 0x0) 5.539416615s ago: executing program 6 (id=2218): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5.447903696s ago: executing program 7 (id=2219): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) lstat(0x0, 0x0) prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r4, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4084, 0xff4}], 0x1, 0xf73, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000020601081500000000000000070004040900020073797a3100000000b557bf15baa15c1536929d5e38bb8caacce855c3eb1e9a449a441fb94964b44b"], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$kcm(0x2, 0xa, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x8440, 0xc0) fcntl$lock(r5, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x3fd4, 0x1000}) 5.44757977s ago: executing program 4 (id=2220): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 5.373411076s ago: executing program 6 (id=2221): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89ff, &(0x7f0000001440)={'bridge0\x00', 0x0}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x6, 0x8, 0x8, 0x40}, 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000280)='%ps \x00'}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_opts(r5, 0x29, 0x36, &(0x7f0000000100)=ANY=[], 0x8) sendto$inet6(r5, 0x0, 0x0, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x2, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) listen(r5, 0x100101) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x1000) r7 = socket$packet(0x11, 0x2, 0x300) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000060000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r8}, 0xfffffffffffffee6) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000180)=r9, 0x4) r10 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r10, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r11}, 0x14) r12 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000780)={'vxcan1\x00', 0x0}) bind$can_j1939(r12, &(0x7f0000000040)={0x1d, r13, 0x3}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) statx(0xffffffffffffffff, &(0x7f0000000740)='./file0\x00', 0x2000, 0x2, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000980)=[{{&(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000340)=[{&(0x7f00000005c0)="ff29c5eb31216bc5e5b3710946d9e72cb24dbec74c887c9210f90c123af3f3f2740c5d14b168ec7821d7d6e77a68d729666dfcc4fded793b7ca0bb5c551bf83ce976c696304148c644a079f08ea2cbb009619ba1b79c9e951267950f4f81ff224d4801755a3d418bff2a00cc73924d7c36faa1f17096d20591b43811a8dbd2d234a35010a03bfa609f5e0bd49a1c8696", 0x90}], 0x1, &(0x7f00000008c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r6, r12]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [r4, r7, 0xffffffffffffffff, r2, r12, r1, r3, r1, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r14, 0xee00}}}], 0xb0, 0x1}}], 0x1, 0x80) syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r12) 4.218865726s ago: executing program 7 (id=2222): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x20, r1, 0x301, 0x70dd29, 0x25dfdbfc, {0x24}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x0) (fail_nth: 4) 4.138293457s ago: executing program 4 (id=2223): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="ecf32a34a3200000001200010a000000000e46be"], 0x26}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x1}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r6) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r8, 0x0}) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f0000000680)={r9, 0x1ff, 0x80, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800020, 0x0, 0xc24], [0x0, 0x1001000], [0x800000000, 0x0, 0x6, 0xc]}) r12 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r12, 0x180000000) socket$inet_tcp(0x2, 0x1, 0x0) r13 = socket(0x1d, 0x1, 0x7) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) ioctl$DRM_IOCTL_MODE_ADDFB2(r6, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r10, 0x0, 0x0, r11], [0x2b8, 0x0, 0x10001], [0x0, 0x4]}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, r0, 0x0) 4.027211352s ago: executing program 6 (id=2224): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200000004000000040000000200020000180000", @ANYRES32, @ANYRES32, @ANYBLOB="ffff018abe00"/23], 0x50) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() ioprio_get$pid(0x2, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0xc67e7be33bfcd098, &(0x7f0000000180)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000580)={0x2, 0x3, @multicast1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000500), 0x9, 0x428581) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8480, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000840)={0x28, 0x2, r5, 0x0, &(0x7f0000007000/0x3000)=nil, 0x3000, 0x7fffffffffffffff}) ioctl$IOMMU_IOAS_MAP(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x2, r5, 0x0, &(0x7f00000001c0)="ecf8eb", 0x3, 0x7}) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000180)={0x28, 0x5, 0x0, r5, 0x1000, 0x7, 0x3ffe}) 3.018765299s ago: executing program 6 (id=2225): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="21012abd7000000000001400000008000300", @ANYRES32=r2, @ANYBLOB="060036"], 0x2c}}, 0x20000800) r3 = syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000180)=ANY=[@ANYRES32=r1], 0x0) syz_usb_control_io(r3, &(0x7f0000000000)={0x2c, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x816}}, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r3, &(0x7f0000000000)={0x2c, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x816}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, &(0x7f0000000280)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x140c}}, 0x0, 0x0, 0x0}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r5 = socket(0x18, 0x80000, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r4, 0xffffffffffffffff}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x1d, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000100000000000000010000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a5000000b7080000000000007b8af8ff00000000b7080000001000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r7, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r7, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_usb_control_io$uac1(r3, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000340)={0x0, 0x3, 0x16, @string={0x16, 0x3, "019ee94ad36d76b50d408467036d6a1dcec81686"}}}, 0x0) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000140)) 2.907077594s ago: executing program 1 (id=2226): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ptrace$poke(0x4, r1, &(0x7f0000000000), 0xffffffff) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$binderfs(0x0, &(0x7f00000023c0)='./binderfs\x00', &(0x7f0000002400), 0x2004000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00"/14, @ANYBLOB="00003b2b92af3fa0a8aadf8eba6493f7", @ANYRES32=0x0], 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r5) waitid(0x1, r1, &(0x7f0000000340), 0x8, &(0x7f00000003c0)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, 0x0, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) 2.579352965s ago: executing program 2 (id=2227): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b70400000000000085000000330000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r0}, &(0x7f0000000280), &(0x7f0000000340)=r1}, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[], 0x0) 2.562708182s ago: executing program 2 (id=2228): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xc}, 0x50) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r3, 0x3b8d, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r3, 0x3b80, &(0x7f0000000340)={0x8, r6}) 1.510143031s ago: executing program 2 (id=2229): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xc}, 0x50) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r3, 0x3b8d, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r3, 0x3b80, &(0x7f0000000340)={0x8, r6}) 1.438462435s ago: executing program 1 (id=2230): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setrlimit(0xf, 0x0) syz_clone(0x2180, 0x0, 0xe4, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x3c) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x200000) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000003000/0x2000)=nil, 0x3) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xc, 0xe, &(0x7f0000000800)=ANY=[@ANYRESHEX=r1, @ANYBLOB="d7c15fbf43f94aad2bc56ee78ffac4cc1ff3469350931aef9ea146a2dca8a7b93c22131451959e06508b88c7cc72dfc518a1f84cb8df5b3aecd8efb2802c204bd414d0195ec9e2e8c97aa565415f01ad7a444a289e455fbe4dc8d236981cb25cd63634dac23fe1fb2217db4549c8b4c41a67b5df57e6c3ea", @ANYRES64=0x0], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r2, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f110800", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x9750, 0x0, 0x0, 0x70000, 0xffffffffffffffff, 0x8f, '\x00', 0x0, r3, 0x5, 0x0, 0x0, 0xd}, 0x50) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$restrict_keyring(0x1d, 0xfffffffffffffffd, &(0x7f0000000c40)='asymmetric\x00', &(0x7f0000000c80)='/dev/snd/midiC#D#\x00') socket(0x15, 0x0, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1100000004000000040000000800000000000000", @ANYRES64=r4, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/13], 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r5) sendmsg$NL80211_CMD_FLUSH_PMKSA(r5, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xcf27f49e3ec8fffe}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r6, 0x800, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x12}, 0x4000) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="20caff45", @ANYRES16=r7, @ANYBLOB="b3af000000000000000033000000"], 0x14}}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r9 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x600, 0x0) ioctl$TIOCSRS485(r9, 0x542f, 0x0) io_setup(0x8, &(0x7f0000000600)) 833.03237ms ago: executing program 4 (id=2231): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xc2) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) 79.381318ms ago: executing program 2 (id=2232): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) lstat(0x0, 0x0) prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r4, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4084, 0xff4}], 0x1, 0xf73, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000020601081500000000000000070004040900020073797a3100000000b557bf15baa15c1536929d5e38bb8caacce855c3eb1e9a449a441fb94964b44b"], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$kcm(0x2, 0xa, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x8440, 0xc0) fcntl$lock(r5, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x3fd4, 0x1000}) 0s ago: executing program 4 (id=2233): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) kernel console output (not intermixed with test programs): 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 771.429107][ T5855] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 771.440539][ T979] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 771.451250][ T5855] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 771.489321][ T5855] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 771.501715][ T5855] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 771.515482][ T5855] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 771.526294][ T5855] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 771.535660][ T5855] usb 5-1: Product: syz [ 771.539889][ T5855] usb 5-1: Manufacturer: syz [ 771.576192][ T5855] cdc_wdm 5-1:1.0: skipping garbage [ 771.595341][ T5855] cdc_wdm 5-1:1.0: skipping garbage [ 771.620509][ T5855] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 771.638233][ T979] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 771.650864][T13450] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 771.659079][ T5855] cdc_wdm 5-1:1.0: Unknown control protocol [ 771.671075][ T979] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.682731][ T979] usb 7-1: Product: syz [ 771.729833][ T979] usb 7-1: Manufacturer: syz [ 771.745411][ T979] usb 7-1: SerialNumber: syz [ 772.160550][T13458] FAULT_INJECTION: forcing a failure. [ 772.160550][T13458] name failslab, interval 1, probability 0, space 0, times 0 [ 772.173573][T13458] CPU: 1 UID: 0 PID: 13458 Comm: syz.2.1847 Tainted: G L syzkaller #0 PREEMPT(full) [ 772.173603][T13458] Tainted: [L]=SOFTLOCKUP [ 772.173609][T13458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 772.173620][T13458] Call Trace: [ 772.173627][T13458] [ 772.173634][T13458] dump_stack_lvl+0x100/0x190 [ 772.173671][T13458] should_fail_ex.cold+0x5/0xa [ 772.173695][T13458] should_failslab+0xc2/0x120 [ 772.173724][T13458] __kmalloc_cache_noprof+0x7a/0x6f0 [ 772.173741][T13458] ? snd_pcm_oss_open+0x5e5/0x1390 [ 772.173762][T13458] ? rcu_is_watching+0x12/0xc0 [ 772.173787][T13458] snd_pcm_oss_open+0x5e5/0x1390 [ 772.173819][T13458] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 772.173842][T13458] ? __lock_acquire+0x4a5/0x2630 [ 772.173869][T13458] ? __pfx_default_wake_function+0x10/0x10 [ 772.173896][T13458] ? preempt_schedule_irq+0x7b/0x90 [ 772.173927][T13458] ? do_raw_spin_lock+0x128/0x260 [ 772.173948][T13458] ? soundcore_open+0x231/0x5a0 [ 772.173972][T13458] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 772.173996][T13458] soundcore_open+0x2e3/0x5a0 [ 772.174019][T13458] ? __pfx_soundcore_open+0x10/0x10 [ 772.174040][T13458] chrdev_open+0x234/0x6a0 [ 772.174058][T13458] ? __pfx_chrdev_open+0x10/0x10 [ 772.174076][T13458] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 772.174097][T13458] ? __sanitizer_cov_trace_pc+0x3f/0x70 [ 772.174124][T13458] do_dentry_open+0x6d8/0x1660 [ 772.174149][T13458] ? __pfx_chrdev_open+0x10/0x10 [ 772.174172][T13458] vfs_open+0x82/0x3f0 [ 772.174196][T13458] path_openat+0x208c/0x31a0 [ 772.174219][T13458] ? __pfx___schedule+0x10/0x10 [ 772.174246][T13458] ? __pfx_path_openat+0x10/0x10 [ 772.174263][T13458] ? preempt_schedule_irq+0x7b/0x90 [ 772.174292][T13458] ? irqentry_exit+0x180/0x670 [ 772.174315][T13458] do_file_open+0x20e/0x430 [ 772.174335][T13458] ? __pfx_do_file_open+0x10/0x10 [ 772.174372][T13458] ? alloc_fd+0x476/0x790 [ 772.174398][T13458] ? do_getname+0x191/0x390 [ 772.174422][T13458] do_sys_openat2+0x10d/0x1e0 [ 772.174442][T13458] ? __pfx_do_sys_openat2+0x10/0x10 [ 772.174462][T13458] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 772.174492][T13458] __x64_sys_openat+0x12d/0x210 [ 772.174514][T13458] ? __pfx___x64_sys_openat+0x10/0x10 [ 772.174536][T13458] ? rcu_is_watching+0x12/0xc0 [ 772.174563][T13458] do_syscall_64+0x106/0xf80 [ 772.174580][T13458] ? clear_bhb_loop+0x40/0x90 [ 772.174602][T13458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.174621][T13458] RIP: 0033:0x7f80b219c629 [ 772.174638][T13458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 772.174654][T13458] RSP: 002b:00007f80b30fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 772.174672][T13458] RAX: ffffffffffffffda RBX: 00007f80b2416180 RCX: 00007f80b219c629 [ 772.174684][T13458] RDX: 0000000000080002 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 772.174695][T13458] RBP: 00007f80b30fb090 R08: 0000000000000000 R09: 0000000000000000 [ 772.174706][T13458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 772.174716][T13458] R13: 00007f80b2416218 R14: 00007f80b2416180 R15: 00007fff04f31ab8 [ 772.174741][T13458] [ 772.907473][ T979] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 772.929058][ T979] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 772.944738][ T29] audit: type=1400 audit(1771947322.024:893): avc: denied { read write } for pid=13435 comm="syz.4.1840" name="cdc-wdm0" dev="devtmpfs" ino=3684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 773.004796][ T29] audit: type=1400 audit(1771947322.024:894): avc: denied { open } for pid=13435 comm="syz.4.1840" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 773.031748][T13461] xt_TPROXY: Can be used only with -p tcp or -p udp [ 773.059022][T11000] Bluetooth: hci2: unknown advertising packet type: 0x75 [ 773.059096][T11000] Bluetooth: hci2: Malformed LE Event: 0x02 [ 773.092546][ T29] audit: type=1400 audit(1771947322.204:895): avc: denied { connect } for pid=13451 comm="syz.1.1846" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 773.156597][ T5920] usb 5-1: USB disconnect, device number 59 [ 773.273831][ T29] audit: type=1400 audit(1771947322.384:896): avc: denied { read write } for pid=13463 comm="syz.2.1848" name="file0" dev="fuse" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 773.307310][ T29] audit: type=1400 audit(1771947322.384:897): avc: denied { open } for pid=13463 comm="syz.2.1848" path="/400/file0/file0" dev="fuse" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 773.673910][ T5920] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 773.803882][ T5920] usb 3-1: device descriptor read/64, error -71 [ 773.833844][ T9047] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 774.148580][ T9047] usb 2-1: config 0 descriptor has 1 excess byte, ignoring [ 774.165782][ T9047] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 774.177804][ T9047] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 774.189073][ T5920] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 774.203304][ T9047] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 774.214969][ T9047] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.223429][ T9047] usb 2-1: Product: syz [ 774.228691][ T9047] usb 2-1: Manufacturer: syz [ 774.233706][ T9047] usb 2-1: SerialNumber: syz [ 774.260800][ T9047] usb 2-1: config 0 descriptor?? [ 774.343825][ T5920] usb 3-1: device descriptor read/64, error -71 [ 774.454374][ T5920] usb usb3-port1: attempt power cycle [ 774.497005][ T9047] usb 2-1: 0:0 : invalid sync pipe. is_playback 1, ep 0b, bSynchAddress ff [ 774.535755][ T9047] usb 2-1: USB disconnect, device number 63 [ 774.626621][ T8083] udevd[8083]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 774.646811][ T979] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 774.668373][ T979] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 774.693251][ T979] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 774.715968][ T979] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 774.771110][ T979] usb 7-1: USB disconnect, device number 16 [ 774.785316][T13479] 9p: Bad value for 'wfdno' [ 774.803988][ T5920] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 774.814742][T13480] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.822101][T13480] bridge0: port 1(bridge_slave_0) entered disabled state [ 774.832880][T13480] bridge0: entered allmulticast mode [ 774.845653][ T5920] usb 3-1: device descriptor read/8, error -71 [ 774.858392][T13480] bridge_slave_1: left allmulticast mode [ 774.864259][T13480] bridge_slave_1: left promiscuous mode [ 774.870231][T13480] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.882023][T13480] bridge_slave_0: left allmulticast mode [ 774.888151][T13480] bridge_slave_0: left promiscuous mode [ 774.894445][T13480] bridge0: port 1(bridge_slave_0) entered disabled state [ 775.104332][ T5920] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 775.144476][ T5920] usb 3-1: device descriptor read/8, error -71 [ 775.163922][ T979] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 775.251737][ T29] audit: type=1400 audit(1771947324.364:898): avc: denied { audit_write } for pid=13485 comm="syz.1.1855" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 775.273464][ T5920] usb usb3-port1: unable to enumerate USB device [ 775.333794][ T979] usb 5-1: Using ep0 maxpacket: 32 [ 775.340172][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 775.351242][ T979] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 775.360339][ T979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 775.370266][ T979] usb 5-1: config 0 descriptor?? [ 775.377187][ T979] hub 5-1:0.0: USB hub found [ 775.583483][ T979] hub 5-1:0.0: 1 port detected [ 775.996045][ T979] usb 5-1: USB disconnect, device number 60 [ 777.571144][ T29] audit: type=1400 audit(1771947326.684:899): avc: denied { map } for pid=13508 comm="syz.1.1863" path="/dev/video36" dev="devtmpfs" ino=1044 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 778.201268][T13521] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=13521 comm=syz.6.1860 [ 779.403957][ T979] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 779.513822][ T5917] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 779.565780][ T979] usb 2-1: config 0 descriptor has 1 excess byte, ignoring [ 779.583285][ T979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 779.604592][ T979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 779.636912][ T979] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 779.653994][ T5917] usb 7-1: device descriptor read/64, error -71 [ 779.663828][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.673962][ T979] usb 2-1: Product: syz [ 779.674002][ T979] usb 2-1: Manufacturer: syz [ 779.674016][ T979] usb 2-1: SerialNumber: syz [ 779.699937][ T979] usb 2-1: config 0 descriptor?? [ 779.913891][ T5917] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 780.040151][ T979] usb 2-1: 0:0 : invalid sync pipe. is_playback 1, ep 0b, bSynchAddress ff [ 780.074939][ T5917] usb 7-1: device descriptor read/64, error -71 [ 780.137555][ T979] usb 2-1: USB disconnect, device number 64 [ 780.188965][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 780.207021][ T5917] usb usb7-port1: attempt power cycle [ 780.332945][ T29] audit: type=1400 audit(1771947329.444:900): avc: denied { connect } for pid=13542 comm="syz.2.1872" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 780.459447][T13546] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 780.532839][ T29] audit: type=1400 audit(1771947329.644:901): avc: denied { bind } for pid=13545 comm="syz.2.1873" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 780.552258][ T5917] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 781.350588][ T5917] usb 7-1: device descriptor read/8, error -71 [ 782.746587][T13570] No such timeout policy "syz0" [ 785.163821][ T5920] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 785.163821][ T979] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 785.245864][T13592] bridge0: port 2(bridge_slave_1) entered disabled state [ 785.253941][T13592] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.264498][T13592] bridge0: entered allmulticast mode [ 785.364033][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 785.376177][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 785.387694][ T5920] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 785.403981][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.415451][T13595] bridge_slave_1: left allmulticast mode [ 785.421093][T13595] bridge_slave_1: left promiscuous mode [ 785.428950][ T979] usb 5-1: device descriptor read/64, error -71 [ 785.476317][T13595] bridge0: port 2(bridge_slave_1) entered disabled state [ 785.481804][ T5920] usb 2-1: config 0 descriptor?? [ 785.511161][ T5920] hub 2-1:0.0: USB hub found [ 785.577869][T13595] bridge_slave_0: left allmulticast mode [ 785.606728][T13595] bridge_slave_0: left promiscuous mode [ 785.623319][T13595] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.683941][ T979] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 785.717171][ T5920] hub 2-1:0.0: 1 port detected [ 785.773943][ T5917] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 785.844519][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 786.093814][ T5917] usb 7-1: Using ep0 maxpacket: 32 [ 786.153874][ T979] usb 5-1: device descriptor read/64, error -71 [ 786.179148][ T5917] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 786.246716][ T5917] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 786.284256][ T979] usb usb5-port1: attempt power cycle [ 786.625728][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.664241][ T5917] usb 7-1: config 0 descriptor?? [ 786.680936][ T5917] hub 7-1:0.0: USB hub found [ 786.686685][ T5821] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 786.704047][ T5821] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 786.720475][ T5821] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 786.743885][ T5821] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 786.756584][ T5821] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 786.849713][ T5920] usb 2-1: USB disconnect, device number 65 [ 787.025374][T13604] FAULT_INJECTION: forcing a failure. [ 787.025374][T13604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 787.052140][ T5917] hub 7-1:0.0: 1 port detected [ 787.068177][T13604] CPU: 0 UID: 0 PID: 13604 Comm: syz.2.1887 Tainted: G L syzkaller #0 PREEMPT(full) [ 787.068204][T13604] Tainted: [L]=SOFTLOCKUP [ 787.068209][T13604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 787.068218][T13604] Call Trace: [ 787.068224][T13604] [ 787.068231][T13604] dump_stack_lvl+0x100/0x190 [ 787.068263][T13604] should_fail_ex.cold+0x5/0xa [ 787.068285][T13604] _copy_from_user+0x2e/0xd0 [ 787.068307][T13604] add_rule_path_beneath+0xac/0x4d0 [ 787.068335][T13604] ? __pfx_add_rule_path_beneath+0x10/0x10 [ 787.068359][T13604] ? fdget+0x17a/0x210 [ 787.068378][T13604] __x64_sys_landlock_add_rule+0x1a9/0x220 [ 787.068400][T13604] do_syscall_64+0x106/0xf80 [ 787.068416][T13604] ? clear_bhb_loop+0x40/0x90 [ 787.068437][T13604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.068456][T13604] RIP: 0033:0x7f80b219c629 [ 787.068471][T13604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 787.068488][T13604] RSP: 002b:00007f80b313d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001bd [ 787.068505][T13604] RAX: ffffffffffffffda RBX: 00007f80b2415fa0 RCX: 00007f80b219c629 [ 787.068515][T13604] RDX: 0000200000000200 RSI: 0000000000000001 RDI: 0000000000000003 [ 787.068525][T13604] RBP: 00007f80b313d090 R08: 0000000000000000 R09: 0000000000000000 [ 787.068535][T13604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 787.068545][T13604] R13: 00007f80b2416038 R14: 00007f80b2415fa0 R15: 00007fff04f31ab8 [ 787.068567][T13604] [ 787.189024][T13600] chnl_net:caif_netlink_parms(): no params data found [ 787.422322][T13600] bridge0: port 1(bridge_slave_0) entered blocking state [ 787.439914][T13600] bridge0: port 1(bridge_slave_0) entered disabled state [ 787.549552][T13600] bridge_slave_0: entered allmulticast mode [ 787.557777][T13600] bridge_slave_0: entered promiscuous mode [ 787.566266][T13600] bridge0: port 2(bridge_slave_1) entered blocking state [ 787.573477][T13600] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.581602][T13600] bridge_slave_1: entered allmulticast mode [ 787.599181][T13600] bridge_slave_1: entered promiscuous mode [ 788.097559][T13600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 788.114058][T13600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 788.204195][ T5917] usb 7-1: USB disconnect, device number 21 [ 788.814248][ T5821] Bluetooth: hci5: command tx timeout [ 789.092969][T13600] team0: Port device team_slave_0 added [ 789.101409][T13600] team0: Port device team_slave_1 added [ 789.264565][T13600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 789.275214][T13600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 789.312158][T13600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 789.365509][T13600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 789.382570][T13600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 789.441570][T13600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 790.041837][T13600] hsr_slave_0: entered promiscuous mode [ 790.057271][T13600] hsr_slave_1: entered promiscuous mode [ 790.071654][T13600] debugfs: 'hsr0' already exists in 'hsr' [ 790.081518][T13600] Cannot create hsr debugfs directory [ 790.191493][T13631] capability: warning: `syz.6.1895' uses deprecated v2 capabilities in a way that may be insecure [ 790.440765][T13633] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1895'. [ 790.521719][ T29] audit: type=1400 audit(1771947339.634:902): avc: denied { read } for pid=13630 comm="syz.6.1895" name="file0" dev="fuse" ino=288230376151711744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 790.576720][T13600] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 790.622038][T13600] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 790.639020][ T29] audit: type=1400 audit(1771947339.634:903): avc: denied { open } for pid=13630 comm="syz.6.1895" path="/81/file0/file0" dev="fuse" ino=288230376151711744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 790.942770][ T5821] Bluetooth: hci5: command tx timeout [ 790.944032][T13600] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 791.081978][T13600] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 791.336690][T13600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 791.374262][ T5855] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 791.383391][ T29] audit: type=1400 audit(1771947340.494:904): avc: denied { bind } for pid=13655 comm="syz.1.1899" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 791.403367][T13600] 8021q: adding VLAN 0 to HW filter on device team0 [ 791.422418][ T143] bridge0: port 1(bridge_slave_0) entered blocking state [ 791.429566][ T143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 791.673860][ T5855] usb 7-1: Using ep0 maxpacket: 8 [ 791.680240][T11711] bridge0: port 2(bridge_slave_1) entered blocking state [ 791.687431][T11711] bridge0: port 2(bridge_slave_1) entered forwarding state [ 791.691566][ T29] audit: type=1400 audit(1771947340.494:905): avc: denied { name_bind } for pid=13655 comm="syz.1.1899" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 791.723873][ T5855] usb 7-1: unable to get BOS descriptor or descriptor too short [ 791.745830][ T5855] usb 7-1: config index 0 descriptor too short (expected 37906, got 18) [ 791.763936][ T5855] usb 7-1: config 72 has too many interfaces: 83, using maximum allowed: 32 [ 791.843840][ T5855] usb 7-1: config 72 has an invalid descriptor of length 0, skipping remainder of the config [ 791.855517][ T29] audit: type=1400 audit(1771947340.494:906): avc: denied { node_bind } for pid=13655 comm="syz.1.1899" saddr=255.255.255.255 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 791.884348][ T5855] usb 7-1: config 72 has 0 interfaces, different from the descriptor's value: 83 [ 791.927405][ T5855] usb 7-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice=31.25 [ 791.936988][ T5855] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.967189][ T5855] usb 7-1: Product: syz [ 791.997560][ T5855] usb 7-1: Manufacturer: syz [ 792.009464][T13660] sctp: [Deprecated]: syz.1.1899 (pid 13660) Use of int in max_burst socket option. [ 792.009464][T13660] Use struct sctp_assoc_value instead [ 792.035093][ T5855] usb 7-1: SerialNumber: syz [ 792.287029][T13600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 792.824133][T13671] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 792.892608][T13671] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 792.964141][ T5821] Bluetooth: hci5: command tx timeout [ 794.452622][T13647] syz.6.1898 (13647): drop_caches: 2 [ 794.918527][ T5855] usb 7-1: USB disconnect, device number 22 [ 794.944189][T13690] netlink: 332 bytes leftover after parsing attributes in process `syz.6.1905'. [ 795.044116][ T5821] Bluetooth: hci5: command tx timeout [ 795.064381][T13690] netlink: 160 bytes leftover after parsing attributes in process `syz.6.1905'. [ 795.545591][T13600] veth0_vlan: entered promiscuous mode [ 795.584847][T13600] veth1_vlan: entered promiscuous mode [ 795.667184][T13600] veth0_macvtap: entered promiscuous mode [ 795.686658][T13600] veth1_macvtap: entered promiscuous mode [ 795.735988][T13600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 795.758397][T13600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 795.775760][T11697] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.813971][ T9047] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 795.831422][T11697] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.876032][ T66] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.901724][ T66] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.944298][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 795.954260][ T979] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 795.966860][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 796.006915][ T9047] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 511, setting to 64 [ 796.023776][ T9047] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 796.940807][ T9047] usb 7-1: New USB device found, idVendor=09da, idProduct=001a, bcdDevice= 0.00 [ 796.949991][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 796.950011][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 796.968293][ T9047] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 796.977123][ T2699] block nbd0: Possible stuck request ffff888027660000: control (read@0,1024B). Runtime 30 seconds [ 796.992849][ T9047] usb 7-1: config 0 descriptor?? [ 796.992981][ T2699] block nbd0: Possible stuck request ffff888027660200: control (read@1024,1024B). Runtime 30 seconds [ 797.003117][T13691] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 797.010311][ T24] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 797.024646][ T2699] block nbd0: Possible stuck request ffff888027660400: control (read@2048,1024B). Runtime 30 seconds [ 797.035658][ T2699] block nbd0: Possible stuck request ffff888027660600: control (read@3072,1024B). Runtime 30 seconds [ 797.050842][ T979] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 797.060907][ T979] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 797.071548][ T979] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 797.086410][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 797.095552][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 797.105208][ T979] usb 3-1: Product: syz [ 797.109445][ T979] usb 3-1: Manufacturer: syz [ 797.114129][ T979] usb 3-1: SerialNumber: syz [ 798.528445][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 798.539775][ T24] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 798.556237][ T24] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 798.571990][ T24] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 798.581866][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 798.590558][ T24] usb 2-1: Product: syz [ 798.599842][ T24] usb 2-1: Manufacturer: syz [ 798.604243][ T9047] usbhid 7-1:0.0: can't add hid device: -71 [ 798.610500][ T24] usb 2-1: SerialNumber: syz [ 798.618453][ T979] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 65 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 798.625156][ T9047] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 798.684838][ T9047] usb 7-1: USB disconnect, device number 23 [ 798.849645][ T979] usb 3-1: USB disconnect, device number 65 [ 798.860866][ T24] usblp 2-1:1.0: usblp1: USB Unidirectional printer dev 66 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 798.888228][ T979] usblp0: removed [ 799.111232][ T10] usb 2-1: USB disconnect, device number 66 [ 799.127182][ T10] usblp1: removed [ 799.143929][ T9047] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 799.305332][ T9047] usb 7-1: config 0 descriptor has 1 excess byte, ignoring [ 799.312608][ T9047] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 799.363821][ T9047] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 799.377150][ T9047] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 799.456791][T13722] No such timeout policy "syz0" [ 800.369365][ T9047] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.388021][ T9047] usb 7-1: Product: syz [ 800.611017][ T9047] usb 7-1: Manufacturer: syz [ 800.615668][ T9047] usb 7-1: SerialNumber: syz [ 800.667547][ T9047] usb 7-1: config 0 descriptor?? [ 800.772506][ T24] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 801.013805][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 801.025330][ T24] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 801.037755][ T24] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 801.107634][ T9047] usb 7-1: 0:0 : invalid sync pipe. is_playback 1, ep 0b, bSynchAddress ff [ 801.168167][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 801.178412][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 801.190151][ T24] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 801.239156][ T24] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 801.310520][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.726747][ T9047] usb 7-1: USB disconnect, device number 24 [ 801.780414][ T5824] udevd[5824]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 802.256358][ T24] usb 3-1: GET_CAPABILITIES returned 0 [ 802.313925][ T24] usbtmc 3-1:16.0: can't read capabilities [ 802.974188][ T9047] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 803.127186][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.158568][ T9047] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 803.420220][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.435715][ T9047] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 803.461580][ T9047] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 803.492036][ T9047] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 803.503870][ T9047] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 803.521319][ T9047] usb 2-1: Product: syz [ 803.530869][ T9047] usb 2-1: Manufacturer: syz [ 803.534500][T13772] No such timeout policy "syz0" [ 803.535863][ T9047] usb 2-1: SerialNumber: syz [ 803.804827][ T9047] usblp 2-1:1.0: usblp1: USB Unidirectional printer dev 67 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 803.847469][ T10] usb 3-1: USB disconnect, device number 66 [ 804.149795][ T9047] usb 2-1: USB disconnect, device number 67 [ 804.222010][ T9047] usblp1: removed [ 805.322793][T13785] FAULT_INJECTION: forcing a failure. [ 805.322793][T13785] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 805.368910][T13785] CPU: 1 UID: 0 PID: 13785 Comm: syz.7.1931 Tainted: G L syzkaller #0 PREEMPT(full) [ 805.368930][T13785] Tainted: [L]=SOFTLOCKUP [ 805.368934][T13785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 805.368941][T13785] Call Trace: [ 805.368946][T13785] [ 805.368950][T13785] dump_stack_lvl+0x100/0x190 [ 805.368972][T13785] should_fail_ex.cold+0x5/0xa [ 805.368986][T13785] _copy_from_user+0x2e/0xd0 [ 805.369002][T13785] copy_msghdr_from_user+0x9f/0x4f0 [ 805.369017][T13785] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 805.369038][T13785] ? __pfx__kstrtoull+0x10/0x10 [ 805.369052][T13785] ___sys_sendmsg+0x106/0x1e0 [ 805.369066][T13785] ? __pfx____sys_sendmsg+0x10/0x10 [ 805.369087][T13785] ? find_held_lock+0x2b/0x80 [ 805.369109][T13785] __sys_sendmmsg+0x205/0x430 [ 805.369121][T13785] ? __pfx___sys_sendmmsg+0x10/0x10 [ 805.369136][T13785] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 805.369153][T13785] ? fput+0x79/0x100 [ 805.369166][T13785] ? ksys_write+0x1ac/0x250 [ 805.369181][T13785] ? __pfx_ksys_write+0x10/0x10 [ 805.369198][T13785] __x64_sys_sendmmsg+0x9c/0x100 [ 805.369209][T13785] ? lockdep_hardirqs_on+0x78/0x100 [ 805.369220][T13785] do_syscall_64+0x106/0xf80 [ 805.369230][T13785] ? clear_bhb_loop+0x40/0x90 [ 805.369243][T13785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.369254][T13785] RIP: 0033:0x7f5af159c629 [ 805.369265][T13785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.369276][T13785] RSP: 002b:00007f5af249d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 805.369288][T13785] RAX: ffffffffffffffda RBX: 00007f5af1816090 RCX: 00007f5af159c629 [ 805.369295][T13785] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 805.369302][T13785] RBP: 00007f5af249d090 R08: 0000000000000000 R09: 0000000000000000 [ 805.369308][T13785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 805.369314][T13785] R13: 00007f5af1816128 R14: 00007f5af1816090 R15: 00007ffe78b76918 [ 805.369328][T13785] [ 805.864632][T13789] FAULT_INJECTION: forcing a failure. [ 805.864632][T13789] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 805.877832][T13790] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 806.004929][T13789] CPU: 0 UID: 0 PID: 13789 Comm: syz.1.1933 Tainted: G L syzkaller #0 PREEMPT(full) [ 806.004961][T13789] Tainted: [L]=SOFTLOCKUP [ 806.004968][T13789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 806.004978][T13789] Call Trace: [ 806.004984][T13789] [ 806.004992][T13789] dump_stack_lvl+0x100/0x190 [ 806.005026][T13789] should_fail_ex.cold+0x5/0xa [ 806.005050][T13789] _copy_from_user+0x2e/0xd0 [ 806.005076][T13789] do_sock_getsockopt+0x30b/0x3d0 [ 806.005099][T13789] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 806.005133][T13789] __sys_getsockopt+0x148/0x260 [ 806.005167][T13789] ? __x64_sys_getsockopt+0xbd/0x160 [ 806.005192][T13789] __x64_sys_getsockopt+0xbd/0x160 [ 806.005219][T13789] ? do_syscall_64+0x95/0xf80 [ 806.005242][T13789] ? lockdep_hardirqs_on+0x78/0x100 [ 806.005260][T13789] do_syscall_64+0x106/0xf80 [ 806.005276][T13789] ? clear_bhb_loop+0x40/0x90 [ 806.005299][T13789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.005317][T13789] RIP: 0033:0x7fd3a7d9c629 [ 806.005333][T13789] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.005350][T13789] RSP: 002b:00007fd3a8c37028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 806.005367][T13789] RAX: ffffffffffffffda RBX: 00007fd3a8015fa0 RCX: 00007fd3a7d9c629 [ 806.005379][T13789] RDX: 0000000000000487 RSI: 0000000000000000 RDI: 0000000000000003 [ 806.005389][T13789] RBP: 00007fd3a8c37090 R08: 0000200000000080 R09: 0000000000000000 [ 806.005399][T13789] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 806.005409][T13789] R13: 00007fd3a8016038 R14: 00007fd3a8015fa0 R15: 00007ffee650fb98 [ 806.005434][T13789] [ 806.964866][T13797] input: syz1 as /devices/virtual/input/input51 [ 808.892243][T11000] Bluetooth: hci4: unexpected event for opcode 0x200f [ 810.531959][T11000] Bluetooth: hci0: unexpected event for opcode 0x200f [ 810.980839][T13829] input: syz1 as /devices/virtual/input/input52 [ 811.224846][ T5920] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 811.486533][ T5920] usb 7-1: config 0 descriptor has 1 excess byte, ignoring [ 811.493947][ T5920] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 811.510735][ T5920] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 811.554244][ T5920] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 811.555742][T13842] FAULT_INJECTION: forcing a failure. [ 811.555742][T13842] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 811.563299][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.563323][ T5920] usb 7-1: Product: syz [ 811.563338][ T5920] usb 7-1: Manufacturer: syz [ 811.563350][ T5920] usb 7-1: SerialNumber: syz [ 811.829242][T13842] CPU: 0 UID: 0 PID: 13842 Comm: syz.2.1941 Tainted: G L syzkaller #0 PREEMPT(full) [ 811.829274][T13842] Tainted: [L]=SOFTLOCKUP [ 811.829280][T13842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 811.829291][T13842] Call Trace: [ 811.829297][T13842] [ 811.829306][T13842] dump_stack_lvl+0x100/0x190 [ 811.829341][T13842] should_fail_ex.cold+0x5/0xa [ 811.829361][T13842] ? prepare_alloc_pages+0x16d/0x5f0 [ 811.829382][T13842] should_fail_alloc_page+0xeb/0x140 [ 811.829412][T13842] prepare_alloc_pages+0x1f0/0x5f0 [ 811.829430][T13842] ? __lock_acquire+0x4a5/0x2630 [ 811.829462][T13842] __alloc_frozen_pages_noprof+0x19a/0x2ba0 [ 811.829494][T13842] ? lock_acquire+0x1cf/0x380 [ 811.829522][T13842] ? find_held_lock+0x2b/0x80 [ 811.829545][T13842] ? page_table_check_set+0x49a/0xa10 [ 811.829571][T13842] ? page_table_check_set+0x49a/0xa10 [ 811.829599][T13842] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 811.829631][T13842] ? __page_table_check_ptes_set+0x1b5/0x4e0 [ 811.829656][T13842] ? xas_move_index+0xae/0x110 [ 811.829676][T13842] ? xas_find+0x32c/0x8e0 [ 811.829698][T13842] ? find_held_lock+0x2b/0x80 [ 811.829720][T13842] ? find_held_lock+0x2b/0x80 [ 811.829741][T13842] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 811.829767][T13842] ? policy_nodemask+0xed/0x4f0 [ 811.829798][T13842] alloc_pages_mpol+0x1fb/0x550 [ 811.829827][T13842] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 811.829862][T13842] folio_alloc_mpol_noprof+0x36/0x340 [ 811.829884][T13842] vma_alloc_folio_noprof+0xed/0x1d0 [ 811.829904][T13842] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 811.829932][T13842] do_anonymous_page+0xb3a/0x1fb0 [ 811.829963][T13842] __handle_mm_fault+0x1d42/0x2b60 [ 811.829990][T13842] ? reacquire_held_locks+0xce/0x1e0 [ 811.830019][T13842] ? __pfx___handle_mm_fault+0x10/0x10 [ 811.830045][T13842] ? lock_vma_under_rcu+0x17c/0x590 [ 811.830083][T13842] handle_mm_fault+0x36d/0xa20 [ 811.830114][T13842] do_user_addr_fault+0x5a3/0x12f0 [ 811.830143][T13842] exc_page_fault+0x6f/0xd0 [ 811.830162][T13842] asm_exc_page_fault+0x26/0x30 [ 811.830180][T13842] RIP: 0033:0x7f80b205df4b [ 811.830201][T13842] Code: 00 00 00 48 8d 3d 3d a7 1a 00 48 89 c1 31 c0 e8 9b 32 ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d 71 a7 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 811.830219][T13842] RSP: 002b:00007f80b313bfa0 EFLAGS: 00010206 [ 811.830234][T13842] RAX: 0000000000000000 RBX: 00007f80b2415fa0 RCX: 0000000000000000 [ 811.830244][T13842] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000200 [ 811.830255][T13842] RBP: 00007f80b313d090 R08: 0000000000000000 R09: 0000000000000000 [ 811.830265][T13842] R10: 0000200000000200 R11: 0000000000000000 R12: 0000000000000001 [ 811.830275][T13842] R13: 00007f80b2416038 R14: 00007f80b2415fa0 R15: 00007fff04f31ab8 [ 811.830301][T13842] [ 812.109670][T13842] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 812.183537][ T5920] usb 7-1: config 0 descriptor?? [ 813.054893][ T5920] usb 7-1: 0:0 : invalid sync pipe. is_playback 1, ep 0b, bSynchAddress ff [ 813.794503][ T29] audit: type=1400 audit(1771947362.914:907): avc: denied { execmem } for pid=13865 comm="syz.1.1954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 814.043083][T13872] No such timeout policy "syz0" [ 814.888703][ T5920] usb 7-1: USB disconnect, device number 25 [ 814.895812][ T29] audit: type=1400 audit(1771947363.074:908): avc: denied { read write } for pid=11532 comm="syz-executor" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 815.038763][ T29] audit: type=1400 audit(1771947363.074:909): avc: denied { open } for pid=11532 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 815.183818][ T29] audit: type=1400 audit(1771947363.074:910): avc: denied { ioctl } for pid=11532 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=653 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 815.323126][ T29] audit: type=1400 audit(1771947363.194:911): avc: denied { read } for pid=13865 comm="syz.1.1954" dev="nsfs" ino=4026533174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 815.400390][ T8083] udevd[8083]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 815.423899][ T29] audit: type=1400 audit(1771947363.194:912): avc: denied { open } for pid=13865 comm="syz.1.1954" path="net:[4026533174]" dev="nsfs" ino=4026533174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 815.668945][ T29] audit: type=1400 audit(1771947363.194:913): avc: denied { create } for pid=13865 comm="syz.1.1954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 815.686447][T13888] input: syz1 as /devices/virtual/input/input53 [ 816.632070][ T29] audit: type=1400 audit(1771947363.214:914): avc: denied { getopt } for pid=13865 comm="syz.1.1954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 816.656978][ T29] audit: type=1400 audit(1771947364.214:915): avc: denied { mounton } for pid=13874 comm="syz.2.1955" path="/424/file1" dev="tmpfs" ino=2309 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 816.723083][ T29] audit: type=1400 audit(1771947364.214:916): avc: denied { mount } for pid=13874 comm="syz.2.1955" name="/" dev="autofs" ino=54063 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 817.914703][ T5792] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 818.113842][ T5792] usb 5-1: Using ep0 maxpacket: 32 [ 818.153858][ T5792] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 818.165225][ T5792] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 818.576719][ T5792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 818.599971][ T5792] usb 5-1: config 0 descriptor?? [ 818.996350][ T29] kauditd_printk_skb: 37 callbacks suppressed [ 818.996367][ T29] audit: type=1400 audit(1771947368.114:954): avc: denied { getopt } for pid=13905 comm="syz.6.1967" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 819.183900][ T29] audit: type=1400 audit(1771947368.154:955): avc: denied { allowed } for pid=13905 comm="syz.6.1967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 819.231666][ T29] audit: type=1400 audit(1771947368.314:956): avc: denied { bind } for pid=13907 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 819.353391][ T29] audit: type=1400 audit(1771947368.314:957): avc: denied { setopt } for pid=13907 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 819.547571][T13917] No such timeout policy "syz0" [ 820.422128][ T29] audit: type=1400 audit(1771947368.314:958): avc: denied { accept } for pid=13907 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 820.441881][ T29] audit: type=1400 audit(1771947368.314:959): avc: denied { write } for pid=13907 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 820.911908][ T29] audit: type=1400 audit(1771947368.314:960): avc: denied { read } for pid=13907 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 821.304501][ T5821] Bluetooth: hci4: unexpected event for opcode 0x200f [ 821.316731][ T29] audit: type=1400 audit(1771947368.344:961): avc: denied { read write } for pid=13911 comm="syz.1.1965" name="video36" dev="devtmpfs" ino=1044 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 821.340803][ T29] audit: type=1400 audit(1771947368.344:962): avc: denied { open } for pid=13911 comm="syz.1.1965" path="/dev/video36" dev="devtmpfs" ino=1044 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 821.367887][ T29] audit: type=1400 audit(1771947368.344:963): avc: denied { ioctl } for pid=13911 comm="syz.1.1965" path="/dev/video36" dev="devtmpfs" ino=1044 ioctlcmd=0x5628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 821.514038][T13929] input: syz1 as /devices/virtual/input/input54 [ 823.477830][ T5792] usb 5-1: can't set config #0, error -71 [ 823.681524][ T5792] usb 5-1: USB disconnect, device number 64 [ 823.782347][T13946] No such timeout policy "syz0" [ 825.022237][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 825.022250][ T29] audit: type=1400 audit(1771947374.134:974): avc: denied { create } for pid=13955 comm="syz.4.1981" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 825.063843][T13712] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 825.209521][T13958] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1982'. [ 825.246477][T13958] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1982'. [ 825.284696][T13712] usb 3-1: Using ep0 maxpacket: 32 [ 825.299476][ T29] audit: type=1400 audit(1771947374.414:975): avc: denied { create } for pid=13957 comm="syz.4.1982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 825.304696][T13712] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 825.364378][T13712] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 825.373566][T13712] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 825.405901][T13712] usb 3-1: config 0 descriptor?? [ 825.434513][ T29] audit: type=1400 audit(1771947374.534:976): avc: denied { create } for pid=13957 comm="syz.4.1982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 825.459250][T13712] hub 3-1:0.0: USB hub found [ 825.504597][ T29] audit: type=1400 audit(1771947374.534:977): avc: denied { ioctl } for pid=13957 comm="syz.4.1982" path="socket:[54219]" dev="sockfs" ino=54219 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 825.746348][T13712] hub 3-1:0.0: 1 port detected [ 825.773834][ T29] audit: type=1400 audit(1771947374.534:978): avc: denied { open } for pid=13957 comm="syz.4.1982" path="/dev/ptyqd" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 825.835426][T13964] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 825.871091][ T29] audit: type=1400 audit(1771947374.544:979): avc: denied { ioctl } for pid=13957 comm="syz.4.1982" path="/dev/ptyqd" dev="devtmpfs" ino=132 ioctlcmd=0x5414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 825.952943][ T29] audit: type=1400 audit(1771947374.544:980): avc: denied { write } for pid=13957 comm="syz.4.1982" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 826.023357][ T29] audit: type=1400 audit(1771947374.894:981): avc: denied { ioctl } for pid=13962 comm="syz.1.1983" path="socket:[55274]" dev="sockfs" ino=55274 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 826.081143][T13965] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 826.128476][ T29] audit: type=1400 audit(1771947375.194:982): avc: denied { bind } for pid=13962 comm="syz.1.1983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 826.153296][T13712] usb 3-1: USB disconnect, device number 67 [ 826.191665][ T29] audit: type=1400 audit(1771947375.204:983): avc: denied { write } for pid=13962 comm="syz.1.1983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 827.160288][T13972] FAULT_INJECTION: forcing a failure. [ 827.160288][T13972] name failslab, interval 1, probability 0, space 0, times 0 [ 827.222698][T13972] CPU: 0 UID: 0 PID: 13972 Comm: syz.6.1975 Tainted: G L syzkaller #0 PREEMPT(full) [ 827.222729][T13972] Tainted: [L]=SOFTLOCKUP [ 827.222735][T13972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 827.222744][T13972] Call Trace: [ 827.222750][T13972] [ 827.222757][T13972] dump_stack_lvl+0x100/0x190 [ 827.222793][T13972] should_fail_ex.cold+0x5/0xa [ 827.222815][T13972] ? __do_sys_futex_waitv+0x20c/0x2c0 [ 827.222832][T13972] should_failslab+0xc2/0x120 [ 827.222856][T13972] __kmalloc_noprof+0xe0/0x850 [ 827.222877][T13972] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 827.222898][T13972] __do_sys_futex_waitv+0x20c/0x2c0 [ 827.222916][T13972] ? __pfx___do_sys_futex_waitv+0x10/0x10 [ 827.222943][T13972] do_syscall_64+0x106/0xf80 [ 827.222965][T13972] ? clear_bhb_loop+0x40/0x90 [ 827.222984][T13972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.222999][T13972] RIP: 0033:0x7f318d19c629 [ 827.223013][T13972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 827.223028][T13972] RSP: 002b:00007f318b3cd028 EFLAGS: 00000246 ORIG_RAX: 00000000000001c1 [ 827.223044][T13972] RAX: ffffffffffffffda RBX: 00007f318d416090 RCX: 00007f318d19c629 [ 827.223055][T13972] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000180 [ 827.223064][T13972] RBP: 00007f318b3cd090 R08: 0000000000000000 R09: 0000000000000000 [ 827.223075][T13972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 827.223085][T13972] R13: 00007f318d416128 R14: 00007f318d416090 R15: 00007ffef7f963b8 [ 827.223106][T13972] [ 827.426616][T13975] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1985'. [ 827.446184][ T2699] block nbd0: Possible stuck request ffff888027660000: control (read@0,1024B). Runtime 60 seconds [ 827.457064][ T2699] block nbd0: Possible stuck request ffff888027660200: control (read@1024,1024B). Runtime 60 seconds [ 827.468213][ T2699] block nbd0: Possible stuck request ffff888027660400: control (read@2048,1024B). Runtime 60 seconds [ 827.479264][ T2699] block nbd0: Possible stuck request ffff888027660600: control (read@3072,1024B). Runtime 60 seconds [ 827.673918][T13712] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 827.854454][T13982] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1988'. [ 827.868689][T13712] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 828.046336][T13712] usb 2-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 828.982468][T13984] tipc: Started in network mode [ 828.987416][T13984] tipc: Node identity 7f000001, cluster identity 4711 [ 828.994917][T11000] Bluetooth: hci5: command 0x0406 tx timeout [ 829.018451][T13712] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.036949][T13712] usb 2-1: config 0 descriptor?? [ 829.048521][T13984] tipc: Enabling of bearer rejected, failed to enable media [ 829.069784][ T50] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 829.084756][T13712] smsusb:smsusb_probe: board id=8, interface number 0 [ 829.310846][T13712] smsusb:smsusb_probe: Device initialized with return code -19 [ 829.411349][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 829.425629][ T50] usb 5-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 829.435404][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.452731][ T50] usb 5-1: config 0 descriptor?? [ 829.790625][ T50] smsusb:smsusb_probe: board id=8, interface number 0 [ 829.854944][ T50] smsusb:smsusb_probe: Device initialized with return code -19 [ 829.925231][T13997] FAULT_INJECTION: forcing a failure. [ 829.925231][T13997] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 829.938417][T13997] CPU: 0 UID: 0 PID: 13997 Comm: syz.4.1988 Tainted: G L syzkaller #0 PREEMPT(full) [ 829.938446][T13997] Tainted: [L]=SOFTLOCKUP [ 829.938453][T13997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 829.938463][T13997] Call Trace: [ 829.938471][T13997] [ 829.938478][T13997] dump_stack_lvl+0x100/0x190 [ 829.938513][T13997] should_fail_ex.cold+0x5/0xa [ 829.938536][T13997] _copy_from_user+0x2e/0xd0 [ 829.938562][T13997] __sys_bpf+0x243/0x4b90 [ 829.938585][T13997] ? __pfx___sys_bpf+0x10/0x10 [ 829.938602][T13997] ? finish_task_switch.isra.0+0x200/0xb80 [ 829.938629][T13997] ? rcu_is_watching+0x12/0xc0 [ 829.938652][T13997] ? finish_task_switch.isra.0+0x205/0xb80 [ 829.938676][T13997] ? lockdep_hardirqs_on+0x78/0x100 [ 829.938695][T13997] ? finish_task_switch.isra.0+0x205/0xb80 [ 829.938719][T13997] ? rcu_is_watching+0x12/0xc0 [ 829.938739][T13997] ? trace_sched_exit_tp+0x13a/0x180 [ 829.938766][T13997] ? __schedule+0x1000/0x60e0 [ 829.938810][T13997] ? fput+0x79/0x100 [ 829.938831][T13997] ? exit_to_user_mode_loop+0xdd/0x4a0 [ 829.938864][T13997] ? rcu_is_watching+0x12/0xc0 [ 829.938887][T13997] __x64_sys_bpf+0x7b/0xc0 [ 829.938906][T13997] ? lockdep_hardirqs_on+0x78/0x100 [ 829.938923][T13997] do_syscall_64+0x106/0xf80 [ 829.938940][T13997] ? clear_bhb_loop+0x40/0x90 [ 829.938962][T13997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.938980][T13997] RIP: 0033:0x7fe087f9c629 [ 829.938997][T13997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.939013][T13997] RSP: 002b:00007fe0861f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 829.939031][T13997] RAX: ffffffffffffffda RBX: 00007fe088216180 RCX: 00007fe087f9c629 [ 829.939043][T13997] RDX: 0000000000000020 RSI: 00002000000000c0 RDI: 0000000000000002 [ 829.939054][T13997] RBP: 00007fe0861f6090 R08: 0000000000000000 R09: 0000000000000000 [ 829.939064][T13997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 829.939074][T13997] R13: 00007fe088216218 R14: 00007fe088216180 R15: 00007fff38343088 [ 829.939099][T13997] [ 830.872022][T12558] usb 2-1: USB disconnect, device number 68 [ 830.965688][ T29] kauditd_printk_skb: 41 callbacks suppressed [ 830.965705][ T29] audit: type=1400 audit(1771947380.084:1025): avc: denied { name_bind } for pid=14008 comm="syz.1.1993" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 830.997315][ T29] audit: type=1400 audit(1771947380.084:1026): avc: denied { node_bind } for pid=14008 comm="syz.1.1993" saddr=224.0.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 831.020054][ T50] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 832.044115][ T5943] usb 5-1: USB disconnect, device number 65 [ 832.242706][ T50] usb 3-1: Using ep0 maxpacket: 16 [ 832.269052][ T50] usb 3-1: config index 0 descriptor too short (expected 1051, got 27) [ 832.288679][ T50] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 832.400427][ T50] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 832.449828][ T50] usb 3-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9 [ 832.740922][ T50] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.772922][T14026] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 832.798493][ T50] usb 3-1: Product: syz [ 832.802724][ T50] usb 3-1: Manufacturer: syz [ 832.808162][ T50] usb 3-1: SerialNumber: syz [ 832.825321][T14029] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 832.836242][ T50] usb 3-1: config 0 descriptor?? [ 833.253488][ T29] audit: type=1400 audit(1771947382.344:1027): avc: denied { mounton } for pid=14031 comm="syz.7.1998" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 833.876345][ T29] audit: type=1400 audit(1771947382.344:1028): avc: denied { mount } for pid=14031 comm="syz.7.1998" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 833.955965][ T29] audit: type=1400 audit(1771947382.704:1029): avc: denied { connect } for pid=14003 comm="syz.2.1992" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 834.192449][ T29] audit: type=1400 audit(1771947383.234:1030): avc: denied { cmd } for pid=14022 comm="syz.4.1995" path="socket:[55345]" dev="sockfs" ino=55345 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 834.293951][T14041] xt_bpf: check failed: parse error [ 834.329902][ T29] audit: type=1400 audit(1771947383.294:1031): avc: denied { ioctl } for pid=14022 comm="syz.4.1995" path="socket:[55343]" dev="sockfs" ino=55343 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 834.572149][ T29] audit: type=1400 audit(1771947383.474:1032): avc: denied { write } for pid=14022 comm="syz.4.1995" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 834.882123][ T50] usb 3-1: USB disconnect, device number 68 [ 835.000692][ T29] audit: type=1400 audit(1771947384.114:1033): avc: denied { connect } for pid=14042 comm="syz.1.2001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 835.284234][T14058] Invalid option length (57448) for dns_resolver key [ 836.973836][ T29] audit: type=1400 audit(1771947386.054:1034): avc: denied { setopt } for pid=14060 comm="syz.7.2004" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 838.521427][T14081] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2012'. [ 839.512819][ T29] audit: type=1400 audit(1771947388.074:1035): avc: denied { ioctl } for pid=14078 comm="syz.7.2009" path="socket:[56496]" dev="sockfs" ino=56496 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 839.563963][T14081] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2012'. [ 839.619173][ T29] audit: type=1400 audit(1771947388.084:1036): avc: denied { write } for pid=14078 comm="syz.7.2009" path="socket:[56496]" dev="sockfs" ino=56496 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 839.678396][ T29] audit: type=1400 audit(1771947388.084:1037): avc: denied { write } for pid=14078 comm="syz.7.2009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 840.727199][ T29] audit: type=1400 audit(1771947389.844:1038): avc: denied { read write } for pid=14092 comm="syz.1.2015" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 840.736831][ T5920] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 840.810751][ T5920] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 840.857534][ T29] audit: type=1400 audit(1771947389.844:1039): avc: denied { open } for pid=14092 comm="syz.1.2015" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 842.989638][ T29] audit: type=1400 audit(1771947391.944:1040): avc: denied { listen } for pid=14110 comm="syz.4.2007" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 843.313839][ T5821] Bluetooth: hci1: unexpected event for opcode 0x200f [ 843.638512][T14118] FAULT_INJECTION: forcing a failure. [ 843.638512][T14118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 843.778688][T14118] CPU: 0 UID: 0 PID: 14118 Comm: syz.4.2020 Tainted: G L syzkaller #0 PREEMPT(full) [ 843.778708][T14118] Tainted: [L]=SOFTLOCKUP [ 843.778712][T14118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 843.778719][T14118] Call Trace: [ 843.778723][T14118] [ 843.778728][T14118] dump_stack_lvl+0x100/0x190 [ 843.778750][T14118] should_fail_ex.cold+0x5/0xa [ 843.778764][T14118] _copy_from_user+0x2e/0xd0 [ 843.778780][T14118] copy_msghdr_from_user+0x9f/0x4f0 [ 843.778796][T14118] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 843.778816][T14118] ___sys_sendmsg+0x106/0x1e0 [ 843.778831][T14118] ? __pfx____sys_sendmsg+0x10/0x10 [ 843.778861][T14118] __sys_sendmsg+0x170/0x220 [ 843.778872][T14118] ? __pfx___sys_sendmsg+0x10/0x10 [ 843.778891][T14118] do_syscall_64+0x106/0xf80 [ 843.778902][T14118] ? clear_bhb_loop+0x40/0x90 [ 843.778915][T14118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.778926][T14118] RIP: 0033:0x7fe087f9c629 [ 843.778935][T14118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.778945][T14118] RSP: 002b:00007fe088d8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 843.778957][T14118] RAX: ffffffffffffffda RBX: 00007fe088215fa0 RCX: 00007fe087f9c629 [ 843.778964][T14118] RDX: 000000000000c800 RSI: 00002000000002c0 RDI: 0000000000000003 [ 843.778970][T14118] RBP: 00007fe088d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 843.778976][T14118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.778982][T14118] R13: 00007fe088216038 R14: 00007fe088215fa0 R15: 00007fff38343088 [ 843.778996][T14118] [ 844.088832][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 844.257365][ T29] audit: type=1400 audit(1771947393.374:1041): avc: denied { create } for pid=14106 comm="syz.1.2018" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 845.063186][ T24] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 845.486108][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 846.034516][ T29] audit: type=1400 audit(1771947394.694:1042): avc: denied { connect } for pid=14137 comm="syz.1.2024" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 846.055861][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 846.121780][ T24] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 846.153554][ T29] audit: type=1400 audit(1771947394.704:1043): avc: denied { setopt } for pid=14137 comm="syz.1.2024" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 846.176430][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.241463][T14144] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 846.260153][T14145] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 846.313899][ T24] usb 7-1: config 0 descriptor?? [ 846.335745][ T24] hub 7-1:0.0: USB hub found [ 846.358894][ T29] audit: type=1400 audit(1771947394.704:1044): avc: denied { write } for pid=14137 comm="syz.1.2024" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 846.408552][ T29] audit: type=1400 audit(1771947394.804:1045): avc: denied { create } for pid=14137 comm="syz.1.2024" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 846.507909][T14151] netlink: 'syz.7.2013': attribute type 10 has an invalid length. [ 846.529960][T14151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 846.539842][T14151] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 846.579460][ T24] hub 7-1:0.0: 1 port detected [ 846.594354][ T5821] Bluetooth: hci5: unexpected event for opcode 0x2003 [ 846.614071][ T29] audit: type=1400 audit(1771947394.804:1046): avc: denied { setopt } for pid=14137 comm="syz.1.2024" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 846.633967][ T29] audit: type=1400 audit(1771947395.664:1047): avc: denied { read } for pid=14148 comm="syz.7.2013" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 846.662734][ T29] audit: type=1400 audit(1771947395.664:1048): avc: denied { open } for pid=14148 comm="syz.7.2013" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 846.719128][ T5821] Bluetooth: hci2: unexpected event for opcode 0x200f [ 847.031769][ T29] audit: type=1400 audit(1771947395.674:1049): avc: denied { ioctl } for pid=14148 comm="syz.7.2013" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 847.270316][ T24] usb 7-1: USB disconnect, device number 26 [ 847.643333][ T5821] Bluetooth: hci2: unexpected event for opcode 0x200f [ 850.461280][ T29] audit: type=1400 audit(1771947399.574:1050): avc: denied { connect } for pid=14191 comm="syz.4.2035" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 850.698282][T14199] FAULT_INJECTION: forcing a failure. [ 850.698282][T14199] name failslab, interval 1, probability 0, space 0, times 0 [ 850.710983][T14199] CPU: 0 UID: 0 PID: 14199 Comm: syz.2.2036 Tainted: G L syzkaller #0 PREEMPT(full) [ 850.711012][T14199] Tainted: [L]=SOFTLOCKUP [ 850.711019][T14199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 850.711029][T14199] Call Trace: [ 850.711036][T14199] [ 850.711042][T14199] dump_stack_lvl+0x100/0x190 [ 850.711077][T14199] should_fail_ex.cold+0x5/0xa [ 850.711102][T14199] should_failslab+0xc2/0x120 [ 850.711131][T14199] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 850.711154][T14199] ? alloc_empty_file+0x55/0x1c0 [ 850.711174][T14199] ? _raw_spin_unlock+0x28/0x50 [ 850.711204][T14199] alloc_empty_file+0x55/0x1c0 [ 850.711226][T14199] dentry_open_nonotify+0x1f/0xd0 [ 850.711248][T14199] fanotify_read+0x5e8/0x28d0 [ 850.711289][T14199] ? __pfx_fanotify_read+0x10/0x10 [ 850.711314][T14199] ? inode_has_perm+0x181/0x1d0 [ 850.711341][T14199] ? file_has_perm+0x27b/0x350 [ 850.711368][T14199] ? __pfx_file_has_perm+0x10/0x10 [ 850.711403][T14199] ? selinux_file_permission+0x8f/0x6d0 [ 850.711423][T14199] ? __pfx_woken_wake_function+0x10/0x10 [ 850.711446][T14199] ? bpf_lsm_file_permission+0x9/0x10 [ 850.711471][T14199] ? security_file_permission+0x76/0x210 [ 850.711492][T14199] ? rw_verify_area+0xce/0x6d0 [ 850.711515][T14199] ? __pfx_fanotify_read+0x10/0x10 [ 850.711542][T14199] vfs_read+0x1e4/0xb30 [ 850.711571][T14199] ? __pfx_vfs_read+0x10/0x10 [ 850.711594][T14199] ? find_held_lock+0x2b/0x80 [ 850.711616][T14199] ? __fget_files+0x215/0x3d0 [ 850.711632][T14199] ? __fget_files+0x215/0x3d0 [ 850.711653][T14199] ? __fget_files+0x21f/0x3d0 [ 850.711677][T14199] ksys_read+0x12a/0x250 [ 850.711702][T14199] ? __pfx_ksys_read+0x10/0x10 [ 850.711734][T14199] do_syscall_64+0x106/0xf80 [ 850.711751][T14199] ? clear_bhb_loop+0x40/0x90 [ 850.711774][T14199] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.711798][T14199] RIP: 0033:0x7f80b219c629 [ 850.711814][T14199] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 850.711832][T14199] RSP: 002b:00007f80b311c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 850.711849][T14199] RAX: ffffffffffffffda RBX: 00007f80b2416090 RCX: 00007f80b219c629 [ 850.711861][T14199] RDX: 0000000000002020 RSI: 0000200000002300 RDI: 0000000000000006 [ 850.711871][T14199] RBP: 00007f80b311c090 R08: 0000000000000000 R09: 0000000000000000 [ 850.711881][T14199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 850.711891][T14199] R13: 00007f80b2416128 R14: 00007f80b2416090 R15: 00007fff04f31ab8 [ 850.711916][T14199] [ 851.271243][ T29] audit: type=1400 audit(1771947399.814:1051): avc: denied { watch } for pid=14196 comm="syz.2.2036" path="/442/file0" dev="tmpfs" ino=2407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 851.383371][ T29] audit: type=1400 audit(1771947399.814:1052): avc: denied { watch_sb watch_reads } for pid=14196 comm="syz.2.2036" path="/442/file0" dev="tmpfs" ino=2407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 851.666964][T14203] bridge0: entered allmulticast mode [ 852.597924][T11000] Bluetooth: hci6: command 0x1003 tx timeout [ 852.605817][ T5821] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 852.863607][ T5821] Bluetooth: hci4: unexpected event for opcode 0x200f [ 853.912450][ T979] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 854.168384][ T979] usb 5-1: Using ep0 maxpacket: 32 [ 854.782466][ T979] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 854.800246][ T979] usb 5-1: can't read configurations, error -71 [ 855.080061][ T29] audit: type=1400 audit(1771947404.194:1053): avc: denied { append } for pid=14233 comm="syz.1.2048" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 855.108055][T14234] loop5: detected capacity change from 0 to 7 [ 855.129716][T14234] Dev loop5: unable to read RDB block 7 [ 855.146983][T14234] loop5: AHDI p1 p2 p3 [ 855.151186][T14234] loop5: partition table partially beyond EOD, truncated [ 855.219230][T14234] loop5: p1 start 1601398130 is beyond EOD, truncated [ 855.243860][T14234] loop5: p2 start 1702059890 is beyond EOD, truncated [ 857.379549][ T29] audit: type=1400 audit(1771947406.114:1054): avc: denied { write } for pid=14249 comm="syz.2.2053" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 857.444961][ T29] audit: type=1400 audit(1771947406.114:1055): avc: denied { connect } for pid=14249 comm="syz.2.2053" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 857.464732][ T29] audit: type=1400 audit(1771947406.114:1056): avc: denied { name_connect } for pid=14249 comm="syz.2.2053" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 857.504186][ T29] audit: type=1400 audit(1771947406.134:1057): avc: denied { setopt } for pid=14249 comm="syz.2.2053" lport=40152 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 857.527861][ T2699] block nbd0: Possible stuck request ffff888027660000: control (read@0,1024B). Runtime 90 seconds [ 857.538570][ T2699] block nbd0: Possible stuck request ffff888027660200: control (read@1024,1024B). Runtime 90 seconds [ 857.553740][ T2699] block nbd0: Possible stuck request ffff888027660400: control (read@2048,1024B). Runtime 90 seconds [ 857.564727][ T2699] block nbd0: Possible stuck request ffff888027660600: control (read@3072,1024B). Runtime 90 seconds [ 857.586114][ T29] audit: type=1400 audit(1771947406.134:1058): avc: denied { name_connect } for pid=14249 comm="syz.2.2053" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 857.606643][ T29] audit: type=1400 audit(1771947406.194:1059): avc: denied { listen } for pid=14249 comm="syz.2.2053" lport=56784 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 857.628565][ T29] audit: type=1400 audit(1771947406.714:1060): avc: denied { ioctl } for pid=14247 comm="syz.4.2051" path="socket:[56867]" dev="sockfs" ino=56867 ioctlcmd=0x48e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 858.011045][ T29] audit: type=1400 audit(1771947407.124:1061): avc: denied { read write } for pid=14257 comm="syz.4.2055" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 858.946431][ T29] audit: type=1400 audit(1771947407.124:1062): avc: denied { open } for pid=14257 comm="syz.4.2055" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 860.306141][T14269] netlink: 84 bytes leftover after parsing attributes in process `syz.7.2045'. [ 860.315207][ T29] audit: type=1400 audit(1771947409.414:1063): avc: denied { create } for pid=14262 comm="syz.7.2045" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 860.496530][T14269] netlink: 64 bytes leftover after parsing attributes in process `syz.7.2045'. [ 860.859183][T14273] FAULT_INJECTION: forcing a failure. [ 860.859183][T14273] name failslab, interval 1, probability 0, space 0, times 0 [ 860.871955][T14273] CPU: 0 UID: 0 PID: 14273 Comm: syz.1.2052 Tainted: G L syzkaller #0 PREEMPT(full) [ 860.871981][T14273] Tainted: [L]=SOFTLOCKUP [ 860.871986][T14273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 860.871996][T14273] Call Trace: [ 860.872002][T14273] [ 860.872008][T14273] dump_stack_lvl+0x100/0x190 [ 860.872039][T14273] should_fail_ex.cold+0x5/0xa [ 860.872060][T14273] ? tomoyo_realpath_from_path+0xb6/0x690 [ 860.872079][T14273] should_failslab+0xc2/0x120 [ 860.872104][T14273] __kmalloc_noprof+0xe0/0x850 [ 860.872129][T14273] tomoyo_realpath_from_path+0xb6/0x690 [ 860.872154][T14273] tomoyo_path_number_perm+0x23c/0x580 [ 860.872179][T14273] ? tomoyo_path_number_perm+0x22e/0x580 [ 860.872209][T14273] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 860.872261][T14273] ? irqentry_exit+0x180/0x670 [ 860.872281][T14273] ? hook_file_ioctl_common+0x146/0x410 [ 860.872312][T14273] ? __x64_sys_ioctl+0x94/0x210 [ 860.872341][T14273] security_file_ioctl+0xd3/0x230 [ 860.872362][T14273] __x64_sys_ioctl+0xb7/0x210 [ 860.872389][T14273] do_syscall_64+0x106/0xf80 [ 860.872406][T14273] ? clear_bhb_loop+0x40/0x90 [ 860.872429][T14273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 860.872447][T14273] RIP: 0033:0x7fd3a7d9c629 [ 860.872463][T14273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 860.872479][T14273] RSP: 002b:00007fd3a8c16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 860.872496][T14273] RAX: ffffffffffffffda RBX: 00007fd3a8016090 RCX: 00007fd3a7d9c629 [ 860.872508][T14273] RDX: 0000200000000080 RSI: 00000000400448e7 RDI: 0000000000000004 [ 860.872518][T14273] RBP: 00007fd3a8c16090 R08: 0000000000000000 R09: 0000000000000000 [ 860.872528][T14273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 860.872538][T14273] R13: 00007fd3a8016128 R14: 00007fd3a8016090 R15: 00007ffee650fb98 [ 860.872563][T14273] [ 860.872618][T14273] ERROR: Out of memory at tomoyo_realpath_from_path. [ 862.552356][T14287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 862.923545][T14287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 863.263814][ T979] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 863.437808][ T979] usb 3-1: device descriptor read/64, error -71 [ 863.703957][ T979] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 863.843797][ T979] usb 3-1: device descriptor read/64, error -71 [ 863.987964][ T979] usb usb3-port1: attempt power cycle [ 865.011471][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 865.023781][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 865.894052][ T979] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 866.075750][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 866.075762][ T29] audit: type=1400 audit(1771947415.194:1066): avc: denied { mounton } for pid=14310 comm="syz.2.2066" path="/450/file0" dev="tmpfs" ino=2454 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 866.125471][ T979] usb 3-1: device not accepting address 71, error -71 [ 866.173787][ T29] audit: type=1400 audit(1771947415.194:1067): avc: denied { mount } for pid=14310 comm="syz.2.2066" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 866.286662][ T29] audit: type=1400 audit(1771947415.404:1068): avc: denied { unmount } for pid=5806 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 868.514105][ T5792] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 868.743282][T14336] No such timeout policy "syz0" [ 869.753752][ T5792] usb 8-1: Using ep0 maxpacket: 16 [ 869.761454][ T5792] usb 8-1: config 0 has an invalid descriptor of length 85, skipping remainder of the config [ 869.771797][ T5792] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 869.782518][ T5792] usb 8-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=59.31 [ 869.791706][ T5792] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.799777][ T5792] usb 8-1: Product: syz [ 869.804370][ T5792] usb 8-1: Manufacturer: syz [ 869.808964][ T5792] usb 8-1: SerialNumber: syz [ 869.948616][ T5792] usb 8-1: config 0 descriptor?? [ 870.655469][T14345] macsec1: entered promiscuous mode [ 870.660735][T14345] macsec1: entered allmulticast mode [ 870.786493][T14328] FAULT_INJECTION: forcing a failure. [ 870.786493][T14328] name failslab, interval 1, probability 0, space 0, times 0 [ 870.818688][T14328] CPU: 1 UID: 0 PID: 14328 Comm: syz.7.2072 Tainted: G L syzkaller #0 PREEMPT(full) [ 870.818718][T14328] Tainted: [L]=SOFTLOCKUP [ 870.818724][T14328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 870.818736][T14328] Call Trace: [ 870.818742][T14328] [ 870.818749][T14328] dump_stack_lvl+0x100/0x190 [ 870.818782][T14328] should_fail_ex.cold+0x5/0xa [ 870.818805][T14328] ? tomoyo_realpath_from_path+0xb6/0x690 [ 870.818826][T14328] should_failslab+0xc2/0x120 [ 870.818854][T14328] __kmalloc_noprof+0xe0/0x850 [ 870.818883][T14328] tomoyo_realpath_from_path+0xb6/0x690 [ 870.818909][T14328] tomoyo_path_number_perm+0x23c/0x580 [ 870.818937][T14328] ? tomoyo_path_number_perm+0x22e/0x580 [ 870.818966][T14328] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 870.819020][T14328] ? find_held_lock+0x2b/0x80 [ 870.819043][T14328] ? __fget_files+0x215/0x3d0 [ 870.819058][T14328] ? hook_file_ioctl_common+0x146/0x410 [ 870.819087][T14328] ? __fget_files+0x21f/0x3d0 [ 870.819108][T14328] security_file_ioctl+0xd3/0x230 [ 870.819129][T14328] __x64_sys_ioctl+0xb7/0x210 [ 870.819156][T14328] do_syscall_64+0x106/0xf80 [ 870.819173][T14328] ? clear_bhb_loop+0x40/0x90 [ 870.819195][T14328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.819212][T14328] RIP: 0033:0x7f5af159c629 [ 870.819227][T14328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 870.819244][T14328] RSP: 002b:00007f5af24be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 870.819262][T14328] RAX: ffffffffffffffda RBX: 00007f5af1815fa0 RCX: 00007f5af159c629 [ 870.819274][T14328] RDX: 0000200000000180 RSI: 0000000080045301 RDI: 0000000000000003 [ 870.819284][T14328] RBP: 00007f5af24be090 R08: 0000000000000000 R09: 0000000000000000 [ 870.819294][T14328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 870.819303][T14328] R13: 00007f5af1816038 R14: 00007f5af1815fa0 R15: 00007ffe78b76918 [ 870.819329][T14328] [ 870.819336][T14328] ERROR: Out of memory at tomoyo_realpath_from_path. [ 871.091814][ T5920] usb 8-1: USB disconnect, device number 2 [ 874.241397][ T29] audit: type=1326 audit(1771947423.324:1069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 874.372727][ T29] audit: type=1326 audit(1771947423.324:1070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 874.793132][ T29] audit: type=1326 audit(1771947423.324:1071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 874.916403][ T29] audit: type=1326 audit(1771947423.324:1072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 875.015995][ T29] audit: type=1326 audit(1771947423.324:1073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 875.096575][ T29] audit: type=1326 audit(1771947423.324:1074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 875.293812][ T29] audit: type=1326 audit(1771947423.324:1075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 875.343795][ T29] audit: type=1326 audit(1771947423.324:1076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 875.429582][T14410] No such timeout policy "syz0" [ 876.377305][ T29] audit: type=1326 audit(1771947423.324:1077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 876.810896][ T5920] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 877.086427][ T29] audit: type=1326 audit(1771947423.324:1078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14386 comm="syz.1.2084" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd3a7d9c629 code=0x7ffc0000 [ 877.353914][ T5920] usb 3-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 877.403077][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.427194][ T5920] usb 3-1: Product: syz [ 877.435775][ T5920] usb 3-1: Manufacturer: syz [ 878.508201][ T5920] usb 3-1: SerialNumber: syz [ 878.549048][ T5920] usb 3-1: config 0 descriptor?? [ 878.688026][ T5920] usb 3-1: can't set config #0, error -71 [ 878.725880][ T5920] usb 3-1: USB disconnect, device number 73 [ 881.165439][ T979] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 881.230932][ T29] kauditd_printk_skb: 42 callbacks suppressed [ 881.230948][ T29] audit: type=1400 audit(1771947430.344:1121): avc: denied { create } for pid=14435 comm="syz.2.2099" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 881.258460][T14439] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2099'. [ 881.269021][T14439] openvswitch: netlink: IP tunnel dst address not specified [ 881.343784][ T979] usb 2-1: Using ep0 maxpacket: 8 [ 881.350340][ T979] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 881.382679][ T979] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 881.402798][ T979] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 881.423162][ T979] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 881.445130][ T979] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 881.473828][ T979] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 881.504097][ T979] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.840686][ T979] usb 2-1: GET_CAPABILITIES returned 0 [ 881.864301][ T979] usbtmc 2-1:16.0: can't read capabilities [ 882.067778][ T29] audit: type=1400 audit(1771947431.184:1122): avc: denied { read } for pid=14431 comm="syz.1.2098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 882.757437][ T29] audit: type=1400 audit(1771947431.874:1123): avc: denied { sqpoll } for pid=14440 comm="syz.7.2094" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 883.540038][T14482] macsec1: entered promiscuous mode [ 883.545285][T14482] macsec1: entered allmulticast mode [ 883.669771][T14485] No such timeout policy "syz0" [ 884.070787][ T979] usb 2-1: USB disconnect, device number 69 [ 885.896413][T14495] IPv6: NLM_F_CREATE should be specified when creating new route [ 885.956864][T14495] FAULT_INJECTION: forcing a failure. [ 885.956864][T14495] name failslab, interval 1, probability 0, space 0, times 0 [ 885.961413][T14498] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2114'. [ 886.006039][T14495] CPU: 1 UID: 0 PID: 14495 Comm: syz.2.2113 Tainted: G L syzkaller #0 PREEMPT(full) [ 886.006070][T14495] Tainted: [L]=SOFTLOCKUP [ 886.006077][T14495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 886.006087][T14495] Call Trace: [ 886.006094][T14495] [ 886.006101][T14495] dump_stack_lvl+0x100/0x190 [ 886.006136][T14495] should_fail_ex.cold+0x5/0xa [ 886.006159][T14495] should_failslab+0xc2/0x120 [ 886.006187][T14495] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 886.006212][T14495] ? __alloc_skb+0x140/0x710 [ 886.006244][T14495] __alloc_skb+0x140/0x710 [ 886.006268][T14495] ? __alloc_skb+0x5b7/0x710 [ 886.006294][T14495] ? __pfx___alloc_skb+0x10/0x10 [ 886.006328][T14495] netlink_ack+0x117/0xb80 [ 886.006356][T14495] netlink_rcv_skb+0x333/0x420 [ 886.006376][T14495] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 886.006397][T14495] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 886.006426][T14495] ? netlink_deliver_tap+0x1ae/0xcc0 [ 886.006449][T14495] netlink_unicast+0x5aa/0x870 [ 886.006472][T14495] ? __pfx_netlink_unicast+0x10/0x10 [ 886.006501][T14495] netlink_sendmsg+0x8b0/0xda0 [ 886.006524][T14495] ? __pfx_netlink_sendmsg+0x10/0x10 [ 886.006540][T14495] ? __might_fault+0x20/0x140 [ 886.006569][T14495] ____sys_sendmsg+0xa54/0xc30 [ 886.006593][T14495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 886.006623][T14495] ___sys_sendmsg+0x190/0x1e0 [ 886.006649][T14495] ? __pfx____sys_sendmsg+0x10/0x10 [ 886.006700][T14495] __sys_sendmsg+0x170/0x220 [ 886.006719][T14495] ? __pfx___sys_sendmsg+0x10/0x10 [ 886.006752][T14495] do_syscall_64+0x106/0xf80 [ 886.006770][T14495] ? clear_bhb_loop+0x40/0x90 [ 886.006793][T14495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.006811][T14495] RIP: 0033:0x7f80b219c629 [ 886.006827][T14495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 886.006851][T14495] RSP: 002b:00007f80b313d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 886.006870][T14495] RAX: ffffffffffffffda RBX: 00007f80b2415fa0 RCX: 00007f80b219c629 [ 886.006882][T14495] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 886.006892][T14495] RBP: 00007f80b313d090 R08: 0000000000000000 R09: 0000000000000000 [ 886.006903][T14495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 886.006912][T14495] R13: 00007f80b2416038 R14: 00007f80b2415fa0 R15: 00007fff04f31ab8 [ 886.006937][T14495] [ 887.285424][ T29] audit: type=1400 audit(1771947436.374:1124): avc: denied { bind } for pid=14499 comm="syz.4.2115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 887.356419][ T29] audit: type=1400 audit(1771947436.374:1125): avc: denied { read write } for pid=14499 comm="syz.4.2115" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 887.430560][ T29] audit: type=1400 audit(1771947436.374:1126): avc: denied { open } for pid=14499 comm="syz.4.2115" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 887.563796][ T979] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 887.613854][ T2699] block nbd0: Possible stuck request ffff888027660000: control (read@0,1024B). Runtime 120 seconds [ 887.626374][ T2699] block nbd0: Possible stuck request ffff888027660200: control (read@1024,1024B). Runtime 120 seconds [ 887.637975][ T2699] block nbd0: Possible stuck request ffff888027660400: control (read@2048,1024B). Runtime 120 seconds [ 887.652029][ T2699] block nbd0: Possible stuck request ffff888027660600: control (read@3072,1024B). Runtime 120 seconds [ 887.733780][ T979] usb 5-1: Using ep0 maxpacket: 16 [ 887.864576][ T979] usb 5-1: config 0 has an invalid interface number: 214 but max is 0 [ 887.952542][T14515] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 887.976316][T14515] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2120'. [ 888.006810][T14515] geneve2: entered promiscuous mode [ 888.012157][T14515] geneve2: entered allmulticast mode [ 888.242615][ T29] audit: type=1400 audit(1771947437.054:1127): avc: denied { create } for pid=14510 comm="syz.2.2120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 888.292646][ T979] usb 5-1: config 0 has no interface number 0 [ 888.305412][ T979] usb 5-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 888.317003][ T29] audit: type=1400 audit(1771947437.084:1128): avc: denied { write } for pid=14510 comm="syz.2.2120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 888.378412][ T979] usb 5-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 888.391152][ T979] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.402055][ T979] usb 5-1: Product: syz [ 888.410188][ T979] usb 5-1: Manufacturer: syz [ 888.415160][ T979] usb 5-1: SerialNumber: syz [ 888.446421][ T979] usb 5-1: config 0 descriptor?? [ 891.958708][ T29] audit: type=1400 audit(1771947441.034:1129): avc: denied { mount } for pid=14541 comm="syz.1.2127" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 892.258526][ T29] audit: type=1400 audit(1771947441.044:1130): avc: denied { mounton } for pid=14541 comm="syz.1.2127" path="/428/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 893.623802][ T979] usbtouchscreen 5-1:0.214: Failed to read FW rev: -110 [ 893.630855][ T979] usbtouchscreen 5-1:0.214: probe with driver usbtouchscreen failed with error -110 [ 893.883983][ T29] audit: type=1400 audit(1771947441.054:1131): avc: denied { mount } for pid=14541 comm="syz.1.2127" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 894.003941][ T29] audit: type=1400 audit(1771947442.724:1132): avc: denied { unmount } for pid=5807 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 894.515907][ T29] audit: type=1400 audit(1771947442.764:1133): avc: denied { unmount } for pid=5807 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 894.547780][ T29] audit: type=1400 audit(1771947443.204:1134): avc: denied { wake_alarm } for pid=14551 comm="syz.6.2130" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 894.597156][ T979] usb 5-1: USB disconnect, device number 68 [ 895.573807][ T5943] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 895.784054][ T5943] usb 2-1: Using ep0 maxpacket: 32 [ 895.789572][ T29] audit: type=1400 audit(1771947444.904:1135): avc: denied { create } for pid=14572 comm="syz.4.2136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 895.824992][ T5943] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 895.844456][ T5943] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 895.865298][ T5943] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.884848][ T10] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 895.884891][ T5943] usb 2-1: config 0 descriptor?? [ 895.917299][ T5943] hub 2-1:0.0: USB hub found [ 895.922540][ T29] audit: type=1400 audit(1771947445.034:1136): avc: denied { mount } for pid=14575 comm="syz.2.2124" name="/" dev="ramfs" ino=57367 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 895.962596][ T29] audit: type=1400 audit(1771947445.074:1137): avc: denied { create } for pid=14575 comm="syz.2.2124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 896.130541][ T5943] hub 2-1:0.0: 1 port detected [ 896.161436][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 896.364838][ T10] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 896.387986][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 896.433821][ T10] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 896.462433][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 896.487521][ T10] usb 7-1: Product: syz [ 896.511332][ T10] usb 7-1: Manufacturer: syz [ 896.516195][ T10] usb 7-1: SerialNumber: syz [ 896.549182][ T5943] usb 2-1: USB disconnect, device number 70 [ 896.744703][ T10] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 896.766544][ T29] audit: type=1400 audit(1771947445.884:1138): avc: denied { unmount } for pid=5806 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 897.083994][ T10] usb 7-1: USB disconnect, device number 27 [ 897.196869][ T10] usblp0: removed [ 898.003851][ T29] audit: type=1400 audit(1771947446.494:1139): avc: denied { create } for pid=14584 comm="syz.2.2138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 898.069556][ T29] audit: type=1400 audit(1771947446.494:1140): avc: denied { setopt } for pid=14584 comm="syz.2.2138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 898.112954][T11000] Bluetooth: hci3: command 0x0406 tx timeout [ 900.433844][ T29] audit: type=1400 audit(1771947449.534:1141): avc: denied { setopt } for pid=14620 comm="syz.6.2146" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 900.813901][ T29] audit: type=1400 audit(1771947449.794:1142): avc: denied { read } for pid=14617 comm="syz.4.2148" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 901.036465][ T29] audit: type=1400 audit(1771947449.794:1143): avc: denied { open } for pid=14617 comm="syz.4.2148" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 901.094368][ T29] audit: type=1400 audit(1771947449.814:1144): avc: denied { ioctl } for pid=14617 comm="syz.4.2148" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 901.150676][ T29] audit: type=1400 audit(1771947449.824:1145): avc: denied { map } for pid=14617 comm="syz.4.2148" path="socket:[57466]" dev="sockfs" ino=57466 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 901.177736][ T29] audit: type=1400 audit(1771947449.824:1146): avc: denied { read } for pid=14617 comm="syz.4.2148" path="socket:[57466]" dev="sockfs" ino=57466 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 901.489399][ T29] audit: type=1400 audit(1771947450.584:1147): avc: denied { read } for pid=14624 comm="syz.6.2150" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 901.574620][ T29] audit: type=1400 audit(1771947450.584:1148): avc: denied { open } for pid=14624 comm="syz.6.2150" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 901.638089][ T29] audit: type=1400 audit(1771947450.584:1149): avc: denied { ioctl } for pid=14624 comm="syz.6.2150" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 901.758510][ T29] audit: type=1400 audit(1771947450.874:1150): avc: denied { set_context_mgr } for pid=14632 comm="syz.4.2153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 902.810005][T14644] FAULT_INJECTION: forcing a failure. [ 902.810005][T14644] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 902.826301][T14644] CPU: 0 UID: 0 PID: 14644 Comm: syz.1.2155 Tainted: G L syzkaller #0 PREEMPT(full) [ 902.826331][T14644] Tainted: [L]=SOFTLOCKUP [ 902.826338][T14644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 902.826348][T14644] Call Trace: [ 902.826355][T14644] [ 902.826362][T14644] dump_stack_lvl+0x100/0x190 [ 902.826396][T14644] should_fail_ex.cold+0x5/0xa [ 902.826420][T14644] _copy_from_user+0x2e/0xd0 [ 902.826447][T14644] kstrtouint_from_user+0xd6/0x1d0 [ 902.826466][T14644] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 902.826484][T14644] ? __lock_acquire+0x4a5/0x2630 [ 902.826522][T14644] ? lock_acquire+0x1cf/0x380 [ 902.826556][T14644] proc_fail_nth_write+0x83/0x220 [ 902.826580][T14644] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 902.826610][T14644] vfs_write+0x2aa/0x1070 [ 902.826638][T14644] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 902.826665][T14644] ? __pfx_vfs_write+0x10/0x10 [ 902.826690][T14644] ? __fget_files+0x215/0x3d0 [ 902.826714][T14644] ? __fget_files+0x21f/0x3d0 [ 902.826739][T14644] ksys_write+0x12a/0x250 [ 902.826764][T14644] ? __pfx_ksys_write+0x10/0x10 [ 902.826797][T14644] do_syscall_64+0x106/0xf80 [ 902.826816][T14644] ? clear_bhb_loop+0x40/0x90 [ 902.826838][T14644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.826857][T14644] RIP: 0033:0x7fd3a7d5cece [ 902.826874][T14644] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 902.826891][T14644] RSP: 002b:00007fd3a8c36fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 902.826909][T14644] RAX: ffffffffffffffda RBX: 00007fd3a8c376c0 RCX: 00007fd3a7d5cece [ 902.826921][T14644] RDX: 0000000000000001 RSI: 00007fd3a8c370a0 RDI: 0000000000000004 [ 902.826932][T14644] RBP: 00007fd3a8c37090 R08: 0000000000000000 R09: 0000000000000000 [ 902.826943][T14644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 902.826953][T14644] R13: 00007fd3a8016038 R14: 00007fd3a8015fa0 R15: 00007ffee650fb98 [ 902.826979][T14644] [ 903.275976][T14650] FAULT_INJECTION: forcing a failure. [ 903.275976][T14650] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 903.314423][T14650] CPU: 0 UID: 0 PID: 14650 Comm: syz.6.2156 Tainted: G L syzkaller #0 PREEMPT(full) [ 903.314452][T14650] Tainted: [L]=SOFTLOCKUP [ 903.314458][T14650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 903.314469][T14650] Call Trace: [ 903.314475][T14650] [ 903.314482][T14650] dump_stack_lvl+0x100/0x190 [ 903.314515][T14650] should_fail_ex.cold+0x5/0xa [ 903.314539][T14650] _copy_from_user+0x2e/0xd0 [ 903.314565][T14650] csum_and_copy_from_iter_full+0x21a/0x1fd0 [ 903.314606][T14650] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 903.314632][T14650] ? __pfx_csum_and_copy_from_iter_full+0x10/0x10 [ 903.314656][T14650] ? policy_nodemask+0xed/0x4f0 [ 903.314686][T14650] ? alloc_pages_mpol+0x25a/0x550 [ 903.314718][T14650] ip_generic_getfrag+0x172/0x270 [ 903.314736][T14650] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 903.314755][T14650] ? alloc_pages_noprof+0x233/0x390 [ 903.314786][T14650] raw6_getfrag+0x235/0x2a0 [ 903.314809][T14650] __ip6_append_data+0x2ae8/0x4de0 [ 903.314838][T14650] ? __pfx_raw6_getfrag+0x10/0x10 [ 903.314865][T14650] ? __pfx___ip6_append_data+0x10/0x10 [ 903.314889][T14650] ? __pfx_ip6_mtu+0x10/0x10 [ 903.314905][T14650] ? ip6_setup_cork+0x5be/0x14c0 [ 903.314930][T14650] ip6_append_data+0x10b/0x410 [ 903.314952][T14650] ? __pfx_raw6_getfrag+0x10/0x10 [ 903.314973][T14650] rawv6_sendmsg+0x16a0/0x4750 [ 903.315004][T14650] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 903.315023][T14650] ? avc_has_perm_noaudit+0x145/0x3b0 [ 903.315052][T14650] ? avc_has_perm+0x135/0x1e0 [ 903.315076][T14650] ? __pfx_avc_has_perm+0x10/0x10 [ 903.315101][T14650] ? is_bpf_text_address+0x94/0x1a0 [ 903.315144][T14650] ? __might_fault+0x20/0x140 [ 903.315166][T14650] ? __might_fault+0xc5/0x140 [ 903.315188][T14650] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 903.315209][T14650] ? inet_sendmsg+0x11c/0x140 [ 903.315231][T14650] inet_sendmsg+0x11c/0x140 [ 903.315255][T14650] ____sys_sendmsg+0x9ad/0xc30 [ 903.315281][T14650] ? __pfx_____sys_sendmsg+0x10/0x10 [ 903.315315][T14650] ___sys_sendmsg+0x190/0x1e0 [ 903.315340][T14650] ? __pfx____sys_sendmsg+0x10/0x10 [ 903.315395][T14650] __sys_sendmsg+0x170/0x220 [ 903.315411][T14650] ? __pfx___sys_sendmsg+0x10/0x10 [ 903.315442][T14650] do_syscall_64+0x106/0xf80 [ 903.315458][T14650] ? clear_bhb_loop+0x40/0x90 [ 903.315479][T14650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.315497][T14650] RIP: 0033:0x7f318d19c629 [ 903.315512][T14650] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 903.315528][T14650] RSP: 002b:00007f318b3ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 903.315544][T14650] RAX: ffffffffffffffda RBX: 00007f318d415fa0 RCX: 00007f318d19c629 [ 903.315555][T14650] RDX: 0000000000044004 RSI: 00002000000000c0 RDI: 0000000000000003 [ 903.315566][T14650] RBP: 00007f318b3ee090 R08: 0000000000000000 R09: 0000000000000000 [ 903.315577][T14650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 903.315593][T14650] R13: 00007f318d416038 R14: 00007f318d415fa0 R15: 00007ffef7f963b8 [ 903.315617][T14650] [ 903.806227][ T10] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 903.978493][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 904.007590][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 904.019931][ T10] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 904.029943][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.043567][ T10] usb 5-1: config 0 descriptor?? [ 904.135516][ T979] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 904.155152][T14661] netlink: 'syz.1.2160': attribute type 1 has an invalid length. [ 904.231189][T14661] 8021q: adding VLAN 0 to HW filter on device bond1 [ 905.193469][ T979] usb 3-1: Using ep0 maxpacket: 32 [ 905.357276][ T979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 905.424020][T14681] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2163'. [ 905.434662][T14681] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2163'. [ 905.482727][ T979] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 905.511154][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.535717][ T979] usb 3-1: config 0 descriptor?? [ 905.777199][ T10] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 905.798856][ T979] hub 3-1:0.0: USB hub found [ 906.671420][ T10] usb 5-1: USB disconnect, device number 69 [ 909.113941][ T10] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 909.365537][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 909.386712][ T10] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 909.415781][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 909.466279][ T10] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 909.476040][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.498157][ T10] usb 7-1: Product: syz [ 909.515267][ T10] usb 7-1: Manufacturer: syz [ 909.541636][ T10] usb 7-1: SerialNumber: syz [ 909.601419][ T10] hub 7-1:1.0: bad descriptor, ignoring hub [ 909.608259][ T10] hub 7-1:1.0: probe with driver hub failed with error -5 [ 909.627593][ T979] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 909.688108][ T979] usbhid 3-1:0.0: can't add hid device: -71 [ 909.723946][ T979] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 909.777898][ T979] usb 3-1: USB disconnect, device number 74 [ 909.807845][ T10] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 28 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 910.114596][ T979] usb 7-1: USB disconnect, device number 28 [ 910.473216][ T979] usblp0: removed [ 910.539461][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 910.539473][ T29] audit: type=1400 audit(1771947459.654:1162): avc: denied { create } for pid=14705 comm="syz.4.2168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 910.736702][ T29] audit: type=1400 audit(1771947459.854:1163): avc: denied { read } for pid=14713 comm="syz.7.2169" name="sg0" dev="devtmpfs" ino=817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 910.809268][ T29] audit: type=1400 audit(1771947459.854:1164): avc: denied { open } for pid=14713 comm="syz.7.2169" path="/dev/sg0" dev="devtmpfs" ino=817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 910.813773][ T979] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 911.145486][ T29] audit: type=1400 audit(1771947459.854:1165): avc: denied { read write } for pid=14713 comm="syz.7.2169" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 911.176635][ T29] audit: type=1400 audit(1771947459.854:1166): avc: denied { open } for pid=14713 comm="syz.7.2169" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 911.239637][ T29] audit: type=1400 audit(1771947460.154:1167): avc: denied { getopt } for pid=14713 comm="syz.7.2169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 911.243853][ T979] usb 7-1: device descriptor read/64, error -71 [ 911.259824][ T29] audit: type=1400 audit(1771947460.254:1168): avc: denied { create } for pid=14721 comm="syz.4.2175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 911.288506][ T29] audit: type=1400 audit(1771947460.254:1169): avc: denied { write } for pid=14721 comm="syz.4.2175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 911.393839][ T50] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 911.565503][ T979] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 911.601250][T14728] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 911.669110][ T50] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 911.693152][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.876232][ T50] usb 5-1: Product: syz [ 911.893439][ T50] usb 5-1: Manufacturer: syz [ 911.898828][ T50] usb 5-1: SerialNumber: syz [ 912.680925][ T50] usb 5-1: config 0 descriptor?? [ 912.743775][ T5943] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 913.666556][T11000] Bluetooth: hci6: command 0x1003 tx timeout [ 913.666647][ T5821] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 913.692712][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 914.015694][ T50] dvb_usb_rtl28xxu 5-1:0.0: chip type detection failed -71 [ 914.047796][ T5943] usb 2-1: device descriptor read/64, error -32 [ 914.063901][ T50] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 914.878311][ T50] usb 5-1: USB disconnect, device number 70 [ 915.114549][T14748] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 915.439220][ T5943] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 915.700992][T14752] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2182'. [ 915.711070][T14752] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2182'. [ 915.957984][T14759] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2183'. [ 915.968746][T14759] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2183'. [ 916.024166][ T29] audit: type=1400 audit(1771947465.124:1170): avc: denied { read write } for pid=14755 comm="syz.2.2184" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 916.443365][ T29] audit: type=1400 audit(1771947465.124:1171): avc: denied { open } for pid=14755 comm="syz.2.2184" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 916.691838][ T29] audit: type=1400 audit(1771947465.804:1172): avc: denied { mounton } for pid=14755 comm="syz.2.2184" path="/syzcgroup/unified/syz2" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 917.684671][ T2699] block nbd0: Possible stuck request ffff888027660000: control (read@0,1024B). Runtime 150 seconds [ 917.695932][ T2699] block nbd0: Possible stuck request ffff888027660200: control (read@1024,1024B). Runtime 150 seconds [ 917.707272][ T2699] block nbd0: Possible stuck request ffff888027660400: control (read@2048,1024B). Runtime 150 seconds [ 917.719541][ T2699] block nbd0: Possible stuck request ffff888027660600: control (read@3072,1024B). Runtime 150 seconds [ 918.991572][T14791] FAULT_INJECTION: forcing a failure. [ 918.991572][T14791] name failslab, interval 1, probability 0, space 0, times 0 [ 919.134072][T14791] CPU: 1 UID: 0 PID: 14791 Comm: syz.4.2188 Tainted: G L syzkaller #0 PREEMPT(full) [ 919.134104][T14791] Tainted: [L]=SOFTLOCKUP [ 919.134111][T14791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 919.134122][T14791] Call Trace: [ 919.134128][T14791] [ 919.134136][T14791] dump_stack_lvl+0x100/0x190 [ 919.134171][T14791] should_fail_ex.cold+0x5/0xa [ 919.134195][T14791] should_failslab+0xc2/0x120 [ 919.134222][T14791] __kmalloc_cache_noprof+0x7a/0x6f0 [ 919.134243][T14791] ? v4l2_ctrls_find_req_obj+0x11c/0x2b0 [ 919.134268][T14791] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 919.134302][T14791] v4l2_ctrls_find_req_obj+0x11c/0x2b0 [ 919.134330][T14791] try_set_ext_ctrls_request+0x16d/0x6c0 [ 919.134361][T14791] try_set_ext_ctrls+0x11b/0x140 [ 919.134392][T14791] v4l_s_ext_ctrls+0x268/0x2f0 [ 919.134421][T14791] __video_do_ioctl+0xaf8/0xdc0 [ 919.134443][T14791] ? __might_fault+0xc5/0x140 [ 919.134465][T14791] ? __pfx___video_do_ioctl+0x10/0x10 [ 919.134493][T14791] video_usercopy+0x47a/0x1740 [ 919.134513][T14791] ? __pfx___video_do_ioctl+0x10/0x10 [ 919.134532][T14791] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 919.134555][T14791] ? __pfx_video_usercopy+0x10/0x10 [ 919.134590][T14791] v4l2_ioctl+0x1bd/0x250 [ 919.134609][T14791] ? __pfx_v4l2_ioctl+0x10/0x10 [ 919.134629][T14791] __x64_sys_ioctl+0x18e/0x210 [ 919.134657][T14791] do_syscall_64+0x106/0xf80 [ 919.134674][T14791] ? clear_bhb_loop+0x40/0x90 [ 919.134698][T14791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.134716][T14791] RIP: 0033:0x7fe087f9c629 [ 919.134732][T14791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 919.134749][T14791] RSP: 002b:00007fe088d8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 919.134772][T14791] RAX: ffffffffffffffda RBX: 00007fe088215fa0 RCX: 00007fe087f9c629 [ 919.134784][T14791] RDX: 0000200000000000 RSI: 00000000c0205648 RDI: 0000000000000005 [ 919.134795][T14791] RBP: 00007fe088d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 919.134805][T14791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.134816][T14791] R13: 00007fe088216038 R14: 00007fe088215fa0 R15: 00007fff38343088 [ 919.134842][T14791] [ 919.685552][T14799] No such timeout policy "syz0" [ 920.724239][ T50] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 920.913914][ T50] usb 5-1: Using ep0 maxpacket: 16 [ 920.946162][ T50] usb 5-1: unable to get BOS descriptor or descriptor too short [ 920.959470][ T29] audit: type=1400 audit(1771947470.074:1173): avc: denied { write } for pid=14806 comm="syz.1.2194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 920.999366][ T50] usb 5-1: config 7 has an invalid interface number: 48 but max is 0 [ 921.033807][ T29] audit: type=1400 audit(1771947470.074:1174): avc: denied { read } for pid=14806 comm="syz.1.2194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 921.036515][ T50] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 921.068291][ T50] usb 5-1: config 7 has no interface number 0 [ 921.091488][ T50] usb 5-1: config 7 interface 48 has no altsetting 0 [ 921.098838][T14812] FAULT_INJECTION: forcing a failure. [ 921.098838][T14812] name failslab, interval 1, probability 0, space 0, times 0 [ 921.114784][T14812] CPU: 1 UID: 0 PID: 14812 Comm: syz.7.2195 Tainted: G L syzkaller #0 PREEMPT(full) [ 921.114812][T14812] Tainted: [L]=SOFTLOCKUP [ 921.114818][T14812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 921.114828][T14812] Call Trace: [ 921.114834][T14812] [ 921.114841][T14812] dump_stack_lvl+0x100/0x190 [ 921.114874][T14812] should_fail_ex.cold+0x5/0xa [ 921.114891][T14812] should_failslab+0xc2/0x120 [ 921.114908][T14812] __kmalloc_cache_noprof+0x7a/0x6f0 [ 921.114921][T14812] ? sctp_association_new+0xbb/0x2990 [ 921.114938][T14812] sctp_association_new+0xbb/0x2990 [ 921.114954][T14812] sctp_connect_new_asoc+0x1a8/0x770 [ 921.114970][T14812] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 921.114984][T14812] ? selinux_sctp_bind_connect+0x112/0x2a0 [ 921.115007][T14812] sctp_sendmsg+0x171a/0x22b0 [ 921.115024][T14812] ? __pfx_sctp_sendmsg+0x10/0x10 [ 921.115040][T14812] ? __pfx_sock_has_perm+0x10/0x10 [ 921.115064][T14812] ? __pfx_sctp_sendmsg+0x10/0x10 [ 921.115078][T14812] inet_sendmsg+0x11c/0x140 [ 921.115093][T14812] __sys_sendto+0x467/0x520 [ 921.115110][T14812] ? __pfx___sys_sendto+0x10/0x10 [ 921.115138][T14812] ? ksys_write+0x1ac/0x250 [ 921.115153][T14812] ? __pfx_ksys_write+0x10/0x10 [ 921.115170][T14812] __x64_sys_sendto+0xe0/0x1c0 [ 921.115186][T14812] ? do_syscall_64+0x95/0xf80 [ 921.115196][T14812] ? lockdep_hardirqs_on+0x78/0x100 [ 921.115207][T14812] do_syscall_64+0x106/0xf80 [ 921.115217][T14812] ? clear_bhb_loop+0x40/0x90 [ 921.115230][T14812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 921.115241][T14812] RIP: 0033:0x7f5af159c629 [ 921.115251][T14812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 921.115262][T14812] RSP: 002b:00007f5af24be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 921.115273][T14812] RAX: ffffffffffffffda RBX: 00007f5af1815fa0 RCX: 00007f5af159c629 [ 921.115279][T14812] RDX: 0000000000034000 RSI: 0000200000000180 RDI: 0000000000000003 [ 921.115286][T14812] RBP: 00007f5af24be090 R08: 0000200000000040 R09: 000000000000001c [ 921.115292][T14812] R10: 0000000000044004 R11: 0000000000000246 R12: 0000000000000001 [ 921.115299][T14812] R13: 00007f5af1816038 R14: 00007f5af1815fa0 R15: 00007ffe78b76918 [ 921.115312][T14812] [ 921.380294][T14818] netlink: 'syz.1.2196': attribute type 83 has an invalid length. [ 921.394716][T13712] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 921.415540][ T50] usb 5-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=56.2c [ 921.424732][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.432781][ T50] usb 5-1: Product: syz [ 921.436970][ T50] usb 5-1: Manufacturer: syz [ 921.441536][ T50] usb 5-1: SerialNumber: syz [ 921.645319][T13712] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 921.655360][T13712] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 921.659995][T14797] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 921.665552][T13712] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 921.672628][T14797] IPv6: NLM_F_CREATE should be set when creating new route [ 921.687575][T13712] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 922.984222][ T29] audit: type=1400 audit(1771947471.084:1175): avc: denied { read } for pid=14822 comm="syz.7.2199" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 923.217204][ T29] audit: type=1400 audit(1771947471.084:1176): avc: denied { open } for pid=14822 comm="syz.7.2199" path="/dev/rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 923.252634][ T29] audit: type=1400 audit(1771947471.084:1177): avc: denied { watch_mount watch_reads } for pid=14822 comm="syz.7.2199" path="/56" dev="tmpfs" ino=316 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 923.261222][T13712] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 923.325143][ T50] cdc_phonet 5-1:7.48: probe with driver cdc_phonet failed with error -22 [ 923.363478][T13712] usb 7-1: Product: syz [ 923.368686][T13712] usb 7-1: Manufacturer: syz [ 923.373291][T13712] usb 7-1: SerialNumber: syz [ 923.457790][ T50] usb 5-1: USB disconnect, device number 71 [ 924.328558][T13712] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 31 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 924.371981][T13712] usb 7-1: USB disconnect, device number 31 [ 924.399118][T13712] usblp0: removed [ 925.375527][ T29] audit: type=1400 audit(1771947474.494:1178): avc: denied { create } for pid=14843 comm="syz.6.2205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 926.296302][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 926.302636][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 926.693833][ T29] audit: type=1400 audit(1771947475.784:1179): avc: denied { write } for pid=14862 comm="syz.6.2211" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 927.324815][T14868] overlayfs: overlapping lowerdir path [ 927.680673][ T29] audit: type=1400 audit(1771947476.794:1180): avc: denied { ioctl } for pid=14876 comm="syz.7.2214" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 928.104396][T13712] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 928.325551][T13712] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 928.357401][T13712] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 928.386130][T13712] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 928.424424][T13712] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 928.435646][T13712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 928.464056][T13712] usb 2-1: Product: syz [ 928.473465][T13712] usb 2-1: Manufacturer: syz [ 928.500330][T13712] usb 2-1: SerialNumber: syz [ 928.729648][T14893] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2210'. [ 928.760815][T13712] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 73 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 928.775822][ T29] audit: type=1400 audit(1771947477.874:1181): avc: denied { read write } for pid=14892 comm="syz.2.2210" name="usbmon9" dev="devtmpfs" ino=743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 928.814178][ T29] audit: type=1400 audit(1771947477.874:1182): avc: denied { open } for pid=14892 comm="syz.2.2210" path="/dev/usbmon9" dev="devtmpfs" ino=743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 928.844813][ T29] audit: type=1400 audit(1771947477.894:1183): avc: denied { ioctl } for pid=14892 comm="syz.2.2210" path="/dev/usbmon9" dev="devtmpfs" ino=743 ioctlcmd=0x9201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 928.872561][ T29] audit: type=1400 audit(1771947477.894:1184): avc: denied { relabelfrom } for pid=14892 comm="syz.2.2210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 928.872972][T14893] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2210'. [ 928.896222][ T29] audit: type=1400 audit(1771947477.894:1185): avc: denied { relabelto } for pid=14892 comm="syz.2.2210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 928.926277][ T29] audit: type=1400 audit(1771947477.994:1186): avc: denied { attach_queue } for pid=14892 comm="syz.2.2210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 929.800399][ T5943] usb 2-1: USB disconnect, device number 73 [ 929.816923][ T5943] usblp0: removed [ 929.824101][ T29] audit: type=1400 audit(1771947478.044:1187): avc: denied { accept } for pid=14897 comm="syz.6.2221" lport=54718 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 929.902739][ T29] audit: type=1400 audit(1771947478.914:1188): avc: denied { read write } for pid=14880 comm="syz.1.2216" name="lp0" dev="devtmpfs" ino=3810 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 931.967823][T14922] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 932.908386][T14929] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 934.941649][ T30] INFO: task syz.0.1838:13430 blocked for more than 145 seconds. [ 934.978575][ T30] Tainted: G L syzkaller #0 [ 935.045637][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 935.063748][ T30] task:syz.0.1838 state:D stack:26392 pid:13430 tgid:13429 ppid:12732 task_flags:0x400140 flags:0x00080002 [ 935.094690][ T30] Call Trace: [ 935.104613][ T30] [ 935.118570][ T30] __schedule+0xfee/0x60e0 [ 935.127454][ T30] ? __lock_acquire+0x4a5/0x2630 [ 935.154734][ T30] ? __pfx___schedule+0x10/0x10 [ 935.187034][ T30] ? find_held_lock+0x2b/0x80 [ 935.214830][ T30] ? schedule+0x2bf/0x390 [ 935.254331][ T30] schedule+0xdd/0x390 [ 935.267446][T14942] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2225'. [ 935.306542][ T30] schedule_preempt_disabled+0x13/0x30 [ 935.318104][ T30] __mutex_lock+0xc9a/0x1b90 [ 935.334259][ T30] ? bdev_open+0xa2/0xe40 [ 935.339069][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 935.375923][ T30] ? bd_prepare_to_claim+0x1e0/0x280 [ 935.408567][ T30] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 935.425920][ T30] ? file_init_path+0x48e/0x670 [ 935.436308][ T30] ? bdev_open+0xa2/0xe40 [ 935.456374][ T30] bdev_open+0xa2/0xe40 [ 935.467186][ T30] ? iput+0x3a/0x40 [ 935.477652][ T30] bdev_file_open_by_dev+0x179/0x210 [ 935.495161][ T30] setup_bdev_super+0x385/0x730 [ 935.507700][ T30] get_tree_bdev_flags+0x363/0x620 [ 935.521613][ T30] ? __pfx_hpfs_fill_super+0x10/0x10 [ 935.533755][ T30] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 935.544438][ T979] usb 7-1: new full-speed USB device number 32 using dummy_hcd [ 935.553621][ T30] ? cap_capable+0x107/0x460 [ 935.566098][ T30] ? bpf_lsm_capable+0x9/0x10 [ 935.583946][ T30] ? security_capable+0x80/0x260 [ 935.600038][ T30] vfs_get_tree+0x92/0x320 [ 935.609160][ T30] path_mount+0x7d0/0x23d0 [ 935.621289][ T30] ? __pfx_path_mount+0x10/0x10 [ 935.632954][ T30] ? lockdep_hardirqs_on+0x78/0x100 [ 935.643708][ T30] ? putname+0xb1/0x110 [ 935.652710][ T30] ? kmem_cache_free+0x124/0x6a0 [ 935.664315][ T30] ? __x64_sys_mount+0x293/0x310 [ 935.673902][ T30] __x64_sys_mount+0x293/0x310 [ 935.684232][ T979] usb 7-1: device descriptor read/64, error -71 [ 935.696186][ T30] ? __pfx___x64_sys_mount+0x10/0x10 [ 935.711527][ T30] do_syscall_64+0x106/0xf80 [ 935.721815][ T30] ? clear_bhb_loop+0x40/0x90 [ 935.733748][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.746421][ T30] RIP: 0033:0x7f7d1699c629 [ 935.758119][ T30] RSP: 002b:00007f7d177e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 935.775915][ T30] RAX: ffffffffffffffda RBX: 00007f7d16c15fa0 RCX: 00007f7d1699c629 [ 935.793758][ T30] RDX: 00002000000004c0 RSI: 00002000000000c0 RDI: 0000200000000000 [ 935.810531][ T30] RBP: 00007f7d16a32b39 R08: 0000000000000000 R09: 0000000000000000 [ 935.827315][ T30] R10: 00000000000000c4 R11: 0000000000000246 R12: 0000000000000000 [ 935.844342][ T30] R13: 00007f7d16c16038 R14: 00007f7d16c15fa0 R15: 00007ffc78f37618 [ 935.862089][ T30] [ 935.868831][ T30] [ 935.868831][ T30] Showing all locks held in the system: [ 935.884674][ T30] 1 lock held by khungtaskd/30: [ 935.906976][ T30] #0: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 935.926995][ T30] 6 locks held by kworker/1:2/979: [ 935.937654][ T30] #0: ffff888020abc948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 935.943809][ T979] usb 7-1: new full-speed USB device number 33 using dummy_hcd [ 935.948927][ T30] #1: ffffc900040d7d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 935.968532][ T30] #2: ffff88802b201198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 935.979626][ T30] #3: ffff88802b212518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2bd2/0x4af0 [ 935.989859][ T30] #4: ffff88802b1b7f68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2bfb/0x4af0 [ 935.999875][ T30] #5: ffffffff8fbb0010 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a5/0x1c60 [ 936.011044][ T30] 2 locks held by getty/5565: [ 936.016003][ T30] #0: ffff8880384630a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 936.037100][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 936.056983][ T30] 1 lock held by udevd/5822: [ 936.061702][ T30] #0: ffff888027580358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 936.071861][ T30] 2 locks held by syz.0.1838/13430: [ 936.077444][ T30] #0: ffff88802e57c0e0 (&type->s_umount_key#90/1){+.+.}-{4:4}, at: alloc_super+0x244/0xd20 [ 936.077840][T14945] FAULT_INJECTION: forcing a failure. [ 936.077840][T14945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 936.088067][ T30] #1: ffff888027580358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 936.105662][ T979] usb 7-1: device descriptor read/64, error -71 [ 936.111047][ T30] 2 locks held by syz.7.2212/14869: [ 936.121737][T14945] CPU: 0 UID: 0 PID: 14945 Comm: syz.7.2222 Tainted: G L syzkaller #0 PREEMPT(full) [ 936.121763][T14945] Tainted: [L]=SOFTLOCKUP [ 936.121768][T14945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 936.121775][T14945] Call Trace: [ 936.121780][T14945] [ 936.121785][T14945] dump_stack_lvl+0x100/0x190 [ 936.121806][T14945] should_fail_ex.cold+0x5/0xa [ 936.121820][T14945] _copy_from_iter+0x1f4/0x1690 [ 936.121837][T14945] ? __asan_memset+0x23/0x50 [ 936.121851][T14945] ? __pfx__copy_from_iter+0x10/0x10 [ 936.121865][T14945] ? __pfx___alloc_skb+0x10/0x10 [ 936.121882][T14945] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 936.121906][T14945] netlink_sendmsg+0x808/0xda0 [ 936.121921][T14945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 936.121932][T14945] ? __might_fault+0x20/0x140 [ 936.121950][T14945] ____sys_sendmsg+0xa54/0xc30 [ 936.121965][T14945] ? __pfx_____sys_sendmsg+0x10/0x10 [ 936.121984][T14945] ___sys_sendmsg+0x190/0x1e0 [ 936.121999][T14945] ? __pfx____sys_sendmsg+0x10/0x10 [ 936.122028][T14945] __sys_sendmsg+0x170/0x220 [ 936.122039][T14945] ? __pfx___sys_sendmsg+0x10/0x10 [ 936.122058][T14945] do_syscall_64+0x106/0xf80 [ 936.122068][T14945] ? clear_bhb_loop+0x40/0x90 [ 936.122082][T14945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.122092][T14945] RIP: 0033:0x7f5af159c629 [ 936.122102][T14945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 936.122113][T14945] RSP: 002b:00007f5af24be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 936.122123][T14945] RAX: ffffffffffffffda RBX: 00007f5af1815fa0 RCX: 00007f5af159c629 [ 936.122130][T14945] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 936.122136][T14945] RBP: 00007f5af24be090 R08: 0000000000000000 R09: 0000000000000000 [ 936.122142][T14945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 936.122149][T14945] R13: 00007f5af1816038 R14: 00007f5af1815fa0 R15: 00007ffe78b76918 [ 936.122162][T14945] [ 936.123749][ T30] #0: [ 936.331520][ T979] usb usb7-port1: attempt power cycle [ 936.340438][ T30] ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 936.349034][ T30] #1: ffffffff8e7f4ff8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 936.359137][ T30] [ 936.362675][ T30] ============================================= [ 936.362675][ T30] [ 936.386304][ T30] NMI backtrace for cpu 1 [ 936.386324][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 936.386345][ T30] Tainted: [L]=SOFTLOCKUP [ 936.386351][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 936.386360][ T30] Call Trace: [ 936.386365][ T30] [ 936.386372][ T30] dump_stack_lvl+0x100/0x190 [ 936.386399][ T30] nmi_cpu_backtrace.cold+0x12d/0x151 [ 936.386416][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 936.386440][ T30] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 936.386462][ T30] sys_info+0x141/0x190 [ 936.386479][ T30] watchdog+0xd25/0x1050 [ 936.386504][ T30] ? __pfx_watchdog+0x10/0x10 [ 936.386524][ T30] ? __kthread_parkme+0x18c/0x230 [ 936.386549][ T30] ? kthread+0x13a/0x450 [ 936.386561][ T30] ? __pfx_watchdog+0x10/0x10 [ 936.386578][ T30] kthread+0x370/0x450 [ 936.386597][ T30] ? __pfx_kthread+0x10/0x10 [ 936.386611][ T30] ret_from_fork+0x754/0xd80 [ 936.386628][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 936.386645][ T30] ? __switch_to+0x7b4/0x1120 [ 936.386665][ T30] ? __pfx_kthread+0x10/0x10 [ 936.386681][ T30] ret_from_fork_asm+0x1a/0x30 [ 936.386709][ T30] [ 936.386717][ T30] Sending NMI from CPU 1 to CPUs 0: [ 936.513187][ C0] NMI backtrace for cpu 0 [ 936.513204][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 936.513223][ C0] Tainted: [L]=SOFTLOCKUP [ 936.513228][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 936.513237][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 936.513262][ C0] Code: d8 82 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 0c 1c 00 fb f4 bc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 936.513276][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000246 [ 936.513288][ C0] RAX: 0000000004505ba5 RBX: ffffffff8e4975c0 RCX: ffffffff8b8f7c75 [ 936.513297][ C0] RDX: 0000000000000000 RSI: ffffffff8de71ed4 RDI: ffffffff8c1aefa0 [ 936.513307][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1017086795 [ 936.513315][ C0] R10: ffff8880b8433cab R11: 0000000000000000 R12: fffffbfff1c92eb8 [ 936.513324][ C0] R13: 0000000000000000 R14: ffffffff90d96410 R15: 0000000000000000 [ 936.513338][ C0] FS: 0000000000000000(0000) GS:ffff88812434a000(0000) knlGS:0000000000000000 [ 936.513352][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 936.513361][ C0] CR2: 00007f5af17e6158 CR3: 000000007dd93000 CR4: 00000000003526f0 [ 936.513371][ C0] Call Trace: [ 936.513376][ C0] [ 936.513382][ C0] default_idle+0x9/0x10 [ 936.513396][ C0] default_idle_call+0x6c/0xb0 [ 936.513411][ C0] do_idle+0x35b/0x4b0 [ 936.513430][ C0] ? __pfx_do_idle+0x10/0x10 [ 936.513448][ C0] cpu_startup_entry+0x4f/0x60 [ 936.513464][ C0] rest_init+0x251/0x260 [ 936.513480][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 936.513500][ C0] start_kernel+0x47f/0x480 [ 936.513517][ C0] x86_64_start_reservations+0x24/0x30 [ 936.513534][ C0] x86_64_start_kernel+0x12b/0x130 [ 936.513551][ C0] common_startup_64+0x13e/0x148 [ 936.513573][ C0] [ 936.516331][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 936.516348][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 936.516370][ T30] Tainted: [L]=SOFTLOCKUP [ 936.516376][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 936.516385][ T30] Call Trace: [ 936.516391][ T30] [ 936.516398][ T30] dump_stack_lvl+0x100/0x190 [ 936.516427][ T30] vpanic+0x552/0x970 [ 936.516443][ T30] ? __pfx_vpanic+0x10/0x10 [ 936.516460][ T30] ? rcu_is_watching+0x12/0xc0 [ 936.516482][ T30] panic+0xd1/0xe0 [ 936.516497][ T30] ? __pfx_panic+0x10/0x10 [ 936.516514][ T30] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 936.516535][ T30] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 936.516556][ T30] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 936.516576][ T30] ? watchdog.cold+0x198/0x1ca [ 936.516598][ T30] ? watchdog+0xd35/0x1050 [ 936.516621][ T30] watchdog.cold+0x1a9/0x1ca [ 936.516644][ T30] ? __pfx_watchdog+0x10/0x10 [ 936.516665][ T30] ? __kthread_parkme+0x18c/0x230 [ 936.516689][ T30] ? kthread+0x13a/0x450 [ 936.516703][ T30] ? __pfx_watchdog+0x10/0x10 [ 936.516721][ T30] kthread+0x370/0x450 [ 936.516736][ T30] ? __pfx_kthread+0x10/0x10 [ 936.516752][ T30] ret_from_fork+0x754/0xd80 [ 936.516768][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 936.516786][ T30] ? __switch_to+0x7b4/0x1120 [ 936.516805][ T30] ? __pfx_kthread+0x10/0x10 [ 936.516821][ T30] ret_from_fork_asm+0x1a/0x30 [ 936.516849][ T30] [ 936.847248][ T30] Kernel Offset: disabled [ 936.851543][ T30] Rebooting in 86400 seconds..