last executing test programs: 9.19843871s ago: executing program 2 (id=89): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_dev$media(&(0x7f00000012c0), 0xffff, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r3, 0x80047c05, 0x0) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000100)) 9.190146001s ago: executing program 2 (id=93): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e24, 0x0, @empty}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x20200000, @mcast1, 0x4}, 0x1c) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, &(0x7f00000004c0), 0x0, 0x0, 0x1, 0x1}, 0x28) socketpair(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1a", @ANYRESDEC=r1, @ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_IO_FLUSHER(0x34, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00'}, 0x10) fadvise64(r3, 0x7, 0x7ff, 0xc35a87c3871c6f7f) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000240)=0xc) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x13, &(0x7f0000000200)=0x1, 0x4) prlimit64(0x0, 0x3, &(0x7f0000000140)={0x4, 0xb416}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="140c000043200900400000000300000003000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x4c000) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x4004885) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000004c00)=""/102392, 0x18ff8) socket(0x23, 0x1, 0x0) sendmsg$nl_route(r5, 0x0, 0x4044004) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00'}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000500)=@gettaction={0x70, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fff}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40000}, 0x40041) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000005c0)={'ip_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x1, 0x20, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x4, 0x400, 0x0, 0x9, 0x4, 0x0, @multicast1, @empty}}}}) 8.43661841s ago: executing program 2 (id=96): r0 = memfd_create(0x0, 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$inet(0x2, 0x801, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) sendto$inet(r3, 0x0, 0x0, 0x90, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r6 = socket$phonet(0x23, 0x2, 0x1) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r7 = gettid() r8 = getpid() rt_tgsigqueueinfo(r8, r7, 0x7, &(0x7f0000000080)={0x0, 0x0, 0x4}) r9 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) read(r9, &(0x7f0000000740)=""/384, 0x200008c0) ioctl$SIOCPNDELRESOURCE(r6, 0x89ef, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) close(0xffffffffffffffff) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000003c0)="d800000018007b18e00212ba0d8105040a0a1100fe0f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b01602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) 8.136531005s ago: executing program 2 (id=98): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x0, 0x8110}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0xffffffffffffff89}}}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x48}}, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) timer_create(0x3, 0x0, &(0x7f0000044000)) timer_delete(0x0) connect$can_bcm(r4, &(0x7f0000001200), 0x10) r5 = gettid() openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syslog(0x4, &(0x7f00000000c0)=""/196, 0xc4) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000200)={0x40, 0xe, 0x4, "345f949f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2102400}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x5c, 0x0, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_LABELS_MASK={0x8, 0x17, [0x2]}, @CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @private=0xa010102}}}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x1}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x40004) 6.152861807s ago: executing program 0 (id=107): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r1) tkill(r1, 0x12) ptrace(0x4208, r1) tkill(r1, 0x12) getsockopt$inet6_tcp_int(r0, 0x6, 0x19, 0x0, &(0x7f0000000040)) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000028850000007000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x6a}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r2, 0x7a, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000003c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, &(0x7f0000000400)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0], 0x0, 0x8, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000500), &(0x7f0000000540), 0x8, 0xa8, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) 6.149645879s ago: executing program 0 (id=108): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)="1ce0", 0xffeb, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x141, 0x0, 0x4}, 0x18) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r4 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r4, 0xc0045103, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_INIT(r1, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x1, 0x40}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/267, 0x10b}], 0x1}, 0x8}], 0x1, 0x40000002, 0x0) listen(r0, 0x8) r5 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt(r5, 0x84, 0x7f, 0x0, 0x0) 6.121541107s ago: executing program 3 (id=109): r0 = memfd_create(0x0, 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$inet(0x2, 0x801, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) sendto$inet(r3, 0x0, 0x0, 0x90, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r6 = socket$phonet(0x23, 0x2, 0x1) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r7 = gettid() r8 = getpid() rt_tgsigqueueinfo(r8, r7, 0x7, &(0x7f0000000080)={0x0, 0x0, 0x4}) r9 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) read(r9, &(0x7f0000000740)=""/384, 0x200008c0) ioctl$SIOCPNDELRESOURCE(r6, 0x89ef, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) close(0xffffffffffffffff) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000003c0)="d800000018007b18e00212ba0d8105040a0a1100fe0f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b01602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) 5.652343865s ago: executing program 3 (id=110): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x3, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)}, 0x4008804) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x5, 0x0, 0x7fff0000}]}) socket$pppoe(0x18, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0xe) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x8, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300), 0x4) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioperm(0x7, 0x81, 0x2) r3 = gettid() socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r4, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa3}}, 0x14) (fail_nth: 1) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000001c0)={{0x2, 0x0, 0x75c, 0x1, 0x1}}) mq_open(&(0x7f00000003c0)='\x00\x01\xc1\xd4\x1f[g\xd4\xe6x\x15\xdd\xfb\x01y\x00\x00\x00\x00\x00\x00\x00\xd9\x91Gv\xe2\x83\x93\xaaop\xb4\xc28G\xcfD2A`\xb1]\xfe\xcc\xbf\xf5\xd1\xdb\xc6\x98;b\xe9 \x86\x9b\x84\xadJ\x12\xf6*l\xf6\xd6(\x89<\t\n\xb1a=s\xf4\xa5h\xdc\xcf+E[\xc6\xdc\xd5b\xd3X\xe5Xb>@\b', 0x5bc31c2eecffe92e, 0x15, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x1d2) fcntl$setlease(r5, 0x400, 0x0) truncate(&(0x7f0000000200)='./file0\x00', 0x810001) close_range(r1, 0xffffffffffffffff, 0x0) 5.295514947s ago: executing program 4 (id=112): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x210000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x2}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) write$sndseq(r1, &(0x7f0000000140)=[{0xc, 0x9, 0x7, 0x7, @tick=0x5, {0x0, 0xa}, {0x77, 0x8}, @note={0x6, 0x8, 0x6, 0xb, 0x2}}], 0x1c) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102398, 0x18ffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x49a, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = syz_io_uring_setup(0x117, &(0x7f00000005c0)={0x0, 0x0, 0x8000, 0x2000000, 0x3a5, 0x0, r3}, &(0x7f0000000280)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000240)=0xffff7c00, 0x0, 0x4) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000000c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x2, 0x0, @fd=r4, 0x9, 0x0, 0x7fff, 0x2, 0x0, {0x0, r7}}) socket$netlink(0x10, 0x3, 0x400000000000004) io_uring_enter(r4, 0x47f6, 0x80ffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) socket(0x22, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, &(0x7f0000000100)=0x20000000000000, 0xffffffffffffffff, &(0x7f00000002c0)=0x9, 0x6, 0xa) connect$unix(r8, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000180), 0x54, 0x4000800) recvmmsg(r8, &(0x7f00000000c0), 0x0, 0x40000001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r10 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) r11 = open(&(0x7f00000000c0)='./bus\x00', 0x608343, 0x12) r12 = open(0x0, 0x145542, 0x0) ftruncate(r12, 0x2007ffd) sendfile(r10, r11, 0x0, 0x1000a3) 5.246239138s ago: executing program 4 (id=113): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$tcp_mem(r1, &(0x7f0000000100)={0xffffffffffffffff, 0x20, 0x7418, 0x20, 0x6e}, 0x48) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x1, 0x9, 0xfe}, 0x10) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x9) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x556, 0x400, 0x140, 0x384, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x2}, {0xfffffffd, 0xfffffffb, 0x80}, {0x0, 0x4}, {0x0, 0xfffffffa, 0x8}, 0x1, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0xb80e, 0x0, 0x0, 0x69, 0x3a, 0x100, 0x3, 0x1}) socket$nl_route(0x10, 0x3, 0x0) unshare(0x62040200) 4.941488994s ago: executing program 2 (id=114): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key$user(&(0x7f0000000040), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000b80)={0x84, &(0x7f00000003c0)={0x40, 0x16, 0x4, "abe7c7a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000280)={0x40, 0x11, 0xd, "145933d5926844687275708d97"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0xfd}, &(0x7f0000000380)={0x20, 0x81, 0x1, "f8"}, 0x0, &(0x7f0000000440)={0x20, 0x83, 0x1, "b2"}, 0x0, &(0x7f00000004c0)={0x20, 0x85, 0x3, "c79fad"}}) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000480)={0x14, &(0x7f0000000400)={0x20, 0x10, 0x9, {0x9, 0xe, "63471beb065fb9"}}, &(0x7f0000000440)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000740)={0x44, &(0x7f00000004c0)={0x0, 0xc, 0x63, "f4cd69193633bc6b2bbbc18b27bc5828aaf1e14a9c973464421fa6471bf196fdeb73c542fff5a7900a665c661def33a764d524da4d63a0faacd46b5daa11b4193f71ce4fa182e3baafd11d3a5f31262abfa016cf91e0e1de77165bd43dcb2087db20c2"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0xd}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000600)={0x20, 0x80, 0x1c, {0x9, 0x2, 0xc, 0x1000, 0x8, 0x3, 0x5, 0x6, 0x3, 0xe0, 0xf3b}}, &(0x7f0000000640)={0x20, 0x85, 0x4, 0x7}, &(0x7f0000000680)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000006c0)={0x20, 0x87, 0x2, 0x5}, &(0x7f0000000700)={0x20, 0x89, 0x2, 0x1}}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_NAME={0x8, 0x1, 'TEE\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) keyctl$describe(0x6, 0x0, &(0x7f0000000080)=""/72, 0x48) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000880), r4) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f00000008c0)={0x54, r5, 0x1, 0x70bd25, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x7ff}, {0x6, 0x11, 0x9}, {0x8, 0x15, 0x6}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040010}, 0x4000020) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f0000000800)={0xc4, r5, 0x300, 0x70bd29, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x100000000}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0x65, 0xa9, @random="909d3f3c3229f5ee6fffdd9ec2bd72e955ed6e3ac7ea247f8920ea03489e51ea6ce63dc91b06a8c37f36014c6aa24ed9f9469740fc092e9504d03c59aafcb37be050609c8e6a77bff202a3dd126bb31c18c9b62aaf2353a9bc7a13efbca52cbc76"}, @handle=@pci={{0x8}, {0x11}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40}, 0x40) 4.828706587s ago: executing program 0 (id=115): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000006c0), 0x0, 0x2, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x135000, 0x0) sendmsg$nl_generic(r2, &(0x7f00000004c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="90020000320005002cbd7000ffdbdf250e0000000500ec00000000000c00050001000000000000807b00ed8004008b8004009f801400a900ff01000000000000000000000000000104003d80cabc3adce16f518046b2b6b859b1f2ffff515403d05dd45126282e084d66949eeb766c3cbcf6f7b707deb890ba4726c00f875febea6df73c60656db1bbd01c9ef0b3bb62a0408893b0fef2bf20d9d23f71f269df56503d0041305f461665544f880db2d457fa3349cea9837c0f981192c3c49e86b8ac442a42e1e5ef42773db2fa1e2bb5ec87084e9bcc405290a6abbb410c858856e6d4839bd787fd366d1ceb4f9ce05713b1dc4f4e274393f1266de97fe843000000005b0bcdee40c3289effa7854428e3a8b8d413bccc35144493bf5ac620deb4194d1251e0643abad8752301e286a0d366ca58ea353e8e330ff7061bb8642cfafd2582804aa7791a587dd7737c64820db21167f96e3b0788998893ef0ef1d42ea9ff5e9436d8cb4d9e8c17b065aa68c5908453a05dd9a0b1b03c4df13b6f2174b87041a1ef060046005b00000005001900000000000555b451073ceb2d0d13a4059e627eaafc3fbb12868f44ac13ca5967aa2c823751cc97fba083e0583a698510501abbe0608c5e3c5bbd84a9f1d351495cd60237785e34405c542d5d8ec0a1873c2652b469b4d2b40a51703cffc15c319be42e5ec8fdfccfea31f989334824ee07308d25d58ac06937a16190015d69acdd83e877e365f75caaaac3d7af8501f6e97374b8110f17f524c02922a13bfdc9dd33641935e6183e3ad867df2af8ed00b82392d6e32a577b07a26e1861754fb5293d34d4b48e9e86a2cbd99e6fee5e322fb05e3930212cd15de215ca66b00fec7d896928f845c80839ce13fb8d558a90ce617acc7c7086823c2777000000"], 0x290}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x1) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000000)="fc", 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) syz_init_net_socket$rose(0xb, 0x5, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r4, 0x84, 0x65, &(0x7f0000000500)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) setsockopt$inet_buf(r7, 0x0, 0x11, &(0x7f0000000280)="2c088334e85eece341fd4b042ec9306cf884010431f2e22989b4b7e4c646e371b62aa29cbfcac76ee3f5c07d4b30fca62af3ecb1e34d88c7f7de7c354dd3ec40e5c07f780419e5ef2d2a9bad5dcf825cc44290cfbd0207755b0afb770334c4f1f47ca99af91f8f66604aa8764b289a61b59cc1e87e230c64ee27abfc20f7500764d3f534de5d6f0efdd53cfdad34b3117712f71f5d54069bed13ef95b98db318e4c7a05e8d27d33e", 0xa8) r8 = dup(0xffffffffffffffff) splice(r3, 0x0, r6, 0x0, 0x5, 0x0) r9 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r9, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2d, 0x4e22, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x8000) r10 = syz_io_uring_setup(0xbda, &(0x7f00000006c0)={0x0, 0x5, 0x8000, 0x1, 0x1c0}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) r14 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r14, 0x3ba0, &(0x7f00000000c0)={0x48, 0x2, r16, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r14, 0x3ba0, &(0x7f0000000180)={0x48, 0xa, r17, 0x0, r15}) r18 = fcntl$getown(r10, 0x9) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000580)={'\x00', 0x3, 0x501, 0xb, 0x5, 0x6, r18}) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000028000000090a01040000000000000000070000000900010073797a3000000000080005400000000d2c0000000b0a01020000000000000000070000000900030073797a31000000000900010073797a30"], 0x9c}}, 0x0) syz_io_uring_submit(r11, r12, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL) 4.376809251s ago: executing program 0 (id=117): fsopen(&(0x7f0000000080)='ubifs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x8, 0x0) r2 = syz_open_dev$evdev(0x0, 0x0, 0x0) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty}, 0x20) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000001000500050007000000000008000900000000001400200000000000000000000000e1ffe000000108000a000000000006000200010000"], 0x5c}, 0x1, 0x6c}, 0x0) ioctl$EVIOCRMFF(r2, 0x4004550e, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/timers\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x20000023896) close(r6) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x8000) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r9, 0x0, 0x0}, 0x20) writev(r7, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005a1000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ac4000/0x4000)=nil) 4.376361263s ago: executing program 3 (id=118): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) unshare(0x6a040000) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0xe7, 0xd7, 0x7f, 0x40, 0x12d6, 0x444, 0x293d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcc, 0x0, 0x0, 0x8b, 0xa, 0x2e}}]}}]}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r2 = memfd_create(&(0x7f0000000580)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec=\x9e\xc3\xfd\x85d\x0fl5\xf3\xbe\" 6\r<\xea\x8dz\xcf6\x99\x91\xear8p\xaaR\xd5\xa6\xab#N>\x9a\xdf\xea\x009\xfbB\xc1\xd0_\xc0\'Z\xeb\xd8\xaf\xf0\'J\xe2\xff\xe5x*;(p\xf7p\xce\xbb\xa7\xfe\x04\xd0t\x81\x1a\x1b?m/\x1ex\xf8\x88^\xbaU\xb9\xa6\xab\x8d\a\xa6\"\xd9\x13\xeb\xe2\rh\x8dsx\xaa!\xd5Q\xf8\xce*\x95\x0es\xfaZ\x94t\x19\xdc\xdc\xcf\x0f\x9a\xa2O>\xb9\xfc\x01\fW\xee\xffh\xbd\xb2\xb4z\xeb\x84\x13\x13u\x8f', 0x0) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) 3.979443932s ago: executing program 4 (id=119): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1a0a, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a, 0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad724a1"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000140)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 3.917109711s ago: executing program 4 (id=120): add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x121801, 0x0) r1 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000540)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffff56}) io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x9, 0x3ff, 0xfffffffb, 0x8001, 0x1a, "08400000c38eaad6a4540ad9455fb5031af800"}) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000100)=0x9) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000480)={0x408, 0x7, 0x0, 0xfffc, 0xe, "4415264a100046001113fb235902af2556c6b6"}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$igmp(0x2, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r5, 0x891a, &(0x7f00000001c0)={'veth1_virt_wifi\x00', {0x2, 0x4e23, @multicast1}}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) add_key$user(&(0x7f00000002c0), &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000280)="85952b", 0x3, 0xfffffffffffffffd) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e21, 0x1f0268bc, @empty, 0x6}}, 0x0, 0x0, 0x3fc, 0x1, 0x12, 0x4}, 0x9c) bind$inet6(r4, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x5, &(0x7f0000002500)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000ffffffdc0700001000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2681d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e345c65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e6e83d15645aa818d92b21aa6459512f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa8666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e517232586872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000600001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736dd19363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419dfc75c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a0ea49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2ddf267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed186a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d36df524b760ab92efcce7dd1574a0730a9e015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbe4fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c63fb9450dd03985d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921bd4d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a980010000fdf278218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9d3696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f21d9d5bc27d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c30600a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86da86b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3d70001500e34ad2e1b2e64af4e37211b524e20f4ae1ba89a32bad2af9030f8add5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e90eb1fffffffffffffcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c2615318bf813e788c84409dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5cc98d992f3de7d1cdfb24384b9f11b615c87c441dc970ec896a5af6bf69b50a244bc138a1cae3d220bcff6bcb3058c6e0d1cc0da889710f33f5638f805ce602365492282863cc8092b16656dea03cd50182aabbac78a14506dcbf823bec4a5dad14c4d7353b6a55c28321647df3a85bf9fca4e18aeaf4867e6a3dbdd7a5dbe1a52bddae83fc368404a032b75649cf74d7af8e9e3e43fad643ad3e8575a2bb0507531eac5e10b631575f1360803c8f556e07f292ab66b9bcea0c2f09db289a5934a4f2f5fe5cfc52b270a4a5fa2a8de62dcaf7ef52f1fd84c55e6a0c5a365a3b4e73c4ac6fc26367f3f6c07b06a0874c039622ba2bd369b105f57099f742a000a36c2f044a5de24604f82a1f197d9a70b5a62f794f57ec02df70d459fedd6125ae41479a2661360a79e175f0add2820018d5985183ee80f681403a7d08e0e2b88d0750c90b7ed5fed6f81ce797f3b60445ce811d2b4e45005a5ea06c1fe927af06433cd3885dc954e698a7a73416c73bfab7773a6e5e14338797ce9148cda4c0bf05fb67915aeb3661e755e4e1a0ceedfe8e91ee5361ff4c7c07b422e1443a6616b6eb3c325d5687644a4c0a1d44d9dfd82896f56bdfa0790406984c123e1d37da4a9a9444485e9b1e3b6b548528989d2aecc1e7b6ee92ca19298801105ced8964e000000000000000000000000000000000000000000000000000000000003d1c031ee2fc25c7ad34283187545b1343f7ab862e66cf5bf4ba4dbf5fda31619c05ddb97199ad4d01471e9b3c7f485b1e74d0ed34201915e79d5ed229f0773ab6b38529c45b10d0796e005b6d663b942320339b9fe1d4e393b4bcb596898cde06955a345db3cb956b0e5da1c1dba7046f4d12fc65085302f333516804d9f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) 3.40078998s ago: executing program 1 (id=121): ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, 0x0) socket$igmp(0x2, 0x3, 0x2) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0x1, 0x0, @empty}}}}}, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x5a0b, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 3.376944888s ago: executing program 0 (id=122): r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x2, 0x3fc, 0x0, 0xb0, 0x0, 0xff}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x600, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r1, 0x0, 0x4000080) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000280)={0x0, [[0x7ff], [0x400, 0x2], [0xfff]], '\x00', [{0x0, 0x1, 0x1}]}) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r7, 0x0, 0xa}, 0x18) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES64=r7], 0x0) 3.375238076s ago: executing program 1 (id=123): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)='syz', 0xfffffffffffffff8) add_key$user(0x0, &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000540)="31f4ab74", 0x4, 0xfffffffffffffffd) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = io_uring_setup(0x177f, &(0x7f0000000140)={0x0, 0x99a}) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r8, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) close_range(r7, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r9, 0x6, 0x5, 0x0, &(0x7f0000000280)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x2, 0x1, 0x2, 0xa, 0xc53e, 0x8}, 0x20) r10 = socket(0x1e, 0x1, 0x0) ioctl$SIOCSIFMTU(r10, 0x8922, &(0x7f00000000c0)={'veth1_macvtap\x00', 0x100}) 1.880626689s ago: executing program 1 (id=124): setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e21, @local}], 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, 0x0, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) ioctl$FBIOBLANK(0xffffffffffffffff, 0x4611, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400010bce) r3 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102384, 0x18ff0) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x8) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x107) socket$nl_netfilter(0x10, 0x3, 0xc) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0x3, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000002c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)="58ec51e8797342d1a100f492eb61156ec020e53a0323daf9c968de2af5a9f224da111d456f836acbb91ca09fbef1ec5bcb8ecdc90f0767943530219940d2d86f2866d897e4b7be73c2ec768ae7faa5fdfb34cea3eb2876cc2696b3104be7f561f68221403f2145b362a9220ab3fb9502433f352109b4b9", 0x77}, 0x1, 0x0, 0x0, 0x2004c014}, 0x4008044) listen(0xffffffffffffffff, 0x3) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macsec0\x00'}) 1.82844806s ago: executing program 2 (id=125): r0 = socket$inet6(0xa, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x5, 0x0, 0x2, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000104) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x8911, &(0x7f0000000140)={0xa, 0xfffc, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) shmget$private(0x0, 0x4000, 0x40, &(0x7f0000ffc000/0x4000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x8446}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000000100)={r6}, 0xc) write$binfmt_aout(r5, 0x0, 0xffffffdb) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$ax25(0x3, 0x2, 0xcf) socket$nl_netfilter(0x10, 0x3, 0xc) 1.524236493s ago: executing program 3 (id=126): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r1 = memfd_create(&(0x7f00000008c0)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\xa4\xf4\xe0\xe8\xed\xf4\x1eM\xd8\x17\xfb\'\x9c\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaa`?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n\xa7\x8d\x82\xe3W\x95\xaf\x98\xbb 4>H?\x97Av&\x1b\x03\x83\xbc?\xe4\xca:e>\xb1\x9d\xaa\xa5H\xc9L!q\xa9\xd2I\x88\b\xbc\x0f\xb3\x16\x86\xad\xd24\xd9\xdb\x18\xca&\xe9\xbc\x0e\x88c\xd4\xd4\xd2T\'\xec\xb4W\xe0\xea\xd8]\xcf\\\x17\x02\xbbeY?\xaa#\b\xb9\xd7\xc0\xc9\x95 Y\t(V\x0f\xe4\x8es7\r\xa2\xed\x9c\b\x8f\xdc\xe0\xce\xc80dEA.t\"\b\xbd\xf4\xa5G\x8ee\x98^\x89k\xc5\x18O\xcb\x1f\xef\x11\xb1\xb0\x9e\x9d\x99\x9bx\x82\xe8\x9d\xe1\xd8\xe4\xc4\xa2\x99\x1b\xb4cS\xb9\x81D\xf1\t6Gs\xb1\xfc\xee\xad\x1e\xf2\xf7\xa7\x9ci_O\x1d\x03\x03\x95tB\x88;\x9bYO\xb9\x86i\x14\x1d)\xac\xb6\x8bTTZ\xd3U-<\"\xfd\x15\xf4\xdfy\xb4\xb0\x804\xb5\x9e\xc0\xf3\xa6n', 0x5) syz_emit_ethernet(0x5e, &(0x7f00000003c0)=ANY=[@ANYRESOCT=r1, @ANYRESHEX=r0, @ANYRES64=0x0, @ANYRESDEC=r0, @ANYRES64=r0, @ANYRES16], 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) (async, rerun: 32) ioctl$VHOST_GET_VRING_ENDIAN(r2, 0x4028af11, &(0x7f00000001c0)) (async, rerun: 32) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) (async, rerun: 32) r3 = syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f00000005c0)=r3, 0x12) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x26, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) (rerun: 64) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="34000000000883ec0000000000010000000000000400048005000300010000000900010073797a3000000000060002"], 0x34}}, 0x0) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="14000000020803"], 0x14}}, 0x40000) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async, rerun: 32) openat$cgroup_ro(r4, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) 1.343971897s ago: executing program 3 (id=127): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), r0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0xb0b}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r1 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000340)="1400000023003517d25a806f8b6394f90324fc60", 0x14}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) r8 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x0, @fd=r8, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="1b000000000000001c000000000004"], 0x48) r9 = socket(0x10, 0x803, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$FOU_CMD_ADD(r9, 0x0, 0x4000) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x38, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1114}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r11, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) setresuid(0x0, 0xee00, 0x0) setpriority(0x1, 0x0, 0x4af) 1.200579819s ago: executing program 1 (id=128): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x202002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) fsync(r0) r3 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000001, 0x13, r3, 0x1e67e000) socket$packet(0x11, 0x3, 0x300) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000977000/0x1000)=nil) r4 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 1.036114166s ago: executing program 4 (id=129): getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000040)=""/50, &(0x7f00000001c0)=0x32) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000100)=0x10000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYRES16=r3, @ANYBLOB="a63e8cff48121653fdbc30cfb8cb7786c819344a4c3270f114cea52c2bbd023697e6b592b187329f8ca59ef906013a19a28c088ec8cee23288b3997b514f799648f38498ed6a83daccd00400c30a5e0e14293c9fbdaef4795e3dc77cc81749fe5249beb66025ecb1026d163aa67f99d5fd3cf9a64365ce251150669f95e7628f06ae7b183297222376e123fbc640ac260f9dbba29864d7aff00c7bc9db06f59d4b7b14d19f7997d9b4a4cb40afbdd1f32ec68d6822f17fe1e1f2d204767bd24cee24141daba651e9", @ANYRESDEC=r3], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x891c, &(0x7f0000000540)={'ipvlan0\x00', {0x2, 0x0, @private}}) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r5, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0xfffffffffffffff6, 0x3, 0x0, 0xfffffffffffffffd, 0x524451ff, 0x6, 0x6, 0x100, 0x105}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r7 = dup(r6) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, 0x0, 0x0) ioctl$BLKRRPART(r7, 0x125f, 0x0) kexec_load(0x0, 0x2, &(0x7f00000002c0)=[{0x0, 0x0, 0x1000000, 0x10000}, {0x0, 0x0, 0x3e0002}], 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0xa, 0x190, 0x320, 0x0, 0x180, 0x0, 0x0, {0x0, 0x0, 0x3e00}, {}, {0x0, 0x3}, {}, 0x3, 0x100, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) 286.238273ms ago: executing program 0 (id=130): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$tcp_mem(r1, &(0x7f0000000100)={0xffffffffffffffff, 0x20, 0x7418, 0x20, 0x6e}, 0x48) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x1, 0x9, 0xfe}, 0x10) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x9) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x556, 0x400, 0x140, 0x384, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x2}, {0xfffffffd, 0xfffffffb, 0x80}, {0x0, 0x4}, {0x0, 0xfffffffa, 0x8}, 0x1, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0xb80e, 0x0, 0x0, 0x69, 0x3a, 0x100, 0x3, 0x1}) socket$nl_route(0x10, 0x3, 0x0) unshare(0x62040200) 133.072247ms ago: executing program 3 (id=131): socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_ALLOC_STREAMS(r2, 0x8008551c, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r5, 0x40405514, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x800) bind$alg(r3, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000040)="4dc07f9471633078", 0x8) r9 = accept4(r3, 0x0, 0x0, 0x80000) r10 = dup(r9) r11 = accept4(r10, 0x0, 0x0, 0x0) sendmmsg$unix(r11, &(0x7f0000000080)=[{{0x0, 0x8d, &(0x7f00000009c0)=[{&(0x7f0000000480)='Y', 0xff8d}, {&(0x7f0000000100)="d5", 0xf4240}], 0x2}}], 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) 58.465405ms ago: executing program 1 (id=132): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast2, @loopback, 0x88}, 0x10) 4.471664ms ago: executing program 4 (id=133): r0 = eventfd2(0x0, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000300), 0x100) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2f, &(0x7f0000003940)=0x1, 0x4) setsockopt$sock_int(r3, 0x1, 0x2f, &(0x7f0000003980)=0x7ff, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) socket$netlink(0x10, 0x3, 0xc) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000080)={0x3, 0x0, 0x1, 0x1, 0x10800f61}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x2a, &(0x7f0000000000)=[{0x0, 0xfffffffffffffed7}], 0x1}, 0x24000000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) close_range(r0, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100005dbafc40fd0b00000000010203010902240001eef76e80090400000221efb0000905020200000000002b0582025f8cb65c567fca263655bca02e4f800639be769c16e1e52058565ec43a52e8288322f5b54a944e3f3f"], 0x0) 0s ago: executing program 1 (id=134): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) io_setup(0x81, &(0x7f0000000180)=0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x200800, 0x32) io_submit(r3, 0x1, &(0x7f0000001d00)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, r4, &(0x7f0000000340)='p', 0x300}]) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000"], 0x122}}, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$packet(0x11, 0x2, 0x300) r8 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r8, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000080)={0x0, 0x23, 0x1, "86"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r9, 0x720, &(0x7f0000000140)={0x1, 0x9, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r10, @ANYBLOB="050003"], 0x28}}, 0x10) r11 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r11, 0xc0145608, &(0x7f0000000040)={0x10000, 0xa, 0x1, 0x0, 0xff}) ioctl$VIDIOC_REQBUFS(r11, 0xc0585609, &(0x7f0000000400)={0x0, 0xa, 0x0, 0x0, 0x1}) syncfs(r1) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000180)=ANY=[@ANYBLOB='\b\x00']) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r13, r14, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000240)="67400f07c40249af4b8bb9800000c00f3235010000000f300f20a366450f769e00000100440f20c03588001d00440f22c0460f01c9c4827d24c366bafc0cf0ff07ef87f345a57a43e16806a4", 0x4c}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r14, 0xae80, 0x0) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x379) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000002c0)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000fed000/0x13000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000fea000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fea000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000feb000/0x3000)=nil, &(0x7f00000001c0)="0c948732fa4e4c6b77bc56dc3df4ba0a9ab334c591c27129869ee98fb527565441b1f4d12170125d043cb5acdaf8b29a22397f12f9a69af1e424c255c9d44b4e77763de62f96c5ec6b4197ea0d3b54eee9027718467f5884f0fd196a41b3ae7396280720289e2cf6", 0x68, r14}, 0x68) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.247' (ED25519) to the list of known hosts. [ 45.233363][ T30] audit: type=1400 audit(1755599354.215:62): avc: denied { mounton } for pid=5830 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 45.234658][ T5830] cgroup: Unknown subsys name 'net' [ 45.256185][ T30] audit: type=1400 audit(1755599354.215:63): avc: denied { mount } for pid=5830 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 45.284647][ T30] audit: type=1400 audit(1755599354.275:64): avc: denied { unmount } for pid=5830 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 45.461247][ T5830] cgroup: Unknown subsys name 'cpuset' [ 45.468221][ T5830] cgroup: Unknown subsys name 'rlimit' [ 45.585231][ T30] audit: type=1400 audit(1755599354.565:65): avc: denied { setattr } for pid=5830 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 45.609276][ T30] audit: type=1400 audit(1755599354.565:66): avc: denied { create } for pid=5830 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 45.630029][ T30] audit: type=1400 audit(1755599354.565:67): avc: denied { write } for pid=5830 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 45.650876][ T5832] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 45.654475][ T30] audit: type=1400 audit(1755599354.565:68): avc: denied { read } for pid=5830 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 45.680599][ T30] audit: type=1400 audit(1755599354.565:69): avc: denied { mounton } for pid=5830 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 45.705591][ T30] audit: type=1400 audit(1755599354.565:70): avc: denied { mount } for pid=5830 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 45.728974][ T30] audit: type=1400 audit(1755599354.635:71): avc: denied { read } for pid=5512 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 46.477599][ T5830] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 50.198607][ T5848] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.205823][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 50.213363][ T5848] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.220471][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 50.228078][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 50.235681][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.239932][ T5856] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 50.243132][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.250670][ T5857] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 50.257153][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 50.264485][ T5856] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 50.278687][ T5856] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.285861][ T5857] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 50.285958][ T5848] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 50.293043][ T5856] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 50.300859][ T5859] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 50.307333][ T5857] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 50.314412][ T5848] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 50.321526][ T5856] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 50.336081][ T5858] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 50.336455][ T5856] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 50.343764][ T5858] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 50.350811][ T5856] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 50.364104][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 50.364118][ T30] audit: type=1400 audit(1755599359.335:82): avc: denied { read } for pid=5840 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.398133][ T30] audit: type=1400 audit(1755599359.335:83): avc: denied { open } for pid=5840 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.399239][ T5846] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 50.421678][ T30] audit: type=1400 audit(1755599359.335:84): avc: denied { mounton } for pid=5840 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 50.456827][ T5854] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 50.587949][ T30] audit: type=1400 audit(1755599359.565:85): avc: denied { module_request } for pid=5840 comm="syz-executor" kmod="rtnl-link-nicvf" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 50.642360][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 50.684571][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 50.711741][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 50.751229][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.758288][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.765774][ T5840] bridge_slave_0: entered allmulticast mode [ 50.772169][ T5840] bridge_slave_0: entered promiscuous mode [ 50.784745][ T5850] chnl_net:caif_netlink_parms(): no params data found [ 50.798499][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.805830][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.813062][ T5840] bridge_slave_1: entered allmulticast mode [ 50.819334][ T5840] bridge_slave_1: entered promiscuous mode [ 50.870735][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.887321][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.894952][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.902283][ T5851] bridge_slave_0: entered allmulticast mode [ 50.908586][ T5851] bridge_slave_0: entered promiscuous mode [ 50.916347][ T5842] chnl_net:caif_netlink_parms(): no params data found [ 50.925648][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.949024][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.956152][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.963369][ T5851] bridge_slave_1: entered allmulticast mode [ 50.969613][ T5851] bridge_slave_1: entered promiscuous mode [ 50.985526][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.993083][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.001034][ T5847] bridge_slave_0: entered allmulticast mode [ 51.007281][ T5847] bridge_slave_0: entered promiscuous mode [ 51.013839][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.021019][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.028098][ T5850] bridge_slave_0: entered allmulticast mode [ 51.034475][ T5850] bridge_slave_0: entered promiscuous mode [ 51.048015][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.058229][ T5840] team0: Port device team_slave_0 added [ 51.064078][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.071336][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.078436][ T5847] bridge_slave_1: entered allmulticast mode [ 51.084977][ T5847] bridge_slave_1: entered promiscuous mode [ 51.095792][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.103019][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.110351][ T5850] bridge_slave_1: entered allmulticast mode [ 51.116669][ T5850] bridge_slave_1: entered promiscuous mode [ 51.127486][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.141998][ T5840] team0: Port device team_slave_1 added [ 51.166324][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.182267][ T5851] team0: Port device team_slave_0 added [ 51.193185][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.207734][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.218330][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.233596][ T5851] team0: Port device team_slave_1 added [ 51.244809][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.252355][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.278595][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.301082][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.308265][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.315610][ T5842] bridge_slave_0: entered allmulticast mode [ 51.322088][ T5842] bridge_slave_0: entered promiscuous mode [ 51.328655][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.336070][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.343317][ T5842] bridge_slave_1: entered allmulticast mode [ 51.349585][ T5842] bridge_slave_1: entered promiscuous mode [ 51.356402][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.363418][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.389304][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.400610][ T5847] team0: Port device team_slave_0 added [ 51.421380][ T5847] team0: Port device team_slave_1 added [ 51.428199][ T5850] team0: Port device team_slave_0 added [ 51.435234][ T5850] team0: Port device team_slave_1 added [ 51.441317][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.448228][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.474685][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.496844][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.503838][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.530090][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.545700][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.569152][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.582735][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.589671][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.615627][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.627350][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.634353][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.660286][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.673521][ T5840] hsr_slave_0: entered promiscuous mode [ 51.679425][ T5840] hsr_slave_1: entered promiscuous mode [ 51.694270][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.701444][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.727347][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.738410][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.746088][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.772285][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.789112][ T5842] team0: Port device team_slave_0 added [ 51.808774][ T5842] team0: Port device team_slave_1 added [ 51.826181][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.833411][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.859552][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.872851][ T5851] hsr_slave_0: entered promiscuous mode [ 51.878721][ T5851] hsr_slave_1: entered promiscuous mode [ 51.884566][ T5851] debugfs: 'hsr0' already exists in 'hsr' [ 51.890313][ T5851] Cannot create hsr debugfs directory [ 51.909004][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.916074][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.941947][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.966691][ T5850] hsr_slave_0: entered promiscuous mode [ 51.972673][ T5850] hsr_slave_1: entered promiscuous mode [ 51.978420][ T5850] debugfs: 'hsr0' already exists in 'hsr' [ 51.984153][ T5850] Cannot create hsr debugfs directory [ 52.002961][ T5847] hsr_slave_0: entered promiscuous mode [ 52.009400][ T5847] hsr_slave_1: entered promiscuous mode [ 52.015391][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 52.021159][ T5847] Cannot create hsr debugfs directory [ 52.044592][ T5842] hsr_slave_0: entered promiscuous mode [ 52.050599][ T5842] hsr_slave_1: entered promiscuous mode [ 52.056388][ T5842] debugfs: 'hsr0' already exists in 'hsr' [ 52.062148][ T5842] Cannot create hsr debugfs directory [ 52.162392][ T5840] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 52.183769][ T5840] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 52.204764][ T5840] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 52.213213][ T5840] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 52.271056][ T5851] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 52.283947][ T5851] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 52.292794][ T5851] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 52.302008][ T5851] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 52.345454][ T5847] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 52.357017][ T5847] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 52.366257][ T5847] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 52.375052][ T5847] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 52.389911][ T51] Bluetooth: hci2: command tx timeout [ 52.390418][ T5846] Bluetooth: hci0: command tx timeout [ 52.427311][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.434923][ T5850] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 52.444161][ T5850] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 52.452505][ T5850] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 52.467520][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.479818][ T5846] Bluetooth: hci4: command tx timeout [ 52.480059][ T51] Bluetooth: hci3: command tx timeout [ 52.494316][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.501392][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.509915][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.517063][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.525018][ T5850] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 52.550052][ T51] Bluetooth: hci1: command tx timeout [ 52.563116][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.585161][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.602800][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.609886][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.623178][ T5842] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 52.631811][ T5842] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 52.653496][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.660572][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.671453][ T5842] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 52.680559][ T5842] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 52.697212][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.742562][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.749722][ T30] audit: type=1400 audit(1755599361.725:86): avc: denied { sys_module } for pid=5851 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 52.788782][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.802522][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.809587][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.833227][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.840325][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.884592][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.914358][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.924006][ T3633] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.931091][ T3633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.952389][ T5847] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 52.969275][ T3633] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.976367][ T3633] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.987380][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.019637][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.039531][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.066013][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.073078][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.084475][ T5851] veth0_vlan: entered promiscuous mode [ 53.093200][ T5851] veth1_vlan: entered promiscuous mode [ 53.122952][ T3633] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.130050][ T3633] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.157903][ T5842] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 53.169339][ T5842] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 53.183672][ T5840] veth0_vlan: entered promiscuous mode [ 53.205423][ T5840] veth1_vlan: entered promiscuous mode [ 53.235208][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.258293][ T5851] veth0_macvtap: entered promiscuous mode [ 53.293803][ T5851] veth1_macvtap: entered promiscuous mode [ 53.301498][ T5840] veth0_macvtap: entered promiscuous mode [ 53.315431][ T5840] veth1_macvtap: entered promiscuous mode [ 53.328254][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.345631][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.358930][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.381706][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.411766][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.431795][ T65] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.440612][ T65] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.449311][ T65] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.472076][ T5850] veth0_vlan: entered promiscuous mode [ 53.479544][ T65] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.491820][ T65] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.504386][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.516166][ T65] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.525367][ T3633] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.544407][ T3633] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.565084][ T5850] veth1_vlan: entered promiscuous mode [ 53.587295][ T3633] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.596854][ T3633] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.615235][ T5842] veth0_vlan: entered promiscuous mode [ 53.631028][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.636548][ T5842] veth1_vlan: entered promiscuous mode [ 53.638839][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.669185][ T5847] veth0_vlan: entered promiscuous mode [ 53.675723][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.676333][ T5842] veth0_macvtap: entered promiscuous mode [ 53.691968][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.693297][ T5842] veth1_macvtap: entered promiscuous mode [ 53.714835][ T5847] veth1_vlan: entered promiscuous mode [ 53.721733][ T30] audit: type=1400 audit(1755599362.695:87): avc: denied { mounton } for pid=5851 comm="syz-executor" path="/root/syzkaller.B1PBdh/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 53.739645][ T5847] veth0_macvtap: entered promiscuous mode [ 53.753664][ T30] audit: type=1400 audit(1755599362.695:88): avc: denied { mount } for pid=5851 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 53.763230][ T5850] veth0_macvtap: entered promiscuous mode [ 53.782136][ T30] audit: type=1400 audit(1755599362.695:89): avc: denied { mounton } for pid=5851 comm="syz-executor" path="/root/syzkaller.B1PBdh/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 53.808173][ T30] audit: type=1400 audit(1755599362.695:90): avc: denied { mount } for pid=5851 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 53.825429][ T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.843057][ T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.854267][ T5847] veth1_macvtap: entered promiscuous mode [ 53.860201][ T30] audit: type=1400 audit(1755599362.695:91): avc: denied { mounton } for pid=5851 comm="syz-executor" path="/root/syzkaller.B1PBdh/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 53.891284][ T5851] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 53.891437][ T5850] veth1_macvtap: entered promiscuous mode [ 53.920340][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.933612][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.945269][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.957999][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.981225][ T65] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.991138][ T65] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.013171][ T65] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.024943][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 54.034121][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.050526][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.064987][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.075041][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.088771][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.098159][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.109414][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.127324][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.136393][ T3633] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.147528][ T2959] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.182920][ T2959] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.193669][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.200745][ T2959] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.202008][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.225053][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.233340][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.240920][ T5914] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 54.274190][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.300768][ T5930] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 54.307799][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.319442][ T5962] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5'. [ 54.331289][ T5962] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5'. [ 54.344211][ T3633] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.357747][ T3633] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.376464][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.386912][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.400991][ T5914] usb 1-1: Using ep0 maxpacket: 32 [ 54.414272][ T5914] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 54.441577][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.459833][ T5930] usb 2-1: Using ep0 maxpacket: 32 [ 54.466188][ T5914] usb 1-1: config 0 descriptor?? [ 54.471786][ T51] Bluetooth: hci0: command tx timeout [ 54.471815][ T5846] Bluetooth: hci2: command tx timeout [ 54.495534][ T5930] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 54.511456][ T5930] usb 2-1: config 0 has no interface number 0 [ 54.518762][ T5930] usb 2-1: config 0 interface 184 has no altsetting 0 [ 54.531725][ T5930] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 54.550106][ T5846] Bluetooth: hci4: command tx timeout [ 54.551610][ T51] Bluetooth: hci3: command tx timeout [ 54.564872][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 54.589456][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 54.654083][ T5846] Bluetooth: hci1: command tx timeout [ 54.654116][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 54.669759][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 54.807453][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 54.830070][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 54.838614][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 54.851084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 54.865135][ T5914] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 54.865402][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.890890][ T5930] usb 2-1: Product: syz [ 54.893193][ T5914] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 54.895107][ T5930] usb 2-1: Manufacturer: syz [ 54.895123][ T5930] usb 2-1: SerialNumber: syz [ 54.904927][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 54.909279][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 54.941459][ T5914] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 54.949884][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 54.975535][ T5930] usb 2-1: config 0 descriptor?? [ 54.976442][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 54.991806][ T5914] usb 1-1: media controller created [ 55.002662][ T5930] smsc75xx v1.0.0 [ 55.012108][ T10] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 55.024808][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 55.038829][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.060080][ T5965] netlink: 'syz.3.4': attribute type 10 has an invalid length. [ 55.061570][ T10] usb 5-1: Product: syz [ 55.104966][ T10] usb 5-1: Manufacturer: syz [ 55.114029][ T10] usb 5-1: SerialNumber: syz [ 55.121211][ T10] usb 5-1: config 0 descriptor?? [ 55.129101][ T5965] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 55.141121][ T10] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 55.149969][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 55.429324][ T5962] tipc: Started in network mode [ 55.434731][ T5962] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 55.443560][ T5962] tipc: Enabled bearer , priority 10 [ 55.453971][ T5962] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=54 sclass=netlink_route_socket pid=5962 comm=syz.4.5 [ 55.466689][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 55.466701][ T30] audit: type=1400 audit(1755599364.445:123): avc: denied { read append } for pid=5979 comm="syz.3.6" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 55.518580][ T30] audit: type=1400 audit(1755599364.445:124): avc: denied { open } for pid=5979 comm="syz.3.6" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 55.520729][ T65] usb 5-1: Failed to submit usb control message: -71 [ 55.550034][ T24] usb 5-1: USB disconnect, device number 2 [ 55.585653][ T65] usb 5-1: unable to send the bmi data to the device: -71 [ 55.598190][ T65] usb 5-1: unable to get target info from device [ 55.716873][ T30] audit: type=1400 audit(1755599364.595:125): avc: denied { create } for pid=5979 comm="syz.3.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 56.252607][ T5914] az6027: usb out operation failed. (-71) [ 56.259926][ T5914] stb0899_attach: Driver disabled by Kconfig [ 56.266011][ T5914] az6027: no front-end attached [ 56.266011][ T5914] [ 56.280143][ T5914] az6027: usb out operation failed. (-71) [ 56.280504][ T65] usb 5-1: could not get target info (-71) [ 56.305901][ T65] usb 5-1: could not probe fw (-71) [ 56.358046][ T5914] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 56.404340][ T30] audit: type=1400 audit(1755599364.595:126): avc: denied { setopt } for pid=5979 comm="syz.3.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 56.470529][ T10] tipc: Node number set to 10005162 [ 56.625705][ T51] Bluetooth: hci0: command tx timeout [ 56.637974][ T51] Bluetooth: hci2: command tx timeout [ 56.643665][ T51] Bluetooth: hci4: command tx timeout [ 56.649209][ T30] audit: type=1400 audit(1755599364.595:127): avc: denied { read write } for pid=5979 comm="syz.3.6" name="video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 56.673935][ T30] audit: type=1400 audit(1755599364.595:128): avc: denied { open } for pid=5979 comm="syz.3.6" path="/dev/video2" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 56.686889][ T5914] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 56.697705][ T30] audit: type=1400 audit(1755599364.595:129): avc: denied { ioctl } for pid=5979 comm="syz.3.6" path="/dev/video2" dev="devtmpfs" ino=932 ioctlcmd=0x5605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 56.734768][ T5914] dvb-usb: schedule remote query interval to 400 msecs. [ 56.741953][ T5846] Bluetooth: hci1: command tx timeout [ 56.741977][ T5846] Bluetooth: hci3: command tx timeout [ 56.750716][ T30] audit: type=1400 audit(1755599364.595:130): avc: denied { name_bind } for pid=5979 comm="syz.3.6" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 56.788927][ T30] audit: type=1400 audit(1755599364.595:131): avc: denied { node_bind } for pid=5979 comm="syz.3.6" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 56.811024][ T30] audit: type=1400 audit(1755599364.595:132): avc: denied { read write } for pid=5979 comm="syz.3.6" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.916119][ T5991] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 56.923428][ T5991] IPv6: NLM_F_CREATE should be set when creating new route [ 56.930754][ T5991] IPv6: NLM_F_CREATE should be set when creating new route [ 56.938009][ T5991] IPv6: NLM_F_CREATE should be set when creating new route [ 57.113493][ T5914] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 57.141970][ T5914] usb 1-1: USB disconnect, device number 2 [ 57.158232][ T5930] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 57.413683][ T6003] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 57.420953][ T6003] IPv6: NLM_F_CREATE should be set when creating new route [ 57.428222][ T6003] IPv6: NLM_F_CREATE should be set when creating new route [ 57.435508][ T6003] IPv6: NLM_F_CREATE should be set when creating new route [ 57.621429][ T6002] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11'. [ 57.621460][ T5914] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 57.700264][ T5999] mkiss: ax0: crc mode is auto. [ 57.828857][ T6009] vlan2: entered promiscuous mode [ 57.834676][ T6009] bridge0: entered promiscuous mode [ 57.840179][ T6009] vlan2: entered allmulticast mode [ 57.845583][ T6009] bridge0: entered allmulticast mode [ 57.925055][ T6009] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12'. [ 58.010980][ T6013] fuse: Bad value for 'fd' [ 58.159181][ T6016] FAULT_INJECTION: forcing a failure. [ 58.159181][ T6016] name failslab, interval 1, probability 0, space 0, times 1 [ 58.201946][ T6016] CPU: 1 UID: 0 PID: 6016 Comm: syz.4.14 Not tainted 6.17.0-rc2-syzkaller-00028-gbe48bcf004f9 #0 PREEMPT(full) [ 58.201973][ T6016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 58.201982][ T6016] Call Trace: [ 58.201990][ T6016] [ 58.201996][ T6016] dump_stack_lvl+0x16c/0x1f0 [ 58.202018][ T6016] should_fail_ex+0x512/0x640 [ 58.202031][ T6016] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 58.202047][ T6016] should_failslab+0xc2/0x120 [ 58.202059][ T6016] __kmalloc_noprof+0xd2/0x510 [ 58.202071][ T6016] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 58.202086][ T6016] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 58.202101][ T6016] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 58.202117][ T6016] ? bpf_lsm_capable+0x9/0x10 [ 58.202132][ T6016] ? security_capable+0x7e/0x260 [ 58.202144][ T6016] ? ns_capable+0xd7/0x110 [ 58.202156][ T6016] genl_rcv_msg+0x55c/0x800 [ 58.202169][ T6016] ? __pfx_genl_rcv_msg+0x10/0x10 [ 58.202182][ T6016] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 58.202197][ T6016] ? __pfx_nl80211_tx_control_port+0x10/0x10 [ 58.202210][ T6016] ? __pfx_nl80211_post_doit+0x10/0x10 [ 58.202223][ T6016] netlink_rcv_skb+0x155/0x420 [ 58.202234][ T6016] ? __pfx_genl_rcv_msg+0x10/0x10 [ 58.202247][ T6016] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 58.202260][ T6016] ? netlink_deliver_tap+0x1ae/0xd30 [ 58.202270][ T6016] genl_rcv+0x28/0x40 [ 58.202281][ T6016] netlink_unicast+0x5aa/0x870 [ 58.202293][ T6016] ? __pfx_netlink_unicast+0x10/0x10 [ 58.202304][ T6016] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 58.202316][ T6016] netlink_sendmsg+0x8d1/0xdd0 [ 58.202327][ T6016] ? __pfx_netlink_sendmsg+0x10/0x10 [ 58.202340][ T6016] ____sys_sendmsg+0xa95/0xc70 [ 58.202354][ T6016] ? copy_msghdr_from_user+0x10a/0x160 [ 58.202363][ T6016] ? __pfx_____sys_sendmsg+0x10/0x10 [ 58.202376][ T6016] ? __pfx_kstrtouint+0x10/0x10 [ 58.202386][ T6016] ? kstrtouint_from_user+0x13c/0x1d0 [ 58.202396][ T6016] ___sys_sendmsg+0x134/0x1d0 [ 58.202406][ T6016] ? __pfx____sys_sendmsg+0x10/0x10 [ 58.202417][ T6016] ? rcu_is_watching+0x12/0xc0 [ 58.202434][ T6016] __sys_sendmsg+0x16d/0x220 [ 58.202443][ T6016] ? __pfx___sys_sendmsg+0x10/0x10 [ 58.202455][ T6016] ? fput+0x9b/0xd0 [ 58.202469][ T6016] do_syscall_64+0xcd/0x4c0 [ 58.202480][ T6016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.202491][ T6016] RIP: 0033:0x7f93ccd8ebe9 [ 58.202499][ T6016] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.202509][ T6016] RSP: 002b:00007f93cdcb6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 58.202519][ T6016] RAX: ffffffffffffffda RBX: 00007f93ccfb5fa0 RCX: 00007f93ccd8ebe9 [ 58.202525][ T6016] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000004 [ 58.202531][ T6016] RBP: 00007f93cdcb6090 R08: 0000000000000000 R09: 0000000000000000 [ 58.202539][ T6016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 58.202544][ T6016] R13: 00007f93ccfb6038 R14: 00007f93ccfb5fa0 R15: 00007ffe0523fe68 [ 58.202553][ T6016] [ 58.710195][ T5846] Bluetooth: hci4: command tx timeout [ 58.715616][ T5846] Bluetooth: hci2: command tx timeout [ 58.721009][ T5846] Bluetooth: hci0: command tx timeout [ 58.840912][ T5854] Bluetooth: hci3: command tx timeout [ 58.847077][ T5930] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 58.849082][ T5846] Bluetooth: hci1: command tx timeout [ 58.873860][ T5930] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 58.929825][ T5880] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 59.169479][ T5930] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 59.179889][ T5930] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 59.189481][ T5930] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 59.217839][ T5930] usb 2-1: USB disconnect, device number 2 [ 59.272645][ T5880] usb 5-1: Using ep0 maxpacket: 32 [ 59.289949][ T43] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 59.305086][ T5880] usb 5-1: descriptor type invalid, skip [ 59.317719][ T5880] usb 5-1: descriptor type invalid, skip [ 59.488317][ T5880] usb 5-1: descriptor type invalid, skip [ 59.494276][ T5880] usb 5-1: descriptor type invalid, skip [ 59.500846][ T5880] usb 5-1: descriptor type invalid, skip [ 59.507604][ T5880] usb 5-1: descriptor type invalid, skip [ 59.518952][ T5880] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 59.527825][ T5880] usb 5-1: can't read configurations, error -61 [ 59.560460][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 59.571512][ T43] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 59.581970][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.717556][ T5880] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 59.856148][ T43] usb 3-1: config 0 descriptor?? [ 59.865323][ T6038] Zero length message leads to an empty skb [ 59.909866][ T5880] usb 5-1: Using ep0 maxpacket: 32 [ 59.917548][ T5880] usb 5-1: descriptor type invalid, skip [ 59.924589][ T5880] usb 5-1: descriptor type invalid, skip [ 59.939366][ T5880] usb 5-1: descriptor type invalid, skip [ 59.951974][ T5880] usb 5-1: descriptor type invalid, skip [ 59.957639][ T5880] usb 5-1: descriptor type invalid, skip [ 59.964120][ T5880] usb 5-1: descriptor type invalid, skip [ 59.972218][ T5880] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 59.992234][ T5880] usb 5-1: can't read configurations, error -61 [ 59.998868][ T5880] usb usb5-port1: attempt power cycle [ 60.108098][ T43] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 60.121536][ T6053] netlink: 'syz.1.26': attribute type 1 has an invalid length. [ 60.132795][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 60.224485][ T43] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 60.429930][ T43] usb 3-1: media controller created [ 60.478990][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 60.537907][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 60.537921][ T30] audit: type=1400 audit(1755599369.515:184): avc: denied { map_create } for pid=6068 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 60.581238][ T5880] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 60.593457][ T30] audit: type=1400 audit(1755599369.515:185): avc: denied { map_read map_write } for pid=6068 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 60.622883][ T5880] usb 5-1: Using ep0 maxpacket: 32 [ 60.648950][ T5880] usb 5-1: descriptor type invalid, skip [ 60.654781][ T5880] usb 5-1: descriptor type invalid, skip [ 60.661391][ T5880] usb 5-1: descriptor type invalid, skip [ 60.667100][ T5880] usb 5-1: descriptor type invalid, skip [ 60.675119][ T5880] usb 5-1: descriptor type invalid, skip [ 60.681495][ T5880] usb 5-1: descriptor type invalid, skip [ 60.697799][ T5880] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 60.705683][ T5880] usb 5-1: can't read configurations, error -61 [ 60.748830][ T6074] ubi31: attaching mtd0 [ 60.758890][ T6074] ubi31: scanning is finished [ 60.765809][ T6074] ubi31: empty MTD device detected [ 60.943581][ T5846] Bluetooth: hci3: command 0x0405 tx timeout [ 61.096031][ T5880] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 61.120587][ T5880] usb 5-1: Using ep0 maxpacket: 32 [ 61.126803][ T5880] usb 5-1: descriptor type invalid, skip [ 61.133065][ T5880] usb 5-1: descriptor type invalid, skip [ 61.138948][ T5880] usb 5-1: descriptor type invalid, skip [ 61.155289][ T5880] usb 5-1: descriptor type invalid, skip [ 61.173008][ T5880] usb 5-1: descriptor type invalid, skip [ 61.188669][ T5880] usb 5-1: descriptor type invalid, skip [ 61.235666][ T5880] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 61.244657][ T5880] usb 5-1: can't read configurations, error -61 [ 61.256396][ T5880] usb usb5-port1: unable to enumerate USB device [ 61.371980][ T6074] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 61.436834][ T30] audit: type=1400 audit(1755599370.415:186): avc: denied { unmount } for pid=6078 comm="syz.3.30" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 61.449800][ T43] stb0899_attach: Driver disabled by Kconfig [ 61.463183][ T43] az6027: no front-end attached [ 61.463183][ T43] [ 61.494373][ T43] az6027: usb out operation failed. (-71) [ 61.509210][ T43] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 61.522440][ T30] audit: type=1400 audit(1755599370.505:187): avc: denied { allowed } for pid=6082 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 61.541487][ C0] vkms_vblank_simulate: vblank timer overrun [ 61.574188][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input6 [ 61.620795][ T43] dvb-usb: schedule remote query interval to 400 msecs. [ 61.639191][ T43] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 61.661305][ T43] usb 3-1: USB disconnect, device number 2 [ 61.704593][ T30] audit: type=1400 audit(1755599370.605:188): avc: denied { sqpoll } for pid=6082 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 61.764808][ T30] audit: type=1400 audit(1755599370.605:190): avc: denied { write } for pid=6085 comm="syz.4.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 61.786393][ T43] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 61.787313][ T30] audit: type=1400 audit(1755599370.605:189): avc: denied { create } for pid=6082 comm="syz.0.31" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 61.821159][ T30] audit: type=1400 audit(1755599370.615:191): avc: denied { map } for pid=6082 comm="syz.0.31" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8646 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 61.844956][ C0] vkms_vblank_simulate: vblank timer overrun [ 61.952667][ T6096] overlayfs: failed to resolve './file1': -2 [ 62.164298][ T6098] netlink: 4 bytes leftover after parsing attributes in process `syz.0.33'. [ 62.174942][ T30] audit: type=1400 audit(1755599370.615:192): avc: denied { read write } for pid=6082 comm="syz.0.31" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8646 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 62.203410][ T30] audit: type=1400 audit(1755599370.665:193): avc: denied { bind } for pid=6082 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 62.489847][ T5894] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 62.825297][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 62.835174][ T5894] usb 4-1: New USB device found, idVendor=056a, idProduct=00de, bcdDevice= 0.00 [ 62.847606][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.861649][ T5894] usb 4-1: config 0 descriptor?? [ 63.317577][ T6116] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 63.362402][ T5894] wacom 0003:056A:00DE.0001: Unknown device_type for 'HID 056a:00de'. Assuming pen. [ 63.388251][ T5894] wacom 0003:056A:00DE.0001: hidraw0: USB HID v0.00 Device [HID 056a:00de] on usb-dummy_hcd.3-1/input0 [ 63.744599][ T5894] input: Wacom Bamboo 16FG 4x5 Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:00DE.0001/input/input7 [ 63.822272][ T5894] usb 4-1: USB disconnect, device number 2 [ 63.865307][ T6127] fido_id[6127]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 64.274993][ T6131] netlink: 12 bytes leftover after parsing attributes in process `syz.4.42'. [ 64.338194][ T6142] netlink: 44 bytes leftover after parsing attributes in process `syz.4.42'. [ 64.809911][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 64.973846][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 64.992193][ T9] usb 3-1: config 176 has an invalid interface number: 142 but max is 0 [ 65.001878][ T9] usb 3-1: config 176 has no interface number 0 [ 65.008149][ T9] usb 3-1: config 176 interface 142 has no altsetting 0 [ 65.021231][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=9e.3c [ 65.032290][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.041204][ T9] usb 3-1: Product: ⮄䧔孕跗爤⋠ꃝ귙⡺ [ 65.048010][ T9] usb 3-1: SerialNumber: syz [ 65.049891][ T43] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 65.219913][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 65.234593][ T43] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 65.247795][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.257193][ T43] usb 1-1: Product: syz [ 65.261518][ T43] usb 1-1: Manufacturer: syz [ 65.266187][ T43] usb 1-1: SerialNumber: syz [ 65.272479][ T43] usb 1-1: config 0 descriptor?? [ 65.279063][ T43] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 65.287202][ T43] usb 1-1: Detected FT232H [ 65.313002][ T9] usb 3-1: Found UVC 0.00 device ⮄䧔孕跗爤⋠ꃝ귙⡺ (046d:087c) [ 65.322813][ T9] usb 3-1: No valid video chain found. [ 65.330738][ T9] usb 3-1: USB disconnect, device number 3 [ 65.479654][ T43] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 65.489926][ T5880] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 65.639817][ T5880] usb 4-1: Using ep0 maxpacket: 32 [ 65.646234][ T5880] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 65.656173][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.665681][ T5880] usb 4-1: config 0 descriptor?? [ 65.721946][ T43] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 65.731634][ T43] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 65.741430][ T43] usb 1-1: USB disconnect, device number 3 [ 65.748654][ T43] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 65.761632][ T43] ftdi_sio 1-1:0.0: device disconnected [ 65.866410][ T6164] ======================================================= [ 65.866410][ T6164] WARNING: The mand mount option has been deprecated and [ 65.866410][ T6164] and is ignored by this kernel. Remove the mand [ 65.866410][ T6164] option from the mount to silence this warning. [ 65.866410][ T6164] ======================================================= [ 65.901244][ C0] vkms_vblank_simulate: vblank timer overrun [ 65.924792][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 65.924808][ T30] audit: type=1400 audit(1755599374.905:216): avc: denied { name_connect } for pid=6160 comm="syz.4.53" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 65.965303][ T30] audit: type=1400 audit(1755599374.945:217): avc: denied { mount } for pid=6162 comm="syz.2.52" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 65.970608][ T6163] overlayfs: workdir and upperdir must reside under the same mount [ 65.987969][ T30] audit: type=1400 audit(1755599374.955:218): avc: denied { mounton } for pid=6162 comm="syz.2.52" path="/8/bus" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 66.055622][ T30] audit: type=1400 audit(1755599374.995:219): avc: denied { shutdown } for pid=6160 comm="syz.4.53" lport=54567 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 66.078445][ T5880] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 66.097772][ T30] audit: type=1400 audit(1755599374.995:220): avc: denied { read } for pid=6160 comm="syz.4.53" lport=54567 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 66.119081][ T5880] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 66.167785][ T5880] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 66.205308][ T6174] warning: `syz.4.56' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 66.225088][ T5880] usb 4-1: media controller created [ 66.410659][ T5880] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 66.970635][ T30] audit: type=1400 audit(1755599375.055:221): avc: denied { create } for pid=6169 comm="syz.4.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 66.990405][ T30] audit: type=1400 audit(1755599375.055:222): avc: denied { write } for pid=6169 comm="syz.4.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 67.009782][ T30] audit: type=1400 audit(1755599375.205:223): avc: denied { unmount } for pid=5842 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 67.030301][ T30] audit: type=1326 audit(1755599375.225:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6173 comm="syz.4.56" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f93ccd8ebe9 code=0x7ffc0000 [ 67.056037][ T30] audit: type=1326 audit(1755599375.225:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6173 comm="syz.4.56" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f93ccd8ebe9 code=0x7ffc0000 [ 67.079680][ T6179] netlink: 'syz.0.59': attribute type 1 has an invalid length. [ 68.510077][ T5880] az6027: usb out operation failed. (-71) [ 68.516386][ T5880] stb0899_attach: Driver disabled by Kconfig [ 68.523397][ T5880] az6027: no front-end attached [ 68.523397][ T5880] [ 68.532758][ T5880] az6027: usb out operation failed. (-71) [ 68.538694][ T5880] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 68.549822][ T43] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 68.590961][ T6206] netlink: 'syz.1.64': attribute type 10 has an invalid length. [ 68.605700][ T6206] veth0_vlan: left promiscuous mode [ 68.612707][ T6206] veth0_vlan: entered promiscuous mode [ 68.621763][ T6206] team0: Device veth0_vlan failed to register rx_handler [ 68.761635][ T43] usb 5-1: device descriptor read/64, error -71 [ 68.782546][ T5880] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input10 [ 68.811606][ T5880] dvb-usb: schedule remote query interval to 400 msecs. [ 68.829465][ T5880] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 68.851306][ T5880] usb 4-1: USB disconnect, device number 3 [ 68.881202][ T5880] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 68.950136][ T24] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 69.019840][ T43] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 69.149924][ T43] usb 5-1: device descriptor read/64, error -71 [ 69.171192][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 43488, setting to 64 [ 69.202092][ T24] usb 2-1: New USB device found, idVendor=056a, idProduct=0217, bcdDevice= 0.fc [ 69.243296][ T24] usb 2-1: New USB device strings: Mfr=0, Product=19, SerialNumber=0 [ 69.287982][ T43] usb usb5-port1: attempt power cycle [ 69.296723][ T24] usb 2-1: Product: syz [ 69.303347][ T24] usb 2-1: config 0 descriptor?? [ 69.562138][ T6206] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 69.570218][ T6220] netlink: 36 bytes leftover after parsing attributes in process `syz.2.69'. [ 69.579197][ T6220] netlink: 16 bytes leftover after parsing attributes in process `syz.2.69'. [ 69.579265][ T51] Bluetooth: hci3: ISO packet for unknown connection handle 0 [ 69.588138][ T6220] netlink: 36 bytes leftover after parsing attributes in process `syz.2.69'. [ 69.605831][ T6220] netlink: 36 bytes leftover after parsing attributes in process `syz.2.69'. [ 69.659862][ T43] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 69.680410][ T43] usb 5-1: device descriptor read/8, error -71 [ 69.906707][ T6225] FAULT_INJECTION: forcing a failure. [ 69.906707][ T6225] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 69.919858][ T43] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 69.934140][ T6225] CPU: 0 UID: 0 PID: 6225 Comm: syz.0.71 Not tainted 6.17.0-rc2-syzkaller-00028-gbe48bcf004f9 #0 PREEMPT(full) [ 69.934166][ T6225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 69.934175][ T6225] Call Trace: [ 69.934179][ T6225] [ 69.934186][ T6225] dump_stack_lvl+0x16c/0x1f0 [ 69.934206][ T6225] should_fail_ex+0x512/0x640 [ 69.934226][ T6225] _copy_from_user+0x2e/0xd0 [ 69.934246][ T6225] binder_ioctl+0x51c/0x71f0 [ 69.934268][ T6225] ? tomoyo_path_number_perm+0x295/0x580 [ 69.934294][ T6225] ? tomoyo_path_number_perm+0x18d/0x580 [ 69.934309][ T6225] ? __pfx_binder_ioctl+0x10/0x10 [ 69.934322][ T6225] ? preempt_count_add+0x76/0x150 [ 69.934332][ T6225] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 69.934345][ T6225] ? do_vfs_ioctl+0x128/0x14f0 [ 69.934371][ T6225] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 69.934393][ T6225] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 69.934419][ T6225] ? hook_file_ioctl_common+0x145/0x410 [ 69.934436][ T6225] ? selinux_file_ioctl+0x180/0x270 [ 69.934450][ T6225] ? selinux_file_ioctl+0xb4/0x270 [ 69.934464][ T6225] ? __pfx_binder_ioctl+0x10/0x10 [ 69.934477][ T6225] __x64_sys_ioctl+0x18e/0x210 [ 69.934493][ T6225] do_syscall_64+0xcd/0x4c0 [ 69.934507][ T6225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.934522][ T6225] RIP: 0033:0x7f82f818ebe9 [ 69.934535][ T6225] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.934549][ T6225] RSP: 002b:00007f82f8ffa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.934565][ T6225] RAX: ffffffffffffffda RBX: 00007f82f83b5fa0 RCX: 00007f82f818ebe9 [ 69.934574][ T6225] RDX: 0000200000000300 RSI: 00000000c0306201 RDI: 0000000000000004 [ 69.934582][ T6225] RBP: 00007f82f8ffa090 R08: 0000000000000000 R09: 0000000000000000 [ 69.934588][ T6225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 69.934593][ T6225] R13: 00007f82f83b6038 R14: 00007f82f83b5fa0 R15: 00007fffd9c03668 [ 69.934602][ T6225] [ 69.934607][ T6225] binder: 6224:6225 ioctl c0306201 200000000300 returned -14 [ 69.940152][ T43] usb 5-1: device descriptor read/8, error -71 [ 70.160828][ T24] wacom 0003:056A:0217.0002: Unknown device_type for 'syz'. Ignoring. [ 70.497600][ T6205] netlink: 24 bytes leftover after parsing attributes in process `syz.1.64'. [ 70.513050][ T6233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.73'. [ 70.588088][ T43] usb usb5-port1: unable to enumerate USB device [ 70.766796][ T6242] mmap: syz.2.73 (6242) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 71.003462][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 71.003478][ T30] audit: type=1400 audit(1755599379.984:248): avc: denied { block_suspend } for pid=6239 comm="syz.3.75" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 71.003506][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.040821][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.212924][ T6245] netlink: 'syz.0.76': attribute type 1 has an invalid length. [ 71.269819][ T43] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 71.420013][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 71.426631][ T43] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 71.437532][ T43] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 71.446850][ T43] usb 4-1: New USB device found, idVendor=04ae, idProduct=8215, bcdDevice=8f.58 [ 71.456162][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.465001][ T43] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 71.473804][ T43] usb 4-1: no configuration chosen from 1 choice [ 71.689819][ T24] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 71.712978][ T43] usb 2-1: USB disconnect, device number 3 [ 71.755906][ T30] audit: type=1400 audit(1755599380.734:249): avc: denied { write } for pid=6255 comm="syz.1.81" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 71.779660][ T30] audit: type=1400 audit(1755599380.734:250): avc: denied { create } for pid=6255 comm="syz.1.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 71.806780][ T30] audit: type=1400 audit(1755599380.734:251): avc: denied { getopt } for pid=6255 comm="syz.1.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 71.849832][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 71.857288][ T24] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 71.867323][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.875711][ T24] usb 5-1: Product: syz [ 71.880014][ T24] usb 5-1: Manufacturer: syz [ 71.884592][ T24] usb 5-1: SerialNumber: syz [ 71.890498][ T24] usb 5-1: config 0 descriptor?? [ 72.032701][ T6258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.042365][ T6258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.097790][ T24] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 72.269860][ T43] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 72.419797][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 72.427283][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.438380][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 72.451446][ T43] usb 2-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 72.460532][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.475982][ T43] usb 2-1: config 0 descriptor?? [ 73.185107][ T43] cougar 0003:060B:500A.0003: unknown main item tag 0x0 [ 73.192831][ T43] cougar 0003:060B:500A.0003: unknown main item tag 0x0 [ 73.204280][ T43] cougar 0003:060B:500A.0003: unknown main item tag 0x0 [ 73.207757][ T30] audit: type=1400 audit(1755599382.184:252): avc: denied { open } for pid=6269 comm="syz.0.86" path="/dev/ptyq5" dev="devtmpfs" ino=124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 73.414239][ T43] cougar 0003:060B:500A.0003: unknown main item tag 0x0 [ 73.487278][ T43] cougar 0003:060B:500A.0003: unknown main item tag 0x0 [ 73.521098][ T43] cougar 0003:060B:500A.0003: hidraw0: USB HID v0.05 Device [HID 060b:500a] on usb-dummy_hcd.1-1/input0 [ 73.539674][ T43] usb 2-1: USB disconnect, device number 4 [ 73.587811][ T30] audit: type=1400 audit(1755599382.554:253): avc: denied { create } for pid=6274 comm="syz.2.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 73.608885][ T6280] fido_id[6280]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 73.660072][ T30] audit: type=1400 audit(1755599382.554:254): avc: denied { sys_module } for pid=6274 comm="syz.2.87" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 73.665443][ T9] usb 4-1: USB disconnect, device number 4 [ 73.681226][ T30] audit: type=1400 audit(1755599382.624:255): avc: denied { connect } for pid=6284 comm="syz.0.88" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 73.837846][ T30] audit: type=1400 audit(1755599382.814:256): avc: denied { name_bind } for pid=6296 comm="syz.2.93" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 74.139388][ T6297] netlink: 'syz.2.93': attribute type 10 has an invalid length. [ 74.153526][ T30] audit: type=1400 audit(1755599382.844:257): avc: denied { ioctl } for pid=6288 comm="syz.3.90" path="socket:[9974]" dev="sockfs" ino=9974 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 74.178850][ T6297] netlink: 40 bytes leftover after parsing attributes in process `syz.2.93'. [ 74.205848][ T6297] dummy0: entered promiscuous mode [ 74.215757][ T6297] bridge0: port 3(dummy0) entered blocking state [ 74.222298][ T6297] bridge0: port 3(dummy0) entered disabled state [ 74.228831][ T6297] dummy0: entered allmulticast mode [ 74.244385][ T6297] bridge0: port 3(dummy0) entered blocking state [ 74.250858][ T6297] bridge0: port 3(dummy0) entered forwarding state [ 74.611249][ T24] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 74.640746][ T24] usb 5-1: USB disconnect, device number 11 [ 74.974143][ T6317] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 74.981440][ T6317] IPv6: NLM_F_CREATE should be set when creating new route [ 74.988704][ T6317] IPv6: NLM_F_CREATE should be set when creating new route [ 74.996029][ T6317] IPv6: NLM_F_CREATE should be set when creating new route [ 75.364395][ T6323] netlink: 4 bytes leftover after parsing attributes in process `syz.2.98'. [ 75.668861][ T6326] Bluetooth: MGMT ver 1.23 [ 75.682336][ T6326] netlink: 260 bytes leftover after parsing attributes in process `syz.4.100'. [ 75.879801][ T43] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 76.039804][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 76.164907][ T92] cfg80211: failed to load regulatory.db [ 76.188306][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 76.188359][ T30] audit: type=1400 audit(1755599385.164:303): avc: denied { create } for pid=6327 comm="syz.4.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 76.220830][ T43] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 76.229937][ T43] usb 3-1: config 0 has no interface number 0 [ 76.237549][ T43] usb 3-1: config 0 interface 184 has no altsetting 0 [ 76.251691][ T30] audit: type=1400 audit(1755599385.194:304): avc: denied { name_bind } for pid=6327 comm="syz.4.101" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 76.288691][ T43] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 76.311337][ T30] audit: type=1400 audit(1755599385.194:305): avc: denied { node_bind } for pid=6327 comm="syz.4.101" saddr=172.20.20.170 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 76.339786][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.360140][ T43] usb 3-1: Product: syz [ 76.371634][ T43] usb 3-1: Manufacturer: syz [ 76.384368][ T43] usb 3-1: SerialNumber: syz [ 76.399017][ T43] usb 3-1: config 0 descriptor?? [ 76.418419][ T43] smsc75xx v1.0.0 [ 76.507658][ T30] audit: type=1400 audit(1755599385.484:306): avc: denied { read write } for pid=6336 comm="syz.1.103" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 76.533129][ T30] audit: type=1400 audit(1755599385.484:307): avc: denied { open } for pid=6336 comm="syz.1.103" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 76.556002][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.562856][ T30] audit: type=1400 audit(1755599385.484:308): avc: denied { ioctl } for pid=6336 comm="syz.1.103" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 76.755574][ T30] audit: type=1400 audit(1755599385.734:309): avc: denied { mount } for pid=6336 comm="syz.1.103" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 76.777816][ T30] audit: type=1400 audit(1755599385.744:310): avc: denied { read append } for pid=6336 comm="syz.1.103" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 76.802384][ T30] audit: type=1400 audit(1755599385.744:311): avc: denied { open } for pid=6336 comm="syz.1.103" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 76.826946][ T30] audit: type=1400 audit(1755599385.754:312): avc: denied { kexec_image_load } for pid=6336 comm="syz.1.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 77.047055][ T6344] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 77.057530][ T6344] ref_ctr increment failed for inode: 0x88 offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88801b872040 [ 77.258219][ T6356] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 77.552534][ T6357] pim6reg: entered allmulticast mode [ 77.564416][ T6357] pim6reg: left allmulticast mode [ 77.715152][ T6366] FAULT_INJECTION: forcing a failure. [ 77.715152][ T6366] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.734596][ T6366] CPU: 0 UID: 0 PID: 6366 Comm: syz.3.110 Not tainted 6.17.0-rc2-syzkaller-00028-gbe48bcf004f9 #0 PREEMPT(full) [ 77.734621][ T6366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 77.734630][ T6366] Call Trace: [ 77.734634][ T6366] [ 77.734640][ T6366] dump_stack_lvl+0x16c/0x1f0 [ 77.734660][ T6366] should_fail_ex+0x512/0x640 [ 77.734678][ T6366] _copy_from_user+0x2e/0xd0 [ 77.734698][ T6366] move_addr_to_kernel+0x65/0x170 [ 77.734720][ T6366] __sys_bind+0x11b/0x260 [ 77.734741][ T6366] ? __pfx___sys_bind+0x10/0x10 [ 77.734761][ T6366] ? __pfx_native_tss_update_io_bitmap+0x10/0x10 [ 77.734772][ T6366] ? rcu_is_watching+0x12/0xc0 [ 77.734786][ T6366] ? __pfx___rdmsr_safe_on_cpu+0x10/0x10 [ 77.734803][ T6366] __x64_sys_bind+0x72/0xb0 [ 77.734817][ T6366] do_syscall_64+0xcd/0x4c0 [ 77.734839][ T6366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.734854][ T6366] RIP: 0033:0x7ff3aa38ebe9 [ 77.734867][ T6366] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.734882][ T6366] RSP: 002b:00007ff3ab1a3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 77.734898][ T6366] RAX: ffffffffffffffda RBX: 00007ff3aa5b6090 RCX: 00007ff3aa38ebe9 [ 77.734904][ T6366] RDX: 0000000000000014 RSI: 0000200000000180 RDI: 0000000000000009 [ 77.734910][ T6366] RBP: 00007ff3ab1a3090 R08: 0000000000000000 R09: 0000000000000000 [ 77.734916][ T6366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.734921][ T6366] R13: 00007ff3aa5b6128 R14: 00007ff3aa5b6090 R15: 00007ffe523fc748 [ 77.734930][ T6366] [ 77.902286][ C0] vkms_vblank_simulate: vblank timer overrun [ 78.187342][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 78.201402][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 78.593433][ T6384] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 78.619987][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 78.712720][ T43] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 78.736344][ T6382] netlink: 'syz.0.115': attribute type 3 has an invalid length. [ 78.763830][ T43] usb 3-1: USB disconnect, device number 4 [ 79.068827][ T6396] netlink: 20 bytes leftover after parsing attributes in process `syz.0.117'. [ 79.240397][ T43] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 79.300130][ T5930] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 79.319149][ T6400] binder: 6399:6400 ioctl c0306201 0 returned -14 [ 79.326257][ T6400] binder_alloc: 6399: binder_alloc_buf, no vma [ 79.402133][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 79.408520][ T43] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 79.416876][ T43] usb 3-1: config 0 has no interface number 0 [ 79.423285][ T43] usb 3-1: config 0 interface 184 has no altsetting 0 [ 79.434926][ T43] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 79.445711][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.453940][ T43] usb 3-1: Product: syz [ 79.465482][ T43] usb 3-1: Manufacturer: syz [ 79.471628][ T5930] usb 4-1: config 0 has an invalid interface number: 204 but max is 0 [ 79.480434][ T5930] usb 4-1: config 0 has no interface number 0 [ 79.520516][ T43] usb 3-1: SerialNumber: syz [ 79.531892][ T5930] usb 4-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=29.3d [ 79.544012][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.552411][ T5930] usb 4-1: Product: syz [ 79.560459][ T43] usb 3-1: config 0 descriptor?? [ 79.565613][ T5930] usb 4-1: Manufacturer: syz [ 79.577635][ T43] smsc75xx v1.0.0 [ 79.581420][ T5930] usb 4-1: SerialNumber: syz [ 79.591913][ T5930] usb 4-1: config 0 descriptor?? [ 79.601256][ T5930] ems_usb 4-1:0.204 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 79.612126][ T5930] ems_usb 4-1:0.204: probe with driver ems_usb failed with error -22 [ 79.806031][ T6392] process 'syz.3.118' launched '/dev/fd/5' with NULL argv: empty string added [ 79.847307][ T5930] usb 4-1: USB disconnect, device number 5 [ 81.406255][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 81.424458][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 81.439970][ T1207] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 81.462745][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 81.474484][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 81.481485][ T30] kauditd_printk_skb: 67 callbacks suppressed [ 81.481500][ T30] audit: type=1400 audit(1755599390.464:380): avc: denied { read } for pid=6419 comm="syz.2.125" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 81.484655][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 81.492967][ T30] audit: type=1400 audit(1755599390.464:381): avc: denied { open } for pid=6419 comm="syz.2.125" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 81.513476][ T43] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 81.628786][ T30] audit: type=1400 audit(1755599390.604:382): avc: denied { write } for pid=6419 comm="syz.2.125" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 81.629828][ T6423] binder_alloc: binder_alloc_mmap_handler: 6419 200000ffc000-200001000000 already mapped failed -16 [ 81.653726][ T6422] overlayfs: missing 'lowerdir' [ 81.662579][ T1207] usb 1-1: device descriptor read/64, error -71 [ 81.733739][ T43] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 81.773322][ T30] audit: type=1400 audit(1755599390.754:383): avc: denied { map } for pid=6419 comm="syz.2.125" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 81.777000][ T43] usb 3-1: USB disconnect, device number 5 [ 81.819904][ T30] audit: type=1400 audit(1755599390.794:384): avc: denied { read write } for pid=6425 comm="syz.3.126" name="vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 81.844158][ C0] vkms_vblank_simulate: vblank timer overrun [ 81.873002][ T30] audit: type=1400 audit(1755599390.794:385): avc: denied { open } for pid=6425 comm="syz.3.126" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 81.898099][ T30] audit: type=1400 audit(1755599390.804:386): avc: denied { ioctl } for pid=6425 comm="syz.3.126" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 81.923553][ C0] vkms_vblank_simulate: vblank timer overrun [ 81.929862][ T1207] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 82.083692][ T1207] usb 1-1: device descriptor read/64, error -71 [ 82.090312][ T30] audit: type=1400 audit(1755599391.044:387): avc: denied { create } for pid=6419 comm="syz.2.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 82.202982][ T30] audit: type=1400 audit(1755599391.184:388): avc: denied { read } for pid=6435 comm="syz.1.128" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 82.226090][ C0] vkms_vblank_simulate: vblank timer overrun [ 82.238009][ T30] audit: type=1400 audit(1755599391.184:389): avc: denied { open } for pid=6435 comm="syz.1.128" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 82.973427][ T1207] usb usb1-port1: attempt power cycle [ 82.997263][ T6423] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x25c pfn:0x5aca8 [ 83.008886][ T6423] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 83.028726][ T6423] memcg:ffff88805aa80d00 [ 83.046632][ T6423] flags: 0xfff00000010041(locked|head|reclaim|node=0|zone=1|lastcpupid=0x7ff) [ 83.059083][ T6423] raw: 00fff00000010041 0000000000000000 dead000000000122 0000000000000000 [ 83.068006][ T6423] raw: 000000000000025c 0000000000000000 00000001ffffffff ffff88805aa80d00 [ 83.077923][ T6423] head: 00fff00000010041 0000000000000000 dead000000000122 0000000000000000 [ 83.089042][ T6423] head: 000000000000025c 0000000000000000 00000001ffffffff ffff88805aa80d00 [ 83.107967][ T6423] head: 00fff00000000202 ffffea00016b2a01 00000000ffffffff 00000000ffffffff [ 83.124771][ T6423] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 83.136450][ T6423] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 83.151983][ T6423] page_owner tracks the page as allocated [ 83.157796][ T6423] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 6423, tgid 6419 (syz.2.125), ts 82997246315, free_ts 82995238562 [ 83.185809][ T6423] post_alloc_hook+0x1c0/0x230 [ 83.185954][ T6447] netlink: 'syz.1.132': attribute type 4 has an invalid length. [ 83.190658][ T6423] get_page_from_freelist+0x132b/0x38e0 [ 83.190683][ T6423] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 83.190698][ T6423] alloc_pages_mpol+0x1fb/0x550 [ 83.190714][ T6423] folio_alloc_noprof+0x20/0x2d0 [ 83.190735][ T6423] filemap_alloc_folio_noprof+0x3a1/0x470 [ 83.190760][ T6423] page_cache_ra_order+0x4e1/0xd70 [ 83.190774][ T6423] page_cache_async_ra+0x69c/0xa00 [ 83.190789][ T6423] filemap_fault+0xd42/0x2930 [ 83.213620][ T6447] netlink: 'syz.1.132': attribute type 4 has an invalid length. [ 83.316163][ T6423] __do_fault+0x10a/0x490 [ 83.321687][ T6423] do_pte_missing+0x1a6/0x3ba0 [ 83.326504][ T6423] __handle_mm_fault+0x152a/0x2a50 [ 83.332254][ T6423] handle_mm_fault+0x589/0xd10 [ 83.337068][ T6423] __get_user_pages+0x551/0x34a0 [ 83.343252][ T6423] faultin_page_range+0x338/0x940 [ 83.348321][ T6423] madvise_do_behavior+0x34c/0x530 [ 83.354301][ T6423] page last free pid 6439 tgid 6438 stack trace: [ 83.360918][ T6423] free_unref_folios+0xa61/0x16b0 [ 83.366565][ T6423] folios_put_refs+0x56f/0x740 [ 83.371366][ T6423] truncate_inode_pages_range+0x311/0xe50 [ 83.377082][ T6423] set_blocksize+0x2b8/0x500 [ 83.381707][ T6423] blkdev_bszset+0x19b/0x240 [ 83.386290][ T6423] blkdev_ioctl+0x44e/0x6d0 [ 83.390830][ T6423] __x64_sys_ioctl+0x18e/0x210 [ 83.395592][ T6423] do_syscall_64+0xcd/0x4c0 [ 83.400112][ T6423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.406120][ T6423] ------------[ cut here ]------------ [ 83.411806][ T6423] kernel BUG at mm/filemap.c:867! [ 83.564000][ T5930] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 83.673178][ T6423] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 83.679714][ T6423] CPU: 0 UID: 0 PID: 6423 Comm: syz.2.125 Not tainted 6.17.0-rc2-syzkaller-00028-gbe48bcf004f9 #0 PREEMPT(full) [ 83.691608][ T6423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 83.701648][ T6423] RIP: 0010:__filemap_add_folio+0xf5b/0x11e0 [ 83.707618][ T6423] Code: 7a c8 ff 48 c7 c6 20 24 b9 8b 4c 89 ef e8 9d 28 11 00 90 0f 0b e8 95 7a c8 ff 48 c7 c6 80 24 b9 8b 4c 89 ef e8 86 28 11 00 90 <0f> 0b e8 7e 7a c8 ff 90 0f 0b 90 e9 f2 fb ff ff e8 70 7a c8 ff 48 [ 83.727289][ T6423] RSP: 0018:ffffc9000b3bf3b8 EFLAGS: 00010246 [ 83.733343][ T6423] RAX: 0000000000080000 RBX: 0000000000000002 RCX: ffffc9000fad6000 [ 83.741293][ T6423] RDX: 0000000000080000 RSI: ffffffff81f3175a RDI: ffff888028188444 [ 83.749240][ T6423] RBP: 0000000000112cc0 R08: 0000000000000000 R09: 0000000000000000 [ 83.757191][ T6423] R10: ffffffff90ab3f97 R11: 0000000000000001 R12: 0000000000000004 [ 83.765199][ T6423] R13: ffffea00016b2a00 R14: 0000000000000002 R15: 0000000000000002 [ 83.773159][ T6423] FS: 00007f42887c66c0(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000 [ 83.782069][ T6423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.788632][ T6423] CR2: 00007f93ccfb7dac CR3: 000000004f9eb000 CR4: 00000000003526f0 [ 83.796587][ T6423] Call Trace: [ 83.799856][ T6423] [ 83.802764][ T6423] ? rcu_is_watching+0x12/0xc0 [ 83.807514][ T6423] ? memcg1_check_events+0x59/0x5a0 [ 83.812697][ T6423] ? __pfx___filemap_add_folio+0x10/0x10 [ 83.818325][ T6423] filemap_add_folio+0x10e/0x220 [ 83.823243][ T6423] ? __pfx_filemap_add_folio+0x10/0x10 [ 83.828700][ T6423] page_cache_ra_order+0x5a7/0xd70 [ 83.833792][ T6423] page_cache_async_ra+0x69c/0xa00 [ 83.838885][ T6423] filemap_fault+0xd42/0x2930 [ 83.843544][ T6423] ? block_dirty_folio+0x114/0x1b0 [ 83.848636][ T6423] ? __pfx_filemap_fault+0x10/0x10 [ 83.853727][ T6423] ? inode_to_bdi+0x9e/0x160 [ 83.858298][ T6423] ? balance_dirty_pages_ratelimited_flags+0x92/0x1260 [ 83.865130][ T6423] ? __pfx_filemap_map_pages+0x10/0x10 [ 83.870567][ T6423] __do_fault+0x10a/0x490 [ 83.874875][ T6423] ? lock_acquire+0x2cd/0x350 [ 83.879538][ T6423] ? __pfx_filemap_map_pages+0x10/0x10 [ 83.884986][ T6423] do_pte_missing+0x1a6/0x3ba0 [ 83.889736][ T6423] ? __handle_mm_fault+0x14fd/0x2a50 [ 83.895008][ T6423] ? rcu_is_watching+0x12/0xc0 [ 83.899768][ T6423] ? lock_release+0x201/0x2f0 [ 83.904442][ T6423] __handle_mm_fault+0x152a/0x2a50 [ 83.909539][ T6423] ? __pfx___handle_mm_fault+0x10/0x10 [ 83.914980][ T6423] ? __pte_offset_map_lock+0x174/0x310 [ 83.920420][ T6423] ? follow_page_pte.constprop.0+0x5cf/0x1390 [ 83.926471][ T6423] handle_mm_fault+0x589/0xd10 [ 83.931229][ T6423] __get_user_pages+0x551/0x34a0 [ 83.936153][ T6423] ? down_read_killable+0x220/0x4b0 [ 83.941332][ T6423] ? __pfx___get_user_pages+0x10/0x10 [ 83.946687][ T6423] faultin_page_range+0x338/0x940 [ 83.951696][ T6423] madvise_do_behavior+0x34c/0x530 [ 83.956789][ T6423] ? __pfx_madvise_do_behavior+0x10/0x10 [ 83.962402][ T6423] ? down_read+0x13d/0x480 [ 83.966802][ T6423] do_madvise+0x176/0x240 [ 83.971112][ T6423] ? __pfx_do_madvise+0x10/0x10 [ 83.975943][ T6423] ? do_futex+0x122/0x350 [ 83.980268][ T6423] ? xfd_validate_state+0x61/0x180 [ 83.985369][ T6423] __x64_sys_madvise+0xa9/0x110 [ 83.990199][ T6423] ? trace_irq_enable.constprop.0+0xd4/0x120 [ 83.996159][ T6423] do_syscall_64+0xcd/0x4c0 [ 84.000654][ T6423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.006525][ T6423] RIP: 0033:0x7f428798ebe9 [ 84.010929][ T6423] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 84.030515][ T6423] RSP: 002b:00007f42887c6038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 84.038904][ T6423] RAX: ffffffffffffffda RBX: 00007f4287bb6180 RCX: 00007f428798ebe9 [ 84.046854][ T6423] RDX: 0000000000000017 RSI: 0000000000c00000 RDI: 0000200000000000 [ 84.055249][ T6423] RBP: 00007f4287a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 84.063201][ T6423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.071147][ T6423] R13: 00007f4287bb6218 R14: 00007f4287bb6180 R15: 00007ffcdca5bd98 [ 84.079099][ T6423] [ 84.082098][ T6423] Modules linked in: [ 84.086060][ C0] vkms_vblank_simulate: vblank timer overrun [ 84.093812][ T6423] ---[ end trace 0000000000000000 ]--- [ 84.209809][ T5930] usb 2-1: Using ep0 maxpacket: 32 [ 84.294343][ T6423] RIP: 0010:__filemap_add_folio+0xf5b/0x11e0 [ 84.296951][ T5930] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 84.310146][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.320210][ T6423] Code: 7a c8 ff 48 c7 c6 20 24 b9 8b 4c 89 ef e8 9d 28 11 00 90 0f 0b e8 95 7a c8 ff 48 c7 c6 80 24 b9 8b 4c 89 ef e8 86 28 11 00 90 <0f> 0b e8 7e 7a c8 ff 90 0f 0b 90 e9 f2 fb ff ff e8 70 7a c8 ff 48 [ 84.339854][ C0] vkms_vblank_simulate: vblank timer overrun [ 84.340718][ T5930] usb 2-1: config 0 descriptor?? [ 84.405723][ T6423] RSP: 0018:ffffc9000b3bf3b8 EFLAGS: 00010246 [ 84.424900][ T6423] RAX: 0000000000080000 RBX: 0000000000000002 RCX: ffffc9000fad6000 [ 84.465806][ T6423] RDX: 0000000000080000 RSI: ffffffff81f3175a RDI: ffff888028188444 [ 84.483874][ T6423] RBP: 0000000000112cc0 R08: 0000000000000000 R09: 0000000000000000 [ 84.496877][ T6423] R10: ffffffff90ab3f97 R11: 0000000000000001 R12: 0000000000000004 [ 84.506284][ T6423] R13: ffffea00016b2a00 R14: 0000000000000002 R15: 0000000000000002 [ 84.514923][ T6423] FS: 00007f42887c66c0(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000 [ 84.525022][ T6423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.534640][ T6423] CR2: 00007f93cdc74d58 CR3: 000000004f9eb000 CR4: 00000000003526f0 [ 84.544935][ T6423] Kernel panic - not syncing: Fatal exception [ 84.551123][ T6423] Kernel Offset: disabled [ 84.555528][ T6423] Rebooting in 86400 seconds..