last executing test programs: 10m17.518273705s ago: executing program 1 (id=1496): r0 = socket$nl_route(0x10, 0x3, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000340)="71e67a15cd", 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x80108907, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x1000000, 0xffffffffffffffff, 0x40c}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000040)=ANY=[@ANYRESDEC=r1, @ANYRES32=r2, @ANYBLOB="0000000100000000b703000008"], &(0x7f0000005d80)='syzkaller\x00', 0xc, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffdfe}, 0x94) r4 = socket$kcm(0x10, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000400)=r3, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x4cc, 0x0, 0x940c, 0x3002, 0x0, 0x2c0, 0x404, 0x3d8, 0x3d8, 0x404, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x28c, 0x2d4, 0x0, {}, [@common=@inet=@recent0={{0xf4}, {0x0, 0x3f, 0x1, 0x0, 'syz0\x00'}}, @common=@inet=@recent0={{0xf4}, {0x0, 0x0, 0x2, 0x0, 'syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, [0x0, 0x0, 0xff000000, 0xff], [0xffffff00, 0xffffff00, 0xff000000, 0xffffffff], 'team_slave_1\x00', 'veth1_virt_wifi\x00', {0xff}, {}, 0x886215f4d37bb4bb, 0x90, 0x1, 0x69}, 0x0, 0xc8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x528) sendmsg$kcm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000004c0)="d80000001a0081044e81f782db4cb904021d0800fe0055a1150015000200142603600e12080005007a010401a8001600200002400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457fffffffffffff0001bace8017cbec4c2ee5a7cef4090000001fb79164d322fe7c9f8775d3f2d5d0683f5aeb4edbb57a5025ccca9e00360db785262f3d40fad95667e006dcdf61951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a94100000000000000000000000000d4da15", 0xd8}], 0x1}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r6, 0x110, 0x6, 0x0, &(0x7f0000000280)=0x61) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mbind(&(0x7f0000018000/0xa000)=nil, 0xa000, 0x3, 0x0, 0x0, 0x2) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2002, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000010000104000000000300000000000000", @ANYRES32=0x0, @ANYBLOB="fab0817dbcb5f31a24001280110001006272696467655f736c617665000000000c09058006001f0009000000000000000000004cd05a90b061"], 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 10m12.166987535s ago: executing program 1 (id=1507): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0xc, 0x2}}, 0x44) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x14, 0x1a, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x1b}]}, 0x14}], 0x1}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000047}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r9 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xc0, r1, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1359}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f2}], @NL80211_ATTR_MESH_SETUP={0x78, 0x70, [@NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_IE={0x67, 0x3, "eab8a44eb5676f1ff73b6a84d296024735ad0a49e6ecd9fd613e7ee8fbd0679ab1d96c6cbc463004f47721ada877df22c00fe33e530486b370d63a0913ad5363d35f7f74bfe1b8fa67dc2ae7e57a952ab709a11460ed293f1e2cfb7d7f63bc6dd3d722"}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}]}]}, 0xc0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) 10m11.026836864s ago: executing program 1 (id=1510): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffffd) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000080)=0x6e, 0x800) connect$unix(r3, &(0x7f00000003c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x0, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000380)={0x1, 0x0, 0x0, &(0x7f0000000280)=""/233, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000780)={0x0, 0x1, 0x0, &(0x7f0000000700)=""/88, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000005c0)) socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000006380)={0x2020}, 0x2020) 10m10.521634691s ago: executing program 1 (id=1515): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000a0000007d95df16"], 0x10b8}, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000000)='./file0/file0\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) (async) mount$bind(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async) socket$kcm(0x21, 0x2, 0x2) (async) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000a0000007d95df16"], 0x10b8}, 0x0) (async) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) (async) umount2(&(0x7f0000000000)='./file0/file0\x00', 0xb) (async) 10m9.751733598s ago: executing program 1 (id=1516): open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006380)={0x2020}, 0x2020) r3 = io_uring_setup(0x669, &(0x7f00000002c0)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r3, 0xa, 0x0, r4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='mountstats\x00') socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) r7 = memfd_create(&(0x7f0000000040)='-&:{-\xaa]{\x00', 0x2) pwrite64(r7, &(0x7f00000000c0)='i', 0x1, 0x3fff) fcntl$addseals(r7, 0x409, 0x6) ioctl$UDMABUF_CREATE_LIST(r6, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000002000000", @ANYRES32=r7, @ANYBLOB="0400008000100000000000000020"]) connect$can_bcm(r5, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r5, &(0x7f00000002c0)={&(0x7f0000000500)={0x1d, r8}, 0x10, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRESHEX=r6], 0x48}, 0x1, 0x0, 0x0, 0x4080}, 0x0) 10m9.532187166s ago: executing program 1 (id=1519): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2, 0x0, 0x7}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x401, 0x1, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000680)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a30000000000800410073697700140033006c6f00000000000000000000000000008ce2d460be75c226af1896a711ff3fe15968bb62eec5256adf4348070c1a1956d226bb1e91339546bd9769343c0deb92f2d1f89eea5890f2eee7ef70c811399eb43c566ab2d50868664be28affb161640279b9d6d4c9fb05e24f9303394eeb909fc977d1c62669daea91afd2f0ca5dad654e92e244ee350141e62427fac09bbe9a578f"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) openat$audio(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000005200), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000055c0)={0x0, 0x0, &(0x7f0000005580)={&(0x7f0000000500)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002dbd7000fcdbdf250f0000000c00078008000100060000000781e0ae002a787d132d30d302334de7ec3fb40924c97144f25152f39fb84ef8e17fc7aa610d6b1967b42b7d0b9571aac8ed27225f828fadbd405a9c59191d90ba050c2c9a4bd727c50e3927e53eb178a9e7769acfb2d58e68252b0790775200122c4fbb7bd28bbd6eff83fd"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008814) 10m9.24262435s ago: executing program 32 (id=1519): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2, 0x0, 0x7}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x401, 0x1, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000680)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a30000000000800410073697700140033006c6f00000000000000000000000000008ce2d460be75c226af1896a711ff3fe15968bb62eec5256adf4348070c1a1956d226bb1e91339546bd9769343c0deb92f2d1f89eea5890f2eee7ef70c811399eb43c566ab2d50868664be28affb161640279b9d6d4c9fb05e24f9303394eeb909fc977d1c62669daea91afd2f0ca5dad654e92e244ee350141e62427fac09bbe9a578f"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) openat$audio(0xffffff9c, &(0x7f00000004c0), 0x800, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000005200), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000055c0)={0x0, 0x0, &(0x7f0000005580)={&(0x7f0000000500)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002dbd7000fcdbdf250f0000000c00078008000100060000000781e0ae002a787d132d30d302334de7ec3fb40924c97144f25152f39fb84ef8e17fc7aa610d6b1967b42b7d0b9571aac8ed27225f828fadbd405a9c59191d90ba050c2c9a4bd727c50e3927e53eb178a9e7769acfb2d58e68252b0790775200122c4fbb7bd28bbd6eff83fd"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008814) 4m46.537805111s ago: executing program 0 (id=2547): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000001c0)=0x2001) fcntl$dupfd(r0, 0x0, r0) io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0xd, &(0x7f0000000140)={0x9, 0x0, 0x0, 0x0}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) userfaultfd(0x801) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000000)={0x0, 0x2, 0x2, 0x0, 0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x3) sched_setaffinity(0x0, 0xfffffd10, &(0x7f0000000200)=0x2000000000006) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000a80), 0x40000) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000004c00)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x0, 0x18c, 0x203, 0x320, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x6}, {}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {}, {}, {0x20, 0x6}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@ipv4_newrule={0x30, 0x20, 0x301, 0x800000, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000c}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x27}, @FRA_DST={0x8, 0x1, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0xc040}, 0x80) 4m45.851671026s ago: executing program 0 (id=2551): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000100000085"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x18) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) 4m45.784892811s ago: executing program 0 (id=2552): syz_emit_ethernet(0x56, &(0x7f0000000280)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x5c, 0x0, {0xb, 0x4, 0x1, 0x1, 0x7, 0x67, 0x8, 0x1, 0x8, 0xfffd, @empty, @broadcast, {[@lsrr={0x83, 0x17, 0x4e, [@multicast2, @loopback, @dev={0xac, 0x14, 0x14, 0x21}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @noop]}}}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000580)={&(0x7f00000005c0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000003a80)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {0x0, 0x100000}, &(0x7f0000000480)=[{&(0x7f00000016c0)=""/96, 0x60}, {&(0x7f0000001740)=""/4096, 0x1000}], 0x2, 0x39, 0x2}}], 0x48, 0x4000000}, 0x0) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000004000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') futimesat(r3, 0x0, 0x0) shutdown(r1, 0x1) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 4m45.401274488s ago: executing program 0 (id=2553): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file1/file2\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1/file2/file3\x00', 0x1c0) mkdirat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x40042, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2080, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0xc048aec8, &(0x7f0000000680)={0xc}) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000000)=0x8) mount$bind(&(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340)='./file0/file6\x00', 0x0, 0x5000, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000004c0)={0x4, 0x0, [{0x0, 0x12, &(0x7f00000002c0)=""/18}, {0xa000, 0x6, &(0x7f0000000400)=""/6}, {0xdddd0000, 0x13, &(0x7f0000000440)=""/19}, {0x2, 0x19, &(0x7f0000000480)=""/25}]}) r4 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000580)={0x3, r4}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x3cc001, 0x2) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x1) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000005c0)={0x6, 0x0, [{0xa04}, {0x17, 0x0, 0x3ff}, {0x38e, 0x0, 0x4}, {0x9cf, 0x0, 0x9}, {0x3b5, 0x0, 0xfffc}, {0x40000090, 0x0, 0x2}]}) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000280)='./file0/file1/file2\x00', 0x0) r6 = landlock_create_ruleset(&(0x7f00000000c0)={0x3ba2}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) 4m44.340839724s ago: executing program 0 (id=2560): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/tty/ldiscs\x00', 0x0, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000780)=@base={0xa, 0x16, 0x800, 0x7f}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x3, 0x8, 0x2, 0xb}, 0x0, &(0x7f0000000280)={0x3ff, 0x0, 0x0, 0x400d, 0x0, 0x9, 0x466}, 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r3, r0, &(0x7f00000000c0)=0x58, 0xa) 4m43.265294776s ago: executing program 0 (id=2564): r0 = epoll_create(0x7a0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r4}}) vmsplice(r3, &(0x7f0000000180)=[{&(0x7f0000000580)="0125", 0x2}], 0x1, 0xf) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000580)={0x4}) syz_usb_connect(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36", @ANYRES32=r1, @ANYRESOCT=r0, @ANYRES16=r0], 0x0) close_range(r1, r1, 0x0) 4m28.001614549s ago: executing program 33 (id=2564): r0 = epoll_create(0x7a0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r4}}) vmsplice(r3, &(0x7f0000000180)=[{&(0x7f0000000580)="0125", 0x2}], 0x1, 0xf) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000580)={0x4}) syz_usb_connect(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36", @ANYRES32=r1, @ANYRESOCT=r0, @ANYRES16=r0], 0x0) close_range(r1, r1, 0x0) 16.592137098s ago: executing program 3 (id=3372): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x18, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="d6813e2a29a841f8e6713c424d612fab236df3f5866461587da6267db916126753e0e0a80c068baa289d433a7d6d11171fc2fd1243fa9d594790f0e160b56c74cffdf8216de72c904d12d087a12f65e67b80343c71f5f14ed701f2dda7544bdbfdb06a7b29ddee366058773d95156caca431375fd42ba3bc10a0c04f8f990b00bd490720b2dd1b79f255f6ec4785c17912a40ab3166b22cc64e82bafdfa0c660c6", @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT], 0x0, 0x9, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00'}, 0x10) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @local}}, {{0x2, 0x0, @loopback}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x83, 0x5, 0xff, 0x6, @time={0x80000000, 0x3}, {0xdd, 0x4}, {0x7f, 0xb1}, @quote={{0x7, 0x7}, 0x200, &(0x7f0000000180)={0xa, 0x40, 0xf1, 0x5, @tick, {0x2b, 0x6}, {0xff, 0x7}, @addr={0x1, 0xa}}}}, {0xf, 0x62, 0x4, 0x5, @time={0x4399, 0x3}, {0x8}, {0x1}, @time=@tick=0x82}, {0xa, 0x5, 0x4, 0x80, @time={0x4, 0x7}, {0x7, 0x1}, {0x0, 0x5}, @time=@tick=0x2}, {0x2, 0xff, 0xff, 0xc, @tick=0x3, {0x4, 0x9}, {0x77, 0x5}, @addr={0x3, 0xfb}}], 0x70) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x200, 0x2, 0x0, 0x0, r0}) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r4, &(0x7f0000776000/0x4000)=nil, 0x5000) read$FUSE(r2, &(0x7f0000002700)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) capget(&(0x7f0000000480)={0x20071026, r5}, &(0x7f00000004c0)={0x8, 0x4, 0x7, 0x1, 0x5, 0x8}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x1, 0x0, &(0x7f0000000240), 0x0}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 13.53609343s ago: executing program 3 (id=3380): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000580), 0x7, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000002dc0)=@userptr={0x2, 0x1, 0x4, 0x0, 0x1, {}, {0x1, 0xc, 0x9, 0xc, 0x6, 0x8, "bf240fef"}, 0x3, 0x2, {&(0x7f00000002c0)}, 0x96000}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, 0x0, &(0x7f00000010c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000100)={0x2098, 0x5, 0x1000, 0xfffffffd}, 0x10) r5 = syz_open_dev$vcsn(0x0, 0x6c90, 0x480c1) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYRES32=r5, @ANYBLOB="0800010003000000901b47854c4d99d38ebde2e09b0704a7444ff4dc1bd52508f64b83715e365ca07b8cdfc27e4d2fd496d34b82e26884077bcecfaf526e89ff2108400d0099a3c73d84138e31f637feb1c9a6f464ec8631c1c9afb5d9be419e1b480c7f2263e2b7040e108a7702dfa3bac1aaf8e464a5399de5d66af1d4f7e56c89e1cd8b7a95697084f6ad5ef898ccf943e2bc6b16bea7d6efe5da855a1ea2fe558cdbddffcdb96c565775e8525b8ce79bd934eb000fd414a39e89f5ccdaa9d2adaf0880f5bc2bac325b9e302806bce7582b05aa994ba7cf453be235fe7e8abcac26e8848b5b"], 0x2c}, 0x1, 0x0, 0x0, 0xc048040}, 0x20000000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000280)=""/34) 10.448450695s ago: executing program 3 (id=3388): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x18, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="d6813e2a29a841f8e6713c424d612fab236df3f5866461587da6267db916126753e0e0a80c068baa289d433a7d6d11171fc2fd1243fa9d594790f0e160b56c74cffdf8216de72c904d12d087a12f65e67b80343c71f5f14ed701f2dda7544bdbfdb06a7b29ddee366058773d95156caca431375fd42ba3bc10a0c04f8f990b00bd490720b2dd1b79f255f6ec4785c17912a40ab3166b22cc64e82bafdfa0c660c6", @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT], 0x0, 0x9, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00'}, 0x10) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @local}}, {{0x2, 0x0, @loopback}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x83, 0x5, 0xff, 0x6, @time={0x80000000, 0x3}, {0xdd, 0x4}, {0x7f, 0xb1}, @quote={{0x7, 0x7}, 0x200, &(0x7f0000000180)={0xa, 0x40, 0xf1, 0x5, @tick, {0x2b, 0x6}, {0xff, 0x7}, @addr={0x1, 0xa}}}}, {0xf, 0x62, 0x4, 0x5, @time={0x4399, 0x3}, {0x8}, {0x1}, @time=@tick=0x82}, {0xa, 0x5, 0x4, 0x80, @time={0x4, 0x7}, {0x7, 0x1}, {0x0, 0x5}, @time=@tick=0x2}, {0x2, 0xff, 0xff, 0xc, @tick=0x3, {0x4, 0x9}, {0x77, 0x5}, @addr={0x3, 0xfb}}], 0x70) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x200, 0x2, 0x0, 0x0, r0}) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r4, &(0x7f0000776000/0x4000)=nil, 0x5000) read$FUSE(r2, &(0x7f0000002700)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) capget(&(0x7f0000000480)={0x20071026, r5}, &(0x7f00000004c0)={0x8, 0x4, 0x7, 0x1, 0x5, 0x8}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f00000003c0)={0x1, 0x0, &(0x7f0000000240), 0x0}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 9.110961423s ago: executing program 4 (id=3393): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f0000003280)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r5, &(0x7f0000000e40)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r5, &(0x7f0000000f80)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r5, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="7400000021a9c6197efa0e0f0e1daac09619ad", @ANYRES16=r4, @ANYRES64=r0, @ANYRES32, @ANYRES32=0x0, @ANYRESOCT=0x0, @ANYRESHEX=r1, @ANYRES32=r0, @ANYRESDEC=r0, @ANYRES64=0x0, @ANYRESOCT=r0, @ANYRES32=r5, @ANYRES64=r1, @ANYRESDEC=r4], 0x74}}, 0x800) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYRES16=r6, @ANYBLOB='8\x00\x00\x00', @ANYRES8=0x0, @ANYBLOB="d05222145cfaf86f5fe9709cba8f2473764201003a757ce77e3f9a52af0ac27590228ad49b0960822c491a79a3841290e957af5270ff87076a7017bc89d8a3e0cb211eef82cd2f5ef988490d800a6a5464cc436daa3d226f8ba32a55b9462242e5bb732ec561ef8678980af86807bd890becc3592763671b8a6b172fa54bf5a13afa1d536bcf00d0ac325a270676146a3b56dbd4717f548aeeaae362fc0e2120692625df3a8a55cb267717a4bd72669d5e3bc60805157682ea726a345d250885d4ab65e994c2be302ea913fcac6ec5c8f88f9b6d50e7f477a574"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000100)="ff0f000000000000b47380c988cafb4cb1b93dd4ff788b78739a60ddf83d40babffec7e63d42aa9d74504bceeca2750298a1f08529fad7ef38d6be9ea2b9cf23a07108f6f2332f73151a382b203546d00b75eedce49cd4e70aec8f352b9a9b683adceb329eec3113200cceabec268a00f9de4cda81ed8e4628039a9ff7a521b58111405a8b23cff1f9dc476308637b2a73e38bf1acf8a5fdbd3edf3cdc5b", 0x9e}, {&(0x7f00000006c0)="493d72f4b067", 0x6}], 0x2) 7.718848304s ago: executing program 4 (id=3396): openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) (async) r0 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x10002, 0xffffffff, 0xd7c4, 0xfffffff9}, 0x10) ioctl$SIOCPNDELRESOURCE(r0, 0x89ef, &(0x7f00000001c0)=0xa4) (async) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000140), 0x0, 0x20000814) prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x3, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000040)={'lo\x00'}) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x20008801) (async) syz_open_dev$loop(0x0, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000002400), 0x2000, 0x0) (async) r4 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r4, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) (async) syz_emit_ethernet(0x46, &(0x7f0000000340)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb0800450000380000000000019078ac1e0001ac1414aa030490781200183f2500000000000000000400007f0000017f00000100186371ae9b1c0319aeafce8ef7033dbfb412966ab23d6ef465e1e8a857f1092bfaa56d280d179317c02d0ca20da9139cb4a6f86bff9f640dc47bbd34d0ec521a8bda1e16a3b6fd7c3d6dd414203800727c88f6f96c58b8e67c80b76fb980d6e3da0135e4b4ff256fc33b8fbe696ec17a6a9b0ac3cb199b77a3350df56e0069512b0bbd082f92ddd2d7820d64f64ed5055c288dc3d65ae5a8ef0152ed41f86f2fda93fa90ca44f51474d5f634c1c256d376a33d6573c29719e99767d744017a4f64c14d59e29fb126b7ca600795bbca8599999489d44c35768066eb0e8a6e1a080e6388cb4238d0d3e4a24e6aa951538f4aa66cbcabdf4bd2c9ff21a24a97929da28295fb3dbbe02cbc3db498acc5d5e6b892b711582b336bb09fe623cf1bf46ca304f077aed01aa4c16b01af89bf9c706e68191c"], 0x0) (async) bind$inet(r4, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) (async) r5 = socket$inet(0x2, 0x1, 0x1) setsockopt$sock_int(r5, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r5, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) listen(r5, 0x7) 7.391357341s ago: executing program 3 (id=3397): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0xc, 0x2}}, 0x44) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000047}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r9 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xc0, r1, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1359}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f2}], @NL80211_ATTR_MESH_SETUP={0x78, 0x70, [@NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_IE={0x67, 0x3, "eab8a44eb5676f1ff73b6a84d296024735ad0a49e6ecd9fd613e7ee8fbd0679ab1d96c6cbc463004f47721ada877df22c00fe33e530486b370d63a0913ad5363d35f7f74bfe1b8fa67dc2ae7e57a952ab709a11460ed293f1e2cfb7d7f63bc6dd3d722"}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}]}]}, 0xc0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) 7.331711439s ago: executing program 5 (id=3398): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0xc, 0x2}}, 0x44) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000047}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r9 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xc0, r1, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1359}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1f2}], @NL80211_ATTR_MESH_SETUP={0x78, 0x70, [@NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_IE={0x67, 0x3, "eab8a44eb5676f1ff73b6a84d296024735ad0a49e6ecd9fd613e7ee8fbd0679ab1d96c6cbc463004f47721ada877df22c00fe33e530486b370d63a0913ad5363d35f7f74bfe1b8fa67dc2ae7e57a952ab709a11460ed293f1e2cfb7d7f63bc6dd3d722"}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}]}]}, 0xc0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) 7.220432099s ago: executing program 4 (id=3400): ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x36, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCL_BLANKSCREEN(0xffffffffffffffff, 0x560e, &(0x7f0000000000)) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x8000102) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x85}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f000067d000/0x2000)=nil, &(0x7f000053d000/0x1000)=nil, 0x2000}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 5.929030701s ago: executing program 6 (id=3404): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000000)=0x5fd, 0x4) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x2022, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x2}, 0x94) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000000)=0x74000000) write$dsp(0xffffffffffffffff, &(0x7f0000002000)='`', 0x88020) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg(r4, &(0x7f00000029c0), 0x400006d, 0x20000004) openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) 5.268091166s ago: executing program 5 (id=3405): syz_emit_ethernet(0x56, &(0x7f0000000280)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x5c, 0x0, {0xb, 0x4, 0x1, 0x1, 0x7, 0x67, 0x8, 0x1, 0x8, 0xfffd, @empty, @broadcast, {[@lsrr={0x83, 0x17, 0x4e, [@multicast2, @loopback, @dev={0xac, 0x14, 0x14, 0x21}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @noop]}}}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000580)={&(0x7f00000005c0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000003a80)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {0x0}, &(0x7f0000000480)=[{&(0x7f0000001740)=""/4096, 0x1000}], 0x1, 0x39, 0x2}}], 0x48, 0x4000000}, 0x0) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000004000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') futimesat(r3, 0x0, 0x0) shutdown(r1, 0x1) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 4.662541309s ago: executing program 5 (id=3406): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setfsgid(0xee00) syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0xe, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0xd}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r0 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = gettid() mknod(&(0x7f0000000180)='./file0\x00', 0x1ffa, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x51) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) pselect6(0x40, &(0x7f0000000040)={0xc, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffb}, 0x0, 0x0, 0x0, 0x0) 4.502150122s ago: executing program 6 (id=3407): ioctl$EVIOCGLED(0xffffffffffffffff, 0x80284504, &(0x7f0000000480)=""/52) r0 = syz_io_uring_setup(0x703, &(0x7f0000000100)={0x0, 0xa110, 0x0, 0x0, 0x361}, &(0x7f0000000180), &(0x7f00000001c0)) r1 = io_uring_setup(0x10a2, &(0x7f0000000040)={0x0, 0xaccc, 0x20, 0x3, 0x3f, 0x0, r0}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x280000, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) socket$nl_generic(0x10, 0x3, 0x10) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000440)) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00002bf000/0x2000)=nil, 0x2000, 0x200000b, 0x11, r2, 0x301be000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r8 = socket$netlink(0x10, 0x3, 0x0) bind$bt_sco(0xffffffffffffffff, &(0x7f0000000180)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x20000800) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r8, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f00000000c0)=0x7) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b4050000000000006110b0000000000063514800000000009500090000000000827573595f16aaba19dee4850fad9dc34ae0ec78734eb5ff8c80d4457498c5a7b0c59abd315c61996d140187d64787b68c0a1b3e36"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f00000000c0)=[0x9, 0x8], 0x2) 4.393068149s ago: executing program 4 (id=3408): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) syz_usb_connect(0x2, 0x440, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000c1b2fd40861246206fc10000000109022e040108004000090450000eff040100da0fe42101caf61f785b7bd6f9a40324b2b8253d68e955dd65abfed59c829185881ffcf5071e69d83a94cccf753dd12f7dafdf5b2d4e3c8bf7d1851b891f21b183913d49bf953bab3ee777ab2030fd27eea9c11becf582bd1b62acc0c22b85cc4a21fdf944da65c501f2bcfe60009f9fd3182f3ef9ea028b761d8d18b12c0fbf64e01fdc16ab3f19ccea2d43d16c315afe1e0654083cd85bdecc1d0c08b65aa2b2b59ecb592696ae75b74bced0a71a55e78c444bc6465fc101e4d0d773fceabb706647834c3dac7f5053ba0fc5a1b7012444dace5c0a0be4300e09210200040122e20b0905e7022000050b08090580014001030607cc31074fbfe106909c0e2a9e3c8f70de1215b05b4e75f54d1fa06a425bb8c7fef594d2ffdf29b12ec1b945fa8258e29da5d13e03ec0c272e99523b2a0be430b629f7fa5bb1d4efc8455fff57efa9f30ce50458ae7f8b794ead783acf5e9960b78172cee5cf148a84453239e84e0e513347117423804b3e605c5fee826960698e8fcb3ed028f3686f7e7c4fc44974d6987f3a16f956683194e67b59a1225efa8d91d82fa9115ce443a8e13e7a3e934b017d087333eef373067226b5e8d836f1f1bdb35584b0e08c8edcc0f3390725010106ff7f090504", @ANYBLOB="b2"], 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r1, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r2, &(0x7f0000000280)={0x90, 0x0, 0x0, {0x0, 0x1, 0x0, 0x0, 0x1, 0x0, {0x2, 0xffff, 0x0, 0x0, 0x20000000000007f, 0x5, 0x0, 0x9, 0x0, 0x6000, 0x0, r3, r4, 0x3, 0x4}}}, 0x90) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r5, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000001c0)="82", 0x1}, {0x0}], 0x2}}], 0x1, 0x4404c880) 4.271960191s ago: executing program 3 (id=3409): ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000b00)={0x1, 0x2, &(0x7f0000000500)=[0x0, 0x0], &(0x7f0000000540)=[0x2, 0xa, 0x7, 0x7f, 0x8, 0x0, 0x1000], &(0x7f0000000a80)=[0x0, 0x0, 0x0], &(0x7f0000000ac0)=[0x8, 0xa, 0x1, 0xad14, 0x6, 0x7fffffffffffffff, 0x7, 0x5], 0x0, 0xf7}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)}], 0x3) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000800000000000000000000000000000002"]) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r0, 0x1, 0x2, 0x0, 0x48) r1 = fsopen(&(0x7f0000001900)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r8, &(0x7f0000001d40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14abb3cbfa03004121e69700004060d7ec000901040000cab81a8792a83863daee3e96b2913103f141a4654a699a81d5a2fcbd1f7df7b6d4d17afa0f7200100000000000000000deff0f"], 0x14}, 0x1, 0x0, 0x0, 0x15}, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) rmdir(&(0x7f0000000640)='./file0\x00') getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 3.717966562s ago: executing program 2 (id=3411): syz_io_uring_setup(0x83b, &(0x7f00000000c0)={0x0, 0x11e, 0x80, 0x2, 0x319}, &(0x7f0000000140), &(0x7f0000000400)) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x2a, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0xffffffff, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f00000002c0)=0x3) 3.47579258s ago: executing program 6 (id=3412): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffc}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3ff}}]}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = io_uring_setup(0xaaf, &(0x7f0000000100)={0x0, 0x1692, 0x1000, 0x3, 0x3e3}) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) io_uring_setup(0x4c8a, &(0x7f00000002c0)={0x0, 0x8b3d, 0x80, 0x8, 0x46, 0x0, r0}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x13, 0x2}) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000", @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 2.917013534s ago: executing program 6 (id=3413): sync() r0 = socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x53, &(0x7f0000000340)=0x8006) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000380)={0x0, 0x5, 0x200004, 0x1}, 0x10) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4000000) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff64}, 0x40000040) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r0, &(0x7f0000000400)="cd", 0x1, 0x80, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty, 0xfffffffe}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)}) lsm_get_self_attr(0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="180200000080000000000000000000008500000036000000850000002a0000009500000000000000910f001083f7b8033157ad3a9ec3e0a154dde8e516b33d49cd6d8ea1ef44e26a9689047dc810523bb6cb646edac69057131e1be7162eed1f07ba5e28f6fe1cb93967ef2f0ef2d0df01ab65f8f730d2851251b7cda33d6e3116f566927744a6e23559db48c03d567c61c6"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000300)=0x1, r5, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000440)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @private1={0xfc, 0x1, '\x00', 0xff}, 0x3}, r5, 0x7}}, 0x48) 2.753245818s ago: executing program 2 (id=3414): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000240)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40c9}, 0x15) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = socket(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000012c0)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r3 = fcntl$dupfd(r2, 0x0, r2) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x0) sendmsg$inet6(r2, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)="5a6871908ddfe3ee43aa1160a73753ce6cab32d184de576a9f314969c1d7546399a47258ea86bbd3febfc84e58f64d32bb361e0af645bad480a103ab7d7fa2404622f26e7f7e668a4d7e5aee1276dc1d52b170003659e627d012cdf5dcb438b8ae0bf19e6c992c68011b7297da8b53655071195f55e0d68ff3a297520e6cd6b2b46822b62f0fa2c9bd78d970b17a23e4096c1aeb98ba30c29a9003ba384101a9bb1ac802a76ec09284effc42886e77fe283439bc49a035bc4699ea3f5f049025dcb27f3bef88634d63ce70dd8756f4bf3100e3fd83131acc6bf88380dd4b1a277f8381d96c02860d605007f25c76d3893b32f43bca88d104b67b9d", 0xfb}, {&(0x7f0000000400)="00d7dcfa632a50c7e2ca9e926aeeec4fd3a058afd83637984e4fc7799bb4d0a6d9952b4862fc0945febba09dd36d7d003a3f2bee15f73ecad8dcced49ebac0ee82b73e666fca9ee06e8fc276d930ca363e81ded9ab4bcfcfc746dde920ce0abd805d7a1139f2a0c3f865aecd944ba7dcc411355fe0fe30c6cc64fd3cc4bbefee8c1796025bb0a941efb1f7992b1f24f68f515efddd644231ab042280db0adc93716380eaf6595835be9246bd9db97a73a284f3bc2dcfeb22599809286d6a441d01abf014aba8eefcf9340f040a0bd5b63b3786b599938d86334cb1aec10768baebac305c82b7be492d10bc022fce5c4c0cff2dd7abe171558eb482156e5472f8eb8c3c4bb1750f00c0ffb2abe4bb3468f3e07bfc15f5ebbd7affadadc5047d2c82b1d075abb7c70d7a305dff7966a8f115699f773442b9b7d57173872ad693d7090b7d946c03ef5f2664400ec4f99b646a21af47f083d9b22fbfaaca86ec515a3298e94f69392bb3bd0af1ef49c7065e8ced08ade3bed0f72e9796f8365623fb405eb5a7b7ca84eb9acb24c58a1cb13c21474eb50c51f664156f53fb44a99ec636d673516c5de2a8bcf8827d6fee81b9b0c414f0eb2db33f5c8ea413b27a6db22b5090e55b9969178a5bb37bc047f59882521d0a730189c48cedd7a6571878ab68ef9fa96bc8a32f50f0c58b1e73828b9ff4194b481b72ef0cc8a0c0bc680f5ef6c81af6da535032e813a47f57f7c3eaf713c07507fa1645bc06989ceb43c0c48dcf92fb37057d4e0adece1e8b4d5b71ebb4b2b3732ecae1dae529e18056b2c21995ec2051a1453fc435c17a7a864c6761453d71d0368cc163dde0dd2423079c3b461b1271404bbb7cce5214b9733c24fb8b48c185a1d2790284848da41a6ddff3b7356ba9ed03ceb3cf346a65b4565e3a6b4dca9ff6955cc8689fc2804b0b34f45fadbd7fab3265f4d8e52c2b0fe0dc4714af1f9d3b2ca9ef9ae1a24c79ac01162ad54ee28bf1aba50a5c395f5a5632c361b070e38b", 0x2d6}], 0x2}, 0x40001080) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000700)=@ccm_128={{0x303}, "4086090000009c0c", "1929a6029d49e4cc504f4eecd2a2dfdb", "e83c5954", "129728494b4b6674"}, 0x28) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) write(r1, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r1, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, 0x0) 2.201562732s ago: executing program 6 (id=3415): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x18, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="d6813e2a29a841f8e6713c424d612fab236df3f5866461587da6267db916126753e0e0a80c068baa289d433a7d6d11171fc2fd1243fa9d594790f0e160b56c74cffdf8216de72c904d12d087a12f65e67b80343c71f5f14ed701f2dda7544bdbfdb06a7b29ddee366058773d95156caca431375fd42ba3bc10a0c04f8f990b00bd490720b2dd1b79f255f6ec4785c17912a40ab3166b22cc64e82bafdfa0c660c6", @ANYRESDEC, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT], 0x0, 0x9, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00'}, 0x10) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x1000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @local}}, {{0x2, 0x0, @loopback}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x83, 0x5, 0xff, 0x6, @time={0x80000000, 0x3}, {0xdd, 0x4}, {0x7f, 0xb1}, @quote={{0x7, 0x7}, 0x200, &(0x7f0000000180)={0xa, 0x40, 0xf1, 0x5, @tick, {0x2b, 0x6}, {0xff, 0x7}, @addr={0x1, 0xa}}}}, {0xf, 0x62, 0x4, 0x5, @time={0x4399, 0x3}, {0x8}, {0x1}, @time=@tick=0x82}, {0xa, 0x5, 0x4, 0x80, @time={0x4, 0x7}, {0x7, 0x1}, {0x0, 0x5}, @time=@tick=0x2}, {0x2, 0xff, 0xff, 0xc, @tick=0x3, {0x4, 0x9}, {0x77, 0x5}, @addr={0x3, 0xfb}}], 0x70) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x200, 0x2, 0x0, 0x0, r0}) r3 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r3, &(0x7f0000776000/0x4000)=nil, 0x5000) capget(&(0x7f0000000480)={0x20071026}, &(0x7f00000004c0)={0x8, 0x4, 0x7, 0x1, 0x5, 0x8}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card3/oss_mixer\x00', 0x400, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f00000003c0)={0x1, 0x0, &(0x7f0000000240), 0x0}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 1.886039717s ago: executing program 6 (id=3416): ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000180)={&(0x7f0000000100)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x36, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x8000102) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x85}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f000067d000/0x2000)=nil, &(0x7f000053d000/0x1000)=nil, 0x2000}) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {r5, 0x1, 0x30, 0x30, 0x0, @in6={0xa, 0x4e24, 0x401, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xe}, @in={0x2, 0x4e21, @empty}}}, 0x118) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r5, 0x4734}}, 0x10) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000200)=0xa, r5, 0x0, 0x0, 0x1}}, 0x20) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) socket(0x10, 0x3, 0x4) 1.811584765s ago: executing program 5 (id=3417): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000000)=0x5fd, 0x4) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x2022, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x2}, 0x94) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000000)=0x74000000) write$dsp(0xffffffffffffffff, &(0x7f0000002000)='`', 0x88020) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg(r4, &(0x7f00000029c0), 0x400006d, 0x20000004) openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) 1.649528594s ago: executing program 4 (id=3418): r0 = socket$pptp(0x18, 0x1, 0x2) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)={{0x1, 0x1, 0x11, 0xffffffffffffffff, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)={{0x1, 0x1, 0x11, 0xffffffffffffffff, {0x4}}, './file0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x2, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000ffffff7f0000000700000000"], &(0x7f0000000440)='GPL\x00', 0x5, 0xfb, &(0x7f0000000480)=""/251, 0x41100, 0x8, '\x00', r2, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x2000008, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x80005, 0xc, 0x3, 0x3ff}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000002c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, r1], &(0x7f0000000300)=[{0x5, 0x5, 0x4, 0x5}], 0x10, 0x8fb}, 0x94) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x2, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000ffffff7f0000000700000000"], &(0x7f0000000440)='GPL\x00', 0x5, 0xfb, &(0x7f0000000480)=""/251, 0x41100, 0x8, '\x00', r2, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x2000008, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x80005, 0xc, 0x3, 0x3ff}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000002c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, r1], &(0x7f0000000300)=[{0x5, 0x5, 0x4, 0x5}], 0x10, 0x8fb}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000400)=r3, 0x4) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc4c85513, &(0x7f0000000540)={{0xb, 0x6, 0x0, 0x2, 'syz0\x00', 0x281d}, 0x0, [0x1, 0x4ea3, 0x40000000000009, 0x56cd, 0x5, 0x6, 0x0, 0x80000001, 0x201, 0x1, 0x3fb, 0x1, 0x9, 0x7, 0x4, 0x10000, 0x43, 0x49b5e351, 0xfffffffffffffffc, 0xe8de, 0xfffffffffffffff9, 0x9, 0x1ff, 0x9, 0x1, 0x8, 0x80000000, 0x4, 0x2, 0x8000, 0x8, 0xa36, 0x57bf4b04, 0x4, 0x40000000000001, 0x6, 0x8, 0xffffffff, 0x8, 0x7ff, 0x6, 0x401, 0x5, 0x1, 0x1ff, 0x10000, 0x42, 0xb7, 0x0, 0x5, 0xbe5, 0xa0000000000, 0x0, 0x1, 0x8, 0x8000000000000000, 0xd3d, 0xbbeb, 0x1, 0x6, 0x4, 0x80000000006, 0x8001, 0x7, 0x1, 0xec7, 0x3, 0xc58e, 0x3, 0x11ad, 0x0, 0x453, 0x8000, 0x100080, 0x7f, 0x9, 0x200000000001, 0x2, 0x8000000000000000, 0x4, 0x7, 0xa5, 0x1b13, 0x4, 0x85, 0x8, 0x4, 0xf75, 0x9, 0xb, 0xffffffffffff66e3, 0xfffffffffffffff9, 0x851a, 0x5e997b8e, 0x0, 0x7, 0xffffffffffffffff, 0x3, 0x100, 0x3, 0x3ff, 0x6, 0x0, 0xffffffffffffff95, 0xa, 0x108000001, 0xcc7e, 0x8, 0x0, 0x8, 0x6, 0xfffffffffffffd96, 0x3f3, 0x1, 0x4, 0x0, 0x7, 0x5, 0x6, 0x1, 0xe1, 0xec2, 0x1, 0x5, 0xfff, 0x0, 0x80]}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000380)={0x22140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x20, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x20, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xd1}) (async) io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xd1}) r5 = io_uring_setup(0x1b7a, &(0x7f0000000040)={0x0, 0xa8bf, 0xc000, 0x7, 0x20002f7}) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000580)={{0xa000, 0x4000, 0x0, 0x5, 0x7f, 0x8, 0xf8, 0x5, 0x3, 0x81, 0x4, 0xfd}, {0x8080000, 0x8000000, 0xe, 0x1b, 0x18, 0x2, 0xf0, 0x4, 0x1, 0x3, 0x3, 0x1}, {0x4000, 0x9000, 0xc, 0x0, 0x4, 0x8, 0x6, 0x2, 0x90, 0xa1, 0x1, 0x9}, {0x2000, 0x0, 0x9, 0x2, 0x1, 0x9, 0xd8, 0x5, 0x1, 0x3, 0xd, 0x3}, {0xeeef0000, 0x200000, 0x0, 0x8, 0x7f, 0x8, 0x34, 0x8, 0x9, 0xfe, 0x9}, {0xfec00000, 0x50000, 0xc, 0x0, 0x9d, 0x80, 0x0, 0x3, 0x57, 0x4, 0x7}, {0xffffffff, 0xdddd1000, 0xe, 0xa, 0x9, 0x40, 0x4, 0x1, 0x81, 0x73, 0x4, 0x7}, {0xffffffff, 0x7000, 0x10, 0x9, 0x61, 0xa, 0x2, 0xf8, 0x7, 0xf4, 0x0, 0xf}, {0x8080000, 0xe}, {0x3000, 0x2}, 0x10022, 0x0, 0x30000, 0x600080, 0x4, 0x1000, 0xffff1000, [0xb, 0xc, 0x8, 0xffffffffffff8000]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5c8c, 0x0, @empty, @mcast1, 0x80, 0x0, 0x0, 0x20000000}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5c8c, 0x0, @empty, @mcast1, 0x80, 0x0, 0x0, 0x20000000}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) r6 = syz_open_dev$media(&(0x7f0000000000), 0x5, 0x101002) pwritev(r6, &(0x7f00000004c0)=[{&(0x7f0000000100)="15", 0x1}], 0x1, 0x2, 0x3) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet(0x2, 0x1, 0x100) (async) socket$inet(0x2, 0x1, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x4000000) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 1.587767168s ago: executing program 2 (id=3419): socket$nl_generic(0x10, 0x3, 0x10) socket$caif_stream(0x25, 0x1, 0x2) socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x240400c3) openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x1, 0x2, 0x4}]}]}, {0x0, [0x5f]}}, &(0x7f0000000f40)=""/4089, 0x33, 0xff9, 0x1}, 0x28) 1.464257983s ago: executing program 4 (id=3420): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000280)='f2fs_readdir\x00', r0, 0x0, 0x5}, 0x18) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x10000008, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x3f, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x13, &(0x7f00000006c0)=ANY=[@ANYRES64=r3, @ANYRES64, @ANYRESOCT=r2], &(0x7f0000000500)='syzkaller\x00', 0x43, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000540)={0x8, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000580)=[{0x5, 0x2, 0x4, 0x8}, {0x2, 0x3, 0xb, 0x7}, {0x0, 0x3, 0xa, 0x2}, {0x0, 0x103, 0xf, 0x7}, {0x3, 0x2, 0x2, 0x2}], 0x10, 0x8}, 0x94) syz_open_dev$sndctrl(&(0x7f00000002c0), 0x9, 0x400) r5 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r5, &(0x7f0000002700)=""/102392, 0x18ff8) r6 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_mreqn(r6, 0x0, 0x20, 0x0, 0x300) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, 0x0, 0x24014844) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYRES64=r8], 0x60}, 0x1, 0x0, 0x0, 0x4000040}, 0x30048084) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000300)=0xc) ioctl$sock_FIOGETOWN(r7, 0x8903, &(0x7f0000000340)=0x0) r10 = epoll_create1(0x0) kcmp$KCMP_EPOLL_TFD(r9, r9, 0x7, r1, &(0x7f0000000380)={r10, r6, 0xa972}) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) setxattr$system_posix_acl(&(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x64, 0x2) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 1.338688725s ago: executing program 2 (id=3421): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061042c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x24000, 0x20) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x3b}}}}, [@NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x3f, 0xbe, "e579e8a201fa4e08ce2c92afaf16264efb02878f59144e9465a40f5aa1a666c6dd88843c642ae4e12bc81ebfc2165b55aa703799a1236a6c7f9a45"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040800}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061042c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x24000, 0x20) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x3b}}}}, [@NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x3f, 0xbe, "e579e8a201fa4e08ce2c92afaf16264efb02878f59144e9465a40f5aa1a666c6dd88843c642ae4e12bc81ebfc2165b55aa703799a1236a6c7f9a45"}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040800}, 0x0) (async) 1.222284631s ago: executing program 3 (id=3422): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}, 0x20048812) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x6) mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x6, &(0x7f00002a0000/0x4000)=nil) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, &(0x7f00000003c0)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020601080000000000000000000000040900020073797a3100000000050004000000000011000300686173683a6e65742c6e6574000000000c000780080012400000000205000500020000000500010006"], 0x58}}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) 1.164429216s ago: executing program 2 (id=3423): openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a310000000008000a4014"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}}, 0x4000010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b80)=@newtaction={0x14, 0x30, 0x400, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4004001) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.039359634s ago: executing program 5 (id=3424): socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$vbi(0x0, 0x0, 0x2) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setfsgid(0xffffffffffffffff) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = open(&(0x7f00000000c0)='.\x00', 0x10000, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) getdents(r5, &(0x7f0000001fc0)=""/184, 0xb8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=@updsa={0x138, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in6=@empty, 0x40}, {@in=@local, 0x0, 0x33}, @in6=@private1, {0x0, 0x0, 0x2, 0x0, 0x0, 0x100}, {}, {0x4}, 0x70bd2b, 0x0, 0x2, 0x1, 0x0, 0x40}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2c0000003f000701ddffffff00000000037c0000180037801300030071"], 0x2c}}, 0x0) mprotect(&(0x7f00009f9000/0xc000)=nil, 0xc000, 0xa) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc004}, 0xc000) 871.95941ms ago: executing program 2 (id=3425): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TCSETS(r0, 0x545c, 0x0) timer_create(0x0, &(0x7f0000000140)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4000) 0s ago: executing program 5 (id=3426): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) kernel console output (not intermixed with test programs): =0cf3, idProduct=9375, bcdDevice=1a.9e [ 791.126326][ T5915] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.232507][ T5915] usb 3-1: config 0 descriptor?? [ 792.010364][ T5915] ath6kl: Unsupported hardware version: 0x0 [ 792.046857][ T5915] ath6kl: Failed to init ath6kl core: -22 [ 792.077700][ T5915] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 793.319791][T15502] hub 8-0:1.0: USB hub found [ 793.324823][T15502] hub 8-0:1.0: 1 port detected [ 793.694101][ T943] usb 3-1: USB disconnect, device number 60 [ 793.897268][T15508] overlayfs: missing 'workdir' [ 795.236195][T15515] nbd: socks must be embedded in a SOCK_ITEM attr [ 795.253030][T15515] block nbd1: shutting down sockets [ 795.270603][ T5930] usb 5-1: new low-speed USB device number 57 using dummy_hcd [ 796.372320][ T5930] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 796.392638][ T5930] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 796.406566][ T5930] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 796.422224][ T5930] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 796.435607][ T5930] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 796.446668][ T5930] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 796.458960][ T5930] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 796.480418][ T5930] usb 5-1: language id specifier not provided by device, defaulting to English [ 796.590707][T15537] hub 8-0:1.0: USB hub found [ 796.600433][T15537] hub 8-0:1.0: 1 port detected [ 797.053070][ T5930] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 797.066524][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.074894][ T5930] usb 5-1: Manufacturer:  [ 797.104393][ T5930] usb 5-1: config 0 descriptor?? [ 797.115131][ T5930] hub 5-1:0.0: bad descriptor, ignoring hub [ 797.121160][ T5930] hub 5-1:0.0: probe with driver hub failed with error -5 [ 797.141178][ T5930] input:  as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input14 [ 797.177565][ T30] audit: type=1400 audit(1766624310.283:903): avc: denied { read } for pid=5171 comm="acpid" name="mouse1" dev="devtmpfs" ino=3328 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 797.200125][ T30] audit: type=1400 audit(1766624310.283:904): avc: denied { open } for pid=5171 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3328 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 797.937099][ T30] audit: type=1400 audit(1766624311.013:905): avc: denied { listen } for pid=15510 comm="syz.4.2243" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 798.153426][T15546] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 798.275411][T15546] bond1 (unregistering): Released all slaves [ 799.730005][ T943] usb 5-1: USB disconnect, device number 57 [ 800.415985][ T30] audit: type=1800 audit(1766624313.523:906): pid=15563 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.2255" name="SYSV00000000" dev="tmpfs" ino=6 res=0 errno=0 [ 800.970728][T15564] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 801.250127][T15570] autofs: Bad value for 'fd' [ 804.285386][T15604] Invalid source name [ 804.289480][T15604] UBIFS error (pid: 15604): cannot open "./file0", error -22 [ 804.297734][T15604] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2266'. [ 804.321539][T15604] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2266'. [ 804.622425][ T30] audit: type=1400 audit(1766624317.373:907): avc: denied { create } for pid=15600 comm="syz.5.2266" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 804.691883][ T30] audit: type=1400 audit(1766624317.393:908): avc: denied { mounton } for pid=15600 comm="syz.5.2266" path="/151/file0" dev="tmpfs" ino=840 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 806.168641][T15627] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 806.177680][T15627] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 808.172224][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.178859][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.816782][T15657] fuse: Unknown parameter 'r00000000000040000' [ 811.260562][ T5930] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 811.430394][ T5930] usb 5-1: Using ep0 maxpacket: 8 [ 811.436920][T15677] autofs: Bad value for 'fd' [ 811.456398][ T5930] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 811.479100][ T5930] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 811.508445][ T5930] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 811.533475][ T5930] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.563954][ T5930] usbtmc 5-1:16.0: bulk endpoints not found [ 814.218666][ T5915] usb 5-1: USB disconnect, device number 58 [ 814.412218][T15702] fuse: Unknown parameter 'r00000000000040000' [ 814.445097][T15705] fuse: Unknown parameter 'user_id00000000000000000000' [ 814.650600][ T5915] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 814.868352][ T5915] usb 3-1: Using ep0 maxpacket: 16 [ 814.875284][ T5915] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 814.887144][ T5915] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 814.900810][ T5915] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 814.910098][ T5915] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.918265][ T5915] usb 3-1: Product: syz [ 814.922559][ T5915] usb 3-1: Manufacturer: syz [ 814.927204][ T5915] usb 3-1: SerialNumber: syz [ 814.934459][ T5915] usb 3-1: config 0 descriptor?? [ 814.943387][ T5915] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 814.952679][ T5915] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 816.110086][ T5915] em28xx 3-1:0.0: unknown em28xx chip ID (222) [ 816.698145][T15703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 816.717123][T15703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.729090][ T5915] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 816.738907][ T5915] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 816.747028][ T5915] em28xx 3-1:0.0: No AC97 audio processor [ 816.765420][ T5915] usb 3-1: USB disconnect, device number 61 [ 816.781352][ T5915] em28xx 3-1:0.0: Disconnecting em28xx [ 816.790030][ T5915] em28xx 3-1:0.0: Freeing device [ 818.557932][T14675] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 818.633581][T15738] fuse: Unknown parameter 'user_id00000000000000000000' [ 818.780557][T14675] usb 5-1: Using ep0 maxpacket: 8 [ 818.799819][T14675] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 818.920469][T14675] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 818.968825][T14675] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 819.006137][T14675] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 819.044824][T14675] usbtmc 5-1:16.0: bulk endpoints not found [ 819.306978][T15748] fuse: Unknown parameter 'r00000000000040000' [ 821.105241][ T5915] usb 5-1: USB disconnect, device number 59 [ 822.580449][ T5915] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 822.790774][ T5915] usb 1-1: Using ep0 maxpacket: 16 [ 822.867186][ T5915] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 822.906085][ T5915] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 822.927579][ T5915] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 822.947811][ T5915] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 822.991515][ T5915] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 823.010758][ T5915] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 823.028936][ T5915] usb 1-1: Manufacturer: syz [ 823.051796][ T5915] usb 1-1: config 0 descriptor?? [ 824.105063][ T30] audit: type=1400 audit(1766624337.213:909): avc: denied { listen } for pid=15787 comm="syz.0.2317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 824.537954][ T30] audit: type=1400 audit(1766624337.643:910): avc: denied { watch watch_reads } for pid=15787 comm="syz.0.2317" path="/499" dev="tmpfs" ino=2696 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 826.161833][ T5930] usb 1-1: USB disconnect, device number 63 [ 828.453286][T15847] autofs: Bad value for 'fd' [ 829.639431][T15855] autofs: Bad value for 'fd' [ 831.329846][T15886] rdma_op ffff8880576281f0 conn xmit_rdma 0000000000000000 [ 833.637487][ T30] audit: type=1400 audit(1766624346.743:911): avc: denied { ioctl } for pid=15916 comm="syz.5.2352" path="socket:[61083]" dev="sockfs" ino=61083 ioctlcmd=0x662b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 835.362566][T15935] rdma_op ffff88803189b9f0 conn xmit_rdma 0000000000000000 [ 835.840637][ T943] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 837.139250][ T943] usb 5-1: config 0 has no interfaces? [ 837.953937][ T943] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 837.963080][ T943] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 838.026424][ T943] usb 5-1: config 0 descriptor?? [ 838.139046][ T5930] usb 5-1: USB disconnect, device number 60 [ 838.494183][ T30] audit: type=1400 audit(1766624351.593:912): avc: denied { getopt } for pid=15961 comm="syz.4.2367" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 838.814514][ T30] audit: type=1400 audit(1766624351.593:913): avc: denied { map } for pid=15961 comm="syz.4.2367" path="socket:[62073]" dev="sockfs" ino=62073 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 838.844171][ T30] audit: type=1400 audit(1766624351.593:914): avc: denied { accept } for pid=15961 comm="syz.4.2367" path="socket:[62073]" dev="sockfs" ino=62073 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 839.402050][T15977] rdma_op ffff888054a6b9f0 conn xmit_rdma 0000000000000000 [ 847.594728][T16045] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 848.649899][ T30] audit: type=1400 audit(1766624361.573:915): avc: denied { bind } for pid=16062 comm="syz.5.2395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 848.820149][ T30] audit: type=1400 audit(1766624361.923:916): avc: denied { ioctl } for pid=16072 comm="syz.2.2396" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 852.010441][ T6945] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 852.171813][ T6945] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 852.180625][ T6945] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 852.193960][ T6945] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 852.203705][ T6945] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 852.218997][ T6945] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 852.230620][ T6945] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 852.239766][ T6945] usb 3-1: Product: syz [ 852.244380][ T6945] usb 3-1: Manufacturer: syz [ 852.261404][ T6945] cdc_wdm 3-1:1.0: skipping garbage [ 852.266728][ T6945] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 852.356411][T16135] hub 8-0:1.0: USB hub found [ 852.361396][T16135] hub 8-0:1.0: 1 port detected [ 852.472415][ T6945] usb 3-1: USB disconnect, device number 62 [ 852.792699][T16139] hub 8-0:1.0: USB hub found [ 852.799379][T16139] hub 8-0:1.0: 1 port detected [ 853.481107][ T30] audit: type=1400 audit(1766624366.583:917): avc: denied { read write } for pid=16143 comm="syz.0.2412" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 853.482655][T16144] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2412'. [ 853.544623][ T30] audit: type=1400 audit(1766624366.583:918): avc: denied { open } for pid=16143 comm="syz.0.2412" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 853.580266][T16144] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16144 comm=syz.0.2412 [ 853.629283][T16144] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 853.642239][T16144] team0: Port device batadv1 added [ 853.798448][T16155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2417'. [ 854.121371][T16162] overlayfs: missing 'workdir' [ 855.775337][T16184] faux_driver vgem: [drm] Unknown color mode 13; guessing buffer size. [ 855.817092][ T30] audit: type=1400 audit(1766624368.893:919): avc: denied { map } for pid=16183 comm="syz.4.2424" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 855.893565][ T30] audit: type=1400 audit(1766624368.893:920): avc: denied { execute } for pid=16183 comm="syz.4.2424" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 857.191439][T16211] mmap: syz.0.2432 (16211): VmData 37728256 exceed data ulimit 519. Update limits or use boot option ignore_rlimit_data. [ 857.484875][T16216] lo speed is unknown, defaulting to 1000 [ 857.847127][T16232] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2437'. [ 857.857336][T16232] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2437'. [ 858.415245][T16235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2437'. [ 858.705004][T16235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2437'. [ 858.742782][ T5997] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 858.768051][ T6067] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 858.884010][ T6067] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 858.900255][ T6067] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.218002][ T43] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 859.377851][T16255] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2440'. [ 859.461685][T16255] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2440'. [ 859.470697][ T43] usb 3-1: device descriptor read/64, error -71 [ 859.723488][ T43] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 859.794380][T16256] syzkaller0: entered promiscuous mode [ 859.801539][T16256] syzkaller0: entered allmulticast mode [ 859.960407][ T43] usb 3-1: device descriptor read/64, error -71 [ 860.091217][ T43] usb usb3-port1: attempt power cycle [ 860.430384][ T43] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 860.450997][ T43] usb 3-1: device descriptor read/8, error -71 [ 860.720599][ T43] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 860.757150][ T43] usb 3-1: device descriptor read/8, error -71 [ 860.870730][ T43] usb usb3-port1: unable to enumerate USB device [ 862.079465][ T30] audit: type=1400 audit(1766624375.183:921): avc: denied { map } for pid=16275 comm="syz.0.2447" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 862.103106][ T30] audit: type=1400 audit(1766624375.213:922): avc: denied { write } for pid=16275 comm="syz.0.2447" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 863.233147][T16296] autofs: Bad value for 'fd' [ 865.980551][T14675] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 866.541032][T14675] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 866.572847][T14675] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 866.607130][T14675] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 866.737885][T14675] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 866.761493][T14675] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 866.771076][T14675] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 866.779173][T14675] usb 3-1: Product: syz [ 866.783467][T14675] usb 3-1: Manufacturer: syz [ 866.914469][T14675] cdc_wdm 3-1:1.0: skipping garbage [ 866.926998][T14675] cdc_wdm 3-1:1.0: skipping garbage [ 866.937412][T14675] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 867.752392][T14675] usb 3-1: USB disconnect, device number 67 [ 868.243794][T16331] autofs: Bad value for 'fd' [ 869.651748][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.658471][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.356167][T16352] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 872.060090][T16377] hub 8-0:1.0: USB hub found [ 872.066066][T16377] hub 8-0:1.0: 1 port detected [ 874.171788][ T30] audit: type=1400 audit(1766624602.285:923): avc: denied { connect } for pid=16402 comm="syz.4.2486" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 874.558989][T16409] xt_ecn: cannot match TCP bits for non-tcp packets [ 874.611367][ T30] audit: type=1326 audit(1766624602.665:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.227776][ T30] audit: type=1326 audit(1766624602.665:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.261332][ T30] audit: type=1326 audit(1766624602.665:926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=268 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.285245][ T30] audit: type=1326 audit(1766624602.665:927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.350467][ T30] audit: type=1326 audit(1766624602.665:928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.402908][ T30] audit: type=1326 audit(1766624602.665:929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 875.448121][ T30] audit: type=1326 audit(1766624602.675:930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 876.704314][ T30] audit: type=1326 audit(1766624602.675:931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 876.729570][ T30] audit: type=1326 audit(1766624602.675:932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16405 comm="syz.0.2487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f913678f749 code=0x7ffc0000 [ 877.500468][ T6945] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 877.650388][ T6945] usb 5-1: Using ep0 maxpacket: 8 [ 877.657545][ T6945] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 877.715520][ T6945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 877.725660][ T6945] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 877.736608][ T6945] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 877.746602][ T6945] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 877.769989][ T6945] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 877.779388][ T6945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.795779][ T6945] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 879.190422][ T43] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 879.670641][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 879.672023][T16461] rdma_op ffff8880441c99f0 conn xmit_rdma 0000000000000000 [ 879.695299][ T43] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 879.706728][ T43] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 879.718754][ T43] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 879.730345][ T43] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 879.890857][ T43] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 879.969299][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.005591][ T43] usb 3-1: Product: syz [ 880.015341][ T43] usb 3-1: Manufacturer: syz [ 880.022107][ T43] usb 3-1: SerialNumber: syz [ 880.042856][ C1] imon 3-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 880.070054][ T43] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/input/input16 [ 880.095085][ T6945] usb 5-1: USB disconnect, device number 61 [ 880.101475][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 880.101528][ T30] audit: type=1400 audit(1766624608.215:959): avc: denied { ioctl } for pid=5171 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3369 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 880.299826][T16473] IPVS: sh: FWM 3 0x00000003 - no destination available [ 880.307724][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 880.870362][ T43] imon 3-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 880.886694][ T43] (id 0x00) [ 880.976565][ T43] rc_core: IR keymap rc-imon-pad not found [ 880.985993][ T43] Registered IR keymap rc-empty [ 881.000488][ T43] imon 3-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 881.110815][ T43] imon 3-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 881.172196][ T43] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/rc/rc0 [ 881.217983][ T43] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/rc/rc0/input17 [ 881.236093][ T43] imon 3-1:155.0: iMON device (15c2:ffdc, intf0) on usb<3:68> initialized [ 881.416564][ T30] audit: type=1400 audit(1766624609.525:960): avc: denied { append } for pid=16447 comm="syz.2.2499" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 881.442256][T16448] imon:vfd_write: invalid payload size [ 881.492983][ T43] usb 3-1: USB disconnect, device number 68 [ 881.720927][T16498] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 883.595760][T16520] autofs: Bad value for 'fd' [ 883.970394][ T43] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 884.290436][ T43] usb 5-1: Using ep0 maxpacket: 8 [ 884.300466][ T43] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 884.311952][ T43] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 884.328961][ T43] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 884.351334][ T43] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 884.390118][ T43] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 884.442959][ T43] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 884.476264][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.519908][ T43] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 886.711341][ T43] usb 5-1: USB disconnect, device number 62 [ 886.750424][ T6945] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 886.913150][ T6945] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 886.930789][ T6945] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 886.952516][ T6945] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 886.964551][ T6945] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 886.991489][ T6945] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 887.260827][ T6945] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 887.269229][ T6945] usb 1-1: Product: syz [ 887.273824][ T6945] usb 1-1: Manufacturer: syz [ 887.296630][ T6945] cdc_wdm 1-1:1.0: skipping garbage [ 887.305877][ T6945] cdc_wdm 1-1:1.0: skipping garbage [ 887.311385][ T6945] cdc_wdm 1-1:1.0: skipping garbage [ 887.316711][ T6945] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 887.561609][ T6945] usb 1-1: USB disconnect, device number 64 [ 887.940439][ T943] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 888.090405][ T943] usb 5-1: Using ep0 maxpacket: 8 [ 888.097359][ T943] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 888.107434][ T943] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.121024][ T943] pvrusb2: Hardware description: Terratec Grabster AV400 [ 888.128138][ T943] pvrusb2: ********** [ 888.132209][ T943] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 888.152897][ T943] pvrusb2: Important functionality might not be entirely working. [ 888.160887][ T943] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 888.172263][ T943] pvrusb2: ********** [ 888.328756][ T2336] pvrusb2: Invalid write control endpoint [ 888.394803][ T2336] pvrusb2: Invalid write control endpoint [ 888.408176][ T2336] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 888.417840][ T2336] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 888.429585][ T2336] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 888.443836][ T2336] pvrusb2: Device being rendered inoperable [ 888.450591][ T2336] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 888.458073][ T2336] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 888.469305][ T2336] pvrusb2: Attached sub-driver cx25840 [ 888.474953][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 888.485251][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 888.755279][T16576] No source specified [ 889.116322][ T30] audit: type=1400 audit(1766624617.105:961): avc: denied { ioctl } for pid=16575 comm="syz.4.2526" path="/544/file0" dev="tmpfs" ino=2907 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 890.971341][ T943] usb 5-1: USB disconnect, device number 63 [ 891.564812][T16627] rdma_op ffff888020b579f0 conn xmit_rdma 0000000000000000 [ 892.100461][ T5930] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 892.479508][ T5930] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 892.500557][ T5930] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 892.544291][ T5930] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 892.573053][ T5930] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 892.600080][ T5930] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 892.652442][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 892.676415][ T5930] usb 3-1: Product: syz [ 892.681950][ T5930] usb 3-1: Manufacturer: syz [ 892.850541][ T5930] cdc_wdm 3-1:1.0: skipping garbage [ 892.875632][ T5930] cdc_wdm 3-1:1.0: skipping garbage [ 892.910478][ T5930] cdc_wdm 3-1:1.0: skipping garbage [ 892.917451][ T5930] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 893.275777][ T943] usb 3-1: USB disconnect, device number 69 [ 894.848036][T16692] rdma_op ffff888035e091f0 conn xmit_rdma 0000000000000000 [ 895.801727][T16710] rdma_op ffff88802af9f9f0 conn xmit_rdma 0000000000000000 [ 896.447127][ T943] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 897.609453][ T943] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 897.687331][ T943] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 897.701427][ T943] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 897.722834][ T943] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 897.737108][ T943] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 897.757545][ T943] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 897.796578][ T943] usb 3-1: Product: syz [ 897.804736][ T943] usb 3-1: Manufacturer: syz [ 897.942350][ T943] cdc_wdm 3-1:1.0: skipping garbage [ 897.947608][ T943] cdc_wdm 3-1:1.0: skipping garbage [ 897.953333][ T943] cdc_wdm 3-1:1.0: skipping garbage [ 897.958525][ T943] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 898.535505][T14675] usb 3-1: USB disconnect, device number 70 [ 898.550393][ T5930] usb 1-1: new low-speed USB device number 65 using dummy_hcd [ 898.771063][ T5930] usb 1-1: Invalid ep0 maxpacket: 64 [ 898.830405][ T943] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 898.900392][ T5930] usb 1-1: new low-speed USB device number 66 using dummy_hcd [ 898.960556][ T943] usb 5-1: device descriptor read/64, error -71 [ 899.050356][ T5930] usb 1-1: Invalid ep0 maxpacket: 64 [ 899.056635][ T5930] usb usb1-port1: attempt power cycle [ 899.200714][ T943] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 899.340638][ T943] usb 5-1: device descriptor read/64, error -71 [ 899.383827][T16758] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2573'. [ 899.400488][ T5930] usb 1-1: new low-speed USB device number 67 using dummy_hcd [ 899.422532][T16758] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16758 comm=syz.2.2573 [ 899.430961][ T5930] usb 1-1: Invalid ep0 maxpacket: 64 [ 899.451113][ T943] usb usb5-port1: attempt power cycle [ 899.570431][ T5930] usb 1-1: new low-speed USB device number 68 using dummy_hcd [ 899.591647][ T5930] usb 1-1: Invalid ep0 maxpacket: 64 [ 899.600247][ T5930] usb usb1-port1: unable to enumerate USB device [ 900.176262][ T943] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 900.201521][ T943] usb 5-1: device descriptor read/8, error -71 [ 900.450996][ T943] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 900.483037][ T943] usb 5-1: device descriptor read/8, error -71 [ 900.602078][ T943] usb usb5-port1: unable to enumerate USB device [ 904.256503][ T30] audit: type=1400 audit(1766624632.365:962): avc: denied { write } for pid=16805 comm="syz.2.2587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 906.539079][T16843] rdma_op ffff888077a4e1f0 conn xmit_rdma 0000000000000000 [ 906.824477][T16847] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 907.698580][T14675] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 907.862571][T14675] usb 3-1: config 0 has no interfaces? [ 907.868627][T14675] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 907.879856][T14675] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.881294][T16871] autofs: Bad value for 'fd' [ 907.894472][T14675] usb 3-1: config 0 descriptor?? [ 908.965513][T14675] usb 3-1: USB disconnect, device number 71 [ 913.228289][ T5812] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 913.242402][ T5812] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 913.250264][ T5812] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 913.258123][ T5812] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 913.265876][ T5812] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 913.328081][T16932] lo speed is unknown, defaulting to 1000 [ 913.909112][T16932] chnl_net:caif_netlink_parms(): no params data found [ 914.108946][T16955] IPVS: sh: FWM 3 0x00000003 - no destination available [ 914.152765][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 914.252574][T16932] bridge0: port 1(bridge_slave_0) entered blocking state [ 914.280544][T16932] bridge0: port 1(bridge_slave_0) entered disabled state [ 914.287753][T16932] bridge_slave_0: entered allmulticast mode [ 914.317619][T16932] bridge_slave_0: entered promiscuous mode [ 914.362532][T16932] bridge0: port 2(bridge_slave_1) entered blocking state [ 914.403224][T16932] bridge0: port 2(bridge_slave_1) entered disabled state [ 914.443830][T16932] bridge_slave_1: entered allmulticast mode [ 914.468603][T16932] bridge_slave_1: entered promiscuous mode [ 914.613487][T16932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 914.663611][T16932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 914.744289][T16977] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2627'. [ 914.826834][T16981] IPVS: sh: FWM 3 0x00000003 - no destination available [ 914.834331][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 914.877837][T16932] team0: Port device team_slave_0 added [ 914.888631][T16932] team0: Port device team_slave_1 added [ 915.099211][T16932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.125747][T16932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.224664][T16932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 915.269867][T16932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 915.277795][T16932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.338610][T16932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 915.360784][ T52] Bluetooth: hci5: command tx timeout [ 915.815511][T16932] hsr_slave_0: entered promiscuous mode [ 916.041475][T16932] hsr_slave_1: entered promiscuous mode [ 916.058569][T16932] debugfs: 'hsr0' already exists in 'hsr' [ 916.066692][T16932] Cannot create hsr debugfs directory [ 916.216860][T17009] hub 8-0:1.0: USB hub found [ 916.222274][T17009] hub 8-0:1.0: 1 port detected [ 916.521600][ T943] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 916.730402][ T943] usb 5-1: Using ep0 maxpacket: 16 [ 916.735897][T16932] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 916.742189][ T943] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.753758][ T943] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 916.756494][T16932] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 916.773414][ T943] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 916.784019][ T943] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.786773][T16932] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 916.798848][ T943] usb 5-1: Product: syz [ 916.803618][ T943] usb 5-1: Manufacturer: syz [ 916.808313][ T943] usb 5-1: SerialNumber: syz [ 916.816452][T16932] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 916.818750][ T943] usb 5-1: config 0 descriptor?? [ 916.969400][T16932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 916.996216][T16932] 8021q: adding VLAN 0 to HW filter on device team0 [ 917.029836][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 917.037062][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 917.074283][T16932] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 917.086524][T16932] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 917.100231][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 917.107329][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 917.440954][ T52] Bluetooth: hci5: command tx timeout [ 917.535468][T16932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 918.451937][T16932] veth0_vlan: entered promiscuous mode [ 918.466954][T16932] veth1_vlan: entered promiscuous mode [ 918.542685][T16932] veth0_macvtap: entered promiscuous mode [ 918.559557][T16932] veth1_macvtap: entered promiscuous mode [ 918.579404][T16932] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 918.595082][T16932] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 918.616024][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 918.626197][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 918.647801][ T6067] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 918.684593][T17052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 918.687435][ T6067] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 918.693678][T17052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 918.805974][ T6067] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 918.828642][ T6067] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 918.863287][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 918.875718][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 919.521707][ T52] Bluetooth: hci5: command tx timeout [ 919.829991][ T943] usb 5-1: USB disconnect, device number 68 [ 920.009026][T17067] autofs: Bad value for 'fd' [ 921.639113][ T52] Bluetooth: hci5: command tx timeout [ 925.747848][T17125] autofs: Bad value for 'fd' [ 926.351116][T17130] netlink: 512 bytes leftover after parsing attributes in process `syz.4.2666'. [ 926.362775][T17130] overlayfs: failed to resolve './bus': -2 [ 926.391412][T17130] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2666'. [ 926.405824][T17130] FAULT_INJECTION: forcing a failure. [ 926.405824][T17130] name failslab, interval 1, probability 0, space 0, times 0 [ 926.418704][T17130] CPU: 0 UID: 0 PID: 17130 Comm: syz.4.2666 Tainted: G L syzkaller #0 PREEMPT(full) [ 926.418731][T17130] Tainted: [L]=SOFTLOCKUP [ 926.418736][T17130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 926.418746][T17130] Call Trace: [ 926.418751][T17130] [ 926.418758][T17130] dump_stack_lvl+0x16c/0x1f0 [ 926.418783][T17130] should_fail_ex+0x512/0x640 [ 926.418808][T17130] ? kmem_cache_alloc_node_noprof+0x65/0x800 [ 926.418831][T17130] should_failslab+0xc2/0x120 [ 926.418855][T17130] kmem_cache_alloc_node_noprof+0x86/0x800 [ 926.418874][T17130] ? __alloc_skb+0x156/0x410 [ 926.418905][T17130] ? __alloc_skb+0x156/0x410 [ 926.418930][T17130] __alloc_skb+0x156/0x410 [ 926.418954][T17130] ? __alloc_skb+0x35d/0x410 [ 926.418980][T17130] ? __pfx___alloc_skb+0x10/0x10 [ 926.419008][T17130] ? netlink_autobind.isra.0+0x158/0x370 [ 926.419037][T17130] netlink_alloc_large_skb+0x69/0x140 [ 926.419062][T17130] netlink_sendmsg+0x698/0xdd0 [ 926.419088][T17130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 926.419119][T17130] ____sys_sendmsg+0xa5d/0xc30 [ 926.419143][T17130] ? copy_msghdr_from_user+0x10a/0x160 [ 926.419161][T17130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 926.419194][T17130] ___sys_sendmsg+0x134/0x1d0 [ 926.419212][T17130] ? __pfx____sys_sendmsg+0x10/0x10 [ 926.419261][T17130] __sys_sendmsg+0x16d/0x220 [ 926.419280][T17130] ? __pfx___sys_sendmsg+0x10/0x10 [ 926.419321][T17130] do_syscall_64+0xcd/0xf80 [ 926.419346][T17130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.419365][T17130] RIP: 0033:0x7f8ecf98f749 [ 926.419379][T17130] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 926.419396][T17130] RSP: 002b:00007f8ed08db038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 926.419413][T17130] RAX: ffffffffffffffda RBX: 00007f8ecfbe5fa0 RCX: 00007f8ecf98f749 [ 926.419425][T17130] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 000000000000000b [ 926.419436][T17130] RBP: 00007f8ed08db090 R08: 0000000000000000 R09: 0000000000000000 [ 926.419447][T17130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 926.419457][T17130] R13: 00007f8ecfbe6038 R14: 00007f8ecfbe5fa0 R15: 00007ffec63265a8 [ 926.419482][T17130] [ 926.890374][T13278] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 927.010370][ T943] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 927.052135][T13278] usb 5-1: config index 0 descriptor too short (expected 174, got 36) [ 927.080515][T13278] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 927.100399][T13278] usb 5-1: config 0 has no interfaces? [ 927.110362][T13278] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 927.120397][T13278] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.140926][T13278] usb 5-1: config 0 descriptor?? [ 927.170425][ T943] usb 7-1: Using ep0 maxpacket: 8 [ 927.190875][ T943] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 927.202986][ T943] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 927.213417][ T943] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 927.223794][ T943] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 927.243838][ T943] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 927.252937][ T943] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.517442][T13278] usb 5-1: string descriptor 0 read error: -71 [ 927.530896][ T943] usb 7-1: GET_CAPABILITIES returned 0 [ 927.536396][ T943] usbtmc 7-1:16.0: can't read capabilities [ 927.543830][T13278] usb 5-1: USB disconnect, device number 69 [ 927.570341][T17135] IPVS: sh: FWM 3 0x00000003 - no destination available [ 927.577714][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 927.733329][ T943] usb 7-1: USB disconnect, device number 2 [ 929.800691][T17162] hub 8-0:1.0: USB hub found [ 929.806468][T17162] hub 8-0:1.0: 1 port detected [ 931.166998][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.173542][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.570801][ T30] audit: type=1400 audit(1766624660.625:963): avc: denied { connect } for pid=17188 comm="syz.5.2679" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 933.338213][T17198] autofs: Bad value for 'fd' [ 934.640444][ T943] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 934.649739][T17223] lo speed is unknown, defaulting to 1000 [ 934.860939][ T943] usb 3-1: config 0 has an invalid interface number: 200 but max is 0 [ 935.170930][ T943] usb 3-1: config 0 has no interface number 0 [ 935.177115][ T943] usb 3-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 935.200770][ T943] usb 3-1: config 0 interface 200 has no altsetting 0 [ 935.210437][ T943] usb 3-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 935.219487][ T943] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 935.240832][ T943] usb 3-1: Product: syz [ 935.245350][ T943] usb 3-1: Manufacturer: syz [ 935.249978][ T943] usb 3-1: SerialNumber: syz [ 935.312345][ T943] usb 3-1: config 0 descriptor?? [ 936.140444][T13278] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 936.380820][T13278] usb 5-1: device descriptor read/64, error -71 [ 936.900534][T13278] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 937.040608][T13278] usb 5-1: device descriptor read/64, error -71 [ 937.152062][T13278] usb usb5-port1: attempt power cycle [ 937.348122][ T943] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.200/input/input18 [ 937.385176][ T943] usb 3-1: USB disconnect, device number 72 [ 937.500435][T13278] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 937.520765][T13278] usb 5-1: device descriptor read/8, error -71 [ 942.656157][T17257] rdma_op ffff8880324c51f0 conn xmit_rdma 0000000000000000 [ 944.131491][T17280] autofs: Bad value for 'fd' [ 944.166504][T17264] autofs: Bad value for 'fd' [ 945.051195][ T30] audit: type=1400 audit(1766624673.165:964): avc: denied { bind } for pid=17282 comm="syz.6.2706" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 945.059921][T17282] delete_channel: no stack [ 945.075951][ T30] audit: type=1400 audit(1766624673.165:965): avc: denied { name_bind } for pid=17282 comm="syz.6.2706" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 945.108112][ T30] audit: type=1400 audit(1766624673.165:966): avc: denied { node_bind } for pid=17282 comm="syz.6.2706" saddr=fe80::28 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 948.338195][ T943] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 948.520480][ T943] usb 5-1: Using ep0 maxpacket: 16 [ 948.533050][ T943] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 948.545623][ T943] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 948.559047][ T943] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 948.568611][ T943] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.576970][ T943] usb 5-1: Product: syz [ 948.581761][ T943] usb 5-1: Manufacturer: syz [ 948.586362][ T943] usb 5-1: SerialNumber: syz [ 948.596850][ T943] usb 5-1: config 0 descriptor?? [ 948.610565][ T943] em28xx 5-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers ! [ 948.872726][ T30] audit: type=1400 audit(1766624676.985:967): avc: denied { open } for pid=17334 comm="syz.6.2722" path="/dev/ptyr0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 948.934513][ T30] audit: type=1400 audit(1766624677.045:968): avc: denied { ioctl } for pid=17334 comm="syz.6.2722" path="/dev/ptyr0" dev="devtmpfs" ino=135 ioctlcmd=0x5404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 951.015794][T17360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 951.036845][T17360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 951.103114][T17362] FAULT_INJECTION: forcing a failure. [ 951.103114][T17362] name failslab, interval 1, probability 0, space 0, times 0 [ 951.116086][T17362] CPU: 1 UID: 0 PID: 17362 Comm: syz.2.2730 Tainted: G L syzkaller #0 PREEMPT(full) [ 951.116114][T17362] Tainted: [L]=SOFTLOCKUP [ 951.116120][T17362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 951.116131][T17362] Call Trace: [ 951.116137][T17362] [ 951.116144][T17362] dump_stack_lvl+0x16c/0x1f0 [ 951.116172][T17362] should_fail_ex+0x512/0x640 [ 951.116198][T17362] ? fs_reclaim_acquire+0xae/0x150 [ 951.116225][T17362] should_failslab+0xc2/0x120 [ 951.116249][T17362] __kmalloc_noprof+0xeb/0x910 [ 951.116275][T17362] ? tomoyo_encode2+0x100/0x3e0 [ 951.116298][T17362] ? tomoyo_encode2+0x100/0x3e0 [ 951.116317][T17362] tomoyo_encode2+0x100/0x3e0 [ 951.116338][T17362] tomoyo_encode+0x29/0x50 [ 951.116356][T17362] tomoyo_realpath_from_path+0x18f/0x6e0 [ 951.116382][T17362] tomoyo_path_number_perm+0x245/0x580 [ 951.116398][T17362] ? tomoyo_path_number_perm+0x237/0x580 [ 951.116416][T17362] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 951.116458][T17362] ? rcu_is_watching+0x12/0xc0 [ 951.116474][T17362] ? hook_file_ioctl_common+0x144/0x410 [ 951.116503][T17362] ? __x64_sys_ioctl+0x94/0x210 [ 951.116523][T17362] security_file_ioctl+0x9b/0x240 [ 951.116544][T17362] __x64_sys_ioctl+0xb7/0x210 [ 951.116562][T17362] do_syscall_64+0xcd/0xf80 [ 951.116582][T17362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.116597][T17362] RIP: 0033:0x7f656998f749 [ 951.116609][T17362] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 951.116624][T17362] RSP: 002b:00007f656a7ca038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 951.116638][T17362] RAX: ffffffffffffffda RBX: 00007f6569be6180 RCX: 00007f656998f749 [ 951.116648][T17362] RDX: 0000000000000000 RSI: 0000000000004c82 RDI: 0000000000000008 [ 951.116657][T17362] RBP: 00007f656a7ca090 R08: 0000000000000000 R09: 0000000000000000 [ 951.116666][T17362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 951.116674][T17362] R13: 00007f6569be6218 R14: 00007f6569be6180 R15: 00007fff04891b38 [ 951.116695][T17362] [ 951.116827][T17362] ERROR: Out of memory at tomoyo_realpath_from_path. [ 951.385778][ T30] audit: type=1400 audit(1766624679.205:969): avc: denied { read } for pid=17358 comm="syz.2.2730" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 951.530412][ T30] audit: type=1400 audit(1766624679.205:970): avc: denied { open } for pid=17358 comm="syz.2.2730" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 951.555449][ T30] audit: type=1400 audit(1766624679.445:971): avc: denied { ioctl } for pid=17358 comm="syz.2.2730" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 951.592997][T13278] usb 5-1: USB disconnect, device number 74 [ 954.750377][ T5917] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 954.912631][ T5917] usb 5-1: config 0 has no interfaces? [ 954.918130][ T5917] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 954.927496][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.949649][ T5917] usb 5-1: config 0 descriptor?? [ 955.564258][T14675] usb 5-1: USB disconnect, device number 75 [ 957.149168][T17435] ubi31: attaching mtd0 [ 957.779751][T17435] ubi31: scanning is finished [ 957.787621][T17435] ubi31: empty MTD device detected [ 958.043594][T17435] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 958.820392][ T6945] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 958.981807][ T6945] usb 5-1: Using ep0 maxpacket: 8 [ 958.988602][ T6945] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 958.999178][ T6945] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 959.008300][ T6945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 961.880961][T15730] usb 5-1: USB disconnect, device number 76 [ 961.910143][T17477] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 961.998447][T17474] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 962.133162][T17477] @0: renamed from bond_slave_1 (while UP) [ 962.492790][ T5917] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 962.680443][ T5917] usb 3-1: Using ep0 maxpacket: 32 [ 962.735826][ T5917] usb 3-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 962.936227][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 962.994856][ T5917] usb 3-1: Product: syz [ 963.003214][ T5917] usb 3-1: Manufacturer: syz [ 963.009594][ T5917] usb 3-1: SerialNumber: syz [ 963.023104][ T5917] usb 3-1: config 0 descriptor?? [ 963.032939][ T5917] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 963.257333][ T5917] gspca_topro: reg_w err -71 [ 963.264840][ T5812] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 963.278158][ T5812] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 963.286501][ T5812] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 963.297254][ T5812] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 963.305303][ T5812] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 963.389725][T17495] lo speed is unknown, defaulting to 1000 [ 963.465191][T15730] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 963.473234][ T5917] gspca_topro: Sensor soi763a [ 963.492648][ T5917] usb 3-1: USB disconnect, device number 73 [ 963.652025][T15730] usb 7-1: Using ep0 maxpacket: 8 [ 963.727233][T15730] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 963.854735][T15730] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 963.958969][T15730] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 963.980384][T15730] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 963.995033][T15730] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 964.010527][T15730] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 964.134713][T17495] chnl_net:caif_netlink_parms(): no params data found [ 964.229867][T15730] usb 7-1: GET_CAPABILITIES returned 0 [ 964.235591][T15730] usbtmc 7-1:16.0: can't read capabilities [ 964.277108][T17495] bridge0: port 1(bridge_slave_0) entered blocking state [ 964.287128][T17495] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.299889][T17495] bridge_slave_0: entered allmulticast mode [ 964.318999][T17495] bridge_slave_0: entered promiscuous mode [ 964.332151][T17495] bridge0: port 2(bridge_slave_1) entered blocking state [ 964.343157][T17495] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.353520][T17495] bridge_slave_1: entered allmulticast mode [ 964.375078][T17495] bridge_slave_1: entered promiscuous mode [ 964.414349][ T6069] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 964.440543][T15730] usb 7-1: USB disconnect, device number 3 [ 964.520599][ T6069] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 964.553858][T17495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 964.600550][T17495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 964.612437][ T6069] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 964.654071][ T6069] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 964.717537][T17495] team0: Port device team_slave_0 added [ 964.727612][T17495] team0: Port device team_slave_1 added [ 964.755650][T17495] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 964.762917][T17495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 964.789078][T17495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 964.801485][T17495] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 964.808455][T17495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 964.835732][T17495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 964.858884][ T30] audit: type=1400 audit(1766624692.965:972): avc: denied { read } for pid=5481 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 964.918637][T17495] hsr_slave_0: entered promiscuous mode [ 964.931704][T17495] hsr_slave_1: entered promiscuous mode [ 964.938343][T17495] debugfs: 'hsr0' already exists in 'hsr' [ 964.944287][T17495] Cannot create hsr debugfs directory [ 965.311342][ T6069] bridge_slave_1: left allmulticast mode [ 965.317013][ T6069] bridge_slave_1: left promiscuous mode [ 965.341297][ T6069] bridge0: port 2(bridge_slave_1) entered disabled state [ 965.352445][ T6069] bridge_slave_0: left allmulticast mode [ 965.358100][ T6069] bridge_slave_0: left promiscuous mode [ 965.364207][ T52] Bluetooth: hci6: command tx timeout [ 965.488850][ T6069] bridge0: port 1(bridge_slave_0) entered disabled state [ 965.606317][T17527] FAULT_INJECTION: forcing a failure. [ 965.606317][T17527] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 965.619597][T17527] CPU: 1 UID: 0 PID: 17527 Comm: syz.2.2772 Tainted: G L syzkaller #0 PREEMPT(full) [ 965.619626][T17527] Tainted: [L]=SOFTLOCKUP [ 965.619632][T17527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 965.619643][T17527] Call Trace: [ 965.619650][T17527] [ 965.619656][T17527] dump_stack_lvl+0x16c/0x1f0 [ 965.619684][T17527] should_fail_ex+0x512/0x640 [ 965.619714][T17527] strncpy_from_user+0x3b/0x2e0 [ 965.619742][T17527] getname_flags.part.0+0x8f/0x550 [ 965.619765][T17527] getname_flags+0x93/0xf0 [ 965.619787][T17527] do_sys_openat2+0xb9/0x290 [ 965.619804][T17527] ? __pfx_do_sys_openat2+0x10/0x10 [ 965.619823][T17527] ? rcu_is_watching+0x12/0xc0 [ 965.619840][T17527] ? irqentry_exit+0x1dd/0x8c0 [ 965.619862][T17527] ? lockdep_hardirqs_on+0x7c/0x110 [ 965.619885][T17527] ? irqentry_exit+0x1dd/0x8c0 [ 965.619910][T17527] __x64_sys_openat+0x174/0x210 [ 965.619928][T17527] ? __pfx___x64_sys_openat+0x10/0x10 [ 965.619950][T17527] ? trace_irq_enable.constprop.0+0x2f/0x110 [ 965.619977][T17527] do_syscall_64+0xcd/0xf80 [ 965.620002][T17527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 965.620020][T17527] RIP: 0033:0x7f656998df90 [ 965.620040][T17527] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44 [ 965.620058][T17527] RSP: 002b:00007f656a7c9f10 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 965.620076][T17527] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f656998df90 [ 965.620088][T17527] RDX: 0000000000000002 RSI: 00007f656a7c9fa0 RDI: 00000000ffffff9c [ 965.620100][T17527] RBP: 00007f656a7c9fa0 R08: 0000000000000000 R09: 0000000000000000 [ 965.620111][T17527] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 965.620122][T17527] R13: 00007f6569be6218 R14: 00007f6569be6180 R15: 00007fff04891b38 [ 965.620148][T17527] [ 965.822239][ T30] audit: type=1400 audit(1766624693.925:973): avc: denied { read } for pid=17525 comm="syz.6.2774" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 965.853508][ T30] audit: type=1400 audit(1766624693.925:974): avc: denied { open } for pid=17525 comm="syz.6.2774" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 965.915800][ T30] audit: type=1400 audit(1766624693.925:975): avc: denied { ioctl } for pid=17525 comm="syz.6.2774" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 966.097807][ T6069] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 966.112077][ T6069] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 966.123866][ T6069] bond0 (unregistering): Released all slaves [ 966.959995][T17546] IPVS: sh: FWM 3 0x00000003 - no destination available [ 966.977947][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 966.997753][ T6069] hsr_slave_0: left promiscuous mode [ 967.010632][ T6069] hsr_slave_1: left promiscuous mode [ 967.027824][ T6069] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 967.072841][ T6069] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 967.087283][ T6069] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 967.095485][ T6069] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 967.124344][ T6069] veth1_macvtap: left promiscuous mode [ 967.136002][ T6069] veth0_macvtap: left promiscuous mode [ 967.148210][ T6069] veth1_vlan: left promiscuous mode [ 967.161442][ T6069] veth0_vlan: left promiscuous mode [ 967.441455][ T52] Bluetooth: hci6: command tx timeout [ 967.663585][ T5930] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 967.699653][ T6069] team0 (unregistering): Port device team_slave_1 removed [ 967.764282][T17574] ubi31: attaching mtd0 [ 967.800322][T17574] ubi31: scanning is finished [ 967.820790][ T6069] team0 (unregistering): Port device team_slave_0 removed [ 967.855935][ T5930] usb 7-1: Using ep0 maxpacket: 8 [ 967.876755][ T5930] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 967.894095][ T5930] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 967.992682][T17574] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 967.993098][ T5930] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 968.011336][T17574] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 968.013384][ T5930] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 968.032114][T17574] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 968.038633][ T5930] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 968.050195][T17574] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 968.059702][T17574] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 968.067242][ T5930] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.076598][T17574] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 968.084997][T17574] ubi31: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 3827338824 [ 968.096759][T17574] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 968.108485][T17575] ubi31: background thread "ubi_bgt31d" started, PID 17575 [ 968.309277][ T5930] usb 7-1: GET_CAPABILITIES returned 0 [ 968.338545][ T5930] usbtmc 7-1:16.0: can't read capabilities [ 968.442442][T17578] ubi: mtd0 is already attached to ubi31 [ 968.674426][ T5930] usb 7-1: USB disconnect, device number 4 [ 969.540448][ T52] Bluetooth: hci6: command tx timeout [ 969.893534][T17600] autofs: Bad value for 'fd' [ 970.055874][T17495] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 970.064066][ T6069] IPVS: stop unused estimator thread 0... [ 970.080535][ T5915] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 970.095489][T17495] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 970.132718][T17495] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 970.166931][T17495] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 970.231350][ T5915] usb 7-1: Using ep0 maxpacket: 16 [ 970.238820][ T5915] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 970.255566][ T5915] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 970.269511][ T5915] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 970.280476][ T5915] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.288536][ T5915] usb 7-1: Product: syz [ 970.293614][ T5915] usb 7-1: Manufacturer: syz [ 970.298835][ T5915] usb 7-1: SerialNumber: syz [ 970.307862][ T5915] usb 7-1: config 0 descriptor?? [ 970.332648][ T5915] em28xx 7-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers ! [ 970.425515][T17495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 970.466717][T17495] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.493226][ T6246] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.500415][ T6246] bridge0: port 1(bridge_slave_0) entered forwarding state [ 970.543037][ T6246] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.550303][ T6246] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.802700][T17495] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 971.022635][T17495] veth0_vlan: entered promiscuous mode [ 971.033597][T17495] veth1_vlan: entered promiscuous mode [ 971.058366][T17495] veth0_macvtap: entered promiscuous mode [ 971.067355][T17495] veth1_macvtap: entered promiscuous mode [ 971.081087][T17495] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 971.094626][T17495] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 971.106320][ T6068] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.115381][ T6068] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.125089][ T6068] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.134694][ T6068] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.195609][ T6069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.205491][ T6069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 971.229170][ T6246] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.237371][ T6246] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 971.433450][T17643] autofs: Bad value for 'fd' [ 971.560406][ T43] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 971.600664][ T52] Bluetooth: hci6: command tx timeout [ 971.712020][ T43] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 971.722976][ T43] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 971.732762][ T43] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 971.742015][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 971.750056][ T43] usb 5-1: SerialNumber: syz [ 971.993405][T17647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.005799][T17647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.025941][ T43] usb 5-1: 0:2 : does not exist [ 972.040082][ T43] usb 5-1: USB disconnect, device number 77 [ 973.760134][ T30] audit: type=1400 audit(1766624701.375:976): avc: denied { append } for pid=17658 comm="syz.4.2792" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 974.075780][ T5917] usb 7-1: USB disconnect, device number 5 [ 974.700352][ T5917] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 974.862304][ T5917] usb 7-1: config 0 has no interfaces? [ 974.868161][ T5917] usb 7-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 974.879229][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.924725][ T5917] usb 7-1: config 0 descriptor?? [ 976.278029][ T6945] usb 7-1: USB disconnect, device number 6 [ 976.462033][T17692] IPVS: sh: FWM 3 0x00000003 - no destination available [ 976.469754][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 978.043039][ T6945] IPVS: starting estimator thread 0... [ 978.290356][T17722] IPVS: using max 76 ests per chain, 182400 per kthread [ 978.399301][T17733] rdma_op ffff888029f0a9f0 conn xmit_rdma 0000000000000000 [ 978.873765][ T30] audit: type=1400 audit(1766624706.975:977): avc: denied { mount } for pid=17736 comm="syz.6.2808" name="/" dev="rpc_pipefs" ino=73124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 979.307605][T17741] ubi: mtd0 is already attached to ubi31 [ 979.863646][ T30] audit: type=1400 audit(1766624707.935:978): avc: denied { create } for pid=17748 comm="syz.4.2810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 983.057203][ T30] audit: type=1400 audit(1766624711.165:979): avc: denied { write } for pid=17771 comm="syz.4.2816" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 984.321089][T17789] autofs: Bad value for 'fd' [ 984.862272][T17805] rdma_op ffff888020bd49f0 conn xmit_rdma 0000000000000000 [ 987.394091][T17832] xt_CT: You must specify a L4 protocol and not use inversions on it [ 990.698632][ T30] audit: type=1400 audit(1766624718.805:980): avc: denied { connect } for pid=17853 comm="syz.2.2836" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 990.869243][ T30] audit: type=1400 audit(1766624718.895:981): avc: denied { accept } for pid=17853 comm="syz.2.2836" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 991.713726][T17876] autofs: Bad value for 'fd' [ 992.690808][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.697145][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.987739][T17910] FAULT_INJECTION: forcing a failure. [ 994.987739][T17910] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 995.044383][T17910] CPU: 0 UID: 0 PID: 17910 Comm: syz.5.2851 Tainted: G L syzkaller #0 PREEMPT(full) [ 995.044413][T17910] Tainted: [L]=SOFTLOCKUP [ 995.044420][T17910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 995.044430][T17910] Call Trace: [ 995.044436][T17910] [ 995.044443][T17910] dump_stack_lvl+0x16c/0x1f0 [ 995.044471][T17910] should_fail_ex+0x512/0x640 [ 995.044501][T17910] _copy_from_user+0x2e/0xd0 [ 995.044528][T17910] copy_msghdr_from_user+0x98/0x160 [ 995.044548][T17910] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 995.044572][T17910] ? __lock_acquire+0x436/0x2890 [ 995.044598][T17910] ___sys_recvmsg+0xdb/0x1a0 [ 995.044617][T17910] ? __pfx____sys_recvmsg+0x10/0x10 [ 995.044638][T17910] ? find_held_lock+0x2b/0x80 [ 995.044681][T17910] do_recvmmsg+0x2fe/0x750 [ 995.044703][T17910] ? __pfx_do_recvmmsg+0x10/0x10 [ 995.044722][T17910] ? find_held_lock+0x2b/0x80 [ 995.044748][T17910] ? try_to_wake_up+0xa5d/0x1860 [ 995.044785][T17910] ? kvm_sched_clock_read+0x11/0x20 [ 995.044806][T17910] ? sched_clock+0x38/0x60 [ 995.044822][T17910] ? sched_clock_cpu+0x6c/0x530 [ 995.044845][T17910] __x64_sys_recvmmsg+0x22a/0x280 [ 995.044872][T17910] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 995.044899][T17910] do_syscall_64+0xcd/0xf80 [ 995.044923][T17910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.044941][T17910] RIP: 0033:0x7f93dcd8f749 [ 995.044954][T17910] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 995.044972][T17910] RSP: 002b:00007f93ddb43038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 995.044989][T17910] RAX: ffffffffffffffda RBX: 00007f93dcfe6090 RCX: 00007f93dcd8f749 [ 995.045000][T17910] RDX: 000000000000005b RSI: 00002000000021c0 RDI: 0000000000000004 [ 995.045011][T17910] RBP: 00007f93ddb43090 R08: 0000000000000000 R09: 0000000000000000 [ 995.045020][T17910] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 995.045030][T17910] R13: 00007f93dcfe6128 R14: 00007f93dcfe6090 R15: 00007ffdd1616a08 [ 995.045053][T17910] [ 995.821517][T17922] ubi: mtd0 is already attached to ubi31 [ 996.059660][ T30] audit: type=1400 audit(1766624724.165:982): avc: denied { create } for pid=17919 comm="syz.4.2854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 997.295410][ T30] audit: type=1400 audit(1766624724.195:983): avc: denied { write } for pid=17919 comm="syz.4.2854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 997.726392][T17936] xt_CT: You must specify a L4 protocol and not use inversions on it [ 999.600345][ T5915] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1000.050335][ T5915] usb 5-1: Using ep0 maxpacket: 8 [ 1000.057682][ T5915] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1000.069931][ T5915] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1000.083352][ T5915] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1000.093395][ T5915] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1000.134783][ T5915] usbtmc 5-1:16.0: bulk endpoints not found [ 1001.173194][T17978] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1002.524529][T17637] usb 5-1: USB disconnect, device number 78 [ 1005.293560][T17980] IPVS: starting estimator thread 0... [ 1005.392160][T18013] IPVS: using max 45 ests per chain, 108000 per kthread [ 1005.654856][T17980] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1005.886139][T17980] usb 7-1: Using ep0 maxpacket: 16 [ 1006.016164][T17980] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1006.100377][T17980] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1006.144622][T17980] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1006.174870][T17980] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.210464][T17980] usb 7-1: Product: syz [ 1006.221991][T17980] usb 7-1: Manufacturer: syz [ 1006.240668][T17980] usb 7-1: SerialNumber: syz [ 1006.257730][T17980] usb 7-1: config 0 descriptor?? [ 1006.270993][T17980] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1006.307477][T17980] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1006.456367][ T5812] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1006.465318][ T5812] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1006.474571][ T5812] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1006.482304][ T5812] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1006.490386][ T5812] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1006.674840][T18036] lo speed is unknown, defaulting to 1000 [ 1006.942289][T17980] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1006.951555][T17980] em28xx 7-1:0.0: Config register raw data: 0xde [ 1006.958266][T18036] chnl_net:caif_netlink_parms(): no params data found [ 1007.149683][T18019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1007.281340][T18019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1007.436826][T18036] bridge0: port 1(bridge_slave_0) entered blocking state [ 1007.450436][T18036] bridge0: port 1(bridge_slave_0) entered disabled state [ 1007.468814][T18036] bridge_slave_0: entered allmulticast mode [ 1007.469020][T17980] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 1007.476386][T18036] bridge_slave_0: entered promiscuous mode [ 1007.518314][T17980] em28xx 7-1:0.0: No AC97 audio processor [ 1007.529076][T18036] bridge0: port 2(bridge_slave_1) entered blocking state [ 1007.552001][T18036] bridge0: port 2(bridge_slave_1) entered disabled state [ 1007.579772][T17980] usb 7-1: USB disconnect, device number 7 [ 1007.660728][T18036] bridge_slave_1: entered allmulticast mode [ 1007.668480][T18036] bridge_slave_1: entered promiscuous mode [ 1007.716062][T17980] em28xx 7-1:0.0: Disconnecting em28xx [ 1007.726088][T17980] em28xx 7-1:0.0: Freeing device [ 1008.668087][ T52] Bluetooth: hci3: command tx timeout [ 1008.732450][T18036] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1008.763820][T18036] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1008.831861][T18036] team0: Port device team_slave_0 added [ 1008.863743][T18036] team0: Port device team_slave_1 added [ 1009.485295][T18036] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1009.600995][T18036] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1010.183801][T18075] rdma_op ffff88803483d9f0 conn xmit_rdma 0000000000000000 [ 1010.278483][T18036] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1010.552157][T18036] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1010.584757][T18036] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1010.655683][T18036] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1010.720632][ T52] Bluetooth: hci3: command tx timeout [ 1010.806335][T18088] hub 8-0:1.0: USB hub found [ 1010.811673][T18088] hub 8-0:1.0: 1 port detected [ 1011.393046][T18036] hsr_slave_0: entered promiscuous mode [ 1011.402410][T18036] hsr_slave_1: entered promiscuous mode [ 1011.414057][T18036] debugfs: 'hsr0' already exists in 'hsr' [ 1011.420973][T18036] Cannot create hsr debugfs directory [ 1011.615367][T18094] FAULT_INJECTION: forcing a failure. [ 1011.615367][T18094] name failslab, interval 1, probability 0, space 0, times 0 [ 1011.640464][T18094] CPU: 0 UID: 0 PID: 18094 Comm: syz.6.2896 Tainted: G L syzkaller #0 PREEMPT(full) [ 1011.640492][T18094] Tainted: [L]=SOFTLOCKUP [ 1011.640497][T18094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1011.640505][T18094] Call Trace: [ 1011.640511][T18094] [ 1011.640517][T18094] dump_stack_lvl+0x16c/0x1f0 [ 1011.640544][T18094] should_fail_ex+0x512/0x640 [ 1011.640570][T18094] ? __kmalloc_cache_noprof+0x5f/0x800 [ 1011.640603][T18094] should_failslab+0xc2/0x120 [ 1011.640626][T18094] __kmalloc_cache_noprof+0x80/0x800 [ 1011.640653][T18094] ? percpu_ref_init+0xec/0x410 [ 1011.640677][T18094] ? percpu_ref_init+0xec/0x410 [ 1011.640694][T18094] ? __pfx_io_ring_ctx_ref_free+0x10/0x10 [ 1011.640714][T18094] percpu_ref_init+0xec/0x410 [ 1011.640736][T18094] io_uring_setup+0x3e9/0x1ff0 [ 1011.640757][T18094] ? __pfx_io_uring_setup+0x10/0x10 [ 1011.640776][T18094] ? avc_has_perm_noaudit+0x117/0x3b0 [ 1011.640828][T18094] ? ksys_write+0x1ac/0x250 [ 1011.640851][T18094] ? __pfx_ksys_write+0x10/0x10 [ 1011.640876][T18094] __x64_sys_io_uring_setup+0xc2/0x170 [ 1011.640895][T18094] do_syscall_64+0xcd/0xf80 [ 1011.640919][T18094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.640936][T18094] RIP: 0033:0x7f7695b8f749 [ 1011.640950][T18094] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1011.640966][T18094] RSP: 002b:00007f769697cfc8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1011.640983][T18094] RAX: ffffffffffffffda RBX: 00007f7695de5fa0 RCX: 00007f7695b8f749 [ 1011.640995][T18094] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000003c5f [ 1011.641005][T18094] RBP: 0000200000000240 R08: 0000000000000000 R09: 0000000000000000 [ 1011.641015][T18094] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 1011.641024][T18094] R13: 0000000000000000 R14: 0000000000003c5f R15: 0000000000000000 [ 1011.641047][T18094] [ 1012.564734][T18036] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.578192][T18036] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.686893][T18036] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.697935][T18036] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.800578][ T52] Bluetooth: hci3: command tx timeout [ 1012.884106][T18036] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.894869][T18036] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.436630][T18036] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1013.457336][T18036] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.884438][T18036] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1013.922188][T18036] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1013.967344][T18036] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1013.996543][T18036] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1014.097234][T18119] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1014.105149][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1014.686255][T18036] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1014.709001][T18118] ubi: mtd0 is already attached to ubi31 [ 1014.811677][T18138] hub 8-0:1.0: USB hub found [ 1014.817055][T18138] hub 8-0:1.0: 1 port detected [ 1014.880397][ T52] Bluetooth: hci3: command tx timeout [ 1015.278724][T18036] 8021q: adding VLAN 0 to HW filter on device team0 [ 1015.381802][ T499] bridge0: port 1(bridge_slave_0) entered blocking state [ 1015.388905][ T499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1015.445253][ T499] bridge0: port 2(bridge_slave_1) entered blocking state [ 1015.452368][ T499] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1016.216973][T18153] ubi: mtd0 is already attached to ubi31 [ 1016.709516][T18036] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1016.756665][T18036] veth0_vlan: entered promiscuous mode [ 1016.878461][T18036] veth1_vlan: entered promiscuous mode [ 1017.045330][T18036] veth0_macvtap: entered promiscuous mode [ 1017.053834][T18036] veth1_macvtap: entered promiscuous mode [ 1017.125365][T18036] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1017.147682][T18036] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1017.172185][ T6246] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1017.187362][ T6246] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1017.208116][ T6246] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1017.226267][ T6246] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1017.300487][T17051] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1017.357687][T11403] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1017.376789][T11403] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1017.435110][T11403] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1017.449904][T11403] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1017.462354][T17051] usb 7-1: config 0 has no interfaces? [ 1017.473971][T17051] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1017.486332][T17051] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1017.495672][T17051] usb 7-1: Product: syz [ 1017.500699][T17051] usb 7-1: Manufacturer: syz [ 1017.505958][T17051] usb 7-1: SerialNumber: syz [ 1017.516586][T17051] usb 7-1: config 0 descriptor?? [ 1017.786113][ T30] audit: type=1400 audit(1766624745.895:984): avc: denied { watch watch_reads } for pid=18169 comm="syz.6.2913" path="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 1017.828491][T15730] usb 7-1: USB disconnect, device number 8 [ 1017.901242][ T5917] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 1018.051031][ T5917] usb 3-1: Using ep0 maxpacket: 8 [ 1018.063871][ T5917] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1018.077215][ T5917] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1018.141546][ T5917] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1018.167418][ T5917] usb 3-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1018.188830][ T5917] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1018.199024][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.213797][ T5917] usbtmc 3-1:16.0: bulk endpoints not found [ 1018.668008][T18188] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1018.708092][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1019.670531][T13278] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 1019.850641][T13278] usb 7-1: not running at top speed; connect to a high speed hub [ 1019.897475][T13278] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1020.008361][T13278] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 1020.038083][T13278] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1020.048958][T13278] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1020.061476][T13278] usb 7-1: Product: syz [ 1020.065648][T13278] usb 7-1: Manufacturer: 哋鳫偉淑૑຾킓䤁﫠祘㙄 [ 1020.092616][T13278] usb 7-1: SerialNumber: syz [ 1020.108671][T18211] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1020.362719][T18211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.384347][T18211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.469202][T18211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.502712][T18211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.575935][T18211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.607963][T18211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.632693][T18211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.712138][T18211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.736706][T17980] usb 3-1: USB disconnect, device number 74 [ 1021.279880][T13278] cdc_ncm 7-1:1.0: bind() failure [ 1021.308209][T13278] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 1021.317607][T13278] cdc_ncm 7-1:1.1: bind() failure [ 1021.331691][T13278] usb 7-1: USB disconnect, device number 9 [ 1021.921323][T17980] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1022.192913][T17980] usb 5-1: New USB device found, idVendor=046d, idProduct=08b7, bcdDevice=ca.8e [ 1022.205888][T17980] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1022.237456][T17980] pwc: Logitech ViewPort AV 100 webcam detected. [ 1022.640192][T17980] pwc: send_video_command error -71 [ 1022.656245][T17980] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1022.676688][T17980] Philips webcam 5-1:127.0: probe with driver Philips webcam failed with error -71 [ 1022.699441][T17980] usb 5-1: USB disconnect, device number 79 [ 1025.090412][ T5917] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1025.436754][ T5917] usb 7-1: Using ep0 maxpacket: 8 [ 1025.449738][ T5917] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1025.461343][ T5917] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1025.476935][ T5917] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1025.488307][ T5917] usb 7-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1025.508768][ T5917] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1025.527425][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1025.563979][ T5917] usbtmc 7-1:16.0: bulk endpoints not found [ 1027.830349][T13278] usb 7-1: USB disconnect, device number 10 [ 1028.970397][ T52] Bluetooth: hci5: ISO packet for unknown connection handle 48 [ 1029.955415][ T30] audit: type=1400 audit(1766624758.065:985): avc: denied { unmount } for pid=16932 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1030.123021][T18324] comedi comedi3: Cannot bond this driver to itself! [ 1030.654520][T18332] ubi: mtd0 is already attached to ubi31 [ 1031.814213][ T5930] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1032.030509][ T5930] usb 5-1: Using ep0 maxpacket: 16 [ 1032.059858][ T5930] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1032.070480][ T5930] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1032.080097][ T5930] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1032.124065][ T5930] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.148398][ T5930] usb 5-1: config 0 descriptor?? [ 1032.714775][ T30] audit: type=1400 audit(1766624760.825:986): avc: denied { shutdown } for pid=18347 comm="syz.4.2964" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1032.737814][T18348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1032.747208][T18348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1032.758018][T18348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1032.766576][T18348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1034.214596][T18380] ubi: mtd0 is already attached to ubi31 [ 1034.575113][T13278] usb 5-1: USB disconnect, device number 80 [ 1034.721727][T16934] Bluetooth: hci3: command 0x0405 tx timeout [ 1035.144691][T18397] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2976'. [ 1035.600668][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 1036.095632][T18412] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1037.050664][ T30] audit: type=1400 audit(1766624765.165:987): avc: denied { shutdown } for pid=18409 comm="syz.5.2982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1037.458830][T18427] ubi: mtd0 is already attached to ubi31 [ 1038.471685][T18444] 9p: Bad value for 'rfdno' [ 1038.986416][T18455] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2048 sclass=netlink_route_socket pid=18455 comm=syz.4.2989 [ 1039.070360][T17980] IPVS: starting estimator thread 0... [ 1039.189866][T18456] IPVS: using max 51 ests per chain, 122400 per kthread [ 1039.344903][T18460] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2990'. [ 1039.354987][T18460] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2990'. [ 1040.183450][T18475] lo: entered promiscuous mode [ 1040.208220][ T30] audit: type=1400 audit(1766624768.315:988): avc: denied { create } for pid=18473 comm="syz.5.2994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1040.454886][T18478] fuse: Bad value for 'group_id' [ 1040.459884][T18478] fuse: Bad value for 'group_id' [ 1040.901412][ T43] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 1041.091449][ T43] usb 5-1: device descriptor read/64, error -71 [ 1041.413442][ T43] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 1041.661330][T14675] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 1041.893161][T14675] usb 3-1: config 0 has no interfaces? [ 1041.898672][T14675] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1041.950409][T14675] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1041.994382][T14675] usb 3-1: config 0 descriptor?? [ 1042.182829][T18498] FAULT_INJECTION: forcing a failure. [ 1042.182829][T18498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1042.249663][T18498] CPU: 0 UID: 0 PID: 18498 Comm: syz.5.3002 Tainted: G L syzkaller #0 PREEMPT(full) [ 1042.249690][T18498] Tainted: [L]=SOFTLOCKUP [ 1042.249695][T18498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1042.249705][T18498] Call Trace: [ 1042.249711][T18498] [ 1042.249718][T18498] dump_stack_lvl+0x16c/0x1f0 [ 1042.249747][T18498] should_fail_ex+0x512/0x640 [ 1042.249775][T18498] _copy_from_user+0x2e/0xd0 [ 1042.249799][T18498] binder_ioctl+0x5df/0x7360 [ 1042.249829][T18498] ? tomoyo_path_number_perm+0x18d/0x580 [ 1042.249856][T18498] ? __pfx_binder_ioctl+0x10/0x10 [ 1042.249879][T18498] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1042.249906][T18498] ? do_vfs_ioctl+0x128/0x14f0 [ 1042.249927][T18498] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1042.249947][T18498] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1042.249978][T18498] ? hook_file_ioctl_common+0x144/0x410 [ 1042.250011][T18498] ? selinux_file_ioctl+0x180/0x270 [ 1042.250031][T18498] ? selinux_file_ioctl+0xb4/0x270 [ 1042.250054][T18498] ? __pfx_binder_ioctl+0x10/0x10 [ 1042.250076][T18498] __x64_sys_ioctl+0x18e/0x210 [ 1042.250099][T18498] do_syscall_64+0xcd/0xf80 [ 1042.250122][T18498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1042.250140][T18498] RIP: 0033:0x7f93dcd8f749 [ 1042.250153][T18498] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1042.250170][T18498] RSP: 002b:00007f93ddb64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1042.250187][T18498] RAX: ffffffffffffffda RBX: 00007f93dcfe5fa0 RCX: 00007f93dcd8f749 [ 1042.250199][T18498] RDX: 0000200000000080 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1042.250210][T18498] RBP: 00007f93ddb64090 R08: 0000000000000000 R09: 0000000000000000 [ 1042.250221][T18498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1042.250234][T18498] R13: 00007f93dcfe6038 R14: 00007f93dcfe5fa0 R15: 00007ffdd1616a08 [ 1042.250258][T18498] [ 1042.337567][T18499] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 1042.710274][T18498] binder: 18497:18498 ioctl c0306201 200000000080 returned -14 [ 1042.929012][T17051] usb 3-1: USB disconnect, device number 75 [ 1044.043502][T18510] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1046.770534][T18522] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1050.311519][T18556] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1052.470494][ T5922] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1053.162269][ T5922] usb 3-1: config 0 has no interfaces? [ 1053.240352][ T5922] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1053.276422][ T5922] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1053.799442][ T5922] usb 3-1: config 0 descriptor?? [ 1053.808622][ T5922] usb 3-1: can't set config #0, error -71 [ 1053.816779][ T5922] usb 3-1: USB disconnect, device number 76 [ 1053.956953][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1053.966834][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.160327][T17980] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1055.310519][T18601] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 1055.370335][T17980] usb 7-1: Using ep0 maxpacket: 16 [ 1055.376891][T17980] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1055.388615][T17980] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1055.410779][T17980] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1055.426390][T17980] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1055.440478][T17980] usb 7-1: Product: syz [ 1055.448126][T17980] usb 7-1: Manufacturer: syz [ 1055.455667][T17980] usb 7-1: SerialNumber: syz [ 1055.477605][T17980] usb 7-1: config 0 descriptor?? [ 1055.493273][T17980] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1055.516464][T17980] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1055.751672][T18608] hub 8-0:1.0: USB hub found [ 1055.757055][T18608] hub 8-0:1.0: 1 port detected [ 1056.108931][T17980] em28xx 7-1:0.0: unknown em28xx chip ID (45) [ 1056.309950][T17980] em28xx 7-1:0.0: Config register raw data: 0xde [ 1056.519440][T18590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1056.541968][T18590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1056.557512][T17980] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 1056.593929][T17980] em28xx 7-1:0.0: No AC97 audio processor [ 1057.070611][T17980] usb 7-1: USB disconnect, device number 11 [ 1057.077526][T17980] em28xx 7-1:0.0: Disconnecting em28xx [ 1057.142671][T17980] em28xx 7-1:0.0: Freeing device [ 1057.216503][T18615] ubi: mtd0 is already attached to ubi31 [ 1060.176132][T18650] binder: 18649:18650 ioctl c0306201 200000000080 returned -14 [ 1060.756693][T18660] hub 8-0:1.0: USB hub found [ 1060.762110][T18660] hub 8-0:1.0: 1 port detected [ 1062.877292][T18686] No control pipe specified [ 1063.459016][T18701] hub 8-0:1.0: USB hub found [ 1063.470483][T18701] hub 8-0:1.0: 1 port detected [ 1067.472987][T18751] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1071.121537][T18778] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1071.129040][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1071.961861][T18798] ubi: mtd0 is already attached to ubi31 [ 1073.393065][T18821] hub 8-0:1.0: USB hub found [ 1073.399067][T18821] hub 8-0:1.0: 1 port detected [ 1074.457331][T18832] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.3087'. [ 1075.294905][T18847] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1075.354470][T18847] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1080.161640][T18895] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1081.520367][T18901] ubi: mtd0 is already attached to ubi31 [ 1082.930474][ T43] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 1083.080587][ T43] usb 3-1: device descriptor read/64, error -71 [ 1083.350426][ T43] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1083.690671][ T43] usb 3-1: device descriptor read/64, error -71 [ 1083.798147][T18937] ubi: mtd0 is already attached to ubi31 [ 1083.812370][ T43] usb usb3-port1: attempt power cycle [ 1084.350434][ T43] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1084.387928][ T43] usb 3-1: device descriptor read/8, error -71 [ 1084.661022][ T43] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1084.701183][ T43] usb 3-1: device descriptor read/8, error -71 [ 1084.814391][ T43] usb usb3-port1: unable to enumerate USB device [ 1084.970385][ T43] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 1086.130716][ T43] usb 7-1: Using ep0 maxpacket: 32 [ 1086.138226][ T43] usb 7-1: too many configurations: 33, using maximum allowed: 8 [ 1086.175719][ T43] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1086.185303][ T43] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1086.556822][ T43] usb 7-1: config 0 descriptor?? [ 1086.720514][ T52] Bluetooth: hci6: command 0x0406 tx timeout [ 1086.729135][ T43] gspca_main: 055f:d001 too many config [ 1087.223134][ T5915] usb 7-1: USB disconnect, device number 12 [ 1089.401447][T18997] ubi: mtd0 is already attached to ubi31 [ 1090.892488][T19011] 9pnet_fd: Insufficient options for proto=fd [ 1093.232031][T19050] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1093.239960][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1094.612942][T19073] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1096.728428][T19088] vcan0: tx drop: invalid da for name 0x0000000007000000 [ 1097.130322][ T5917] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1097.291984][ T5917] usb 3-1: config 0 has no interfaces? [ 1097.304219][ T5917] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1097.400102][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1098.043214][ T5917] usb 3-1: config 0 descriptor?? [ 1098.912695][T18965] usb 3-1: USB disconnect, device number 81 [ 1101.476728][T19123] autofs: Bad value for 'fd' [ 1104.884869][ T5917] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1105.045229][T19163] ubi: mtd0 is already attached to ubi31 [ 1105.226139][ T5917] usb 3-1: config 0 has no interfaces? [ 1105.232708][ T5917] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1105.250450][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.278762][ T5917] usb 3-1: config 0 descriptor?? [ 1105.976565][T18965] usb 3-1: USB disconnect, device number 82 [ 1107.590775][T19184] netlink: 87 bytes leftover after parsing attributes in process `syz.4.3189'. [ 1108.002011][T19190] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1109.105486][T19193] autofs: Bad value for 'fd' [ 1110.580590][T19208] ubi: mtd0 is already attached to ubi31 [ 1111.085453][T19212] autofs: Bad value for 'fd' [ 1111.513046][T19219] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3199'. [ 1112.581405][T18965] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1113.010324][T18965] usb 5-1: Using ep0 maxpacket: 8 [ 1113.040809][T18965] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1113.503523][T18965] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1113.513747][T18965] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1113.524592][T18965] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1113.546926][T18965] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1113.566452][T18965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1113.950355][T18965] usb 5-1: usb_control_msg returned -32 [ 1113.956973][T18965] usbtmc 5-1:16.0: can't read capabilities [ 1113.983690][T18965] usb 5-1: USB disconnect, device number 83 [ 1114.350322][ T5930] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1114.500288][ T5930] usb 7-1: Using ep0 maxpacket: 16 [ 1114.511609][ T5930] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1114.522863][ T5930] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1114.553092][ T5930] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1114.567994][ T5930] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1114.586985][ T5930] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.627757][ T5930] usb 7-1: config 0 descriptor?? [ 1115.221797][ T5930] shield 0003:0955:7214.0008: unexpected long global item [ 1115.241744][ T5930] shield 0003:0955:7214.0008: Parse failed [ 1115.256667][ T5930] shield 0003:0955:7214.0008: probe with driver shield failed with error -22 [ 1115.335399][T19262] ubi: mtd0 is already attached to ubi31 [ 1115.350138][T19246] dlm: no locking on control device [ 1115.376190][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.384249][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.401769][ T5930] usb 7-1: USB disconnect, device number 13 [ 1117.633729][T19289] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3220'. [ 1117.670547][T19289] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3220'. [ 1118.216552][T19305] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.3221'. [ 1121.370510][T19356] ubi: mtd0 is already attached to ubi31 [ 1121.657972][T19340] SELinux: ebitmap: truncated map [ 1121.827077][T19340] SELinux: failed to load policy [ 1122.466246][ T43] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1122.863793][ T43] usb 5-1: config 0 has no interfaces? [ 1122.873189][ T43] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1122.888667][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.908085][ T43] usb 5-1: config 0 descriptor?? [ 1123.499172][ T43] usb 5-1: USB disconnect, device number 84 [ 1123.775982][T19381] autofs: Bad value for 'fd' [ 1124.356105][T19394] 9p: Bad value for 'wfdno' [ 1124.545224][ T30] audit: type=1400 audit(1766624852.655:989): avc: denied { create } for pid=19402 comm="syz.2.3242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1124.573016][T19403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3242'. [ 1124.592075][T19405] autofs: Bad value for 'fd' [ 1124.940721][T19416] ubi: mtd0 is already attached to ubi31 [ 1125.409252][T19430] ubi: mtd0 is already attached to ubi31 [ 1126.037807][T19432] autofs: Bad value for 'fd' [ 1128.705627][T19476] SELinux: ebitmap: truncated map [ 1128.804302][T19476] SELinux: failed to load policy [ 1131.313801][T19514] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1132.801352][ T5812] Bluetooth: hci3: command 0x0405 tx timeout [ 1133.550294][T18965] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 1133.834348][T18965] usb 7-1: config 0 has no interfaces? [ 1133.977131][T18965] usb 7-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1134.130802][T18965] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.140682][T17621] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1134.201083][T18965] usb 7-1: config 0 descriptor?? [ 1134.331064][T17621] usb 5-1: Using ep0 maxpacket: 32 [ 1134.356778][T17621] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1134.494843][T17621] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.807848][T17621] usb 5-1: config 0 descriptor?? [ 1134.843012][T18413] usb 7-1: USB disconnect, device number 14 [ 1135.145591][T17621] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1135.160614][T17621] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1135.704142][T17621] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1135.731250][T17621] usb 5-1: media controller created [ 1135.778038][T17621] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1136.611965][T17621] az6027: usb out operation failed. (-71) [ 1136.623390][T17621] az6027: usb out operation failed. (-71) [ 1136.634405][T17621] stb0899_attach: Driver disabled by Kconfig [ 1136.645750][T17621] az6027: no front-end attached [ 1136.645750][T17621] [ 1136.653495][T17621] az6027: usb out operation failed. (-71) [ 1136.659479][T17621] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1136.669986][T17621] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input19 [ 1136.683202][T17621] dvb-usb: schedule remote query interval to 400 msecs. [ 1136.708065][T17621] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1136.734249][T17621] usb 5-1: USB disconnect, device number 85 [ 1136.785117][T17621] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1137.519997][T19573] vlan2: entered promiscuous mode [ 1137.525192][T19573] bridge0: entered promiscuous mode [ 1138.056229][T19581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3288'. [ 1138.095765][T19581] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3288'. [ 1141.777230][T19633] ubi: mtd0 is already attached to ubi31 [ 1141.868963][T19634] ubi: mtd0 is already attached to ubi31 [ 1142.590363][T18965] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1143.030450][T18965] usb 3-1: Using ep0 maxpacket: 32 [ 1143.066714][T18965] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1143.105692][T18965] usb 3-1: config 0 has no interface number 0 [ 1143.134426][T18965] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1143.157905][T18965] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1143.182782][T18965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1143.203479][T18965] usb 3-1: Product: syz [ 1143.211672][T18965] usb 3-1: Manufacturer: syz [ 1143.222930][T18965] usb 3-1: SerialNumber: syz [ 1143.237883][T18965] usb 3-1: config 0 descriptor?? [ 1143.253762][T18965] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1143.279760][T18965] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1143.682209][T17621] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1143.899946][T19642] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3308'. [ 1143.911441][T17621] usb 7-1: config 0 has no interfaces? [ 1143.919032][T17621] usb 7-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1143.928499][T18965] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1143.939147][T17621] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1143.950784][T17621] usb 7-1: config 0 descriptor?? [ 1144.745034][ T5917] usb 7-1: USB disconnect, device number 15 [ 1144.886290][T19674] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1144.895464][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1145.032023][T18965] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1145.049576][T18965] em28xx 3-1:0.89: board has no eeprom [ 1145.328664][T18965] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1145.336981][T18965] em28xx 3-1:0.89: analog set to bulk mode. [ 1145.343676][ T5922] em28xx 3-1:0.89: Registering V4L2 extension [ 1145.359904][T18965] usb 3-1: USB disconnect, device number 83 [ 1145.372076][T18965] em28xx 3-1:0.89: Disconnecting em28xx [ 1145.407298][ T5922] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1145.420295][ T5922] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1145.427891][ T5922] em28xx 3-1:0.89: No AC97 audio processor [ 1145.445342][ T5922] usb 3-1: Decoder not found [ 1145.450542][ T5922] em28xx 3-1:0.89: failed to create media graph [ 1145.457004][ T5922] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1145.471563][ T5922] em28xx 3-1:0.89: Registering snapshot button... [ 1145.483177][ T5922] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input20 [ 1145.500804][ T5922] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1145.512038][T18965] em28xx 3-1:0.89: Closing input extension [ 1145.519870][T18965] em28xx 3-1:0.89: Deregistering snapshot button [ 1147.776508][T18965] em28xx 3-1:0.89: Freeing device [ 1149.460835][T19726] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1150.276964][T19747] gre1: entered promiscuous mode [ 1150.296903][T19747] gre1: entered allmulticast mode [ 1150.808849][T19696] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1151.571227][T19696] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1151.589521][T19696] usb 3-1: New USB device found, idVendor=04f2, idProduct=1123, bcdDevice= 0.00 [ 1151.611689][T19696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1151.635714][T19696] usb 3-1: config 0 descriptor?? [ 1152.315652][T19696] chicony 0003:04F2:1123.0009: item fetching failed at offset 1/3 [ 1152.339054][T19696] chicony 0003:04F2:1123.0009: Chicony hid parse failed: -22 [ 1152.350294][T19696] chicony 0003:04F2:1123.0009: probe with driver chicony failed with error -22 [ 1152.554740][ T43] usb 3-1: USB disconnect, device number 84 [ 1152.587229][T19771] FAULT_INJECTION: forcing a failure. [ 1152.587229][T19771] name failslab, interval 1, probability 0, space 0, times 0 [ 1152.623014][T19771] CPU: 1 UID: 0 PID: 19771 Comm: syz.4.3340 Tainted: G L syzkaller #0 PREEMPT(full) [ 1152.623036][T19771] Tainted: [L]=SOFTLOCKUP [ 1152.623040][T19771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1152.623046][T19771] Call Trace: [ 1152.623050][T19771] [ 1152.623055][T19771] dump_stack_lvl+0x16c/0x1f0 [ 1152.623074][T19771] should_fail_ex+0x512/0x640 [ 1152.623091][T19771] ? fs_reclaim_acquire+0xae/0x150 [ 1152.623109][T19771] should_failslab+0xc2/0x120 [ 1152.623124][T19771] __kmalloc_noprof+0xeb/0x910 [ 1152.623142][T19771] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1152.623161][T19771] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1152.623175][T19771] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1152.623192][T19771] ? tomoyo_profile+0x47/0x60 [ 1152.623210][T19771] tomoyo_path_number_perm+0x245/0x580 [ 1152.623223][T19771] ? tomoyo_path_number_perm+0x237/0x580 [ 1152.623237][T19771] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1152.623251][T19771] ? find_held_lock+0x2b/0x80 [ 1152.623280][T19771] ? find_held_lock+0x2b/0x80 [ 1152.623301][T19771] ? hook_file_ioctl_common+0x144/0x410 [ 1152.623321][T19771] ? __fget_files+0x20e/0x3c0 [ 1152.623340][T19771] security_file_ioctl+0x9b/0x240 [ 1152.623356][T19771] __x64_sys_ioctl+0xb7/0x210 [ 1152.623370][T19771] do_syscall_64+0xcd/0xf80 [ 1152.623386][T19771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.623398][T19771] RIP: 0033:0x7f03e5d8f749 [ 1152.623408][T19771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1152.623419][T19771] RSP: 002b:00007f03e6bc1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1152.623429][T19771] RAX: ffffffffffffffda RBX: 00007f03e5fe5fa0 RCX: 00007f03e5d8f749 [ 1152.623436][T19771] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 1152.623443][T19771] RBP: 00007f03e6bc1090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.623449][T19771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1152.623455][T19771] R13: 00007f03e5fe6038 R14: 00007f03e5fe5fa0 R15: 00007ffde235a578 [ 1152.623469][T19771] [ 1152.623474][T19771] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1152.970612][T19696] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1153.186872][T19696] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1153.213596][T19696] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 1153.260281][T19696] usb 7-1: can't read configurations, error -71 [ 1154.076931][T19795] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3347'. [ 1154.537859][T19800] SELinux: policydb magic number 0x6 does not match expected magic number 0xf97cff8c [ 1154.549811][T19800] SELinux: failed to load policy [ 1154.967579][T19806] input: syz0 as /devices/virtual/input/input21 [ 1156.200284][T18965] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1156.401747][T18965] usb 3-1: Using ep0 maxpacket: 16 [ 1156.442219][T18965] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1156.460484][T18965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1156.481326][T18965] usb 3-1: Product: syz [ 1156.494411][T18965] usb 3-1: Manufacturer: syz [ 1156.512587][T18965] usb 3-1: SerialNumber: syz [ 1156.569351][T18965] usb 3-1: config 0 descriptor?? [ 1156.719529][T18965] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 1157.229025][T18965] usb 3-1: clie_3_5_startup: get config number bad return length: 0 [ 1157.246185][T18965] visor 3-1:0.0: probe with driver visor failed with error -5 [ 1157.864191][ T30] audit: type=1400 audit(1766624885.975:990): avc: denied { append } for pid=19820 comm="syz.4.3354" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1157.888220][T19826] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3354'. [ 1159.002310][T14675] usb 3-1: USB disconnect, device number 85 [ 1159.644068][T19846] autofs: Bad value for 'fd' [ 1162.126557][T19870] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3367'. [ 1165.410661][T19898] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3376'. [ 1166.205627][T19913] autofs: Bad value for 'fd' [ 1167.685078][T19929] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1168.098938][T19932] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1169.505230][T19950] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3381'. [ 1169.677419][T19951] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3381'. [ 1169.686441][T19951] netlink: 15 bytes leftover after parsing attributes in process `syz.5.3381'. [ 1169.699777][T19952] SELinux: failed to load policy [ 1171.430773][T19969] syzkaller0: entered promiscuous mode [ 1171.436277][T19969] syzkaller0: entered allmulticast mode [ 1171.580327][ T5965] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 1171.731768][ T5965] usb 7-1: config 1 interface 0 altsetting 89 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 1171.742955][ T5965] usb 7-1: config 1 interface 0 has no altsetting 0 [ 1171.758021][ T5965] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1171.767367][ T5965] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.778999][ T5965] usb 7-1: Product: ᜂ䇶䉒밙鑢菾됉꙼옥笐氡䯞욟䱪헢ﺸ蚃銻졼씫嵐Ꞝ봅膋ᩚ怀쩾桖꺯連꾔穡壔܊곾郫旤鷈ᰶ⋣⫣偅素䉉ﶮꕶ錃給딿뾸⽲؜䙅ủ [ 1171.798052][ T5965] usb 7-1: Manufacturer: Х [ 1171.802702][ T5965] usb 7-1: SerialNumber: ⴅ姓윘膧촟뙫턴먍잞睿莴쫰铙퐠깛詼졧蛶祹ᶻܾर㘮ꉭⰘ蹐퉗쐉௬녱杰釲嚨⯿훐㈣셍돴齢ｉ䐽ᾗ㞝Ы풤ጼ϶邌䶑鋉뼈ጰ淜농â盗灶搜椁릳ㆎ웖賟瀭蟁 [ 1171.827993][T19967] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1172.005369][ T30] audit: type=1400 audit(1766624900.115:991): avc: denied { read write } for pid=19970 comm="syz.2.3394" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1172.011508][T19971] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3394'. [ 1172.030503][ T30] audit: type=1400 audit(1766624900.115:992): avc: denied { open } for pid=19970 comm="syz.2.3394" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1172.274837][ T30] audit: type=1400 audit(1766624900.385:993): avc: denied { ioctl } for pid=19966 comm="syz.6.3392" path="socket:[83931]" dev="sockfs" ino=83931 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1172.332560][ T30] audit: type=1400 audit(1766624900.435:994): avc: denied { connect } for pid=19966 comm="syz.6.3392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1172.714375][ T5965] cdc_ether 7-1:1.0: probe with driver cdc_ether failed with error -71 [ 1172.731743][ T5965] usb 7-1: USB disconnect, device number 18 [ 1173.361848][T19989] ubi: mtd0 is already attached to ubi31 [ 1173.602861][T19993] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1173.625895][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1176.390493][T18965] usb 5-1: new full-speed USB device number 86 using dummy_hcd [ 1176.749074][T18965] usb 5-1: config 8 has an invalid interface number: 80 but max is 0 [ 1176.758360][T18965] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1176.769014][T18965] usb 5-1: config 8 has no interface number 0 [ 1176.796090][T18965] usb 5-1: config 8 interface 80 altsetting 0 has an endpoint descriptor with address 0xE7, changing to 0x87 [ 1176.810774][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1176.817113][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1176.938169][T18965] usb 5-1: config 8 interface 80 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1176.960005][T18965] usb 5-1: config 8 interface 80 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1176.997520][T18965] usb 5-1: config 8 interface 80 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 14 [ 1177.480401][T18965] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=c1.6f [ 1177.500917][T18965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1177.544447][T18965] usb 5-1: NFC: intf ffff888066ba3000 id ffffffff8f325140 [ 1177.620406][T18965] nfcmrvl 5-1:8.80: NFC: registered with nci successfully [ 1178.316494][T18413] usb 5-1: USB disconnect, device number 86 [ 1178.324334][T18413] usb 5-1: NFC: intf ffff888066ba3000 [ 1178.879761][ T30] audit: type=1400 audit(1766624906.985:995): avc: denied { setopt } for pid=20072 comm="syz.4.3418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1179.239963][T20082] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.3420'. [ 1179.340639][T20090] netlink: 'syz.2.3423': attribute type 5 has an invalid length. [ 1179.390934][T20090] batman_adv: batadv0: Adding interface: vxlan0 [ 1179.409325][T20090] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1179.440333][T20090] batman_adv: batadv0: Interface activated: vxlan0 [ 1179.492302][ T1102] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1179.605775][ T1102] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1179.628550][ T1102] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1179.649899][ T1102] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1238.242354][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.248667][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1286.950162][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1286.957122][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5982/1:b..l [ 1286.965366][ C0] rcu: (detected by 0, t=10502 jiffies, g=102889, q=518 ncpus=2) [ 1286.973151][ C0] task:kworker/u8:16 state:R running task stack:22792 pid:5982 tgid:5982 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1286.987735][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 1286.993978][ C0] Call Trace: [ 1286.997232][ C0] [ 1287.000142][ C0] ? __schedule+0x10b9/0x6150 [ 1287.004807][ C0] __schedule+0x1139/0x6150 [ 1287.009304][ C0] ? __pfx___schedule+0x10/0x10 [ 1287.014132][ C0] ? mark_held_locks+0x49/0x80 [ 1287.018883][ C0] preempt_schedule_irq+0x51/0x90 [ 1287.023880][ C0] irqentry_exit+0x1d8/0x8c0 [ 1287.028715][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1287.034679][ C0] RIP: 0010:lock_release+0x8f/0x2d0 [ 1287.039855][ C0] Code: 01 00 00 65 4c 8b 35 08 bb 18 12 41 8b b6 2c 0b 00 00 85 f6 0f 85 ff 00 00 00 48 81 3b 00 86 b9 93 0f 84 f2 00 00 00 9c 41 5d 48 c7 c7 ad e5 bb 8d e8 34 2a de 09 65 ff 05 05 02 19 12 8b 0d [ 1287.059434][ C0] RSP: 0018:ffffc90003057408 EFLAGS: 00000206 [ 1287.065479][ C0] RAX: 0000000000000000 RBX: ffffffff8e3c96a0 RCX: ffffc90003058001 [ 1287.073422][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 1287.081375][ C0] RBP: 0000000000000001 R08: 0000000000000001 R09: 00000000d5c8f7f7 [ 1287.089318][ C0] R10: 0000000000000002 R11: 0000000000008490 R12: ffffffff816cb9a4 [ 1287.097258][ C0] R13: 0000000000000206 R14: ffff888034e524c0 R15: ffffc900030574f4 [ 1287.105223][ C0] ? unwind_next_frame+0x3f4/0x20b0 [ 1287.110411][ C0] unwind_next_frame+0x3f9/0x20b0 [ 1287.115407][ C0] ? worker_thread+0x6c8/0xf10 [ 1287.120143][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1287.126281][ C0] arch_stack_walk+0x94/0x100 [ 1287.130932][ C0] ? kthread+0x3c5/0x780 [ 1287.135149][ C0] stack_trace_save+0x8e/0xc0 [ 1287.139794][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1287.145136][ C0] ? __lock_acquire+0x436/0x2890 [ 1287.150059][ C0] kasan_save_stack+0x33/0x60 [ 1287.154706][ C0] ? kasan_save_stack+0x33/0x60 [ 1287.159541][ C0] ? kasan_save_track+0x14/0x30 [ 1287.164360][ C0] ? kasan_save_free_info+0x3b/0x60 [ 1287.169534][ C0] ? __kasan_slab_free+0x5f/0x80 [ 1287.174456][ C0] ? kfree+0x2f8/0x6e0 [ 1287.178494][ C0] ? ieee80211_ibss_rx_queued_mgmt+0x1ab4/0x2fc0 [ 1287.184808][ C0] ? ieee80211_iface_work+0xe28/0x1350 [ 1287.190243][ C0] ? cfg80211_wiphy_work+0x3fb/0x560 [ 1287.195499][ C0] ? process_one_work+0x9ba/0x1b20 [ 1287.200581][ C0] ? worker_thread+0x6c8/0xf10 [ 1287.205334][ C0] kasan_save_track+0x14/0x30 [ 1287.209981][ C0] kasan_save_free_info+0x3b/0x60 [ 1287.214980][ C0] __kasan_slab_free+0x5f/0x80 [ 1287.219723][ C0] kfree+0x2f8/0x6e0 [ 1287.223589][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 1287.228759][ C0] ? ieee80211_ibss_rx_queued_mgmt+0x1ab4/0x2fc0 [ 1287.235063][ C0] ? ieee80211_ibss_rx_queued_mgmt+0x1ab4/0x2fc0 [ 1287.241366][ C0] ieee80211_ibss_rx_queued_mgmt+0x1ab4/0x2fc0 [ 1287.247501][ C0] ? __pfx_ieee80211_ibss_rx_queued_mgmt+0x10/0x10 [ 1287.253978][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.258711][ C0] ? trace_contention_end+0xdd/0x110 [ 1287.263976][ C0] ? kcov_remote_start+0x399/0x680 [ 1287.269061][ C0] ieee80211_iface_work+0xe28/0x1350 [ 1287.274318][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.279055][ C0] cfg80211_wiphy_work+0x3fb/0x560 [ 1287.284153][ C0] process_one_work+0x9ba/0x1b20 [ 1287.289071][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1287.294418][ C0] ? assign_work+0x1a0/0x250 [ 1287.298982][ C0] worker_thread+0x6c8/0xf10 [ 1287.303549][ C0] ? __kthread_parkme+0x19e/0x250 [ 1287.308545][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1287.313640][ C0] kthread+0x3c5/0x780 [ 1287.317681][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.322255][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.326990][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.331553][ C0] ret_from_fork+0x983/0xb10 [ 1287.336117][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1287.341206][ C0] ? __switch_to+0x7af/0x10d0 [ 1287.345879][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.350457][ C0] ret_from_fork_asm+0x1a/0x30 [ 1287.355220][ C0] [ 1287.358217][ C0] rcu: rcu_preempt kthread starved for 10494 jiffies! g102889 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 1287.369472][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1287.379424][ C0] rcu: RCU grace-period kthread stack dump: [ 1287.385287][ C0] task:rcu_preempt state:R running task stack:27480 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1287.398901][ C0] Call Trace: [ 1287.402153][ C0] [ 1287.405060][ C0] ? __schedule+0x10b9/0x6150 [ 1287.409709][ C0] __schedule+0x1139/0x6150 [ 1287.414191][ C0] ? __lock_acquire+0x436/0x2890 [ 1287.419103][ C0] ? __mod_timer+0x8f2/0xd30 [ 1287.423668][ C0] ? __pfx___schedule+0x10/0x10 [ 1287.428492][ C0] ? find_held_lock+0x2b/0x80 [ 1287.433152][ C0] ? schedule+0x2d7/0x3a0 [ 1287.437454][ C0] schedule+0xe7/0x3a0 [ 1287.441495][ C0] schedule_timeout+0x123/0x290 [ 1287.446314][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1287.451652][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1287.456911][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1287.462699][ C0] ? prepare_to_swait_event+0xf5/0x480 [ 1287.468130][ C0] rcu_gp_fqs_loop+0x1ea/0xaf0 [ 1287.472867][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1287.478132][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 1287.483040][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.487772][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1287.493554][ C0] rcu_gp_kthread+0x26d/0x380 [ 1287.498203][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1287.503376][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.508111][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 1287.513282][ C0] ? __kthread_parkme+0x19e/0x250 [ 1287.518286][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1287.523466][ C0] kthread+0x3c5/0x780 [ 1287.527519][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.532611][ C0] ? rcu_is_watching+0x12/0xc0 [ 1287.537355][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.541932][ C0] ret_from_fork+0x983/0xb10 [ 1287.546504][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1287.551588][ C0] ? __switch_to+0x7af/0x10d0 [ 1287.556237][ C0] ? __pfx_kthread+0x10/0x10 [ 1287.560796][ C0] ret_from_fork_asm+0x1a/0x30 [ 1287.565541][ C0] [ 1287.568529][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1287.574816][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1287.580014][ C1] NMI backtrace for cpu 1 [ 1287.580027][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1287.580047][ C1] Tainted: [L]=SOFTLOCKUP [ 1287.580052][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1287.580060][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1287.580079][ C1] Code: c6 5f 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 49 12 00 fb f4 cc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1287.580093][ C1] RSP: 0018:ffffc90000197de8 EFLAGS: 000002c6 [ 1287.580105][ C1] RAX: 000000000757ed97 RBX: 0000000000000001 RCX: ffffffff8b7816d9 [ 1287.580114][ C1] RDX: 0000000000000000 RSI: ffffffff8dacdf23 RDI: ffffffff8bf2b400 [ 1287.580123][ C1] RBP: ffffed1003b56498 R08: 0000000000000001 R09: ffffed10170a673d [ 1287.580132][ C1] R10: ffff8880b85339eb R11: ffff88801dab2ff0 R12: 0000000000000001 [ 1287.580140][ C1] R13: ffff88801dab24c0 R14: ffffffff9088b4d0 R15: 0000000000000000 [ 1287.580153][ C1] FS: 0000000000000000(0000) GS:ffff8881249f5000(0000) knlGS:0000000000000000 [ 1287.580168][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1287.580178][ C1] CR2: 00007f8fc2e616c8 CR3: 00000000368cf000 CR4: 00000000003526f0 [ 1287.580188][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000001800 [ 1287.580196][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1287.580205][ C1] Call Trace: [ 1287.580212][ C1] [ 1287.580217][ C1] default_idle+0x13/0x20 [ 1287.580236][ C1] default_idle_call+0x6c/0xb0 [ 1287.580254][ C1] do_idle+0x38d/0x510 [ 1287.580276][ C1] ? __pfx_do_idle+0x10/0x10 [ 1287.580295][ C1] ? do_idle+0x2e2/0x510 [ 1287.580316][ C1] cpu_startup_entry+0x4f/0x60 [ 1287.580335][ C1] start_secondary+0x21d/0x2d0 [ 1287.580348][ C1] ? __pfx_start_secondary+0x10/0x10 [ 1287.580364][ C1] common_startup_64+0x13e/0x148 [ 1287.580384][ C1]