last executing test programs: 2m7.249382767s ago: executing program 4 (id=115): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b595000000000000000002000000", @ANYRES32=r0, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r2, 0x421, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) gettimeofday(&(0x7f0000000200), &(0x7f00000002c0)) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r2, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_BSSID={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4004) futex(&(0x7f0000000240)=0x1, 0x85, 0x2, 0x0, 0x0, 0xfffffffc) ioctl$OCFS2_IOC_UNRESVSP(r1, 0x40305829, &(0x7f00000001c0)={0x0, 0x1, 0xa, 0x400, 0x5, 0x7fffffff}) 2m6.659235097s ago: executing program 4 (id=118): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x14, 0x0, 0x4, 0x301, 0x70bd29, 0x25dfdbfc, {0x2, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x8090) (fail_nth: 3) 2m6.436964937s ago: executing program 4 (id=119): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fsopen(&(0x7f0000000700)='affs\x00', 0x1) r4 = fcntl$dupfd(r3, 0x0, r3) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x18, 0x3f, 0x107, 0xfffffffe, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff), 0x0, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r6, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMO'], 0x86) r7 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r7, r6, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x3}, &(0x7f0000000180)=0xc) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) 2m5.447741841s ago: executing program 4 (id=123): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008004500004400000000002190337bf58400ffffffff050090780a0101026a0000000000000000000000ac1e0001ac14140107be00e0000002000000"], 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r7 = socket$netlink(0x10, 0x3, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x1, 0x3, 0x47, 0x100, 0x1, 0x3, 0x5}, 0x1c) r8 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r8, 0x28, 0x1, &(0x7f0000000100)=0xfffffffffffffffe, 0x112) socket(0x200000000000011, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) syz_clone3(&(0x7f0000000080)={0x204801600, &(0x7f00000001c0), 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r9}}, 0x58) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32, @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x44004}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x80) r10 = syz_open_dev$usbfs(0x0, 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r10, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) socketpair$unix(0x1, 0x2, 0x0, 0x0) 2m2.258068108s ago: executing program 4 (id=130): r0 = syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000102105a8b140000102030109021b000101000000090400ff020701010009050102"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000000c0)={0xffffff04, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1, 0x4}}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000000) fcntl$addseals(r1, 0x409, 0x5) write$char_usb(r1, 0x0, 0x1a) 1m58.717428912s ago: executing program 4 (id=142): r0 = syz_clone(0x2080, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$pokeuser(0x6, r0, 0x358, 0xffff8880a120a000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x27d, 0x2406c011) (async) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x27d, 0x2406c011) r2 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$unix(0x1, 0x2, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r3, &(0x7f00000000c0)=""/53, 0x35) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) write$dsp(r4, &(0x7f0000002000)='`', 0x88020) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000f0000003805000041000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000bee798c60006d5030e1c598daa170fc0970a6e5dcb545ae69de4852c30cc05c07af8b02c27ade207e9aa300b87e96d093ada8204ca446509b96f09e8dcce0eec2d27333db239cc62b749f3922908037105570a3e5c7dd72c0d4914f15743021b99f7151310eff7", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r6}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r6}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xb, 0x9, 0x1, 0xff, 0x7, 0x2, 0x6427, 0x7f}, &(0x7f00000001c0)={0x101, 0x8, 0x29a8cbd6, 0x3f, 0xe8, 0x0, 0x8, 0x10001}, &(0x7f0000000200)={0x0, 0xa, 0x6aa4, 0x464, 0x6, 0x0, 0x6, 0x100}, &(0x7f0000000240), &(0x7f0000000380)={&(0x7f0000000340)={[0x1]}, 0x8}) setrlimit(0x7, &(0x7f0000000640)) (async) setrlimit(0x7, &(0x7f0000000640)) ptrace$pokeuser(0x6, r0, 0x4, 0x4) (async) ptrace$pokeuser(0x6, r0, 0x4, 0x4) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) (async) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r7, 0x4068aea3, &(0x7f0000000100)) 1m42.319405666s ago: executing program 32 (id=142): r0 = syz_clone(0x2080, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$pokeuser(0x6, r0, 0x358, 0xffff8880a120a000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x27d, 0x2406c011) (async) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x27d, 0x2406c011) r2 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$unix(0x1, 0x2, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r3, &(0x7f00000000c0)=""/53, 0x35) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) write$dsp(r4, &(0x7f0000002000)='`', 0x88020) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000f0000003805000041000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000bee798c60006d5030e1c598daa170fc0970a6e5dcb545ae69de4852c30cc05c07af8b02c27ade207e9aa300b87e96d093ada8204ca446509b96f09e8dcce0eec2d27333db239cc62b749f3922908037105570a3e5c7dd72c0d4914f15743021b99f7151310eff7", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r6}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r6}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xb, 0x9, 0x1, 0xff, 0x7, 0x2, 0x6427, 0x7f}, &(0x7f00000001c0)={0x101, 0x8, 0x29a8cbd6, 0x3f, 0xe8, 0x0, 0x8, 0x10001}, &(0x7f0000000200)={0x0, 0xa, 0x6aa4, 0x464, 0x6, 0x0, 0x6, 0x100}, &(0x7f0000000240), &(0x7f0000000380)={&(0x7f0000000340)={[0x1]}, 0x8}) setrlimit(0x7, &(0x7f0000000640)) (async) setrlimit(0x7, &(0x7f0000000640)) ptrace$pokeuser(0x6, r0, 0x4, 0x4) (async) ptrace$pokeuser(0x6, r0, 0x4, 0x4) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) (async) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r7, 0x4068aea3, &(0x7f0000000100)) 21.193425251s ago: executing program 1 (id=418): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) timerfd_create(0x0, 0x80800) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c00)=@newtaction={0xe68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x7, 0x1, 0x10000000, 0x4, 0xaee}, 0x7, 0x7}, [{0x8, 0xfffff000, 0x2, 0x9, 0x1ff, 0xafe}, {0xe, 0x2, 0x1, 0x9, 0x4, 0xa}, {0x2, 0xfe73, 0x6, 0x8, 0x2, 0x10000}, {0x4320, 0x3bf6, 0x4, 0x8, 0xffffff9d, 0x4}, {0x6, 0x44, 0x3, 0x986, 0xffff6d72, 0xbf5}, {0x7ff, 0x8009ef, 0x1, 0x3, 0x9, 0x81}, {0x7f, 0x5752, 0x0, 0x9, 0x7}, {0x9, 0xf7b, 0xa004, 0x8, 0x5, 0x20000a17}, {0x7, 0x200, 0x1000, 0x80, 0x4, 0x1}, {0x7, 0x80000000, 0x40, 0x3, 0xfffffff2, 0x8}, {0x6, 0xfff, 0xe4af, 0x0, 0x8, 0x7}, {0x6, 0xd, 0x230, 0x400, 0x6971, 0xfff}, {0x6, 0x8, 0x6, 0x2, 0x4, 0x3}, {0x83, 0x3, 0x4, 0x7, 0x9, 0xaa7}, {0x5, 0x5, 0x4, 0x80, 0x0, 0x100}, {0x4, 0x8, 0x9, 0x1, 0x2, 0x9}, {0x2690, 0x7ff, 0x11, 0xd, 0x2, 0x722dadd0}, {0x4b, 0x5, 0x9, 0x9, 0x279, 0x3}, {0x7, 0x7b5a, 0x4, 0x0, 0xfffffffb, 0x80000000}, {0x2, 0x0, 0x6fbc79d2, 0x9, 0x401, 0x5}, {0x0, 0x527e, 0xc7, 0x4, 0x80, 0x7}, {0x4, 0xd, 0x5, 0xbd52, 0x80, 0xef35}, {0x9, 0xb, 0x4, 0xb904, 0xfffffff8, 0x1}, {0x3, 0x8, 0xd, 0x1d00, 0x5, 0x400}, {0x8000, 0x74dfe8ce, 0x956b, 0x4, 0x2, 0xfffffff4}, {0xf2, 0x1ee, 0x5, 0xfffffd14, 0x9, 0x40}, {0x0, 0xd, 0x9, 0x6, 0xffffffff, 0x1}, {0xfffff125, 0x1000, 0x1ff, 0xfffffffe, 0x3, 0x1}, {0x0, 0xfffffff9, 0x6, 0x3, 0x7fffffff, 0x20000002}, {0xec, 0x8, 0x8f1, 0xfffffffb, 0xa, 0x10000}, {0x6, 0x726, 0x6, 0x8, 0xfff, 0x9}, {0x0, 0x9, 0x3, 0x5, 0x3, 0x2}, {0x4, 0xffff, 0x5, 0xfffffffe, 0x7f, 0x6}, {0x400, 0xf, 0xcf, 0xc, 0x4022, 0x44}, {0x4, 0x4, 0x8, 0xfff, 0x6, 0x1}, {0xffff, 0x3, 0xb5, 0x433, 0x6, 0x6}, {0x10000, 0x0, 0x7, 0x9, 0x20, 0x4}, {0x4, 0x9, 0x3, 0xf90, 0xc, 0x3}, {0x5, 0x657a0ecc, 0x1, 0xa4, 0x4, 0x7}, {0x5, 0xe4, 0x2, 0x4, 0x8001, 0x2}, {0x2, 0xe4, 0x42, 0x2, 0x0, 0x9}, {0x3, 0xff, 0x6, 0x7, 0xd7d6, 0xfffffffb}, {0x42, 0x2, 0x6, 0x7, 0xae45, 0x5}, {0x6, 0x9c, 0x5, 0x80, 0x7fffdfff, 0x5}, {0x7, 0x3, 0x3, 0x7, 0x0, 0x4}, {0x7ff, 0x2, 0x8, 0x8, 0x9, 0x5}, {0x1, 0xb, 0xfffffffe, 0x800, 0x0, 0x1}, {0x8, 0x5, 0x3fd, 0x4, 0xffffffff, 0x7}, {0x4, 0x0, 0x6, 0x5, 0x9, 0x9}, {0x3, 0x80000001, 0x9d, 0x1, 0x80000000}, {0x0, 0xfffffff7, 0x84e5, 0x7f, 0x3a, 0x3fd}, {0x8000, 0x7, 0x2, 0xd8, 0xa}, {0x9, 0x1004, 0x8, 0x6, 0x1, 0x2}, {0x0, 0x9, 0x9, 0xd, 0x7fffffff, 0xfffffc00}, {0x1, 0xfffffffc, 0x6, 0xffffffff, 0xc0, 0xfffff44c}, {0x4, 0x3, 0xfffffff5, 0x9, 0xbe, 0x4}, {0x20006, 0x3, 0x0, 0x7fff, 0x5, 0x7ff}, {0x400, 0x7, 0x80000000, 0x5, 0xfffffff7, 0x1}, {0x7, 0x100000, 0x5, 0x9, 0xbc, 0x11}, {0x1ff, 0xfffffffc, 0xf, 0x4, 0x1, 0x2}, {0x10000, 0x3, 0x0, 0x111, 0x7, 0x2}, {0x1d, 0x3, 0xda62, 0x4, 0x0, 0x8}, {0xb8000000, 0xfffffff8, 0x7, 0x9, 0x0, 0x49}, {0x8, 0x401, 0x9, 0x332a, 0x1, 0x2}, {0xfa0, 0x6, 0x7f, 0x7, 0x8, 0x80}, {0x10001, 0x4, 0x400, 0x9, 0x6, 0xdbce}, {0x1, 0x57f, 0x800, 0xe49, 0x0, 0xa81c}, {0x5, 0x8, 0xa, 0xa, 0x100006, 0x8}, {0x7f, 0xf, 0x1, 0x5, 0x401}, {0x7f, 0x4, 0x6, 0x2, 0x3}, {0x625, 0x80000001, 0xfc4, 0xfffffffd, 0x7}, {0x6, 0xfffffffc, 0x95db, 0x3d0b, 0x3, 0x80000001}, {0x7fff, 0x2, 0xffffff7f, 0x381, 0x8, 0x1}, {0x9, 0x4, 0x1, 0x80000000, 0xae, 0x9}, {0x9, 0xffffff80, 0xffff, 0xfff, 0x3, 0x3ff}, {0x9, 0x2, 0xb2f9, 0xbf, 0x1ff, 0x9}, {0xe, 0x310, 0x2, 0xad0, 0x7fffffff, 0x859}, {0x7, 0x6, 0x2, 0x200, 0x6, 0x3}, {0x7bf65384, 0x8, 0xe87, 0x0, 0x3, 0xfffffffd}, {0x3, 0x2, 0x1fd, 0x7, 0x2, 0x6}, {0x3, 0x0, 0x3, 0x80000001, 0xc3, 0xa9d}, {0x8, 0x200, 0x8, 0x8, 0xc}, {0x4, 0x4, 0x13ca, 0x74, 0x2, 0x1}, {0x2, 0x2, 0x1, 0x7fff, 0x14, 0x3}, {0x80000000, 0x4, 0x899, 0xfff, 0x0, 0x2}, {0x5, 0x80000, 0x0, 0x1, 0x3, 0x3}, {0x400, 0x5, 0x3ff, 0x3, 0xd, 0x5}, {0x2, 0x20000000, 0x3, 0x5, 0x81, 0x5}, {0x6, 0x7ff, 0x1, 0x3f, 0x9, 0x7}, {0x8, 0x0, 0xd, 0x6, 0x5}, {0x3, 0x7, 0x1, 0x3b1c, 0x2, 0x6}, {0x100004, 0x49354bbb, 0x2, 0x3, 0x7, 0x9}, {0x5, 0x2, 0x10, 0x9, 0x2, 0x400}, {0x40000fff, 0x54, 0x8, 0xc, 0x0, 0x6}, {0x401, 0x0, 0xff, 0x6, 0x3, 0x3}, {0x80000000, 0x7d, 0x2, 0xb, 0x84, 0x3}, {0xc45c, 0xa, 0x0, 0x2, 0x4, 0x2}, {0x7, 0x6, 0x86, 0x9, 0x3, 0x8001}, {0x3a, 0x7eb, 0x4, 0x9, 0x9, 0x405}, {0x7011, 0xfff, 0x9, 0x1, 0x40000009, 0x2}, {0x1, 0xff, 0x8, 0x2968, 0x2, 0xfffffffc}, {0x0, 0x9, 0xc402, 0x2, 0x100, 0xc72}, {0xfffffff9, 0x5, 0x81, 0x26, 0x9, 0x1}, {0x7ff, 0x81, 0xfffffff8, 0x401, 0x5, 0x3ff}, {0x3, 0x6, 0xd, 0x0, 0x6e5f, 0x80}, {0x4, 0x3ff, 0x7, 0x0, 0x0, 0x6}, {0x0, 0x4, 0x7f, 0x4, 0x10, 0x4}, {0x7, 0x4, 0x54, 0x6, 0x2f, 0x7}, {0x3, 0xff, 0x2, 0x7f, 0x4, 0x5}, {0x8000, 0x8, 0xd, 0x1, 0x5, 0x4}, {0xcab, 0xd, 0x4, 0xf, 0x8, 0x7}, {0x2, 0x2, 0x3, 0x5, 0x7, 0x34}, {0x0, 0x6, 0x10000, 0x8, 0xbb, 0x7fffffff}, {0x2, 0x9, 0x9, 0x9, 0x80, 0x7}, {0x39e3, 0x9, 0x0, 0x0, 0x31, 0x3}, {0xfffffffc, 0x4, 0x0, 0xbe50, 0x40, 0x7}, {0xe, 0x5, 0x7, 0xffffffff, 0xd, 0x1}, {0x5, 0x1000, 0x9, 0x7ffc, 0x24e, 0x1}, {0x7, 0x7, 0x7, 0x80000000, 0x1, 0x5}, {0x7, 0x9, 0x4, 0x8dad, 0x6, 0x7}, {0x1, 0x101, 0x3, 0x7, 0x4, 0x7}, {0x3ff, 0x3, 0x5, 0x2, 0x0, 0x2}, {0x2, 0x5, 0x7, 0x5, 0x2, 0x8}, {0x3c, 0x3409, 0x3, 0x5, 0x997c, 0x2df0}, {0x2, 0x9, 0x10001, 0x8711, 0x800}, {0x81, 0x0, 0x1, 0x1db, 0x0, 0xb}, {0x2, 0x5, 0x2, 0xc, 0x0, 0x7}, {0x8, 0xdfd3, 0x8, 0x2, 0xfffffffe, 0x2}], [{0x4}, {0x1, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x5}, {0x3, 0x1}, {0x0, 0x1}, {0x6}, {0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x2}, {0x5}, {0x2, 0x1}, {0x2}, {0x0, 0x1}, {0x4}, {0x4}, {0x2}, {0x2, 0x1}, {}, {0x2, 0x1}, {0x4}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x5}, {0x3}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0xe691a73254f1a9a5, 0x1}, {0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x5}, {0x5}, {}, {0x2}, {0x4, 0x1}, {0x0, 0x3}, {0x2}, {0x2}, {0x1}, {0x5, 0x1}, {0x2}, {0x2, 0x1}, {0x1, 0x1}, {0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x5}, {0x0, 0x1}, {0x5}, {}, {0x5}, {0x4}, {0x5}, {}, {0x5}, {}, {0x2}, {0x3}, {0x0, 0x1}, {0x5, 0x2}, {0x2, 0x1}, {0x3}, {0x5}, {0x4, 0x1}, {0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {}, {}, {0x2, 0x1}, {0x0, 0x1}, {0x1, 0x708aee799a2a8f33}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x3}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x1}, {}, {0x6}, {0x5, 0x1}, {0x2}, {}, {0x3, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {}, {0x1, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x3, 0x1}, {0x2, 0x1}, {0x3}, {}, {0x1}, {0x3}, {0x2}, {0x4}, {0x4, 0x1}, {}, {0x1}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0xe68}, 0x1, 0x0, 0x0, 0x4}, 0x20000015) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="0903000000000000000022"], 0x14}}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r5, &(0x7f0000006040)=[{{&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000200)=[{&(0x7f00000005c0)='6', 0x1}], 0x1}}, {{&(0x7f0000001e00)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, &(0x7f0000003300)=[{&(0x7f0000001e40)}], 0x1}}], 0x2, 0x48000) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r6, 0x54a3) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000100)={0xfbfb, 0x10200, 0x5, 0x115}, 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8983, &(0x7f0000000000)={0x6, 'veth0_vlan\x00', {0x2}, 0x101}) socket$nl_generic(0x10, 0x3, 0x10) 16.934354045s ago: executing program 1 (id=421): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x15, &(0x7f0000000740)=ANY=[@ANYBLOB="800001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000300)={0x40, 0x8, 0x5, "3a45444db4"}, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d04}]}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000080)={0x79, 0x0, 0x169}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000005000/0x1000)=nil, 0x0, 0x2, 0x13, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04090380"], 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r4, &(0x7f0000048040)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) fsopen(&(0x7f0000000140)='vfat\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x2b, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x4, @loopback}, 0x10) 10.30703536s ago: executing program 1 (id=438): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = syz_clone(0x4088080, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) syz_open_procfs(r0, &(0x7f0000000080)='sched\x00') ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x1, 0x5001) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a067fbc45ff810500000000070058000b480400945f640094272d7061d328b92d00", 0x32}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0e000000040000"], 0x48) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000019380)={&(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000200)="8e3961205ded65c1bf", 0x0, 0x4d70, r4, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x4, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.248620361s ago: executing program 2 (id=439): setfsuid(0xee00) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r0}, 0x38) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f0000000040)={0x0, 0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) 8.730006168s ago: executing program 5 (id=441): r0 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x680) r1 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) pwritev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='1', 0x1}], 0x1, 0x4, 0x201) ioctl$NBD_SET_BLKSIZE(r0, 0xab01, 0x5) 8.585027047s ago: executing program 2 (id=442): socket$inet6_mptcp(0xa, 0x1, 0x106) keyctl$reject(0x13, 0x0, 0x400, 0x8000000000000204, 0x0) setreuid(0x0, 0xee00) request_key(&(0x7f0000000440)='rxrpc_s\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f0000000500)='/dev/vcsu#\x00', 0xffffffffffffffff) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x34, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x2d}, 0x1, 0x0, 0x0, 0x2400cc04}, 0x0) request_key(&(0x7f0000000080)='id_legacy\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='NLBL_MGMT\x00', 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f0000000380)=ANY=[@ANYBLOB="20120c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x40, 0x39, 0x28, "855c0b5d089199f64dc36d07df5cdacfd2381eeb86c13f1ea82a515c7fef8e16bb83d7c47c9929f9"}, 0x0, 0x0, 0x0, 0x0}) 8.531318195s ago: executing program 5 (id=443): r0 = socket(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000340)=0x7) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000100)={0x0, 0x0, 0x4, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x8071, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8), 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x0, 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x13, 0x4, &(0x7f0000000900)=ANY=[@ANYRES16], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x0, 0xc, 0x4, 0xc0, 0x2, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) epoll_create1(0x80000) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000003c0)={@remote}, 0x14) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000040)=0x1) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}, @private1={0xfc, 0x1, '\x00', 0x4}, 0x0, 0x8000, 0x0, 0x80000}}) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000a40)={0xa, @vbi={0x8, 0xfffffff7, 0xe95, 0x36314d4e, [0x1, 0x3], [0x1, 0x6], 0x108}}) capset(&(0x7f00000000c0)={0x19980330, r1}, &(0x7f0000000280)={0xfffffffc, 0xd, 0x0, 0x6, 0x2, 0x53ecfbd8}) r6 = creat(&(0x7f00000016c0)='./file0\x00', 0x63) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r6}, 0x68) 8.490592903s ago: executing program 1 (id=444): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRESOCT], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x15, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) open(0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@fwd={0x0, 0x0, 0x0, 0x10, 0x2}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0x3e}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) rmdir(&(0x7f0000000000)='./file0\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x3, 0x8, 0x10000, 0x4}, 0x1c) 7.657043325s ago: executing program 2 (id=446): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRESOCT], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x15, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) open(0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@fwd={0x0, 0x0, 0x0, 0x10, 0x2}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0x3e}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) rmdir(&(0x7f0000000000)='./file0\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x3, 0x8, 0x10000, 0x4}, 0x1c) 7.445224825s ago: executing program 5 (id=447): syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000b3838108480b0310547b01020301090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) r1 = msgget(0x1, 0x200) msgctl$MSG_STAT_ANY(r1, 0xd, &(0x7f0000001180)=""/150) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000006c0)={&(0x7f0000000600)=[{0x6, 0xa10, 0x0, 0x0}], 0x1}) 6.545945127s ago: executing program 0 (id=448): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = syz_io_uring_setup(0xb, &(0x7f00000002c0)={0x0, 0x4200002f, 0x0, 0x1, 0x100020b}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r4) syz_io_uring_setup(0x237, &(0x7f0000000380)={0x0, 0x260e, 0x10100, 0xfffffffd, 0x170}, &(0x7f00000002c0)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r4, 0x0, 0x0, 0x0, {}, 0x1}) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000140), 0x0, 0x4) fchmod(r0, 0x8) 5.893694151s ago: executing program 2 (id=449): r0 = socket$kcm(0x21, 0x2, 0x2) r1 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="bcea"]) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x85, 0x0) mknod(0x0, 0x1000, 0x0) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000580)=""/90) syz_usb_disconnect(r1) sendmsg$kcm(r0, &(0x7f0000000280)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e23, @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x10) close(0x3) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1200000004000000040000000200000004000000e42c8104a1c61748f01a72a90efc5f1a090239dc9e955cacd7d0a258ca648b978205d76121a9a897a8e86125f711df909a0a2c832d63a72d5cc6462d9dde374e2127bccf9f8c89b993c61707e9b921f1ab941fb1f4ca0478999b559af4f330666dc2abc3ce91bf1f7398901f8ce95cd4e0c8e338c7c73eb8ca9f980514a56ea519f2fdc567da3e484a30044f7b6668be9afab17f329739bf13a4b664ed831f9477ad3ab15614674d29f07f951035f28ca57cf24566c84c37d8f50d7441163be82b9605e71611d1e086d701016d27d55fba0dfce6d06c4795311af1b5335ecfb0e2ac4eec6ae49833270d85da75de7ab6d4199d237f8e4fffe2f011fc53b6b7", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00'/20], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r5, &(0x7f0000000040)}, 0x20) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x1f, {[@global=@item_012={0x2, 0x1, 0x3, "2313"}, @global=@item_012={0x2, 0x1, 0x0, '\x00\x00'}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @global=@item_4={0x3, 0x1, 0x0, "1ac14c50"}, @global=@item_4={0x3, 0x1, 0x0, "0122be00"}, @main=@item_4={0x3, 0x0, 0x8, "1a6abbb2"}, @local=@item_012={0x2, 0x2, 0x3, "9a37"}, @local=@item_012={0x1, 0x2, 0x7, "16"}]}}, 0x0}, 0x0) 5.372170847s ago: executing program 3 (id=450): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x6, 0x400) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000c102, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r2, 0x0, 0xffffffdb) ioprio_set$pid(0x2, 0x0, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) syz_genetlink_get_family_id$nl80211(&(0x7f0000000fc0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010022bd7000400000008900000008000300", @ANYRES32, @ANYBLOB="180006"], 0x34}}, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r5, 0x4008af13, &(0x7f0000000000)={0x0, 0x4}) 5.053913466s ago: executing program 0 (id=451): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f00000009c0)=ANY=[@ANYBLOB="1c000000050605002dbd7000fedbdf251400c0a40800e800", @ANYRES32=r0, @ANYBLOB="7c7d231b23d1bc7f27162ed9b0a37a5081af3adb6afed15040cb6da048252c64c6b7cefa6d87aa13f721fcddcb99320e320f4e7a87beb32527f986e8"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}}, 0x1c) setsockopt$sock_linger(r5, 0x1, 0x3c, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000000)=[@register_looper, @register_looper, @increfs_done={0x40106308, 0x2}, @clear_death={0x400c630f, 0x3}], 0xf26, 0x0, &(0x7f00000014c0)="ca9bb559252828f7280f1e9d66aa3f61297e27ee1cee598c4a07dafdcd35cbe58dc20ecc4265f005a6daa4921b1ca68dd3f12459d069c4a08044e8b7837af53779ab199063234d5166e7744eb276399d052cd0e760a76bfdf196d4cb207014823352e28af53d187c448895a05938700791c9c90a8ea8cbd85ff179d8e6a799ab4603abe70b87bbc700ff6b728c0f7a658d155d6096cb21a9a7baf8069bab4e318d700960c30be5ca8f90aa1103043552cf8b6a7ab57199aa4c32c463a32e5da2f1f6b342012f64c0286c1f4ddf63d2acbd0c164d7d915ee3e552ee364e1745cc47059b95b5a050daeecf3f09b2b5f779afd0942579f1eff52485cccc1b49b9e8d6a8cfca0eb55dbdc5da133fc3e0c23a9b63bf5d8e0bca947f4dbaa3b5482b690c1e3eee6555767ecacf477927de85e22cabcb7930ba362bbe7d672102ef3ddc776c7593e38c9182af9b814f4ddc40c5fd1c352476c1f85535420443abf6e064f2099e144b1a0ae954a64e1b114ae1f6c0384e36b321209d2a42fc1d71b992e3b5efee65007c58ce4c9943f0b1caae0828d72bebedda6bd57ff2f1128de8a68cbfb8b8ba293848ba4177f468707749d87decbea303cde7bc9592602545e1447281ca94d6d08b6aad60c29809bc25f6bed7c80e6d7a74eea5f2377eed00257aa1969e19160f51dca402a7293397495e7f3df3347f260747ddcd0abbf47226b21cee04db718bf3173660431f85beb2e816d041040dd1de0dddff4942d201b6cd2fda0456aae6da036a31621606e4f7d9945e7c746b02604a54aaa16610308aa2f9e1546bfbdba943c2a52e386851b723d4f96d0ffbe3e065c7d7d672763019a50a61b2755a4c9fb8216553e06bedeb5809e31af7bb03a4a754f12ea41c50dd306fb8ce05909ba426c677ced4183a174665d5da48becec51dd9123450c76ba60228b341678f0f3b2bd1bcf440a488c785acb98f9f196195363951164215d884f97d2a6077b4e01b4a2b442b32b95db5e8d63c4bd5227e9c63ca9ed99a7fb155d13dc283af1af5363ceea55daa0afc7b8a07b6f4ffb0e230fb845ffaadc5dfe57bebf04753f88a0bd2d66d771cbff8a87882a8597e90e3259d636824a6c2b31b54da0c8383053d369f354a1f972136d3638b3bf052d33b44bde9bc2099641e29c32099fa11290b523a3824eaaa18c6270452ca757ae5eccb9f684771fb54b10ba0fa7cc9381eb1409e2aa2ea153556f254416d210f04661734386f1ff795b41955642821085d107a22712338a8ccfbd5bf5c1a8447364bd2cfe544dfefd70777f4bed14a6d2c4b5f47cc7594839da3ac6cff44e965de5007906014c137ec9b692c78b558a4ea336c7f8ae09f315360ba7bb9b578962ad601b8746d4049a373f0999ec52ab0d59fd76aaf64e2ca4c4a5f5ef915ed6e9df4600bbce1967037f2a20849c06fae29e82aeb3cfb54621d3c28bef9d8afea56c571c76868ce9d61a03d1af94c3c2f4f1b4ed2fe26012e63e8aada2ca21bf1fe7a2cdb916cc80c9847b075fa295507612417e9bf90e65330ad7ca90014cd79373152300743dfde1c3e7943f256a5e706d8030100ab66f6b9069a21703b80d70afdbe1e9d74e4bd16ec24222e45c4cbf6de6981669a8525db8d8dadb3e09c8d0bbd5bcecd138a49d8569dcea0b1867f23df8f9575147d48418f2b4bee2ce146510cb0271fa2e70ab4b749b6ceb2ba44b17e0928f5b4f42c25d7f3720f92ad13a88fdbc070b985bc8231902a3488bb0932cffdc73042425883bbb9556e790ee97e9bbcb17de3b4a935f34c87113a7d7c7dd82031c8b0213bf9fe784fc1d95f8810bf1f643c533d693ba236a5e8595064cb710f9d0c949b87fb1789135645215faeeb7f1871d7c180dfb9b9e89caf5235e634b61b80ef17d30814d2b82cee2905e9911f9b48ba3eac331628689a4767c5044303289d7f5f9fd6c4b7fbeb4cd536ca2b766769255229aad45b742ef4be8615409df469bc0c06f3ea4faf5e1f9797063b9c533e8633e9440550ae47aef2c6985ef893f3b7bda30fff5bef98162b6b6cee7ff7dce60fd1f94c2f25c7b76400f792abdbc90ab81d61a70b8a24efc2beaac8b3419714ab8ae03e2c579b319a0a2422b24de4a96151b757f0ec44b8d0f154059ee20c0f321a60fab07827b9e73b34dee388271167524de1604cccfa9f5ccd8468814589e80dd6622af0041a7e4abc7c3ea945dc8591caf61ef05b61f07b3bcc2a830b4ddd3ffaebb127d980f5f7fe86562e7c54a10dcb3f17b2fe8a1def2a463f72fc17604ec6ab1c1c789b9c53ee147c5c979d1c5ce85bd422414a32bd8b760b6c916c1dc14014dfb047287c245218fe748d6b53b51154ae871749e5bd00411b2f6131c9a44da36049d9b326f8bc1e245ce325d96497c0af51c314272af7ea8e00d7d396dae288434d463efe31446fef7fa343ddc8d8946ea061478f6efeb5b14850adc7cf0985c93acfe8bbb89d134a19db1d3a87176eebe03838bea6c87ff180606ff23aa85526909eca38f4d1e39a13f6895773a98b459ea409ff3848e505032b0e1c1b0a96982eff863e51dad6ad5d353ab60de5c9d43a82b12e26da973dae63ca9807c25a205278166a224a38945ac64ea661fbb44120a1e8697493ba38d41231fdd70117c628ec7b079ac84a7807231d52594d3ffadef5d824ac120d79b8b0d40658fe1f01bd7b92aefd2f9a1417002df418d9c92736f569872a10d1316f4c4fec336fca3d4b376a7fcbf1b65c9b1e7805d2b8205c8c3803b90f8adcba6d1621d10d7ac02849982ada2c6dfb132c8036726d9f99832f9a1b74c85dbad759a4f56c879d34099c9420cda4ae9ba91a055cb4bbb9593527596780c1f33966899f0f077e8d671d328e2afe5604c113e4371d1202390344bfa7c936a4e250db77fa065b51c0d9b10c56090af6cbf3c0cf0de32c7ec21620bc1dc145e81a8e174572e1c4974c1121706b1dbc52488ce42158c41c505fb247640b4807bf28e91ba06af969065cab2d69d988239e5276435fe67a844bb9616392238cd7d41f30cbbe910b2a29bb772ffff87423e02950b7be953566d04e1c0f5d1e6b0deaca591e1f64de6cef048af101b6eb6186b16700aec3ee5cb772867d3bd5545aa912312958b37fc6cb7dd53cd428d456a7240738510a337dba694fe26994cbe866a27868a5989df8b2817e4acb571640c6e15b2f64c5f8ab7edc4cbc21e67addcee5caca0a4cce01015f19a20fdb7f5f3de018954aae79739e3e3cb8e047b654f64192c2ebb7cdf8f48b7d518bfda5fb7b14d2d07ebad7ce33e62f791254e57708ac7c3b107cd5b235038b50f0a5d87ae2fc65a7f363ac69db0637f259a829c385d23a0c44914afec4a58543e52f443cd9a3c2fd1229c26d1392a149d172d8c16b83587a6f6e02958ee1528f621962ddb2abcd8e01f847190ff290b1b2b1269afd7766ff1a892d3c292b6e6f8773898e58235eb4e46d0b4068a345aa92e9205ff441e93b12dfc1c65ecf39af69b6ddef22f38a394c7505d8130b78b332ad4c8168b49dc0e826118b7cd96a0c5efb43c91700b69069d28cb6d17ca8b44034df41519812cb7bb4b22b1a481a97f38b6546ce844166e98251a0b921bba6da12948fea199a85ac6b8086ee5f6786510b22e2c2f255bf42212a3a978e0faceba6726e5835eb2c7574265f6c68efcb0e32228926a35697416d31906c8e39b3a957269a6d1c63ee46026a2af642246a8184a780c846e61e4462a34d38c7ea44ebaf66e81f2a7e3af71884142dec43ae9fdb7cce8c5e432787529a8058a4020fad245e4af841c31200e2bcdf652113001cd06d79e38a5c8857dea57d9bdc73d37bd07b48b6413ffe1fddd7119c13d1ae831a0cbfb26b8448218c630d7fbf32ccd2f68eb10f53bf48ca58a02e948b3a77aba6d02caab96b5c551d8de2da99e8c82ac9092d93711fd6f5473f7bba5c6ea96b2b9665f2b898c18e6a11699da1c6556d48e60e5800ae9a1968491d1e8e5e90ceaf693bb4f151ec8fdfe93bef3d41d11a1df388853a5afb58e01addbc16d8da0302e7394fb46550f26d1fa43cb82410b18910f06ef16d60e30f6e32ef8631488e29b7637b86b2ad9dc076096933fb04b237d89dc25b08d1d6125b98d8b619754290abe1fdf2fafdf4cfe7b8fa5c6656038553857b099a54a45c05d084e3f4f3b4859e41475de8b676ac4c97e59d146da94694f34b1d97a119a2dd6a2321205802bf0d55eb793f5128e14aeaa43e5da3215cdc77420be5f3b62422f2efd24f95e535d3415ddce1c0401272b021243ded28d240cea411b885e5825ab60d4809703cb3586250f22604440088a71f000701938c8b8aa6dcf4aba150306f38d6502f0c4b380801e339fb0f1e415d289642903d1a31d1f051b13a13a16b66155a49a0cc5de60b893ccbc3cde597eb5964cb180fe34338d1617fe004a4993aed5650189c17cfde75b05756e335b02854ab2c0c5b22b9a27c150b5e191e466468d0ba4d10d51a9b8f171a4bf3004df226e762041cb4fe0417e81e6f711a2e5320e9287589250e7928d1a0dbc1d5ed725fbe979e4bdb200c5daa4b2fb9e0d743da090895f150c65c3a323cdc04bcef16320d650b0869a72c7f69b3366aadf578d6e8ecfd7e9e2b68d686326c4651a57a96f1e1fcba447fcc8220efe1a3fdf1d7d235255abd964b2358009910648b00f693801c8440b7fc0fa390f045e21b1224bbf0ae8b1c9f4b3ef52b251637045db02f6ba223269bfd475bc02b0353b04dd5e8630eed360e47db8a5cad0657a08345fffe22746ad68b7a7da812c00b0d615148c80e3744a54836f169230e4a150d36dbb3abbe61822528df234a70be2d53ceb7b23bfbbcc45e6d93cd029b3e035936a2aaa1d46a035da0d5e912732c0ddd0909fec2660703ed4eb87c3811dd90bf6a0c45fadafe99167d6b953184ea3008dcf8900725c8023e9b921058e9ef30e94076d50ebacdcaee88b7420312ee5f55c8cc4b82a89cb34aa41f7966a7055165f0d53d3eef82d123a67270dbd6c94c21295e8be496825886c7296bd7658eef94d775e6a2cea0528a9741f0a1b2b342f62317b3d91f434d0ce788e2e119272d05b6621893d0e7f8178e49da1edb3a5af74c827e018858f9dc5a243c816c15c6616ff9255136bf77dcebec43e29389b257918e086e5e28c238dc6ca3ad57c193b580514fc9a1c3cf30ee12e514c45e7b84460d2ce3b709998b270b181f5a8fff8a7b65f9437916ed964ebf4408153ca9696e90eb4a6e32500fe7dda1ade058c3f9376ed417d2494a3cbeb0375d3db576cbadc05c5e97f1cd788b2dc2ec15b99b585c87259d624781a4bab19e6e72073694521030221e8fe8657ea0d28ef7133c527baf2f509f5c9bb7628d3de9d8c234a586d9feb2c815904b4c77134b9dacb6be80e8f52a2f71a365e472749a914666326fe07d7c941f67aec4c97dcca5"}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)}, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) write$binfmt_misc(r8, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f00000002c0)={r8, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8000000000000000]}}) sendmsg$inet(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000330000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x4040844) 4.736308974s ago: executing program 1 (id=452): setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffff", 0x9) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f00000000c0)=0x6, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r4, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r4, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0xd007) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$kcm(0x2, 0x2, 0x73) dup3(r0, r1, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000380)={r5, &(0x7f0000000000)='l2tp\x00', 0x18420, &(0x7f0000000100)={@_ha_fsid={[0x5, 0x10]}, {0x4, 0x1, 0x10, 0x5}}, 0x8, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x4}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) sendmsg$NL80211_CMD_SET_TID_CONFIG(r8, &(0x7f0000000680)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x1bc, r9, 0x991, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x3a}}}}, [@NL80211_ATTR_TID_CONFIG={0xd4, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x58, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8e}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x8f3}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x9d}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xbe}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x10}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf0}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x87}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x30, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xaf}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x6}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xc9}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}, @NL80211_ATTR_TID_CONFIG={0x90, 0x11d, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x68}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x72}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xc9}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x6}]}, {0x40, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x8d}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x10}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x38, 0x11d, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x3a}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xa}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x8af4}]}]}]}, 0x1bc}, 0x1, 0x0, 0x0, 0x20004010}, 0x20000010) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="2309fefffffffcffffff0100000005000700000000000800090000000000060002000100000008000a000400010008001700", @ANYRES32], 0x3c}}, 0x0) 4.067774263s ago: executing program 0 (id=453): setfsuid(0xee00) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r0}, 0x38) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f0000000040)={0x0, 0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) 4.033412222s ago: executing program 5 (id=454): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) write(r0, &(0x7f0000000040)="0600", 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000180)=ANY=[], 0xe) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x45, &(0x7f000002eff0)={0x135, &(0x7f0000000000)=[{}]}, 0x10) 4.013410853s ago: executing program 3 (id=455): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="2404f2000000011502008059a726f512", 0x10) r1 = socket(0x11, 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter6\x00') socket(0x80000000000000a, 0x2, 0x0) preadv(r6, &(0x7f0000000080)=[{&(0x7f0000000580)=""/118, 0x76}, {0x0}], 0x2, 0x9, 0x100) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) setsockopt(r1, 0x107, 0x1, &(0x7f00000001c0)="110000000200060000071a80010061cc", 0x10) r7 = socket$netlink(0x10, 0x3, 0x4) write(r7, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) r8 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x20010, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r8, 0xc020aa08, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) socket$nl_route(0x10, 0x3, 0x0) 2.805521984s ago: executing program 0 (id=456): getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x38}, 0x0, 0x1, 0x0, 0x8}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000100)={0x48}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) syz_usb_connect(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000143edd08b82225646cd3010203010902440001000000000904000000020a0000052406000105240000000d240f0105000000000000000006a41a000000102412"], 0x0) 2.716757884s ago: executing program 3 (id=457): socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000000)={0x80, 0x8, 0x2, 0xe05, 0xe7, 0x4}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) pwrite64(r3, 0x0, 0x0, 0x5) ioctl$FE_DISEQC_RECV_SLAVE_REPLY(0xffffffffffffffff, 0x800c6f40, &(0x7f0000000100)={""/4, 0x4}) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000180)=@gcm_256={{0x304}, "4a0e53a4e05b4ef7", "bb2af02acbacec51107a8cfd6fbb543495be9c640c2a0d72fde738900c1226f8", "a1c0fcc8", "2931a1b7f3057ccc"}, 0x38) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e1e, @loopback}, 0xfffffdf2) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r6) 2.584516368s ago: executing program 5 (id=458): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x6000, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010400000000000000000100000a74000000060a0b04000000000000000002000008400004803c000180080001006c6f670030000280060004400001000008000340fffffffa0a0002407d5def2e21000000080003400000000806000140000100000900010073797a30000000000900020073797a320000000008000b400000000314000000110001"], 0x9c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 2.141295396s ago: executing program 5 (id=459): socket$nl_xfrm(0x10, 0x3, 0x6) syz_io_uring_setup(0x487, &(0x7f0000000240)={0x0, 0xa5ba, 0x1, 0xffd, 0x5cc}, &(0x7f0000000300), &(0x7f0000000340)) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000380), 0x3, r2, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x401, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r3], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080), 0xfffffe13) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f0000000200)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x1000}}) pwritev(r5, &(0x7f0000000640)=[{&(0x7f0000000600)}], 0x1, 0x200, 0x4614) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%(:2', 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r7, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, 0x0) 2.121002961s ago: executing program 3 (id=460): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x2}, 0x28) ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, &(0x7f0000000000)) 1.968010591s ago: executing program 1 (id=461): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x15, &(0x7f0000000740)=ANY=[@ANYBLOB="800001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000300)={0x40, 0x8, 0x5, "3a45444db4"}, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d04}]}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000080)={0x79, 0x0, 0x169}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000005000/0x1000)=nil, 0x0, 0x2, 0x13, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04090380"], 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r4, &(0x7f0000048040)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) fsopen(&(0x7f0000000140)='vfat\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x4, @loopback}, 0x10) 1.898694778s ago: executing program 3 (id=462): ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000140)='befs\x00', 0x0) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) msync(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x4) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$TIOCSLCKTRMIOS(r3, 0x5457, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x541b, &(0x7f0000000240)) add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb) 1.699483152s ago: executing program 2 (id=463): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) fallocate(r0, 0x0, 0x9, 0x4) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x1a2c42) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x0, 0x14a1fb, 0x0, 0x0, 0xd, 0x1c, "3384020bbe82b398000000000000000000001d0ec0c1b4e9b1c4369d03740100ceaac594b3d6d741dd17c1c50d38ef2a565ef1e80000000058966500", "a9103939c787a16c1ca4f837026d1a8554feac911e1cd130e04d528539f3d3289737f0374c72a964a02447a75df8a6ca7f040000000000000072fd29f35239d2", "24431a1e77a68e174f00", [0x9, 0x400]}}) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd84568b8f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0xfffffe38) openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x21041, 0x0) keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000004c0)=[{0x0}], 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) getpid() read$msr(r3, &(0x7f000001f6c0)=""/102400, 0x19000) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x44040) getgroups(0x1, &(0x7f0000001080)=[0xee01]) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) r4 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$mixer_OSS_GETVERSION(r4, 0x80086303, 0x0) 936.888562ms ago: executing program 3 (id=464): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000080)=[{0xd0, 0x0, 0x0, 0x0}, {0x5, 0x1, 0x0, 0x0}], 0x2}) syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, &(0x7f0000000100)={0x40, 0x5, 0x4b, {0x4b, 0x31, "a42307aa6fd6be190753c5da6920b8cfd7884fabbf0fcc08ae3414d10fd9d31b48b30c3c424ab124cf8c44275f7bd9b753222fe9fd22aac242a2efdc2cf9527ee9ebf517fc79ab0651"}}, &(0x7f0000000180)={0x0, 0x3, 0xfb, @string={0xfb, 0x3, "ca594f78d8c43a04df098b6b9cc4aa94b1d9f05e01cf9250afee28471a7efab892e2c156bf5df7e243f4d6e0c2cf7bc4446f1f363e252745a679f68d347652e00f5f0198c467c51e3ce845a82ee3b536f0b877f928095a8add440c402beb36ea2beee142ae3c6e938af79420850b7222787c8c98b191379431575387c42d578b1409bec08367578c8e4b1735f345ba496bdf5037895c11ccfe0825866eb2e84189d2ad978cb55d92ecc5cd0671dc054c534adf7a7e13e930e315331a969dda8f567a516ca3f3dda0a86574fd3b6eadd39bdb49a5323b3b0b7cd5035d9e84d7ba648ad60596fe3e13eb0ae915befa278bb61b6760327100b51d"}}}, &(0x7f0000000540)={0x44, &(0x7f00000002c0)={0x20, 0x15, 0xb1, "45604f5f0b423c6d35a4425236beecf6753f2426f181a7c705cd0a321d531488d1eb1715c52bd4e5b2a43e73acd43b7dcbc4c159e8636225c571edcd88c7af9f5ca3f1dd37b690f6e5b93417694929dcee4c59e5aeb1dd7b994e5f34682a37cb02d4343c5bf7cb0fcd9034ab33ffb91636fefd1ecab5c556fa94f8aa54f900ccccee5815453b1e7480ece166ac1b59bec402fcf211a46d391adae5f780d7668fce2103ff864ddd7de288f7ae07daf598d4"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000400)={0x20, 0x81, 0x1, 'S'}, &(0x7f0000000440)={0x20, 0x82, 0x1, '\b'}, &(0x7f0000000480)={0x20, 0x83, 0x2, "ee18"}, &(0x7f00000004c0)={0x20, 0x84, 0x1, 'P'}, &(0x7f0000000500)={0x20, 0x85, 0x3, "eab66b"}}) 572.425118ms ago: executing program 2 (id=465): openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_usb_connect$uac1(0x0, 0x96, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902840003010000000904000000010100000a2401000000020102072405000000000c24020106020304800e0509090401000001020000090401010101020000090501090800000000072501000000000904020000010200000904020101010200000b2402016f0200012507b7072401000001000905820910"], 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x18ef, 0x800, 0xffffbfff, 0xa}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) r3 = fsopen(&(0x7f0000000140)='tmpfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0xa) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x8, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f00000001c0)={&(0x7f0000001000)={[{&(0x7f0000000040)="2cbfd925e141a82527c87f1dd99168262e56ba5a15ec5a06edf0361499091b241db7b5c81b0db026483d9db4469bf1f6", 0x30}, {&(0x7f00000000c0)="e729d9b00bbbc6244bc55d8342269a28999c45656ee915758be8eaddc1cc98933f4a442ffa02609a6c26bba11cf5fc258e9708f0fdb4b8bebb88d3201114fef33244f6cf7d3176402ae17340ce33f528cdf5d4a1b48fc9c0ba9f1176f214334b37", 0x61}]}, 0x2, 0x3}, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0x47f6, 0x0, 0x2, 0x0, 0x300) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000200)={0x0}) ioctl$DRM_IOCTL_LOCK(r4, 0x4008642a, &(0x7f0000000240)={r5, 0x15}) 198.752926ms ago: executing program 0 (id=466): setfsuid(0xee00) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r0}, 0x38) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f0000000040)={0x0, 0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 0 (id=467): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x39, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x1, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000780)=0x1e) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x10}}, 0x24008000) sendmmsg(r1, 0x0, 0xffffffffffffff58, 0x496d) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000000)={0x18, 0x2, {0x0, @dev}}, 0x1e) connect$pptp(r3, &(0x7f0000000280)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) connect$pptp(r3, 0x0, 0x0) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2800008) r4 = fcntl$getown(r1, 0x9) ptrace$PTRACE_SETSIGMASK(0x420b, r4, 0x8, &(0x7f00000001c0)={[0x3]}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_GETMODE(r5, 0x5601, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a050000000000000000000700000a0900010073797a30000000003c000000090a010400000000000000000700000308000a40000000000900020073797a31000000000900010073797a30000000000800054000000021900000000c0a01030000000000000000070000"], 0x114}}, 0x0) kernel console output (not intermixed with test programs): cal softirq work is pending, handler #02!!! [ 88.366342][ T24] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 88.375394][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.397987][ T29] audit: type=1400 audit(1774788137.631:241): avc: denied { bind } for pid=6244 comm="syz.2.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 88.505523][ T6236] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 88.571716][ T29] audit: type=1400 audit(1774788138.670:242): avc: denied { read } for pid=6233 comm="syz.3.79" name="event3" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 88.620094][ T6256] loop5: detected capacity change from 0 to 2640 [ 88.627106][ T6256] buffer_io_error: 341 callbacks suppressed [ 88.627118][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.660809][ T29] audit: type=1400 audit(1774788138.670:243): avc: denied { ioctl } for pid=6233 comm="syz.3.79" path="/dev/input/event3" dev="devtmpfs" ino=949 ioctlcmd=0x450a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 88.687067][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.694909][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.703857][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.712065][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.720696][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.728581][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.777798][ T6236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 88.806288][ T6236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 88.825051][ T29] audit: type=1400 audit(1774788138.876:244): avc: denied { write } for pid=6233 comm="syz.3.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 88.844385][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.859232][ T6256] ldm_validate_partition_table(): Disk read failed. [ 88.865865][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.895478][ T6256] Buffer I/O error on dev loop5, logical block 0, async page read [ 88.921738][ T6256] Dev loop5: unable to read RDB block 0 [ 88.936813][ T5887] usb 4-1: USB disconnect, device number 5 [ 88.936873][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 88.953119][ C1] dummy_hcd dummy_hcd.3: timer fired with no URBs pending? [ 89.000154][ T6256] loop5: unable to read partition table [ 89.024547][ T6256] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 89.262639][ T6262] loop5: detected capacity change from 0 to 2640 [ 89.299778][ T6262] ldm_validate_partition_table(): Disk read failed. [ 89.311480][ T6262] Dev loop5: unable to read RDB block 0 [ 89.318399][ T6262] loop5: unable to read partition table [ 89.335066][ T6262] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 89.467218][ T29] audit: type=1400 audit(1774788139.531:245): avc: denied { create } for pid=6263 comm="syz.2.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 89.759366][ T29] audit: type=1400 audit(1774788139.774:246): avc: denied { setopt } for pid=6263 comm="syz.2.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 90.052970][ T6281] netlink: zone id is out of range [ 90.058182][ T6281] netlink: zone id is out of range [ 90.063310][ T6281] netlink: zone id is out of range [ 90.068470][ T6281] netlink: zone id is out of range [ 90.073590][ T6281] netlink: zone id is out of range [ 90.608132][ T6265] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=36 sclass=netlink_tcpdiag_socket pid=6265 comm=syz.2.87 [ 91.523337][ T29] audit: type=1400 audit(1774788141.449:247): avc: denied { create } for pid=6291 comm="syz.2.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 91.624792][ T6292] netlink: 'syz.2.93': attribute type 12 has an invalid length. [ 91.632737][ T6292] netlink: 120 bytes leftover after parsing attributes in process `syz.2.93'. [ 92.081992][ T6297] netlink: 48 bytes leftover after parsing attributes in process `syz.2.94'. [ 92.151896][ T29] audit: type=1400 audit(1774788141.955:248): avc: denied { write } for pid=6296 comm="syz.2.94" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 92.284953][ T29] audit: type=1400 audit(1774788141.983:249): avc: denied { write } for pid=6296 comm="syz.2.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 92.845681][ T6308] mkiss: ax0: crc mode is auto. [ 92.893964][ T29] audit: type=1400 audit(1774788142.741:250): avc: denied { search } for pid=5474 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 93.414181][ T6318] netlink: zone id is out of range [ 93.419346][ T6318] netlink: zone id is out of range [ 93.424643][ T6318] netlink: zone id is out of range [ 93.429764][ T6318] netlink: zone id is out of range [ 93.434923][ T6318] netlink: zone id is out of range [ 96.189272][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 96.189306][ T29] audit: type=1400 audit(1774788145.829:258): avc: denied { write } for pid=6336 comm="syz.1.106" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 96.189531][ T6339] random: crng reseeded on system resumption [ 96.218364][ T29] audit: type=1400 audit(1774788145.829:259): avc: denied { open } for pid=6336 comm="syz.1.106" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 96.619439][ T29] audit: type=1400 audit(1774788146.035:260): avc: denied { ioctl } for pid=6336 comm="syz.1.106" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x3302 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 96.860520][ T29] audit: type=1400 audit(1774788146.353:261): avc: denied { nlmsg_write } for pid=6341 comm="syz.4.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 96.929725][ T29] audit: type=1400 audit(1774788146.353:262): avc: denied { bind } for pid=6341 comm="syz.4.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 96.966707][ T29] audit: type=1400 audit(1774788146.353:263): avc: denied { connect } for pid=6341 comm="syz.4.107" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 97.046293][ T29] audit: type=1400 audit(1774788146.353:264): avc: denied { write } for pid=6341 comm="syz.4.107" laddr=::1 lport=7 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 97.073652][ T29] audit: type=1400 audit(1774788146.400:265): avc: denied { bind } for pid=6341 comm="syz.4.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 97.129629][ T29] audit: type=1400 audit(1774788146.400:266): avc: denied { write } for pid=6341 comm="syz.4.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 97.160738][ T29] audit: type=1400 audit(1774788146.737:267): avc: denied { map } for pid=6355 comm="syz.1.112" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 97.246816][ T6358] FAULT_INJECTION: forcing a failure. [ 97.246816][ T6358] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.275196][ T6358] CPU: 1 UID: 0 PID: 6358 Comm: syz.2.114 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.275225][ T6358] Tainted: [L]=SOFTLOCKUP [ 97.275231][ T6358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 97.275241][ T6358] Call Trace: [ 97.275247][ T6358] [ 97.275253][ T6358] dump_stack_lvl+0x100/0x190 [ 97.275286][ T6358] should_fail_ex.cold+0x5/0xa [ 97.275310][ T6358] _copy_to_user+0x32/0xd0 [ 97.275333][ T6358] ptr_to_user+0x23c/0x5c0 [ 97.275350][ T6358] ? __pfx_ptr_to_user+0x10/0x10 [ 97.275382][ T6358] try_set_ext_ctrls_common+0xf2b/0x1840 [ 97.275408][ T6358] ? __mutex_lock+0x26a/0x1b90 [ 97.275438][ T6358] ? __pfx_try_set_ext_ctrls_common+0x10/0x10 [ 97.275473][ T6358] try_set_ext_ctrls+0x81/0x140 [ 97.275496][ T6358] v4l_s_ext_ctrls+0x268/0x2f0 [ 97.275521][ T6358] __video_do_ioctl+0xb2a/0xdf0 [ 97.275550][ T6358] ? __might_fault+0xc5/0x140 [ 97.275575][ T6358] ? __pfx___video_do_ioctl+0x10/0x10 [ 97.275609][ T6358] video_usercopy+0x47a/0x1740 [ 97.275636][ T6358] ? __pfx___video_do_ioctl+0x10/0x10 [ 97.275661][ T6358] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 97.275690][ T6358] ? __pfx_video_usercopy+0x10/0x10 [ 97.275732][ T6358] v4l2_ioctl+0x1bd/0x250 [ 97.275757][ T6358] ? __pfx_v4l2_ioctl+0x10/0x10 [ 97.275784][ T6358] __x64_sys_ioctl+0x18e/0x210 [ 97.275813][ T6358] do_syscall_64+0x106/0xf80 [ 97.275838][ T6358] ? clear_bhb_loop+0x40/0x90 [ 97.275860][ T6358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.275878][ T6358] RIP: 0033:0x7f1929d9c799 [ 97.275893][ T6358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.275909][ T6358] RSP: 002b:00007f192ac24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.275926][ T6358] RAX: ffffffffffffffda RBX: 00007f192a015fa0 RCX: 00007f1929d9c799 [ 97.275938][ T6358] RDX: 0000200000000100 RSI: 00000000c0205648 RDI: 0000000000000003 [ 97.275948][ T6358] RBP: 00007f192ac24090 R08: 0000000000000000 R09: 0000000000000000 [ 97.275958][ T6358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.275967][ T6358] R13: 00007f192a016038 R14: 00007f192a015fa0 R15: 00007ffc57eb4b68 [ 97.275992][ T6358] [ 97.639624][ T6363] netlink: 'syz.1.112': attribute type 11 has an invalid length. [ 97.721085][ T6366] netlink: 'syz.4.115': attribute type 1 has an invalid length. [ 97.728819][ T6366] netlink: 'syz.4.115': attribute type 2 has an invalid length. [ 97.830213][ T6369] futex_wake_op: syz.4.115 tries to shift op by -1; fix this program [ 98.197537][ T6366] syz.4.115 (6366) used greatest stack depth: 19672 bytes left [ 98.517885][ T6376] overlayfs: missing 'lowerdir' [ 98.562524][ T6376] macvtap0: entered allmulticast mode [ 98.685163][ T6376] veth0_macvtap: entered allmulticast mode [ 98.730410][ T6380] 9p: Unknown access argument A: -22 [ 98.813005][ T6385] ALSA: mixer_oss: invalid OSS volume 'MO' [ 98.826848][ T6385] netlink: 8 bytes leftover after parsing attributes in process `syz.4.119'. [ 99.753521][ T6390] netlink: 12 bytes leftover after parsing attributes in process `syz.1.122'. [ 101.733443][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 101.733461][ T29] audit: type=1400 audit(1774788150.985:273): avc: denied { create } for pid=6391 comm="syz.4.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 101.785417][ T29] audit: type=1400 audit(1774788150.985:274): avc: denied { setopt } for pid=6391 comm="syz.4.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 101.852984][ T29] audit: type=1400 audit(1774788150.995:275): avc: denied { create } for pid=6391 comm="syz.4.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 102.276837][ T115] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 102.471311][ T115] usb 4-1: device descriptor read/64, error -71 [ 102.471561][ T6418] random: crng reseeded on system resumption [ 102.729024][ T29] audit: type=1400 audit(1774788151.865:276): avc: denied { ioctl } for pid=6416 comm="syz.2.129" path="socket:[10036]" dev="sockfs" ino=10036 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 102.818756][ T6419] ======================================================= [ 102.818756][ T6419] WARNING: The mand mount option has been deprecated and [ 102.818756][ T6419] and is ignored by this kernel. Remove the mand [ 102.818756][ T6419] option from the mount to silence this warning. [ 102.818756][ T6419] ======================================================= [ 102.855396][ T29] audit: type=1400 audit(1774788152.015:277): avc: denied { bind } for pid=6414 comm="syz.0.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 102.905178][ T6419] tmpfs: Bad value for 'mpol' [ 102.919557][ T29] audit: type=1400 audit(1774788152.024:278): avc: denied { mounton } for pid=6414 comm="syz.0.121" path="/syzcgroup/unified/syz0" dev="cgroup2" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 102.943228][ T115] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 103.133679][ T115] usb 4-1: device descriptor read/64, error -71 [ 103.933575][ T6431] netlink: zone id is out of range [ 103.938848][ T6431] netlink: zone id is out of range [ 103.943974][ T6431] netlink: zone id is out of range [ 103.949120][ T6431] netlink: zone id is out of range [ 103.954240][ T6431] netlink: zone id is out of range [ 103.984619][ T5860] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 103.986856][ T6426] ALSA: mixer_oss: invalid OSS volume 'MO' [ 104.003549][ T6426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.131'. [ 104.017020][ T115] usb usb4-port1: attempt power cycle [ 104.464207][ T5860] usb 5-1: Using ep0 maxpacket: 16 [ 104.474302][ T5860] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 104.484546][ T5860] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 104.497253][ T5860] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 104.510528][ T5860] usb 5-1: config 1 interface 0 has no altsetting 0 [ 104.535922][ T29] audit: type=1400 audit(1774788153.624:279): avc: denied { bind } for pid=6433 comm="syz.2.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 104.560285][ T115] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 104.573610][ T5130] Bluetooth: Wrong link type (-22) [ 104.574605][ T5860] usb 5-1: New USB device found, idVendor=0521, idProduct=b1a8, bcdDevice= 0.40 [ 104.621052][ T115] usb 4-1: device descriptor read/8, error -71 [ 104.633779][ T29] audit: type=1400 audit(1774788153.624:280): avc: denied { listen } for pid=6433 comm="syz.2.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 104.672365][ T5860] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.684309][ T5860] usb 5-1: Product: syz [ 104.694832][ T5860] usb 5-1: Manufacturer: syz [ 104.699433][ T5860] usb 5-1: SerialNumber: syz [ 104.709796][ T29] audit: type=1400 audit(1774788153.624:281): avc: denied { ioctl } for pid=6433 comm="syz.2.132" path="socket:[10467]" dev="sockfs" ino=10467 ioctlcmd=0x1272 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 104.753095][ T6441] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 104.757176][ T29] audit: type=1400 audit(1774788153.765:282): avc: denied { connect } for pid=6437 comm="syz.2.134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 104.902066][ T115] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 104.961458][ T115] usb 4-1: device descriptor read/8, error -71 [ 104.993543][ T5860] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 255 proto 1 vid 0x0521 pid 0xB1A8 [ 105.052211][ T6451] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=6451 comm=syz.0.136 [ 105.084734][ T6451] netlink: 'syz.0.136': attribute type 3 has an invalid length. [ 105.099810][ T115] usb usb4-port1: unable to enumerate USB device [ 105.389324][ T115] usb 5-1: USB disconnect, device number 2 [ 105.405267][ T115] usblp0: removed [ 105.763541][ T6461] netlink: 'syz.1.140': attribute type 10 has an invalid length. [ 105.771321][ T6461] netlink: 40 bytes leftover after parsing attributes in process `syz.1.140'. [ 105.780283][ T6461] batadv0: entered promiscuous mode [ 105.785535][ T6461] batadv0: entered allmulticast mode [ 105.792895][ T6461] bridge0: port 3(batadv0) entered blocking state [ 105.799748][ T6461] bridge0: port 3(batadv0) entered disabled state [ 105.813839][ T6461] bridge0: port 3(batadv0) entered blocking state [ 105.820352][ T6461] bridge0: port 3(batadv0) entered forwarding state [ 105.924365][ T171] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 105.933633][ T171] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 106.553115][ T5860] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 106.724207][ T5860] usb 1-1: Using ep0 maxpacket: 16 [ 106.736154][ T5860] usb 1-1: unable to get BOS descriptor or descriptor too short [ 106.745104][ T5860] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 106.767232][ T6472] binder: 6471:6472 ioctl 89fb 2000000002c0 returned -22 [ 106.775736][ T5860] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 106.789199][ T5860] usb 1-1: can't read configurations, error -61 [ 106.950842][ T5860] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 107.130372][ T5860] usb 1-1: Using ep0 maxpacket: 16 [ 107.138008][ T5860] usb 1-1: unable to get BOS descriptor or descriptor too short [ 107.146092][ T5860] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 107.155247][ T5860] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 107.163180][ T5860] usb 1-1: can't read configurations, error -61 [ 107.170966][ T5860] usb usb1-port1: attempt power cycle [ 107.232318][ T6478] faux_driver vgem: [drm] Unknown color mode 7; guessing buffer size. [ 107.241281][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 107.241293][ T29] audit: type=1400 audit(1774788156.170:292): avc: denied { map } for pid=6477 comm="syz.3.145" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 107.547816][ T5860] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 107.569285][ T5860] usb 1-1: Using ep0 maxpacket: 16 [ 107.576889][ T5860] usb 1-1: unable to get BOS descriptor or descriptor too short [ 107.584664][ T5860] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 107.593512][ T5860] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 107.601134][ T5860] usb 1-1: can't read configurations, error -61 [ 107.760647][ T5860] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 107.793123][ T5860] usb 1-1: Using ep0 maxpacket: 16 [ 107.799739][ T5860] usb 1-1: unable to get BOS descriptor or descriptor too short [ 107.807666][ T5860] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 107.816716][ T5860] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 107.825841][ T5860] usb 1-1: can't read configurations, error -61 [ 107.833486][ T5860] usb usb1-port1: unable to enumerate USB device [ 108.324450][ T6491] fuse: Bad value for 'fd' [ 109.856480][ T5130] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 109.865432][ T5130] Bluetooth: hci2: Injecting HCI hardware error event [ 109.873061][ T5819] Bluetooth: hci2: hardware error 0x00 [ 110.094401][ T6511] fuse: Bad value for 'fd' [ 110.465345][ T5939] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 110.628114][ T6519] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 110.787756][ T5939] usb 1-1: Using ep0 maxpacket: 8 [ 110.813581][ T5939] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 110.850128][ T5939] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 110.869211][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.879156][ T5939] usb 1-1: Product: syz [ 110.880582][ T6523] loop5: detected capacity change from 0 to 2640 [ 110.891551][ T5939] usb 1-1: Manufacturer: syz [ 110.900463][ T6100] buffer_io_error: 32 callbacks suppressed [ 110.900474][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 110.918575][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 110.919285][ T5939] usb 1-1: SerialNumber: syz [ 110.927164][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 110.927191][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 110.927211][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 110.927247][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 111.027625][ T29] audit: type=1400 audit(1774788159.669:293): avc: denied { setopt } for pid=6522 comm="syz.2.156" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 111.050854][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 111.089268][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 111.099042][ T6100] ldm_validate_partition_table(): Disk read failed. [ 111.408362][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 111.413301][ T5939] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 111.424012][ T5939] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 111.457995][ T6100] Buffer I/O error on dev loop5, logical block 0, async page read [ 111.470531][ T6100] Dev loop5: unable to read RDB block 0 [ 111.488112][ T6100] loop5: unable to read partition table [ 111.498346][ T5939] usb 1-1: USB disconnect, device number 7 [ 111.517199][ T6523] ldm_validate_partition_table(): Disk read failed. [ 111.532384][ T6523] Dev loop5: unable to read RDB block 0 [ 111.566284][ T6523] loop5: unable to read partition table [ 111.605840][ T6523] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 111.775544][ T6537] netlink: 'syz.1.160': attribute type 10 has an invalid length. [ 111.783355][ T6537] netlink: 40 bytes leftover after parsing attributes in process `syz.1.160'. [ 112.200457][ T5819] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 112.318686][ T29] audit: type=1400 audit(1774788160.914:294): avc: denied { write } for pid=6540 comm="syz.2.163" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 112.461003][ T29] audit: type=1400 audit(1774788161.045:295): avc: denied { write } for pid=6545 comm="syz.0.164" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 112.581905][ T6549] (syz.0.164,6549,0):ocfs2_get_sector:1714 ERROR: status = -5 [ 112.589882][ T6549] (syz.0.164,6549,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 112.601700][ T29] audit: type=1400 audit(1774788161.157:296): avc: denied { accept } for pid=6545 comm="syz.0.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 112.624317][ T6549] (syz.0.164,6549,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 112.632898][ T6549] (syz.0.164,6549,0):ocfs2_fill_super:1177 ERROR: status = -5 [ 113.732504][ T5804] cgroup: fork rejected by pids controller in /syz3 [ 114.234596][ T105] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.568078][ T105] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.665946][ T29] audit: type=1400 audit(1774788163.123:297): avc: denied { ioctl } for pid=6567 comm="syz-executor" path="socket:[11510]" dev="sockfs" ino=11510 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 114.691602][ T5130] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 114.704038][ T5130] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 114.712074][ T5130] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 114.722078][ T5130] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 114.837055][ T5130] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 114.877410][ T105] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.005472][ T105] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.243698][ T6567] chnl_net:caif_netlink_parms(): no params data found [ 115.471570][ T6567] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.483436][ T6567] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.559303][ T6587] ALSA: mixer_oss: invalid OSS volume 'MO' [ 115.895110][ T6567] bridge_slave_0: entered allmulticast mode [ 115.915012][ T6567] bridge_slave_0: entered promiscuous mode [ 115.990841][ T6567] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.998465][ T6567] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.007709][ T6567] bridge_slave_1: entered allmulticast mode [ 116.016540][ T6567] bridge_slave_1: entered promiscuous mode [ 116.056724][ T105] bridge_slave_1: left allmulticast mode [ 116.062496][ T105] bridge_slave_1: left promiscuous mode [ 116.070341][ T105] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.081070][ T105] bridge_slave_0: left allmulticast mode [ 116.087545][ T105] bridge_slave_0: left promiscuous mode [ 116.093252][ T105] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.309358][ T29] audit: type=1400 audit(1774788164.648:298): avc: denied { create } for pid=6594 comm="syz.2.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 116.783868][ T29] audit: type=1400 audit(1774788164.657:299): avc: denied { bind } for pid=6594 comm="syz.2.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 116.804217][ T29] audit: type=1400 audit(1774788164.788:300): avc: denied { setopt } for pid=6594 comm="syz.2.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 116.997553][ T105] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 117.007755][ T105] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 117.019262][ T105] bond0 (unregistering): Released all slaves [ 117.036478][ T5130] Bluetooth: hci0: command tx timeout [ 117.106832][ T6567] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 117.126941][ T6567] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 117.229736][ T6567] team0: Port device team_slave_0 added [ 117.323692][ T29] audit: type=1400 audit(1774788165.602:301): avc: denied { read open } for pid=6611 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.381032][ T29] audit: type=1400 audit(1774788165.630:302): avc: denied { getattr } for pid=6611 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.381597][ T6567] team0: Port device team_slave_1 added [ 117.486723][ T29] audit: type=1400 audit(1774788165.752:303): avc: denied { wake_alarm } for pid=6620 comm="syz.0.179" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 117.488761][ T6617] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 117.636074][ T6567] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.645201][ T6567] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.691180][ T6567] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.731943][ T6567] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.747163][ T6567] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.811204][ T6567] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.817473][ T29] audit: type=1400 audit(1774788166.061:304): avc: denied { add_name } for pid=6610 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.867538][ T29] audit: type=1400 audit(1774788166.061:305): avc: denied { create } for pid=6610 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 118.031439][ T29] audit: type=1400 audit(1774788166.061:306): avc: denied { write } for pid=6610 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=2893 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 118.072403][ T29] audit: type=1400 audit(1774788166.061:307): avc: denied { append } for pid=6610 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=2893 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 118.226520][ T6567] hsr_slave_0: entered promiscuous mode [ 118.243701][ T6567] hsr_slave_1: entered promiscuous mode [ 118.249850][ T6567] debugfs: 'hsr0' already exists in 'hsr' [ 118.264995][ T6567] Cannot create hsr debugfs directory [ 118.307912][ T29] audit: type=1400 audit(1774788166.519:308): avc: denied { remove_name } for pid=6634 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2893 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 118.363247][ T29] audit: type=1400 audit(1774788166.548:309): avc: denied { unlink } for pid=6634 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2893 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 118.365138][ T105] hsr_slave_0: left promiscuous mode [ 118.454586][ T105] hsr_slave_1: left promiscuous mode [ 118.462650][ T105] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.470178][ T105] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 118.480065][ T105] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.487487][ T105] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 118.499127][ T105] batman_adv: batadv0: Interface deactivated: macsec1 [ 118.513417][ T6638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 118.531277][ T105] batman_adv: batadv0: Removing interface: macsec1 [ 118.590165][ T6638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 118.640189][ T105] veth1_macvtap: left promiscuous mode [ 118.644824][ T29] audit: type=1400 audit(1774788166.838:310): avc: denied { setopt } for pid=6636 comm="syz.2.181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 118.645981][ T105] veth0_macvtap: left allmulticast mode [ 118.692121][ T105] veth0_macvtap: left promiscuous mode [ 119.002458][ T105] veth1_vlan: left promiscuous mode [ 119.013353][ T105] veth0_vlan: left promiscuous mode [ 119.261865][ T5130] Bluetooth: hci0: command tx timeout [ 119.918639][ T29] audit: type=1400 audit(1774788167.661:311): avc: denied { setopt } for pid=6647 comm="syz.1.184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 119.974647][ T105] team0 (unregistering): Port device team_slave_1 removed [ 120.018124][ T105] team0 (unregistering): Port device team_slave_0 removed [ 120.153438][ T6650] dummy0: entered allmulticast mode [ 120.205449][ T6647] dummy0: left allmulticast mode [ 120.595820][ T6663] fuse: Bad value for 'fd' [ 121.222888][ T6567] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 121.367632][ T6567] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 121.493088][ T5130] Bluetooth: hci0: command tx timeout [ 121.702291][ T6567] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 121.710233][ T6679] wg1 speed is unknown, defaulting to 1000 [ 121.732673][ T6679] wg1 speed is unknown, defaulting to 1000 [ 121.757842][ T6567] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 121.775670][ T6683] netlink: 'syz.2.188': attribute type 21 has an invalid length. [ 121.790083][ T6679] wg1 speed is unknown, defaulting to 1000 [ 121.797346][ T6683] netlink: 128 bytes leftover after parsing attributes in process `syz.2.188'. [ 121.809353][ T6683] netlink: 'syz.2.188': attribute type 4 has an invalid length. [ 121.821209][ T6679] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 121.821938][ T6683] netlink: 3 bytes leftover after parsing attributes in process `syz.2.188'. [ 121.841984][ T6690] netlink: 'syz.2.188': attribute type 1 has an invalid length. [ 121.861321][ T6690] netlink: 224 bytes leftover after parsing attributes in process `syz.2.188'. [ 121.890420][ T6679] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 122.034952][ T6679] wg1 speed is unknown, defaulting to 1000 [ 122.154491][ T6679] wg1 speed is unknown, defaulting to 1000 [ 122.199029][ T6679] wg1 speed is unknown, defaulting to 1000 [ 122.275103][ T29] audit: type=1400 audit(1774788170.225:312): avc: denied { setopt } for pid=6697 comm="syz.1.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 122.636474][ T6567] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.659070][ T6679] wg1 speed is unknown, defaulting to 1000 [ 122.693287][ T6679] wg1 speed is unknown, defaulting to 1000 [ 122.702913][ T6567] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.733274][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.740423][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.776251][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.783424][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 123.116855][ T6723] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 123.132489][ T6723] qnx6: wrong signature (magic) in superblock #1. [ 123.139119][ T6723] qnx6: unable to read the first superblock [ 123.341857][ T6724] tipc: Enabling of bearer rejected, failed to enable media [ 123.400875][ T5819] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 123.421036][ T5819] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 123.428771][ T5819] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 123.441541][ T5819] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 123.456457][ T5819] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 123.595835][ T6725] wg1 speed is unknown, defaulting to 1000 [ 123.704993][ T5130] Bluetooth: hci0: command tx timeout [ 123.989331][ T6567] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 124.622950][ T6743] dummy0: entered allmulticast mode [ 124.642174][ T6743] dummy0: left allmulticast mode [ 124.933583][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 124.974227][ T6567] veth0_vlan: entered promiscuous mode [ 125.423433][ T6567] veth1_vlan: entered promiscuous mode [ 125.597396][ T6725] chnl_net:caif_netlink_parms(): no params data found [ 125.670535][ T5130] Bluetooth: hci5: command tx timeout [ 125.876140][ T6567] veth0_macvtap: entered promiscuous mode [ 125.887444][ T6567] veth1_macvtap: entered promiscuous mode [ 125.938602][ T29] audit: type=1400 audit(1774788173.660:313): avc: denied { ioctl } for pid=6776 comm="syz.2.201" path="socket:[13332]" dev="sockfs" ino=13332 ioctlcmd=0x5610 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 125.995715][ T6567] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 126.040112][ T6567] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 126.064597][ T1315] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.097028][ T1315] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.121380][ T6725] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.136048][ T6725] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.145481][ T6725] bridge_slave_0: entered allmulticast mode [ 126.153089][ T6725] bridge_slave_0: entered promiscuous mode [ 126.162284][ T1315] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.171136][ T1315] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.184065][ T5874] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 126.203048][ T6725] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.230311][ T6725] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.238519][ T6725] bridge_slave_1: entered allmulticast mode [ 126.277849][ T6725] bridge_slave_1: entered promiscuous mode [ 126.386792][ T5874] usb 3-1: Using ep0 maxpacket: 16 [ 126.408640][ T5874] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 126.447255][ T5874] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=f4.9b [ 126.462290][ T6725] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 126.471427][ T5874] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 126.482179][ T5874] usb 3-1: Product: syz [ 126.487096][ T6725] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.498633][ T5874] usb 3-1: SerialNumber: syz [ 126.503117][ T29] audit: type=1400 audit(1774788174.193:314): avc: denied { mount } for pid=6790 comm="syz.1.203" name="/" dev="ramfs" ino=13408 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 126.509425][ T5874] usb 3-1: config 0 descriptor?? [ 126.534555][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.563879][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.609949][ T6725] team0: Port device team_slave_0 added [ 126.635017][ T6725] team0: Port device team_slave_1 added [ 126.640722][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.659977][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.693300][ T6725] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.714741][ T29] audit: type=1400 audit(1774788174.390:315): avc: denied { mounton } for pid=6567 comm="syz-executor" path="/root/syzkaller.j6oGyM/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=13516 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 126.742274][ T6725] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.782178][ T6725] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.786897][ T29] audit: type=1400 audit(1774788174.455:316): avc: denied { mount } for pid=6567 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 126.795475][ T6725] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.846089][ T6725] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.871908][ T29] audit: type=1400 audit(1774788174.502:317): avc: denied { setopt } for pid=6797 comm="syz.1.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 126.879602][ T6725] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.918357][ T29] audit: type=1400 audit(1774788174.502:318): avc: denied { read } for pid=6797 comm="syz.1.204" path="socket:[12727]" dev="sockfs" ino=12727 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 126.945716][ T29] audit: type=1400 audit(1774788174.567:319): avc: denied { map } for pid=6797 comm="syz.1.204" path="socket:[12703]" dev="sockfs" ino=12703 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 126.950330][ T6725] hsr_slave_0: entered promiscuous mode [ 126.980090][ T6725] hsr_slave_1: entered promiscuous mode [ 127.692046][ T6725] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 127.702203][ T6725] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 127.790910][ T6815] dummy0: entered allmulticast mode [ 127.805719][ T6725] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 127.907794][ T5130] Bluetooth: hci5: command tx timeout [ 127.928220][ T6725] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 127.953672][ T6816] Unsupported ieee802154 address type: 0 [ 127.972705][ T29] audit: type=1400 audit(1774788175.550:320): avc: denied { bind } for pid=6814 comm="syz.1.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 128.190467][ T6824] loop5: detected capacity change from 0 to 2640 [ 128.202042][ T6725] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.213428][ T6824] buffer_io_error: 27 callbacks suppressed [ 128.213442][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.220424][ T6725] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.239171][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.251793][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.252926][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.258920][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.274155][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.295878][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.302959][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.329289][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.338152][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.348218][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.356709][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.364694][ T6824] ldm_validate_partition_table(): Disk read failed. [ 128.372156][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.380266][ T6824] Buffer I/O error on dev loop5, logical block 0, async page read [ 128.388518][ T6824] Dev loop5: unable to read RDB block 0 [ 128.397679][ T6824] loop5: unable to read partition table [ 128.403984][ T6824] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 128.623976][ T6806] dummy0: left allmulticast mode [ 129.144426][ T5887] usb 3-1: USB disconnect, device number 4 [ 129.717219][ T6725] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.886712][ T29] audit: type=1400 audit(1774788177.347:321): avc: denied { ioctl } for pid=6843 comm="syz.3.213" path="socket:[13611]" dev="sockfs" ino=13611 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 129.990002][ T6848] ALSA: mixer_oss: invalid OSS volume 'MO' [ 130.004211][ T6848] netlink: 8 bytes leftover after parsing attributes in process `syz.1.212'. [ 130.155963][ T5130] Bluetooth: hci5: command tx timeout [ 130.615065][ T6860] binder: 6859:6860 ioctl c0306201 200000000540 returned -22 [ 130.721063][ T6861] ALSA: mixer_oss: invalid OSS volume 'MO' [ 130.735964][ T6861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.215'. [ 131.090640][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.617076][ T6868] overlayfs: failed to resolve './file0': -2 [ 132.757477][ T5130] Bluetooth: hci5: command tx timeout [ 132.793947][ T6860] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 133.125190][ T6878] dummy0: entered allmulticast mode [ 133.812387][ T6872] dummy0: left allmulticast mode [ 133.910865][ T6885] netlink: 'syz.0.221': attribute type 10 has an invalid length. [ 133.918628][ T6885] netlink: 40 bytes leftover after parsing attributes in process `syz.0.221'. [ 134.649648][ T6889] fuse: Bad value for 'fd' [ 135.097844][ T6725] veth0_vlan: entered promiscuous mode [ 135.217349][ T6725] veth1_vlan: entered promiscuous mode [ 135.945750][ T6725] veth0_macvtap: entered promiscuous mode [ 136.027364][ T6725] veth1_macvtap: entered promiscuous mode [ 136.361031][ T6902] syzkaller1: entered promiscuous mode [ 136.366516][ T6902] syzkaller1: entered allmulticast mode [ 136.410564][ T6902] netlink: 4 bytes leftover after parsing attributes in process `syz.1.226'. [ 136.530123][ T6914] netlink: zone id is out of range [ 136.535329][ T6914] netlink: zone id is out of range [ 136.540544][ T6914] netlink: zone id is out of range [ 136.545672][ T6914] netlink: zone id is out of range [ 136.550988][ T6914] netlink: zone id is out of range [ 136.580432][ T6902] netlink: 4 bytes leftover after parsing attributes in process `syz.1.226'. [ 136.802581][ T6725] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 136.825711][ T248] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 137.083292][ T248] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 137.092131][ T248] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 137.113444][ T248] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 137.125195][ T6902] netlink: 20 bytes leftover after parsing attributes in process `syz.1.226'. [ 137.136640][ T29] audit: type=1400 audit(1774788184.131:322): avc: denied { getopt } for pid=6900 comm="syz.1.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 137.179222][ T6725] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.200160][ T29] audit: type=1400 audit(1774788184.197:323): avc: denied { ioctl } for pid=6900 comm="syz.1.226" path="socket:[13723]" dev="sockfs" ino=13723 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 137.240850][ T29] audit: type=1400 audit(1774788184.197:324): avc: denied { write } for pid=6900 comm="syz.1.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 137.240881][ T35] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.270998][ T35] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.370189][ T29] audit: type=1400 audit(1774788184.318:325): avc: denied { create } for pid=6920 comm="syz.2.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 137.488581][ T35] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.499707][ T35] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.503930][ T29] audit: type=1400 audit(1774788184.449:326): avc: denied { bind } for pid=6920 comm="syz.2.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 137.548997][ T6922] sp0: Synchronizing with TNC [ 138.061387][ T248] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.075465][ T248] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.124587][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.151571][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.567746][ T6941] dummy0: entered allmulticast mode [ 139.166926][ T6935] dummy0: left allmulticast mode [ 139.939927][ T6954] netlink: zone id is out of range [ 139.945137][ T6954] netlink: zone id is out of range [ 139.950336][ T6954] netlink: zone id is out of range [ 139.955490][ T6954] netlink: zone id is out of range [ 139.960652][ T6954] netlink: zone id is out of range [ 140.763102][ T6920] delete_channel: no stack [ 140.778801][ T6920] [U] è [ 141.140096][ T6957] ceph: No mds server is up or the cluster is laggy [ 141.153866][ T5939] libceph: connect (1)[c::]:6789 error -101 [ 141.165525][ T5939] libceph: mon0 (1)[c::]:6789 connect error [ 141.526689][ T6971] FAULT_INJECTION: forcing a failure. [ 141.526689][ T6971] name failslab, interval 1, probability 0, space 0, times 0 [ 141.540359][ T6971] CPU: 0 UID: 0 PID: 6971 Comm: syz.1.239 Tainted: G L syzkaller #0 PREEMPT(full) [ 141.540386][ T6971] Tainted: [L]=SOFTLOCKUP [ 141.540392][ T6971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 141.540402][ T6971] Call Trace: [ 141.540408][ T6971] [ 141.540415][ T6971] dump_stack_lvl+0x100/0x190 [ 141.540448][ T6971] should_fail_ex.cold+0x5/0xa [ 141.540472][ T6971] should_failslab+0xc2/0x120 [ 141.540491][ T6971] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 141.540516][ T6971] ? vm_area_alloc+0x1f/0x160 [ 141.540538][ T6971] ? vma_merge_new_range+0x38b/0xa30 [ 141.540561][ T6971] ? __sanitizer_cov_trace_switch+0x30/0x90 [ 141.540589][ T6971] vm_area_alloc+0x1f/0x160 [ 141.540612][ T6971] __mmap_region+0x10cc/0x29e0 [ 141.540637][ T6971] ? trace_sched_exit_tp+0x13a/0x180 [ 141.540664][ T6971] ? __schedule+0x1000/0x6120 [ 141.540688][ T6971] ? __pfx___mmap_region+0x10/0x10 [ 141.540711][ T6971] ? process_measurement+0x1f4/0x2350 [ 141.540781][ T6971] ? finish_task_switch.isra.0+0x205/0xb80 [ 141.540807][ T6971] ? rcu_is_watching+0x12/0xc0 [ 141.540858][ T6971] ? irqentry_exit+0x180/0x670 [ 141.540892][ T6971] mmap_region+0x30a/0x3e0 [ 141.540922][ T6971] do_mmap+0xc63/0x12f0 [ 141.540946][ T6971] ? __pfx_do_mmap+0x10/0x10 [ 141.540965][ T6971] ? __pfx_down_write_killable+0x10/0x10 [ 141.540994][ T6971] vm_mmap_pgoff+0x29e/0x470 [ 141.541018][ T6971] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 141.541036][ T6971] ? __fget_files+0x215/0x3d0 [ 141.541060][ T6971] ? __fget_files+0x21f/0x3d0 [ 141.541084][ T6971] ksys_mmap_pgoff+0x3c8/0x650 [ 141.541104][ T6971] ? __pfx___schedule+0x10/0x10 [ 141.541128][ T6971] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 141.541145][ T6971] ? fput+0x79/0x100 [ 141.541167][ T6971] ? exit_to_user_mode_loop+0xdd/0x4a0 [ 141.541189][ T6971] __x64_sys_mmap+0x125/0x190 [ 141.541210][ T6971] do_syscall_64+0x106/0xf80 [ 141.541235][ T6971] ? clear_bhb_loop+0x40/0x90 [ 141.541257][ T6971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.541274][ T6971] RIP: 0033:0x7f2c3d99c799 [ 141.541290][ T6971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.541306][ T6971] RSP: 002b:00007f2c3bbb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 141.541324][ T6971] RAX: ffffffffffffffda RBX: 00007f2c3dc16180 RCX: 00007f2c3d99c799 [ 141.541335][ T6971] RDX: 0000000000000003 RSI: 0000000000003000 RDI: 0000200000fa2000 [ 141.541345][ T6971] RBP: 00007f2c3bbb4090 R08: 0000000000000006 R09: 0000000000000000 [ 141.541356][ T6971] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 141.541366][ T6971] R13: 00007f2c3dc16218 R14: 00007f2c3dc16180 R15: 00007ffece854a38 [ 141.541391][ T6971] [ 142.266655][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 142.319582][ T5939] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 142.410568][ T6980] netlink: 204 bytes leftover after parsing attributes in process `syz.1.244'. [ 142.444704][ T6980] netlink: 212 bytes leftover after parsing attributes in process `syz.1.244'. [ 142.458879][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 142.470859][ T10] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 142.482967][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.499229][ T10] usb 6-1: Product: syz [ 142.503869][ T10] usb 6-1: Manufacturer: syz [ 142.509274][ T10] usb 6-1: SerialNumber: syz [ 142.542813][ T10] usb 6-1: config 0 descriptor?? [ 142.551986][ T10] visor 6-1:0.0: Sony Clie 3.5 converter detected [ 142.560941][ T5939] usb 4-1: Using ep0 maxpacket: 32 [ 142.588411][ T5939] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 142.618981][ T5939] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.634138][ T5939] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 142.644200][ T5939] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 142.810960][ T29] audit: type=1400 audit(1774788189.306:327): avc: denied { watch watch_reads } for pid=6982 comm="syz.2.247" path="/51/file1" dev="tmpfs" ino=290 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 143.706904][ T5939] usb 4-1: Product: syz [ 143.849792][ T10] usb 6-1: clie_3_5_startup: get config number bad return length: 0 [ 143.857905][ T10] visor 6-1:0.0: probe with driver visor failed with error -5 [ 144.733705][ T5939] usb 4-1: Manufacturer: syz [ 144.747176][ T5939] hub 4-1:4.0: USB hub found [ 145.132313][ T6991] dummy0: entered allmulticast mode [ 145.259088][ T6985] dummy0: left allmulticast mode [ 145.590468][ T5939] hub 4-1:4.0: config failed, can't read hub descriptor (err -22) [ 145.661792][ T5939] usb 4-1: USB disconnect, device number 10 [ 146.093006][ T10] usb 6-1: USB disconnect, device number 2 [ 146.434709][ T7015] netlink: 'syz.5.252': attribute type 11 has an invalid length. [ 146.581275][ T7017] io-wq is not configured for unbound workers [ 146.583868][ T29] audit: type=1400 audit(1774788192.984:328): avc: denied { read } for pid=7018 comm="syz.1.256" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 146.672929][ T29] audit: type=1400 audit(1774788193.021:329): avc: denied { open } for pid=7018 comm="syz.1.256" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 146.700964][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 146.916877][ T7029] fuse: Bad value for 'fd' [ 147.302063][ T7030] fuse: Bad value for 'fd' [ 147.314864][ T7030] netlink: 'syz.3.255': attribute type 39 has an invalid length. [ 147.366159][ T29] audit: type=1400 audit(1774788193.714:330): avc: denied { map } for pid=7031 comm="syz.0.258" path="/dev/input/event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 147.473225][ T29] audit: type=1400 audit(1774788193.714:331): avc: denied { execute } for pid=7031 comm="syz.0.258" path="/dev/input/event0" dev="devtmpfs" ino=918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 147.696433][ T29] audit: type=1400 audit(1774788193.957:332): avc: denied { create } for pid=7031 comm="syz.0.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 148.854351][ T29] audit: type=1400 audit(1774788193.966:333): avc: denied { connect } for pid=7031 comm="syz.0.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 148.982000][ T7041] dummy0: entered allmulticast mode [ 149.035457][ T7036] dummy0: left allmulticast mode [ 149.658530][ T7060] netlink: 8 bytes leftover after parsing attributes in process `syz.2.264'. [ 151.323310][ T29] audit: type=1400 audit(1774788197.401:334): avc: denied { write } for pid=7071 comm="syz.0.267" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 151.530795][ T5874] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 151.626887][ T5939] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 151.648747][ T29] audit: type=1326 audit(1774788197.719:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.682841][ T29] audit: type=1326 audit(1774788197.719:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.734209][ T29] audit: type=1326 audit(1774788197.794:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.765800][ T29] audit: type=1326 audit(1774788197.794:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.806079][ T29] audit: type=1326 audit(1774788197.859:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.808717][ T5874] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 151.906795][ T5939] usb 1-1: config 13 has an invalid interface number: 209 but max is 0 [ 151.937962][ T29] audit: type=1326 audit(1774788197.859:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 151.967494][ T29] audit: type=1326 audit(1774788197.869:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7076 comm="syz.1.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c3d99c799 code=0x7ffc0000 [ 152.083406][ T7085] dummy0: entered allmulticast mode [ 152.466462][ T5939] usb 1-1: config 13 has no interface number 0 [ 152.484533][ T5939] usb 1-1: config 13 interface 209 has no altsetting 0 [ 152.492145][ T5939] usb 1-1: New USB device found, idVendor=12d1, idProduct=dd3c, bcdDevice=88.00 [ 152.502229][ T5874] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 152.513002][ T5939] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.543417][ T5874] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 152.580760][ T5874] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 152.607169][ T5874] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.629459][ T5874] usb 4-1: config 0 descriptor?? [ 152.635038][ T7082] dummy0: left allmulticast mode [ 153.099769][ T7074] tipc: Started in network mode [ 153.104758][ T7074] tipc: Node identity fa8216bacb76, cluster identity 4711 [ 153.111927][ T7074] tipc: Enabled bearer , priority 0 [ 153.122231][ T7074] netlink: 44 bytes leftover after parsing attributes in process `syz.3.268'. [ 153.193906][ T7074] tipc: Disabling bearer [ 153.289706][ T7087] netlink: 'syz.5.272': attribute type 11 has an invalid length. [ 153.314786][ T7095] netlink: 'syz.2.273': attribute type 11 has an invalid length. [ 153.963976][ T29] audit: type=1400 audit(1774788199.684:342): avc: denied { name_bind } for pid=7097 comm="syz.1.274" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 153.992644][ T5874] usbhid 4-1:0.0: can't add hid device: -71 [ 154.000560][ T5874] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 154.015213][ T5874] usb 4-1: USB disconnect, device number 11 [ 154.250384][ T7107] netlink: 'syz.2.276': attribute type 4 has an invalid length. [ 154.311929][ T5939] usb 1-1: string descriptor 0 read error: -71 [ 154.343471][ T5939] option 1-1:13.209: GSM modem (1-port) converter detected [ 154.363800][ T5939] usb 1-1: USB disconnect, device number 8 [ 154.371616][ T5939] option 1-1:13.209: device disconnected [ 154.377330][ T115] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 154.415266][ T7112] FAULT_INJECTION: forcing a failure. [ 154.415266][ T7112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 154.429881][ T7112] CPU: 1 UID: 0 PID: 7112 Comm: syz.0.279 Tainted: G L syzkaller #0 PREEMPT(full) [ 154.429908][ T7112] Tainted: [L]=SOFTLOCKUP [ 154.429914][ T7112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 154.429924][ T7112] Call Trace: [ 154.429930][ T7112] [ 154.429936][ T7112] dump_stack_lvl+0x100/0x190 [ 154.429980][ T7112] should_fail_ex.cold+0x5/0xa [ 154.430003][ T7112] _copy_to_user+0x32/0xd0 [ 154.430025][ T7112] simple_read_from_buffer+0xcb/0x170 [ 154.430046][ T7112] proc_fail_nth_read+0x1af/0x230 [ 154.430073][ T7112] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 154.430099][ T7112] ? rw_verify_area+0xce/0x6d0 [ 154.430124][ T7112] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 154.430149][ T7112] vfs_read+0x1e4/0xb30 [ 154.430167][ T7112] ? __pfx_vfs_read+0x10/0x10 [ 154.430193][ T7112] ? __fget_files+0x215/0x3d0 [ 154.430217][ T7112] ? __fget_files+0x21f/0x3d0 [ 154.430248][ T7112] ksys_read+0x12a/0x250 [ 154.430264][ T7112] ? __pfx_ksys_read+0x10/0x10 [ 154.430287][ T7112] do_syscall_64+0x106/0xf80 [ 154.430313][ T7112] ? clear_bhb_loop+0x40/0x90 [ 154.430335][ T7112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.430353][ T7112] RIP: 0033:0x7f434295cfce [ 154.430367][ T7112] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 154.430382][ T7112] RSP: 002b:00007f43438b1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 154.430399][ T7112] RAX: ffffffffffffffda RBX: 00007f43438b26c0 RCX: 00007f434295cfce [ 154.430410][ T7112] RDX: 000000000000000f RSI: 00007f43438b20a0 RDI: 0000000000000006 [ 154.430420][ T7112] RBP: 00007f43438b2090 R08: 0000000000000000 R09: 0000000000000000 [ 154.430429][ T7112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 154.430438][ T7112] R13: 00007f4342c16038 R14: 00007f4342c15fa0 R15: 00007ffcb64de648 [ 154.430462][ T7112] [ 154.628940][ T5928] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 154.705114][ T115] usb 6-1: Using ep0 maxpacket: 16 [ 154.711689][ T115] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 154.722833][ T115] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=f4.9b [ 154.731957][ T115] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 154.743798][ T115] usb 6-1: Product: syz [ 154.748428][ T115] usb 6-1: SerialNumber: syz [ 154.755238][ T115] usb 6-1: config 0 descriptor?? [ 154.789898][ T5928] usb 2-1: Using ep0 maxpacket: 16 [ 154.798077][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 154.819624][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 154.848406][ T5928] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 154.896752][ T5928] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 155.294147][ T5928] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.374284][ T7124] Bluetooth: MGMT ver 1.23 [ 155.379540][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 155.379553][ T29] audit: type=1400 audit(1774788201.200:344): avc: denied { ioctl } for pid=7113 comm="syz.0.281" path="socket:[14708]" dev="sockfs" ino=14708 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 155.380379][ T5928] usb 2-1: config 0 descriptor?? [ 155.388695][ T29] audit: type=1400 audit(1774788201.200:345): avc: denied { bind } for pid=7113 comm="syz.0.281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 155.469625][ T29] audit: type=1400 audit(1774788201.210:346): avc: denied { write } for pid=7102 comm="syz.5.275" path="socket:[14714]" dev="sockfs" ino=14714 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 155.500545][ T29] audit: type=1400 audit(1774788201.322:347): avc: denied { read } for pid=7113 comm="syz.0.281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 155.876265][ T29] audit: type=1400 audit(1774788201.677:348): avc: denied { read write } for pid=7127 comm="syz.0.284" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 155.900577][ T29] audit: type=1400 audit(1774788201.696:349): avc: denied { open } for pid=7127 comm="syz.0.284" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 155.924668][ T29] audit: type=1400 audit(1774788201.724:350): avc: denied { ioctl } for pid=7127 comm="syz.0.284" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 156.017186][ T5928] shield 0003:0955:7214.0001: unknown main item tag 0x0 [ 156.025806][ T5928] shield 0003:0955:7214.0001: unknown main item tag 0x0 [ 156.044809][ T5928] shield 0003:0955:7214.0001: unknown main item tag 0x0 [ 156.061541][ T5928] shield 0003:0955:7214.0001: unknown main item tag 0x0 [ 156.068506][ T5928] shield 0003:0955:7214.0001: unknown main item tag 0x0 [ 156.169669][ T29] audit: type=1400 audit(1774788201.958:351): avc: denied { bind } for pid=7131 comm="syz.2.283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 156.195319][ T5928] input: HID 0955:7214 Haptics as /devices/virtual/input/input5 [ 156.222530][ T7106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.231690][ T7106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.293225][ T5928] shield 0003:0955:7214.0001: Registered Thunderstrike controller [ 156.326444][ T5928] shield 0003:0955:7214.0001: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 156.480958][ T10] shield 0003:0955:7214.0001: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 156.504463][ T5928] usb 2-1: USB disconnect, device number 2 [ 157.507346][ T10] shield 0003:0955:7214.0001: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 157.545802][ T10] shield 0003:0955:7214.0001: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 157.826784][ T10] shield 0003:0955:7214.0001: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 157.827238][ T7142] loop5: detected capacity change from 0 to 2640 [ 157.868852][ T10] usb 6-1: USB disconnect, device number 3 [ 157.907794][ T7144] buffer_io_error: 11 callbacks suppressed [ 157.907811][ T7144] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 157.922879][ T6725] Buffer I/O error on dev loop5, logical block 256, lost async page write [ 157.931409][ T6725] Buffer I/O error on dev loop5, logical block 257, lost async page write [ 157.964282][ T7144] Buffer I/O error on dev loop5, logical block 1, lost async page write [ 157.965189][ T6725] Buffer I/O error on dev loop5, logical block 258, lost async page write [ 157.972688][ T7144] Buffer I/O error on dev loop5, logical block 2, lost async page write [ 157.972712][ T7144] Buffer I/O error on dev loop5, logical block 3, lost async page write [ 157.972733][ T7144] Buffer I/O error on dev loop5, logical block 4, lost async page write [ 157.972754][ T7144] Buffer I/O error on dev loop5, logical block 5, lost async page write [ 157.972775][ T7144] Buffer I/O error on dev loop5, logical block 6, lost async page write [ 158.125483][ T6725] ldm_validate_partition_table(): Disk read failed. [ 158.154119][ T6725] Dev loop5: unable to read RDB block 0 [ 158.203065][ T6725] loop5: unable to read partition table [ 158.353867][ T7142] ldm_validate_partition_table(): Disk read failed. [ 158.368976][ T7142] Dev loop5: unable to read RDB block 0 [ 158.377384][ T7142] loop5: unable to read partition table [ 158.466389][ T7152] netlink: 8 bytes leftover after parsing attributes in process `syz.2.288'. [ 158.900685][ T7145] ALSA: mixer_oss: invalid OSS volume 'MO' [ 159.000589][ T7142] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 159.268772][ T29] audit: type=1400 audit(1774788204.840:352): avc: denied { ioctl } for pid=7157 comm="syz.1.292" path="socket:[14781]" dev="sockfs" ino=14781 ioctlcmd=0x6f01 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 159.845661][ T5939] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 159.983997][ T5928] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 160.082558][ T5939] usb 3-1: Using ep0 maxpacket: 16 [ 160.110146][ T5939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 160.167719][ T5939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 160.218171][ T5939] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 160.230088][ T5928] usb 2-1: Using ep0 maxpacket: 16 [ 160.287264][ T5939] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 160.382759][ T5939] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.413786][ T5928] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.443032][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 160.514159][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 160.519450][ T5939] usb 3-1: config 0 descriptor?? [ 160.673684][ T5928] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 160.720751][ T5928] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 160.766827][ T5928] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 160.784809][ T5928] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 160.804150][ T5928] usb 2-1: Manufacturer: syz [ 160.820138][ T5928] usb 2-1: config 0 descriptor?? [ 161.173392][ T7185] ALSA: mixer_oss: invalid OSS volume 'MO' [ 161.312119][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.490709][ T5928] rc_core: IR keymap rc-hauppauge not found [ 161.503433][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.503437][ T5928] Registered IR keymap rc-empty [ 161.538396][ T29] audit: type=1400 audit(1774788206.955:353): avc: denied { create } for pid=7153 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 161.569744][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.585428][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.605921][ T29] audit: type=1400 audit(1774788206.965:354): avc: denied { bind } for pid=7153 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 161.618310][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 161.636607][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.649524][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.659203][ T29] audit: type=1400 audit(1774788207.021:355): avc: denied { read } for pid=7153 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 161.671854][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 161.679551][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.698944][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.708714][ T29] audit: type=1400 audit(1774788207.021:356): avc: denied { sqpoll } for pid=7153 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 161.729891][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.731182][ T5928] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 161.738191][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.757640][ T29] audit: type=1400 audit(1774788207.030:357): avc: denied { getopt } for pid=7153 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 161.782647][ T5939] hid-multitouch 0003:0457:07DA.0002: unknown main item tag 0x0 [ 161.904345][ T5939] hid-multitouch 0003:0457:07DA.0002: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.2-1/input0 [ 161.943374][ T5939] usb 3-1: USB disconnect, device number 5 [ 162.094815][ T5928] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input6 [ 162.119990][ T7192] FAULT_INJECTION: forcing a failure. [ 162.119990][ T7192] name failslab, interval 1, probability 0, space 0, times 0 [ 162.165763][ T7192] CPU: 0 UID: 0 PID: 7192 Comm: syz.5.298 Tainted: G L syzkaller #0 PREEMPT(full) [ 162.165793][ T7192] Tainted: [L]=SOFTLOCKUP [ 162.165799][ T7192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 162.165808][ T7192] Call Trace: [ 162.165814][ T7192] [ 162.165820][ T7192] dump_stack_lvl+0x100/0x190 [ 162.165850][ T7192] should_fail_ex.cold+0x5/0xa [ 162.165873][ T7192] should_failslab+0xc2/0x120 [ 162.165893][ T7192] __kvmalloc_node_noprof+0xfa/0xa00 [ 162.165923][ T7192] ? page_pool_create_percpu+0x2e0/0xcd0 [ 162.165947][ T7192] page_pool_create_percpu+0x2e0/0xcd0 [ 162.165967][ T7192] bpf_test_run_xdp_live+0x192/0x760 [ 162.165991][ T7192] ? __mutex_unlock_slowpath+0x15c/0x790 [ 162.166019][ T7192] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 162.166043][ T7192] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 162.166070][ T7192] ? __pfx___schedule+0x10/0x10 [ 162.166092][ T7192] ? find_held_lock+0x2b/0x80 [ 162.166120][ T7192] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 162.166162][ T7192] ? 0xffffffffa0205480 [ 162.166177][ T7192] ? 0xffffffffa0205480 [ 162.166189][ T7192] ? bpf_dispatcher_change_prog+0x2dc/0xa60 [ 162.166221][ T7192] bpf_prog_test_run_xdp+0xd7d/0x1670 [ 162.166255][ T7192] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 162.166288][ T7192] ? fput+0x79/0x100 [ 162.166310][ T7192] ? __bpf_prog_get+0x97/0x2a0 [ 162.166335][ T7192] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 162.166360][ T7192] __sys_bpf+0x1725/0x4b90 [ 162.166383][ T7192] ? __pfx___sys_bpf+0x10/0x10 [ 162.166400][ T7192] ? proc_fail_nth_write+0x9f/0x220 [ 162.166425][ T7192] ? find_held_lock+0x2b/0x80 [ 162.166452][ T7192] ? find_held_lock+0x2b/0x80 [ 162.166473][ T7192] ? ksys_write+0x190/0x250 [ 162.166496][ T7192] ? __mutex_unlock_slowpath+0x15c/0x790 [ 162.166522][ T7192] ? __fget_files+0x215/0x3d0 [ 162.166554][ T7192] ? fput+0x79/0x100 [ 162.166574][ T7192] ? ksys_write+0x1ac/0x250 [ 162.166590][ T7192] ? __pfx_ksys_write+0x10/0x10 [ 162.166611][ T7192] __x64_sys_bpf+0x7b/0xc0 [ 162.166629][ T7192] ? lockdep_hardirqs_on+0x78/0x100 [ 162.166654][ T7192] do_syscall_64+0x106/0xf80 [ 162.166678][ T7192] ? clear_bhb_loop+0x40/0x90 [ 162.166700][ T7192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.166718][ T7192] RIP: 0033:0x7f19b139c799 [ 162.166732][ T7192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.166748][ T7192] RSP: 002b:00007f19b2192028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 162.166769][ T7192] RAX: ffffffffffffffda RBX: 00007f19b1615fa0 RCX: 00007f19b139c799 [ 162.166780][ T7192] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 162.166791][ T7192] RBP: 00007f19b2192090 R08: 0000000000000000 R09: 0000000000000000 [ 162.166800][ T7192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 162.166810][ T7192] R13: 00007f19b1616038 R14: 00007f19b1615fa0 R15: 00007ffc5ece3aa8 [ 162.166834][ T7192] [ 162.166859][ T7192] page_pool_create_percpu() gave up with errno -12 [ 162.526683][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.560530][ C0] rc rc0: IR event FIFO is full! [ 162.565712][ T7194] rc rc0: two consecutive events of type space [ 162.612193][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.621284][ T7190] fido_id[7190]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 162.655017][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.681657][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.709278][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.746037][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 162.881544][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 163.384288][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 163.415092][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 163.605922][ T5928] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 163.659364][ T5928] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 163.686481][ T5928] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 164.079610][ T7204] loop5: detected capacity change from 0 to 2640 [ 164.152071][ T5928] usb 2-1: USB disconnect, device number 3 [ 164.429832][ T7206] buffer_io_error: 357 callbacks suppressed [ 164.429843][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.495355][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.503389][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.513287][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.524106][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.534945][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.648117][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.681718][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.717324][ T7206] ldm_validate_partition_table(): Disk read failed. [ 164.723926][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.770708][ T7206] Buffer I/O error on dev loop5, logical block 0, async page read [ 164.778698][ T7206] Dev loop5: unable to read RDB block 0 [ 164.811081][ T7206] loop5: unable to read partition table [ 164.833592][ T7204] ldm_validate_partition_table(): Disk read failed. [ 164.845932][ T7204] Dev loop5: unable to read RDB block 0 [ 164.851533][ T7204] loop5: unable to read partition table [ 164.873809][ T7204] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 165.647214][ T5939] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 165.825617][ T5939] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.042360][ T5939] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.081837][ T5939] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.416314][ T5939] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.432477][ T5939] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.479821][ T5939] usb 6-1: config 0 descriptor?? [ 166.486883][ T29] audit: type=1400 audit(1774788211.606:358): avc: denied { create } for pid=7233 comm="syz.3.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 166.506776][ T29] audit: type=1400 audit(1774788211.606:359): avc: denied { create } for pid=7233 comm="syz.3.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 167.207083][ T5867] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 167.295044][ T248] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.376345][ T7243] comedi comedi3: rti800: I/O port conflict (0x3,16) [ 167.408484][ T7243] process 'syz.0.309' launched './file0' with NULL argv: empty string added [ 167.474131][ T29] audit: type=1400 audit(1774788212.477:360): avc: denied { execute_no_trans } for pid=7235 comm="syz.0.309" path="/58/file0" dev="tmpfs" ino=318 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 167.625623][ T5867] usb 2-1: Using ep0 maxpacket: 8 [ 167.641290][ T5867] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 167.650857][ T5867] usb 2-1: config 179 has no interface number 0 [ 167.667942][ T5867] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 167.685499][ T5867] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 167.751623][ T248] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.752988][ T5867] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 167.790468][ T5867] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 167.904983][ T7250] tipc: Started in network mode [ 167.910832][ T7250] tipc: Node identity 82c58bf19fdb, cluster identity 4711 [ 168.008725][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 168.052850][ T7250] tipc: Enabled bearer , priority 0 [ 168.096989][ T5867] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 168.097273][ T5867] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 168.097390][ T5867] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.407294][ T7237] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 168.461253][ T248] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.530055][ T7255] syzkaller0: entered promiscuous mode [ 168.535600][ T7255] syzkaller0: entered allmulticast mode [ 168.599343][ T7247] netlink: 44 bytes leftover after parsing attributes in process `syz.5.303'. [ 168.704432][ T7250] tipc: Resetting bearer [ 168.798557][ T7250] tipc: Disabling bearer [ 168.831996][ T248] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.868363][ T5939] usbhid 6-1:0.0: can't add hid device: -71 [ 168.874674][ T5939] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 168.920778][ T5939] usb 6-1: USB disconnect, device number 4 [ 169.023287][ T5867] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input7 [ 169.296987][ T5928] usb 2-1: USB disconnect, device number 4 [ 169.297016][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 169.311350][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 169.440707][ T248] bridge_slave_1: left allmulticast mode [ 169.449438][ T248] bridge_slave_1: left promiscuous mode [ 169.465283][ T248] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.511687][ T248] bridge_slave_0: left allmulticast mode [ 169.535916][ T248] bridge_slave_0: left promiscuous mode [ 169.570477][ T248] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.659558][ T29] audit: type=1400 audit(1774788214.582:361): avc: denied { read } for pid=7270 comm="syz.5.315" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 169.707895][ T7274] loop5: detected capacity change from 0 to 2640 [ 169.742822][ T29] audit: type=1400 audit(1774788214.582:362): avc: denied { open } for pid=7270 comm="syz.5.315" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 169.782571][ T7276] buffer_io_error: 255 callbacks suppressed [ 169.782588][ T7276] Buffer I/O error on dev loop5, logical block 164, lost async page write [ 169.825235][ T29] audit: type=1400 audit(1774788214.582:363): avc: denied { ioctl } for pid=7270 comm="syz.5.315" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9379 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 169.904615][ T7274] Buffer I/O error on dev loop5, logical block 320, lost async page write [ 169.910660][ T5928] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 169.943100][ T7274] Buffer I/O error on dev loop5, logical block 321, lost async page write [ 170.027125][ T7276] Buffer I/O error on dev loop5, logical block 165, lost async page write [ 170.052468][ T7274] Buffer I/O error on dev loop5, logical block 322, lost async page write [ 170.057229][ T7276] Buffer I/O error on dev loop5, logical block 166, lost async page write [ 170.069766][ T7276] Buffer I/O error on dev loop5, logical block 167, lost async page write [ 170.078653][ T7276] Buffer I/O error on dev loop5, logical block 168, lost async page write [ 170.088471][ T7276] Buffer I/O error on dev loop5, logical block 169, lost async page write [ 170.098252][ T7276] Buffer I/O error on dev loop5, logical block 170, lost async page write [ 170.140101][ T5928] usb 2-1: Using ep0 maxpacket: 16 [ 170.147840][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.161760][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 41728, setting to 1024 [ 170.177873][ T5928] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 170.198011][ T29] audit: type=1400 audit(1774788215.069:364): avc: denied { accept } for pid=7281 comm="syz.0.316" lport=56930 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 170.246328][ T5928] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 170.501980][ T5928] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.512455][ T5928] usb 2-1: config 0 descriptor?? [ 170.569558][ T248] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 170.570911][ T29] audit: type=1400 audit(1774788215.424:365): avc: denied { shutdown } for pid=7281 comm="syz.0.316" lport=56930 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 170.608070][ T248] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 170.706652][ T248] bond0 (unregistering): Released all slaves [ 170.729916][ T5928] usbhid 2-1:0.0: can't add hid device: -71 [ 170.730039][ T5179] ldm_validate_partition_table(): Disk read failed. [ 170.757188][ T7299] netlink: 68 bytes leftover after parsing attributes in process `syz.0.316'. [ 170.803594][ T5179] Dev loop5: unable to read RDB block 0 [ 170.819104][ T5179] loop5: unable to read partition table [ 170.904543][ T5928] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 171.404064][ T5928] usb 2-1: USB disconnect, device number 5 [ 171.798136][ T7316] netlink: zone id is out of range [ 171.803369][ T7316] netlink: zone id is out of range [ 171.808497][ T7316] netlink: zone id is out of range [ 171.813680][ T7316] netlink: zone id is out of range [ 171.818819][ T7316] netlink: zone id is out of range [ 172.507530][ T7317] netlink: zone id is out of range [ 172.512667][ T7317] netlink: zone id is out of range [ 172.517847][ T7317] netlink: zone id is out of range [ 172.523338][ T7317] netlink: zone id is out of range [ 172.528454][ T7317] netlink: zone id is out of range [ 173.052295][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 173.358035][ T29] audit: type=1400 audit(1774788218.035:366): avc: denied { write } for pid=7326 comm="syz.2.323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 173.689316][ T248] hsr_slave_0: left promiscuous mode [ 173.765869][ T248] hsr_slave_1: left promiscuous mode [ 173.833018][ T248] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 173.840418][ T248] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 174.010484][ T248] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.181577][ T248] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 174.256737][ T248] veth1_macvtap: left promiscuous mode [ 174.287029][ T248] veth0_macvtap: left promiscuous mode [ 174.315501][ T248] veth1_vlan: left promiscuous mode [ 174.412906][ T248] veth0_vlan: left promiscuous mode [ 175.725640][ T7366] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 176.035518][ T5814] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 176.099256][ T7370] loop5: detected capacity change from 0 to 2640 [ 176.120393][ T7370] buffer_io_error: 108 callbacks suppressed [ 176.120408][ T7370] Buffer I/O error on dev loop5, logical block 0, async page read [ 176.140656][ T7370] Buffer I/O error on dev loop5, logical block 0, async page read [ 176.149583][ T7370] Buffer I/O error on dev loop5, logical block 0, async page read [ 176.169655][ T7370] Buffer I/O error on dev loop5, logical block 0, async page read [ 176.208373][ T7370] Buffer I/O error on dev loop5, logical block 0, async page read [ 176.231031][ T7371] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 176.240677][ T29] audit: type=1400 audit(1774788220.730:367): avc: denied { bind } for pid=7346 comm="syz.3.327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 176.247647][ T7370] loop5: unable to read partition table [ 176.288520][ T5814] usb 2-1: unable to get BOS descriptor or descriptor too short [ 176.312069][ T5814] usb 2-1: not running at top speed; connect to a high speed hub [ 176.323736][ T7371] Buffer I/O error on dev loop5, logical block 1, lost async page write [ 176.338596][ T5814] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 176.358390][ T7371] Buffer I/O error on dev loop5, logical block 2, lost async page write [ 176.366961][ T7371] Buffer I/O error on dev loop5, logical block 3, lost async page write [ 176.367219][ T7370] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 176.384297][ T5814] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 176.401649][ T248] team0 (unregistering): Port device team_slave_1 removed [ 176.418830][ T7371] Buffer I/O error on dev loop5, logical block 4, lost async page write [ 176.419026][ T5814] usb 2-1: string descriptor 0 read error: -22 [ 176.447647][ T248] team0 (unregistering): Port device team_slave_0 removed [ 176.461523][ T5814] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 176.492358][ T5814] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.541002][ T5814] usb 2-1: 0:2 : does not exist [ 176.546838][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 177.718461][ T7387] syzkaller0: entered promiscuous mode [ 177.738232][ T7387] syzkaller0: entered allmulticast mode [ 177.759524][ T7387] tipc: Enabled bearer , priority 0 [ 177.775335][ T7386] tipc: Resetting bearer [ 177.819318][ T7386] tipc: Disabling bearer [ 177.833499][ T29] audit: type=1400 audit(1774788222.218:368): avc: denied { create } for pid=7365 comm="syz.1.330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 178.015568][ T5814] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 178.046689][ T5814] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 178.372371][ T5814] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 178.456924][ T5814] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 178.541711][ T5814] usb 2-1: USB disconnect, device number 6 [ 178.689925][ T29] audit: type=1400 audit(1774788223.032:369): avc: denied { create } for pid=7405 comm="syz.0.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 179.090025][ T29] audit: type=1400 audit(1774788223.061:370): avc: denied { setopt } for pid=7405 comm="syz.0.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 179.195429][ T29] audit: type=1400 audit(1774788223.491:371): avc: denied { create } for pid=7405 comm="syz.0.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 180.366386][ T7444] overlayfs: failed to resolve './file1': -2 [ 180.460942][ T5814] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 181.708287][ T5814] usb 6-1: Using ep0 maxpacket: 8 [ 181.715295][ T5814] usb 6-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 181.725811][ T5814] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 181.741792][ T5814] usb 6-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 181.841394][ T7454] loop5: detected capacity change from 0 to 7 [ 181.883409][ T7454] Dev loop5: unable to read RDB block 7 [ 181.889051][ T7454] loop5: AHDI p1 [ 181.892852][ T7454] loop5: partition table partially beyond EOD, truncated [ 181.918140][ T7454] netlink: 'syz.2.344': attribute type 10 has an invalid length. [ 181.926040][ T7454] netlink: 40 bytes leftover after parsing attributes in process `syz.2.344'. [ 181.935040][ T7454] batadv0: entered promiscuous mode [ 181.940273][ T7454] batadv0: entered allmulticast mode [ 181.947657][ T7454] bridge0: port 3(batadv0) entered blocking state [ 181.954493][ T7454] bridge0: port 3(batadv0) entered disabled state [ 181.968741][ T7454] bridge0: port 3(batadv0) entered blocking state [ 181.975254][ T7454] bridge0: port 3(batadv0) entered forwarding state [ 182.325300][ T6949] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 182.334588][ T6949] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 182.367502][ T5814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.388497][ T5814] usb 6-1: config 0 descriptor?? [ 182.659636][ T7461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.348'. [ 184.504369][ T7485] netlink: 48 bytes leftover after parsing attributes in process `syz.5.342'. [ 185.960732][ T5887] usb 6-1: USB disconnect, device number 5 [ 185.999868][ T29] audit: type=1400 audit(1774788229.536:372): avc: denied { connect } for pid=7498 comm="syz.3.356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 186.396673][ T7518] syzkaller0: entered promiscuous mode [ 186.402297][ T7518] syzkaller0: entered allmulticast mode [ 186.412073][ T7518] tipc: Enabled bearer , priority 0 [ 186.489344][ T7517] tipc: Resetting bearer [ 186.515596][ T7517] tipc: Disabling bearer [ 186.641389][ T7522] loop5: detected capacity change from 0 to 7 [ 186.694335][ T7522] Dev loop5: unable to read RDB block 7 [ 186.700204][ T7522] loop5: AHDI p1 [ 186.704023][ T7522] loop5: partition table partially beyond EOD, truncated [ 186.715633][ T7523] netlink: 'syz.1.360': attribute type 10 has an invalid length. [ 186.723911][ T7523] netlink: 40 bytes leftover after parsing attributes in process `syz.1.360'. [ 187.285829][ T5179] Dev loop5: unable to read RDB block 7 [ 187.298790][ T5179] loop5: AHDI p1 [ 187.314814][ T5179] loop5: partition table partially beyond EOD, truncated [ 187.917903][ T5810] Bluetooth: hci1: command 0x0406 tx timeout [ 187.917913][ T5811] Bluetooth: hci3: command 0x0406 tx timeout [ 188.354588][ T7536] syzkaller0: entered promiscuous mode [ 189.318791][ T29] audit: type=1400 audit(1774788232.812:373): avc: denied { connect } for pid=7540 comm="syz.3.365" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 189.374523][ T29] audit: type=1400 audit(1774788233.017:374): avc: denied { bind } for pid=7538 comm="syz.2.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 191.091202][ T7571] syzkaller0: entered promiscuous mode [ 191.147411][ T7571] syzkaller0: entered allmulticast mode [ 191.180793][ T7577] tipc: Enabled bearer , priority 0 [ 191.214567][ T7565] tipc: Resetting bearer [ 191.232311][ T7565] tipc: Disabling bearer [ 191.286375][ T7584] loop5: detected capacity change from 0 to 2640 [ 191.300308][ T7584] buffer_io_error: 325 callbacks suppressed [ 191.300344][ T7584] Buffer I/O error on dev loop5, logical block 0, async page read [ 191.341628][ T7584] Buffer I/O error on dev loop5, logical block 0, async page read [ 191.353629][ T7584] Buffer I/O error on dev loop5, logical block 0, async page read [ 191.384158][ T7584] Buffer I/O error on dev loop5, logical block 0, async page read [ 191.420513][ T7584] loop5: unable to read partition table [ 191.478009][ T7584] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 191.567992][ T7586] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 191.687777][ T7586] Buffer I/O error on dev loop5, logical block 1, lost async page write [ 191.706323][ T7586] Buffer I/O error on dev loop5, logical block 2, lost async page write [ 191.730902][ T7586] Buffer I/O error on dev loop5, logical block 3, lost async page write [ 191.904441][ T7586] Buffer I/O error on dev loop5, logical block 4, lost async page write [ 191.915120][ T7586] Buffer I/O error on dev loop5, logical block 5, lost async page write [ 192.127471][ T5179] ldm_validate_partition_table(): Disk read failed. [ 192.134147][ T5179] Dev loop5: unable to read RDB block 0 [ 192.239450][ T5179] loop5: unable to read partition table [ 192.241488][ T7604] binder: 7603:7604 ioctl c0306201 0 returned -14 [ 192.324825][ T7606] binder: 7603:7606 ioctl c0306201 0 returned -14 [ 192.475753][ T7608] netlink: 'syz.5.378': attribute type 11 has an invalid length. [ 192.754266][ T7620] syz.3.382 uses obsolete (PF_INET,SOCK_PACKET) [ 192.804420][ T29] audit: type=1400 audit(1774788236.237:375): avc: denied { connect } for pid=7619 comm="syz.3.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 192.888865][ T29] audit: type=1400 audit(1774788236.321:376): avc: denied { listen } for pid=7619 comm="syz.3.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 194.439293][ T7629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.386'. [ 194.603443][ T7653] tipc: Enabling of bearer rejected, failed to enable media [ 194.684985][ T29] audit: type=1400 audit(1774788237.996:377): avc: denied { ioctl } for pid=7649 comm="syz.3.389" path="socket:[17420]" dev="sockfs" ino=17420 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 195.782712][ T7677] netlink: 8 bytes leftover after parsing attributes in process `syz.3.393'. [ 196.257097][ T7676] Process accounting resumed [ 196.381093][ T7688] loop5: detected capacity change from 0 to 7 [ 196.397038][ T7688] Dev loop5: unable to read RDB block 7 [ 196.402794][ T7688] loop5: AHDI p1 [ 196.406595][ T7688] loop5: partition table partially beyond EOD, truncated [ 196.736807][ T7688] netlink: 'syz.1.397': attribute type 10 has an invalid length. [ 196.744619][ T7688] netlink: 40 bytes leftover after parsing attributes in process `syz.1.397'. [ 196.770663][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 197.548380][ T7701] netlink: 'syz.1.401': attribute type 29 has an invalid length. [ 197.652883][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 197.685097][ T7704] netlink: 'syz.1.401': attribute type 29 has an invalid length. [ 197.695527][ T7701] netlink: 'syz.1.401': attribute type 32 has an invalid length. [ 197.711795][ T7701] netlink: 500 bytes leftover after parsing attributes in process `syz.1.401'. [ 197.801234][ T5814] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 197.872447][ T7708] trusted_key: encrypted_key: insufficient parameters specified [ 197.973697][ T5814] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.985742][ T5814] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 198.126525][ T5814] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 198.154016][ T5814] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 198.195796][ T5814] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.238538][ T5814] usb 4-1: config 0 descriptor?? [ 198.495020][ T7713] syzkaller0: entered promiscuous mode [ 198.501050][ T7713] syzkaller0: entered allmulticast mode [ 198.715231][ T7692] netlink: 44 bytes leftover after parsing attributes in process `syz.3.399'. [ 198.874627][ T5814] usbhid 4-1:0.0: can't add hid device: -71 [ 198.905355][ T5814] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 198.914127][ T7721] netlink: 4 bytes leftover after parsing attributes in process `syz.5.404'. [ 198.953626][ T5814] usb 4-1: USB disconnect, device number 12 [ 198.961487][ T7721] erspan0: entered promiscuous mode [ 198.987740][ T7721] macvtap1: entered promiscuous mode [ 198.993756][ T7721] macvtap1: entered allmulticast mode [ 198.999536][ T7721] erspan0: entered allmulticast mode [ 199.043203][ T7726] macvtap1: left promiscuous mode [ 199.049780][ T7726] macvtap1: left allmulticast mode [ 199.058560][ T7726] erspan0: left allmulticast mode [ 199.556120][ T7741] overlayfs: failed to resolve './file1': -2 [ 201.010828][ T7753] netlink: zone id is out of range [ 201.016002][ T7753] netlink: zone id is out of range [ 201.021178][ T7753] netlink: zone id is out of range [ 201.026298][ T7753] netlink: zone id is out of range [ 201.031470][ T7753] netlink: zone id is out of range [ 201.276054][ T10] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 201.712654][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 201.731231][ T10] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 201.760284][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.774136][ T7765] syzkaller0: entered promiscuous mode [ 201.779695][ T10] usb 4-1: Product: syz [ 201.818629][ T7765] syzkaller0: entered allmulticast mode [ 201.826561][ T10] usb 4-1: Manufacturer: syz [ 201.831639][ T10] usb 4-1: SerialNumber: syz [ 201.840158][ T7765] tipc: Enabled bearer , priority 0 [ 201.923467][ T5814] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 201.952016][ T10] usb 4-1: config 0 descriptor?? [ 201.982484][ T10] gspca_main: se401-2.14.0 probing 047d:5003 [ 202.129658][ T5814] usb 1-1: Using ep0 maxpacket: 16 [ 202.141922][ T7762] tipc: Resetting bearer [ 202.206867][ T7769] binder: 7764:7769 ioctl c0306201 0 returned -14 [ 202.237260][ T5814] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 202.362368][ T5814] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 202.414201][ T5814] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 202.452724][ T5814] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.493666][ T5814] usb 1-1: Product: syz [ 202.498849][ T5814] usb 1-1: Manufacturer: syz [ 202.507422][ T5814] usb 1-1: SerialNumber: syz [ 202.543962][ T7762] tipc: Disabling bearer [ 202.607897][ T5814] usb 1-1: config 0 descriptor?? [ 203.052543][ T5814] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 203.062010][ T5814] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 203.068653][ T10] input: se401 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input8 [ 203.304516][ T10] usb 4-1: USB disconnect, device number 13 [ 203.358736][ T5814] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 203.436576][ T5814] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 203.487705][ T5814] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 203.524539][ T5814] em28xx 1-1:0.0: No AC97 audio processor [ 203.559403][ T5814] usb 1-1: USB disconnect, device number 9 [ 203.592777][ T5814] em28xx 1-1:0.0: Disconnecting em28xx [ 203.617057][ T5814] em28xx 1-1:0.0: Freeing device [ 203.725998][ T29] audit: type=1400 audit(1774788246.456:378): avc: denied { read } for pid=7803 comm="syz.5.417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 203.813153][ T29] audit: type=1400 audit(1774788246.540:379): avc: denied { create } for pid=7803 comm="syz.5.417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 203.891478][ T29] audit: type=1400 audit(1774788246.605:380): avc: denied { sys_admin } for pid=7803 comm="syz.5.417" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 204.472459][ T7823] netlink: zone id is out of range [ 204.477599][ T7823] netlink: zone id is out of range [ 204.482763][ T7823] netlink: zone id is out of range [ 204.487861][ T7823] netlink: zone id is out of range [ 204.492994][ T7823] netlink: zone id is out of range [ 205.506303][ T7825] overlayfs: failed to resolve './file1': -2 [ 208.583521][ T24] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 208.591089][ T29] audit: type=1400 audit(1774788251.013:381): avc: denied { append } for pid=7844 comm="syz.0.426" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 208.636600][ T7843] syzkaller0: entered promiscuous mode [ 208.679473][ T7843] syzkaller0: entered allmulticast mode [ 208.693059][ T7851] tipc: Enabled bearer , priority 0 [ 208.732738][ T7838] tipc: Resetting bearer [ 208.843900][ T24] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 208.872717][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.884993][ T7838] tipc: Disabling bearer [ 208.900781][ T24] usb 2-1: Product: syz [ 208.923096][ T24] usb 2-1: Manufacturer: syz [ 208.935135][ T24] usb 2-1: SerialNumber: syz [ 208.952849][ T24] usb 2-1: config 0 descriptor?? [ 209.010295][ T24] hub 2-1:0.0: bad descriptor, ignoring hub [ 209.045318][ T24] hub 2-1:0.0: probe with driver hub failed with error -5 [ 209.217921][ T7842] netlink: 'syz.2.425': attribute type 11 has an invalid length. [ 209.255275][ T24] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 209.316706][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 209.345964][ T7858] syzkaller0: entered promiscuous mode [ 209.360475][ T24] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 209.372709][ T7858] syzkaller0: entered allmulticast mode [ 209.393102][ T24] usb 2-1: media controller created [ 209.494354][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 209.523852][ T5814] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 209.596242][ T24] DVB: Unable to find symbol dib7000p_attach() [ 209.603347][ T24] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 209.684095][ T5814] usb 6-1: Using ep0 maxpacket: 8 [ 209.689241][ T24] rc_core: IR keymap rc-dib0700-rc5 not found [ 209.718576][ T24] Registered IR keymap rc-empty [ 209.724813][ T5814] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 209.733482][ T24] dvb-usb: could not initialize remote control. [ 209.748579][ T5814] usb 6-1: config 0 has no interface number 0 [ 209.754710][ T5814] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 209.769314][ T24] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 209.800569][ T5814] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 209.818775][ T5887] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 209.885898][ T5814] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 209.922639][ T5814] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 209.935977][ T5814] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 209.946262][ T5814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.967052][ T5814] usb 6-1: config 0 descriptor?? [ 209.979704][ T5814] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 210.017797][ T5887] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 210.054159][ T5887] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 254, changing to 7 [ 210.094142][ T5887] usb 1-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 210.132547][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.165549][ T5887] usb 1-1: Product: syz [ 210.169773][ T5887] usb 1-1: Manufacturer: syz [ 210.174367][ T5887] usb 1-1: SerialNumber: syz [ 210.642643][ T29] audit: type=1400 audit(1774788252.847:382): avc: denied { create } for pid=7871 comm="syz.5.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 210.797430][ T29] audit: type=1400 audit(1774788252.856:383): avc: denied { setopt } for pid=7871 comm="syz.5.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 210.818860][ T29] audit: type=1400 audit(1774788252.856:384): avc: denied { connect } for pid=7871 comm="syz.5.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 210.902294][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 212.411449][ C0] ldusb 6-1:0.55: usb_submit_urb failed (-1) [ 212.659971][ T5814] usb 6-1: USB disconnect, device number 6 [ 212.661214][ T5887] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 212.755200][ T5814] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 212.888853][ T5887] usb 1-1: USB disconnect, device number 10 [ 213.127678][ T7914] overlayfs: failed to resolve './file1': -2 [ 214.450810][ T6100] udevd[6100]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 214.649041][ T9] usb 2-1: USB disconnect, device number 7 [ 214.652363][ T29] audit: type=1400 audit(1774788256.674:385): avc: denied { name_bind } for pid=7917 comm="syz.0.436" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 214.868785][ T7926] loop5: detected capacity change from 0 to 7 [ 214.887215][ T7926] Dev loop5: unable to read RDB block 7 [ 214.892887][ T7926] loop5: AHDI p1 [ 214.896631][ T7926] loop5: partition table partially beyond EOD, truncated [ 214.923714][ T7926] netlink: 'syz.3.437': attribute type 10 has an invalid length. [ 214.931516][ T7926] netlink: 40 bytes leftover after parsing attributes in process `syz.3.437'. [ 214.940464][ T7926] batadv0: entered promiscuous mode [ 214.945716][ T7926] batadv0: entered allmulticast mode [ 214.953976][ T7926] bridge0: port 3(batadv0) entered blocking state [ 214.960814][ T7926] bridge0: port 3(batadv0) entered disabled state [ 214.975396][ T7926] bridge0: port 3(batadv0) entered blocking state [ 214.981894][ T7926] bridge0: port 3(batadv0) entered forwarding state [ 215.342598][ T5928] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 215.384748][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 215.394291][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 215.412071][ T9] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 215.488919][ T5887] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 216.222993][ T5928] usb 6-1: device descriptor read/all, error -71 [ 216.269796][ T5887] usb 1-1: Using ep0 maxpacket: 32 [ 216.312402][ T5887] usb 1-1: unable to get BOS descriptor or descriptor too short [ 216.331325][ T5887] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 216.352174][ T5887] usb 1-1: can't read configurations, error -71 [ 216.523188][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 217.187316][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 217.227572][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 217.254625][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 217.302333][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 217.321937][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.335948][ T9] usb 4-1: config 0 descriptor?? [ 217.638021][ T7949] overlayfs: failed to resolve './file1': -2 [ 217.869229][ T7953] netlink: 44 bytes leftover after parsing attributes in process `syz.3.440'. [ 218.410198][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 218.436020][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 218.445958][ T9] usb 4-1: USB disconnect, device number 14 [ 219.719884][ T29] audit: type=1400 audit(1774788261.428:386): avc: denied { setattr } for pid=7962 comm="syz.0.448" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 219.941454][ T7970] netlink: 'syz.3.450': attribute type 11 has an invalid length. [ 219.953791][ T5814] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 220.208964][ T7975] loop5: detected capacity change from 0 to 7 [ 220.266048][ T7976] netlink: 'syz.0.451': attribute type 10 has an invalid length. [ 220.273848][ T7976] netlink: 40 bytes leftover after parsing attributes in process `syz.0.451'. [ 220.309447][ T7975] Dev loop5: unable to read RDB block 7 [ 220.315503][ T7975] loop5: AHDI p1 [ 220.319493][ T7975] loop5: partition table partially beyond EOD, truncated [ 220.345171][ T5814] usb 3-1: Using ep0 maxpacket: 8 [ 220.410531][ T5814] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 220.543128][ T5814] usb 3-1: config 179 has no interface number 0 [ 220.630170][ T5814] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 220.668823][ T5814] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 220.688179][ T5814] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 220.701263][ T5814] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 220.701612][ T5928] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 220.724299][ T5814] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 220.786915][ T5814] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 220.855694][ T5814] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.889143][ T7965] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 220.955213][ T5928] usb 6-1: device descriptor read/all, error -71 [ 221.186053][ T5867] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input10 [ 221.306768][ T7992] dummy0: entered allmulticast mode [ 221.971894][ T7987] dummy0: left allmulticast mode [ 221.999823][ T29] audit: type=1400 audit(1774788262.841:387): avc: denied { read } for pid=5164 comm="acpid" name="js0" dev="devtmpfs" ino=2956 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 222.041300][ T5887] usb 3-1: USB disconnect, device number 6 [ 222.041305][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 222.041341][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 222.123366][ T29] audit: type=1400 audit(1774788262.841:388): avc: denied { open } for pid=5164 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=2956 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 222.152362][ T29] audit: type=1400 audit(1774788262.841:389): avc: denied { ioctl } for pid=5164 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=2956 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 222.817286][ T5887] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 223.041686][ T10] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 223.073697][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 223.087984][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.111948][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 41728, setting to 1024 [ 223.126591][ T5887] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 223.278550][ T5887] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 223.287634][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.307833][ T5887] usb 3-1: config 0 descriptor?? [ 223.320841][ T5887] usb 3-1: can't set config #0, error -71 [ 223.330621][ T5887] usb 3-1: USB disconnect, device number 7 [ 223.351522][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 223.460671][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.499510][ T8020] loop5: detected capacity change from 0 to 2640 [ 223.592361][ T8020] buffer_io_error: 345 callbacks suppressed [ 223.592393][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.631736][ T10] usb 1-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 223.658031][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.687983][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.707234][ T10] usb 1-1: Product: syz [ 223.722025][ T10] usb 1-1: Manufacturer: syz [ 223.726253][ T5867] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 223.759463][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.767627][ T10] usb 1-1: SerialNumber: syz [ 223.774388][ T10] usb 1-1: config 0 descriptor?? [ 223.780615][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.789693][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.800270][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.811381][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.820051][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 223.827995][ T8020] ldm_validate_partition_table(): Disk read failed. [ 223.863608][ T10] cdc_ether 1-1:0.0: skipping garbage [ 223.882477][ T10] usb 1-1: bad CDC descriptors [ 223.913704][ T10] usb 1-1: unsupported MDLM descriptors [ 223.941761][ T10] cdc_acm 1-1:0.0: skipping garbage [ 224.100874][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 224.109044][ T8020] Buffer I/O error on dev loop5, logical block 0, async page read [ 224.119296][ T8020] Dev loop5: unable to read RDB block 0 [ 224.127566][ T5867] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 224.137941][ T8020] loop5: unable to read partition table [ 224.153209][ T8020] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 224.161115][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.166005][ T10] usb 1-1: USB disconnect, device number 13 [ 224.281180][ T5867] usb 2-1: Product: syz [ 224.288262][ T5867] usb 2-1: Manufacturer: syz [ 224.294669][ T5867] usb 2-1: SerialNumber: syz [ 224.305830][ T5867] usb 2-1: config 0 descriptor?? [ 224.315674][ T5867] hub 2-1:0.0: bad descriptor, ignoring hub [ 224.321625][ T5867] hub 2-1:0.0: probe with driver hub failed with error -5 [ 224.381536][ T5179] ldm_validate_partition_table(): Disk read failed. [ 224.388454][ T5179] Dev loop5: unable to read RDB block 0 [ 224.394109][ T5179] loop5: unable to read partition table [ 224.532764][ T5867] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 224.544058][ T5867] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 224.548386][ T5887] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 224.554089][ T5867] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 224.569591][ T5867] usb 2-1: media controller created [ 224.585067][ T5867] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 224.629994][ T5867] DVB: Unable to find symbol dib7000p_attach() [ 224.636256][ T5867] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 224.697963][ T5867] rc_core: IR keymap rc-dib0700-rc5 not found [ 224.707066][ T5867] Registered IR keymap rc-empty [ 224.730029][ T5814] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 224.737824][ T5867] dvb-usb: could not initialize remote control. [ 224.740742][ T5887] usb 4-1: Using ep0 maxpacket: 32 [ 224.752790][ T5887] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 224.755110][ T5867] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 224.760775][ T5887] usb 4-1: config 0 has no interface number 0 [ 224.789800][ T5887] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 224.815510][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.839643][ T5887] usb 4-1: Product: syz [ 224.843836][ T5887] usb 4-1: Manufacturer: syz [ 224.860788][ T5887] usb 4-1: SerialNumber: syz [ 224.877015][ T5887] usb 4-1: config 0 descriptor?? [ 224.896821][ T5887] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 224.911723][ T5814] usb 3-1: Using ep0 maxpacket: 16 [ 224.916512][ T5887] usb 4-1: selecting invalid altsetting 1 [ 224.927281][ T5887] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 224.944101][ T5814] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.954843][ T5814] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 224.963784][ T5814] usb 3-1: config 1 has no interface number 1 [ 224.964580][ T5887] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 224.972453][ T5814] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 225.008155][ T5887] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 225.023907][ T5814] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 225.036932][ T5887] usb 4-1: media controller created [ 225.042302][ T5814] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 225.050086][ T5887] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 225.055091][ T5814] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 225.080463][ T5814] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.093194][ T5814] usb 3-1: Product: syz [ 225.100016][ T5814] usb 3-1: Manufacturer: syz [ 225.105480][ T5814] usb 3-1: SerialNumber: syz [ 225.130302][ T8025] ------------[ cut here ]------------ [ 225.135922][ T8025] usb 2-1: BOGUS control dir, pipe 80000880 doesn't match bRequestType c0 [ 225.144459][ T8025] WARNING: drivers/usb/core/urb.c:411 at usb_submit_urb+0x1573/0x1910, CPU#1: syz.3.464/8025 [ 225.154632][ T8025] Modules linked in: [ 225.158672][ T8025] CPU: 1 UID: 0 PID: 8025 Comm: syz.3.464 Tainted: G L syzkaller #0 PREEMPT(full) [ 225.169425][ T8025] Tainted: [L]=SOFTLOCKUP [ 225.173735][ T8025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 225.183863][ T8025] RIP: 0010:usb_submit_urb+0x157e/0x1910 [ 225.189588][ T8025] Code: d2 74 5d 48 89 54 24 40 e8 ef 60 b7 fa 4c 89 ef e8 67 9b de fe 48 89 c6 48 8d 3d 3d e6 94 09 48 8b 54 24 40 45 89 f8 44 89 f1 <67> 48 0f b9 3a e9 c7 ed ff ff e8 c3 60 b7 fa 89 ee bf ff 00 00 00 [ 225.209344][ T8025] RSP: 0018:ffffc900047e7968 EFLAGS: 00010287 [ 225.215589][ T8025] RAX: ffffffff8c80efe0 RBX: ffff888074c8df00 RCX: 0000000080000880 [ 225.223609][ T8025] RDX: ffff8880223c1d60 RSI: ffffffff8c80efe0 RDI: ffffffff90e67d20 [ 225.231572][ T8025] RBP: ffff88805aaa4058 R08: 00000000000000c0 R09: 0000000000000000 [ 225.239974][ T8025] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888051d746a0 [ 225.242924][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 225.248239][ T8025] R13: ffff88805aaa40b0 R14: 0000000080000880 R15: 00000000000000c0 [ 225.264066][ T8025] FS: 00007f22dd9f66c0(0000) GS:ffff88812443c000(0000) knlGS:0000000000000000 [ 225.273212][ T8025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 225.279813][ T8025] CR2: 000020000001c000 CR3: 00000000355d7000 CR4: 00000000003526f0 [ 225.287788][ T8025] Call Trace: [ 225.291048][ T8025] [ 225.293964][ T8025] ? __init_swait_queue_head+0xca/0x150 [ 225.299536][ T8025] usb_start_wait_urb+0x10e/0x580 [ 225.304551][ T8025] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 225.310120][ T8025] ? __asan_memset+0x23/0x50 [ 225.314695][ T8025] usb_control_msg+0x328/0x4b0 [ 225.319513][ T8025] ? __pfx_usb_control_msg+0x10/0x10 [ 225.324774][ T8025] ? check_noncircular+0x97/0x160 [ 225.329809][ T8025] dib0700_ctrl_rd+0x1b5/0x320 [ 225.334575][ T8025] dib0700_i2c_xfer+0x460/0xd90 [ 225.339456][ T8025] __i2c_transfer+0x5d9/0x17f0 [ 225.344212][ T8025] ? __pfx___i2c_transfer+0x10/0x10 [ 225.349723][ T8025] ? rt_mutex_slowtrylock+0x93/0x100 [ 225.355263][ T8025] i2c_transfer+0x15f/0x380 [ 225.359744][ T8025] i2cdev_ioctl_rdwr+0x3ec/0x700 [ 225.364801][ T8025] i2cdev_ioctl+0x19d/0x830 [ 225.369292][ T8025] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 225.374348][ T8025] ? selinux_file_ioctl+0x139/0x290 [ 225.379542][ T8025] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 225.384634][ T8025] __x64_sys_ioctl+0x18e/0x210 [ 225.389386][ T8025] do_syscall_64+0x106/0xf80 [ 225.393977][ T8025] ? clear_bhb_loop+0x40/0x90 [ 225.398645][ T8025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.404544][ T8025] RIP: 0033:0x7f22df79c799 [ 225.408957][ T8025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.428606][ T8025] RSP: 002b:00007f22dd9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.437065][ T8025] RAX: ffffffffffffffda RBX: 00007f22dfa15fa0 RCX: 00007f22df79c799 [ 225.445038][ T8025] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000004 [ 225.453032][ T8025] RBP: 00007f22df832c99 R08: 0000000000000000 R09: 0000000000000000 [ 225.461262][ T8025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.469418][ T8025] R13: 00007f22dfa16038 R14: 00007f22dfa15fa0 R15: 00007ffdd298cba8 [ 225.477379][ T8025] [ 225.480410][ T8025] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 225.487664][ T8025] CPU: 1 UID: 0 PID: 8025 Comm: syz.3.464 Tainted: G L syzkaller #0 PREEMPT(full) [ 225.498417][ T8025] Tainted: [L]=SOFTLOCKUP [ 225.502719][ T8025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 225.512757][ T8025] Call Trace: [ 225.516029][ T8025] [ 225.518943][ T8025] dump_stack_lvl+0x100/0x190 [ 225.523617][ T8025] vpanic+0x552/0x970 [ 225.527588][ T8025] ? __pfx_vpanic+0x10/0x10 [ 225.532090][ T8025] panic+0xd1/0xe0 [ 225.535796][ T8025] ? __pfx_panic+0x10/0x10 [ 225.540203][ T8025] check_panic_on_warn.cold+0x19/0x34 [ 225.545558][ T8025] ? usb_submit_urb+0x1573/0x1910 [ 225.550578][ T8025] __warn.cold+0x191/0x348 [ 225.554992][ T8025] __report_bug+0x296/0x3d0 [ 225.559483][ T8025] ? usb_submit_urb+0x1573/0x1910 [ 225.564497][ T8025] ? __pfx___report_bug+0x10/0x10 [ 225.569527][ T8025] ? irqentry_exit+0x180/0x670 [ 225.574275][ T8025] ? lockdep_hardirqs_on+0x78/0x100 [ 225.579474][ T8025] ? usb_submit_urb+0x157e/0x1910 [ 225.584503][ T8025] report_bug_entry+0xe1/0x290 [ 225.589266][ T8025] ? usb_submit_urb+0x157e/0x1910 [ 225.594270][ T8025] handle_bug+0x1cd/0x2a0 [ 225.598589][ T8025] exc_invalid_op+0x17/0x50 [ 225.603082][ T8025] asm_exc_invalid_op+0x1a/0x20 [ 225.607929][ T8025] RIP: 0010:usb_submit_urb+0x157e/0x1910 [ 225.613565][ T8025] Code: d2 74 5d 48 89 54 24 40 e8 ef 60 b7 fa 4c 89 ef e8 67 9b de fe 48 89 c6 48 8d 3d 3d e6 94 09 48 8b 54 24 40 45 89 f8 44 89 f1 <67> 48 0f b9 3a e9 c7 ed ff ff e8 c3 60 b7 fa 89 ee bf ff 00 00 00 [ 225.633171][ T8025] RSP: 0018:ffffc900047e7968 EFLAGS: 00010287 [ 225.639234][ T8025] RAX: ffffffff8c80efe0 RBX: ffff888074c8df00 RCX: 0000000080000880 [ 225.647188][ T8025] RDX: ffff8880223c1d60 RSI: ffffffff8c80efe0 RDI: ffffffff90e67d20 [ 225.655156][ T8025] RBP: ffff88805aaa4058 R08: 00000000000000c0 R09: 0000000000000000 [ 225.663122][ T8025] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888051d746a0 [ 225.671090][ T8025] R13: ffff88805aaa40b0 R14: 0000000080000880 R15: 00000000000000c0 [ 225.679059][ T8025] ? usb_submit_urb+0x1569/0x1910 [ 225.684093][ T8025] ? __init_swait_queue_head+0xca/0x150 [ 225.689622][ T8025] usb_start_wait_urb+0x10e/0x580 [ 225.694637][ T8025] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 225.700183][ T8025] ? __asan_memset+0x23/0x50 [ 225.704772][ T8025] usb_control_msg+0x328/0x4b0 [ 225.709524][ T8025] ? __pfx_usb_control_msg+0x10/0x10 [ 225.714806][ T8025] ? check_noncircular+0x97/0x160 [ 225.719848][ T8025] dib0700_ctrl_rd+0x1b5/0x320 [ 225.724599][ T8025] dib0700_i2c_xfer+0x460/0xd90 [ 225.729458][ T8025] __i2c_transfer+0x5d9/0x17f0 [ 225.734224][ T8025] ? __pfx___i2c_transfer+0x10/0x10 [ 225.739403][ T8025] ? rt_mutex_slowtrylock+0x93/0x100 [ 225.744676][ T8025] i2c_transfer+0x15f/0x380 [ 225.749163][ T8025] i2cdev_ioctl_rdwr+0x3ec/0x700 [ 225.754102][ T8025] i2cdev_ioctl+0x19d/0x830 [ 225.758586][ T8025] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 225.763615][ T8025] ? selinux_file_ioctl+0x139/0x290 [ 225.768821][ T8025] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 225.773835][ T8025] __x64_sys_ioctl+0x18e/0x210 [ 225.778605][ T8025] do_syscall_64+0x106/0xf80 [ 225.783176][ T8025] ? clear_bhb_loop+0x40/0x90 [ 225.787837][ T8025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.793727][ T8025] RIP: 0033:0x7f22df79c799 [ 225.798121][ T8025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.817718][ T8025] RSP: 002b:00007f22dd9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.826139][ T8025] RAX: ffffffffffffffda RBX: 00007f22dfa15fa0 RCX: 00007f22df79c799 [ 225.834101][ T8025] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000004 [ 225.842060][ T8025] RBP: 00007f22df832c99 R08: 0000000000000000 R09: 0000000000000000 [ 225.850007][ T8025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.857953][ T8025] R13: 00007f22dfa16038 R14: 00007f22dfa15fa0 R15: 00007ffdd298cba8 [ 225.865976][ T8025] [ 225.869270][ T8025] Kernel Offset: disabled [ 225.873581][ T8025] Rebooting in 86400 seconds..