last executing test programs: 11m12.295298964s ago: executing program 0 (id=544): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001000000000012000000000000000000000000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef) 11m8.022463286s ago: executing program 0 (id=550): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) mount$overlay(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000040)={[], [{@dont_appraise}], 0x3a}) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000009000000000000000000000018110000", @ANYRES32, @ANYBLOB="0bb1000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040200020000000095000000000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) r2 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_int(r2, 0x29, 0x3, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180), 0x4) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x4, &(0x7f0000000680)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8922, &(0x7f0000000280)={'dummy0\x00'}) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000500), 0x40002, 0x0) preadv(r5, &(0x7f0000004040)=[{&(0x7f0000002e00)=""/156, 0x9c}], 0x1, 0x401, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0500000004000000030000000400000000000000", @ANYRES32, @ANYBLOB="030000000000000000000000000db5f709fb0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r6 = semget(0x0, 0x4, 0x39c) semop(r6, &(0x7f0000000080)=[{0x3, 0x8001, 0x1000}], 0x1) semop(r6, &(0x7f0000000200)=[{0x1, 0xffff, 0x1000}, {0x0, 0x7fc0, 0x1800}, {0x7b8bf35831bb5de4, 0x10, 0x800}], 0x3) semctl$SETALL(r6, 0x0, 0x11, &(0x7f0000000240)=[0x7fff]) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010200000000000000000000000015000300686173683a69702c706f72742c6e6574000000000900020073797a32000000000500040000000000140007800800124000000000050015002200000005000500020000000500"], 0x64}}, 0x0) 11m6.71403496s ago: executing program 0 (id=554): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f0000000080)="0fae84f9ff660f7091fe00800f09650f35f30fe6d7660f388161c40f01c30ff27f00672cd466b9a40b000066b81601fa2566ba72572d800f30", 0x39}], 0x1, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000180)={'\x00', 0x1ff, 0x3, 0x6, 0x3749, 0x4, 0x0}) sched_setscheduler(r4, 0x6, &(0x7f0000000240)=0x6) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r5, &(0x7f0000000540)={{0x3, @bcast, 0x1}, [@null={0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x2}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x48) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c000000170a01080000000000000000020000080900020073797a30000000000900010073797a30"], 0x2c}, 0x1, 0x0, 0x0, 0x44000}, 0x8094) ioctl$sock_x25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000280)={@remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}, 0xe, 'ip6tnl0\x00'}) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$GIO_UNIMAP(r7, 0x4b66, &(0x7f0000000480)={0x6, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000040)=ANY=[@ANYBLOB="911003000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 11m5.313923924s ago: executing program 0 (id=556): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x5, 0x2, 0x2}) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) r0 = syz_io_uring_setup(0x497, &(0x7f0000000000)={0x0, 0xf62c, 0x800, 0x3, 0x379}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x3516, 0x0, 0x20, 0x0, 0x0) 11m4.437929389s ago: executing program 0 (id=557): read$FUSE(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x86) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x16d) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x20c01, 0x8) chown(&(0x7f0000000240)='./file0/file1\x00', 0x0, 0x0) lseek(r0, 0x3, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000040000000c000000aa0b000003000000", @ANYRESOCT=r0, @ANYBLOB="0000eaff00000000000002283711205161230000", @ANYRESHEX=r0, @ANYRES32, @ANYRES32=r0], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x18, 0x3, &(0x7f0000000840)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES8, @ANYRES8=r1, @ANYRES32=r1, @ANYRES16=r2, @ANYRESOCT=r2, @ANYBLOB="2e3b0808cd27250ea8254722ba8806f16c1b4376f300f5e113064ea5b6aaae409f7115ad71f7ec3dbce8210608000000d8ff86116e0af6d5b8937fd879bea30501fa3ff4f5df8dc321e6a9306559862f29eed41ea52b363278b098c5a032a778048bac23f5b3e85b88d4f61a1cb759874ea367d96868a53366cce72583bdaeb24579922d39dc6cc7c091f05797eb331df039e800892d88dff5abeaeec5dc5fc5e5445093c09bf9bea5b52e0e4309d21fd928493a3cbaa28397248943c034f8d5840f2fcf3e28f2b33243055b7dc4481eaa853fc81b5b2d6858a39ee0539490a9d3670000000000a4ebe9e930f016397b7a61a2f5bbfa01e060f3e92420b364c73b3e6a27b31700cf12d1fc64a0c1d36c80f933cbc9dd32563e5e2f3001432bb0efacb1dd89f6d145484cebb760d5671bc220968db731985e403e4df2c91276e36f5e0c56cf2431835f6747064a8610f402ea271137156cd837294608127b3a3f18e6db8aea957b3e00"/375, @ANYRESDEC=r1], &(0x7f0000000280)='syzkaller\x00', 0x2, 0xc8, &(0x7f0000000640)=""/200, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newtaction={0x68, 0x30, 0x200, 0x2, 0x0, {}, [{0x54, 0x1, [@m_vlan={0x50, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x23, 0x6, "66cc983166e5bb28cbcfca9b261a71da1825a823e6c9a860c5fe7ffefc42bb"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0x68}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x100, 0x0, @empty}}, 0x0, 0x0, 0x11e, 0x0, 0x8a}, 0x9c) bind$inet6(r6, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r6, &(0x7f0000847fff)='X', 0x1, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0xffffffff, @private1}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000001380)={0x0, @in6={{0xa, 0x4e23, 0x8000, @loopback, 0xfffbfffd}}, 0x2da, 0x4, 0x500, 0x0, 0x0, 0xa, 0x2}, 0x9c) openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/resume', 0x88102, 0x0) 10m59.478540923s ago: executing program 0 (id=570): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2c240, 0x0) (async) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2c240, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000440)={r0, 0x0, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x13, 0x1c, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c18e8438ef2a565ef1e83323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a019363e8772fd29f35239d200", "24431a3977a68e174f005e95ac6a00"}}) ioctl$FS_IOC_GETFSMAP(r1, 0x4c09, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) (async) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000080)) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_9p2000}]}}) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r4, @ANYRES32], 0x15) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000040)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x4, 0x0, 0xb}) (async) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x4, 0x0, 0xb}) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) r7 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) ioctl$MON_IOCQ_URB_LEN(r7, 0x9201) syz_usb_control_io$hid(r6, 0x0, 0x0) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) (async) r8 = fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000300)='5\xfd\x04\xc6\xc9]\v\xd6S9q\x0f#\x93\x9d\xeb\x00\xcf\xb2~9*\xa9\x1d:\x06u46N\xd93\xe1\xa2\x05\x83Z\xbc\xbeT\x16\xab\xfb=4\xa6\x10,\"\xee\xf8o+\x02\xd8\xaft_\r\x1d\"\xc8\\k\xcc4\x96\xdb\xb0\xadA\x02[\x16\xb4\xca\xa5n\x87\xdb\xb3\x1f\xbb\xc0\x9f\xc2\x9e\t[\xba\x9e\xfd\xc76#\x8f\xc6\xe7\x11\x8fL\xd970xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_9p2000}]}}) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r4, @ANYRES32], 0x15) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000040)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x4, 0x0, 0xb}) (async) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x4, 0x0, 0xb}) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) r7 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) ioctl$MON_IOCQ_URB_LEN(r7, 0x9201) syz_usb_control_io$hid(r6, 0x0, 0x0) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) (async) r8 = fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000300)='5\xfd\x04\xc6\xc9]\v\xd6S9q\x0f#\x93\x9d\xeb\x00\xcf\xb2~9*\xa9\x1d:\x06u46N\xd93\xe1\xa2\x05\x83Z\xbc\xbeT\x16\xab\xfb=4\xa6\x10,\"\xee\xf8o+\x02\xd8\xaft_\r\x1d\"\xc8\\k\xcc4\x96\xdb\xb0\xadA\x02[\x16\xb4\xca\xa5n\x87\xdb\xb3\x1f\xbb\xc0\x9f\xc2\x9e\t[\xba\x9e\xfd\xc76#\x8f\xc6\xe7\x11\x8fL\xd970xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x2, 0x11}, &(0x7f0000001fee)='R\brust\xe3c*sgrVex:D0', 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000100)={0x0, 0x2, 0x0, "343d70dde51f0900", 0xb5315258}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) syz_io_uring_setup(0x12e, &(0x7f0000000340)={0x0, 0x5cb1, 0x2, 0x3, 0xfffffffd}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8000, 0x103) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x40413, &(0x7f0000000740)=ANY=[@ANYBLOB='fd=', @ANYRES8=r7, @ANYBLOB="2c726f6f746d6f64657365725f69643d00000000000000000000e100000000003f642f507ba6dd6a6628760866f7ff7b3cef0f5d452a98f277fd006928da7ae70357b6b53343c2c431d1931cd5bd4e3ebed5c375b10db8668d2ce9d4ad1528f02cdd2b7043b1b97c0781f48761e4b05872a1b2", @ANYRESDEC=0x0, @ANYRES16=r1, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r8 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)="2e00000010008188e6b62ac03772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) 1m7.205033114s ago: executing program 5 (id=2482): mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x6, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_create(0x1, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r0, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0x1, 0xc001) shutdown(r4, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, 0x0, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}, 0x4000) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = openat$binfmt_register(0xffffff9c, &(0x7f0000000100), 0x1, 0x0) write$binfmt_register(r7, &(0x7f0000000240)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x7fffffff, 0x3a, '\xbe)\x00\x00\x00\x00\x00\x00', 0x3a, '\\\xbd\x00\xa5\x95\xa0IY\x95\x85\xeb\xd9\xa7\xa04\x00^{', 0x3a, './file1'}, 0x41) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 1m4.80615857s ago: executing program 5 (id=2488): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = shmget(0x1, 0x3000, 0x200, &(0x7f0000ffd000/0x3000)=nil) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000040)=""/220) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000080), 0x84, &(0x7f0000000200)={[{@grpquota_inode_hardlimit={'grpquota_inode_hardlimit', 0x3d, [0x65]}}]}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @dev={0xac, 0x14, 0x14, 0x40}, 0x4e22, 0x1, 'lblcr\x00', 0x0, 0x10001, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @private=0xa010102, 0x1ffc, 0x200000001, 'none\x00', 0x9, 0x821}, 0x2c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@ipv4_getroute={0x1c, 0x1a, 0x20, 0x70bd25, 0x25dfdbfe, {0x2, 0x75e43d06108f7c7b, 0x14, 0xf, 0xfc, 0x0, 0xfe, 0x7}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x3, 0x1, 0x101, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x4, 0x2, 0x292}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000012c0)=ANY=[@ANYBLOB="09000000020000006d05", @ANYRES32, @ANYBLOB="faffff82b5ade696cf8f54000000000002000000", @ANYBLOB="6232c05966b634b3c38ea337d09da6944a2185b286d11879c7386afc06852a201d332760e02a5c8bc258f5843a8090d69335df07ba4b34ad1c3b63e5c8a1ba3f1ccfe51167f18e5c237a439d692873e36e1c76e57d47597b59a5b1fd1d4351df278de27f6bec6212ef45f60ad635abafe55a1b841f675463fddc6882e73002ed377f5314fe55ee337e70e7145665dce908e0d6eb92d81aa23400b2abb94828563da8bd520fa0298b86df4abf91482d6613e9e40d13831180d5a4794d024f88c25a5692e082a7979a9a21af8c4f1bc0b29be93e29235e6e2944afac74fa115e705bc1743cfb4787d4ccb8635ef9ddd1e8e2e4a7526df212c9a673845cb5f9985dd7fecdced87442e21f76d61469c9925fb07df357c4e789a7ba489aab02436354c65c8cff51bb45319c1f215fc5d7ec694df58b3e561ed8a17513f43e7819262cee2f937e58b1b278dbc1c9f80bdf7d7fec419b549777556a37fe08e69800c4fd8704c82757c6fadc63c270a659ceb5c3b8ac08168de72fb88018489d609400db0172f846916d6ef56c3ae63d917ec95cf4e1ba5937ebee4b8e0d4a4692b0474ff7ed1a43704ee6654e892e63dbd0e73257338619749e4fa24e430e986eba7a6b3afb4e77b31c1c7507e6f28dbf48f89697621cd1899271973e1bb7df24e6e39439682800ebff1138efc6cea5f3a326159ace3f642c659f745a5bfd81674759a8a9624e63e46632c3e4d1541ad4acbbd73060550122d738d3ff0361a77457f30f6fe5352e9288543ed078aba92d656751ce69e433efcee3df52aa50c4ae798e022130fd1470e60dae85e331c857a72e6c0009c82714f7c2a91771826025af1ae0b2ac9b020bcb2b18f8da35d9843f950e1f0cb74ff86f3fc215cdbf762b83eed2f6df0de940ea73f210759d821df06a9411e179b292c51a8b31cf1fafdf4cbde62cd9f3214bc64711c5d2abb36e0594b56c6ed3988acac93f0aff874ba72db00fbf39b3f206d7b03ee8454de4cd1a6960c6567f6edf07801a527069d9bdc2363015ea761a2778c6ef0825300d4400d0eb750f54bad805a14539a27288ee1cfa63bd57214e0556f02654a51a8ec994ae6c918e6f61e6f6e707685d1e576a5d6e162dc340d7a8b971d3f4ae8fb0c335098ef9ad0f588c01b299ee7ceda5bb8bd5c21343a5df7b76a2af97b5084aa17f6170e6c8836a0783afb421093fe7c1ef05056bcdd7a09c56d9e120ee86eb29b80eca5da50360e99473e6619386381ce7945b6aab0c090a3ea0dbe1362d854e17ed3cc8821d6407198be80605b4169c441c58c3a460d164453ef64cfbc82b8f5dcca927c82e8a99a0307e0fceb844b433031cba34952a5e85a62d027aa5e01a5cf069bcc75040d9368f315630e2ae79cef56bd2be9d11db4dfded5538aefb57871e2a11cf44ae0515c355fd526cc2bd8c50c7d98f53c409bf6af0cf68064d59d64e5197447196ec54f83f69633d884844ffe867e005237e036cefee5beade9f62f305794a95ca6a1a51afefab8eb497a6c943f621adfa579d3aa25fbd22e049e1a16f9152a7d2441bebfd0a94366f92fa280bd3352b68d139469386762314937dc63566c0cffa77d42ad8e58196fa431cc87daf93d495e93ed2435f0c3cb39d833862c44edffcd7ed1df28632fbdbfedc1a0e6dc5968e4a15c710cc37cd0bbecab01d618ccc74c926ee5667cf5beddaa93d7e55c3ca3956c5b9295945a73c834941222972838e9a9d47bcfac1f1d163082fe748c9b0902b4c28a0a6f4b3009ee362064d4b712fd6f6d92ebc75e88d47156d4a0304f18f754c268927a905dbc85242bc36ac27dd8ed2fe75ef56b3ad7b09e50e8b4a36776d9d92e184b7480ba3b2a5c63ee74fe52aff1ebe5f5834a8a0d59308f0f064bc42300a59d520b9d2b467923e534adc8600f9e37344d14510fd44455fc7b2a1ac28354140a3252300044066ba994396125eb841aff1a4cd8e710293f4f9a69778b3e9a81e877432592f4daac12abfec60979bd7c1c04cb2f73f73454ca56a2e5a737a9cb5a88e7d9d5b5f4d01d6f1309d11fac9e91a0b1f8efbc3d01beb392c68cba3080f44edbb85a6e9749b245923b3cdc9ab1abcdf7dc32418a5acce357c8dcd3a7929f328473fe95045f769662db8aab6352ea55b0a4f44bb3c26abad1dd57415ec252a85a077ea13be9512328f8b30a5cb3557e0edba0ecb6efdf0ccd78663350000f09536ce0a6b73a1d6db8b10aefccee9116765c1d9981d7784dbf82b3327ec73f70d538c30beffa4d8359f6ad1068607ac41e2765e052f6bcea60fe5456be9b2db4a1f9ee74b95dca338488e012175aba3e0ae6c450429ce9a9f661516cba72f0adc836df064080d3e8e710192059897ca1528c9fff990a1e3d8b943fed13d367ee22dfcd9e0e3d79e4c3c73755e78a74adffe0f97836b2036025901d6588e50603e20b20bc1f936dcba33a33df57ced90dae8fea16e66242ef8ef0df2a00d0a27f9931b465c7a6afbad31537aea2d005cee03451b035fb2bdfff478cd71c702667266c819f5d99eb27822e6fc636b54f586737b2127921458dc6be550e9cf247bff1d71044fee976f745a7124abf1fbc2e1679ad73953bb6a866cb65dd69c75ddc56704a53b9f6bc3f50bcf210c56a9e8df9a9ba19d0903a9c9c514b7f790adb0b11caac9a1c16518f6839db844e1d9098ff79aa8cc592127dab0b52b9302f963ebec511eeaca68b5ea849014348907883f842342836df9fda34ab4329c5e6eb783e8dd319138e3ecc05eba3de1448208c3f32a401e3faa893ff965a9b79f1bcc6ddf0250fe3d0463cd15b8ba180880f42ecc91b59fb6f2dd7432e78de5140362c333184b4c3091e31a5886a9c961cd57d9f0d28f8ca81fd42908a5cd17a0d68ed98b5fa5680435a3ed9d0673975be20e8500618bea11c4d7dfe1ed890572af42b00b196595c2b66e7c9039aefb048c04f8c24189a9fcbdcdec0127ac9ed4e523092050eb1c31bc21983f166d930542d0e714acbfe1624b18e0cb80e40e32812e895784ae60331b353854f6b9822de88e9e6c2a76379eb232f07ce7d3b845d16f405d02061b6e2ffdb3eb5eb2fa7c1460c9acc5ea3c614e44ad15b7b801a88014dbcbb5e24228452e9c0d1bbbb8a40aaf9afa47e260fd0689fba5a425269420cc2761da76d5fbe3e3d2cdfa861e6342fc7ad924067acdd8a3c9e32b836148125c789cbdf6bdacf4804f76c5ec267dde198b8c3312dbed146a9c5e5757e600e0b084d5cab27263476c119d7d0345beeab58ce923e310883b38fdef745f01e7bc202e380c238521ed7f0b831ee305f3038a2bafac87ccb9f1ae5e8a82d9bc062b859714099e0314f76bff3f7c12da9e31d3274f3b534acfeebc16100d8834956cb437b02ea2998014c43bc7c7e34f632707a10579ac40748cf8a11da4df89a7a8e7ab0f707a64cf0e268d62a092c5b307b3d6da353b59d6d9b6696948354f6f5ad9c8cd52018aa725444f7c37c40faa9160af766d52eb45d10ff4b0c4134b6654bccb44c3e8a4c615fd0d995ee806009eb0c4c209a7d0f722be9488f98d8818c62ee8ccf80ed0e282c2285af8600c68d051e19bdf4164b6aa98ca03a8614b9434620168bec54abfdad4c9579c399c6808a3a3af15e8f21ded8765764734a3618b58948e3a222115ec084db5a98c6781dceaedc0edacda77ff61b2f21004f70955c6be43faf9b85e9c0c07e4334c3b895d057669a3954723e92173a40d93b3b02c0b5f86f5a4588072dc5a1d83a5e417a3f1b5983b19b35e58f3a52951cc56ffa6d712ba6a0e6ff7e30988dacca0e415aca1a9ed981976219cfa28b40f3e67aad611d326c6516c16f871f680d6db3a914041ed758d3363d6c0050fd06045f690d91bb73425cd85077b0a63ea6a474034f4f328f6bafb8657f80679f46c172dd870de0ec6c8241500f4d6a9f33bf40a9c798fdbadb634701f2730d8e013f9098d7dab1d967d2169aae546a5e6be61055643ce5c494b1ec25148d67a6d7cc3cebd352f047e25ebe3d501bf5560fc6597e55d0631b995b4eff9b9b6eb79380bd47ade5487aab6ab59cff74ed777df3681d623e053f156d6e6ccc8396a5e3c1a4c1b39e2db401c16f98e8ffabef0a853529d66b8f58269052d94b870ccce7c858da037d12ac2bcc13aa0dd6376c30c57bf5989d186be4236c860a541930bb488a6109a43b6b38b9c2e6e8c9b39a5c7e9dc987efe610f7a11205bd20e8203080b70a64577f11c1726b4789afbcdd7b3b0a91d977a2030e0664211ff1c2708caf3efe91ba00299711fca957e85681a8631ca358b46b9430122fbeeb65e3ff1288a636475425d2daf41db956477ac0fa422a49aed2c228ae968673bb9daf66af90ac85a130f132031efe5d84e556fd85583c36c6df9f20e25f5e3069395484eed847e5e1345d229c8669771bce110e3da4574a4ccbff066eb1b620367c25180d82bcab538254811b7a095c1a091900698d98354bedd91f1280e33e616f57105254bb4def5fb472fa58a1b199d0625765be4076a8b2491186e96383902905687c704601520481581b7fa94656cad26c657ef12031511ad5948d2bf178fff4047397a9a09a4dd8456b4d39193372c2c06a9ed221498fb102d35ca850c6c3f251ea40ab04ff5aa358b3f4f5d251a88f6f4a8ae089b8bc58d9bb2e840668fa73a7758eedca1475f6d7f946e38f35fadde16cd631ca4a663b7ea6112179b9b73470d559ab37db6a56047576e6fe2451dc561b23a3ebd4e3c06ce1bb847dedec84adcef835b334a7cc0bb333bf5d7dc3c888342f821f7edeff3895e3986bea194c223dde3d3f150e9566e8755c548490ca810e1de810e84956e93307af2de971afe0dc96696b884c35bb6dd0ce434a66b556d6bbc3011e427b4dde39484d4cf88805e822f5fe5bf12cf48c4c8653087d90736bd48da83f5733a6b589ec75d9fd70c62e1a40b4ce6f151ca6f42614f114df0e89a8b1800c29960ee5ce1684a0304fba98c368d5ae6c3bdcdee706b6270e3033275636439217c6978c107af0366ae94aa7d4ebea3df42781838e056cc02c94c026135875a9fa86fe890b5c90b02e2b1e7223e0a621b9880cf11158bb197684bfbbefeb84bf8d6d541ad99806fff6d258f54a1245a5d50d577ede54dc56447e2d10ebab8e77a03bfc2dd2e29ac351c2eb00ea65c96394a1ca2ca39ceea354ea36646817ec01e72743fd7ef907e234077a21aaa39951d97b5a0831552413407f254908dd204b276d281acc01377caeeba43f2e91a4457b7517d437a0641b6e06c5aa4f6d42ba5af78bb6426cbccf2d959e06187fe12a93e84f10ced6067ee2fdda43b64f9ca2977e27ad8a3287844825315334e690efb09c8057977fb0551297a568d93a0197f78dc2c6327a96df3c76acb36d679848236fe2173566d1cb18c75ec9a9052d4b58d9bc1ebf7f8e5cc4210857dfc3e2b3824fe23bc224901382fe85ad44552a35d2cc5b59a9622f7f1bc87ef056e4eaef52d6115900bbf9bf7f661ce3e5d3db01febec885f2e4cdd6c9fbf3bbfea5bff46e8835431162289591433fb142b4b02faf1357db5e1d5695d7d5cf801fafe34657eb9cbae47d1d59ce8a229dd596787d12366d158caf331097ee3e2d7ecc11d80733206bca198f0b45272fd3b13e008344a40afb6c939a8d57804493e77e82414fc1d0010296f15d99be93bbfe29582a717d2b46bfeccf882ed3da70ad21d7d8d852ebf87bcd7cfe39af0bfd164604e35b0e7ac9afe4cca8d", @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@getsa={0x28, 0x12, 0x1, 0x70bd28, 0x25dfdbfa, {@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4d6, 0x2, 0x33}}, 0x28}, 0x1, 0x0, 0x0, 0x4800}, 0x40040d0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r5}, 0x38) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x30, r9, 0x5, 0xffffffff, 0x8, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_WIPHY_FREQ_HINT={0x8}]}, 0x30}}, 0x488c0) sendmsg$NL80211_CMD_DEL_INTERFACE(r7, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x60040000) 1m4.194749915s ago: executing program 5 (id=2490): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000300)='./file2\x00', 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe90, 0x30, 0x25, 0x0, 0x0, {}, [{0xe7c, 0x1, [@m_pedit={0xe78, 0x1, 0x0, 0x0, {{0xa}, {0xe4c, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x28, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x4}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x80}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x401}, {}, {}, {}, {0x20, 0x0, 0x0, 0x41fa}, {0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x943}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}], [{}, {}, {}, {}, {0x0, 0x1}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe90}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') listxattr(&(0x7f0000000180)='./file7\x00', &(0x7f00000001c0)=""/7, 0x7) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, 0x0) setpgid(0x0, r4) r5 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r5, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder1\x00') ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000280)) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file3\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x0) close(0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) 1m2.796988383s ago: executing program 5 (id=2495): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r2, 0x0) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140), 0x111000, 0x0) pidfd_send_signal(r3, 0x0, &(0x7f0000000640)={0x0, 0x0, 0xfffffffa}, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x1000000000000000, 0x7, 0x109e93, 0x7fffffffffffffff, 0x400000, 0xd, 0x0, 0x2, 0xfffffffffffffffd, 0x48d6, 0x200000010000, 0x6, 0x5, 0x100020000001], 0xd5d5c004, 0x8340}) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000000)=0x9, 0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x80, 0x4, 0x5, 0x0, 0x8, 0x5, 0x40, 0x7, 0x6, 0x4, 0xf9, 0x8, 0x0, 0x0, 0x5, 0x2, 0x84, 0x3, 0x4, '\x00', 0x4, 0x6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = syz_io_uring_setup(0xac9, &(0x7f00000002c0)={0x0, 0x3594, 0x10, 0x1103, 0x21e}, &(0x7f0000000240)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) io_uring_enter(r4, 0x6efc, 0x3900, 0xb, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) r6 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000380)={0x1, @pix_mp={0x8, 0x5, 0x34524742, 0x5, 0x4, [{0x8, 0x9}, {0x7, 0x9}, {0x3}, {0xd, 0x8}, {0xd, 0xe0}, {0x200, 0x7ff}, {0x2, 0x3}, {0xfffffffc, 0xa}], 0xff, 0x28, 0x8, 0x1, 0x5}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r8, &(0x7f0000000040)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1e8) 1m2.471719762s ago: executing program 5 (id=2499): memfd_create(&(0x7f0000000500)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7}}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x4, 0x0, &(0x7f0000000100)="e0b9547e", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0x4}, 0x18) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000040)={0x6, 0x27, 0x3ff, 0xffff, 0x7}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000004c0)={'veth1_virt_wifi\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r9, r10, 0x25, 0x4, @val=@tcx}, 0x1c) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c010000100013072abd7000fedbdf2464010102000000000000000000000000fc010000000000000000000000000001000000004e2001020a0000802e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffff0900000000000000000000000000000000000900000000000080000000000000000043050000000000000400000000000000ffffffffffffff7f000000000000000000000000000000000200000000000000000000002ebd7000003500000a00000050000000000000001c00040000004e244e200000fe80000000000000000000000000002d600012007266633431406fe29e1efef332b11367f530362867636d2861657329"], 0x16c}, 0x1, 0x0, 0x0, 0x40050}, 0x0) unshare(0x2040400) r12 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSREP(r12, 0x40004580, 0xffffffffffffffff) 1m1.016863802s ago: executing program 33 (id=2499): memfd_create(&(0x7f0000000500)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7}}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x4, 0x0, &(0x7f0000000100)="e0b9547e", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0x4}, 0x18) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000040)={0x6, 0x27, 0x3ff, 0xffff, 0x7}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000004c0)={'veth1_virt_wifi\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r9, r10, 0x25, 0x4, @val=@tcx}, 0x1c) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c010000100013072abd7000fedbdf2464010102000000000000000000000000fc010000000000000000000000000001000000004e2001020a0000802e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffff0900000000000000000000000000000000000900000000000080000000000000000043050000000000000400000000000000ffffffffffffff7f000000000000000000000000000000000200000000000000000000002ebd7000003500000a00000050000000000000001c00040000004e244e200000fe80000000000000000000000000002d600012007266633431406fe29e1efef332b11367f530362867636d2861657329"], 0x16c}, 0x1, 0x0, 0x0, 0x40050}, 0x0) unshare(0x2040400) r12 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSREP(r12, 0x40004580, 0xffffffffffffffff) 17.279986315s ago: executing program 1 (id=2613): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000000280)="f34f7d11cc16f9", 0x7}, {&(0x7f0000000dc0)="def4f404b64fd56e340856b3cdfebea6f3215e6c6a2f6835307ac41ff951cbea813c6670dcecaeca98677ada0c6fb55b642f0f74d3ae36175b1803298a66de355cacf1379033b9e23a2c2be8f9177b4d353a3b04fa087bbf4118cfe5ffbc853f7c180f7a45e3b5303e6495d27d639d2b56b88f9432f48374b43be276a96085d2913e9b9b2e4a3eb55f18ab5d3be1857b1574602eecf6a8266cb02bf12e714941b3e1d4ba20aef7eb14758822773ef97d7521b4c02de1d5a0c538ad159ad7c1905a", 0xc1}, {&(0x7f0000000ec0)="ac3683507b9ed5fb6389beeabe08d4c5489e38614f412c7103d0f964bd9d460fa980c7cab97ecff7cf1aaa2e273b356a542ce667c3516c6c8b32c9ee0321019d4578f72c44f271350ced3e1f1d570828a3553bb8f354e88b40cb595704566a77d3437a4e333778a936a5239b688345d97f9d", 0x72}, {&(0x7f0000001040)="66ed941972bedd4107384a0f97644a73d0b1905dc50019674ec8a755ad60bc21855820eb582489ec22025c07ce1f3180c99c820d94538a72f02ee6e8078a610d850de1674191b9e1a79852293724bff6cc97cb1449874d8af9ae90a62c37664677e6e60ccd94baa8b8bf9b70609f8b0404517e02da44fce980079a654c3a850d1237b5dcd1985877466dc9c806fa501d6ef7cbe6b2b9d1e67956a37c8c1a8239e93c9f33796991c6634d796f0670cd7403d33f5c907b8026a423fb2ef0b1250686a3191b3b09ece9790cb0d6", 0xcc}, {&(0x7f0000001140)="b2e55cc159ac0d4e882c19b4b4a49efdc34c3a091e2eb5c879a9da44dbea80167b5aa8b50c93007873400caacec0db868e38d01efd00b6c3ecd7a608ea3e0fb748b940cbc62309176c2a93110812e09ff2711d38482c65f3f36f65a14d22da6a271c5806cd308343038a85acb003465f01c015a5ba1cea0a0827a6867d39265ab3c7c6cee6b86f81404d634b0750bf6831138d55520595fc96ae3a", 0x9b}, {&(0x7f0000001240)="b4c1d02b617c76686100eac58f6ece28d084765271b28b2e8871286d46097e6e8cd265a640263f2a1527a4065cae4a29e97b7ce566b9eeb5d7b92c136003c9bb14c0b208ab8b8b8d69edf9a7153e49c3691475fc0c8f08f799c7e96208d02ebebce0788d44b6914c0560b111cee751", 0x6f}], 0x6}, 0x4000006) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc0081, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x48882, 0x0) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r5, &(0x7f0000000640)={0x2, 0x0, {&(0x7f0000001900)=""/4096, 0x1000, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r5, &(0x7f0000000800)={0x2, 0x0, {&(0x7f0000000b80)=""/239, 0xef, 0x0, 0x2, 0x2}}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r6, 0x8983, &(0x7f00000001c0)={0x3, 'vlan1\x00', {0x3}, 0x7}) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r4, 0x0, 0x0) r7 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) mmap(&(0x7f0000442000/0x2000)=nil, 0x2000, 0x2000003, 0x11, r7, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x15) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) 15.893801936s ago: executing program 1 (id=2616): syz_clone(0x0, 0x0, 0xfffffffffffffe4b, 0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/time\x00') bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x2}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb01001800000000000000507f00000300000002000000090000000000000e03000000010000000a0000000000000203000000000000000500000d0000000006000000010000000000000000000000000000000000000009000000000000000100000003"], 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r3}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) clock_settime(0xfffffffb, 0x0) 11.602452206s ago: executing program 1 (id=2625): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @multicast2}, 0x3}}, 0x2e) connect$pppl2tp(r1, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='westwood', 0x8) getsockopt$inet_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0x0, 0xc9}}}, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xf3a, 0x0) syz_open_dev$vim2m(&(0x7f0000000300), 0x7fffffff, 0x2) sendmsg$nl_generic(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001b00)={0x14, 0x30, 0x800, 0xf0bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40089}, 0x20000000) 9.972564263s ago: executing program 1 (id=2629): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='autogroup\x00') setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f0000000040)=0x6, 0x4) (async) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000080)={0x3, 0x7fffffffffffffff, 0x1, 0x1, 0x2, 0x0, [{0x889, 0x4, 0x2, '\x00', 0x1900}, {0x3, 0x3, 0x1ff, '\x00', 0xa04}]}) (async) fallocate(r0, 0x2f, 0xe89, 0x8) (async) getsockname(r0, &(0x7f0000000140)=@alg, &(0x7f00000001c0)=0x80) r1 = fcntl$getown(r0, 0x9) (async) ioctl$SIOCX25SSUBSCRIP(r0, 0x89e1, &(0x7f0000000200)={'ip6_vti0\x00', 0x5, 0x2}) (async) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000300)={0x76, {{0x2, 0x4e24, @private=0xa010100}}, 0x0, 0x9, [{{0x2, 0x4e20, @local}}, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x36}}}, {{0x2, 0x4e22, @remote}}, {{0x2, 0x4e20, @rand_addr=0x64010102}}, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {{0x2, 0x4e21, @private=0xa010100}}, {{0x2, 0x4e22, @multicast2}}, {{0x2, 0x4e20, @rand_addr=0x64010101}}]}, 0x510) (async) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000000840), &(0x7f0000000880)=0x4) (async) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0x5, 0x101442) r3 = mq_open(&(0x7f0000000900)='[\x00', 0x40, 0xd, &(0x7f0000000940)={0x7a, 0xcd79, 0x10001, 0x80000000000}) syz_open_dev$hidraw(&(0x7f0000000980), 0x3ff, 0x252c01) (async) mount$9p_fd(0x0, &(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00), 0x1000400, &(0x7f0000000a40)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@msize={'msize', 0x3d, 0x5}}, {@fscache}, {@mmap}, {@version_u}, {@cache_none}], [{@permit_directio}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000b40), r0) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x2c, r4, 0x800, 0x70bd26, 0x25dfdbfd, {{}, {}, {0x10, 0x13, @udp='udp:syz0\x00'}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0xc048001}, 0x0) (async) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f0000000c40)={0x6, {{0x2, 0x4e20, @empty}}, {{0x2, 0x4e21, @multicast2}}}, 0x108) (async) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000d80)={r0}) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000e80)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x38, 0x3, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000010}, 0x40060) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000ec0)={0xe022, r2}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000f40), r5) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r6, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x84000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x14, r7, 0x10, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000004) (async) prlimit64(r1, 0x6, &(0x7f0000001040)={0xffffffffffff73eb, 0xfffffffffffffffd}, &(0x7f0000001080)) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x1, &(0x7f00000010c0)=@ccm_128={{0x304}, "81845dc325bc0f40", "7f49f27d5643381685cfd396baa4584c", "491bad27", "216dae2aa12aa06c"}, 0x28) (async) getsockopt$WPAN_WANTACK(r5, 0x0, 0x0, &(0x7f0000001100), &(0x7f0000001140)=0x4) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000001180)=0x1) r10 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000011c0), 0x2000, 0x0) ioctl$PPPIOCGIDLE(r10, 0x8010743f, &(0x7f0000001200)) 9.678609289s ago: executing program 1 (id=2631): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x41) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) r5 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d00)=@deltfilter={0x24, 0x2d, 0x4, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0x10, 0xa}, {0x4, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c000008000100", @ANYRES32=r5], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) ftruncate(r4, 0x8800000) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) sendfile(r8, r4, 0x0, 0x558410e9) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) 8.835971001s ago: executing program 2 (id=2632): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000040), r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x18, 0x4, &(0x7f00000005c0)=ANY=[@ANYRES8=r1], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x9, 0xffffffff, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7800, 0xf000, 0x80, 0xffffffff}}) sendmsg$nl_route_sched(r4, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000680)=@deltfilter={0x98, 0x2d, 0x2, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0x1, 0x5}, {0xfff2, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_POLICE={0x5c, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffff57d}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x8, 0x16, 0x2, 0x0, {0x2, 0x0, 0x3, 0xff72, 0x3, 0x140afbe}, {0x1, 0x0, 0xc46, 0xb, 0x70f0, 0x2}, 0x1, 0x4201}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x4}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}]}]}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}]}, 0x98}, 0x1, 0x0, 0x0, 0x400c0d0}, 0x884) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket(0x10, 0x3, 0x0) fsetxattr$security_selinux(r4, &(0x7f0000000540), &(0x7f0000000580)='system_u:object_r:var_auth_t:s0\x00', 0x20, 0x1) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="a00000001a00010000000000000c00001c140000000000000000000084001300000000000000000000000000000000000000faffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000059c4872f00"/156], 0xa0}}, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000200095"], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) pipe(&(0x7f0000000200)) 8.705992556s ago: executing program 1 (id=2634): memfd_create(&(0x7f0000000500)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7}}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x4, 0x0, &(0x7f0000000100)="e0b9547e", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404"], &(0x7f0000000080)='GPL\x00', 0x80005, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4, 0x0, 0x4}, 0x18) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000040)={0x6, 0x27, 0x3ff, 0xffff, 0x7}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000004c0)={'veth1_virt_wifi\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r9, r10, 0x25, 0x4, @val=@tcx}, 0x1c) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c010000100013072abd7000fedbdf2464010102000000000000000000000000fc010000000000000000000000000001000000004e2001020a0000802e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffff0900000000000000000000000000000000000900000000000080000000000000000043050000000000000400000000000000ffffffffffffff7f000000000000000000000000000000000200000000000000000000002ebd7000003500000a00000050000000000000001c00040000004e244e200000fe80000000000000000000000000002d600012007266633431406fe29e1efef332b11367f530362867636d2861657329"], 0x16c}, 0x1, 0x0, 0x0, 0x40050}, 0x0) unshare(0x2040400) r12 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSREP(r12, 0x40004580, 0xffffffffffffffff) 7.297280101s ago: executing program 6 (id=2635): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r0, &(0x7f0000000640), 0x2, 0x0) 7.149309784s ago: executing program 2 (id=2636): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x8822d55593a2179}, 0xc) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_xfrm(0x10, 0x3, 0x6) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x10000, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r4, 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') io_setup(0x2e, &(0x7f0000000200)=0x0) io_submit(r5, 0x1, &(0x7f0000000380)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xfe, 0x4}]) r6 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0x0, 0xffff, 0x0, 0xa}, {}, {0xffffffffffffffff}, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x0, 0x6c}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x3}}, 0xe8) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x8031, 0xffffffffffffffff, 0x6a855000) 6.243301544s ago: executing program 3 (id=2638): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r1, @ANYRES16=r1, @ANYRESDEC=r0], 0x20}, 0x1, 0x0, 0x0, 0x48800}, 0x40000) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000000340)={0x2020}, 0xcb0a) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='qrtr_ns_message\x00', r2, 0x0, 0x7}, 0x18) 6.188884512s ago: executing program 2 (id=2639): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getpgrp(r0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="4d7e00000000000000002a00000008002f000000000005003600000000000c0005000000000000000000050037000000000008000200", @ANYRES32=r7, @ANYBLOB="0600060000000000060004"], 0x50}, 0x4, 0x700000000000000}, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x164) r9 = fanotify_init(0x2, 0x40000) fanotify_mark(r9, 0x541, 0x40001019, r8, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40)=ANY=[@ANYBLOB="020000090100000000000000040000000000000010000000000600d20e00000000000000"], 0x24, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000002c0), 0x8) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f0000000280)=0x4, 0x4) timerfd_create(0x2, 0x80800) r10 = eventfd2(0x4, 0x1) flock(r10, 0x5) 6.035596842s ago: executing program 3 (id=2640): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r2 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x114df, 0x0, 0x1, 0x89}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902120001000000000904"], 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000100)={&(0x7f0000000140)=[{0x365e, 0xb00, 0x4f, &(0x7f0000000040)="d1596137019028b4e6973edf1911fbfc4c57a11c8b9430e181a0399636ff048efb6d1ff9da18c7b520508922e15ef5a43a2403935d48ed4c365d55448dc474f02bfc8c827508000000000000009cea"}, {0x36de, 0x4801, 0x0, 0x0}], 0x2}) io_uring_enter(r2, 0x3518, 0xaddf, 0x2, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r8, 0x4138ae84, &(0x7f00000001c0)={{0x0, 0xdddd0000, 0xd, 0xf0, 0x40, 0xfd, 0x7, 0xd4, 0x0, 0x4, 0x7, 0x6}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x40, 0x6, 0x9, 0x5, 0xf, 0x3, 0xca}, {0xeeee0000, 0xe6e50002, 0xb, 0x0, 0x2, 0x7, 0x4, 0x1, 0xc, 0x0, 0x6, 0x5}, {0xeeef0000, 0x3000, 0xd, 0xf, 0x43, 0x46, 0x2, 0xd, 0x6, 0x3, 0xfc, 0x1}, {0x100000, 0x0, 0x3, 0x1, 0x3, 0x9, 0x9, 0x7, 0x5, 0x4, 0x1e, 0x4b}, {0x2, 0xd000, 0x9, 0x7, 0x4, 0x6e, 0x1, 0xfb, 0x4, 0x80, 0x1, 0xfc}, {0x6000, 0x1000, 0xf, 0x9d, 0x3, 0x0, 0x1, 0xb, 0x5, 0x7, 0x0, 0xf8}, {0xffff1000, 0x8000000, 0xd, 0x5, 0x3, 0x3, 0xa, 0x9, 0x54, 0x6, 0x2, 0x7}, {0x100000, 0x5}, {0xdddd1000, 0x9}, 0x40010000, 0x0, 0xf000, 0x300, 0x9, 0x0, 0xeeef0000, [0x4, 0x401, 0x8, 0x10800000000000c5]}) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_SREGS(r9, 0x4138ae84, &(0x7f0000000300)={{0x0, 0x4000, 0x0, 0x49, 0x1, 0x7, 0x4, 0xe, 0x0, 0x0, 0x8, 0x2}, {0xf000, 0xdddd0000, 0x0, 0x5, 0xbb, 0x5, 0x38, 0x8, 0x5, 0xfd, 0xd9, 0x2}, {0xeeef0000, 0x10000, 0x0, 0xe4, 0x3, 0xd, 0x6, 0x9, 0x0, 0x5, 0x0, 0xa}, {0x0, 0x8000000, 0xc, 0x9, 0x44, 0xcb, 0x5, 0x9, 0x40, 0x9, 0x1, 0x5}, {0xffff1000, 0x2000, 0xb, 0x7, 0xe, 0x2, 0x6, 0x8f, 0x1, 0xd, 0x5, 0x1}, {0x80a0001, 0x80a0000, 0xc, 0x5, 0x61, 0x18, 0x7, 0xfc, 0xc, 0x9, 0x6, 0x4}, {0x3000, 0xeeee0000, 0x1b, 0xff, 0xbc, 0x80, 0x1, 0x4, 0x1, 0x0, 0xbf, 0x9}, {0x8000000, 0x2000, 0xf, 0x3, 0x4, 0x6, 0x9, 0xfa, 0x7, 0xc6, 0x0, 0x81}, {0xf000, 0x3}, {0x2000, 0x8}, 0x14, 0x0, 0xeeee8000, 0x20, 0x0, 0x4801, 0x0, [0x6, 0x1ff, 0x86d, 0x8001]}) 6.034180123s ago: executing program 6 (id=2641): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="01000000a728fe0b58180c40000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800"/12, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100e3008500000082000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'veth1_virt_wifi\x00', &(0x7f0000000040)=@ethtool_eee={0x44, 0x1, 0x3, 0x400, 0x3, 0x7, 0x15ac, 0xf, [0x4, 0x8]}}) syz_open_procfs(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x8, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0xa, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x6, 0x5, 0x4, 0x0, 0x7, 0x3c57, 0x0, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x5, 0x7, 0x83, 0x9, 0x4c74, 0x0, 0x242, 0x2, 0xe, 0x0, 0x400, 0x7, 0x17, 0x21, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x85, 0x6, 0xffff8001, 0x3ff, 0x83, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x2, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0x388000, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2b, 0xe, 0x312, 0x78, 0xea4, 0x0, 0xfff, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0xff, 0x0, 0x1000ff, 0x5, 0x1000005, 0x5f31, 0xf, 0xd86, 0x2, 0x4, 0x8, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0xbc2, 0x1, 0xfe000000, 0x8, 0x2, 0x200004, 0x9, 0x3, 0x3, 0x9, 0x4, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x1, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x3, 0x5, 0x800000, 0x1ef, 0x8, 0x8, 0x86, 0x3, 0x3038, 0xff, 0xb, 0x2, 0x2, 0x2, 0x7, 0x20000008, 0x4, 0x16d01, 0x6, 0x38, 0x800003, 0x600, 0x80, 0xbf7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x5, 0x4a9, 0x5, 0x6, 0xac8, 0x5, 0x7, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x3, 0x5, 0x1b, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x80000000], [0x9, 0xbb33, 0xa, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x7, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x10000016, 0xffffffff, 0x80000000, 0x5, 0xffffffff, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xae, 0x8, 0x6, 0x226, 0x3, 0x100, 0x8, 0x30b1d693, 0xa22, 0xf40, 0x7, 0x1, 0x6c1b, 0x8, 0x4, 0x5, 0x40b22, 0xda, 0x200, 0xffff3441, 0x4]}, 0x45c) sendmsg$nl_generic(r4, 0x0, 0xc000) 5.316661503s ago: executing program 4 (id=2642): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, r1, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x4}]}, 0x20}}, 0x0) 5.22381952s ago: executing program 4 (id=2643): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000080)={r4}, 0x8) setsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={r4, 0x9}, 0x8) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x18) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x38) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_init_net_socket$rose(0xb, 0x5, 0x0) dup3(r8, r9, 0x80000) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_usb_connect(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r10, 0x0, 0x44080) 4.901919829s ago: executing program 6 (id=2644): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x41) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) r5 = gettid() recvmsg$unix(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x40000020) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d00)=@deltfilter={0x24, 0x2d, 0x4, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0x10, 0xa}, {0x4, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c000008000100", @ANYRES32=r5], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) ftruncate(r4, 0x8800000) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) sendfile(r8, r4, 0x0, 0x558410e9) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) 4.828588382s ago: executing program 2 (id=2645): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000040), r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x18, 0x4, &(0x7f00000005c0)=ANY=[@ANYRES8=r1], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x9, 0xffffffff, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7800, 0xf000, 0x80, 0xffffffff}}) sendmsg$nl_route_sched(r4, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000680)=@deltfilter={0x98, 0x2d, 0x2, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0x1, 0x5}, {0xfff2, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_POLICE={0x5c, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffff57d}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x8, 0x16, 0x2, 0x0, {0x2, 0x0, 0x3, 0xff72, 0x3, 0x140afbe}, {0x1, 0x0, 0xc46, 0xb, 0x70f0, 0x2}, 0x1, 0x4201}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x4}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}]}]}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}]}, 0x98}, 0x1, 0x0, 0x0, 0x400c0d0}, 0x884) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket(0x10, 0x3, 0x0) fsetxattr$security_selinux(r4, &(0x7f0000000540), &(0x7f0000000580)='system_u:object_r:var_auth_t:s0\x00', 0x20, 0x1) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="a00000001a00010000000000000c00001c140000000000000000000084001300000000000000000000000000000000000000faffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000059c4872f00"/156], 0xa0}}, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000200095"], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) 3.569831251s ago: executing program 6 (id=2646): r0 = syz_open_procfs(0x0, &(0x7f0000000280)='timerslack_ns\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) io_setup(0x9, &(0x7f0000000b80)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)=0x1) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x3, 0x38, 0x0, 0xa, 0x0, 0x65}}) lseek(r0, 0x8, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x440540) ioctl$NBD_SET_SIZE(r2, 0xab02, 0x419f) mount$afs(&(0x7f00000019c0)=ANY=[@ANYBLOB='#'], &(0x7f0000001a00)='.\x00', &(0x7f0000001a40), 0x1, 0x0) 3.540905935s ago: executing program 2 (id=2647): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = timerfd_create(0x9, 0x80000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000002ec0)=""/261, 0x105, 0x6) timerfd_settime(r1, 0x1, &(0x7f0000000080)={{0x0, 0x989680}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1404200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder1\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0xffffff8b, 0x0, &(0x7f0000000480)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@flat=@weak_handle={0x77682a85, 0x0, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/204, 0x0, 0x0, 0x800010}}, &(0x7f0000000280)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000bc0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0xf8, 0x0, &(0x7f0000000740)=[@free_buffer={0x40086303, r6}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000600)={@fda={0x66646185, 0x0, 0x0, 0x3f}, @flat=@handle={0x73682a85, 0x1100, 0x1}, @fd}, &(0x7f0000000540)={0x0, 0x20, 0x38}}}, @clear_death={0x400c630f, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000680)={@fda={0x66646185, 0x8, 0x1, 0x18}, @flat=@binder={0x73622a85, 0x1101}, @flat=@binder={0x73622a85, 0x2, 0x3}}, &(0x7f0000000700)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000400019070000000000000025037c00000c"], 0x20}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x15) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xts-twofish-avx,camellia-asm,cbcmac(aes))\x00'}, 0x58) arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, &(0x7f00000000c0)) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) 2.96877674s ago: executing program 6 (id=2648): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000680), 0x9e900, 0x0) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000006c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x6c7e, &(0x7f0000000140)={0x0, 0x0, 0x3000}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000180)="1a", 0x1, 0x0, 0x0, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x2}) ioctl(r2, 0x8b33, &(0x7f0000000040)) r6 = syz_usb_connect$printer(0x1, 0x36, &(0x7f0000000080)=ANY=[@ANYRESHEX=r5], &(0x7f00000001c0)={0xa, &(0x7f0000000700)={0xa, 0x6, 0x200, 0x7, 0x2, 0xa, 0x20, 0x1}, 0x19, &(0x7f0000000140)=ANY=[@ANYRES64=r4], 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x3001}}]}) syz_usb_control_io$printer(r6, &(0x7f0000000300)={0x14, &(0x7f0000000200)={0x20, 0x9, 0x4a, {0x4a, 0x4, "f2f81d1e089a9a65c13a382eb16ab8a2c5b948974c1fff172573b792617210cf03c8914cdb57b6fafcf5554eda74510be5c0b880ac806fd30b297c3004f95266b5008c419087c244"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42b}}}, &(0x7f0000000640)={0x34, &(0x7f0000000340)=ANY=[@ANYBLOB="200afd00000010964ecd55c5044231f4f5d50fc2f88aa873aa2332749d28a836a8f1aae32280e982310557f98ae7cb6cc92e5b9fe8ada18a3e3149571cb42b28b4a47c15e1ce627a3c5992a9b2bdfa5fce0ffd864a2c7b5ce2b455c0cac42f5e0f5e31667bc54819cde90faa5a900bc7cd9fa6d940f56adf9017284aac43146413d2c16ffae734d812343823cff1275d2e838f8e0ef27c6431d9f5c6a62e7397594c9be062011105944e1eb89d000acb0307de24fe2798250fd8dbab09b63503ed1ea84a5953d00ca22e9d6405d47141c5f2655691e9459aa74faca27750c60e897f8afa72b1794b17b1e31129007b7813c2f0a1d61568d409963a975bdae83c176eff"], &(0x7f0000000480)={0x0, 0xa, 0x1, 0xdb}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0xf1}, &(0x7f0000000500)={0x20, 0x0, 0xba, {0xb8, "c3753c1010ac04ee4f74e8888fe01d07845a97828171a8fd6e9f14517e72f30bb8133be7b44074bf08cc8075d1b313011c490a62cec06607bc6a2a26986d4278be7901b44bfba72f6456bd9fc1879ad942c1983a6adb2353d7e8e2793975ac8e8c26af078a7267a13ddfe50a5fe39993963ae3f62970767247382e93c3254cc66c860c6558a2bccbf1387ea348045d96a32f3dbaf8819d96488fdd991f309a3c74f10446db44a23a1c750d838a59408267555d38e289bee0"}}, &(0x7f00000005c0)={0x20, 0x1, 0x1, 0x10}, &(0x7f0000000600)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) setreuid(0xee01, 0xee01) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) r8 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_MADVISE={0x19, 0x50, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x16}) io_uring_enter(r8, 0x627, 0x4c1, 0x43, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCGUSAGES(r7, 0xd01c4813, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.562119388s ago: executing program 2 (id=2649): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = fcntl$dupfd(r3, 0x0, r4) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="2800b2ca2ff0020000003b6b6d86838fcdd244f59e6dc2e7e1e7dba423c50f4bd67907ac1f331f4b447d36a19a058905a797323c6b0d3102", @ANYRES32, @ANYBLOB, @ANYRES32=r5, @ANYBLOB, @ANYRES64=0x0], 0x20) ioctl$TIOCGPTPEER(r5, 0x4004af07, 0xffffffffffffffff) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCGUSAGES(r7, 0xd01c4813, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.525050342s ago: executing program 3 (id=2650): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8000, 0x0, 0x9, 0x8, 0xfffffe0000000001, 0xfa11, 0x3}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) (async) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x22, 0x2, 0x3) (async) r4 = socket(0x22, 0x2, 0x3) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000100)={0x5, "5660359c3245d1c42317afad7d48ed51040000000000000100"}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000100)={0x5, "5660359c3245d1c42317afad7d48ed51040000000000000100", 0xffffffffffffffff}) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) (async) r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000140)={0x10001000, "34096a32ceef92aeb8e6498c25f51d665f14b178c8aec01830819a2558a14ae5"}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000140)={0x10001000, "34096a32ceef92aeb8e6498c25f51d665f14b178c8aec01830819a2558a14ae5", 0xffffffffffffffff}) r9 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000300)='source', &(0x7f0000000180)='%\xde({^\xfa@:', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000300)='source', &(0x7f0000000180)='%\xde({^\xfa@:', 0x0) ioctl$SYNC_IOC_MERGE(r8, 0xc0303e03, &(0x7f00000001c0)={"3c24139ed44aec57f2e2ad238e7b448ed886923c31d4b8affbf514fd00", r6, 0xffffffffffffffff}) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) (async) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r13, 0x4138ae84, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) close_range(r3, r10, 0x0) r14 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x2, 0x4) connect$inet(r14, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000080)={0x2, 0x0, 0x1, 0x4, 0x0, 0xfffe}) 1.990281361s ago: executing program 4 (id=2651): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x280, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000140)="3ef0879bf966b92b03000066b8ca9153c366baea67184c0f30f30f92c0baf80c66b83479a08266efbafc0cb87600ef0f395c660f15d0baf80c66b89c19228e66efbafc0c66b8ae3800000f23c00f21f8663501000f000f23f8ef646519e2469e9eb91300000066b80055010066ba000000000f30673e0ffd7df08ee0", 0x7c}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$pppl2tp(0x18, 0x1, 0x1) syz_emit_ethernet(0x272, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r9, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r10, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100"], 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) sendmsg$ETHTOOL_MSG_TSINFO_GET(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRESHEX=r1, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)=ANY=[@ANYBLOB="44000000020605000000000000000000000000000c000300686173683a69700005220400000000000900020073797a3100000000050005006c0dd9381f75c2d39a4f1bfd"], 0x44}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.07300023s ago: executing program 3 (id=2652): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, r1, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x4}]}, 0x20}}, 0x0) 988.640549ms ago: executing program 4 (id=2653): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x101800, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x5400, 0x0) listen(r0, 0x0) (async) r3 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x18) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000100)=@generic={&(0x7f0000000040)='./file0\x00', r3}, 0x18) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r5, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20) recvfrom$inet6(r0, 0x0, 0x0, 0x12062, 0x0, 0x0) 972.708856ms ago: executing program 3 (id=2654): socket$pppoe(0x18, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1400000010000700000e0000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002600000000c0a01080000000000000000010000000900020073797a32000000003400038030000080080003400000000224000b80200001800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30"], 0xe4}, 0x1, 0x0, 0x0, 0x4000010}, 0x4) 242.580541ms ago: executing program 4 (id=2655): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x4c, r1, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_DEVKEY={0x30, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x18, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x4c}}, 0x0) 227.325219ms ago: executing program 4 (id=2656): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000040), r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x18, 0x4, &(0x7f00000005c0)=ANY=[@ANYRES8=r1], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x9, 0xffffffff, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7800, 0xf000, 0x80, 0xffffffff}}) sendmsg$nl_route_sched(r4, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000680)=@deltfilter={0x98, 0x2d, 0x2, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0x1, 0x5}, {0xfff2, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_POLICE={0x5c, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffff57d}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x8, 0x16, 0x2, 0x0, {0x2, 0x0, 0x3, 0xff72, 0x3, 0x140afbe}, {0x1, 0x0, 0xc46, 0xb, 0x70f0, 0x2}, 0x1, 0x4201}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x4}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}]}]}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}]}, 0x98}, 0x1, 0x0, 0x0, 0x400c0d0}, 0x884) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = socket(0x10, 0x3, 0x0) fsetxattr$security_selinux(r4, &(0x7f0000000540), &(0x7f0000000580)='system_u:object_r:var_auth_t:s0\x00', 0x20, 0x1) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="a00000001a00010000000000000c00001c140000000000000000000084001300000000000000000000000000000000000000faffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000059c4872f00"/156], 0xa0}}, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000200095"], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) pipe(&(0x7f0000000200)) 133.45775ms ago: executing program 6 (id=2657): pipe(&(0x7f00000003c0)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$int_in(r0, 0x5452, &(0x7f0000000440)=0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r4 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x237, &(0x7f0000000240)={0x0, 0xebcc, 0x1, 0x2, 0x24e}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f00000001c0)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x40, 0x0, 0x80, 0x3, 0x0, 0x9276, 0x0, 0x0, {0x1}}) io_uring_enter(r5, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000240)={'batadv_slave_1\x00', &(0x7f0000000140)=@ethtool_eeprom={0xc, 0x1, 0x9}}) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000480)='hpfs\x00', 0x10008, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001a40)={0x6, 0x1b, &(0x7f0000000280)=@raw=[@btf_id={0x18, 0x9, 0x3, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xd}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}], &(0x7f0000000100)='GPL\x00', 0x9, 0x1000, &(0x7f0000000a40)=""/4096, 0x40f00, 0x4a, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000800)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000840)={0x2, 0xb, 0x1, 0xc533}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000880)}, 0x94) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_key_refresh_complete={{0x30, 0x3}, {0x0, 0xc9}}}, 0x6) 0s ago: executing program 3 (id=2658): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x48}}, 0x11) r1 = socket$inet6(0xa, 0x80003, 0x1) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0xff00) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="74000000040a01040000000000000000010000080900010073797a300000000051000c00ac2d8ea976fd5ce0a90d5561739f4108353f5c3ea89976c72deb3a3f0930c9b204f87e45d649222718f895b6392a3d5e4f95a53499484b085bf76fd1db0c2eabdd11650000"], 0x74}, 0x1, 0x0, 0x0, 0x400c040}, 0x4040041) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f0000000280)={0x0, 0x4}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): s `syz.5.1926'. [ 730.879751][T13592] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1926'. [ 731.582513][T13601] overlayfs: missing 'lowerdir' [ 731.735520][T13607] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.1931'. [ 733.174030][ T977] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 733.335090][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 733.362765][ T977] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 733.428351][ T977] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0120, bcdDevice=f9.ad [ 733.440041][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.460465][ T977] usb 4-1: Product: syz [ 733.465050][ T977] usb 4-1: Manufacturer: syz [ 733.469655][ T977] usb 4-1: SerialNumber: syz [ 733.493390][ T977] usb 4-1: config 0 descriptor?? [ 733.504862][T13625] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=422521815 (54082792320 ns) > initial count (22125137792 ns). Using initial count to start timer. [ 733.520563][ T977] kvaser_usb 4-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 733.849568][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1934'. [ 733.972561][T13637] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 734.257158][ T6637] usb 4-1: USB disconnect, device number 41 [ 734.641030][ T977] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 734.666237][T13657] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1945'. [ 734.802423][ T977] usb 6-1: Using ep0 maxpacket: 8 [ 734.813439][ T977] usb 6-1: config 0 has no interfaces? [ 734.830976][ T977] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 734.862662][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.899941][ T977] usb 6-1: config 0 descriptor?? [ 735.001487][T13671] netlink: 'syz.2.1950': attribute type 1 has an invalid length. [ 735.037663][T13671] bond2: entered promiscuous mode [ 735.043716][T13671] 8021q: adding VLAN 0 to HW filter on device bond2 [ 735.051488][T13670] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1950'. [ 735.142184][ T977] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 735.295388][T13644] Invalid source name [ 735.299457][T13644] UBIFS error (pid: 13644): cannot open "./file0", error -22 [ 735.310948][ T977] usb 4-1: Using ep0 maxpacket: 8 [ 735.337220][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 735.346869][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 735.356938][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 735.366595][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 735.376647][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 735.386225][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 735.396054][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 735.405651][T13644] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 735.415142][T13644] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 735.459759][T13644] fuse: Bad value for 'fd' [ 735.472792][ T977] usb 4-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 735.501008][ T977] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 735.510143][ T30] audit: type=1400 audit(1766361607.739:1035): avc: denied { append } for pid=13643 comm="syz.5.1941" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 735.553274][ T977] usb 4-1: New USB device found, idVendor=e8c0, idProduct=1504, bcdDevice=30.22 [ 735.571749][ T10] usb 6-1: USB disconnect, device number 51 [ 735.573473][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.616687][ T977] usb 4-1: config 0 descriptor?? [ 736.940732][ T977] usb 4-1: USB disconnect, device number 42 [ 738.763398][T13708] lo speed is unknown, defaulting to 1000 [ 738.985031][T13720] fuse: Unknown parameter '' [ 740.374861][ T30] audit: type=1400 audit(1766361612.609:1036): avc: denied { map } for pid=13735 comm="syz.5.1966" path="/proc/sys/kernel/yama/ptrace_scope" dev="proc" ino=24736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_kernel_t tclass=file permissive=1 [ 740.408946][T13737] tmpfs: Cannot change global quota limit on remount [ 741.722849][T13774] No such timeout policy "syz1" [ 741.787140][T13774] 9p: Bad value for 'wfdno' [ 743.471890][T13791] netlink: 'syz.5.1982': attribute type 5 has an invalid length. [ 743.584492][T13800] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 743.648230][T13801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 743.776465][T13791] ip6erspan0: entered promiscuous mode [ 743.843643][T13802] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1980'. [ 744.274487][T13812] 9p: Bad value for 'wfdno' [ 744.437090][T13815] sctp: [Deprecated]: syz.5.1987 (pid 13815) Use of struct sctp_assoc_value in delayed_ack socket option. [ 744.437090][T13815] Use struct sctp_sack_info instead [ 745.081047][T13830] »»»»»»: renamed from dummy0 (while UP) [ 747.102156][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.108526][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.656580][T13860] netlink: 'syz.1.1996': attribute type 2 has an invalid length. [ 748.347643][T13881] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2002'. [ 749.593019][ T30] audit: type=1400 audit(1766361621.829:1037): avc: denied { bind } for pid=13889 comm="syz.2.2004" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 749.960097][ T30] audit: type=1400 audit(1766361622.189:1038): avc: denied { getopt } for pid=13895 comm="syz.2.2008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 750.038025][T13900] overlayfs: failed to clone upperpath [ 751.797427][T13924] affs: No valid root block on device nullb0 [ 751.950928][ T6637] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 752.605106][ T6637] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 752.613474][ T6637] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 752.624160][ T6637] usb 6-1: config 0 has no interface number 0 [ 752.630474][ T6637] usb 6-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 752.641801][ T6637] usb 6-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 752.655093][ T6637] usb 6-1: config 0 interface 41 has no altsetting 0 [ 752.755324][ T6637] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 752.789454][ T6637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.809706][ T6637] usb 6-1: Product: syz [ 752.819039][ T6637] usb 6-1: Manufacturer: syz [ 752.828128][ T6637] usb 6-1: SerialNumber: syz [ 752.839555][ T6637] usb 6-1: config 0 descriptor?? [ 752.849166][ T6637] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -22 [ 752.965906][T13938] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2018'. [ 753.428471][ T30] audit: type=1400 audit(1766361625.659:1039): avc: denied { mounton } for pid=13945 comm="syz.3.2021" path="/385/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.429047][T13946] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 753.516777][T13946] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 753.531446][ T30] audit: type=1400 audit(1766361625.769:1040): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.557050][ T30] audit: type=1400 audit(1766361625.799:1041): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.595459][T13946] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 753.603863][T13946] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 753.614917][T13946] overlayfs: d_ino too big (385, ino=9223372036854777857, xinobits=3) [ 753.646194][T13946] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 753.668146][ T30] audit: type=1400 audit(1766361625.799:1042): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="overlay" ino=2305843009213693954 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.701255][T13946] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 753.710395][T13946] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 753.718726][ T30] audit: type=1400 audit(1766361625.799:1043): avc: denied { open } for pid=13945 comm="syz.3.2021" path="/385/file0" dev="overlay" ino=2305843009213693954 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.760005][T13946] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 753.785775][ T30] audit: type=1400 audit(1766361625.799:1044): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.787531][T13946] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 753.839794][ T30] audit: type=1400 audit(1766361625.799:1045): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.891303][T13946] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 753.907170][ T30] audit: type=1400 audit(1766361625.799:1046): avc: denied { read } for pid=13945 comm="syz.3.2021" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 753.954449][T13946] overlayfs: d_ino too big (instances, ino=4611686018427388030, xinobits=3) [ 754.537815][T13961] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2025'. [ 754.700201][T13969] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 754.898089][T13974] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 755.129548][T13974] netlink: 'syz.3.2028': attribute type 2 has an invalid length. [ 755.268131][T13961] netlink: 'syz.4.2025': attribute type 1 has an invalid length. [ 755.280902][T13961] netlink: 'syz.4.2025': attribute type 2 has an invalid length. [ 755.331007][ T6637] usb 6-1: USB disconnect, device number 52 [ 756.072082][T13988] xt_CT: You must specify a L4 protocol and not use inversions on it [ 756.550952][ T6637] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 756.700938][ T6637] usb 6-1: Using ep0 maxpacket: 8 [ 756.732541][ T6637] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 756.807112][ T6637] usb 6-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 756.829851][ T6637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.854206][ T6637] usb 6-1: Product: syz [ 756.864828][ T6637] usb 6-1: Manufacturer: syz [ 756.876496][ T6637] usb 6-1: SerialNumber: syz [ 756.896236][ T6637] usb 6-1: config 0 descriptor?? [ 757.114637][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 757.121486][ T30] audit: type=1400 audit(1766361629.349:1053): avc: denied { ioctl } for pid=13993 comm="syz.4.2034" path="/dev/input/mice" dev="devtmpfs" ino=916 ioctlcmd=0x4b4e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 757.495662][ T6005] usb 6-1: USB disconnect, device number 53 [ 758.895179][T14010] overlayfs: failed to clone upperpath [ 759.509721][ T30] audit: type=1400 audit(1766361631.739:1054): avc: denied { ioctl } for pid=14015 comm="syz.3.2041" path="/dev/usbmon7" dev="devtmpfs" ino=737 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 760.639960][T14029] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2044'. [ 761.126749][T14029] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2044'. [ 761.159134][ T30] audit: type=1400 audit(1766361633.389:1055): avc: denied { ioctl } for pid=14042 comm="syz.1.2048" path="socket:[39190]" dev="sockfs" ino=39190 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 761.195615][T14043] netlink: 'syz.1.2048': attribute type 10 has an invalid length. [ 761.206427][T14043] bond0: (slave wlan1): Opening slave failed [ 761.322680][ T5927] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 761.501632][ T5927] usb 4-1: Using ep0 maxpacket: 32 [ 761.512116][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.882183][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.913125][ T5927] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 761.930906][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.975237][ T5927] usb 4-1: config 0 descriptor?? [ 761.999068][ T5927] hub 4-1:0.0: USB hub found [ 762.056580][T14052] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2051'. [ 762.078223][T14052] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2051'. [ 762.217380][ T5927] hub 4-1:0.0: 1 port detected [ 762.253824][T14055] trusted_key: encrypted_key: keyword 'ÿew' not recognized [ 764.264087][ T5927] usb 4-1: USB disconnect, device number 43 [ 766.100617][T14101] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 769.070999][T10112] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 769.242598][T10112] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 769.682361][T10112] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 769.691613][T10112] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 769.714803][T10112] usb 5-1: config 0 descriptor?? [ 770.810940][ T6005] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 770.988654][ T6005] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 771.010229][ T6005] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 771.027649][ T6005] usb 4-1: config 0 has no interface number 0 [ 771.035318][ T6005] usb 4-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 771.049168][ T6005] usb 4-1: config 0 interface 41 has no altsetting 0 [ 771.077458][ T6005] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 771.118977][ T6005] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.185643][ T6005] usb 4-1: Product: syz [ 771.193750][ T6005] usb 4-1: Manufacturer: syz [ 771.208778][ T6005] usb 4-1: SerialNumber: syz [ 771.267931][ T6005] usb 4-1: config 0 descriptor?? [ 771.289574][ T6005] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 771.875569][T14172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2080'. [ 772.374309][T10112] usbhid 5-1:0.0: can't add hid device: -71 [ 772.391738][T10112] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 772.424341][T10112] usb 5-1: USB disconnect, device number 52 [ 772.545330][T14179] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2081'. [ 772.579684][T14179] netlink: 'syz.4.2081': attribute type 1 has an invalid length. [ 772.587523][T14179] netlink: 'syz.4.2081': attribute type 2 has an invalid length. [ 773.431677][ T6637] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 773.581936][T14194] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2087'. [ 773.600969][ T6637] usb 5-1: Using ep0 maxpacket: 32 [ 773.611815][T14194] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2087'. [ 773.624445][ T6637] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 773.634799][ T6637] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.653955][ T6637] usb 5-1: Product: syz [ 773.663299][ T6637] usb 5-1: Manufacturer: syz [ 773.673346][ T6637] usb 5-1: SerialNumber: syz [ 773.692366][ T6637] usb 5-1: config 0 descriptor?? [ 773.750068][T14197] netlink: 'syz.1.2088': attribute type 2 has an invalid length. [ 773.866049][T14201] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2090'. [ 773.885060][T14201] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2090'. [ 774.498208][ T10] usb 4-1: USB disconnect, device number 44 [ 774.613696][T14207] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2092'. [ 774.642151][T14211] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2091'. [ 775.860932][ T5927] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 776.033142][ T5927] usb 6-1: config 16 has an invalid interface number: 19 but max is 0 [ 776.044328][ T5927] usb 6-1: config 16 has no interface number 0 [ 776.050925][ T5927] usb 6-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 776.062845][ T5927] usb 6-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 776.192745][ T6637] usb 5-1: USB disconnect, device number 53 [ 776.329258][ T5927] usb 6-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 776.339036][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.347374][ T5927] usb 6-1: Product: syz [ 776.351881][ T5927] usb 6-1: Manufacturer: syz [ 776.356485][ T5927] usb 6-1: SerialNumber: syz [ 776.423612][T14239] netlink: 'syz.2.2098': attribute type 10 has an invalid length. [ 776.884927][T14245] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2101'. [ 776.905469][ T5927] usb 6-1: USB disconnect, device number 54 [ 776.923316][T14245] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2101'. [ 776.975477][T14132] udevd[14132]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 777.079988][T14228] delete_channel: no stack [ 777.192366][ T30] audit: type=1400 audit(1766361649.419:1056): avc: denied { set_context_mgr } for pid=14252 comm="syz.3.2104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 777.196161][T14253] binder: 14252:14253 ioctl 7a0 0 returned -22 [ 777.411208][ T6637] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 777.575412][ T6637] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 777.583809][ T6637] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 777.624710][ T6637] usb 5-1: config 0 has no interface number 0 [ 777.644921][ T6637] usb 5-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 777.681592][ T6637] usb 5-1: config 0 interface 41 has no altsetting 0 [ 777.705711][ T6637] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 777.709218][T14264] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2107'. [ 777.749810][ T6637] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.762084][ T6637] usb 5-1: Product: syz [ 777.767521][ T6637] usb 5-1: Manufacturer: syz [ 777.774762][ T6637] usb 5-1: SerialNumber: syz [ 777.817257][ T6637] usb 5-1: config 0 descriptor?? [ 778.139651][ T6637] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 778.229194][T14263] SELinux: failed to load policy [ 778.750364][T14279] C: renamed from team_slave_0 (while UP) [ 778.802683][T14279] netlink: 'syz.1.2111': attribute type 2 has an invalid length. [ 778.838149][T14279] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2111'. [ 778.873805][T14279] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 778.898118][T14285] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2112'. [ 778.920935][ T6637] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 778.937856][T14285] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2112'. [ 779.001287][T14284] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2109'. [ 779.084137][T14288] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2113'. [ 779.101154][ T6637] usb 4-1: Using ep0 maxpacket: 32 [ 779.108642][T14288] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 779.116917][T14288] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 779.129349][ T6637] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 779.138700][ T6637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.147067][ T6637] usb 4-1: Product: syz [ 779.156596][ T6637] usb 4-1: Manufacturer: syz [ 779.171557][ T6637] usb 4-1: SerialNumber: syz [ 779.193014][ T6637] usb 4-1: config 0 descriptor?? [ 780.159952][ T977] usb 5-1: USB disconnect, device number 54 [ 780.554261][T14305] »»»»»»: renamed from dummy0 (while UP) [ 781.007529][T14315] SELinux: policydb magic number 0x5f434d53 does not match expected magic number 0xf97cff8c [ 781.060773][T14315] SELinux: failed to load policy [ 781.060907][T14314] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2120'. [ 781.618444][ T30] audit: type=1400 audit(1766361653.679:1057): avc: denied { write } for pid=14318 comm="syz.4.2121" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 781.896255][ T977] usb 4-1: USB disconnect, device number 45 [ 782.878046][T14348] 9pnet_fd: Insufficient options for proto=fd [ 782.901069][T14347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 782.931852][ T977] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 783.115219][ T977] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 783.130649][ T977] usb 5-1: config 0 has no interface number 0 [ 783.138862][T14357] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2133'. [ 783.179122][ T977] usb 5-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 783.190429][ T977] usb 5-1: config 0 interface 41 has no altsetting 0 [ 783.202518][ T977] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 783.212233][ T977] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.311081][ T977] usb 5-1: Product: syz [ 783.315696][ T977] usb 5-1: Manufacturer: syz [ 783.320330][ T977] usb 5-1: SerialNumber: syz [ 783.328381][ T977] usb 5-1: config 0 descriptor?? [ 783.343704][ T977] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 785.015751][ T30] audit: type=1400 audit(1766361657.249:1058): avc: denied { getopt } for pid=14390 comm="syz.3.2143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 785.489851][ T30] audit: type=1400 audit(1766361657.329:1059): avc: denied { read write } for pid=14390 comm="syz.3.2143" name="file0" dev="fuse" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 785.514423][ T30] audit: type=1400 audit(1766361657.329:1060): avc: denied { open } for pid=14390 comm="syz.3.2143" path="/407/file0/file0" dev="fuse" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 785.776089][ T5938] usb 5-1: USB disconnect, device number 55 [ 785.908621][ T30] audit: type=1400 audit(1766361658.139:1061): avc: denied { name_bind 0x1000000 } for pid=14399 comm="syz.1.2145" path="socket:[40925]" dev="sockfs" ino=40925 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 791.838308][T14447] overlayfs: failed to clone upperpath [ 792.151149][T14452] overlayfs: empty lowerdir [ 792.253895][T14452] overlayfs: empty lowerdir [ 792.317736][T14452] overlayfs: empty lowerdir [ 792.335017][T14452] overlayfs: empty lowerdir [ 792.343338][T14452] overlayfs: empty lowerdir [ 792.356132][T14452] overlayfs: empty lowerdir [ 792.375406][T14452] overlayfs: empty lowerdir [ 792.392651][T14452] overlayfs: empty lowerdir [ 792.405002][T14452] overlayfs: empty lowerdir [ 792.413507][T14452] overlayfs: empty lowerdir [ 792.448995][T14452] overlayfs: empty lowerdir [ 792.456369][T14452] overlayfs: empty lowerdir [ 792.463457][T14452] overlayfs: empty lowerdir [ 792.471345][T14452] overlayfs: empty lowerdir [ 792.476785][T14458] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2158'. [ 792.491582][T14452] overlayfs: empty lowerdir [ 792.498045][T14452] overlayfs: empty lowerdir [ 792.505710][T14452] overlayfs: empty lowerdir [ 792.515828][T14452] overlayfs: empty lowerdir [ 792.524398][T14452] overlayfs: empty lowerdir [ 792.533716][T14452] overlayfs: empty lowerdir [ 792.539782][T14452] overlayfs: empty lowerdir [ 792.545967][T14452] overlayfs: empty lowerdir [ 792.558109][T14452] overlayfs: empty lowerdir [ 792.563106][T14452] overlayfs: empty lowerdir [ 792.568431][T14452] overlayfs: empty lowerdir [ 792.579569][T14452] overlayfs: empty lowerdir [ 792.585029][T14452] overlayfs: empty lowerdir [ 792.592435][T14452] overlayfs: empty lowerdir [ 792.607554][T14452] overlayfs: empty lowerdir [ 792.615511][T14452] overlayfs: empty lowerdir [ 792.620520][T14452] overlayfs: empty lowerdir [ 792.630673][T14452] overlayfs: empty lowerdir [ 792.647417][T14452] overlayfs: empty lowerdir [ 792.740974][ T977] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 792.904547][ T977] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 793.016601][ T977] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 793.049153][ T977] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 793.083537][T14471] netlink: 'syz.1.2163': attribute type 2 has an invalid length. [ 793.132717][ T977] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 793.142455][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.173247][T14469] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2162'. [ 793.183005][T14469] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2162'. [ 793.207167][ T977] usb 4-1: config 0 descriptor?? [ 793.591221][T10112] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 793.617204][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.624775][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.644674][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.672600][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.679998][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.721237][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.746617][ T977] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 793.766485][T10112] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 793.781667][ T977] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 793.814333][T10112] usb 5-1: config 0 has no interface number 0 [ 793.880002][ T977] usb 4-1: USB disconnect, device number 46 [ 794.109557][T14489] fido_id[14489]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 794.152339][T10112] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 794.179775][T10112] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.219116][T10112] usb 5-1: Product: syz [ 794.236688][T10112] usb 5-1: Manufacturer: syz [ 794.255006][T10112] usb 5-1: SerialNumber: syz [ 794.271518][T10112] usb 5-1: config 0 descriptor?? [ 794.870283][T10112] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 794.896195][T10112] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 794.927706][T10112] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 794.960930][T10112] usb 5-1: media controller created [ 794.992621][T14498] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2172'. [ 795.004094][T10112] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 795.012645][ T5938] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 795.071696][T14498] netlink: 'syz.1.2172': attribute type 16 has an invalid length. [ 795.079990][T14498] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2172'. [ 795.111326][T14501] fuse: Bad value for 'group_id' [ 795.116282][T14501] fuse: Bad value for 'group_id' [ 795.174692][ T5938] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 795.200879][T14498] bridge0: port 1(bridge_slave_0) entered disabled state [ 795.222145][T14505] bridge0: port 2(bridge_slave_1) entered disabled state [ 795.251815][ T5938] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 795.304698][ T5938] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 795.378853][T14505] bridge0: entered allmulticast mode [ 795.427076][ T5938] usb 6-1: config 220 has no interface number 2 [ 795.458836][T14498] netlink: 'syz.1.2172': attribute type 2 has an invalid length. [ 795.500781][ T5938] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 795.791856][T14509] bridge_slave_1: left allmulticast mode [ 795.834201][ T5938] usb 6-1: config 220 interface 0 has no altsetting 0 [ 795.892003][T14509] bridge_slave_1: left promiscuous mode [ 795.932662][ T5938] usb 6-1: config 220 interface 76 has no altsetting 0 [ 796.013927][ T5938] usb 6-1: config 220 interface 1 has no altsetting 0 [ 796.027960][T14509] bridge0: port 2(bridge_slave_1) entered disabled state [ 796.086379][ T5938] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 796.174971][ T5938] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.211127][T10112] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 796.235033][ T5938] usb 6-1: Product: syz [ 796.252034][ T5938] usb 6-1: Manufacturer: syz [ 796.256646][ T5938] usb 6-1: SerialNumber: syz [ 796.300517][T10112] usb 5-1: USB disconnect, device number 56 [ 796.370594][T14509] bridge_slave_0: left promiscuous mode [ 796.412250][T14509] bridge0: port 1(bridge_slave_0) entered disabled state [ 797.583661][ T5938] uvcvideo 6-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 797.625519][ T5938] uvcvideo 6-1:220.0: No valid video chain found. [ 797.632080][ T5938] usb 6-1: selecting invalid altsetting 0 [ 797.667227][ T5938] usb 6-1: selecting invalid altsetting 0 [ 797.673836][ T5938] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 797.688619][ T5938] usb 6-1: USB disconnect, device number 55 [ 799.831220][ T977] usb 6-1: new full-speed USB device number 56 using dummy_hcd [ 799.909799][T14556] netlink: 'syz.2.2189': attribute type 1 has an invalid length. [ 799.956548][T14556] 8021q: adding VLAN 0 to HW filter on device bond3 [ 799.992613][ T977] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 800.001154][ T977] usb 6-1: config 0 has no interface number 0 [ 800.003954][T14556] bond3: (slave geneve2): making interface the new active one [ 800.007357][ T977] usb 6-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 800.028275][ T977] usb 6-1: config 0 interface 41 has no altsetting 0 [ 800.037683][ T977] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 800.043131][T14556] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 800.058146][ T977] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.067132][ T977] usb 6-1: Product: syz [ 800.071219][ T4875] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.071715][ T977] usb 6-1: Manufacturer: syz [ 800.090979][ T977] usb 6-1: SerialNumber: syz [ 800.095730][ T5938] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 800.107357][ T977] usb 6-1: config 0 descriptor?? [ 800.113776][ T4875] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.115477][ T977] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -22 [ 800.147237][ T4875] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.166875][ T4875] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.175864][ T10] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 800.330964][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 800.337696][ T5938] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 800.345810][ T5938] usb 4-1: config 0 has no interface number 0 [ 800.361488][ T5938] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 800.391043][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 800.409778][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.419916][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 800.804874][ T10] usb 5-1: config 0 has no interface number 0 [ 800.811699][ T5938] usb 4-1: Product: syz [ 800.823485][ T5938] usb 4-1: Manufacturer: syz [ 800.834782][ T5938] usb 4-1: SerialNumber: syz [ 800.846106][ T10] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 800.858110][ T5938] usb 4-1: config 0 descriptor?? [ 800.864548][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.873012][ T10] usb 5-1: Product: syz [ 800.877623][ T10] usb 5-1: Manufacturer: syz [ 800.879747][ T5938] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 800.893375][ T10] usb 5-1: SerialNumber: syz [ 800.900360][ T10] usb 5-1: config 0 descriptor?? [ 800.911901][ T5938] usb 4-1: selecting invalid altsetting 1 [ 800.917664][ T5938] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 800.928155][ T10] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 800.939530][ T5938] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 800.951851][ T10] usb 5-1: selecting invalid altsetting 1 [ 800.957597][ T10] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 800.966148][ T5938] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 800.976994][ T10] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 800.987451][ T5938] usb 4-1: media controller created [ 800.998760][ T5938] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 801.013726][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 801.022198][ T10] usb 5-1: media controller created [ 801.051136][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 802.045131][T14570] kAFS: unparsable volume name [ 802.121124][ T5938] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 802.128738][ T5938] zl10353_read_register: readreg error (reg=127, ret==-110) [ 802.201942][ T10] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 802.209706][ T10] zl10353_read_register: readreg error (reg=127, ret==-110) [ 802.359794][T14588] netlink: 'syz.1.2195': attribute type 10 has an invalid length. [ 803.261393][ T5938] usb 4-1: USB disconnect, device number 47 [ 803.271371][ T6637] usb 5-1: USB disconnect, device number 57 [ 803.370135][ T10] usb 6-1: USB disconnect, device number 56 [ 803.452116][T14582] delete_channel: no stack [ 803.895458][T14595] SELinux: failed to load policy [ 805.511025][ T10] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 806.052387][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 806.059155][ T10] usb 6-1: config 0 has an invalid interface number: 71 but max is 1 [ 806.080413][ T10] usb 6-1: config 0 has an invalid interface number: 220 but max is 1 [ 806.098246][ T10] usb 6-1: config 0 has no interface number 0 [ 806.111949][ T10] usb 6-1: config 0 has no interface number 1 [ 806.124022][ T10] usb 6-1: config 0 interface 71 has no altsetting 0 [ 806.132836][T14625] tipc: Enabling of bearer rejected, failed to enable media [ 806.155777][ T10] usb 6-1: config 0 interface 220 has no altsetting 0 [ 806.175391][ T10] usb 6-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=1b.69 [ 806.189301][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.203577][ T10] usb 6-1: Product: syz [ 806.216271][ T10] usb 6-1: Manufacturer: syz [ 806.228234][ T10] usb 6-1: SerialNumber: syz [ 806.245423][ T10] usb 6-1: config 0 descriptor?? [ 806.684607][ T10] usb 6-1: USB disconnect, device number 57 [ 806.757386][T14132] udevd[14132]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.71/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 807.441046][ T6251] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 807.741091][ T6251] usb 5-1: Using ep0 maxpacket: 8 [ 807.781077][ T6251] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 808.138335][ T6251] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 808.182479][ T6251] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 808.207712][ T6251] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 808.248777][ T6251] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 808.266719][T14648] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2210'. [ 808.292720][ T6251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 808.403127][ T6251] usbtmc 5-1:16.0: bulk endpoints not found [ 808.426142][T14653] netlink: 'syz.2.2210': attribute type 1 has an invalid length. [ 808.444608][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.461690][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.710215][T14653] netlink: 'syz.2.2210': attribute type 2 has an invalid length. [ 809.757129][ T977] usb 5-1: USB disconnect, device number 58 [ 810.765984][T14666] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2214'. [ 810.776665][T14666] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2214'. [ 810.828799][ T30] audit: type=1400 audit(1766361683.059:1062): avc: denied { read } for pid=14664 comm="syz.2.2216" path="socket:[41334]" dev="sockfs" ino=41334 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 810.895968][ T30] audit: type=1400 audit(1766361683.059:1063): avc: denied { ioctl } for pid=14664 comm="syz.2.2216" path="socket:[41334]" dev="sockfs" ino=41334 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 811.234626][T14654] SELinux: failed to load policy [ 812.442208][ T30] audit: type=1400 audit(1766361684.669:1064): avc: denied { read } for pid=14696 comm="syz.3.2222" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 813.810987][ T5884] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 813.984597][ T5884] usb 6-1: Using ep0 maxpacket: 8 [ 814.002529][ T5884] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 814.023001][ T5884] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 814.045849][ T5884] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 814.060188][ T5884] usb 6-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 814.075710][ T5884] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 814.133145][ T5884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 814.219084][ T5884] usbtmc 6-1:16.0: bulk endpoints not found [ 814.815088][T14730] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2231'. [ 814.914038][T14730] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2231'. [ 816.261557][ T5884] usb 6-1: USB disconnect, device number 58 [ 817.368566][T14780] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 817.475820][T14784] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 817.523754][T14784] netlink: 'syz.4.2241': attribute type 2 has an invalid length. [ 817.749476][T14786] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2245'. [ 817.760518][T14786] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2245'. [ 818.352641][T14800] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 818.362058][T14800] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 820.391084][ T5938] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 820.698058][ T5938] usb 4-1: config 16 has an invalid interface number: 19 but max is 0 [ 820.711897][T10112] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 820.720027][ T5938] usb 4-1: config 16 has no interface number 0 [ 820.738619][ T5938] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 820.752696][ T5938] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 820.878470][T10112] usb 5-1: device descriptor read/64, error -71 [ 820.936333][ T5938] usb 4-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 820.946558][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.962032][ T5938] usb 4-1: Product: syz [ 820.968437][ T5938] usb 4-1: Manufacturer: syz [ 820.973250][ T5938] usb 4-1: SerialNumber: syz [ 821.109389][T14837] netlink: 'syz.1.2259': attribute type 2 has an invalid length. [ 821.157254][T14835] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2258'. [ 821.168922][T14835] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2258'. [ 821.201056][T10112] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 821.218723][T14841] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2260'. [ 821.277798][ T5938] usb 4-1: USB disconnect, device number 48 [ 821.289086][T14132] udevd[14132]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 821.371122][T10112] usb 5-1: device descriptor read/64, error -71 [ 821.374493][T14845] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2262'. [ 821.393331][T14846] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 821.404459][T14845] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2262'. [ 821.481550][T10112] usb usb5-port1: attempt power cycle [ 822.135057][T10112] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 822.192382][T10112] usb 5-1: device descriptor read/8, error -71 [ 822.511323][T10112] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 822.541998][T10112] usb 5-1: device descriptor read/8, error -71 [ 822.583965][ T6251] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 822.651470][T10112] usb usb5-port1: unable to enumerate USB device [ 822.820587][T14871] fuse: Bad value for 'fd' [ 823.503637][ T6251] usb 6-1: Using ep0 maxpacket: 16 [ 823.517247][ T6251] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 823.559034][ T6251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.593508][ T6251] usb 6-1: Product: syz [ 823.597703][ T6251] usb 6-1: Manufacturer: syz [ 823.623813][ T6251] usb 6-1: SerialNumber: syz [ 823.646826][ T6251] usb 6-1: config 0 descriptor?? [ 824.020295][ T6251] visor 6-1:0.0: Sony Clie 3.5 converter detected [ 824.029017][T14875] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 824.109614][T14875] netlink: 'syz.4.2271': attribute type 2 has an invalid length. [ 824.642077][T14880] CIFS mount error: No usable UNC path provided in device string! [ 824.642077][T14880] [ 824.669133][T14880] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 824.973800][T14891] IPv6: NLM_F_CREATE should be specified when creating new route [ 825.361936][ T30] audit: type=1400 audit(1766361697.589:1065): avc: denied { mounton } for pid=14905 comm="syz.2.2281" path="/552/file0" dev="tmpfs" ino=2974 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 825.504107][T14911] No source specified [ 826.371316][ T5938] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 826.530938][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 826.538657][ T5938] usb 4-1: config 0 has an invalid interface number: 29 but max is 0 [ 826.547332][ T5938] usb 4-1: config 0 has no interface number 0 [ 826.554320][ T5938] usb 4-1: config 0 interface 29 has no altsetting 0 [ 826.567036][ T5938] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 826.576813][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.585080][ T5938] usb 4-1: Product: syz [ 826.589769][ T5938] usb 4-1: Manufacturer: syz [ 826.594671][ T5938] usb 4-1: SerialNumber: syz [ 826.603039][ T5938] usb 4-1: config 0 descriptor?? [ 827.413239][ T6251] usb 6-1: clie_3_5_startup: get interface number failed: -71 [ 827.448956][ T6251] visor 6-1:0.0: probe with driver visor failed with error -71 [ 827.509424][ T6251] usb 6-1: USB disconnect, device number 59 [ 827.980100][T14958] netlink: 'syz.2.2294': attribute type 4 has an invalid length. [ 828.718796][ T5938] peak_usb 4-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 828.837957][ T5938] peak_usb 4-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 829.112612][ T5938] peak_usb 4-1:0.29: probe with driver peak_usb failed with error -71 [ 829.619138][ T6251] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 829.678484][ T5938] usb 4-1: USB disconnect, device number 49 [ 829.814004][ T6251] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 829.907027][ T6251] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 829.937293][ T6251] usb 6-1: New USB device found, idVendor=04b4, idProduct=ed81, bcdDevice= 0.00 [ 829.957477][ T6251] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.986480][ T6251] usb 6-1: config 0 descriptor?? [ 830.213683][ T6251] cypress 0003:04B4:ED81.001C: unknown main item tag 0x2 [ 830.231508][ T6251] cypress 0003:04B4:ED81.001C: hidraw0: USB HID v0.00 Device [HID 04b4:ed81] on usb-dummy_hcd.5-1/input0 [ 830.276579][ T6251] usb 6-1: USB disconnect, device number 60 [ 830.322335][ T5938] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 830.555362][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 830.613536][T14980] fido_id[14980]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 830.644999][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 830.896702][ T5938] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 830.919658][ T5938] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 830.993066][ T5938] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.027168][ T5938] usb 5-1: config 0 descriptor?? [ 831.952132][ T5938] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 831.992470][ T5938] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 832.003052][ T5938] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 832.111194][ T5938] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 832.179616][ T5938] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 832.246219][ T5938] plantronics 0003:047F:FFFF.001D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 832.303378][ T5938] usb 5-1: USB disconnect, device number 63 [ 832.429365][T15001] fido_id[15001]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 832.871051][ T10] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 833.123719][ T10] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 833.134688][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.747075][ T10] usb 6-1: Product: syz [ 833.755615][ T10] usb 6-1: Manufacturer: syz [ 833.769532][ T10] usb 6-1: SerialNumber: syz [ 833.962702][ T10] usb 6-1: config 0 descriptor?? [ 835.534908][ T10] usb 6-1: USB disconnect, device number 61 [ 835.606347][ T30] audit: type=1400 audit(1766361707.839:1066): avc: denied { mount } for pid=15036 comm="syz.2.2316" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 835.631142][T15037] overlayfs: failed to clone lowerpath [ 835.762384][T15041] trusted_key: syz.1.2318 sent an empty control message without MSG_MORE. [ 835.811002][ T6251] usb 4-1: new full-speed USB device number 50 using dummy_hcd [ 836.091025][ T6251] usb 4-1: config 16 has an invalid interface number: 19 but max is 0 [ 836.120935][ T6251] usb 4-1: config 16 has no interface number 0 [ 836.127159][ T6251] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 836.593085][ T6251] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 836.708457][ T6251] usb 4-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 836.755287][ T6251] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.804890][ T6251] usb 4-1: Product: syz [ 836.809084][ T6251] usb 4-1: Manufacturer: syz [ 836.830889][ T6251] usb 4-1: SerialNumber: syz [ 837.609702][T15064] netlink: 'syz.5.2322': attribute type 10 has an invalid length. [ 837.825599][ T6251] usb 4-1: USB disconnect, device number 50 [ 837.861821][T14132] udevd[14132]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 837.921438][T15066] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2324'. [ 838.035859][T15060] SELinux: failed to load policy [ 838.149252][T15066] netlink: 'syz.1.2324': attribute type 1 has an invalid length. [ 838.157009][T15066] netlink: 'syz.1.2324': attribute type 2 has an invalid length. [ 838.345101][T15057] delete_channel: no stack [ 838.551041][ T6251] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 838.640039][T15075] netlink: 'syz.3.2328': attribute type 4 has an invalid length. [ 838.712730][T15075] netlink: 'syz.3.2328': attribute type 4 has an invalid length. [ 838.739954][ T6251] usb 5-1: Using ep0 maxpacket: 32 [ 838.744485][T15078] CUSE: info not properly terminated [ 838.753003][ T6251] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 838.793002][ T6251] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0120, bcdDevice=f9.ad [ 838.828517][ T6251] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.836879][ T6251] usb 5-1: Product: syz [ 838.851742][ T6251] usb 5-1: Manufacturer: syz [ 838.856366][ T6251] usb 5-1: SerialNumber: syz [ 838.883362][ T6251] usb 5-1: config 0 descriptor?? [ 838.890213][ T6251] kvaser_usb 5-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 839.420267][T15089] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2326'. [ 839.593947][T15089] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 839.710958][ T30] audit: type=1400 audit(1766361711.919:1067): avc: denied { create } for pid=15080 comm="syz.5.2330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 839.794055][ T30] audit: type=1400 audit(1766361711.939:1068): avc: denied { write } for pid=15080 comm="syz.5.2330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 840.115955][ T5927] usb 5-1: USB disconnect, device number 64 [ 841.152938][T15100] overlayfs: failed to clone upperpath [ 841.805133][T15107] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2334'. [ 841.906608][T15107] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2334'. [ 842.352291][T15115] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2337'. [ 842.369279][T15115] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2337'. [ 842.425953][T15118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.434799][T15118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 843.086991][ T6251] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 843.250908][ T6251] usb 5-1: Using ep0 maxpacket: 32 [ 843.265231][ T6251] usb 5-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 843.294147][ T6251] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.314086][ T6251] usb 5-1: Product: syz [ 843.325289][ T6251] usb 5-1: Manufacturer: syz [ 843.336419][ T6251] usb 5-1: SerialNumber: syz [ 843.401572][ T6251] usb 5-1: config 0 descriptor?? [ 843.452622][ T6251] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 843.665242][ T6251] gspca_topro: reg_w err -71 [ 843.690952][ T6251] gspca_topro: Sensor soi763a [ 843.712122][ T6251] usb 5-1: USB disconnect, device number 65 [ 844.871037][ T10] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 845.842058][ C0] raw-gadget.0 gadget.5: ignoring, device is not running [ 846.170910][ T10] usb 6-1: device descriptor read/64, error -32 [ 846.251270][T15145] fuse: Bad value for 'fd' [ 846.306495][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2345'. [ 846.626414][T15155] overlayfs: failed to clone upperpath [ 847.001287][ T5927] usb 5-1: new low-speed USB device number 66 using dummy_hcd [ 847.257592][T15147] SELinux: failed to load policy [ 847.324788][ T5927] usb 5-1: Invalid ep0 maxpacket: 64 [ 847.851191][ T5927] usb 5-1: new low-speed USB device number 67 using dummy_hcd [ 848.140991][ T5927] usb 5-1: Invalid ep0 maxpacket: 64 [ 848.150194][ T5927] usb usb5-port1: attempt power cycle [ 848.711488][ T5927] usb 5-1: new low-speed USB device number 68 using dummy_hcd [ 848.742455][ T5927] usb 5-1: Invalid ep0 maxpacket: 64 [ 849.121079][ T5927] usb 5-1: new low-speed USB device number 69 using dummy_hcd [ 849.619680][ T30] audit: type=1326 audit(1766361721.839:1069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 849.691133][ T5927] usb 5-1: device descriptor read/8, error -71 [ 849.750074][ T30] audit: type=1326 audit(1766361721.849:1070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 849.809674][ T30] audit: type=1326 audit(1766361721.849:1071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 849.842719][ T5927] usb usb5-port1: unable to enumerate USB device [ 849.870971][T15182] netlink: 2 bytes leftover after parsing attributes in process `syz.4.2355'. [ 849.931791][ T30] audit: type=1326 audit(1766361721.849:1072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f98df98df90 code=0x7ffc0000 [ 849.975548][ T30] audit: type=1326 audit(1766361721.849:1073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 850.025458][T15184] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 850.057787][ T30] audit: type=1326 audit(1766361721.849:1074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 850.170957][ T5927] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 850.327006][ T30] audit: type=1326 audit(1766361722.019:1075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15178 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f98df9c2005 code=0x7ffc0000 [ 850.449151][ T30] audit: type=1326 audit(1766361722.019:1076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 850.552697][ T30] audit: type=1326 audit(1766361722.019:1077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15172 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 850.663126][ T30] audit: type=1326 audit(1766361722.159:1078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15178 comm="syz.1.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=60 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 851.421712][T15208] fuse: Bad value for 'fd' [ 853.047237][ T5927] usb 5-1: device descriptor read/all, error -71 [ 853.260458][T15215] loop6: detected capacity change from 0 to 2640 [ 853.284130][T15215] buffer_io_error: 7 callbacks suppressed [ 853.284145][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 853.329375][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 853.436887][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 853.463688][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 853.509537][T15225] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2366'. [ 853.707655][T15227] input: syz0 as /devices/virtual/input/input39 [ 853.981524][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.018286][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.055726][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.128423][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.261651][T15215] ldm_validate_partition_table(): Disk read failed. [ 854.303860][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.341299][T15215] Buffer I/O error on dev loop6, logical block 0, async page read [ 854.382706][T15215] Dev loop6: unable to read RDB block 0 [ 854.751288][T15215] loop6: unable to read partition table [ 854.764715][T15242] overlayfs: failed to clone upperpath [ 854.779199][T15215] loop_reread_partitions: partition scan of loop6 (3„ ¾‚³˜) failed (rc=-5) [ 855.722053][ T5927] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 856.010913][ T5927] usb 5-1: Using ep0 maxpacket: 32 [ 856.020751][ T5927] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 856.029733][ T5927] usb 5-1: config 0 has no interface number 0 [ 856.253989][T15273] input: syz0 as /devices/virtual/input/input40 [ 856.350710][ T5927] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 856.493071][ T5927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.808247][ T5927] usb 5-1: Product: syz [ 857.443643][ T5927] usb 5-1: Manufacturer: syz [ 857.454611][ T5927] usb 5-1: SerialNumber: syz [ 857.468223][ T5927] usb 5-1: config 0 descriptor?? [ 857.542029][ T5927] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 857.550932][ T5927] usb 5-1: selecting invalid altsetting 1 [ 857.556662][ T5927] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 857.683891][ T5927] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 857.757741][ T5927] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 858.363099][ T5927] usb 5-1: media controller created [ 858.752801][ T5927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 859.435514][ T5927] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 859.443064][ T5927] zl10353_read_register: readreg error (reg=127, ret==-71) [ 859.450997][ T5927] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 859.528252][ T5927] usb 5-1: USB disconnect, device number 72 [ 859.775611][T15315] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2389'. [ 859.796989][T15315] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2389'. [ 860.765945][T15344] input: syz0 as /devices/virtual/input/input41 [ 861.044334][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 861.044349][ T30] audit: type=1400 audit(1766361733.279:1111): avc: denied { getopt } for pid=15342 comm="syz.1.2398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 861.711852][ T5884] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 861.872288][ T5884] usb 6-1: Using ep0 maxpacket: 32 [ 862.465778][ T5884] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 862.489444][ T5884] usb 6-1: config 0 has no interface number 0 [ 862.523924][ T5884] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 862.551826][ T5884] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.575782][ T5884] usb 6-1: Product: syz [ 862.581520][ T5884] usb 6-1: Manufacturer: syz [ 862.630464][T15364] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2401'. [ 862.933558][ T5884] usb 6-1: SerialNumber: syz [ 862.972842][ T5884] usb 6-1: config 0 descriptor?? [ 863.019246][ T5884] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 863.059304][ T5884] usb 6-1: selecting invalid altsetting 1 [ 863.085344][ T5884] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 863.117147][ T5884] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 863.178383][ T5884] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 863.198373][ T5884] usb 6-1: media controller created [ 863.219120][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 864.472195][ T6251] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 864.770032][ T6251] usb 5-1: config 0 has an invalid descriptor of length 137, skipping remainder of the config [ 864.822133][ T6251] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 864.912235][ T5884] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 864.919245][ T5884] zl10353_read_register: readreg error (reg=127, ret==-71) [ 864.948360][ T5884] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 864.978265][ T6251] usb 5-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 865.016734][ T6251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.042023][ T6251] usb 5-1: config 0 descriptor?? [ 865.118424][ T5884] usb 6-1: USB disconnect, device number 64 [ 866.577780][T15426] /dev/nullb0: Can't lookup blockdev [ 867.491229][ T977] usb 5-1: USB disconnect, device number 73 [ 867.798936][T15435] fuse: Unknown parameter 'r' [ 868.231051][ T977] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 868.485332][ T977] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 868.504948][ T977] usb 5-1: New USB device found, idVendor=11ff, idProduct=3331, bcdDevice= 0.00 [ 868.515614][ T977] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 868.533759][ T977] usb 5-1: config 0 descriptor?? [ 868.607022][T15451] netlink: 208 bytes leftover after parsing attributes in process `syz.2.2425'. [ 868.948710][ T977] gembird 0003:11FF:3331.001E: unknown main item tag 0x0 [ 868.957926][ T977] gembird 0003:11FF:3331.001E: unknown main item tag 0x0 [ 868.965568][ T977] gembird 0003:11FF:3331.001E: unknown main item tag 0x0 [ 868.973111][ T977] gembird 0003:11FF:3331.001E: unknown main item tag 0x0 [ 868.980310][ T977] gembird 0003:11FF:3331.001E: unknown main item tag 0x0 [ 868.990585][ T977] gembird 0003:11FF:3331.001E: hidraw0: USB HID v0.00 Device [HID 11ff:3331] on usb-dummy_hcd.4-1/input0 [ 869.101159][ T5968] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 869.441127][ T5968] usb 6-1: Using ep0 maxpacket: 32 [ 869.448622][ T5968] usb 6-1: config 0 has no interfaces? [ 869.460588][ T5968] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 869.483846][ T5968] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.521350][ T5968] usb 6-1: config 0 descriptor?? [ 869.573713][T15468] netlink: 'syz.3.2430': attribute type 14 has an invalid length. [ 869.739448][T15455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 869.748247][T15455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 869.757551][ T5927] usb 6-1: USB disconnect, device number 65 [ 869.860965][ T977] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 869.894572][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.900955][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 869.943541][ T30] audit: type=1326 audit(1766361742.179:1112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 869.976166][ T30] audit: type=1326 audit(1766361742.179:1113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.000674][ T30] audit: type=1326 audit(1766361742.209:1114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.001147][ T977] usb 4-1: device descriptor read/64, error -71 [ 870.031307][ T30] audit: type=1326 audit(1766361742.209:1115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.055206][ T30] audit: type=1326 audit(1766361742.209:1116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.078946][ T30] audit: type=1326 audit(1766361742.209:1117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.103891][ T30] audit: type=1326 audit(1766361742.209:1118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.128632][ T30] audit: type=1326 audit(1766361742.209:1119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.1.2435" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98df98f749 code=0x7ffc0000 [ 870.281350][ T977] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 870.340929][ T5927] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 870.411106][ T977] usb 4-1: device descriptor read/64, error -71 [ 870.493994][ T5927] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 870.502448][ T5927] usb 6-1: config 0 has no interface number 0 [ 870.508664][ T5927] usb 6-1: config 0 interface 184 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 870.523452][ T977] usb usb4-port1: attempt power cycle [ 870.530121][ T5927] usb 6-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 870.543734][ T5927] usb 6-1: config 0 interface 184 has no altsetting 0 [ 870.554867][ T5927] usb 6-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=69.ee [ 870.564121][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.573047][ T5927] usb 6-1: Product: syz [ 870.577310][ T5927] usb 6-1: Manufacturer: syz [ 870.592034][ T5927] usb 6-1: SerialNumber: syz [ 870.606045][ T5927] usb 6-1: config 0 descriptor?? [ 870.619769][ T5927] ttusbir 6-1:0.184: cannot find expected altsetting [ 871.081554][ T6251] usb 6-1: USB disconnect, device number 66 [ 871.662984][ T5884] usb 5-1: USB disconnect, device number 74 [ 871.668957][ T977] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 871.695497][ T977] usb 4-1: device descriptor read/8, error -71 [ 871.795819][T15489] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 871.996160][ T5968] IPVS: starting estimator thread 0... [ 872.051273][ T977] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 872.222485][T15494] IPVS: using max 63 ests per chain, 151200 per kthread [ 872.284400][ T977] usb 4-1: device descriptor read/8, error -71 [ 872.482644][T15488] netlink: 'syz.5.2439': attribute type 2 has an invalid length. [ 872.531726][ T977] usb usb4-port1: unable to enumerate USB device [ 872.952454][T15515] netlink: 'syz.5.2445': attribute type 1 has an invalid length. [ 872.960297][T15515] netlink: 'syz.5.2445': attribute type 2 has an invalid length. [ 873.130323][T15518] affs: No valid root block on device nullb0 [ 875.924905][ T5968] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 876.121716][ T5968] usb 4-1: device descriptor read/64, error -71 [ 876.210727][T15555] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=15555 comm=syz.4.2456 [ 876.381354][ T5968] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 876.569112][T15563] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2457'. [ 876.585748][ T5968] usb 4-1: device descriptor read/64, error -71 [ 876.939682][T15566] ptrace attach of "./syz-executor exec"[5810] was attempted by "./syz-executor exec"[15566] [ 876.952102][ T5968] usb usb4-port1: attempt power cycle [ 877.198804][T15573] affs: No valid root block on device nullb0 [ 877.300910][ T5968] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 877.331619][ T5968] usb 4-1: device descriptor read/8, error -71 [ 877.600945][ T5968] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 877.634163][ T5968] usb 4-1: device descriptor read/8, error -71 [ 878.030284][ T5968] usb usb4-port1: unable to enumerate USB device [ 878.621596][ T5968] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 878.703971][ T5884] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 878.881076][ T5968] usb 5-1: Using ep0 maxpacket: 32 [ 878.887858][ T5968] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 878.907801][ T5968] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0120, bcdDevice=f9.ad [ 878.912727][ T5884] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 878.927590][ T5968] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.935953][ T5884] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 878.946295][ T5884] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 878.962639][ T5884] usb 4-1: config 0 descriptor?? [ 878.976216][ T5884] pwc: Askey VC010 type 2 USB webcam detected. [ 879.012479][T15597] SELinux: Context system_u:object_r:var_auth_t:s0 is not valid (left unmapped). [ 879.360899][ T5968] usb 5-1: Product: syz [ 879.365099][ T5968] usb 5-1: Manufacturer: syz [ 879.369701][ T5968] usb 5-1: SerialNumber: syz [ 879.382413][ T30] audit: type=1400 audit(1766361751.239:1120): avc: denied { relabelfrom } for pid=15594 comm="syz.1.2466" name="NETLINK" dev="sockfs" ino=44882 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 879.422553][ T30] audit: type=1400 audit(1766361751.269:1121): avc: denied { relabelto } for pid=15594 comm="syz.1.2466" name="NETLINK" dev="sockfs" ino=44882 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netlink_route_socket permissive=1 trawcon="system_u:object_r:var_auth_t:s0" [ 879.461359][ T5968] usb 5-1: config 0 descriptor?? [ 879.517773][ T5968] kvaser_usb 5-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 879.581670][ T5884] pwc: recv_control_msg error -32 req 02 val 2b00 [ 879.588980][ T5884] pwc: recv_control_msg error -32 req 02 val 2700 [ 879.627996][ T5884] pwc: recv_control_msg error -71 req 02 val 2c00 [ 879.649342][ T5884] pwc: recv_control_msg error -71 req 04 val 1000 [ 879.675162][ T5884] pwc: recv_control_msg error -71 req 04 val 1300 [ 879.693919][ T5884] pwc: recv_control_msg error -71 req 04 val 1400 [ 879.704098][T15607] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 879.708015][ T5884] pwc: recv_control_msg error -71 req 02 val 2000 [ 879.722246][T15607] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 879.734998][T15607] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 879.735788][ T5884] pwc: recv_control_msg error -71 req 02 val 2100 [ 879.749464][T15607] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 879.758230][ T5884] pwc: recv_control_msg error -71 req 04 val 1500 [ 879.834845][T15607] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 879.869139][T15613] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2463'. [ 879.879002][ T5884] pwc: recv_control_msg error -71 req 02 val 2500 [ 879.952042][T15613] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 880.032823][ T5884] pwc: recv_control_msg error -71 req 02 val 2400 [ 880.219001][ T5884] pwc: recv_control_msg error -71 req 02 val 2600 [ 880.268748][ T977] usb 5-1: USB disconnect, device number 75 [ 880.372097][ T5813] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 880.406935][ T5884] pwc: recv_control_msg error -71 req 02 val 2900 [ 880.434027][ T5813] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 880.447751][ T5813] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 880.482751][ T5813] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 880.596904][ T5884] pwc: recv_control_msg error -71 req 02 val 2800 [ 880.715530][ T5813] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 880.808952][ T5884] pwc: recv_control_msg error -71 req 04 val 1100 [ 880.889473][ T5884] pwc: recv_control_msg error -71 req 04 val 1200 [ 880.974344][ T5884] pwc: Registered as video103. [ 880.995819][T15604] lo speed is unknown, defaulting to 1000 [ 881.015055][ T5884] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input43 [ 881.153661][ T5884] usb 4-1: USB disconnect, device number 59 [ 881.255373][T15624] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2470'. [ 881.874004][T15630] netlink: 'syz.1.2473': attribute type 10 has an invalid length. [ 882.740025][T15604] chnl_net:caif_netlink_parms(): no params data found [ 882.765450][ T30] audit: type=1400 audit(1766361754.999:1122): avc: denied { create } for pid=15649 comm="syz.1.2478" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 882.909888][ T30] audit: type=1400 audit(1766361754.999:1123): avc: denied { map } for pid=15649 comm="syz.1.2478" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45085 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 882.941352][ T977] usb 4-1: new low-speed USB device number 60 using dummy_hcd [ 882.941389][ T5813] Bluetooth: hci6: command tx timeout [ 882.959568][ T30] audit: type=1400 audit(1766361754.999:1124): avc: denied { read write } for pid=15649 comm="syz.1.2478" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45085 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 882.993844][T15654] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2479'. [ 883.004876][T15654] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2479'. [ 883.072482][T15657] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2476'. [ 883.073853][T15658] netlink: 'syz.5.2479': attribute type 10 has an invalid length. [ 883.134896][ T977] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 883.143124][ T977] usb 4-1: config 0 has no interface number 0 [ 883.168092][ T977] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 883.184389][ T977] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 883.195415][ T977] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 883.207358][ T977] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 883.207865][T15658] syz_tun: entered promiscuous mode [ 883.224418][ T977] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 883.235528][ T977] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 883.242877][T15658] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 883.257244][ T977] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 883.266795][T15604] bridge0: port 1(bridge_slave_0) entered blocking state [ 883.274822][T15604] bridge0: port 1(bridge_slave_0) entered disabled state [ 883.277087][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 883.299582][T15604] bridge_slave_0: entered allmulticast mode [ 883.310720][ T977] usb 4-1: config 0 descriptor?? [ 883.324031][T15604] bridge_slave_0: entered promiscuous mode [ 883.324369][T15643] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 883.338203][T15643] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 883.353898][T15604] bridge0: port 2(bridge_slave_1) entered blocking state [ 883.374703][T15604] bridge0: port 2(bridge_slave_1) entered disabled state [ 883.375764][ T977] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 883.414690][T15604] bridge_slave_1: entered allmulticast mode [ 883.424309][ T30] audit: type=1400 audit(1766361755.659:1125): avc: denied { ioctl } for pid=15661 comm="syz.5.2480" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 883.542973][T15604] bridge_slave_1: entered promiscuous mode [ 883.802389][T15665] netlink: 'syz.5.2480': attribute type 10 has an invalid length. [ 884.192482][T15604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 884.230729][T15643] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 884.379252][T15604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 884.443776][ T10] usb 4-1: USB disconnect, device number 60 [ 884.458675][ T10] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 884.638317][T15604] team0: Port device team_slave_0 added [ 884.657129][T15604] team0: Port device team_slave_1 added [ 884.862524][T15604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 884.877951][T15604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 884.912446][T15604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 884.933694][T15604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 884.944492][T15604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 884.980442][T15680] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2483'. [ 885.002085][ T5813] Bluetooth: hci6: command tx timeout [ 885.028664][T15604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 885.170633][T15604] hsr_slave_0: entered promiscuous mode [ 885.177552][T15604] hsr_slave_1: entered promiscuous mode [ 885.184586][T15604] debugfs: 'hsr0' already exists in 'hsr' [ 885.190478][T15604] Cannot create hsr debugfs directory [ 885.641536][T15688] input: syz0 as /devices/virtual/input/input44 [ 886.902208][T15700] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 886.928227][T15700] netlink: 'syz.5.2488': attribute type 2 has an invalid length. [ 887.081017][ T5813] Bluetooth: hci6: command tx timeout [ 887.368277][T15604] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.182906][T15604] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.765620][ T6005] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 888.800238][T15604] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.806087][T15724] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2494'. [ 888.948933][T15720] bond0: (slave syz_tun): Releasing backup interface [ 888.992373][ T6005] usb 4-1: Using ep0 maxpacket: 16 [ 889.019766][T15604] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 889.149442][ T6005] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 889.160234][ T6005] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 889.169285][ T5813] Bluetooth: hci6: command tx timeout [ 889.188654][ T6005] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 889.197890][ T6005] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.206066][ T6005] usb 4-1: Product: syz [ 889.406838][ T6005] usb 4-1: Manufacturer: syz [ 889.470813][ T6005] usb 4-1: SerialNumber: syz [ 889.888803][ T3443] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.077875][ T3443] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.521134][T15734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.571480][T15734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.744755][ T6005] usb 4-1: cannot find UAC_HEADER [ 890.763180][T15607] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 890.774143][T15607] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 890.782837][T15607] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 890.790469][T15607] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 890.801526][T15607] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 890.844472][ T6005] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 891.349982][T15746] input: syz0 as /devices/virtual/input/input45 [ 891.387823][ T3443] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 891.426032][T15399] udevd[15399]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 891.742533][ T3443] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.290098][T15739] lo speed is unknown, defaulting to 1000 [ 892.330933][T15755] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2505'. [ 892.507100][T15604] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 892.578560][T15604] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 892.699848][T15604] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 892.768288][T15604] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 893.248310][ T5813] Bluetooth: hci3: command tx timeout [ 893.958933][ T6005] usb 4-1: USB disconnect, device number 61 [ 894.887418][ T3443] bond0 (unregistering): (slave team0): Releasing backup interface [ 894.897436][ T3443] bond0 (unregistering): Released all slaves [ 894.930153][T15780] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2509'. [ 895.319983][T15799] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2514'. [ 895.371511][ T5813] Bluetooth: hci3: command tx timeout [ 896.055609][T15816] netlink: 'syz.1.2515': attribute type 1 has an invalid length. [ 896.188988][T15820] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2515'. [ 896.283815][T15816] bond4: entered promiscuous mode [ 896.289563][T15816] bond4: entered allmulticast mode [ 896.298084][T15816] 8021q: adding VLAN 0 to HW filter on device bond4 [ 896.339253][T15817] erspan1: entered allmulticast mode [ 896.368795][T15817] bond4: (slave erspan1): making interface the new active one [ 896.377247][T15817] erspan1: entered promiscuous mode [ 896.388352][T15817] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 896.552557][T15739] chnl_net:caif_netlink_parms(): no params data found [ 896.823976][T15823] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2518'. [ 896.927143][T15820] bond4 (unregistering): (slave erspan1): Releasing active interface [ 896.935689][T15820] erspan1: left promiscuous mode [ 896.946790][T15820] bond4 (unregistering): Released all slaves [ 897.041945][T15823] ip6gretap0: entered promiscuous mode [ 897.048818][T15823] macvtap1: entered promiscuous mode [ 897.055199][T15823] macvtap1: entered allmulticast mode [ 897.062116][ T6005] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 897.073451][T15823] ip6gretap0: entered allmulticast mode [ 897.218024][T15828] ip6gretap0: left allmulticast mode [ 897.230582][T15828] ip6gretap0: left promiscuous mode [ 897.245245][ T6005] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 897.254396][ T6005] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.263341][ T6005] usb 5-1: Product: syz [ 897.267928][ T6005] usb 5-1: Manufacturer: syz [ 897.276451][ T6005] usb 5-1: SerialNumber: syz [ 897.319310][ T3443] hsr_slave_0: left promiscuous mode [ 897.337782][ T6005] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 897.355276][ T3443] hsr_slave_1: left promiscuous mode [ 897.366402][ T3443] batman_adv: batadv0: Interface deactivated: macsec1 [ 897.376078][ T3443] batman_adv: batadv0: Removing interface: macsec1 [ 897.394919][ T3443] batman_adv: batadv0: Interface deactivated: macvlan2 [ 897.402157][ T5813] Bluetooth: hci3: command tx timeout [ 897.432283][ T3443] batman_adv: batadv0: Removing interface: macvlan2 [ 897.458891][ T5884] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 897.567241][ T3443] batadv_slave_1: left promiscuous mode [ 897.580801][ T3443] batadv_slave_0: left promiscuous mode [ 897.629548][ T3443] veth1_macvtap: left promiscuous mode [ 897.638342][ T3443] veth0_macvtap: left promiscuous mode [ 897.648818][ T3443] veth1_vlan: left promiscuous mode [ 897.679742][ C1] usb 5-1: ath9k_htc: invalid pkt_len (fedb) [ 897.885477][ T6251] usb 5-1: USB disconnect, device number 76 [ 897.973878][ T3443] pim6reg (unregistering): left allmulticast mode [ 898.337615][ T3443] team0 (unregistering): Port device vlan0 removed [ 898.520897][ T5884] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 898.528019][ T5884] ath9k_htc: Failed to initialize the device [ 898.555219][ T6251] usb 5-1: ath9k_htc: USB layer deinitialized [ 899.492217][ T5813] Bluetooth: hci3: command tx timeout [ 899.745258][ T6251] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 900.250954][ T6251] usb 4-1: Using ep0 maxpacket: 8 [ 900.275139][ T6251] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 900.287195][ T6251] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 900.299304][ T6251] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 900.325947][ T6251] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 900.338985][ T6251] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 900.348378][ T6251] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.371825][ T6251] usbtmc 4-1:16.0: bulk endpoints not found [ 900.598857][T15855] tipc: Started in network mode [ 900.604162][T15855] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 900.613719][T15855] tipc: New replicast peer: fc00:0000:0000:0000:0000:0000:0000:0000 [ 900.624228][T15855] tipc: Enabled bearer , priority 10 [ 900.639049][T15845] debugfs: 'ptm0' already exists in 'caif_serial' [ 900.824180][T15739] bridge0: port 1(bridge_slave_0) entered blocking state [ 900.854737][T15739] bridge0: port 1(bridge_slave_0) entered disabled state [ 900.882541][T15739] bridge_slave_0: entered allmulticast mode [ 900.899997][ T30] audit: type=1804 audit(1766361773.129:1126): pid=15862 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.2524" name="file0" dev="tmpfs" ino=3112 res=1 errno=0 [ 900.910461][T15739] bridge_slave_0: entered promiscuous mode [ 900.924937][T15862] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: 1 [ 900.938764][T15862] ref_ctr increment failed for inode: 0xc28 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802858b100 [ 900.954692][T15604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 900.965738][T15739] bridge0: port 2(bridge_slave_1) entered blocking state [ 900.977302][T15739] bridge0: port 2(bridge_slave_1) entered disabled state [ 900.986717][T15739] bridge_slave_1: entered allmulticast mode [ 900.995449][T15739] bridge_slave_1: entered promiscuous mode [ 901.022113][T15604] 8021q: adding VLAN 0 to HW filter on device team0 [ 901.141288][T15867] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: -1 [ 901.255629][T15739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 901.347858][T15739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 901.550081][T15867] ref_ctr decrement failed for inode: 0xc28 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802858b100 [ 901.581577][T15867] uprobe: syz.1.2524:15867 failed to unregister, leaking uprobe [ 901.597787][ T1528] bridge0: port 1(bridge_slave_0) entered blocking state [ 901.604896][ T1528] bridge0: port 1(bridge_slave_0) entered forwarding state [ 901.643352][ T6005] tipc: Node number set to 1 [ 901.684074][ T6005] usb 4-1: USB disconnect, device number 62 [ 901.732882][T15739] team0: Port device team_slave_0 added [ 901.742192][T15739] team0: Port device team_slave_1 added [ 901.833939][ T1528] bridge0: port 2(bridge_slave_1) entered blocking state [ 901.841204][ T1528] bridge0: port 2(bridge_slave_1) entered forwarding state [ 901.945639][T15877] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2527'. [ 902.093715][T15882] netlink: 'syz.3.2527': attribute type 1 has an invalid length. [ 902.101803][T15882] netlink: 'syz.3.2527': attribute type 2 has an invalid length. [ 902.375654][ T3443] IPVS: stop unused estimator thread 0... [ 902.407762][T15739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 902.529061][T15739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 902.879516][T15739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 902.962889][T15739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 902.969867][T15739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 903.018758][T15891] tmpfs: Bad value for 'mpol' [ 903.022145][T15739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 903.251138][ T5968] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 903.471214][ T5968] usb 5-1: Using ep0 maxpacket: 32 [ 903.519300][ T5968] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 903.589503][ T5968] usb 5-1: config 0 has no interface number 0 [ 903.638896][ T5968] usb 5-1: config 0 interface 12 has no altsetting 0 [ 903.734115][ T5968] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 903.812150][ T5968] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.868222][ T5968] usb 5-1: Product: syz [ 903.901926][ T5968] usb 5-1: Manufacturer: syz [ 903.932167][ T5968] usb 5-1: SerialNumber: syz [ 903.973154][ T5968] usb 5-1: config 0 descriptor?? [ 904.035851][T15739] hsr_slave_0: entered promiscuous mode [ 904.073258][T15739] hsr_slave_1: entered promiscuous mode [ 904.079529][T15739] debugfs: 'hsr0' already exists in 'hsr' [ 904.090979][T15739] Cannot create hsr debugfs directory [ 904.400983][ T10] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 904.573319][T15604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 904.580304][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 904.596474][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 904.606351][T15739] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 904.615034][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 904.621444][T15739] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 904.629324][ T10] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 904.643993][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.665499][ T10] usb 4-1: config 0 descriptor?? [ 904.670140][T15739] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 904.709252][T15916] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2533'. [ 904.743630][T15739] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 904.842769][T15604] veth0_vlan: entered promiscuous mode [ 904.884445][T15604] veth1_vlan: entered promiscuous mode [ 904.966150][T15604] veth0_macvtap: entered promiscuous mode [ 905.003350][T15604] veth1_macvtap: entered promiscuous mode [ 905.049752][T15739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 905.079325][T15604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 905.122120][ T10] plantronics 0003:047F:FFFF.001F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 905.174960][T15739] 8021q: adding VLAN 0 to HW filter on device team0 [ 905.209687][T15604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 905.232169][ T4875] bridge0: port 1(bridge_slave_0) entered blocking state [ 905.239366][ T4875] bridge0: port 1(bridge_slave_0) entered forwarding state [ 905.307546][ T4875] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.359161][ T4875] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.395290][ T4875] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.412815][ T4875] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.426242][ T2127] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.433426][ T2127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 905.661098][ T4875] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.695144][ T4875] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 905.795329][ T4875] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.827177][ T4875] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.038454][ T5968] f81534 5-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 906.048348][ T5968] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 906.151410][ T5968] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 906.381022][ T5968] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 906.408113][ T5968] usb 5-1: USB disconnect, device number 77 [ 906.577283][T15739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 906.898626][T15973] netlink: 'syz.4.2537': attribute type 12 has an invalid length. [ 906.925542][T15973] netlink: 'syz.4.2537': attribute type 29 has an invalid length. [ 907.043076][T15973] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2537'. [ 907.093236][ T30] audit: type=1400 audit(1766361779.329:1127): avc: denied { ioctl } for pid=15977 comm="syz.3.2538" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=46956 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 907.134999][T15973] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2537'. [ 907.369824][T15739] veth0_vlan: entered promiscuous mode [ 907.428362][T15739] veth1_vlan: entered promiscuous mode [ 907.523568][ T6251] usb 4-1: USB disconnect, device number 63 [ 907.597617][T15739] veth0_macvtap: entered promiscuous mode [ 907.608934][T15739] veth1_macvtap: entered promiscuous mode [ 907.634966][T15739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 907.722095][T15739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 907.791225][ T1528] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.847984][ T1528] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.895070][T15995] tmpfs: Bad value for 'mpol' [ 907.900633][ T1528] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.947334][ T1528] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.314641][ T1528] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.347235][ T1528] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 908.552596][T16015] netlink: 35 bytes leftover after parsing attributes in process `syz.2.2545'. [ 908.592807][ T4510] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.600654][ T4510] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 908.753275][T15991] delete_channel: no stack [ 909.404254][T16023] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2547'. [ 909.578417][T16027] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 909.586312][T16027] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 909.626755][T16020] SELinux: failed to load policy [ 910.761356][ T5968] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 910.934630][ T5968] usb 5-1: Using ep0 maxpacket: 8 [ 910.945358][ T5968] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 910.969622][ T5968] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 911.001645][ T5968] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 911.035569][ T5968] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 911.061622][ T30] audit: type=1400 audit(1766361783.289:1128): avc: denied { connect } for pid=16043 comm="syz.6.2553" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 911.084639][ T5968] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 911.111516][ T5968] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.144613][T16050] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2553'. [ 911.157751][ T5968] usbtmc 5-1:16.0: bulk endpoints not found [ 911.264308][ T30] audit: type=1400 audit(1766361783.499:1129): avc: denied { read } for pid=16044 comm="syz.1.2552" lport=50256 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 912.050913][ T10] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 912.171726][T16063] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2556'. [ 912.272950][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 912.289733][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 912.375836][ T10] usb 4-1: config 1 has no interface number 0 [ 912.446573][ T10] usb 4-1: config 1 interface 2 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 912.551661][ T10] usb 4-1: Duplicate descriptor for config 1 interface 2 altsetting 0, skipping [ 912.604461][ T10] usb 4-1: config 1 interface 2 has no altsetting 1 [ 912.630696][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 912.709748][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.728871][ T10] usb 4-1: Product: syz [ 912.738728][ T6005] usb 5-1: USB disconnect, device number 78 [ 912.792853][ T10] usb 4-1: Manufacturer: syz [ 912.802126][ T10] usb 4-1: SerialNumber: syz [ 912.809932][T16067] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2557'. [ 914.229244][T16075] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2561'. [ 914.398257][ T5968] usb 4-1: USB disconnect, device number 64 [ 915.340927][ T6637] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 915.760929][ T6637] usb 7-1: Using ep0 maxpacket: 32 [ 915.767859][ T6637] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 915.846915][ T6637] usb 7-1: New USB device found, idVendor=0bfd, idProduct=0120, bcdDevice=f9.ad [ 915.866118][ T6637] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.902801][ T6637] usb 7-1: Product: syz [ 915.906987][ T6637] usb 7-1: Manufacturer: syz [ 915.923735][ T6637] usb 7-1: SerialNumber: syz [ 915.949882][ T6637] usb 7-1: config 0 descriptor?? [ 915.971486][ T6637] kvaser_usb 7-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 916.321752][T16095] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 916.525235][ T977] usb 7-1: USB disconnect, device number 2 [ 916.551146][ T6637] IPVS: starting estimator thread 0... [ 916.671269][T16096] IPVS: using max 35 ests per chain, 84000 per kthread [ 918.012071][T16101] delete_channel: no stack [ 918.894091][T16115] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2571'. [ 918.911851][T16115] openvswitch: netlink: Missing key (keys=200040, expected=100) [ 919.135535][T16121] 9pnet_virtio: no channels available for device 127.0.0.1 [ 919.190215][ T30] audit: type=1326 audit(1766361791.419:1130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16120 comm="syz.4.2572" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3de6f8f749 code=0x0 [ 919.294696][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2572'. [ 919.323823][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2572'. [ 919.386427][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2572'. [ 919.386501][T16127] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 919.414113][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2572'. [ 919.642779][T16123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2572'. [ 919.690224][T16127] netlink: 'syz.2.2573': attribute type 2 has an invalid length. [ 919.760688][T16130] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2565'. [ 920.358943][T16151] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2577'. [ 920.711309][ T48] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 920.902589][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 920.948241][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 920.989322][ T48] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 921.036029][ T48] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 921.085031][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.195492][ T48] usb 3-1: config 0 descriptor?? [ 921.725489][ T48] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 921.817550][ T6637] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 922.017827][ T6637] usb 7-1: Using ep0 maxpacket: 32 [ 922.070137][ T6637] usb 7-1: config 0 has an invalid interface number: 157 but max is 0 [ 922.096877][ T6637] usb 7-1: config 0 has no interface number 0 [ 922.115331][ T6637] usb 7-1: New USB device found, idVendor=0711, idProduct=0200, bcdDevice=1b.b7 [ 922.129053][ T6637] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.137362][ T6637] usb 7-1: Product: syz [ 922.141920][ T6637] usb 7-1: Manufacturer: syz [ 922.146514][ T6637] usb 7-1: SerialNumber: syz [ 922.208869][ T6637] usb 7-1: config 0 descriptor?? [ 922.222930][ T6637] mct_u232 7-1:0.157: MCT U232 converter detected [ 922.287464][T16181] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 922.296685][T16181] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 922.305580][ T6637] mct_u232 ttyUSB0: expected endpoint missing [ 922.416159][ T30] audit: type=1800 audit(1766361794.649:1131): pid=16149 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.2576" name="bus" dev="ramfs" ino=48604 res=0 errno=0 [ 923.236482][ T10] usb 3-1: USB disconnect, device number 28 [ 924.361181][T16200] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2583'. [ 924.396733][T16200] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2583'. [ 924.459692][ T48] usb 7-1: USB disconnect, device number 3 [ 924.508833][ T48] mct_u232 7-1:0.157: device disconnected [ 924.609648][ T30] audit: type=1400 audit(1766361796.839:1132): avc: denied { create } for pid=16201 comm="syz.6.2584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 924.662895][ T30] audit: type=1400 audit(1766361796.889:1133): avc: denied { watch } for pid=16201 comm="syz.6.2584" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 924.798214][ T30] audit: type=1400 audit(1766361796.889:1134): avc: denied { watch_sb watch_reads } for pid=16201 comm="syz.6.2584" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 924.910375][T16210] 9p: Bad value for 'rfdno' [ 929.242826][T16266] overlayfs: failed to clone upperpath [ 929.523250][T16284] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2593'. [ 930.680036][T16230] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 930.823456][T16298] input: syz0 as /devices/virtual/input/input49 [ 931.330073][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.350958][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.621021][ T10] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 931.864543][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 931.885892][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 931.906237][ T10] usb 3-1: config 129 has an invalid interface number: 28 but max is 0 [ 931.925283][ T10] usb 3-1: config 129 has no interface number 0 [ 931.945610][ T10] usb 3-1: config 129 interface 28 altsetting 250 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 931.970879][ T10] usb 3-1: config 129 interface 28 altsetting 250 endpoint 0x8D has invalid maxpacket 18502, setting to 64 [ 931.992517][ T10] usb 3-1: config 129 interface 28 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 932.031165][ T10] usb 3-1: config 129 interface 28 has no altsetting 0 [ 932.047334][ T10] usb 3-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice=db.57 [ 932.067906][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.070961][ T48] usb 7-1: new low-speed USB device number 4 using dummy_hcd [ 932.093995][ T10] usb 3-1: Product: syz [ 932.103744][ T10] usb 3-1: Manufacturer: syz [ 932.118791][ T10] usb 3-1: SerialNumber: syz [ 932.242136][T16329] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 932.244242][ T48] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 932.303952][ T48] usb 7-1: config 0 has no interface number 0 [ 932.347900][ T48] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 932.394130][ T48] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 932.437015][ T48] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 932.482029][ T48] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 932.691771][ T10] etas_es58x 3-1:129.28: Starting syz syz (Serial Number syz) [ 932.713040][ T10] etas_es58x 3-1:129.28: could not retrieve the product info string [ 932.791142][ T10] usb 3-1: USB disconnect, device number 29 [ 932.798751][ T10] etas_es58x 3-1:129.28: Disconnecting syz syz [ 932.879076][ T48] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 932.903742][ T48] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 932.920964][ T48] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 933.322222][ T48] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.339866][ T48] usb 7-1: config 0 descriptor?? [ 933.350121][T16335] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 933.357459][T16335] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 933.391080][ T48] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 933.711676][T16353] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2609'. [ 933.758030][T16335] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 934.323061][ T10] usb 7-1: USB disconnect, device number 4 [ 934.338181][ T10] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 934.408802][ T6251] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 934.643029][ T6251] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 934.655417][ T6251] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 934.666820][ T6251] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 935.098953][ T6251] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 935.122682][ T6251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.242842][ T6251] usb 5-1: config 0 descriptor?? [ 936.125156][ T6251] usbhid 5-1:0.0: can't add hid device: -71 [ 936.141675][ T6251] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 936.271497][T16383] input: syz0 as /devices/virtual/input/input50 [ 936.456999][ T30] audit: type=1400 audit(1766361808.359:1135): avc: denied { getopt } for pid=16360 comm="syz.4.2612" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 936.564263][ T6251] usb 5-1: USB disconnect, device number 79 [ 938.019306][T16394] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2620'. [ 939.487393][T16410] netlink: 156 bytes leftover after parsing attributes in process `syz.6.2623'. [ 939.502762][T16410] netlink: 156 bytes leftover after parsing attributes in process `syz.6.2623'. [ 939.771380][ T6005] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 940.070938][ T6005] usb 7-1: Using ep0 maxpacket: 16 [ 940.084657][ T6005] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 940.132019][ T6005] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 940.167202][ T6005] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 940.213723][ T6005] usb 7-1: config 0 interface 0 has no altsetting 0 [ 940.283918][ T6005] usb 7-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 940.305232][ T6005] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.336909][ T6005] usb 7-1: Product: syz [ 940.367787][ T6005] usb 7-1: Manufacturer: syz [ 940.388427][ T6005] usb 7-1: SerialNumber: syz [ 940.416633][ T6005] usb 7-1: config 0 descriptor?? [ 940.657044][ T6005] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input51 [ 940.698515][ T5172] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 940.742366][ T5172] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 940.887143][T16408] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 941.241134][ T5172] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 941.426068][ T5172] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 941.525021][ T5968] usb 7-1: USB disconnect, device number 5 [ 941.580020][T16318] synaptics_usb 7-1:0.0: synusb_open - usb_submit_urb failed, error: -19 [ 942.092058][ T10] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 942.250970][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 942.644010][ T10] usb 5-1: config 8 has an invalid interface number: 215 but max is 1 [ 942.736270][ T10] usb 5-1: config 8 has no interface number 1 [ 942.805771][ T10] usb 5-1: config 8 interface 0 has no altsetting 0 [ 942.818725][ T10] usb 5-1: config 8 interface 215 has no altsetting 0 [ 942.839502][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=0896, bcdDevice=3a.1d [ 942.886404][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.059966][ T10] usb 5-1: Product: syz [ 943.069543][ T10] usb 5-1: Manufacturer: syz [ 943.164202][T11255] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 943.188394][ T10] usb 5-1: SerialNumber: syz [ 944.311335][T11255] usb 4-1: config 16 has an invalid interface number: 19 but max is 0 [ 944.319541][T11255] usb 4-1: config 16 has no interface number 0 [ 944.418133][ T10] gspca_main: vc032x-2.14.0 probing 046d:0896 [ 944.432666][T11255] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 944.444333][T11255] usb 4-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 944.470207][ T10] gspca_vc032x: reg_r err -71 [ 944.491516][T11255] usb 4-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 944.499128][ T10] vc032x 5-1:8.0: probe with driver vc032x failed with error -71 [ 944.500569][T11255] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.557260][T11255] usb 4-1: Product: syz [ 944.570939][T11255] usb 4-1: Manufacturer: syz [ 944.576030][T11255] usb 4-1: SerialNumber: syz [ 944.670910][ T10] usb 5-1: USB disconnect, device number 80 [ 945.417525][T11255] usb 4-1: USB disconnect, device number 65 [ 945.440638][T16330] udevd[16330]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 945.589269][T15607] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 945.608378][T15607] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 945.616361][T15607] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 945.624275][T15607] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 945.631920][T15607] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 946.302615][T16472] lo speed is unknown, defaulting to 1000 [ 946.732210][ T6637] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 948.016490][ T6637] usb 4-1: Using ep0 maxpacket: 32 [ 948.064257][T16472] chnl_net:caif_netlink_parms(): no params data found [ 948.073139][ T6637] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 948.128520][ T6637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.228854][T16508] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2647'. [ 948.242185][ T6637] usb 4-1: Product: syz [ 948.242930][T16507] kAFS: unparsable volume name [ 948.250558][ T6637] usb 4-1: Manufacturer: syz [ 948.284715][T15607] Bluetooth: hci5: command tx timeout [ 948.346345][ T6637] usb 4-1: SerialNumber: syz [ 948.494226][ T6637] usb 4-1: config 0 descriptor?? [ 948.543034][ T6637] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 948.604982][ T6637] dvb-usb: bulk message failed: -22 (2/0) [ 948.678629][ T6637] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 948.832685][T16506] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2647'. [ 948.861346][ T30] audit: type=1400 audit(1766361821.069:1136): avc: denied { write } for pid=16505 comm="syz.2.2647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 948.928734][ T6637] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 948.941675][ T977] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 948.970736][ T6637] usb 4-1: media controller created [ 948.982204][T16472] bridge0: port 1(bridge_slave_0) entered blocking state [ 948.993823][T16472] bridge0: port 1(bridge_slave_0) entered disabled state [ 949.021790][T16472] bridge_slave_0: entered allmulticast mode [ 949.038018][T16472] bridge_slave_0: entered promiscuous mode [ 949.055183][T16472] bridge0: port 2(bridge_slave_1) entered blocking state [ 949.065739][T16472] bridge0: port 2(bridge_slave_1) entered disabled state [ 949.076854][T16472] bridge_slave_1: entered allmulticast mode [ 949.093976][ T6637] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 949.097409][T16472] bridge_slave_1: entered promiscuous mode [ 949.112926][ T977] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 949.131644][ T977] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 949.155686][ T6637] usb 4-1: selecting invalid altsetting 7 [ 949.157156][ T977] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 949.176294][ T6637] cxusb: set interface failed [ 949.185234][ T6637] dvb-usb: bulk message failed: -22 (1/0) [ 949.190468][ T977] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 949.205550][T16472] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 949.221660][T16472] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 949.233367][ T977] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.236140][ T6637] DVB: Unable to find symbol lgdt330x_attach() [ 949.251780][ T6637] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 949.254264][ T977] usb 7-1: config 0 descriptor?? [ 949.318574][T16472] team0: Port device team_slave_0 added [ 949.335218][T16472] team0: Port device team_slave_1 added [ 949.341193][ T6005] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 949.361553][ T6637] rc_core: IR keymap rc-dvico-portable not found [ 949.374208][ T6637] Registered IR keymap rc-empty [ 949.385176][T16472] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 949.386402][ T6637] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 949.393137][T16472] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 949.425944][ T6637] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input52 [ 949.431980][T16472] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 949.462521][ T6637] dvb-usb: schedule remote query interval to 100 msecs. [ 949.474036][ T6637] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 949.513754][ T6637] usb 4-1: USB disconnect, device number 66 [ 949.554640][ T6005] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 949.578048][ T6005] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 949.589320][ T6005] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 949.593845][ T6251] dvb-usb: bulk message failed: -22 (1/0) [ 949.602827][ T6005] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 949.627427][ T6005] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.648356][T16472] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 949.666758][ T6005] usb 3-1: config 0 descriptor?? [ 949.674366][T16472] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 949.722922][T16472] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 949.740776][ T6637] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 949.756767][T16516] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 949.802388][T16516] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 949.840223][ T977] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 950.109663][T16534] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2651'. [ 950.127637][T16534] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2651'. [ 950.241253][T16520] netlink: 'syz.2.2649': attribute type 10 has an invalid length. [ 950.316010][T16472] hsr_slave_0: entered promiscuous mode [ 950.336723][ T6005] plantronics 0003:047F:FFFF.0022: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 950.361697][T16472] hsr_slave_1: entered promiscuous mode [ 950.371147][T15607] Bluetooth: hci5: command tx timeout [ 950.392206][T16472] debugfs: 'hsr0' already exists in 'hsr' [ 950.428253][T16472] Cannot create hsr debugfs directory [ 950.444060][T16520] team0: Device ipvlan1 failed to register rx_handler [ 950.720761][T16544] 9p: Bad value for 'wfdno' [ 950.806628][T16544] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 950.834523][ T6005] usb 7-1: USB disconnect, device number 6 [ 951.038082][ T977] usb 3-1: USB disconnect, device number 30 [ 951.307266][T16472] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 951.321835][T16472] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.408070][T16472] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 951.419079][T16472] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.800903][ C0] ------------[ cut here ]------------ [ 951.806872][ C0] ODEBUG: free active (active state 0) object: ffff88805861cc90 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 [ 951.819819][ C0] WARNING: lib/debugobjects.c:612 at debug_print_object+0x18e/0x2a0, CPU#0: syz.4.2656/16558 [ 951.830042][ C0] Modules linked in: [ 951.834465][ C0] CPU: 0 UID: 0 PID: 16558 Comm: syz.4.2656 Tainted: G L syzkaller #0 PREEMPT(full) [ 951.845448][ C0] Tainted: [L]=SOFTLOCKUP [ 951.849784][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 951.859906][ C0] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 951.865758][ C0] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d f2 4c dd 0b 41 56 48 8b 14 dd e0 c4 f2 8b 4c 89 e6 <67> 48 0f b9 3a 58 83 05 fc fe d3 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 951.885440][ C0] RSP: 0018:ffffc90000007a08 EFLAGS: 00010246 [ 951.891559][ C0] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 951.899558][ C0] RDX: ffffffff8bf2c420 RSI: ffffffff8bf2c000 RDI: ffffffff90923260 [ 951.907592][ C0] RBP: 0000000000000001 R08: ffff88805861cc90 R09: ffffffff8b906bc0 [ 951.915602][ C0] R10: ffffffff9088b3d7 R11: ffff88802ec98b30 R12: ffffffff8bf2c000 [ 951.923635][ C0] R13: ffffffff8b906c00 R14: ffffffff8a637890 R15: ffffc90000007b08 [ 951.931640][ C0] FS: 00007f3de7d5a6c0(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 [ 951.940599][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 951.947243][ C0] CR2: 00007f879bfb74e0 CR3: 000000005265e000 CR4: 00000000003526f0 [ 951.955263][ C0] Call Trace: [ 951.958558][ C0] [ 951.961451][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 951.967119][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 951.972987][ C0] debug_check_no_obj_freed+0x4b7/0x600 [ 951.978575][ C0] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 951.984715][ C0] ? mark_held_locks+0x49/0x80 [ 951.989518][ C0] ? kasan_quarantine_put+0x10a/0x240 [ 951.994956][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 952.000197][ C0] kfree+0x2d1/0x6e0 [ 952.004145][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 952.009550][ C0] ? rose_timer_expiry+0x53f/0x630 [ 952.014726][ C0] ? rose_timer_expiry+0x53f/0x630 [ 952.019872][ C0] rose_timer_expiry+0x53f/0x630 [ 952.024903][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 952.030418][ C0] call_timer_fn+0x19a/0x5a0 [ 952.035145][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 952.040345][ C0] ? mark_held_locks+0x49/0x80 [ 952.045225][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 952.050744][ C0] __run_timers+0x74a/0xae0 [ 952.055387][ C0] ? __pfx___run_timers+0x10/0x10 [ 952.060492][ C0] run_timer_base+0x114/0x190 [ 952.065296][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 952.070596][ C0] run_timer_softirq+0x1a/0x40 [ 952.075469][ C0] handle_softirqs+0x219/0x950 [ 952.080297][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 952.085729][ C0] __irq_exit_rcu+0x109/0x170 [ 952.090451][ C0] irq_exit_rcu+0x9/0x30 [ 952.094813][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 952.101234][ C0] [ 952.104712][ C0] [ 952.107753][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 952.114781][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 952.123231][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 c6 0d 1f f6 48 89 df e8 7e 60 1f f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 85 63 0f f6 65 8b 05 2e c9 37 08 85 c0 74 16 5b [ 952.129718][T16569] hpfs: Bad magic ... probably not HPFS [ 952.143159][ C0] RSP: 0018:ffffc9000be9f760 EFLAGS: 00000246 [ 952.143215][ C0] RAX: 0000000000000006 RBX: ffff88807b015880 RCX: 0000000000000006 [ 952.143234][ C0] RDX: 0000000000000000 RSI: ffffffff8dacde6c RDI: ffffffff8bf2b380 [ 952.143252][ C0] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000001 [ 952.143269][ C0] R10: ffffffff9088b3d7 R11: ffff88802ec98b30 R12: ffff8880772e8c80 [ 952.143290][ C0] R13: 0000000000000246 R14: ffff88807b015868 R15: ffffc9000be9f8e8 [ 952.143338][ C0] __skb_try_recv_datagram+0x172/0x4f0 [ 952.143390][ C0] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 952.143431][ C0] ? __pfx___skb_try_recv_datagram+0x10/0x10 [ 952.143482][ C0] __unix_dgram_recvmsg+0x1bc/0xc30 [ 952.143535][ C0] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 952.143595][ C0] ? iovec_from_user+0xbb/0x140 [ 952.143642][ C0] unix_dgram_recvmsg+0xd0/0x110 [ 952.143684][ C0] ____sys_recvmsg+0x5f9/0x6b0 [ 952.143719][ C0] ? __pfx_____sys_recvmsg+0x10/0x10 [ 952.143761][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 952.231519][ T977] usb 4-1: new low-speed USB device number 67 using dummy_hcd [ 952.231768][ C0] ___sys_recvmsg+0x114/0x1a0 [ 952.270409][ C0] ? __pfx____sys_recvmsg+0x10/0x10 [ 952.277055][ C0] ? __pfx___might_resched+0x10/0x10 [ 952.283571][ C0] do_recvmmsg+0x2fe/0x750 [ 952.288539][ C0] ? __pfx_do_recvmmsg+0x10/0x10 [ 952.293562][ C0] ? do_futex+0x122/0x350 [ 952.297971][ C0] ? __x64_sys_futex+0x1e0/0x4c0 [ 952.303830][ C0] __x64_sys_recvmmsg+0x22a/0x280 [ 952.312044][ C0] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 952.317641][ C0] do_syscall_64+0xcd/0xf80 [ 952.322915][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.329383][ C0] RIP: 0033:0x7f3de6f8f749 [ 952.334747][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 952.355565][ C0] RSP: 002b:00007f3de7d5a038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 952.370849][ C0] RAX: ffffffffffffffda RBX: 00007f3de71e6090 RCX: 00007f3de6f8f749 [ 952.380316][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000007 [ 952.390426][ C0] RBP: 00007f3de7013f91 R08: 0000000000000000 R09: 0000000000000000 [ 952.398583][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 952.399501][ T977] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 952.406758][ C0] R13: 00007f3de71e6128 R14: 00007f3de71e6090 R15: 00007ffff5f14e48 [ 952.406800][ C0] [ 952.406812][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 952.406833][ C0] CPU: 0 UID: 0 PID: 16558 Comm: syz.4.2656 Tainted: G L syzkaller #0 PREEMPT(full) [ 952.406870][ C0] Tainted: [L]=SOFTLOCKUP [ 952.406879][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 952.406895][ C0] Call Trace: [ 952.406904][ C0] [ 952.406913][ C0] dump_stack_lvl+0x3d/0x1f0 [ 952.406951][ C0] vpanic+0x640/0x6f0 [ 952.406982][ C0] ? debug_print_object+0x18e/0x2a0 [ 952.407009][ C0] panic+0xca/0xd0 [ 952.407033][ C0] ? __pfx_panic+0x10/0x10 [ 952.407064][ C0] ? check_panic_on_warn+0x1f/0xb0 [ 952.407094][ C0] check_panic_on_warn+0xab/0xb0 [ 952.407124][ C0] __warn+0x108/0x3c0 [ 952.407155][ C0] __report_bug+0x2a0/0x520 [ 952.407179][ C0] ? debug_print_object+0x18e/0x2a0 [ 952.407209][ C0] ? __pfx___report_bug+0x10/0x10 [ 952.407245][ C0] ? mark_held_locks+0x49/0x80 [ 952.407273][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 952.407317][ C0] report_bug_entry+0xe1/0x290 [ 952.407344][ C0] ? debug_print_object+0x19b/0x2a0 [ 952.407372][ C0] handle_bug+0x18a/0x260 [ 952.407408][ C0] exc_invalid_op+0x17/0x50 [ 952.407444][ C0] asm_exc_invalid_op+0x1a/0x20 [ 952.407468][ C0] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 952.407497][ C0] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d f2 4c dd 0b 41 56 48 8b 14 dd e0 c4 f2 8b 4c 89 e6 <67> 48 0f b9 3a 58 83 05 fc fe d3 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 952.407521][ C0] RSP: 0018:ffffc90000007a08 EFLAGS: 00010246 [ 952.407542][ C0] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 952.407558][ C0] RDX: ffffffff8bf2c420 RSI: ffffffff8bf2c000 RDI: ffffffff90923260 [ 952.407575][ C0] RBP: 0000000000000001 R08: ffff88805861cc90 R09: ffffffff8b906bc0 [ 952.407592][ C0] R10: ffffffff9088b3d7 R11: ffff88802ec98b30 R12: ffffffff8bf2c000 [ 952.407608][ C0] R13: ffffffff8b906c00 R14: ffffffff8a637890 R15: ffffc90000007b08 [ 952.407627][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 952.407677][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 952.407711][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 952.407745][ C0] debug_check_no_obj_freed+0x4b7/0x600 [ 952.407786][ C0] ? __pfx_debug_check_no_obj_freed+0x10/0x10 [ 952.407825][ C0] ? mark_held_locks+0x49/0x80 [ 952.407852][ C0] ? kasan_quarantine_put+0x10a/0x240 [ 952.407881][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 952.407916][ C0] kfree+0x2d1/0x6e0 [ 952.407937][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 952.407970][ C0] ? rose_timer_expiry+0x53f/0x630 [ 952.408002][ C0] ? rose_timer_expiry+0x53f/0x630 [ 952.408026][ C0] rose_timer_expiry+0x53f/0x630 [ 952.408053][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 952.408079][ C0] call_timer_fn+0x19a/0x5a0 [ 952.408108][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 952.408145][ C0] ? mark_held_locks+0x49/0x80 [ 952.408174][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 952.408201][ C0] __run_timers+0x74a/0xae0 [ 952.408239][ C0] ? __pfx___run_timers+0x10/0x10 [ 952.408289][ C0] run_timer_base+0x114/0x190 [ 952.408324][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 952.408359][ C0] run_timer_softirq+0x1a/0x40 [ 952.408388][ C0] handle_softirqs+0x219/0x950 [ 952.408431][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 952.408473][ C0] __irq_exit_rcu+0x109/0x170 [ 952.408508][ C0] irq_exit_rcu+0x9/0x30 [ 952.408543][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 952.408572][ C0] [ 952.408581][ C0] [ 952.408590][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 952.408617][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 952.408647][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 c6 0d 1f f6 48 89 df e8 7e 60 1f f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 85 63 0f f6 65 8b 05 2e c9 37 08 85 c0 74 16 5b [ 952.408671][ C0] RSP: 0018:ffffc9000be9f760 EFLAGS: 00000246 [ 952.408690][ C0] RAX: 0000000000000006 RBX: ffff88807b015880 RCX: 0000000000000006 [ 952.408706][ C0] RDX: 0000000000000000 RSI: ffffffff8dacde6c RDI: ffffffff8bf2b380 [ 952.408723][ C0] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000001 [ 952.408738][ C0] R10: ffffffff9088b3d7 R11: ffff88802ec98b30 R12: ffff8880772e8c80 [ 952.408755][ C0] R13: 0000000000000246 R14: ffff88807b015868 R15: ffffc9000be9f8e8 [ 952.408789][ C0] __skb_try_recv_datagram+0x172/0x4f0 [ 952.408831][ C0] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 952.408866][ C0] ? __pfx___skb_try_recv_datagram+0x10/0x10 [ 952.408914][ C0] __unix_dgram_recvmsg+0x1bc/0xc30 [ 952.408960][ C0] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 952.409015][ C0] ? iovec_from_user+0xbb/0x140 [ 952.409055][ C0] unix_dgram_recvmsg+0xd0/0x110 [ 952.409096][ C0] ____sys_recvmsg+0x5f9/0x6b0 [ 952.409134][ C0] ? __pfx_____sys_recvmsg+0x10/0x10 [ 952.409177][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 952.409215][ C0] ___sys_recvmsg+0x114/0x1a0 [ 952.409242][ C0] ? __pfx____sys_recvmsg+0x10/0x10 [ 952.409284][ C0] ? __pfx___might_resched+0x10/0x10 [ 952.409319][ C0] do_recvmmsg+0x2fe/0x750 [ 952.409348][ C0] ? __pfx_do_recvmmsg+0x10/0x10 [ 952.409382][ C0] ? do_futex+0x122/0x350 [ 952.409428][ C0] ? __x64_sys_futex+0x1e0/0x4c0 [ 952.409466][ C0] __x64_sys_recvmmsg+0x22a/0x280 [ 952.409496][ C0] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 952.409532][ C0] do_syscall_64+0xcd/0xf80 [ 952.409566][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.409591][ C0] RIP: 0033:0x7f3de6f8f749 [ 952.409610][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 952.409635][ C0] RSP: 002b:00007f3de7d5a038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 952.409657][ C0] RAX: ffffffffffffffda RBX: 00007f3de71e6090 RCX: 00007f3de6f8f749 [ 952.409675][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000007 [ 952.409690][ C0] RBP: 00007f3de7013f91 R08: 0000000000000000 R09: 0000000000000000 [ 952.409706][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 952.409722][ C0] R13: 00007f3de71e6128 R14: 00007f3de71e6090 R15: 00007ffff5f14e48 [ 952.409755][ C0] [ 952.415383][ C0] Kernel Offset: disabled