last executing test programs: 19.358450098s ago: executing program 1 (id=3737): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000480)={{0x0, 0x3, 0x1, 0x4}, 'syz0\x00', 0x10}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@newtfilter={0x68, 0x28, 0xd27, 0x1004001, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x2, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_pedit={0x30, 0x1, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x810}, 0x48c0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="1201000020679e08720c140076c70102030109021200010000100009043800000128ff006d86c18e04b8c77dfd273709a84b71245945150b02b7184dbe2907b62925ec89c4a199d5abd7"], 0x0) socket(0x10, 0x3, 0x0) setgroups(0x0, 0x0) socket$inet(0x2, 0x2, 0x1) syz_usb_control_io$lan78xx(r5, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) 18.520504424s ago: executing program 4 (id=3739): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x400000002) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000000)="b9800000c00f3235000800000f3066baf80cb8b58eb48aef66bafc0cec0fe72d16da0000c4c37d054e0000b93c090000b80000c0feba000000000f30df180f20583e650f01c9660fdcd42e0f78dc", 0x4e}], 0x1, 0x90, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa15, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0700000004000000080000000100000bf7619638bbdbc23c5bb7c7e100", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000e00000850000001b000000b700000000", @ANYRES8], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x18) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="4400000001090104000000000000000005000004080005400000000808000640000000000900010073797a31000000000c00048008000140000000770800054000000002970ab973ea1c143119948c6a400844c7096ead6e7de06c2d4f900fb1d21541c7d3ac346857575d371345c294b4f50d330e4db30677049d8480e9971ae1078da798"], 0x44}}, 0x400d0) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, &(0x7f0000000200)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r7, 0xd000941e, &(0x7f00000007c0)={0x0, "a5acaf0ada5df38be8b210968d20047c"}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000017c0)={{r5}, r9, 0x10, @unused=[0xca3, 0x6, 0x5, 0x3], @devid=r10}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r11, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0xe, 0x0, 0xa}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) 16.251850355s ago: executing program 4 (id=3742): syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) mknod(&(0x7f0000000080)='./bus\x00', 0x8000, 0x7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x5, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) listen(0xffffffffffffffff, 0x3) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r4, 0x4008af60, &(0x7f0000000280)={@my=0x1}) 15.191307589s ago: executing program 4 (id=3744): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendmsg(r0, 0x0, 0x400c040) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000530000/0x3000)=nil) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) r2 = gettid() r3 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) syz_clone(0x91, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x16) move_pages(r2, 0x1, &(0x7f0000000240)=[&(0x7f000062e000/0x3000)=nil], 0x0, 0x0, 0x2) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', 0x0, 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x11) getdents64(r4, 0x0, 0x0) 14.955507066s ago: executing program 1 (id=3745): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, 0x0, 0x0, 0x0) getsockopt$bt_hci(r3, 0x84, 0x7d, &(0x7f0000000840)=""/4127, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) ioctl$VIDIOC_QUERYCTRL(0xffffffffffffffff, 0xc0445624, &(0x7f0000000280)={0x7, 0x100, "77c638b05041a0115f44304807e55536b7fc5ae52727d800", 0x1ff, 0x5, 0x79, 0xdf4, 0x100}) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 11.966309167s ago: executing program 3 (id=3750): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="b400000000000000731132000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$kcm(0x2d, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs\x00') pread64(r2, &(0x7f0000000280)=""/86, 0x56, 0x4000000000000f3) preadv(r2, &(0x7f0000000380)=[{&(0x7f0000000080)=""/83, 0x53}], 0x1, 0xc9, 0x1) pipe2$watch_queue(0x0, 0x80) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c0000010006010800000000000000c7e686471800ef80e2053c8147ec4597c524a3cb1000000914000780080011400000000005001500000a10000005000100070000000500040000000000090002000000eb8f017e7419ccbafedd7c0ff8790c5949b3"], 0x4c}}, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x7) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_DMA(r1, 0xc0286429, &(0x7f0000000580)={0x0, 0x8, &(0x7f0000000300)=[0x3ff, 0x4, 0x3af, 0x7, 0x4, 0x8, 0x4, 0xa], &(0x7f00000004c0), 0x66, 0x6, 0x100, &(0x7f0000000500)=[0x1, 0x3, 0x1d, 0x4, 0xe0c6, 0x7], &(0x7f0000000540)=[0x7ff, 0xa]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a"], 0x7c}}, 0x0) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) syz_usb_connect(0x0, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x0, 0x5d, 0xba, 0xfc, 0x40, 0xbfd, 0x10c, 0x2d16, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x21, 0xef, 0xb0}}]}}]}}, 0x0) 10.044406745s ago: executing program 4 (id=3753): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) r1 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000140)=0xe6e5, 0x4) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, 0x0, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0xcc0}, 0x8) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, 0x0, 0xffc9) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$evdev(0x0, 0x2, 0x862b01) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) dup3(r3, 0xffffffffffffffff, 0x0) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f00000000c0)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0xfd87) 10.014229913s ago: executing program 1 (id=3754): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x40000000, 0x0, 0x0, 0x5, "2af01c3d0040fbffffffffffffff00"}) r1 = syz_open_pts(r0, 0x0) mount(0x0, 0x0, &(0x7f0000000000)='f2fs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$TIOCSTI(r1, 0x5412, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000140)=0xd) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{0x1}, 0x0, &(0x7f0000000340)}, 0x20) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000180)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r5, 0x0, 0x484, &(0x7f0000001280)={0x20000000000084, @remote, 0x0, 0x0, 'rr\x00'}, 0x2c) 9.119890333s ago: executing program 4 (id=3757): syz_open_dev$tty1(0xc, 0x4, 0x2) socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = fcntl$getown(r1, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) chdir(&(0x7f0000000480)='./cgroup\x00') mkdir(&(0x7f0000000000)='./control\x00', 0x0) r4 = open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r5, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r5, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$TIPC_CONN_TIMEOUT(r6, 0x10f, 0x82, &(0x7f0000000640), &(0x7f0000000680)=0x4) r7 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x40b, 0x0, 0x0, {0xa}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x60}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r7, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000000)={0x0, 0x8, 0x4, "000000d5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) unlinkat(r4, &(0x7f00000000c0)='./control\x00', 0x200) rmdir(&(0x7f0000000040)='./control\x00') setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, 0x0, 0x0) 8.906669305s ago: executing program 1 (id=3759): sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, 0x0, 0x20000000) r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl(r0, 0x8b32, &(0x7f0000000040)) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') syz_open_dev$tty20(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) r2 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f00000001c0)=0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000240)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r5, 0x4400ae8f, &(0x7f0000000440)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000), 0x111, 0x1}}, 0x20) ioctl$KVM_RUN(r5, 0xae80, 0x0) 8.22224867s ago: executing program 2 (id=3761): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x4, 0x7, 0xfe}]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x3}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x7, 0xffffff80, 0x5, 0x6dd3, 0x9d50}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x121a02, 0x0) writev(r0, &(0x7f0000000640)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) socket(0x14, 0x2, 0xfffffffc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) mkdirat(0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x71) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095", @ANYRES16], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) r2 = creat(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x154) r3 = fanotify_init(0xf00, 0x40000) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4000009}, 0x801) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) fanotify_mark(r3, 0x105, 0x4000997d, r2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ff9}]}) close_range(r4, 0xffffffffffffffff, 0x0) 8.12611117s ago: executing program 0 (id=3762): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x1f, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x8, 0x3, 0x1ff, 0x3d, 0x963, 0x3, 0x53, 0x202, 0x1, 0xc}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[], 0x0, 0x26}, 0x28) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) syz_emit_ethernet(0x85, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff0180c24c9e00000086dd60120008004f3a00fe8000000000000000000000000000bbfe800000000000000000000000aa03029078000000006000081000001100fc0100000e000000000000000000000000000000000000000000000000000020bb"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0xffffffea}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000008c0)={r4, 0x0, 0x0}, 0x10) socket$nl_route(0x10, 0x3, 0x0) 7.413519289s ago: executing program 3 (id=3763): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8800, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000034000)=""/102392, 0x18ff8) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000006c0)="0d18687da3e7f33aed145cf8ff2d1e5a18c0d5f9856f4824f41040f6987d0b531da10713ed151bc4867681f28e033aef683334d03864ed30590dd4ea64a20ecbbc1346c9f42510d91eec0632885b7da95ca85f4b1435c5c1e993a85257df5f19bdfc5e038a16e6a8aef907e347081fdb93cee93217e11f19cde423e6138bd1b79ee615527ccaf8049959ac6e32af46d777ccb8c26ca925f69590df13a81aee3213e80ba5cacf1f930b3cc49093d11594ef13325790b55efbdc2dd99ed1", 0xbd}, {&(0x7f00000002c0)="9c811ff500139d7d", 0x8}], 0x2}}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f00000007c0)="353a35d6094e4ee7d764b6993f65136c5d6b84d9b1324a0b25e094700c9a66f9181738098f32e3e48859c3878d53a9752474da0d6af299d849d48f2fa2c8c807d7a1521da940585790ff1e6f9da83e32b751d1af9cfac640c1361f5ae8b99c187dafe9ea854120f6eaab11e7fdeb3f2152ebdbc21520ca01f64bb821576deef4ed6696cdddc1768b5b4fbd68a687cb6ba52ecf5cc6f8f05062f26de19d6aaaeb6cbca00e46685f77d2b3e8dd9d0d099e799cd5a76c67ab283f790366f7f744508edc9e48fa101b89215bd330c4e706c1f09d781a5a50aef5e424a7a88b3241a338ca7411cda28aa167b5628b79e8a7d588efb69636181b9c54f6d296386c95f8a08e27d5792dcb20fa3b5b4f60c71f310b31bb1ab4a825c2dc10fac150a17d92bb51849d9eea53c78d427d8d1036dc906084046fcae09499c220ef50c2c7c475f392bc288eb5efb8032d1ade92e88e50a05a95dd5c6cbbdfb086fa53bca14d40c8c3f7149b39b16b7c7370978389366174db5fbc99dbe958f8c1690cd695dfbe6c384162a412c8d3cfd7cf223f9df4c67b92514111891f53d4e19826797302e1a87e7a627c52740bb3bd311771a68d349c0a68ef6f2a765f8220323add67b2b6695ca41adcda387a4264bcd94c8578a9ccca3b55ebcda45369b56068cfeec34abc2cbd94b9b12d057fa9d4328d57073f40e5ae64443e4a10ed400575bbd1168a170a0134b9ad28735dbd9603a9e417cce864f2141a92f57e1fdfcff4776f94a794d6db8d3e9e0ecc783956c7ab15a8d5639d3df1ac9da6057af913a563bd55b657f37cbf4cae2919aea6ff8a7490b4c036361b8866cc062bbad019f43d02b0c38bd6309f2baa53924466203ab8d00daaac4c9da846e645d64c10e47c32e9824e79ade4eeee7cbf71b1bb48f760800b04334745ab553dea12a85f0671eb07a4cc67ceaffa8269e0b052f25136cfb8a6b9327a2d165c42933642d3171ad00ebf0be485f5ed319021600a94072f251c8905a2451eba3ba7db2ec5fb8613463a796610629719166259ffa3261e06f09b5a69798b88848da9", 0x2f6}], 0x1}}], 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r3, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 7.379286548s ago: executing program 1 (id=3764): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x40004) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x14, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x3938700}}) r6 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r6, 0x40045532, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) r7 = syz_open_dev$sndpcmp(0x0, 0x8000, 0x82c65) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r8, 0x1, &(0x7f0000004540)=[0x0]) ioctl$SNDRV_PCM_IOCTL_REWIND(r7, 0x40084146, &(0x7f0000000200)=0x6f4) ioctl$sock_SIOCSIFBR(r0, 0x8941, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_POOL_GET(r9, 0x0, 0x40080c0) ptrace$getenv(0x4201, 0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r3, 0x47f6, 0x0, 0x2, 0x0, 0x0) 7.217933423s ago: executing program 0 (id=3765): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x75b08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e27}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x80047456, 0x0) socket$inet(0x2, 0x3, 0x13) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000240)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f00000001c0)={0x24, r4, 0x62c21a4ade68aba1, 0x0, 0x25dfdbfb, {{0x32}, {@val={0x8, 0x1, 0x60}, @val={0x8, 0x3, r6}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x48d4}, 0x40010) 6.231988328s ago: executing program 0 (id=3766): memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, 0x0, 0x0, 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) timerfd_create(0x9, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) 5.416390007s ago: executing program 0 (id=3767): timer_create(0x3, 0x0, &(0x7f0000044000)) timer_delete(0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) timer_create(0x0, 0x0, 0x0) ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000040)=[0x6, 0x6]) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, 0x0, 0x404a05c) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="21980600000000001c001280090001007866726d000000000c0002800800020001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 5.291064747s ago: executing program 2 (id=3768): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x1f, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ipvlan1\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008c}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000440), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) setregid(0x0, 0xee01) faccessat2(0xffffffffffffff9c, 0x0, 0xc7, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000540)={'\x00', 0x7ff, 0x5, 0xc, 0x2, 0x3}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x40010) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setaffinity(0x0, 0xffffffffffffff6c, &(0x7f0000000200)=0x400000bce) socket$netlink(0x10, 0x3, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x15) dup2(0xffffffffffffffff, 0xffffffffffffffff) 4.965959693s ago: executing program 2 (id=3769): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x20440, 0x0) ioctl$RTC_PIE_ON(r4, 0x7005) ioctl$RTC_IRQP_SET(r4, 0x4008700c, 0xe24) r5 = creat(0x0, 0x4b) r6 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r5, 0xc06864ce, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r5, 0xc06864b8, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, 0x0) 3.990918684s ago: executing program 3 (id=3770): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x3, 0x2, 0x5) ioctl$IMGETCOUNT(r0, 0x80044943, 0x0) syz_open_dev$sndpcmp(&(0x7f0000001040), 0x101, 0xa000) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001180)={0x3, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}, {0x80a0000, 0x30, &(0x7f0000001240)=""/48}, {0x0, 0x23, &(0x7f0000001140)=""/35}]}) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r3}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6daa00"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) 3.90969272s ago: executing program 2 (id=3771): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, &(0x7f0000001100)={0x77359400}, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r2, 0x8040942d, &(0x7f00000002c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) read$FUSE(r0, &(0x7f0000006380)={0x2020}, 0x2020) write$FUSE_INIT(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) 3.812876956s ago: executing program 1 (id=3772): r0 = socket$inet_sctp(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) unlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r3, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000000)=0xffff0018) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) socket$rxrpc(0x21, 0x2, 0xa) write$6lowpan_control(r3, &(0x7f0000000340)='connect aa:aa:aa:aa:aa:10 0', 0x1b) r5 = landlock_create_ruleset(0x0, 0x0, 0x1) landlock_restrict_self(r5, 0x5) landlock_restrict_self(0xffffffffffffffff, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x200000000180, 0x2000000001b0, 0x2000000001e0], 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB]}, 0x78) socket$nl_route(0x10, 0x3, 0x0) 3.606009715s ago: executing program 0 (id=3773): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x83, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%(,:', 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f00000003c0), 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000000)={0x8001, 0x5, 0xde, 0xffff}, 0x8) sendto$inet6(r4, &(0x7f00000001c0)="ad", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) shutdown(r4, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000380), 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x11a, 0x23, 0x0, 0x0) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r8, 0x0, 0x8081) ioctl$KVM_SET_CPUID(r6, 0x4008ae8a, 0x0) splice(r0, 0x0, r2, 0x0, 0x8b, 0x0) 3.029742647s ago: executing program 4 (id=3774): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) socket$rxrpc(0x21, 0x2, 0xa) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x0) ioctl$TIOCSTI(r6, 0x5412, 0x0) syz_usb_connect(0x0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$P9_RGETLOCK(r4, 0x0, 0xffffff6a) 2.973648705s ago: executing program 2 (id=3775): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) socket$inet(0xa, 0x801, 0x84) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f7508003900", 0x25) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x4, 0x0, 0x80000001}, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) accept(r0, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x2) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 2.098042182s ago: executing program 3 (id=3776): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_smc(0x2b, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r7 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) ftruncate(r7, 0xffff) fcntl$addseals(r7, 0x409, 0x7) r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f00000002c0)={r7, 0x0, 0x0, 0x8000}) r9 = fcntl$dupfd(r8, 0x406, r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r9}) close_range(r2, 0xffffffffffffffff, 0x0) 1.389505126s ago: executing program 3 (id=3777): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsmount(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='.\x00', 0x10000, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r4) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) memfd_create(&(0x7f0000000480)='\xff\x00l\x1e\xa00x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000600)={r7, 0x0, 0x0, 0x0, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800000], [0x0, 0x1001000], [0x0, 0x0, 0xe8a6]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r4, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r8, 0x0, 0x0, r9], [0x2b8]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000280)={&(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) 582.128722ms ago: executing program 2 (id=3778): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r1 = msgget$private(0x0, 0x0) msgrcv(r1, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_RMID(r1, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket$inet(0x2, 0x803, 0x2) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045520, &(0x7f00000001c0)=0xffffbf7f) 365.936112ms ago: executing program 3 (id=3779): syz_usb_connect(0x0, 0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = socket$inet6(0xa, 0x3, 0x6) socket(0x14, 0x80000, 0x9) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0x0, 0x2}}, 0xe8) sendmmsg(r3, &(0x7f0000000480), 0x2e9, 0xffe0) sendmsg$IPSET_CMD_SWAP(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x40000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=@updpolicy={0xc4, 0x19, 0x501, 0x0, 0x25dfdbfb, {{@in6=@private0, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, r5}, {0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x2}, [@offload={0xc, 0x1c, {r5, 0x4}}]}, 0xc4}}, 0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x84f34a583dfc7f42, 0x10010, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x0, 0xbfdfffbc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7fffffff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r9, 0xc0d05605, &(0x7f0000000580)={0x1, @pix_mp={0xfffffffc, 0x0, 0x3631564e, 0x7, 0x2, [{}, {0x277c}, {}, {}, {}, {0xd360}, {0x7, 0xfffffffd}, {0x0, 0x80000}], 0x10, 0x0, 0x0, 0x0, 0x2}}) syz_io_uring_submit(r7, r8, 0x0) syz_io_uring_submit(r6, r8, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x40, 0x4004, @fd, 0x3, 0x20, 0x1, 0xf0a462ef7147f6e5, 0x1, {0x2}}) 0s ago: executing program 0 (id=3780): socket$pppl2tp(0x18, 0x1, 0x1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) syz_init_net_socket$rose(0xb, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYBLOB="080002007f00"], 0x50}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000340)={'pimreg\x00', {0x2, 0x4e23, @empty=0x7f000000}}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="940000000001050500000000000000000a0000003c0002802c00018014000300ff010000efff0000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020000000000000000000000000001"], 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x58}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, &(0x7f0000000300)) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6}) r5 = openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) preadv(r5, 0x0, 0x0, 0x9065, 0x4) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) kernel console output (not intermixed with test programs): ntext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 717.496025][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 717.521698][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 717.529083][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 717.608448][ T60] veth1_macvtap: left promiscuous mode [ 717.633536][ T60] veth0_macvtap: left promiscuous mode [ 717.663035][ T60] veth1_vlan: left promiscuous mode [ 717.676096][ T60] veth0_vlan: left promiscuous mode [ 718.613175][ T30] audit: type=1400 audit(1756724529.816:4122): avc: denied { setopt } for pid=16060 comm="syz.1.3076" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 718.988543][ T30] audit: type=1400 audit(1756724529.816:4123): avc: denied { connect } for pid=16060 comm="syz.1.3076" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 719.008502][ T30] audit: type=1400 audit(1756724529.826:4124): avc: denied { write } for pid=16060 comm="syz.1.3076" laddr=fe80::c0bb:4dff:fe2e:9e79 lport=7 faddr=ff02::1 fport=20005 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 719.078927][ T30] audit: type=1400 audit(1756724529.836:4125): avc: denied { read } for pid=16060 comm="syz.1.3076" laddr=fe80::c0bb:4dff:fe2e:9e79 lport=7 faddr=ff02::1 fport=20005 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 719.140706][ T30] audit: type=1400 audit(1756724530.386:4126): avc: denied { read } for pid=16046 comm="syz.2.3071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 719.870883][ T1574] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 719.911999][ T60] team0 (unregistering): Port device team_slave_1 removed [ 719.958754][ T60] team0 (unregistering): Port device team_slave_0 removed [ 720.065290][ T1574] usb 2-1: config 0 has an invalid interface number: 29 but max is 0 [ 720.073815][ T1574] usb 2-1: config 0 has no interface number 0 [ 720.079866][ T1574] usb 2-1: config 0 interface 29 has no altsetting 0 [ 720.089353][ T1574] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 720.098740][ T1574] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.106767][ T1574] usb 2-1: Product: syz [ 720.111004][ T1574] usb 2-1: Manufacturer: syz [ 720.115584][ T1574] usb 2-1: SerialNumber: syz [ 720.131159][ T1574] usb 2-1: config 0 descriptor?? [ 720.289037][ T60] team0 (unregistering): Port device dummy0 removed [ 720.427955][T15943] chnl_net:caif_netlink_parms(): no params data found [ 720.452700][ T5996] lo speed is unknown, defaulting to 1000 [ 720.472003][ T5996] infiniband syz0: ib_query_port failed (-19) [ 720.535817][ T30] audit: type=1400 audit(1756724531.806:4127): avc: denied { read write } for pid=16073 comm="syz.2.3080" name="mouse0" dev="devtmpfs" ino=982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 720.588032][ T1574] peak_usb 2-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 720.604198][ T30] audit: type=1400 audit(1756724531.806:4128): avc: denied { open } for pid=16073 comm="syz.2.3080" path="/dev/input/mouse0" dev="devtmpfs" ino=982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 720.634777][ T30] audit: type=1400 audit(1756724531.826:4129): avc: denied { create } for pid=16073 comm="syz.2.3080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 720.654486][ C0] vkms_vblank_simulate: vblank timer overrun [ 722.406418][T15943] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.435930][T15943] bridge0: port 1(bridge_slave_0) entered disabled state [ 722.536153][T15943] bridge_slave_0: entered allmulticast mode [ 722.543921][T15943] bridge_slave_0: entered promiscuous mode [ 722.564417][T15943] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.572060][T15943] bridge0: port 2(bridge_slave_1) entered disabled state [ 722.579283][T15943] bridge_slave_1: entered allmulticast mode [ 722.586682][T15943] bridge_slave_1: entered promiscuous mode [ 723.719145][T15943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 723.742563][T15943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 724.008686][T15943] team0: Port device team_slave_0 added [ 724.117679][T15943] team0: Port device team_slave_1 added [ 724.606980][ T30] audit: type=1400 audit(1756724535.446:4130): avc: denied { getopt } for pid=16102 comm="syz.3.3086" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 724.793120][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 724.800229][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 724.806993][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 725.228575][T16109] infiniband syz2: set active [ 725.233656][T16109] infiniband syz2: added vxcan1 [ 725.239833][T16109] syz2: rxe_create_cq: returned err = -12 [ 725.246184][T16109] infiniband syz2: Couldn't create ib_mad CQ [ 725.252313][T16109] infiniband syz2: Couldn't open port 1 [ 725.274536][T16109] RDS/IB: syz2: added [ 725.279008][T16109] smc: adding ib device syz2 with port count 1 [ 725.285386][T16109] smc: ib device syz2 port 1 has pnetid [ 725.293420][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 725.398081][ T30] audit: type=1400 audit(1756724535.526:4131): avc: denied { create } for pid=16103 comm="syz.2.3096" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 725.475262][ T30] audit: type=1400 audit(1756724535.526:4132): avc: denied { write } for pid=16103 comm="syz.2.3096" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 725.646804][ T43] vxcan1 speed is unknown, defaulting to 1000 [ 725.647357][T15943] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 725.670462][T15943] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.011307][T15943] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 727.024639][T15943] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 727.031674][T15943] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.057737][T15943] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 727.087441][ T979] vxcan1 speed is unknown, defaulting to 1000 [ 727.093159][ T1574] peak_usb 2-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 727.097917][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 727.207475][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 727.294896][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 727.378318][T16109] vxcan1 speed is unknown, defaulting to 1000 [ 727.532889][ T1574] peak_usb 2-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 727.635550][T15943] hsr_slave_0: entered promiscuous mode [ 727.646883][T15943] hsr_slave_1: entered promiscuous mode [ 727.653078][T15943] debugfs: 'hsr0' already exists in 'hsr' [ 727.658938][T15943] Cannot create hsr debugfs directory [ 727.748023][ T1574] peak_usb 2-1:0.29: probe with driver peak_usb failed with error -71 [ 727.760261][ T1574] usb 2-1: USB disconnect, device number 63 [ 727.792276][T16134] block nbd4: Attempted send on invalid socket [ 727.798498][T16134] I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 727.807774][T16134] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 728.311844][T16138] block nbd3: Attempted send on invalid socket [ 728.318779][T16138] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 728.328151][T16138] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 728.466390][T16139] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3090'. [ 728.574029][T16140] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3092'. [ 731.188420][ T30] audit: type=1400 audit(1756724542.466:4133): avc: denied { write } for pid=16159 comm="syz.1.3100" name="event3" dev="devtmpfs" ino=984 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 731.277453][T15943] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 731.405720][T15943] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 731.678030][T15943] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 731.695108][T15943] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 731.876503][T15943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 731.913322][T15943] 8021q: adding VLAN 0 to HW filter on device team0 [ 731.945192][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.953719][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 731.963553][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.970756][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.003201][T16184] block nbd3: Attempted send on invalid socket [ 732.009445][T16184] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 732.018798][T16184] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 732.091761][T16184] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3104'. [ 732.190948][ T9] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 732.421057][ T9] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 732.429267][ T9] usb 5-1: config 0 has no interface number 0 [ 732.469229][ T9] usb 5-1: config 0 interface 29 has no altsetting 0 [ 732.610848][ T9] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 732.622842][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.639137][ T9] usb 5-1: Product: syz [ 732.694743][ T9] usb 5-1: Manufacturer: syz [ 732.708354][ T9] usb 5-1: SerialNumber: syz [ 732.761090][T15943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 732.788194][ T9] usb 5-1: config 0 descriptor?? [ 732.803185][ T5925] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 732.960829][ T5925] usb 2-1: Using ep0 maxpacket: 16 [ 732.969781][T15943] veth0_vlan: entered promiscuous mode [ 732.977477][ T5925] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice=a3.85 [ 732.998270][T15943] veth1_vlan: entered promiscuous mode [ 733.030775][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.063164][T15943] veth0_macvtap: entered promiscuous mode [ 733.076707][T15943] veth1_macvtap: entered promiscuous mode [ 733.103694][T15943] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 733.117522][ T5925] usb 2-1: config 0 descriptor?? [ 733.123798][T15943] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 733.190576][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.256982][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.285226][ T5925] usb 2-1: interface 1 not found [ 733.319882][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.343005][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.356235][ T9] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 733.372202][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 733.436415][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 733.495906][ T6014] usb 2-1: USB disconnect, device number 64 [ 733.514092][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 733.524264][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 733.555709][ T30] audit: type=1400 audit(1756724544.826:4134): avc: denied { mounton } for pid=15943 comm="syz-executor" path="/root/syzkaller.zXI2hT/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 733.720977][ T5925] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 734.610956][ T30] audit: type=1400 audit(1756724544.826:4135): avc: denied { mount } for pid=15943 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 734.633498][ T30] audit: type=1400 audit(1756724544.826:4136): avc: denied { mounton } for pid=15943 comm="syz-executor" path="/root/syzkaller.zXI2hT/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 734.662016][ T30] audit: type=1400 audit(1756724544.826:4137): avc: denied { mounton } for pid=15943 comm="syz-executor" path="/root/syzkaller.zXI2hT/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=61367 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 734.748383][ T30] audit: type=1400 audit(1756724544.866:4138): avc: denied { mounton } for pid=15943 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 734.836341][T16197] input: syz1 as /devices/virtual/input/input29 [ 735.069510][ T5925] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 735.086461][ T5925] usb 3-1: config 0 has no interface number 0 [ 735.096680][ T5925] usb 3-1: config 0 interface 29 has no altsetting 0 [ 735.117669][ T30] audit: type=1400 audit(1756724544.866:4139): avc: denied { mount } for pid=15943 comm="syz-executor" name="/" dev="gadgetfs" ino=7969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 735.148874][ T5925] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 735.158614][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.168535][ T5925] usb 3-1: Product: syz [ 735.188248][ T5925] usb 3-1: Manufacturer: syz [ 735.205067][ T5925] usb 3-1: SerialNumber: syz [ 735.219775][ T5925] usb 3-1: config 0 descriptor?? [ 735.391193][T16214] tipc: Started in network mode [ 735.407114][T16214] tipc: Node identity 9acc704b2ec3, cluster identity 4711 [ 735.615847][ T5925] peak_usb 3-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 735.779626][ T30] audit: type=1400 audit(1756724544.866:4140): avc: denied { mounton } for pid=15943 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 735.809259][T16214] tipc: Enabled bearer , priority 0 [ 735.825323][T16216] syzkaller0: entered promiscuous mode [ 735.841020][T16216] syzkaller0: entered allmulticast mode [ 735.914119][ T9] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 735.924714][ T30] audit: type=1400 audit(1756724544.986:4141): avc: denied { read } for pid=16203 comm="syz.0.3039" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 735.947878][ T9] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 737.095464][ T30] audit: type=1400 audit(1756724544.986:4142): avc: denied { open } for pid=16203 comm="syz.0.3039" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 737.119054][ T30] audit: type=1400 audit(1756724546.126:4143): avc: denied { read } for pid=5207 comm="acpid" name="mouse1" dev="devtmpfs" ino=3806 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 737.149516][ T30] audit: type=1400 audit(1756724546.126:4144): avc: denied { open } for pid=5207 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3806 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 737.161266][ T5959] tipc: Node number set to 3020910667 [ 737.173432][ T30] audit: type=1400 audit(1756724546.126:4145): avc: denied { ioctl } for pid=5207 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3806 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 737.258635][T16220] tipc: Resetting bearer [ 737.277216][T16213] tipc: Resetting bearer [ 737.313059][ T9] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 737.336301][T16213] tipc: Disabling bearer [ 737.357903][ T9] usb 5-1: USB disconnect, device number 61 [ 738.350636][T16229] netlink: del zone limit has 4 unknown bytes [ 738.562456][T16238] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 738.934991][T16240] tipc: Enabled bearer , priority 0 [ 738.950497][T16240] syzkaller0: entered promiscuous mode [ 738.956347][T16240] syzkaller0: entered allmulticast mode [ 738.979962][T16240] tipc: Resetting bearer [ 738.993798][T16239] tipc: Resetting bearer [ 739.187901][T16239] tipc: Disabling bearer [ 741.054958][ T30] audit: type=1400 audit(1756724551.856:4146): avc: denied { create } for pid=16256 comm="syz.1.3123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 741.478930][ T5925] peak_usb 3-1:0.29 can1: unable to request usb[type=2 value=5] err=-71 [ 741.613918][ T30] audit: type=1400 audit(1756724552.856:4147): avc: denied { read } for pid=16263 comm="syz.4.3124" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 741.953891][ T5925] peak_usb 3-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 741.996271][T16268] tipc: Started in network mode [ 742.001824][ T30] audit: type=1400 audit(1756724552.856:4148): avc: denied { open } for pid=16263 comm="syz.4.3124" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 742.005585][T16268] tipc: Node identity 7a7654b80efd, cluster identity 4711 [ 742.026037][ T30] audit: type=1400 audit(1756724552.866:4149): avc: denied { ioctl } for pid=16263 comm="syz.4.3124" path="/dev/usbmon0" dev="devtmpfs" ino=716 ioctlcmd=0x9204 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 742.062400][ T5925] peak_usb 3-1:0.29: probe with driver peak_usb failed with error -71 [ 742.106624][ T5925] usb 3-1: USB disconnect, device number 68 [ 742.125320][T16268] tipc: Enabled bearer , priority 0 [ 742.135491][T16269] syzkaller0: entered promiscuous mode [ 742.141339][T16269] syzkaller0: entered allmulticast mode [ 743.075744][T16268] tipc: Resetting bearer [ 743.142955][T16267] tipc: Resetting bearer [ 743.172733][T16267] tipc: Disabling bearer [ 744.709512][T16297] tipc: Enabled bearer , priority 0 [ 744.716765][T16297] syzkaller0: entered promiscuous mode [ 744.723435][T16297] syzkaller0: entered allmulticast mode [ 744.752495][T16297] tipc: Resetting bearer [ 745.063550][T16294] tipc: Resetting bearer [ 745.101743][T16302] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3133'. [ 745.126526][T16294] tipc: Disabling bearer [ 747.312130][ T5959] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 747.338158][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.344960][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.351322][ T30] audit: type=1400 audit(1756724558.216:4150): avc: denied { bind } for pid=16316 comm="syz.4.3138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 747.381691][ T30] audit: type=1400 audit(1756724558.226:4151): avc: denied { node_bind } for pid=16316 comm="syz.4.3138" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 747.411016][ T43] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 747.490846][ T5959] usb 3-1: Using ep0 maxpacket: 8 [ 747.511045][ T5959] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 747.538466][ T5959] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.550403][ T30] audit: type=1400 audit(1756724558.226:4152): avc: denied { connect } for pid=16316 comm="syz.4.3138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 747.577155][ T5959] usb 3-1: Product: syz [ 747.682740][ T5959] usb 3-1: Manufacturer: syz [ 747.687371][ T5959] usb 3-1: SerialNumber: syz [ 747.696178][ T30] audit: type=1400 audit(1756724558.226:4153): avc: denied { write } for pid=16316 comm="syz.4.3138" laddr=::1 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 747.721355][ T5959] usb 3-1: config 0 descriptor?? [ 748.288831][ T43] usb 4-1: config 0 has an invalid interface number: 29 but max is 0 [ 748.297024][ T43] usb 4-1: config 0 has no interface number 0 [ 748.467635][ T5959] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 748.672345][ T43] usb 4-1: config 0 interface 29 has no altsetting 0 [ 748.810831][ T5925] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 749.324820][ T43] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 749.334075][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.342174][ T43] usb 4-1: Product: syz [ 749.346537][ T43] usb 4-1: Manufacturer: syz [ 749.352287][ T43] usb 4-1: SerialNumber: syz [ 749.411004][ T43] usb 4-1: config 0 descriptor?? [ 749.465712][ T5925] usb 2-1: config 0 has an invalid interface number: 29 but max is 0 [ 749.484494][ T5925] usb 2-1: config 0 has no interface number 0 [ 749.490631][ T5925] usb 2-1: config 0 interface 29 has no altsetting 0 [ 749.722300][ T30] audit: type=1400 audit(1756724560.876:4154): avc: denied { write } for pid=16335 comm="syz.0.3143" name="file0" dev="tmpfs" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 750.002025][ T5925] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 750.012159][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.040905][ T5925] usb 2-1: Product: syz [ 750.045101][ T5925] usb 2-1: Manufacturer: syz [ 750.049831][ T30] audit: type=1400 audit(1756724560.876:4155): avc: denied { open } for pid=16335 comm="syz.0.3143" path="/5/file0" dev="tmpfs" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 750.212189][ T5925] usb 2-1: SerialNumber: syz [ 750.220309][ T5925] usb 2-1: config 0 descriptor?? [ 750.766980][ T5959] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 750.846764][ T5959] usb 3-1: USB disconnect, device number 69 [ 750.863326][ T30] audit: type=1400 audit(1756724560.876:4156): avc: denied { ioctl } for pid=16335 comm="syz.0.3143" path="/5/file0" dev="tmpfs" ino=44 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 751.019696][T16348] netlink: 161716 bytes leftover after parsing attributes in process `syz.0.3146'. [ 751.029293][T16348] netlink: zone id is out of range [ 751.138339][ T30] audit: type=1400 audit(1756724562.386:4157): avc: denied { create } for pid=16343 comm="syz.4.3145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 751.727485][ T30] audit: type=1400 audit(1756724562.986:4158): avc: denied { bind } for pid=16350 comm="syz.2.3147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 751.765161][ T43] peak_usb 4-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 751.811891][ T43] peak_usb 4-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 751.873592][ T43] peak_usb 4-1:0.29: probe with driver peak_usb failed with error -71 [ 751.896671][ T43] usb 4-1: USB disconnect, device number 59 [ 752.270868][ T5996] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 752.390790][ T5925] usb 2-1: can't set config #0, error -71 [ 752.518773][ T5996] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 752.536025][T16365] tipc: Started in network mode [ 752.546750][ T5925] usb 2-1: USB disconnect, device number 65 [ 752.552724][ T5996] usb 5-1: config 0 has no interface number 0 [ 752.566470][ T5996] usb 5-1: config 0 interface 29 has no altsetting 0 [ 752.566487][T16365] tipc: Node identity 56a6dd7dd887, cluster identity 4711 [ 752.566607][T16365] tipc: Enabled bearer , priority 0 [ 752.606606][ T5996] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 752.616101][ T5996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.644324][T16368] syzkaller0: entered promiscuous mode [ 752.649882][ T5996] usb 5-1: Product: syz [ 752.657525][T16368] syzkaller0: entered allmulticast mode [ 752.665892][ T5996] usb 5-1: Manufacturer: syz [ 752.720989][ T5996] usb 5-1: SerialNumber: syz [ 752.750647][ T5996] usb 5-1: config 0 descriptor?? [ 752.840197][T16365] tipc: Resetting bearer [ 752.930774][T16374] befs: (nbd2): No write support. Marking filesystem read-only [ 752.941234][T16374] block nbd2: Attempted send on invalid socket [ 752.948313][T16374] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 752.958683][T16374] befs: (nbd2): unable to read superblock [ 753.842081][ T5959] tipc: Node number set to 2384584061 [ 753.863981][T16364] tipc: Resetting bearer [ 753.981834][T16364] tipc: Disabling bearer [ 754.044244][T16377] tipc: Enabled bearer , priority 0 [ 754.124474][T16372] tipc: Resetting bearer [ 754.154004][T16378] syzkaller0: entered promiscuous mode [ 754.159605][T16378] syzkaller0: entered allmulticast mode [ 754.167795][ T5996] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 754.296119][T16371] tipc: Resetting bearer [ 754.616368][T16371] tipc: Disabling bearer [ 754.633202][ T30] audit: type=1400 audit(1756724565.916:4159): avc: denied { create } for pid=16392 comm="syz.2.3156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 754.796324][ T30] audit: type=1400 audit(1756724566.066:4160): avc: denied { create } for pid=16392 comm="syz.2.3156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 754.819671][T16392] delete_channel: no stack [ 755.799269][ T5996] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 755.909741][ T30] audit: type=1400 audit(1756724567.146:4161): avc: denied { write } for pid=16398 comm="syz.2.3159" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 756.210388][ T5996] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 756.292252][ T5996] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 756.326789][ T5996] usb 5-1: USB disconnect, device number 62 [ 756.730836][ T6014] usb 2-1: new full-speed USB device number 66 using dummy_hcd [ 756.941026][T16425] netlink: 165 bytes leftover after parsing attributes in process `syz.2.3163'. [ 756.983756][T16425] netlink: 277 bytes leftover after parsing attributes in process `syz.2.3163'. [ 757.642455][ T6014] usb 2-1: config 0 has an invalid interface number: 29 but max is 0 [ 757.723334][ T6014] usb 2-1: config 0 has no interface number 0 [ 757.739917][ T6014] usb 2-1: config 0 interface 29 has no altsetting 0 [ 757.786259][ T6014] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 757.806679][ T6014] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.827238][ T6014] usb 2-1: Product: syz [ 757.836574][ T6014] usb 2-1: Manufacturer: syz [ 757.846826][ T6014] usb 2-1: SerialNumber: syz [ 757.862469][ T6014] usb 2-1: config 0 descriptor?? [ 757.880957][ T5959] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 758.051355][ T5959] usb 4-1: config 0 has an invalid interface number: 29 but max is 0 [ 758.059936][ T5959] usb 4-1: config 0 has no interface number 0 [ 758.066143][ T5959] usb 4-1: config 0 interface 29 has no altsetting 0 [ 758.079769][ T5959] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 758.088960][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.098350][ T5959] usb 4-1: Product: syz [ 758.104683][ T5959] usb 4-1: Manufacturer: syz [ 758.113436][ T5959] usb 4-1: SerialNumber: syz [ 758.271460][T16435] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3165'. [ 758.336490][ T5959] usb 4-1: config 0 descriptor?? [ 758.417442][ T6014] peak_usb 2-1:0.29 can0: unable to request usb[type=0 value=1] err=-32 [ 758.432949][ T6014] peak_usb 2-1:0.29: unable to read PCAN-USB X6 firmware info (err -32) [ 758.501449][ T6014] peak_usb 2-1:0.29: probe with driver peak_usb failed with error -32 [ 758.711607][ T5959] peak_usb 4-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 759.527322][ T6014] usb 2-1: USB disconnect, device number 66 [ 761.394774][ T30] audit: type=1400 audit(1756724572.676:4162): avc: denied { write } for pid=16443 comm="syz.4.3168" path="socket:[62125]" dev="sockfs" ino=62125 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 761.884374][ T30] audit: type=1400 audit(1756724573.156:4163): avc: denied { name_bind } for pid=16452 comm="syz.2.3170" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 761.923134][ T30] audit: type=1400 audit(1756724573.186:4164): avc: denied { connect } for pid=16452 comm="syz.2.3170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 761.942716][ C0] vkms_vblank_simulate: vblank timer overrun [ 763.078924][ T5959] peak_usb 4-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 763.091025][ T5959] peak_usb 4-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 764.438677][ T5959] peak_usb 4-1:0.29: probe with driver peak_usb failed with error -71 [ 764.528506][ T5959] usb 4-1: USB disconnect, device number 60 [ 764.733855][ T30] audit: type=1400 audit(1756724575.996:4165): avc: denied { read } for pid=16468 comm="syz.1.3176" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 766.408809][ T5959] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 766.608256][ T30] audit: type=1400 audit(1756724577.886:4166): avc: denied { setopt } for pid=16485 comm="syz.0.3179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 767.457587][ T5959] usb 4-1: config 0 has an invalid interface number: 29 but max is 0 [ 767.486564][ T5959] usb 4-1: config 0 has no interface number 0 [ 767.668933][ T5959] usb 4-1: config 0 interface 29 has no altsetting 0 [ 767.773423][ T43] IPVS: starting estimator thread 0... [ 768.293388][T16512] ptrace attach of "./syz-executor exec"[5845] was attempted by "   jC*p\x1bŖ 3Hej$x2e|yOkYxMxOB B͒GMP%OޜtĎ\x0dT[g]LJ;2$|gP\x22̏R׾{Vd,ru\x0da1i-6M+\x07}T#a5Zd0ƌ{w$)i%L>Q,oQeꮰHrʏ.ҿɷ0JVw^{'ǁo_8v:7>LpF,Z3R<\x07}A\x07B{ g`g/3`0=\x1bJ-^0eyJq -ʹ\x0bL\x0c [ 768.298939][ T30] audit: type=1400 audit(1756724579.576:4167): avc: denied { read write } for pid=16507 comm="syz.4.3184" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 768.389993][ C0] vkms_vblank_simulate: vblank timer overrun [ 768.415436][ C0] vkms_vblank_simulate: vblank timer overrun [ 768.570988][T16510] IPVS: using max 73 ests per chain, 175200 per kthread [ 768.771190][ T30] audit: type=1400 audit(1756724579.576:4168): avc: denied { open } for pid=16507 comm="syz.4.3184" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 768.795974][ C0] vkms_vblank_simulate: vblank timer overrun [ 770.285634][ T30] audit: type=1400 audit(1756724581.566:4169): avc: denied { create } for pid=16525 comm="syz.2.3188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 770.576016][ T30] audit: type=1400 audit(1756724581.846:4170): avc: denied { bind } for pid=16525 comm="syz.2.3188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 771.605894][ T30] audit: type=1400 audit(1756724582.886:4171): avc: denied { write } for pid=16525 comm="syz.2.3188" path="socket:[62250]" dev="sockfs" ino=62250 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 772.621120][ T5959] usb 4-1: string descriptor 0 read error: -71 [ 772.667887][ T5959] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 772.705772][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.814296][ T5959] usb 4-1: config 0 descriptor?? [ 772.834869][ T5959] usb 4-1: can't set config #0, error -71 [ 772.844533][ T5959] usb 4-1: USB disconnect, device number 61 [ 775.226117][T16579] block nbd0: Attempted send on invalid socket [ 775.232603][T16579] I/O error, dev nbd0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 775.440952][T16579] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 776.941278][T16579] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3201'. [ 777.883183][T16604] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.3206'. [ 778.193717][T16606] syzkaller0: entered promiscuous mode [ 778.231034][T16606] syzkaller0: entered allmulticast mode [ 778.612775][T16616] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3210'. [ 779.871877][T16628] block nbd0: Attempted send on invalid socket [ 780.172626][T16628] I/O error, dev nbd0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 780.262119][T16628] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 780.306507][T16633] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3214'. [ 780.437944][T16642] syz.2.3216 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 780.466219][T16643] block nbd3: Attempted send on invalid socket [ 780.486737][T16643] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 780.496871][ T30] audit: type=1400 audit(1756724591.766:4172): avc: denied { watch } for pid=16630 comm="syz.4.3213" path="/672/bus/bus" dev="overlay" ino=3528 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 780.602169][T16619] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3208'. [ 780.631155][T16643] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 780.810783][ T30] audit: type=1400 audit(1756724591.766:4173): avc: denied { watch_sb watch_reads } for pid=16630 comm="syz.4.3213" path="/672/bus/bus" dev="overlay" ino=3528 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 780.882692][ T30] audit: type=1400 audit(1756724591.836:4174): avc: denied { getattr } for pid=16641 comm="syz.2.3216" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=64192 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 781.061438][ T30] audit: type=1400 audit(1756724592.316:4175): avc: denied { mounton } for pid=16648 comm="syz.1.3217" path="/633/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 781.089972][T16645] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3215'. [ 781.893830][ T30] audit: type=1400 audit(1756724593.166:4176): avc: denied { append } for pid=16650 comm="syz.1.3218" name="sg0" dev="devtmpfs" ino=753 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 782.080157][T16663] block nbd2: Attempted send on invalid socket [ 782.160332][ T30] audit: type=1400 audit(1756724593.436:4177): avc: denied { read write } for pid=16656 comm="syz.0.3221" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 782.586623][ T30] audit: type=1400 audit(1756724593.436:4178): avc: denied { open } for pid=16656 comm="syz.0.3221" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 782.705295][T16663] I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 782.714911][T16663] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 783.102045][T16667] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3219'. [ 783.143607][ T30] audit: type=1400 audit(1756724594.286:4179): avc: denied { create } for pid=16659 comm="syz.3.3220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 783.780894][ T30] audit: type=1400 audit(1756724594.986:4180): avc: denied { bind } for pid=16671 comm="syz.0.3223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 785.291298][T16695] rdma_op ffff88803299e9f0 conn xmit_rdma 0000000000000000 [ 785.380182][ T30] audit: type=1400 audit(1756724595.796:4181): avc: denied { create } for pid=16685 comm="syz.3.3230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 789.402179][T16716] block nbd3: Attempted send on invalid socket [ 789.409731][T16716] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 789.426331][T16716] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 789.537364][T16723] input: syz1 as /devices/virtual/input/input30 [ 789.545221][T16723] input: failed to attach handler leds to device input30, error: -6 [ 790.398306][T16716] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3231'. [ 790.789137][ T5925] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 791.015270][ T5925] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 791.040870][ T5925] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 791.100099][ T5925] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.111891][ T5925] usb 1-1: config 0 descriptor?? [ 791.121964][ T5925] pwc: Askey VC010 type 2 USB webcam detected. [ 791.208294][T16742] block nbd2: Attempted send on invalid socket [ 791.214678][T16742] I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 791.224294][T16742] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 791.310121][T16743] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3240'. [ 791.371009][ T9] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 791.547625][ T9] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 791.557033][ T9] usb 5-1: config 0 has no interface number 0 [ 791.581180][ T9] usb 5-1: config 0 interface 29 has no altsetting 0 [ 791.596473][ T5925] pwc: recv_control_msg error -32 req 02 val 2b00 [ 791.606263][ T5925] pwc: recv_control_msg error -32 req 02 val 2700 [ 791.633414][ T5925] pwc: recv_control_msg error -32 req 02 val 2c00 [ 791.646420][ T5925] pwc: recv_control_msg error -32 req 04 val 1000 [ 791.653640][ T9] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 791.662889][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.663688][ T5925] pwc: recv_control_msg error -32 req 04 val 1300 [ 791.690822][ T9] usb 5-1: Product: syz [ 791.699463][ T9] usb 5-1: Manufacturer: syz [ 791.710816][ T9] usb 5-1: SerialNumber: syz [ 791.726782][ T5925] pwc: recv_control_msg error -32 req 04 val 1400 [ 791.734933][ T5925] pwc: recv_control_msg error -32 req 02 val 2000 [ 791.744358][ T5925] pwc: recv_control_msg error -32 req 02 val 2100 [ 791.752934][ T5925] pwc: recv_control_msg error -32 req 04 val 1500 [ 791.760998][ T5925] pwc: recv_control_msg error -32 req 02 val 2500 [ 791.770781][ T5925] pwc: recv_control_msg error -32 req 02 val 2400 [ 791.778606][ T5925] pwc: recv_control_msg error -32 req 02 val 2600 [ 791.787900][ T5925] pwc: recv_control_msg error -32 req 02 val 2900 [ 791.798066][ T5925] pwc: recv_control_msg error -32 req 02 val 2800 [ 791.981640][ T9] usb 5-1: config 0 descriptor?? [ 792.015402][ T5925] pwc: recv_control_msg error -71 req 04 val 1200 [ 792.196026][ T5925] pwc: Registered as video103. [ 792.229956][ T9] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 792.261749][ T5925] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input31 [ 792.277889][ T5925] usb 1-1: USB disconnect, device number 66 [ 793.156080][T16753] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input32 [ 793.420803][ T30] audit: type=1400 audit(1756724604.416:4182): avc: denied { connect } for pid=16749 comm="syz.2.3243" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 793.597095][T16757] warning: `syz.0.3244' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 795.123327][ T9] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 795.132487][ T9] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 795.551480][ T9] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 795.731785][ T9] usb 5-1: USB disconnect, device number 63 [ 795.760378][T16776] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3247'. [ 795.919813][T16785] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 797.602509][ T30] audit: type=1326 audit(1756724608.886:4183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16794 comm="syz.4.3253" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fce2ad8ebe9 code=0x0 [ 797.961064][ T5996] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 798.401407][ T30] audit: type=1400 audit(1756724609.296:4184): avc: denied { ioctl } for pid=16798 comm="syz.1.3254" path="socket:[63041]" dev="sockfs" ino=63041 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 798.797797][ T5996] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 798.810788][ T5996] usb 3-1: config 0 has no interface number 0 [ 798.816883][ T5996] usb 3-1: config 0 interface 29 has no altsetting 0 [ 798.828929][ T30] audit: type=1400 audit(1756724610.096:4185): avc: denied { bind } for pid=16806 comm="syz.4.3256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 799.794467][ T5996] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 799.880949][ T5996] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 799.896527][T16802] o2cb: This node has not been configured. [ 799.902625][T16802] o2cb: Cluster check failed. Fix errors before retrying. [ 799.909711][T16802] (syz.3.3255,16802,1):user_dlm_register:674 ERROR: status = -22 [ 799.917431][T16802] (syz.3.3255,16802,1):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "bus" [ 799.934189][ T30] audit: type=1400 audit(1756724611.176:4186): avc: denied { add_name } for pid=16801 comm="syz.3.3255" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 800.082987][T16819] block nbd4: Attempted send on invalid socket [ 800.089263][T16819] I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 800.098837][T16819] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 800.123793][ T5996] usb 3-1: Product: syz [ 800.222748][ T5996] usb 3-1: Manufacturer: syz [ 800.227404][ T5996] usb 3-1: SerialNumber: syz [ 800.252622][ T5996] usb 3-1: config 0 descriptor?? [ 800.252998][ T30] audit: type=1400 audit(1756724611.176:4187): avc: denied { create } for pid=16801 comm="syz.3.3255" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 800.800807][ T30] audit: type=1400 audit(1756724611.176:4188): avc: denied { associate } for pid=16801 comm="syz.3.3255" name="bus" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 800.853822][T16825] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3258'. [ 801.320866][ T9] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 801.811665][ T9] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 801.819759][ T9] usb 1-1: config 0 has no interface number 0 [ 801.855400][ T9] usb 1-1: config 0 interface 29 has no altsetting 0 [ 802.091154][ T9] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 802.143009][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.238106][ T9] usb 1-1: Product: syz [ 802.262626][ T9] usb 1-1: Manufacturer: syz [ 802.267303][ T9] usb 1-1: SerialNumber: syz [ 802.274253][ T9] usb 1-1: config 0 descriptor?? [ 802.447746][ T30] audit: type=1400 audit(1756724613.696:4189): avc: denied { append } for pid=16838 comm="syz.1.3263" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 802.562559][ T9] peak_usb 1-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 802.670632][ T5996] usb 3-1: can't set config #0, error -71 [ 802.679723][ T5996] usb 3-1: USB disconnect, device number 70 [ 804.262216][T16864] block nbd4: Attempted send on invalid socket [ 804.268409][T16864] I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 804.782333][T16864] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 804.876246][T16864] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3269'. [ 805.330589][ T30] audit: type=1400 audit(1756724616.386:4190): avc: denied { setopt } for pid=16870 comm="syz.3.3271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 806.195102][ T9] peak_usb 1-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 806.203732][ T9] peak_usb 1-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 806.283717][ T9] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 806.314785][ T9] usb 1-1: USB disconnect, device number 67 [ 806.345899][T16886] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3274'. [ 806.470812][ T5925] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 806.643635][ T30] audit: type=1400 audit(1756724617.896:4191): avc: denied { write } for pid=16891 comm="syz.2.3277" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 806.768184][ T5925] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 806.830949][ T5925] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 806.851726][ T5925] usb 2-1: New USB device found, idVendor=04e7, idProduct=0030, bcdDevice= 0.00 [ 806.865315][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.878980][ T5925] usb 2-1: config 0 descriptor?? [ 807.036522][T16898] block nbd2: Attempted send on invalid socket [ 807.044463][T16900] trusted_key: syz.4.3276 sent an empty control message without MSG_MORE. [ 807.061051][T16898] I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 807.100832][T16898] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 807.234750][T16901] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3278'. [ 807.938578][ T5925] elo 0003:04E7:0030.0039: item fetching failed at offset 5/7 [ 807.948293][ T5925] elo 0003:04E7:0030.0039: parse failed [ 807.955144][ T5925] elo 0003:04E7:0030.0039: probe with driver elo failed with error -22 [ 808.204224][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.217506][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.293461][ T5925] usb 2-1: USB disconnect, device number 67 [ 811.164342][ T9] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 811.686221][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 812.143025][ T9] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 812.161138][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 812.171566][ T9] usb 4-1: config 0 has no interface number 0 [ 812.178099][ T9] usb 4-1: config 0 interface 231 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 812.284508][T16935] block nbd2: Attempted send on invalid socket [ 812.422735][T16935] I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 812.505037][T16935] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 812.700333][ T9] usb 4-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 812.710801][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.728683][ T9] usb 4-1: Product: syz [ 812.738742][ T9] usb 4-1: Manufacturer: syz [ 812.766581][T16943] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3286'. [ 812.861460][ T6014] usb 5-1: new full-speed USB device number 64 using dummy_hcd [ 812.874860][ T9] usb 4-1: SerialNumber: syz [ 812.987861][ T9] usb 4-1: config 0 descriptor?? [ 813.040049][ T9] usb 4-1: can't set config #0, error -71 [ 813.052508][ T9] usb 4-1: USB disconnect, device number 62 [ 813.066200][T16947] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3290'. [ 813.310656][ T6014] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 813.355932][ T6014] usb 5-1: config 0 has no interface number 0 [ 813.839928][ T6014] usb 5-1: config 0 interface 29 has no altsetting 0 [ 813.991251][ T6014] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 814.010636][ T6014] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.032613][ T6014] usb 5-1: Product: syz [ 814.036786][ T6014] usb 5-1: Manufacturer: syz [ 814.042849][ T6014] usb 5-1: SerialNumber: syz [ 814.063980][ T6014] usb 5-1: config 0 descriptor?? [ 814.358479][ T6014] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 815.010181][T16965] block nbd0: Attempted send on invalid socket [ 815.036583][T16965] I/O error, dev nbd0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 815.062367][T16965] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 815.364883][T16965] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3294'. [ 816.492249][T16979] block nbd0: Attempted send on invalid socket [ 816.498432][T16979] I/O error, dev nbd0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 816.509130][T16979] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 816.615854][ T6014] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 816.627060][ T6014] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 816.648947][ T30] audit: type=1400 audit(1756724627.926:4192): avc: denied { read } for pid=16981 comm="syz.1.3297" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 816.815132][T16979] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3296'. [ 816.836403][ T6014] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 817.284020][ T6014] usb 5-1: USB disconnect, device number 64 [ 817.340797][ T30] audit: type=1400 audit(1756724628.076:4193): avc: denied { open } for pid=16981 comm="syz.1.3297" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 817.470824][ T5996] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 817.632228][ T5996] usb 2-1: Using ep0 maxpacket: 16 [ 818.681723][ T5996] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 818.960330][ T5996] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 818.975649][ T5996] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 818.985391][ T5996] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 819.000751][ T5996] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 819.042379][ T5996] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 819.052104][ T5996] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 819.060193][ T5996] usb 2-1: Manufacturer: syz [ 819.074912][ T5996] usb 2-1: config 0 descriptor?? [ 819.941365][ T30] audit: type=1400 audit(1756724631.216:4194): avc: denied { ioctl } for pid=16981 comm="syz.1.3297" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 819.988479][ T5996] rc_core: IR keymap rc-hauppauge not found [ 820.121106][ T5996] Registered IR keymap rc-empty [ 820.128059][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 820.244999][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 820.336290][T17015] block nbd2: Attempted send on invalid socket [ 820.371135][ T5996] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 820.633332][T17022] sp0: Synchronizing with TNC [ 821.497745][T17015] I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 821.548602][ T5996] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input33 [ 821.604218][T17015] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 821.675015][ T30] audit: type=1400 audit(1756724632.956:4195): avc: denied { mount } for pid=17016 comm="syz.3.3304" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 821.703311][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 822.544269][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 822.970983][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 823.068783][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 823.093427][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 824.076573][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 824.971436][T17053] tipc: Enabled bearer , priority 10 [ 825.008909][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 825.381615][ T30] audit: type=1400 audit(1756724635.726:4196): avc: denied { accept } for pid=17039 comm="syz.4.3310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 825.452882][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 825.910539][ T30] audit: type=1400 audit(1756724637.176:4197): avc: denied { map } for pid=17055 comm="syz.1.3313" path="socket:[65079]" dev="sockfs" ino=65079 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 826.247905][ T30] audit: type=1400 audit(1756724637.176:4198): avc: denied { read accept } for pid=17055 comm="syz.1.3313" path="socket:[65079]" dev="sockfs" ino=65079 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 826.272024][ C0] vkms_vblank_simulate: vblank timer overrun [ 826.320147][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 827.127764][ T5996] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 828.175610][ T5996] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 828.325653][ T5996] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 828.408302][T17078] syz_tun: entered allmulticast mode [ 828.433948][ T5996] usb 2-1: USB disconnect, device number 68 [ 828.439424][ T30] audit: type=1400 audit(1756724639.716:4199): avc: denied { mounton } for pid=17080 comm="syz.4.3318" path=2F3639302FE91F7189591E9233614B dev="tmpfs" ino=3621 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 828.467391][T17083] netlink: 'syz.2.3317': attribute type 4 has an invalid length. [ 828.712200][T17077] syz_tun: left allmulticast mode [ 828.735629][T17089] block nbd1: Attempted send on invalid socket [ 828.742024][T17089] I/O error, dev nbd1, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 829.619334][T17089] isofs_fill_super: bread failed, dev=nbd1, iso_blknum=16, block=32 [ 830.824553][T17089] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3319'. [ 831.928008][T17103] kexec: Could not allocate control_code_buffer [ 834.015635][ T30] audit: type=1400 audit(1756724644.746:4200): avc: denied { override_creds } for pid=17120 comm="syz.0.3329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 834.538062][T17128] ptrace attach of "./syz-executor exec"[5849] was attempted by "   jC*p\x1bŖ 3Hej$x2e|yOkYxMxOB B͒GMP%OޜtĎ\x0dT[g]LJ;2$|gP\x22̏R׾{Vd,ru\x0da1i-6M+\x07}T#a5Zd0ƌ{w$)i%L>Q,oQeꮰHrʏ.ҿɷ0JVw^{'ǁo_8v:7>LpF,Z3R<\x07}A\x07B{ g`g/3`0=\x1bJ-^0eyJq -ʹ\x0bL\x0c [ 838.490662][ T5855] usb 5-1: new full-speed USB device number 65 using dummy_hcd [ 839.975668][T17188] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3343'. [ 841.220869][ T5855] usb 5-1: device descriptor read/all, error -71 [ 841.296240][T17197] block nbd3: Attempted send on invalid socket [ 841.302501][T17197] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 841.311958][T17197] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 841.403089][T17197] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3345'. [ 841.850869][ T9] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 842.250924][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 842.485411][ T9] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 842.495466][ T9] usb 2-1: config 0 has no interface number 0 [ 842.601425][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 842.631534][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 842.651638][ T9] usb 2-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 842.723699][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.753855][ T9] usb 2-1: config 0 descriptor?? [ 843.026872][T17221] loop2: detected capacity change from 0 to 7 [ 843.644056][T17221] loop2: p1 p4 [ 843.649391][T17221] loop2: partition table partially beyond EOD, truncated [ 843.656574][T17221] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 843.834036][T17221] loop2: p4 start 2495 is beyond EOD, truncated [ 844.004151][ T9] uclogic 0003:28BD:0071.003A: pen parameters not found [ 844.017873][ T9] uclogic 0003:28BD:0071.003A: interface is invalid, ignoring [ 844.050915][ T9] usb 2-1: USB disconnect, device number 69 [ 844.667969][ T9] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 844.868753][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 844.893887][ T9] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 844.948003][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.006297][ T9] usb 4-1: config 0 descriptor?? [ 845.034376][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 846.060120][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 846.074691][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 846.081627][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 846.091335][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 846.273095][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 846.301613][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 846.320133][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 846.328965][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 846.340501][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 846.368172][ T9] pwc: recv_control_msg error -32 req 02 val 2500 [ 846.379960][ T9] pwc: recv_control_msg error -32 req 02 val 2400 [ 846.391164][ T9] pwc: recv_control_msg error -32 req 02 val 2600 [ 846.402582][ T9] pwc: recv_control_msg error -32 req 02 val 2900 [ 846.583146][T17251] netlink: 'syz.1.3359': attribute type 5 has an invalid length. [ 846.798442][ T9] pwc: recv_control_msg error -32 req 04 val 1100 [ 846.816253][ T9] pwc: Registered as video103. [ 846.816458][T17253] ufs: You didn't specify the type of your ufs filesystem [ 846.816458][T17253] [ 846.816458][T17253] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 846.816458][T17253] [ 846.816458][T17253] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 846.821074][ T30] audit: type=1400 audit(1756724658.076:4201): avc: denied { mounton } for pid=17244 comm="syz.0.3358" path="/50/file0" dev="tmpfs" ino=275 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 846.867569][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input34 [ 846.946542][T17253] ufs: ufstype=old is supported read-only [ 846.983783][T17253] I/O error, dev loop1, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 847.015930][ T5996] usb 4-1: USB disconnect, device number 63 [ 848.302761][T17267] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 848.684542][ T9] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 848.878562][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 848.909017][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 849.102756][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 849.114011][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 849.122640][ T9] usb 5-1: SerialNumber: syz [ 850.132514][T17275] vivid-003: disconnect [ 850.347203][T17270] vivid-003: reconnect [ 850.446881][T17277] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=56793 sclass=netlink_route_socket pid=17277 comm=syz.4.3364 [ 850.831945][ T9] cdc_ether 5-1:1.0: skipping garbage [ 850.837356][ T9] usb 5-1: bad CDC descriptors [ 850.846715][ T9] usb 5-1: USB disconnect, device number 67 [ 852.039740][ T30] audit: type=1400 audit(1756724662.816:4202): avc: denied { getopt } for pid=17284 comm="syz.0.3369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 852.896676][ T5855] usb 4-1: new full-speed USB device number 64 using dummy_hcd [ 854.535267][ T30] audit: type=1400 audit(1756724665.796:4203): avc: denied { ioctl } for pid=17312 comm="syz.0.3377" path="socket:[66491]" dev="sockfs" ino=66491 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 854.537195][T17314] vxcan1 speed is unknown, defaulting to 1000 [ 854.720009][T17319] /dev/nullb0: Can't open blockdev [ 854.826906][ T30] audit: type=1400 audit(1756724665.806:4204): avc: denied { execute } for pid=17312 comm="syz.0.3377" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=66492 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 854.901281][ T30] audit: type=1400 audit(1756724666.186:4205): avc: denied { name_bind } for pid=17312 comm="syz.0.3377" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 856.414160][ T5855] usb 4-1: device descriptor read/all, error -71 [ 857.166428][T17344] block nbd3: Attempted send on invalid socket [ 857.190647][T17344] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 857.801040][T17344] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 857.876702][T17347] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3381'. [ 860.747569][ T30] audit: type=1400 audit(1756724672.026:4206): avc: denied { watch } for pid=17348 comm="syz.1.3384" path="/665/control" dev="tmpfs" ino=3490 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 860.921670][T17385] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3390'. [ 860.940840][ T5996] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 861.374519][T17390] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 861.374519][T17390] Q&|xXX initial count (1876204212 ns). Using initial count to start timer. [ 996.930989][ T9] usb 5-1: new full-speed USB device number 75 using dummy_hcd [ 997.058072][T19083] block nbd3: Attempted send on invalid socket [ 997.064547][T19083] I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 997.073951][T19083] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 997.804711][ T9] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 997.813240][ T9] usb 5-1: config 0 has no interface number 0 [ 997.819408][ T9] usb 5-1: config 0 interface 29 has no altsetting 0 [ 997.920020][T19086] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3698'. [ 998.031521][T19091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3700'. [ 998.075906][ T9] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 998.085035][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.172925][ T9] usb 5-1: Product: syz [ 998.200069][ T9] usb 5-1: Manufacturer: syz [ 998.310770][ T9] usb 5-1: SerialNumber: syz [ 998.348507][ T9] usb 5-1: config 0 descriptor?? [ 999.855471][ T9] peak_usb 5-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 999.907265][ T9] peak_usb 5-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 1000.546641][ T9] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 1000.559217][ T9] usb 5-1: USB disconnect, device number 75 [ 1002.160857][ T30] audit: type=1400 audit(1756724813.326:4320): avc: denied { bind } for pid=19123 comm="syz.1.3709" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1002.678106][ T30] audit: type=1400 audit(1756724813.326:4321): avc: denied { setopt } for pid=19123 comm="syz.1.3709" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1002.718291][ T30] audit: type=1400 audit(1756724813.486:4322): avc: denied { write } for pid=19123 comm="syz.1.3709" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1003.282797][T19131] : entered promiscuous mode [ 1003.419875][ T30] audit: type=1400 audit(1756724814.696:4323): avc: denied { setopt } for pid=19117 comm="syz.3.3707" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1004.642656][ T5855] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1005.060838][ T5855] usb 2-1: Using ep0 maxpacket: 8 [ 1005.067612][ T5855] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1005.078261][ T5855] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1005.087417][ T5855] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1005.107543][ T5855] usb 2-1: Product: syz [ 1005.136048][ T5855] usb 2-1: Manufacturer: syz [ 1005.154851][ T5855] usb 2-1: SerialNumber: syz [ 1005.369041][ T5855] usb 2-1: Handspring Visor / Palm OS: No valid connect info available [ 1005.387793][ T5855] usb 2-1: Handspring Visor / Palm OS: port 216, is for unknown use [ 1005.499281][ T5855] usb 2-1: Handspring Visor / Palm OS: port 253, is for unknown use [ 1005.500818][ T30] audit: type=1400 audit(1756724816.766:4324): avc: denied { shutdown } for pid=19141 comm="syz.2.3713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1005.527610][ T5855] usb 2-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1005.692328][ T30] audit: type=1400 audit(1756724816.846:4325): avc: denied { block_suspend } for pid=19141 comm="syz.2.3713" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1005.949441][ T5855] usb 2-1: palm_os_3_probe - error -71 getting bytes available request [ 1005.992236][ T5855] visor 2-1:1.0: Handspring Visor / Palm OS converter detected [ 1006.022244][ T5855] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1006.062583][ T5855] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1006.103173][ T5855] usb 2-1: USB disconnect, device number 73 [ 1006.127785][ T5855] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1006.261168][ T5855] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1006.306355][ T5855] visor 2-1:1.0: device disconnected [ 1006.955566][ T6014] usb 1-1: new full-speed USB device number 73 using dummy_hcd [ 1007.707910][ T30] audit: type=1400 audit(1756724818.986:4326): avc: denied { append } for pid=19169 comm="syz.4.3718" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1008.958186][T19186] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1008.970681][T19186] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 1008.989155][ T30] audit: type=1400 audit(1756724820.216:4327): avc: denied { mount } for pid=19176 comm="syz.3.3719" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1009.325731][ T30] audit: type=1400 audit(1756724820.566:4328): avc: denied { unmount } for pid=5856 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1009.420174][ T6014] usb 1-1: device descriptor read/all, error -71 [ 1010.717676][ T30] audit: type=1400 audit(1756724821.736:4329): avc: denied { create } for pid=19194 comm="syz.0.3724" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1011.908285][T19206] syz.2.3723 (19206) used greatest stack depth: 17544 bytes left [ 1012.998974][T19219] block nbd1: Attempted send on invalid socket [ 1013.005456][T19219] I/O error, dev nbd1, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1013.111135][T19219] isofs_fill_super: bread failed, dev=nbd1, iso_blknum=16, block=32 [ 1013.271065][T19219] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3726'. [ 1013.983260][T19232] block nbd0: Attempted send on invalid socket [ 1013.989533][T19232] I/O error, dev nbd0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1013.998979][T19232] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 1014.082926][T19232] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3729'. [ 1015.975075][ T30] audit: type=1400 audit(1756724827.236:4330): avc: denied { setopt } for pid=19252 comm="syz.3.3736" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1016.254448][T19256] gtp0: entered promiscuous mode [ 1016.638247][ T5925] usb 1-1: new full-speed USB device number 75 using dummy_hcd [ 1016.899761][ T5925] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 1016.908310][ T5925] usb 1-1: config 0 has no interface number 0 [ 1016.952041][ T5925] usb 1-1: config 0 interface 29 has no altsetting 0 [ 1017.089430][ T5925] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 1017.099399][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.351475][ T5925] usb 1-1: Product: syz [ 1017.355760][ T5925] usb 1-1: Manufacturer: syz [ 1017.436620][ T5925] usb 1-1: SerialNumber: syz [ 1017.447936][ T5925] usb 1-1: config 0 descriptor?? [ 1017.560770][ T6014] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1017.714541][ T6014] usb 2-1: Using ep0 maxpacket: 8 [ 1017.841614][ T6014] usb 2-1: config 0 has an invalid interface number: 56 but max is 0 [ 1018.305288][ T6014] usb 2-1: config 0 has no interface number 0 [ 1018.384636][ T5925] peak_usb 1-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 1018.421175][ T6014] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=c7.76 [ 1018.430483][ T6014] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.703705][ T6014] usb 2-1: Product: syz [ 1018.871742][ T6014] usb 2-1: Manufacturer: syz [ 1018.904216][ T6014] usb 2-1: SerialNumber: syz [ 1018.931702][ T6014] usb 2-1: config 0 descriptor?? [ 1019.132712][ T30] audit: type=1400 audit(1756724830.286:4331): avc: denied { mount } for pid=19271 comm="syz.3.3740" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1019.196085][ T30] audit: type=1400 audit(1756724830.296:4332): avc: denied { mounton } for pid=19271 comm="syz.3.3740" path="/767/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 1019.332956][T19278] overlayfs: failed to clone upperpath [ 1019.555833][ T6014] peak_usb 2-1:0.56: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 1019.713308][ T6014] peak_usb 2-1:0.56 can1: unable to request usb[type=2 value=5] err=-71 [ 1019.726713][ T6014] peak_usb 2-1:0.56: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 1019.993648][ T6014] peak_usb 2-1:0.56: probe with driver peak_usb failed with error -71 [ 1020.007296][ T6014] usb 2-1: USB disconnect, device number 74 [ 1020.753199][ T30] audit: type=1400 audit(1756724832.036:4333): avc: denied { unmount } for pid=5856 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1021.276655][ T30] audit: type=1400 audit(1756724832.256:4334): avc: denied { getopt } for pid=19284 comm="syz.3.3743" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1021.333636][ T5925] peak_usb 1-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 1021.342026][ T5925] peak_usb 1-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 1021.452015][ T5925] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 1021.482029][ T5925] usb 1-1: USB disconnect, device number 75 [ 1022.040779][T19301] overlayfs: missing 'lowerdir' [ 1026.890796][ T43] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1027.051764][T19341] 9pnet_fd: Insufficient options for proto=fd [ 1027.263209][T19348] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3758'. [ 1027.638167][T19357] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3760'. [ 1027.961166][ T9] usb 5-1: new full-speed USB device number 76 using dummy_hcd [ 1028.131737][ T30] audit: type=1400 audit(1756724839.406:4335): avc: denied { create } for pid=19359 comm="syz.2.3761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 1028.691583][ T43] usb 4-1: string descriptor 0 read error: -71 [ 1028.697873][ T43] usb 4-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 1028.704518][ T9] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 1028.723379][ T9] usb 5-1: config 0 has no interface number 0 [ 1028.757254][ T9] usb 5-1: config 0 interface 29 has no altsetting 0 [ 1028.760693][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.777488][ T9] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 1028.796816][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.811632][ T43] usb 4-1: config 0 descriptor?? [ 1028.814794][ T9] usb 5-1: Product: syz [ 1028.826726][ T43] usb 4-1: can't set config #0, error -71 [ 1028.834545][ T9] usb 5-1: Manufacturer: syz [ 1028.916158][ T9] usb 5-1: SerialNumber: syz [ 1028.925808][ T9] usb 5-1: config 0 descriptor?? [ 1029.003461][ T43] usb 4-1: USB disconnect, device number 67 [ 1029.947658][ T9] peak_usb 5-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 1029.981372][T19362] overlayfs: failed to resolve './file1': -2 [ 1030.483933][ T30] audit: type=1400 audit(1756724841.516:4336): avc: denied { watch } for pid=19359 comm="syz.2.3761" path="/777/bus/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=4121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1032.913767][ T30] audit: type=1400 audit(1756724844.176:4337): avc: denied { read } for pid=19401 comm="syz.1.3772" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1032.991982][ T30] audit: type=1400 audit(1756724844.176:4338): avc: denied { open } for pid=19401 comm="syz.1.3772" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1033.121770][ T9] peak_usb 5-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 1033.130216][ T9] peak_usb 5-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 1034.204204][ T1039] Bluetooth: hci5: Frame reassembly failed (-84) [ 1034.221276][ T9] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -71 [ 1034.221756][ T30] audit: type=1400 audit(1756724845.496:4339): avc: denied { accept } for pid=19420 comm="syz.2.3775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1034.232526][ T9] usb 5-1: USB disconnect, device number 76 [ 1036.112119][ T5864] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1036.197449][T19443] ================================================================== [ 1036.205549][T19443] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x7401/0x84c0 [ 1036.213450][T19443] Read of size 1 at addr ffff8880570bc330 by task syz.3.3779/19443 [ 1036.221933][T19443] [ 1036.224240][T19443] CPU: 0 UID: 0 PID: 19443 Comm: syz.3.3779 Not tainted syzkaller #0 PREEMPT(full) [ 1036.224260][T19443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 1036.224269][T19443] Call Trace: [ 1036.224276][T19443] [ 1036.224281][T19443] dump_stack_lvl+0x116/0x1f0 [ 1036.224302][T19443] print_report+0xcd/0x630 [ 1036.224318][T19443] ? __virt_addr_valid+0x81/0x610 [ 1036.224338][T19443] ? __phys_addr+0xe8/0x180 [ 1036.224359][T19443] ? xfrm_state_find+0x7401/0x84c0 [ 1036.224376][T19443] kasan_report+0xe0/0x110 [ 1036.224393][T19443] ? xfrm_state_find+0x7401/0x84c0 [ 1036.224412][T19443] xfrm_state_find+0x7401/0x84c0 [ 1036.224436][T19443] ? __pfx_xfrm_state_find+0x10/0x10 [ 1036.224456][T19443] ? __rt6_find_exception_rcu+0x2cb/0x3c0 [ 1036.224476][T19443] ? rt6_find_cached_rt+0x1d6/0x280 [ 1036.224496][T19443] xfrm_resolve_and_create_bundle+0x4cd/0x3740 [ 1036.224521][T19443] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 1036.224549][T19443] ? find_held_lock+0x2b/0x80 [ 1036.224567][T19443] ? ip6_dst_lookup_tail.constprop.0+0x852/0x2140 [ 1036.224582][T19443] ? xfrm_expand_policies.constprop.0+0x252/0x6a0 [ 1036.224604][T19443] xfrm_lookup_with_ifid+0x2a0/0x1e40 [ 1036.224625][T19443] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 1036.224644][T19443] ? __pfx_ip6_dst_lookup_tail.constprop.0+0x10/0x10 [ 1036.224661][T19443] ? __lock_acquire+0x62e/0x1ce0 [ 1036.224685][T19443] xfrm_lookup_route+0x3b/0x200 [ 1036.224704][T19443] ip6_dst_lookup_flow+0x15c/0x1d0 [ 1036.224719][T19443] ? __pfx_ip6_dst_lookup_flow+0x10/0x10 [ 1036.224732][T19443] ? find_held_lock+0x2b/0x80 [ 1036.224749][T19443] ? rawv6_sendmsg+0xb6e/0x4820 [ 1036.224775][T19443] rawv6_sendmsg+0xe85/0x4820 [ 1036.224799][T19443] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1036.224820][T19443] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1036.224836][T19443] ? avc_has_perm+0x144/0x1f0 [ 1036.224850][T19443] ? __pfx_avc_has_perm+0x10/0x10 [ 1036.224864][T19443] ? lock_acquire+0x179/0x350 [ 1036.224893][T19443] ? __import_iovec+0x1dd/0x650 [ 1036.224912][T19443] ? __might_fault+0xe3/0x190 [ 1036.224926][T19443] ? __might_fault+0x13b/0x190 [ 1036.224939][T19443] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1036.224960][T19443] ? inet_sendmsg+0x11c/0x140 [ 1036.224981][T19443] inet_sendmsg+0x11c/0x140 [ 1036.225002][T19443] ____sys_sendmsg+0x973/0xc70 [ 1036.225023][T19443] ? copy_msghdr_from_user+0x10a/0x160 [ 1036.225038][T19443] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1036.225058][T19443] ? find_held_lock+0x2b/0x80 [ 1036.225075][T19443] ? futex_unqueue+0x133/0x2c0 [ 1036.225097][T19443] ___sys_sendmsg+0x134/0x1d0 [ 1036.225113][T19443] ? __pfx____sys_sendmsg+0x10/0x10 [ 1036.225132][T19443] ? find_held_lock+0x2b/0x80 [ 1036.225154][T19443] __sys_sendmmsg+0x200/0x420 [ 1036.225170][T19443] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1036.225189][T19443] ? __pfx_do_futex+0x10/0x10 [ 1036.225210][T19443] ? rcu_is_watching+0x12/0xc0 [ 1036.225232][T19443] ? xfd_validate_state+0x61/0x180 [ 1036.225254][T19443] ? __sys_setsockopt+0x1c0/0x230 [ 1036.225270][T19443] __x64_sys_sendmmsg+0x9c/0x100 [ 1036.225285][T19443] ? lockdep_hardirqs_on+0x7c/0x110 [ 1036.225301][T19443] do_syscall_64+0xcd/0x4c0 [ 1036.225318][T19443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1036.225333][T19443] RIP: 0033:0x7f1ef318ebe9 [ 1036.225347][T19443] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1036.225361][T19443] RSP: 002b:00007f1ef13b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1036.225376][T19443] RAX: ffffffffffffffda RBX: 00007f1ef33c6180 RCX: 00007f1ef318ebe9 [ 1036.225386][T19443] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 0000000000000006 [ 1036.225396][T19443] RBP: 00007f1ef3211e19 R08: 0000000000000000 R09: 0000000000000000 [ 1036.225405][T19443] R10: 000000000000ffe0 R11: 0000000000000246 R12: 0000000000000000 [ 1036.225414][T19443] R13: 00007f1ef33c6218 R14: 00007f1ef33c6180 R15: 00007fff33645cd8 [ 1036.225428][T19443] [ 1036.225433][T19443] [ 1036.606339][T19443] Allocated by task 16807: [ 1036.610728][T19443] kasan_save_stack+0x33/0x60 [ 1036.615388][T19443] kasan_save_track+0x14/0x30 [ 1036.620042][T19443] __kasan_slab_alloc+0x89/0x90 [ 1036.624870][T19443] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 1036.630308][T19443] xfrm_state_alloc+0x23/0x5c0 [ 1036.635055][T19443] xfrm_state_find+0x31e6/0x84c0 [ 1036.639970][T19443] xfrm_resolve_and_create_bundle+0x4cd/0x3740 [ 1036.646104][T19443] xfrm_lookup_with_ifid+0x2a0/0x1e40 [ 1036.651457][T19443] xfrm_lookup_route+0x3b/0x200 [ 1036.656288][T19443] ip6_dst_lookup_flow+0x15c/0x1d0 [ 1036.661379][T19443] rawv6_sendmsg+0xe85/0x4820 [ 1036.666041][T19443] inet_sendmsg+0x11c/0x140 [ 1036.670530][T19443] ____sys_sendmsg+0x973/0xc70 [ 1036.675276][T19443] ___sys_sendmsg+0x134/0x1d0 [ 1036.679929][T19443] __sys_sendmmsg+0x200/0x420 [ 1036.684587][T19443] __x64_sys_sendmmsg+0x9c/0x100 [ 1036.689503][T19443] do_syscall_64+0xcd/0x4c0 [ 1036.693987][T19443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1036.699857][T19443] [ 1036.702156][T19443] Freed by task 5959: [ 1036.706108][T19443] kasan_save_stack+0x33/0x60 [ 1036.710762][T19443] kasan_save_track+0x14/0x30 [ 1036.715419][T19443] kasan_save_free_info+0x3b/0x60 [ 1036.720431][T19443] __kasan_slab_free+0x60/0x70 [ 1036.725173][T19443] kmem_cache_free+0x2d1/0x4d0 [ 1036.729911][T19443] xfrm_state_gc_task+0x50a/0x770 [ 1036.734912][T19443] process_one_work+0x9cf/0x1b70 [ 1036.739828][T19443] worker_thread+0x6c8/0xf10 [ 1036.744396][T19443] kthread+0x3c5/0x780 [ 1036.748441][T19443] ret_from_fork+0x5d4/0x6f0 [ 1036.753009][T19443] ret_from_fork_asm+0x1a/0x30 [ 1036.757756][T19443] [ 1036.760060][T19443] The buggy address belongs to the object at ffff8880570bc000 [ 1036.760060][T19443] which belongs to the cache xfrm_state of size 928 [ 1036.773999][T19443] The buggy address is located 816 bytes inside of [ 1036.773999][T19443] freed 928-byte region [ffff8880570bc000, ffff8880570bc3a0) [ 1036.787776][T19443] [ 1036.790080][T19443] The buggy address belongs to the physical page: [ 1036.796465][T19443] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880570bddc0 pfn:0x570bc [ 1036.806500][T19443] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1036.814972][T19443] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1036.822492][T19443] page_type: f5(slab) [ 1036.826450][T19443] raw: 00fff00000000040 ffff888020ed9c80 ffffea0000c87000 0000000000000002 [ 1036.835010][T19443] raw: ffff8880570bddc0 00000000000f0004 00000000f5000000 0000000000000000 [ 1036.843570][T19443] head: 00fff00000000040 ffff888020ed9c80 ffffea0000c87000 0000000000000002 [ 1036.852216][T19443] head: ffff8880570bddc0 00000000000f0004 00000000f5000000 0000000000000000 [ 1036.860862][T19443] head: 00fff00000000002 ffffea00015c2f01 00000000ffffffff 00000000ffffffff [ 1036.869514][T19443] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 1036.878156][T19443] page dumped because: kasan: bad access detected [ 1036.884540][T19443] page_owner tracks the page as allocated [ 1036.890227][T19443] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7865, tgid 7864 (syz.3.495), ts 206220530520, free_ts 205543459640 [ 1036.909406][T19443] post_alloc_hook+0x1c0/0x230 [ 1036.914159][T19443] get_page_from_freelist+0x132b/0x38e0 [ 1036.919684][T19443] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 1036.925554][T19443] alloc_pages_mpol+0x1fb/0x550 [ 1036.930385][T19443] new_slab+0x247/0x330 [ 1036.934522][T19443] ___slab_alloc+0xcf2/0x1740 [ 1036.939181][T19443] __slab_alloc.constprop.0+0x56/0xb0 [ 1036.944536][T19443] kmem_cache_alloc_noprof+0xef/0x3b0 [ 1036.949884][T19443] xfrm_state_alloc+0x23/0x5c0 [ 1036.954631][T19443] __find_acq_core+0xb59/0x2900 [ 1036.959457][T19443] xfrm_find_acq+0x7b/0xa0 [ 1036.963849][T19443] xfrm_alloc_userspi+0x58e/0xbb0 [ 1036.968852][T19443] xfrm_user_rcv_msg+0x58b/0xc00 [ 1036.973765][T19443] netlink_rcv_skb+0x155/0x420 [ 1036.978511][T19443] xfrm_netlink_rcv+0x71/0x90 [ 1036.983172][T19443] netlink_unicast+0x5aa/0x870 [ 1036.987916][T19443] page last free pid 6199 tgid 6199 stack trace: [ 1036.994212][T19443] __free_frozen_pages+0x7d5/0x10f0 [ 1036.999395][T19443] qlist_free_all+0x4d/0x120 [ 1037.003962][T19443] kasan_quarantine_reduce+0x195/0x1e0 [ 1037.009395][T19443] __kasan_slab_alloc+0x69/0x90 [ 1037.014222][T19443] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 1037.019656][T19443] flock_lock_inode+0xbe5/0x1030 [ 1037.024571][T19443] locks_lock_inode_wait+0x1da/0x490 [ 1037.029834][T19443] __do_sys_flock+0x446/0x520 [ 1037.034487][T19443] do_syscall_64+0xcd/0x4c0 [ 1037.038971][T19443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1037.044839][T19443] [ 1037.047140][T19443] Memory state around the buggy address: [ 1037.052744][T19443] ffff8880570bc200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.060786][T19443] ffff8880570bc280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.068823][T19443] >ffff8880570bc300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.076855][T19443] ^ [ 1037.082475][T19443] ffff8880570bc380: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 1037.090518][T19443] ffff8880570bc400: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1037.098554][T19443] ================================================================== [ 1037.209811][T19446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3780'. [ 1037.218855][T19446] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3780'. [ 1037.492622][T19443] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1037.499843][T19443] CPU: 1 UID: 0 PID: 19443 Comm: syz.3.3779 Not tainted syzkaller #0 PREEMPT(full) [ 1037.509194][T19443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 1037.519228][T19443] Call Trace: [ 1037.522490][T19443] [ 1037.525400][T19443] dump_stack_lvl+0x3d/0x1f0 [ 1037.529975][T19443] vpanic+0x6e8/0x7a0 [ 1037.533947][T19443] ? __pfx_vpanic+0x10/0x10 [ 1037.538455][T19443] ? __pfx_vprintk_emit+0x10/0x10 [ 1037.543469][T19443] ? xfrm_state_find+0x7401/0x84c0 [ 1037.548566][T19443] panic+0xca/0xd0 [ 1037.552274][T19443] ? __pfx_panic+0x10/0x10 [ 1037.556679][T19443] ? xfrm_state_find+0x7401/0x84c0 [ 1037.561771][T19443] ? preempt_schedule_common+0x44/0xc0 [ 1037.567208][T19443] ? preempt_schedule_thunk+0x16/0x30 [ 1037.572566][T19443] check_panic_on_warn+0xab/0xb0 [ 1037.577484][T19443] end_report+0x107/0x170 [ 1037.581803][T19443] kasan_report+0xee/0x110 [ 1037.586289][T19443] ? xfrm_state_find+0x7401/0x84c0 [ 1037.591383][T19443] xfrm_state_find+0x7401/0x84c0 [ 1037.596306][T19443] ? __pfx_xfrm_state_find+0x10/0x10 [ 1037.601579][T19443] ? __rt6_find_exception_rcu+0x2cb/0x3c0 [ 1037.607288][T19443] ? rt6_find_cached_rt+0x1d6/0x280 [ 1037.612472][T19443] xfrm_resolve_and_create_bundle+0x4cd/0x3740 [ 1037.619140][T19443] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 1037.625747][T19443] ? find_held_lock+0x2b/0x80 [ 1037.630407][T19443] ? ip6_dst_lookup_tail.constprop.0+0x852/0x2140 [ 1037.636801][T19443] ? xfrm_expand_policies.constprop.0+0x252/0x6a0 [ 1037.643202][T19443] xfrm_lookup_with_ifid+0x2a0/0x1e40 [ 1037.648558][T19443] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 1037.654349][T19443] ? __pfx_ip6_dst_lookup_tail.constprop.0+0x10/0x10 [ 1037.661007][T19443] ? __lock_acquire+0x62e/0x1ce0 [ 1037.665933][T19443] xfrm_lookup_route+0x3b/0x200 [ 1037.670767][T19443] ip6_dst_lookup_flow+0x15c/0x1d0 [ 1037.675857][T19443] ? __pfx_ip6_dst_lookup_flow+0x10/0x10 [ 1037.681469][T19443] ? find_held_lock+0x2b/0x80 [ 1037.686130][T19443] ? rawv6_sendmsg+0xb6e/0x4820 [ 1037.690970][T19443] rawv6_sendmsg+0xe85/0x4820 [ 1037.695637][T19443] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1037.700735][T19443] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1037.706087][T19443] ? avc_has_perm+0x144/0x1f0 [ 1037.710742][T19443] ? __pfx_avc_has_perm+0x10/0x10 [ 1037.715745][T19443] ? lock_acquire+0x179/0x350 [ 1037.720415][T19443] ? __import_iovec+0x1dd/0x650 [ 1037.725248][T19443] ? __might_fault+0xe3/0x190 [ 1037.729902][T19443] ? __might_fault+0x13b/0x190 [ 1037.734643][T19443] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1037.739742][T19443] ? inet_sendmsg+0x11c/0x140 [ 1037.744406][T19443] inet_sendmsg+0x11c/0x140 [ 1037.748896][T19443] ____sys_sendmsg+0x973/0xc70 [ 1037.753645][T19443] ? copy_msghdr_from_user+0x10a/0x160 [ 1037.759082][T19443] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1037.764353][T19443] ? find_held_lock+0x2b/0x80 [ 1037.769013][T19443] ? futex_unqueue+0x133/0x2c0 [ 1037.773765][T19443] ___sys_sendmsg+0x134/0x1d0 [ 1037.778421][T19443] ? __pfx____sys_sendmsg+0x10/0x10 [ 1037.783605][T19443] ? find_held_lock+0x2b/0x80 [ 1037.788268][T19443] __sys_sendmmsg+0x200/0x420 [ 1037.792924][T19443] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1037.798104][T19443] ? __pfx_do_futex+0x10/0x10 [ 1037.802769][T19443] ? rcu_is_watching+0x12/0xc0 [ 1037.807520][T19443] ? xfd_validate_state+0x61/0x180 [ 1037.812618][T19443] ? __sys_setsockopt+0x1c0/0x230 [ 1037.817622][T19443] __x64_sys_sendmmsg+0x9c/0x100 [ 1037.822540][T19443] ? lockdep_hardirqs_on+0x7c/0x110 [ 1037.827743][T19443] do_syscall_64+0xcd/0x4c0 [ 1037.832231][T19443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1037.838104][T19443] RIP: 0033:0x7f1ef318ebe9 [ 1037.842499][T19443] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1037.862086][T19443] RSP: 002b:00007f1ef13b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1037.870476][T19443] RAX: ffffffffffffffda RBX: 00007f1ef33c6180 RCX: 00007f1ef318ebe9 [ 1037.878430][T19443] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 0000000000000006 [ 1037.886380][T19443] RBP: 00007f1ef3211e19 R08: 0000000000000000 R09: 0000000000000000 [ 1037.894328][T19443] R10: 000000000000ffe0 R11: 0000000000000246 R12: 0000000000000000 [ 1037.902279][T19443] R13: 00007f1ef33c6218 R14: 00007f1ef33c6180 R15: 00007fff33645cd8 [ 1037.910233][T19443] [ 1037.913445][T19443] Kernel Offset: disabled [ 1037.917747][T19443] Rebooting in 86400 seconds..