last executing test programs: 34.883478758s ago: executing program 4 (id=1308): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000480)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time={0x3, 0x10000}, {}, {}, @time=@time={0xa, 0x4}}], 0x38) read$snapshot(r1, 0x0, 0xffffffbf) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000000)) (fail_nth: 3) 34.134905077s ago: executing program 4 (id=1311): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_LLC_GET_PARAMS(r4, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x44, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_FIRMWARE_NAME={0x6, 0x14, ':%'}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 32.030596723s ago: executing program 4 (id=1316): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) pipe(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/169, 0xa9) read$msr(r0, &(0x7f0000019680)=""/102384, 0x18ff0) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2000a804) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18e4ff892880d7874ed9d1583d82bd3d14000000000000000015000000007912c800000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r2, 0x0, &(0x7f0000000500)=""/120}, 0x20) 31.396928314s ago: executing program 4 (id=1318): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0xf) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) unshare(0x400) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x10c5408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r4, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x2, 0x3}) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendto$inet(r0, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) 30.180070422s ago: executing program 4 (id=1321): r0 = getpid() sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d40"], 0x6c}}, 0x0) sendmsg$NFT_MSG_GETSET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x14, 0xa, 0xa, 0x101}, 0x14}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x8000) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000240)="957bc3871f54da01138019ebbb3587e39b0af28eea1dc1c5b6b0f27c1111d0f8b71e196a9bb19b466172df083b602f37901653c0b41e9ea3218f6680923cb44fcde97805fe3eaf057d955a0de7c0d566c5549dfde8c0703c0f633cd8c5f98fc10f484ec2ab2611e94e", 0x69}, {&(0x7f0000000380)}, {0x0}, {&(0x7f0000000140)="6b7a240a296a37fa753082010bbab360f5b4702580e51f24741ca0e156030aea99d1b437951913173b3187878dc29f77c7a9ec2bf03cada5b063cb819d7f8bf1dd40a6db89c1a295", 0x48}, {0x0}, {&(0x7f0000000300)="d4eb0cb9b5afe8a92397fd60", 0xc}], 0x6, &(0x7f00000005c0)=[@tclass={{0x14, 0x29, 0x43, 0x2}}], 0x18}}], 0x1, 0x40004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x11, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000004851000000600000018000000", @ANYRES32, @ANYBLOB="0000000000000004180000000000001000000000000200009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100200000ffffb702000008000000b50a00000000000085000000b400000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000001a00010029bd700000000000022020050003c80000000000080002000a01010008000100ac1414aa08000300", @ANYRES32=r8], 0x60}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x33fe0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="84000000", @ANYRES16=0x0, @ANYBLOB="00032dbd7000fbdbdf25190000000c00018008c1a9000100000064000180080003000300000008000100", @ANYRES32=r0, @ANYBLOB="08000300000000001400020076657468315f746f5f627269646765000800030003"], 0x84}, 0x1, 0x0, 0x0, 0x8004}, 0x40008d4) r9 = syz_io_uring_setup(0x895, &(0x7f0000000140)={0x0, 0x8c36, 0x80, 0xfffffffe, 0xbfdffddc}, &(0x7f00000001c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_SYMLINKAT={0x26, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x1}) io_uring_enter(r9, 0x47f6, 0x0, 0x0, 0x0, 0x0) r12 = socket(0x10, 0x3, 0x0) write(r12, &(0x7f0000000240)="aefc00001a0025f01d85bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) 26.44625823s ago: executing program 4 (id=1330): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) io_cancel(0x0, 0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f0000000300)={0xc36, 0x0, 0x1}) prlimit64(0xffffffffffffffff, 0xe, &(0x7f0000000140)={0xa, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000000)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0x40c9}, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = socket(0x10, 0x3, 0x0) syz_usb_connect(0x4, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf8, &(0x7f0000000400)=ANY=[@ANYBLOB="f8030ee82fd82ab94ee190edf2ebb1f2162d67792ecbf64daf9c3aede1567ec8fd7a021656e6484f23cc4b13e0dee0f10aa917b9663386bea2042ca60bc5761edd82d08ad50613c42bea580ddfd758911bd22a60652ec0f141dc3c010ba47d844bc88ae941c22b2f1b07ac1bff6a6388edaf84b12dfa44f55c09a264dd1ac264a77b762e11bc17dfd49a00b39ac9e3f45456a4013789c9e2c256340bfe515fe1446279faafa44b3de1444ce4d3511612935b756926ea9c91ee7706b998e8f0bf9486e445d2911a6b9f77ab02ff4f919da523f201b7bd181628969f7c3b2ee11798e64a4b6ca8ac4ad5ee0b8ea20d5dbd814d830d60fbbad9c681bfa1a37e"]}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000012c0)=0x3, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r3 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240), 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r3, 0x0, 0x0) sendmsg$inet6(r1, &(0x7f0000001500)={0x0, 0x0, 0x0, 0xfffffffffffffe28}, 0x40001080) syz_genetlink_get_family_id$nl80211(0x0, r3) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f00000008c0), 0x0, 0x40040c0) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000100)={0x2, 0x80, 0x200, 0x2, 0x7, 0x3, 0x4, 0x4}, 0x20) recvmmsg(r1, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, 0x0) socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3c0, 0xffffffff, 0xffffffff, 0x3c0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0xffffff00], [0xff000000, 0xffffff00, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x3a}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0x84e9, 0x3}}, @common=@ipv6header={{0x28}, {0x24, 0x3, 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@mcast1, @rand_addr=' \x01\x00', [0xff, 0xffffff00, 0xffffffff, 0xff], [0x0, 0x0, 0xff, 0xffffffff], 'veth0_to_team\x00', 'gretap0\x00', {}, {0xff}, 0x2f, 0xd1, 0x2, 0x4}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}, {0x800000}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x4000000000, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x4}, {0xffffffffffffffff}}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x3, {0xa2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4f0) socket$nl_generic(0x10, 0x3, 0x10) 26.127855468s ago: executing program 32 (id=1330): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) io_cancel(0x0, 0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f0000000300)={0xc36, 0x0, 0x1}) prlimit64(0xffffffffffffffff, 0xe, &(0x7f0000000140)={0xa, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000000)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0x40c9}, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = socket(0x10, 0x3, 0x0) syz_usb_connect(0x4, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf8, &(0x7f0000000400)=ANY=[@ANYBLOB="f8030ee82fd82ab94ee190edf2ebb1f2162d67792ecbf64daf9c3aede1567ec8fd7a021656e6484f23cc4b13e0dee0f10aa917b9663386bea2042ca60bc5761edd82d08ad50613c42bea580ddfd758911bd22a60652ec0f141dc3c010ba47d844bc88ae941c22b2f1b07ac1bff6a6388edaf84b12dfa44f55c09a264dd1ac264a77b762e11bc17dfd49a00b39ac9e3f45456a4013789c9e2c256340bfe515fe1446279faafa44b3de1444ce4d3511612935b756926ea9c91ee7706b998e8f0bf9486e445d2911a6b9f77ab02ff4f919da523f201b7bd181628969f7c3b2ee11798e64a4b6ca8ac4ad5ee0b8ea20d5dbd814d830d60fbbad9c681bfa1a37e"]}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000012c0)=0x3, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r3 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240), 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r3, 0x0, 0x0) sendmsg$inet6(r1, &(0x7f0000001500)={0x0, 0x0, 0x0, 0xfffffffffffffe28}, 0x40001080) syz_genetlink_get_family_id$nl80211(0x0, r3) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f00000008c0), 0x0, 0x40040c0) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000100)={0x2, 0x80, 0x200, 0x2, 0x7, 0x3, 0x4, 0x4}, 0x20) recvmmsg(r1, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, 0x0) socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3c0, 0xffffffff, 0xffffffff, 0x3c0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0xffffff00], [0xff000000, 0xffffff00, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x3a}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0x84e9, 0x3}}, @common=@ipv6header={{0x28}, {0x24, 0x3, 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@mcast1, @rand_addr=' \x01\x00', [0xff, 0xffffff00, 0xffffffff, 0xff], [0x0, 0x0, 0xff, 0xffffffff], 'veth0_to_team\x00', 'gretap0\x00', {}, {0xff}, 0x2f, 0xd1, 0x2, 0x4}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}, {0x800000}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x4000000000, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x4}, {0xffffffffffffffff}}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x3, {0xa2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4f0) socket$nl_generic(0x10, 0x3, 0x10) 9.81790257s ago: executing program 0 (id=1363): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r4, 0x802c550a, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r5 = memfd_create(&(0x7f0000000a00)='/dev/loop#\x00\xee\b\xce\xde\xe9\x8d\xd2\xd59\xe8\xda\b\xd6\xb2\x15\xf6F\xb8\xb4{r.\xd2\xea\xec\xdbXe&J \xe9\x16\x82\xe8=\x83\x88sN\x83N`\xf9\xec\xe1\xb16\xfb*\xf5\xd5\\\xa7\xebe\xbe\x9d\xd7\xf5\xb9<\xb2\xc4\xf9:\xef\xc0g\xc3\xb5\x7f\xc0\xcck.5=\xcc\x10Y\xad^*\x10\x00\x00\x00\x00\x00\x00\x00\x0e%\x84\x95bXy\x81;o\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa9{b\xab\x91\x88\xba\xa5J\xfd\xd2\x96R\x06\xeeP\x0f\xb0\xad_\x0e\xf6\xe7k\xbf\x93)\x02yX\x91\xc0\x8c\xeb\xd9\xda=\\\xa0\xdeke\xb6\xef\x10\xd2\xbd9\x87<[BKq\t*t\x9e\xf9\xa6\xb5\xda\tb\xcc%?\x14Y\x9b\x18nx\x19\x11\xb7\x9d~\xc5{O\xd0S\xbdi\xf8\"P>4\x05E|h?\x0f\xf5\xf8\x8c\xce\xebXN\xb7\xc0F\xbao\xf7\xab\xedO\x96\xa1(\n\x1e\xf9\xbe/.\xe2^\xb0\xb6{\x1fdX\x100v\xab\xce\x05\x00i\x85\xf63\x05\b\xd8\xeb\xdf\x00\x00]N\xe1\x9di&\r\xd2pw\x85\vQ \x82v\x8a7\xb6\xf8\x1c\x8c\xf0\xaf\xfa\x17\xbeD\a\vM\x87\xc0Q\x94\xd4\xd3\xc7I@Z\t\xa9\xf0\x9d4c\xb1^\xeeF\x96\xa1{OV\xe0\x1e#\xb3w\xc7\x87\xdd\'c\xcf.\x04\x8b\x9e\xef-b\xbe\x17T\xee\xe1\xf7\'+s\x15\xeb\xb1D\x86\x93\x1e\xf9\xf1L\x0f\x9b7/\xd9D\x91\xc47hI\xbc\x13.@R\x8b\xe2x\x97:A\xf1\xb6\xe2\xc8\xb2\x9bD\xb2P\xdc\xd4\xb1\xa50\x9f\x83~)\x9b7-\x80&r\xbc\xf60x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x48000009, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4c, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8, 0xe}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_QUANTUM={0x5, 0xf}]}}]}, 0x78}}, 0x0) r9 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r10 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000000e000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x35}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r11}, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r10, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) syz_init_net_socket$netrom(0x6, 0x5, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r10, 0x100000000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x40) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000100)={0x10000, 0x116000, 0x8}) r12 = syz_kvm_add_vcpu$x86(r9, &(0x7f0000000000)={0x0, &(0x7f0000000140)=[@set_irq_handler={0xc8, 0x20, {0x18, 0x1}}, @nested_load_code={0x12e, 0x55, {0x1, "b9560900000f320f3036f30f01f8b9800000c00f3235008000000f300f09470f494007b805000000b9003800000f01d90fbd629fc463f960d7000f01cb"}}, @rdmsr={0x66, 0x18, {0x8cb}}, @set_irq_handler={0xc8, 0x20, {0xb0, 0x1}}, @wrmsr={0x65, 0x20, {0x9c4, 0x1}}, @enable_nested={0x12c, 0x18}, @cpuid={0x64, 0x18, {0x3, 0x8}}], 0xfd}) ioctl$KVM_RUN(r12, 0xae80, 0x0) 9.442098381s ago: executing program 2 (id=1364): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000040000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$can_bcm(0x1d, 0x2, 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0x80001) connect$can_bcm(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc048aeca, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, 0x0) close(0x3) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, 0x0) 8.318500385s ago: executing program 2 (id=1365): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c00)=ANY=[@ANYBLOB="400000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310001000014000380100000f20c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x0, 0x1}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3}}, 0xe8) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x10}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a00000000000000", @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r4 = socket(0x2c, 0x3, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x11, 0x4, 0x4, 0xff}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r5, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r4}, 0x20) 8.181182348s ago: executing program 2 (id=1366): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x8, @remote, 0x9b}, 0x1c) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) mount$fuse(0x0, 0x0, 0x0, 0x280449c, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x28, r5, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}]}]}, 0x28}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x20, r7, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) 7.699414681s ago: executing program 3 (id=1368): r0 = socket$inet6(0xa, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000180)) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0xc, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffc}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) creat(&(0x7f0000000240)='./file0\x00', 0x0) chmod(&(0x7f0000000140)='./file0\x00', 0x50) syz_emit_ethernet(0xfffffffffffffddf, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c200000000000000000081003b000800401e00000064000005069078ac1414bbac14143f94005577ab379e50cadde6ff3f4d004400c5b17f00000100000002e00000017fffffff4400052000008000000000f1000000000000000000000000000000000100004e2400004e220000000000"], 0x0) 7.032518099s ago: executing program 2 (id=1369): ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, 0x0) r0 = add_key$keyring(&(0x7f00000003c0), &(0x7f0000000400)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) add_key$user(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000440)='<', 0x1, r0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) kexec_load(0x0, 0x0, 0x0, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r5 = bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x17, 0x5, 0x81, 0xa6f, 0x14000, 0xffffffffffffffff, 0x8, '\x00', 0x0, r4, 0x2, 0x2, 0x2, 0x0, @void, @value, @value=r5}, 0x50) syz_usb_connect(0x6, 0x1fc, &(0x7f0000000780)=ANY=[@ANYBLOB="12015002b8005108101407a0683e010203010902ea01030e00300309040309027f54cc00090502040004040403800109661bede31b6d40ffd5a6457d3483a7c64a2cf09c6b30e3afe9caf13ed9a2924ed053d2b4b24aedb4035d4212c8a5f7df3b67916187c245f81035efe9b53a8d79988d4b00a8aa5926f8b9103fd0e543cebd14ca5d0825146c7ff12ef0b8fe612538542d6f5c9fdc7894374795b8ccb6bdb303b42aa86746d3370ad7a31c090504104000050209072501830200040725018101070009045b060c317135060905051008000600d30725018002000009050610200080ff0407250101060200090500100004090401090504104000ab0005090505022000060d0d48007672bf7524ef90e0a086de3562bf356642bc0201de8fa807c3b757b1c182c0f4c59af7c59293e1bc41956912be0eafd96bdf03aa6117bc3e50fbee59a6e5dfc7206516e091fce94c0c778a134b5368d1af31d240535b0725018002010009050b08000401a9050725010332f60b0725010206ac15090502140000c7070e0905010400020805800905051000020802ae07250103fbff0009050010400008000309050c040002030d07410f8c1ea652c620acd24cbf2bfeb921dfc3f2c147f7c05a53e4f7db6742a64c76fe8d2f319387c80165b1ad6b9054e93ae7385d785e1c040f2c4e5c2388ef8791090509002000010802"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1400000004000000040000000200020000000000", @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="8001"], 0x50) syz_open_procfs$namespace(0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x7}}, 0x14}}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r7, &(0x7f0000000380)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r8, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x48) listen(r8, 0x80) 6.79153634s ago: executing program 3 (id=1370): r0 = syz_open_dev$video(&(0x7f0000000080), 0xa7, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) r2 = fcntl$getown(r0, 0x9) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000080)={0x50, 0x0, r5, {0x7, 0x29, 0x9, 0xffffffff90acedc6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, &(0x7f00000083c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be00", 0x2000, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="d800000000000000f9ffffffffffffff01000000000000000200000000000000030000000000000006000000000000000500000003000000060000000000000009000000000000000000000000000000ff0000000000000003000000000000000200000000000000ffffff7f60e800000300000005800000ff030000", @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="040000000400000000000000000000000000200037050000000000002b000000090000003a2d285cc980000000c30000f3397dd86d4d928d24d3a4c80c2ce0be09628e0000000000002b133b0000000000000000857d50709ba8426b9d898c728743503e2de07b85ca4d62d7bc0d04d57292296fe82b7bdd2ab872e22f30dd58c410e8bc1a5eceb2e06d52036ef67c6d4d1b540ede9f6a6bcc6da7ab186fc51de3976e17e6"], 0x0, 0x0, 0x0}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r8, 0x0) ftruncate(r8, 0xc17a) write$eventfd(r8, &(0x7f0000000100)=0x8, 0x8) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={r2, r3, r7}, 0xc) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f00000004c0)={0x1, @capture={0xe7, 0x0, {0x0, 0x10001}, 0x0, 0x33}}) 6.634761268s ago: executing program 0 (id=1372): ioctl$FBIOBLANK(0xffffffffffffffff, 0x4611, 0x3) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept$alg(r2, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000600), 0xfec8) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}, 0x265c}], 0x1, 0xcb, 0x0) 6.556549757s ago: executing program 3 (id=1373): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x100) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) prlimit64(0x0, 0xd, 0x0, &(0x7f0000000340)) connect(r0, &(0x7f0000000000)=@hci={0x1f, 0x2, 0x3}, 0x80) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x21, &(0x7f0000000000)=ANY=[@ANYBLOB='nr_blocks=e,n\f\x00\x00\x00\x00\x00\x00\x00=']) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x845}, 0x24008004) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000772904202404019957c201020301090210000904430002317d55002a05020200020200000905820200020000000000000000"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x2, 0x6, 0x5}, 0x14}}, 0x0) personality(0xfe47fef9f5ff7379) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000480)={&(0x7f0000000640)={0x54, 0x0, 0x10, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x72}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4002}, 0x24000000) 5.943976553s ago: executing program 1 (id=1374): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000040000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) ioctl$MON_IOCQ_URB_LEN(r1, 0x9201) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4004881) recvmsg$unix(0xffffffffffffffff, 0x0, 0x2000) close(0x3) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.878280971s ago: executing program 0 (id=1375): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c00)=ANY=[@ANYBLOB="400000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310001000014000380100000f20c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x0, 0x1}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3}}, 0xe8) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x10}}, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a00000000000000", @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r5 = socket(0x2c, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x11, 0x4, 0x4, 0xff}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r6, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r5}, 0x20) 4.590146085s ago: executing program 3 (id=1376): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = syz_clone(0x84008000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) (async) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) (async) r3 = socket$netlink(0x10, 0x3, 0x6) setsockopt(r3, 0x10e, 0xb, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r4 = inotify_init() fchmod(r4, 0x40) (async) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x2d) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000032c0)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) 4.147314813s ago: executing program 0 (id=1377): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfffffffffffffe9e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r2 = syz_io_uring_setup(0x126b, &(0x7f0000000500)={0x0, 0x72de, 0x0, 0x0, 0x261, 0x0, r1}, &(0x7f0000000140), &(0x7f0000000280)) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x10, 0x803, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x8, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2b}, 0x94) openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r2, 0x2, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hfsplus\x00', 0x2000010, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000008c0)={0x53, 0xfffffffffffffffe, 0x6, 0x40, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000800)="5cc1ca0ca500", 0x0, 0x5, 0x31, 0x0, 0x0}) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) io_setup(0x5, &(0x7f0000000180)) 3.406445394s ago: executing program 5 (id=1331): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x80000b) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000200), 0x2, r0}, 0x38) 3.210273874s ago: executing program 2 (id=1378): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3629ff075475e4bd6e43be1712bf8b4dc", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412b", 0xf}, {&(0x7f0000000140)="ebe3", 0x2}], 0x2}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 2.704641404s ago: executing program 1 (id=1379): r0 = socket$inet6(0xa, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000180)) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') read$FUSE(r5, &(0x7f00000005c0)={0x2020}, 0x2020) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0xc, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffc}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) creat(&(0x7f0000000240)='./file0\x00', 0x0) chmod(&(0x7f0000000140)='./file0\x00', 0x50) syz_emit_ethernet(0xfffffffffffffddf, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c200000000000000000081003b000800401e00000064000005069078ac1414bbac14143f94005577ab379e50cadde6ff3f4d004400c5b17f00000100000002e00000017fffffff4400052000008000000000f1000000000000000000000000000000000100004e2400004e220000000000"], 0x0) 2.703539521s ago: executing program 2 (id=1380): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = syz_io_uring_setup(0x4280, 0x0, &(0x7f0000000540), &(0x7f0000000580)) syz_io_uring_setup(0x717c, &(0x7f00000005c0)={0x0, 0xebf8, 0x20000, 0x0, 0x1aa, 0x0, r0}, &(0x7f0000000640), &(0x7f0000000680)) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0xf1}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {}, {0x18, 0x6, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_usb_connect(0x0, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r8, 0x0, 0x0) syz_usb_control_io$printer(r8, 0x0, 0x0) r9 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r9, 0x707, &(0x7f0000000280)={&(0x7f00000001c0)=[{0x7, 0x211, 0x0, 0x0}, {0x50, 0x4000, 0x0, 0x0}, {0x3, 0x1000, 0x0, 0x0}], 0x3}) syz_usb_connect(0x6, 0x180, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x31, 0x2b, 0xb5, 0x8, 0xaf0, 0x6911, 0xe731, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x16e, 0x1, 0x1, 0x0, 0x0, 0x5, [{{0x9, 0x4, 0xda, 0x0, 0xc, 0x88, 0xd6, 0xcb, 0x0, [], [{{0x9, 0x5, 0x8, 0x2, 0x10, 0x4, 0x7, 0x4, [@generic={0x21, 0xd, "56df94007e85f07fc1e302b9bcf7d277493f7cd77603b3b818ca51b642d7c6"}, @generic={0x29, 0x23, "4187050410f565e935826f67d5218c86bdb1c4007cafd4414d3b41a2a2deea8d236b0219b7e82d"}]}}, {{0x9, 0x5, 0x8a, 0x19, 0x8, 0x4, 0x8, 0x18, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x1, 0x8}]}}, {{0x9, 0x5, 0xb, 0x0, 0x200, 0x8, 0x8c, 0x5}}, {{0x9, 0x5, 0x0, 0x0, 0x200, 0x4, 0xa, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0x1ff0}]}}, {{0x9, 0x5, 0xb, 0x4, 0x19f, 0x9, 0xa, 0x3, [@generic={0x2, 0x2}]}}, {{0x9, 0x5, 0x3, 0x1, 0x400, 0x5, 0x6, 0x4}}, {{0x9, 0x5, 0x80, 0x10, 0x200, 0xe, 0x5}}, {{0x9, 0x5, 0xb, 0x8, 0x8, 0x1, 0x0, 0xff}}, {{0x9, 0x5, 0x4, 0x10, 0x8, 0x92, 0x2}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0x7, 0x81, 0x81, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0xd0, 0x2}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x0, 0x2, 0x7, [@generic={0x1a, 0x4, "03c23da19f3dfa2936cd35d690f7a418eb8c8ba6132f01fb"}]}}, {{0x9, 0x5, 0x5, 0x1, 0x20, 0x9d, 0x9b, 0x1, [@generic={0x75, 0xc, "7277cc694627f01f2935a0f3989d8dbe6a0206874dd638259505733ddffc88767a64237482096693ff95194b9860a978595ed9dac3326d176c36baffd6bbc4a6350a6a83223452311fda0db2841ec7adb005c6d37fc657b1eb6afa33d339ae41c71a3b14b800d9fb7f64dcef08ea836f65e443"}]}}]}}]}}]}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000900)="5490", 0x2}], 0x1}, 0x4048841) getpeername$packet(r7, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000440)=0x14) 2.590168379s ago: executing program 3 (id=1381): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xffffffff}}}, 0x32) 1.889178934s ago: executing program 5 (id=1382): socket$inet_sctp(0x2, 0x0, 0x84) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000240)={0x8, 0x1, 0x0, 'queue0\x00', 0x8000000}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000340)="b8db008ee8f30f0122670fc71c1b3e0f01c3640f01d167f39863130f01c20fda1b66b8010000000f01d9", 0x2a}], 0x1, 0x1, 0x0, 0x62) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x2000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000440)={0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8}}) io_setup(0x2, 0xfffffffffffffffe) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaab4d1136088a84a0081"], 0x16) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r10, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r10, 0x84, 0x15, &(0x7f0000000200), 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r10, 0x84, 0x64, &(0x7f00000004c0)=[@in6={0xa, 0x4e23, 0x401, @loopback}, @in6={0xa, 0x4e22, 0x9, @rand_addr=' \x01\x00', 0x10}], 0x38) sendto$inet6(r10, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x30000000, @loopback, 0xf}, 0x1c) writev(r10, &(0x7f0000000100)=[{&(0x7f0000000180)="c2", 0x1}], 0x1) write$UHID_SET_REPORT_REPLY(r10, &(0x7f00000007c0)=ANY=[], 0xffe0) close_range(r1, 0xffffffffffffffff, 0x0) 1.881361315s ago: executing program 0 (id=1383): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e22, @remote}, 0x10) io_uring_setup(0x1458, &(0x7f00000001c0)={0x0, 0x85d3, 0x4, 0x2, 0x178}) r1 = socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_io_uring_setup(0x24fa, 0x0, &(0x7f0000000100), 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x1000089}, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000240), 0x200800, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) connect$bt_l2cap(r5, &(0x7f00000000c0)={0x1f, 0x80, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r6 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000040)={{0xa, 0x4e23, 0x7ff, @local, 0xffffffff}, {0xa, 0x4e23, 0x0, @private2, 0x8}, 0xffffffffffffffff, {[0xfffffff5, 0x3, 0x5, 0x7, 0xff, 0xfffffffe, 0x4, 0x8]}}, 0x5c) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000001, 0x2052, r6, 0x4b000) close_range(r2, 0xffffffffffffffff, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="9800000009060101000000528785e71e0f61f16240e300000000000200000605000100070000007c000880100007800c001b4000000000000000090c00078008000940000000041c0007801800018014000240fe880000000000000000000000000001100007800c00184000000000000000cd0c00078008000a40000000040c00078008000640000001000c00078005000700330000000c0007800500030002000000"], 0x98}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'hsr0\x00'}) socket$nl_route(0x10, 0x3, 0x0) 1.758028496s ago: executing program 1 (id=1384): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r2, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x110, 0xd, {0x0, @loopback=0x7f000300, @multicast2}}}], 0x20}, 0x4044088) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) madvise(&(0x7f0000834000/0x1000)=nil, 0x1000, 0x9) r3 = getpid() mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0x10, 0xffffffffffffffff, 0x200000) migrate_pages(0x0, 0x5, &(0x7f0000000040)=0x9, &(0x7f0000000080)=0x272) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4) keyctl$get_persistent(0x16, 0xffffffffffffffff, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r4, &(0x7f00000006c0)=ANY=[@ANYRESDEC=r4, @ANYBLOB="b8f478a1e13e2d5fca7bbe420352e3a0518471582ee547b989ffc736054ad824fed512bddfe0f2bf40dcb9aa48d38e7c7736bcfab37f95e248a7b6cd31726b24e443cccbecf17a0df64806f23409bbd76d6748a0ae4bbac366927a070073333124e3e8505ee200f62db94d12161d5821b7135b579bfac0de03a7b20118abbf3646eb27cc945820d98ac4a96d22d5e992c4d6e2037cffd53105477257a40f210896a3a1b054756b95bfe3f94b56c898f4aaeee6e84a91bf7d96d53443e39f434dcb0a7af1f82a4933128b7ae17686fc7f2b75f2a195a651dbd3937e3081120b9518c2256a6d771eb4cf849fc24762", @ANYRES32=0x0, @ANYRES32=0x0], 0x1ec) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe8000000000000000000000000000bbfc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000007f000001000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff000000000000ee001f00000000000000feffffffffffffff02000000fcffffff070000002abd7000043500000a0001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb1000000080008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r7}, 0x14) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 1.561717147s ago: executing program 3 (id=1385): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c40000000000109022472510000000009040000120701030009050102000000000009058202"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000040)='hpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="180000003d000107"], 0x18}}, 0x880) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) socket$tipc(0x1e, 0x5, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'veth0_vlan\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000000)={@private2, 0x0, r7}) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000040)={@private2, r7}, 0x14) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000001000010029bd7000fcdbdf2500000000", @ANYRES32=r7, @ANYBLOB="3a8d04005a10000008000400440000003cfeca652dfefec1385909000000000000003aa5e5f0f3e1f7e2472f9a08e572ef2ccbd659b1625497a86055c72dc96e4face0c53925144eb419e65095d7ff820db18efd6343bf4dee7057c7cd194a9b62bc29cf448cdfe8081c8279d0d88efb3fedbf14bf3a5548c13ef27ba9245ea03a23b9a6670e90e0462a0117bb8a60c37c691aa6d6e7dff8c9ebe9d00c0bbe444be32859af1d01da6b981c98c00c5b35f1be8b76885e573392c70f2d024a5f0ca3416bef8cff18b6fc60f70b68bd51b3ac11cb265cc3db6df4d8d116fe95851c4bde2d6a8fbd8532775105d47e707bff8a78b81cb63e8dd16806000000018a6005921846a9a70c0000000000000003353cd39b05d92817aeaa2291553bd9111cbd4451b1e23ead553350be3e34e33e376f73d7f07151e366dc3a3360c0d69ff0d6ae345448c15ed70e355a8a983dd553a499d61d45546d37727d53313a7ceade325a86ecb2761b00524c7e13c79c159686e6a23d885d0dc81d22c5f50a4c6e25e6f383627d9450618b3570145b354f3c12422afb60d06c65a63ccf7ed97f820d30864f116ce26cbc8f2475b2aed7eb167baed836bf0178fb8b49a30f5e55a376ec"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x200000000000000c, &(0x7f00000000c0)}) 1.46699417s ago: executing program 0 (id=1386): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x10, 0x765b, 0x100000000, 0x2b06, 0x7, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x8c842, 0x0) r5 = syz_open_dev$rtc(&(0x7f0000000300), 0xffc, 0x20000) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {r5}}, './file0\x00'}) unshare(0x62040200) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x70}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(0xffffffffffffffff, 0x4018f50b, &(0x7f0000000100)={0xfffffffb, 0x0, 0x40}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="130000004e007f049e3ab018a75ab611b876", 0x12}], 0x1}, 0x0) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) unshare(0x2000000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000140)={0x4, 0x61f290e6, 0x5, 0xff, 0x4af, 0xa75}) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 1.235163653s ago: executing program 1 (id=1387): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x40940, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000003c0)=0x2) readv(r0, &(0x7f0000000600)=[{&(0x7f00000002c0)=""/135, 0x87}], 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x2) 1.138167753s ago: executing program 5 (id=1388): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000010000000000000a50000000060a0904000000000000000002000003240004802000018008b87cd8c9bcc916585a816469310ec12a006300848514f79811ea64cd556c6f6700149a4d5e9929038ffb02000008000540000800000000000000797a30000000000900020073e756a404dc48b06a13daec0d53c7797a320000000000001100010000000000000000000000000a4e78967d1f2a0d7eaa949a0fd79ab28e465f482c9a2f9cf9f12b44a10de7f93a1c4f5fdd096c6e93c66d17b5db73c4cb3f1b735947eac3d67e8220e6bebc2512dc68fd2ccb86624e76872599b15059768c8a2afe98bd94e996c8485db035541278a7aa4c242b7a52d087b84ace0329fc028c4a77"], 0x78}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd2(0x4001, 0x800) r6 = eventfd(0x7) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000100)={r6, 0x7, 0x2, r5}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000140)={r5, 0x7, 0x2, r5}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x74, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x74}, 0x1, 0x0, 0x0, 0x2400a800}, 0x8000000) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x20, r7, 0x50dc85624ea6cf59, 0x0, 0x1, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c080}, 0xe432e00fdd45f8b1) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r9, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r10, 0x720, &(0x7f0000000180)={0x1, 0x8, 0x1, &(0x7f0000000040)={0x55, "c6c54bf28facb1ed3ee2dfe17a04bc507b54efecb94bce47509d00"}}) r11 = fcntl$dupfd(r8, 0x406, r8) ioctl$SIOCGSTAMPNS(r11, 0x8907, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r12 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r12, &(0x7f000001b700)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0900000005000000080000000f00000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000557588b9d789bb4498078e70a263c44a51510091cd0c8ccd6248acb6d6457bb480", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) 997.081799ms ago: executing program 1 (id=1389): getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="3400000010e237a9260c8b000000000000000000", @ANYRES32=0x0, @ANYBLOB="00880000000000001400030074756e6c3000"/28], 0x34}, 0x1, 0x0, 0x0, 0x4008000}, 0x40020) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x70bd27, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001800dd8d00000000000000000a000000000000060000000008001e0002"], 0x30}}, 0x4090) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x38}, 0x1, 0x300}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x24}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x4924b68, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) 0s ago: executing program 1 (id=1390): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="c4000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff0000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000c0015005a0735007f"], 0xc4}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}}, 0xb8}}, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x8, 0xfffffff6) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x0, 0x9729d20e8e64d55c, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socket$kcm(0x29, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0xc008ae88, &(0x7f0000000180)={0x1, 0x0, [{0x400000f2, 0x0, 0xf}]}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0xfffffffffffffedc, 0x0, 0x1, 0x0, 0x0, 0x4000040}, 0x20004080) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1, 0x0, 0x0, 0x7400}, 0x40094) recvmmsg$unix(r7, 0x0, 0x0, 0x26022, 0x0) syz_open_dev$dri(&(0x7f00000002c0), 0x80003fffffd, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r8}) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000040)='xfs\x00', 0x800000, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r3, 0xc02054a5, 0x0) kernel console output (not intermixed with test programs): 37] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 423.806066][ T6437] usb 4-1: Using ep0 maxpacket: 16 [ 423.831690][ T6437] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.865505][ T6437] usb 4-1: config 0 has no interfaces? [ 423.910906][ T6437] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 423.919958][ T6437] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.480640][ T6437] usb 4-1: Product: syz [ 424.484826][ T6437] usb 4-1: Manufacturer: syz [ 424.489414][ T6437] usb 4-1: SerialNumber: syz [ 424.544558][ T6437] usb 4-1: config 0 descriptor?? [ 424.591828][ T6437] usb 4-1: can't set config #0, error -71 [ 424.612225][ T6437] usb 4-1: USB disconnect, device number 24 [ 424.614092][ T9154] netlink: 32 bytes leftover after parsing attributes in process `syz.3.859'. [ 424.670096][ T9153] netlink: 32 bytes leftover after parsing attributes in process `syz.3.859'. [ 424.690125][ T9154] netlink: 32 bytes leftover after parsing attributes in process `syz.3.859'. [ 424.731263][ T9153] overlayfs: failed to resolve './file2': -2 [ 424.950643][ T55] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 426.551864][ T55] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 426.577074][ T55] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 426.607346][ T55] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 426.617545][ T55] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 426.629337][ T9157] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 426.643278][ T55] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 426.890660][ T6437] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 427.128439][ T6437] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 427.146194][ T6437] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 427.176126][ T6437] usb 4-1: New USB device found, idVendor=054c, idProduct=03d5, bcdDevice= 0.00 [ 427.198045][ T6437] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.221725][ T6437] usb 4-1: config 0 descriptor?? [ 427.707765][ T6437] input: HID 054c:03d5 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:054C:03D5.0003/input/input11 [ 427.838456][ T6437] sony 0003:054C:03D5.0003: input,hidraw0: USB HID vff.ff Joystick [HID 054c:03d5] on usb-dummy_hcd.3-1/input0 [ 427.927420][ T6437] usb 4-1: USB disconnect, device number 25 [ 428.002200][ T9171] udevd[9171]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 428.027820][ T9178] fido_id[9178]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 428.058491][ T9171] udevd[9171]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 428.172329][ T9181] netlink: 'syz.4.865': attribute type 30 has an invalid length. [ 428.297555][ T9182] netlink: 'syz.4.865': attribute type 30 has an invalid length. [ 428.393178][ T9183] 9pnet_virtio: no channels available for device syz [ 429.730824][ T55] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 430.257869][ T9193] hub 5-0:1.0: USB hub found [ 430.263189][ T9193] hub 5-0:1.0: 1 port detected [ 430.888784][ T5866] usb 1-1: USB disconnect, device number 26 [ 430.915093][ T55] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 431.049636][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.050294][ T9197] netlink: 5120 bytes leftover after parsing attributes in process `syz.4.869'. [ 431.085480][ T55] usb 3-1: config 0 descriptor?? [ 431.608988][ T9205] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 431.692120][ T9205] CIFS mount error: No usable UNC path provided in device string! [ 431.692120][ T9205] [ 431.705050][ T9205] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 431.743720][ T9206] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.752288][ T9206] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.902886][ T9197] syz.4.869 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 432.290646][ T5866] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 432.477796][ T5866] usb 1-1: unable to get BOS descriptor or descriptor too short [ 432.565919][ T9221] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 432.742149][ T55] ath6kl: Failed to submit usb control message: -110 [ 432.788356][ T5866] usb 1-1: config 174 has an invalid interface number: 153 but max is 0 [ 432.814340][ T55] ath6kl: unable to send the bmi data to the device: -110 [ 432.821893][ T5866] usb 1-1: config 174 has no interface number 0 [ 432.828385][ T55] ath6kl: Unable to send get target info: -110 [ 432.834827][ T5866] usb 1-1: config 174 interface 153 has no altsetting 0 [ 432.846099][ T5866] usb 1-1: New USB device found, idVendor=0f3d, idProduct=68a3, bcdDevice=77.4a [ 432.855554][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.865413][ T5866] usb 1-1: Product: syz [ 432.870073][ T5866] usb 1-1: Manufacturer: syz [ 432.878074][ T5866] usb 1-1: SerialNumber: syz [ 432.887157][ T55] ath6kl: Failed to init ath6kl core: -110 [ 432.898255][ T55] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 433.001618][ T6437] usb 3-1: USB disconnect, device number 25 [ 433.210284][ T9225] loop7: detected capacity change from 0 to 7 [ 433.270687][ C0] blk_print_req_error: 10 callbacks suppressed [ 433.270702][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.286460][ C0] buffer_io_error: 10 callbacks suppressed [ 433.286469][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.300549][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.310116][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.319401][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.328967][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.337490][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.347064][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.377558][ T30] audit: type=1400 audit(1767195188.601:393): avc: denied { module_request } for pid=9224 comm="syz.2.877" kmod="netdev-wpan3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 433.407044][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.416603][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.424758][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.434322][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.446687][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.456268][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.467298][ T9225] ldm_validate_partition_table(): Disk read failed. [ 433.485184][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.494806][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.509226][ T9230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.517682][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.527239][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.541046][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 433.550594][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 433.560963][ T9225] Dev loop7: unable to read RDB block 0 [ 433.561437][ T9230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.580399][ T9225] loop7: unable to read partition table [ 433.626567][ T9225] loop7: partition table beyond EOD, truncated [ 433.714705][ T9225] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 433.738798][ T5185] ldm_validate_partition_table(): Disk read failed. [ 433.811388][ T5185] Dev loop7: unable to read RDB block 0 [ 433.837953][ T5185] loop7: unable to read partition table [ 433.846747][ T5185] loop7: partition table beyond EOD, truncated [ 433.863428][ T5866] sierra 1-1:174.153: Sierra USB modem converter detected [ 433.897285][ T5866] usb 1-1: USB disconnect, device number 27 [ 433.941997][ T5866] sierra 1-1:174.153: device disconnected [ 434.263095][ T9236] netlink: 24 bytes leftover after parsing attributes in process `syz.3.878'. [ 434.300733][ T5866] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 435.160628][ T5866] usb 3-1: Using ep0 maxpacket: 8 [ 435.167182][ T5866] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 435.178796][ T5866] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 435.189009][ T5866] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 435.214120][ T5866] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 435.225811][ T5866] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 435.239992][ T5866] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 435.251968][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.596430][ T5866] usb 3-1: usb_control_msg returned -32 [ 436.605909][ T5866] usbtmc 3-1:16.0: can't read capabilities [ 437.526756][ T9257] FAULT_INJECTION: forcing a failure. [ 437.526756][ T9257] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 437.580679][ T9257] CPU: 0 UID: 0 PID: 9257 Comm: syz.2.879 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.580704][ T9257] Tainted: [L]=SOFTLOCKUP [ 437.580710][ T9257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 437.580718][ T9257] Call Trace: [ 437.580724][ T9257] [ 437.580731][ T9257] dump_stack_lvl+0x16c/0x1f0 [ 437.580756][ T9257] should_fail_ex+0x512/0x640 [ 437.580784][ T9257] _copy_from_user+0x2e/0xd0 [ 437.580808][ T9257] kstrtouint_from_user+0xd6/0x1d0 [ 437.580825][ T9257] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 437.580841][ T9257] ? __lock_acquire+0x436/0x2890 [ 437.580865][ T9257] ? lock_acquire+0x179/0x330 [ 437.580888][ T9257] proc_fail_nth_write+0x83/0x220 [ 437.580906][ T9257] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 437.580928][ T9257] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 437.580943][ T9257] vfs_write+0x2a0/0x11d0 [ 437.580965][ T9257] ? __pfx___mutex_lock+0x10/0x10 [ 437.580988][ T9257] ? __pfx_vfs_write+0x10/0x10 [ 437.581016][ T9257] ? __fget_files+0x20e/0x3c0 [ 437.581046][ T9257] ksys_write+0x12a/0x250 [ 437.581066][ T9257] ? __pfx_ksys_write+0x10/0x10 [ 437.581087][ T9257] ? fdget+0x187/0x210 [ 437.581113][ T9257] do_syscall_64+0xcd/0xf80 [ 437.581142][ T9257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.581159][ T9257] RIP: 0033:0x7f315a98e1ff [ 437.581172][ T9257] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 437.581186][ T9257] RSP: 002b:00007f3158bf6030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 437.581202][ T9257] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f315a98e1ff [ 437.581212][ T9257] RDX: 0000000000000001 RSI: 00007f3158bf60a0 RDI: 0000000000000004 [ 437.581222][ T9257] RBP: 00007f3158bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 437.581231][ T9257] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 437.581241][ T9257] R13: 00007f315abe6128 R14: 00007f315abe6090 R15: 00007ffc306369f8 [ 437.581265][ T9257] [ 437.812095][ T6437] usb 3-1: USB disconnect, device number 26 [ 437.840953][ T30] audit: type=1400 audit(1767195193.071:394): avc: denied { ioctl } for pid=9259 comm="syz.2.889" path="socket:[21063]" dev="sockfs" ino=21063 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 438.045793][ T30] audit: type=1400 audit(1767195193.101:395): avc: denied { write } for pid=9259 comm="syz.2.889" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 438.510656][ T5866] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 438.783158][ T5866] usb 4-1: Using ep0 maxpacket: 32 [ 438.790994][ T5866] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 438.800718][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.818458][ T5866] usb 4-1: config 0 descriptor?? [ 438.825972][ T5866] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 439.060621][ T6437] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 439.523412][ T6437] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 439.539644][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.547196][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.555470][ T5866] gspca_nw80x: reg_r err -110 [ 439.560430][ T5866] nw80x 4-1:0.0: probe with driver nw80x failed with error -110 [ 439.571305][ T6437] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.578727][ T5866] usb 4-1: USB disconnect, device number 26 [ 440.116480][ T6437] usb 1-1: config 0 descriptor?? [ 440.488328][ T9286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.500838][ T9286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.511104][ T5814] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 440.682645][ T5814] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 440.700121][ T5814] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.708811][ T9291] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 440.716363][ T9291] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 440.725197][ T9291] vhci_hcd vhci_hcd.0: Device attached [ 440.740231][ T5814] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 440.765437][ T5814] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.786870][ T5814] usb 3-1: config 0 descriptor?? [ 440.802288][ T5814] hub 3-1:0.0: USB hub found [ 440.911096][ T5887] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 440.971240][ T5887] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 440.981217][ T5866] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 441.002483][ T5814] hub 3-1:0.0: 2 ports detected [ 441.142015][ T5866] usb 4-1: config 0 has no interfaces? [ 441.148292][ T5866] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 441.159160][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.188442][ T5866] usb 4-1: config 0 descriptor?? [ 441.210978][ T6437] ath6kl: Failed to submit usb control message: -110 [ 441.224163][ T6437] ath6kl: unable to send the bmi data to the device: -110 [ 441.239045][ T6437] ath6kl: Unable to send get target info: -110 [ 441.257098][ T6437] ath6kl: Failed to init ath6kl core: -110 [ 441.265941][ T6437] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 441.412160][ T6437] usb 4-1: USB disconnect, device number 27 [ 441.412650][ T9292] usb 39-1: recv xbuf, 0 [ 441.432819][ T6172] vhci_hcd vhci_hcd.3: stop threads [ 441.439856][ T6172] vhci_hcd vhci_hcd.3: release socket [ 441.447990][ T6172] vhci_hcd vhci_hcd.3: disconnect device [ 441.470815][ T5814] usb 3-1: USB disconnect, device number 27 [ 441.560144][ T5887] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 441.735108][ T30] audit: type=1400 audit(1767195196.921:396): avc: denied { write } for pid=9306 comm="syz.1.901" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 442.144275][ T5866] usb 1-1: USB disconnect, device number 28 [ 442.751160][ T9316] overlayfs: failed to resolve './file1': -2 [ 444.181073][ T55] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 444.390643][ T55] usb 3-1: Using ep0 maxpacket: 32 [ 444.398087][ T55] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 444.417876][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.442905][ T9335] netlink: 72 bytes leftover after parsing attributes in process `syz.3.911'. [ 444.447061][ T55] usb 3-1: config 0 descriptor?? [ 444.460117][ T55] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 444.579248][ T30] audit: type=1400 audit(1767195199.801:397): avc: denied { create } for pid=9334 comm="syz.3.911" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 444.614563][ T30] audit: type=1400 audit(1767195199.841:398): avc: denied { listen } for pid=9336 comm="syz.1.912" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 444.742861][ T30] audit: type=1400 audit(1767195199.971:399): avc: denied { accept } for pid=9336 comm="syz.1.912" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netrom_socket permissive=1 [ 444.830699][ T5887] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 445.061455][ T5887] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 445.152768][ T5887] usb 4-1: config 0 has no interface number 0 [ 445.158897][ T5887] usb 4-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x96, changing to 0x86 [ 445.170487][ T5887] usb 4-1: config 0 interface 49 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 445.171357][ T55] gspca_nw80x: reg_r err -110 [ 445.187610][ T5887] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 445.216160][ T55] nw80x 3-1:0.0: probe with driver nw80x failed with error -110 [ 445.358914][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.366971][ T5887] usb 4-1: Product: syz [ 445.371298][ T5887] usb 4-1: Manufacturer: syz [ 445.375885][ T5887] usb 4-1: SerialNumber: syz [ 445.383126][ T5887] usb 4-1: config 0 descriptor?? [ 445.496747][ T5920] usb 3-1: USB disconnect, device number 28 [ 445.770202][ T30] audit: type=1400 audit(1767195200.921:400): avc: denied { write } for pid=9334 comm="syz.3.911" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 446.182644][ T9361] netlink: 'syz.2.914': attribute type 30 has an invalid length. [ 446.234455][ T9364] netlink: 'syz.2.914': attribute type 30 has an invalid length. [ 446.526951][ T9361] 9pnet_virtio: no channels available for device syz [ 446.785366][ T9368] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 446.845124][ T9370] FAULT_INJECTION: forcing a failure. [ 446.845124][ T9370] name failslab, interval 1, probability 0, space 0, times 0 [ 446.867245][ T9370] CPU: 0 UID: 0 PID: 9370 Comm: syz.2.917 Tainted: G L syzkaller #0 PREEMPT(full) [ 446.867276][ T9370] Tainted: [L]=SOFTLOCKUP [ 446.867282][ T9370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 446.867292][ T9370] Call Trace: [ 446.867297][ T9370] [ 446.867304][ T9370] dump_stack_lvl+0x16c/0x1f0 [ 446.867329][ T9370] should_fail_ex+0x512/0x640 [ 446.867353][ T9370] ? kmem_cache_alloc_node_noprof+0x65/0x800 [ 446.867374][ T9370] should_failslab+0xc2/0x120 [ 446.867395][ T9370] kmem_cache_alloc_node_noprof+0x86/0x800 [ 446.867412][ T9370] ? __alloc_skb+0x156/0x410 [ 446.867441][ T9370] ? __alloc_skb+0x156/0x410 [ 446.867463][ T9370] __alloc_skb+0x156/0x410 [ 446.867485][ T9370] ? __alloc_skb+0x35d/0x410 [ 446.867508][ T9370] ? __pfx___alloc_skb+0x10/0x10 [ 446.867532][ T9370] ? netlink_autobind.isra.0+0x158/0x370 [ 446.867559][ T9370] netlink_alloc_large_skb+0x69/0x140 [ 446.867580][ T9370] netlink_sendmsg+0x698/0xdd0 [ 446.867604][ T9370] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.867633][ T9370] ____sys_sendmsg+0xa5d/0xc30 [ 446.867655][ T9370] ? copy_msghdr_from_user+0x10a/0x160 [ 446.867672][ T9370] ? __pfx_____sys_sendmsg+0x10/0x10 [ 446.867704][ T9370] ___sys_sendmsg+0x134/0x1d0 [ 446.867722][ T9370] ? __pfx____sys_sendmsg+0x10/0x10 [ 446.867768][ T9370] __sys_sendmsg+0x16d/0x220 [ 446.867783][ T9370] ? __pfx___sys_sendmsg+0x10/0x10 [ 446.867814][ T9370] do_syscall_64+0xcd/0xf80 [ 446.867838][ T9370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.867854][ T9370] RIP: 0033:0x7f315a98f749 [ 446.867867][ T9370] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 446.867882][ T9370] RSP: 002b:00007f315b751038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.867899][ T9370] RAX: ffffffffffffffda RBX: 00007f315abe5fa0 RCX: 00007f315a98f749 [ 446.867909][ T9370] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 446.867919][ T9370] RBP: 00007f315b751090 R08: 0000000000000000 R09: 0000000000000000 [ 446.867928][ T9370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.867937][ T9370] R13: 00007f315abe6038 R14: 00007f315abe5fa0 R15: 00007ffc306369f8 [ 446.867961][ T9370] [ 447.611151][ T9378] overlayfs: failed to resolve './file1': -2 [ 450.504449][ T6437] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 450.701007][ T6437] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 450.719815][ T6437] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 450.747186][ T6437] usb 1-1: config 8 has no interface number 0 [ 450.755245][ T6437] usb 1-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 450.771216][ T6437] usb 1-1: config 8 interface 177 has no altsetting 0 [ 450.785707][ T6437] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 450.795136][ T6437] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.835484][ T6437] ir_toy 1-1:8.177: required endpoints not found [ 451.082687][ T5136] Bluetooth: hci0: connection err: -111 [ 452.514036][ T5866] usb 1-1: USB disconnect, device number 29 [ 453.060796][ T9421] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2562 sclass=netlink_route_socket pid=9421 comm=syz.0.933 [ 453.083174][ T9421] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=9421 comm=syz.0.933 [ 453.096057][ T9421] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2571 sclass=netlink_route_socket pid=9421 comm=syz.0.933 [ 453.137844][ T9421] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 453.671201][ T6437] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 453.840585][ T6437] usb 1-1: Using ep0 maxpacket: 16 [ 453.849282][ T6437] usb 1-1: config 9 has an invalid interface number: 34 but max is 0 [ 453.871837][ T6437] usb 1-1: config 9 has no interface number 0 [ 453.890053][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 453.976944][ T6437] usb 1-1: config 9 interface 34 altsetting 2 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 454.022005][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 454.039995][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has an endpoint descriptor with address 0xDD, changing to 0x8D [ 454.082373][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0x9, skipping [ 454.100980][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0xD, skipping [ 454.119122][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 454.152220][ T6437] usb 1-1: config 9 interface 34 altsetting 2 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 454.163173][ T6437] usb 1-1: config 9 interface 34 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 32 [ 454.180945][ T6437] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0x5, skipping [ 454.200874][ T6437] usb 1-1: config 9 interface 34 has no altsetting 0 [ 454.209794][ T6437] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=bb.e7 [ 454.230625][ T6437] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.241690][ T6437] usb 1-1: Product: ﮺荫园ꠇ箊ꄐ酏탶ᯩꎷ簷⥽㵥旼鬐剈弤歔ᇏ龨㐢妦絠롴肘ণ੃뵔䃔霔ુⴴ》飫븟鈖䦱婤㨸͙ૹ㗯噁ᆑ妨턋ౚ앎ꖜ [ 454.279512][ T6437] usb 1-1: Manufacturer: Ъ [ 454.289609][ T6437] usb 1-1: SerialNumber: syz [ 454.326767][ T9429] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 454.851472][ T6437] mdc800 1-1:9.34: probe fails -> wrong Interface [ 454.887386][ T6437] usb 1-1: USB disconnect, device number 30 [ 455.419961][ T30] audit: type=1400 audit(1767195210.631:401): avc: denied { connect } for pid=9440 comm="syz.2.938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 455.719423][ T30] audit: type=1400 audit(1767195210.671:402): avc: denied { write } for pid=9440 comm="syz.2.938" path="socket:[22384]" dev="sockfs" ino=22384 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 455.882588][ T9451] set match dimension is over the limit! [ 456.014320][ T9453] input: syz1 as /devices/virtual/input/input13 [ 456.198537][ T9454] gfs2: error -5 reading superblock [ 456.314889][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.325689][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.444757][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.492758][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.506795][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.672192][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.697753][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.740502][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 456.794571][ T9457] 9pnet_fd: p9_fd_create_tcp (9457): problem connecting socket to 127.0.0.1 [ 457.372888][ T5920] usb 4-1: USB disconnect, device number 28 [ 457.818101][ T9480] netlink: 'syz.3.949': attribute type 3 has an invalid length. [ 457.825962][ T9480] netlink: 'syz.3.949': attribute type 3 has an invalid length. [ 458.210601][ T5920] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 458.370637][ T5920] usb 1-1: Using ep0 maxpacket: 16 [ 458.380311][ T5920] usb 1-1: config 9 has an invalid interface number: 34 but max is 0 [ 458.390070][ T5920] usb 1-1: config 9 has no interface number 0 [ 458.409126][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 458.429290][ T5920] usb 1-1: config 9 interface 34 altsetting 2 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 458.456477][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 458.483349][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has an endpoint descriptor with address 0xDD, changing to 0x8D [ 458.517960][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0x9, skipping [ 458.613712][ T9487] ptrace attach of "./syz-executor exec"[9488] was attempted by "./syz-executor exec"[9487] [ 458.628479][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0xD, skipping [ 458.720572][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 458.772516][ T5920] usb 1-1: config 9 interface 34 altsetting 2 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 458.850021][ T5920] usb 1-1: config 9 interface 34 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 32 [ 458.928706][ T5920] usb 1-1: config 9 interface 34 altsetting 2 has a duplicate endpoint with address 0x5, skipping [ 459.014239][ T5920] usb 1-1: config 9 interface 34 has no altsetting 0 [ 460.166852][ T5920] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=bb.e7 [ 460.191255][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.210969][ T5920] usb 1-1: Product: ﮺荫园ꠇ箊ꄐ酏탶ᯩꎷ簷⥽㵥旼鬐剈弤歔ᇏ龨㐢妦絠롴肘ণ੃뵔䃔霔ુⴴ》飫븟鈖䦱婤㨸͙ૹ㗯噁ᆑ妨턋ౚ앎ꖜ [ 460.250656][ T5920] usb 1-1: Manufacturer: Ъ [ 460.255153][ T5920] usb 1-1: SerialNumber: syz [ 460.273429][ T9483] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 460.791314][ T5920] mdc800 1-1:9.34: probe fails -> wrong Interface [ 460.818333][ T5920] usb 1-1: USB disconnect, device number 31 [ 461.754045][ T30] audit: type=1400 audit(1767195216.981:403): avc: denied { bind } for pid=9497 comm="syz.2.955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 461.777013][ T30] audit: type=1400 audit(1767195217.001:404): avc: denied { read } for pid=9497 comm="syz.2.955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 461.837506][ T30] audit: type=1400 audit(1767195217.061:405): avc: denied { setopt } for pid=9497 comm="syz.2.955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 462.961944][ T9519] netlink: 'syz.0.962': attribute type 3 has an invalid length. [ 462.969741][ T9519] netlink: 'syz.0.962': attribute type 3 has an invalid length. [ 463.033950][ T30] audit: type=1400 audit(1767195218.261:406): avc: denied { write } for pid=9520 comm="syz.1.958" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 463.112241][ T30] audit: type=1400 audit(1767195218.291:407): avc: denied { setopt } for pid=9520 comm="syz.1.958" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 463.400645][ T55] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 464.425046][ T55] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 464.450976][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.475759][ T55] usb 3-1: config 0 descriptor?? [ 464.494670][ T55] cp210x 3-1:0.0: cp210x converter detected [ 464.522969][ T9532] netlink: 'syz.0.967': attribute type 30 has an invalid length. [ 464.574200][ T9533] netlink: 'syz.0.967': attribute type 30 has an invalid length. [ 464.662270][ T9532] 9pnet_virtio: no channels available for device syz [ 465.291231][ T8263] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 465.533271][ T8263] usb 1-1: config 0 has an invalid interface number: 150 but max is 0 [ 465.722405][ T30] audit: type=1400 audit(1767195220.591:408): avc: denied { mount } for pid=9538 comm="syz.4.969" name="/" dev="autofs" ino=22647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 465.745027][ T30] audit: type=1400 audit(1767195220.591:409): avc: denied { read } for pid=9538 comm="syz.4.969" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 465.769164][ T30] audit: type=1400 audit(1767195220.591:410): avc: denied { open } for pid=9538 comm="syz.4.969" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 465.770052][ T8263] usb 1-1: config 0 has no interface number 0 [ 465.799410][ T8263] usb 1-1: New USB device found, idVendor=05d1, idProduct=9008, bcdDevice=95.91 [ 465.812676][ T8263] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.813101][ T30] audit: type=1400 audit(1767195220.591:411): avc: denied { ioctl } for pid=9538 comm="syz.4.969" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9379 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 465.822691][ T8263] usb 1-1: config 0 descriptor?? [ 465.849078][ T9543] FAULT_INJECTION: forcing a failure. [ 465.849078][ T9543] name failslab, interval 1, probability 0, space 0, times 0 [ 465.865024][ T9543] CPU: 0 UID: 0 PID: 9543 Comm: syz.3.966 Tainted: G L syzkaller #0 PREEMPT(full) [ 465.865049][ T9543] Tainted: [L]=SOFTLOCKUP [ 465.865055][ T9543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 465.865065][ T9543] Call Trace: [ 465.865070][ T9543] [ 465.865077][ T9543] dump_stack_lvl+0x16c/0x1f0 [ 465.865102][ T9543] should_fail_ex+0x512/0x640 [ 465.865126][ T9543] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 465.865154][ T9543] should_failslab+0xc2/0x120 [ 465.865176][ T9543] kmem_cache_alloc_noprof+0x83/0x770 [ 465.865194][ T9543] ? skb_clone+0x190/0x3f0 [ 465.865215][ T9543] ? skb_clone+0x190/0x3f0 [ 465.865229][ T9543] skb_clone+0x190/0x3f0 [ 465.865246][ T9543] netlink_deliver_tap+0xabd/0xd30 [ 465.865271][ T9543] netlink_unicast+0x64c/0x870 [ 465.865294][ T9543] ? __pfx_netlink_unicast+0x10/0x10 [ 465.865324][ T9543] netlink_sendmsg+0x8c8/0xdd0 [ 465.865347][ T9543] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.865375][ T9543] ____sys_sendmsg+0xa5d/0xc30 [ 465.865396][ T9543] ? copy_msghdr_from_user+0x10a/0x160 [ 465.865413][ T9543] ? __pfx_____sys_sendmsg+0x10/0x10 [ 465.865446][ T9543] ___sys_sendmsg+0x134/0x1d0 [ 465.865465][ T9543] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.865511][ T9543] __sys_sendmsg+0x16d/0x220 [ 465.865528][ T9543] ? __pfx___sys_sendmsg+0x10/0x10 [ 465.865561][ T9543] do_syscall_64+0xcd/0xf80 [ 465.865583][ T9543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.865601][ T9543] RIP: 0033:0x7f449678f749 [ 465.865615][ T9543] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 465.865630][ T9543] RSP: 002b:00007f44975d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 465.865646][ T9543] RAX: ffffffffffffffda RBX: 00007f44969e5fa0 RCX: 00007f449678f749 [ 465.865657][ T9543] RDX: 00000000040c0080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 465.865666][ T9543] RBP: 00007f44975d5090 R08: 0000000000000000 R09: 0000000000000000 [ 465.865675][ T9543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.865684][ T9543] R13: 00007f44969e6038 R14: 00007f44969e5fa0 R15: 00007ffdacb15d38 [ 465.865712][ T9543] [ 465.891059][ T8263] hub 1-1:0.150: bad descriptor, ignoring hub [ 466.150966][ T8263] hub 1-1:0.150: probe with driver hub failed with error -5 [ 466.151657][ T30] audit: type=1400 audit(1767195221.371:412): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 466.159041][ T8263] ftdi_sio 1-1:0.150: FTDI USB Serial Device converter detected [ 466.312141][ T8263] ftdi_sio ttyUSB0: unknown device type: 0x9591 [ 466.358869][ T55] cp210x 3-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 466.370359][ T55] cp210x 3-1:0.0: GPIO initialisation failed: -71 [ 466.734114][ T55] usb 3-1: cp210x converter now attached to ttyUSB1 [ 466.757065][ T55] usb 3-1: USB disconnect, device number 29 [ 466.773786][ T55] cp210x ttyUSB1: cp210x converter now disconnected from ttyUSB1 [ 466.794956][ T55] cp210x 3-1:0.0: device disconnected [ 467.098202][ T9559] kAFS: unable to lookup cell '({^@' [ 467.135653][ T55] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 467.143293][ T30] audit: type=1400 audit(1767195222.311:413): avc: denied { create } for pid=9554 comm="syz.1.973" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 467.171026][ T9562] program syz.3.975 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 468.471776][ T55] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 468.500719][ T55] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 468.509773][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.732549][ T55] usb 3-1: config 0 descriptor?? [ 468.743688][ T55] pwc: Askey VC010 type 2 USB webcam detected. [ 468.759625][ T10] usb 1-1: USB disconnect, device number 32 [ 468.767382][ T10] ftdi_sio 1-1:0.150: device disconnected [ 469.123104][ T9575] netlink: 'syz.1.981': attribute type 30 has an invalid length. [ 469.175239][ T9576] netlink: 'syz.1.981': attribute type 30 has an invalid length. [ 469.183931][ T55] pwc: recv_control_msg error -32 req 02 val 2b00 [ 469.233157][ T55] pwc: recv_control_msg error -32 req 02 val 2700 [ 469.247016][ T55] pwc: recv_control_msg error -32 req 02 val 2c00 [ 469.257520][ T9577] netlink: 'syz.3.977': attribute type 3 has an invalid length. [ 469.265249][ T9577] netlink: 'syz.3.977': attribute type 3 has an invalid length. [ 469.285740][ T55] pwc: recv_control_msg error -32 req 04 val 1000 [ 469.305804][ T9575] 9pnet_virtio: no channels available for device syz [ 469.318060][ T55] pwc: recv_control_msg error -32 req 04 val 1300 [ 469.330327][ T55] pwc: recv_control_msg error -32 req 04 val 1400 [ 469.349131][ T55] pwc: recv_control_msg error -32 req 02 val 2000 [ 470.630969][ T9586] ptrace attach of "./syz-executor exec"[9588] was attempted by "./syz-executor exec"[9586] [ 471.006441][ T55] pwc: recv_control_msg error -71 req 02 val 2100 [ 471.015184][ T55] pwc: recv_control_msg error -71 req 04 val 1500 [ 471.022558][ T55] pwc: recv_control_msg error -71 req 02 val 2500 [ 471.029329][ T55] pwc: recv_control_msg error -71 req 02 val 2400 [ 471.036361][ T55] pwc: recv_control_msg error -71 req 02 val 2600 [ 471.043574][ T55] pwc: recv_control_msg error -71 req 02 val 2900 [ 471.050326][ T55] pwc: recv_control_msg error -71 req 02 val 2800 [ 471.061284][ T55] pwc: recv_control_msg error -71 req 04 val 1100 [ 471.068027][ T55] pwc: recv_control_msg error -71 req 04 val 1200 [ 471.081178][ T55] pwc: Registered as video103. [ 471.095759][ T55] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input14 [ 471.128306][ T55] usb 3-1: USB disconnect, device number 30 [ 471.792813][ T9597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 475.748068][ T9632] ptrace attach of "./syz-executor exec"[9633] was attempted by "./syz-executor exec"[9632] [ 476.877834][ T9649] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9649 comm=syz.4.994 [ 476.890566][ T5136] Bluetooth: hci4: command 0x0406 tx timeout [ 476.935669][ T9650] netlink: 'syz.1.999': attribute type 3 has an invalid length. [ 477.020858][ T9649] netlink: 4 bytes leftover after parsing attributes in process `syz.4.994'. [ 477.064946][ T9650] netlink: 'syz.1.999': attribute type 3 has an invalid length. [ 477.072358][ T9653] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9653 comm=syz.4.994 [ 483.085948][ T9714] ptrace attach of "./syz-executor exec"[9712] was attempted by "./syz-executor exec"[9714] [ 483.402767][ T30] audit: type=1326 audit(1767195238.631:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9717 comm="syz.3.1018" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f449678f749 code=0x0 [ 485.107676][ T9735] FAULT_INJECTION: forcing a failure. [ 485.107676][ T9735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 485.121291][ T9735] CPU: 1 UID: 0 PID: 9735 Comm: syz.4.1022 Tainted: G L syzkaller #0 PREEMPT(full) [ 485.121318][ T9735] Tainted: [L]=SOFTLOCKUP [ 485.121324][ T9735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 485.121333][ T9735] Call Trace: [ 485.121339][ T9735] [ 485.121345][ T9735] dump_stack_lvl+0x16c/0x1f0 [ 485.121370][ T9735] should_fail_ex+0x512/0x640 [ 485.121397][ T9735] _copy_from_user+0x2e/0xd0 [ 485.121427][ T9735] btf_new_fd+0x70f/0x54c0 [ 485.121451][ T9735] ? avc_has_perm_noaudit+0x149/0x3b0 [ 485.121480][ T9735] ? cred_has_capability.isra.0+0x18f/0x310 [ 485.121502][ T9735] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 485.121528][ T9735] ? __pfx_btf_new_fd+0x10/0x10 [ 485.121552][ T9735] ? cap_capable+0x10d/0x3f0 [ 485.121570][ T9735] ? bpf_lsm_capable+0x9/0x10 [ 485.121587][ T9735] ? security_capable+0x7e/0x260 [ 485.121605][ T9735] ? ns_capable+0xd7/0x110 [ 485.121630][ T9735] __sys_bpf+0x39f/0x4980 [ 485.121658][ T9735] ? __pfx___sys_bpf+0x10/0x10 [ 485.121679][ T9735] ? find_held_lock+0x2b/0x80 [ 485.121710][ T9735] ? find_held_lock+0x2b/0x80 [ 485.121739][ T9735] ? __mutex_unlock_slowpath+0x161/0x790 [ 485.121775][ T9735] ? fput+0x70/0xf0 [ 485.121789][ T9735] ? ksys_write+0x1ac/0x250 [ 485.121809][ T9735] ? __pfx_ksys_write+0x10/0x10 [ 485.121833][ T9735] __x64_sys_bpf+0x78/0xc0 [ 485.121856][ T9735] ? lockdep_hardirqs_on+0x7c/0x110 [ 485.121877][ T9735] do_syscall_64+0xcd/0xf80 [ 485.121899][ T9735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.121915][ T9735] RIP: 0033:0x7f7a2d78f749 [ 485.121928][ T9735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 485.121944][ T9735] RSP: 002b:00007f7a2e6eb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 485.121961][ T9735] RAX: ffffffffffffffda RBX: 00007f7a2d9e5fa0 RCX: 00007f7a2d78f749 [ 485.121972][ T9735] RDX: 0000000000000028 RSI: 0000200000000000 RDI: 0000000000000012 [ 485.121982][ T9735] RBP: 00007f7a2e6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 485.121991][ T9735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.122001][ T9735] R13: 00007f7a2d9e6038 R14: 00007f7a2d9e5fa0 R15: 00007ffeaba21a68 [ 485.122024][ T9735] [ 485.434612][ T30] audit: type=1400 audit(1767195240.661:415): avc: denied { write } for pid=9736 comm="syz.4.1024" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 485.488771][ T9741] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1012'. [ 485.500570][ T9741] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1012'. [ 485.568136][ T9741] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1012'. [ 485.579743][ T9741] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1012'. [ 486.217701][ T9755] netlink: 'syz.2.1020': attribute type 3 has an invalid length. [ 486.240857][ T9755] netlink: 'syz.2.1020': attribute type 3 has an invalid length. [ 487.951289][ T9772] FAULT_INJECTION: forcing a failure. [ 487.951289][ T9772] name failslab, interval 1, probability 0, space 0, times 0 [ 487.964491][ T9772] CPU: 0 UID: 0 PID: 9772 Comm: syz.1.1034 Tainted: G L syzkaller #0 PREEMPT(full) [ 487.964508][ T9772] Tainted: [L]=SOFTLOCKUP [ 487.964512][ T9772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 487.964517][ T9772] Call Trace: [ 487.964521][ T9772] [ 487.964525][ T9772] dump_stack_lvl+0x16c/0x1f0 [ 487.964541][ T9772] should_fail_ex+0x512/0x640 [ 487.964557][ T9772] ? __kmalloc_noprof+0xca/0x910 [ 487.964575][ T9772] should_failslab+0xc2/0x120 [ 487.964588][ T9772] __kmalloc_noprof+0xeb/0x910 [ 487.964604][ T9772] ? drm_atomic_state_init+0xec/0x540 [ 487.964621][ T9772] ? drm_atomic_state_init+0xec/0x540 [ 487.964635][ T9772] drm_atomic_state_init+0xec/0x540 [ 487.964656][ T9772] ? kasan_save_track+0x14/0x30 [ 487.964669][ T9772] drm_atomic_state_alloc+0xd3/0x120 [ 487.964685][ T9772] drm_mode_atomic_ioctl+0x393/0x2640 [ 487.964703][ T9772] ? avc_has_extended_perms+0x33a/0x1090 [ 487.964721][ T9772] ? avc_has_extended_perms+0x47c/0x1090 [ 487.964738][ T9772] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 487.964754][ T9772] ? __lock_acquire+0x436/0x2890 [ 487.964766][ T9772] ? __pfx_avc_has_extended_perms+0x10/0x10 [ 487.964789][ T9772] ? drm_is_current_master+0x2c/0x40 [ 487.964806][ T9772] ? do_raw_spin_unlock+0x172/0x230 [ 487.964822][ T9772] drm_ioctl_kernel+0x1f4/0x3e0 [ 487.964835][ T9772] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 487.964851][ T9772] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 487.964869][ T9772] drm_ioctl+0x5c9/0xc30 [ 487.964884][ T9772] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 487.964901][ T9772] ? __pfx_drm_ioctl+0x10/0x10 [ 487.964920][ T9772] ? selinux_file_ioctl+0x180/0x270 [ 487.964933][ T9772] ? selinux_file_ioctl+0xb4/0x270 [ 487.964946][ T9772] ? __pfx_drm_ioctl+0x10/0x10 [ 487.964960][ T9772] __x64_sys_ioctl+0x18e/0x210 [ 487.964975][ T9772] do_syscall_64+0xcd/0xf80 [ 487.964988][ T9772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.964999][ T9772] RIP: 0033:0x7f770a98f749 [ 487.965007][ T9772] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 487.965017][ T9772] RSP: 002b:00007f770b89a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 487.965027][ T9772] RAX: ffffffffffffffda RBX: 00007f770abe5fa0 RCX: 00007f770a98f749 [ 487.965033][ T9772] RDX: 0000200000000380 RSI: 00000000c03864bc RDI: 0000000000000003 [ 487.965039][ T9772] RBP: 00007f770b89a090 R08: 0000000000000000 R09: 0000000000000000 [ 487.965045][ T9772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 487.965050][ T9772] R13: 00007f770abe6038 R14: 00007f770abe5fa0 R15: 00007ffc2127e3c8 [ 487.965063][ T9772] [ 488.644597][ T5866] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 490.195222][ T30] audit: type=1400 audit(1767195245.411:416): avc: denied { bind } for pid=9792 comm="syz.4.1037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 490.399180][ T9816] netlink: 'syz.1.1042': attribute type 3 has an invalid length. [ 490.407146][ T9816] netlink: 'syz.1.1042': attribute type 3 has an invalid length. [ 492.663518][ T30] audit: type=1400 audit(1767195247.891:417): avc: denied { map } for pid=9838 comm="syz.3.1048" path="/206" dev="tmpfs" ino=1231 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 492.685984][ T9839] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1048'. [ 493.347139][ T30] audit: type=1400 audit(1767195247.911:418): avc: denied { execute } for pid=9838 comm="syz.3.1048" path="/206" dev="tmpfs" ino=1231 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 494.144019][ T9858] ptrace attach of "./syz-executor exec"[9859] was attempted by "./syz-executor exec"[9858] [ 494.961033][ T30] audit: type=1400 audit(1767195250.191:419): avc: denied { map } for pid=9854 comm="syz.0.1052" path="socket:[23141]" dev="sockfs" ino=23141 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 495.065513][ T9860] netlink: 'syz.0.1052': attribute type 4 has an invalid length. [ 495.180769][ T30] audit: type=1400 audit(1767195250.221:420): avc: denied { read accept } for pid=9854 comm="syz.0.1052" path="socket:[23141]" dev="sockfs" ino=23141 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 496.400610][ T5866] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 496.918899][ T5866] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 496.961392][ T5866] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 496.975963][ T5866] usb 3-1: config 1 interface 0 has no altsetting 0 [ 497.005241][ T5866] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 497.017640][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.036474][ T5866] usb 3-1: Product: syz [ 497.048579][ T5866] usb 3-1: Manufacturer: syz [ 497.061185][ T5866] usb 3-1: SerialNumber: syz [ 497.180889][ T9872] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 497.251147][ T9872] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 498.237537][ T9888] netlink: 'syz.3.1056': attribute type 3 has an invalid length. [ 498.245438][ T9888] netlink: 'syz.3.1056': attribute type 3 has an invalid length. [ 499.170404][ T30] audit: type=1400 audit(1767195254.391:421): avc: denied { mounton } for pid=9871 comm="syz.2.1057" path="/219/file0" dev="tmpfs" ino=1346 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 499.195212][ T5873] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 499.286717][ T9906] ptrace attach of "./syz-executor exec"[9905] was attempted by "./syz-executor exec"[9906] [ 499.805920][ T5866] (unnamed net_device) (uninitialized): Assigned a random MAC address: de:36:45:04:83:e2 [ 499.945347][ T5866] rtl8150 3-1:1.0: eth1: rtl8150 is detected [ 500.897209][ T30] audit: type=1400 audit(1767195256.121:422): avc: denied { ioctl } for pid=9889 comm="syz.0.1062" path="socket:[24343]" dev="sockfs" ino=24343 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 500.930059][ T5873] usb 1-1: unable to get BOS descriptor or descriptor too short [ 500.950695][ T5873] usb 1-1: no configurations [ 500.955301][ T5873] usb 1-1: can't read configurations, error -22 [ 500.978646][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.986220][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.167082][ T30] audit: type=1400 audit(1767195256.391:423): avc: denied { read open } for pid=9922 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 501.210725][ T30] audit: type=1400 audit(1767195256.421:424): avc: denied { getattr } for pid=9922 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1836 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 501.478344][ T5887] usb 3-1: USB disconnect, device number 31 [ 502.369933][ T30] audit: type=1400 audit(1767195257.591:425): avc: denied { add_name } for pid=9919 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 502.521324][ T30] audit: type=1400 audit(1767195257.621:426): avc: denied { create } for pid=9919 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 502.967778][ T30] audit: type=1400 audit(1767195257.621:427): avc: denied { write } for pid=9919 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth1.link" dev="tmpfs" ino=4715 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 503.123401][ T9952] netlink: 'syz.0.1075': attribute type 3 has an invalid length. [ 503.131408][ T9952] netlink: 'syz.0.1075': attribute type 3 has an invalid length. [ 503.151878][ T30] audit: type=1400 audit(1767195257.621:428): avc: denied { append } for pid=9919 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" dev="tmpfs" ino=4715 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 503.380735][ T30] audit: type=1400 audit(1767195258.361:429): avc: denied { remove_name } for pid=9950 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=4715 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 503.561535][ T30] audit: type=1400 audit(1767195258.361:430): avc: denied { unlink } for pid=9950 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=4715 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 505.526721][ T8263] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 505.661439][ T9985] FAULT_INJECTION: forcing a failure. [ 505.661439][ T9985] name failslab, interval 1, probability 0, space 0, times 0 [ 505.674200][ T9985] CPU: 0 UID: 0 PID: 9985 Comm: syz.4.1083 Tainted: G L syzkaller #0 PREEMPT(full) [ 505.674216][ T9985] Tainted: [L]=SOFTLOCKUP [ 505.674220][ T9985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 505.674226][ T9985] Call Trace: [ 505.674229][ T9985] [ 505.674233][ T9985] dump_stack_lvl+0x16c/0x1f0 [ 505.674254][ T9985] should_fail_ex+0x512/0x640 [ 505.674272][ T9985] should_failslab+0xc2/0x120 [ 505.674287][ T9985] kmem_cache_alloc_noprof+0x83/0x770 [ 505.674298][ T9985] ? radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 505.674311][ T9985] ? radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 505.674322][ T9985] radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 505.674334][ T9985] idr_get_free+0x528/0xa30 [ 505.674350][ T9985] idr_alloc_u32+0x1ac/0x320 [ 505.674363][ T9985] ? __pfx_idr_alloc_u32+0x10/0x10 [ 505.674375][ T9985] ? lock_acquire+0x179/0x330 [ 505.674390][ T9985] idr_alloc_cyclic+0x10b/0x230 [ 505.674402][ T9985] ? __pfx_idr_alloc_cyclic+0x10/0x10 [ 505.674413][ T9985] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 505.674431][ T9985] bpf_link_prime+0x7b/0x4c0 [ 505.674444][ T9985] ? bpf_link_init_sleepable+0x91/0x220 [ 505.674462][ T9985] bpf_raw_tp_link_attach+0x2ad/0x630 [ 505.674478][ T9985] ? __pfx_bpf_raw_tp_link_attach+0x10/0x10 [ 505.674492][ T9985] ? find_held_lock+0x2b/0x80 [ 505.674507][ T9985] ? __fget_files+0x204/0x3c0 [ 505.674527][ T9985] ? fput+0x70/0xf0 [ 505.674536][ T9985] ? __bpf_prog_get+0x97/0x2a0 [ 505.674548][ T9985] __sys_bpf+0x20c1/0x4980 [ 505.674564][ T9985] ? __pfx___sys_bpf+0x10/0x10 [ 505.674578][ T9985] ? find_held_lock+0x2b/0x80 [ 505.674595][ T9985] ? find_held_lock+0x2b/0x80 [ 505.674613][ T9985] ? __mutex_unlock_slowpath+0x161/0x790 [ 505.674635][ T9985] ? fput+0x70/0xf0 [ 505.674643][ T9985] ? ksys_write+0x1ac/0x250 [ 505.674655][ T9985] ? __pfx_ksys_write+0x10/0x10 [ 505.674670][ T9985] __x64_sys_bpf+0x78/0xc0 [ 505.674684][ T9985] ? lockdep_hardirqs_on+0x7c/0x110 [ 505.674696][ T9985] do_syscall_64+0xcd/0xf80 [ 505.674710][ T9985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.674721][ T9985] RIP: 0033:0x7f7a2d78f749 [ 505.674730][ T9985] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 505.674740][ T9985] RSP: 002b:00007f7a2e6eb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 505.674749][ T9985] RAX: ffffffffffffffda RBX: 00007f7a2d9e5fa0 RCX: 00007f7a2d78f749 [ 505.674756][ T9985] RDX: 0000000000000018 RSI: 00002000000001c0 RDI: 0000000000000011 [ 505.674761][ T9985] RBP: 00007f7a2e6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 505.674767][ T9985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 505.674773][ T9985] R13: 00007f7a2d9e6038 R14: 00007f7a2d9e5fa0 R15: 00007ffeaba21a68 [ 505.674785][ T9985] [ 506.031685][ T8263] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 506.398081][ T8263] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.514075][ T8263] usb 4-1: config 0 descriptor?? [ 506.658441][ T9995] netlink: 'syz.0.1080': attribute type 30 has an invalid length. [ 506.768733][ T9996] netlink: 'syz.0.1080': attribute type 30 has an invalid length. [ 506.869185][ T9998] 9pnet_virtio: no channels available for device syz [ 506.999650][T10000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.087696][T10000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.209414][ T30] audit: type=1400 audit(1767195262.361:431): avc: denied { create } for pid=9997 comm="syz.4.1086" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 507.471571][ T30] audit: type=1400 audit(1767195262.601:432): avc: denied { read } for pid=9997 comm="syz.4.1086" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 507.652431][ T8263] ath6kl: Failed to submit usb control message: -110 [ 507.690608][ T8263] ath6kl: unable to send the bmi data to the device: -110 [ 507.713533][ T8263] ath6kl: Unable to send get target info: -110 [ 507.760418][ T8263] ath6kl: Failed to init ath6kl core: -110 [ 507.771532][ T8263] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 507.850903][ T5866] usb 4-1: USB disconnect, device number 29 [ 508.352798][T10006] vivid-003: disconnect [ 508.742045][T10007] vivid-003: reconnect [ 509.135890][T10011] netlink: 'syz.1.1085': attribute type 30 has an invalid length. [ 509.181060][T10009] netlink: 'syz.1.1085': attribute type 30 has an invalid length. [ 509.282231][T10010] 9pnet_virtio: no channels available for device syz [ 510.073758][T10020] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57872 sclass=netlink_route_socket pid=10020 comm=syz.0.1091 [ 510.090353][T10020] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1091'. [ 510.104726][T10020] tipc: Started in network mode [ 510.111635][T10020] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 510.120484][T10020] tipc: Enabling of bearer rejected, failed to enable media [ 512.920751][T10042] JFS: discard option not supported on device [ 512.944481][T10042] Mount JFS Failure: -22 [ 512.954878][T10042] jfs_mount failed w/return code = -22 [ 514.021907][T10048] loop6: detected capacity change from 0 to 524287487 [ 514.029362][T10048] buffer_io_error: 25 callbacks suppressed [ 514.029374][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.043073][ T30] audit: type=1400 audit(1767195269.241:433): avc: denied { append } for pid=10043 comm="syz.0.1093" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 514.067087][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.075825][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.147031][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.155018][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.162935][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.170828][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.193979][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.202421][T10048] ldm_validate_partition_table(): Disk read failed. [ 514.209353][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.260643][T10048] Buffer I/O error on dev loop6, logical block 0, async page read [ 514.365807][T10048] Dev loop6: unable to read RDB block 0 [ 514.383889][T10048] loop6: unable to read partition table [ 514.828798][T10048] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 514.897651][ T5185] ldm_validate_partition_table(): Disk read failed. [ 514.907594][ T5185] Dev loop6: unable to read RDB block 0 [ 514.918235][ T5185] loop6: unable to read partition table [ 515.281706][T10071] No such timeout policy "syz1" [ 515.387563][ T30] audit: type=1326 audit(1767195270.611:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10056 comm="syz.4.1100" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7a2d78f749 code=0x7ffe0000 [ 515.643050][T10076] ptrace attach of "./syz-executor exec"[10075] was attempted by "./syz-executor exec"[10076] [ 517.142361][T10085] JFS: discard option not supported on device [ 517.153877][T10088] 9pnet_virtio: no channels available for device syz [ 517.211347][T10085] Mount JFS Failure: -22 [ 517.239527][T10085] jfs_mount failed w/return code = -22 [ 518.229198][T10097] xt_hashlimit: max too large, truncated to 1048576 [ 518.377769][ T30] audit: type=1400 audit(1767195273.491:435): avc: denied { write } for pid=10090 comm="syz.1.1107" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 519.051284][T10104] overlayfs: missing 'lowerdir' [ 520.035607][T10119] netlink: 'syz.3.1110': attribute type 2 has an invalid length. [ 520.054325][T10119] : entered promiscuous mode [ 522.372691][T10131] ceph: No mds server is up or the cluster is laggy [ 522.380161][ T5866] libceph: connect (1)[c::]:6789 error -101 [ 522.427944][ T5866] libceph: mon0 (1)[c::]:6789 connect error [ 522.730897][ T5887] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 523.704376][ T5887] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 523.737563][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.855141][ T5887] usb 1-1: config 0 descriptor?? [ 524.274398][T10138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.295353][T10138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.356955][ T5887] ath6kl: Failed to submit usb control message: -71 [ 524.586733][T10164] overlayfs: missing 'lowerdir' [ 525.472553][ T5887] ath6kl: unable to send the bmi data to the device: -71 [ 525.479606][ T5887] ath6kl: Unable to send get target info: -71 [ 525.517983][ T5887] ath6kl: Failed to init ath6kl core: -71 [ 525.627318][ T5887] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 525.663863][ T5887] usb 1-1: USB disconnect, device number 36 [ 525.860664][ T5866] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 526.300971][ T5866] usb 4-1: Using ep0 maxpacket: 32 [ 526.321897][ T5866] usb 4-1: config 4 has an invalid descriptor of length 49, skipping remainder of the config [ 526.340938][ T5866] usb 4-1: config 4 has 0 interfaces, different from the descriptor's value: 9 [ 526.362232][ T5866] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 526.380216][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.380584][ T5887] usb 1-1: new full-speed USB device number 37 using dummy_hcd [ 526.389564][ T5866] usb 4-1: Product: syz [ 526.552925][T10182] random: crng reseeded on system resumption [ 526.600844][ T30] audit: type=1400 audit(1767195281.781:436): avc: denied { read write } for pid=10177 comm="syz.1.1129" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 526.700661][ T5866] usb 4-1: Manufacturer: syz [ 526.705306][ T5866] usb 4-1: SerialNumber: syz [ 526.710809][ T30] audit: type=1400 audit(1767195281.781:437): avc: denied { ioctl open } for pid=10177 comm="syz.1.1129" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 526.893308][ T5887] usb 1-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x93, changing to 0x83 [ 526.907168][T10188] ./cgroup: Can't lookup blockdev [ 526.947140][ T5887] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 526.978814][ T5887] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x83 has invalid maxpacket 90, setting to 64 [ 527.009053][ T5887] usb 1-1: config 0 interface 0 has no altsetting 0 [ 527.030109][ T5887] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 527.100837][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 527.124885][ T5887] usb 1-1: Product: syz [ 527.129064][ T5887] usb 1-1: Manufacturer: syz [ 527.140813][ T5887] usb 1-1: SerialNumber: syz [ 527.149415][ T5866] usb 4-1: USB disconnect, device number 30 [ 527.261304][ T5887] usb 1-1: config 0 descriptor?? [ 527.292701][T10180] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 527.781491][ T5887] usb 1-1: selecting invalid altsetting 0 [ 527.868858][ T5887] usb 1-1: USB disconnect, device number 37 [ 528.032693][T10194] udevd[10194]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 528.240798][T10197] netlink: 'syz.3.1132': attribute type 30 has an invalid length. [ 528.848716][T10200] netlink: 'syz.3.1132': attribute type 30 has an invalid length. [ 529.002414][T10211] 9pnet_virtio: no channels available for device syz [ 529.413334][T10212] overlayfs: missing 'lowerdir' [ 530.756414][T10225] tipc: Started in network mode [ 530.780588][T10225] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 530.816241][T10225] tipc: Enabled bearer , priority 10 [ 530.952610][T10238] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1145'. [ 531.552618][T10238] hsr_slave_0: left promiscuous mode [ 531.559047][T10238] hsr_slave_1: left promiscuous mode [ 531.932471][ T5816] tipc: Node number set to 1 [ 532.278848][T10255] block device autoloading is deprecated and will be removed. [ 533.211252][T10261] overlayfs: missing 'lowerdir' [ 533.600655][ T5866] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 533.751946][ T5866] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 533.776046][ T5866] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.804767][ T5866] usb 1-1: config 0 descriptor?? [ 534.020575][ T5887] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 534.055043][T10258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.073159][T10258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.202396][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 534.203473][ T5866] ath6kl: Failed to submit usb control message: -71 [ 534.221182][ T5887] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 534.229357][ T5887] usb 3-1: config 1 has no interface number 0 [ 534.242554][ T5866] ath6kl: unable to send the bmi data to the device: -71 [ 534.260093][ T5866] ath6kl: Unable to send get target info: -71 [ 534.260553][ T5887] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 534.273003][ T5866] ath6kl: Failed to init ath6kl core: -71 [ 534.284818][ T5866] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 534.314478][ T5866] usb 1-1: USB disconnect, device number 38 [ 534.328236][ T5887] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 534.358784][ T5887] usb 3-1: config 1 interface 105 has no altsetting 0 [ 534.384310][ T5887] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 534.413770][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.437384][ T5887] usb 3-1: Product: syz [ 534.441685][ T5887] usb 3-1: Manufacturer: syz [ 534.446312][ T5887] usb 3-1: SerialNumber: syz [ 534.993498][T10275] FAULT_INJECTION: forcing a failure. [ 534.993498][T10275] name failslab, interval 1, probability 0, space 0, times 0 [ 535.006224][T10275] CPU: 0 UID: 0 PID: 10275 Comm: syz.3.1153 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.006246][T10275] Tainted: [L]=SOFTLOCKUP [ 535.006250][T10275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 535.006256][T10275] Call Trace: [ 535.006260][T10275] [ 535.006264][T10275] dump_stack_lvl+0x16c/0x1f0 [ 535.006282][T10275] should_fail_ex+0x512/0x640 [ 535.006297][T10275] ? kmem_cache_alloc_noprof+0x62/0x770 [ 535.006310][T10275] should_failslab+0xc2/0x120 [ 535.006324][T10275] kmem_cache_alloc_noprof+0x83/0x770 [ 535.006333][T10275] ? __might_fault+0xe3/0x190 [ 535.006342][T10275] ? getname_flags.part.0+0x4c/0x550 [ 535.006356][T10275] ? getname_flags.part.0+0x4c/0x550 [ 535.006365][T10275] getname_flags.part.0+0x4c/0x550 [ 535.006377][T10275] getname_flags+0x93/0xf0 [ 535.006391][T10275] user_path_at+0x24/0x60 [ 535.006404][T10275] __x64_sys_mount+0x1fb/0x310 [ 535.006414][T10275] ? __pfx___x64_sys_mount+0x10/0x10 [ 535.006429][T10275] do_syscall_64+0xcd/0xf80 [ 535.006443][T10275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.006455][T10275] RIP: 0033:0x7f449678f749 [ 535.006463][T10275] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 535.006474][T10275] RSP: 002b:00007f44975b4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 535.006484][T10275] RAX: ffffffffffffffda RBX: 00007f44969e6090 RCX: 00007f449678f749 [ 535.006490][T10275] RDX: 0000200000001300 RSI: 00002000000012c0 RDI: 0000200000000300 [ 535.006496][T10275] RBP: 00007f44975b4090 R08: 0000000000000000 R09: 0000000000000000 [ 535.006502][T10275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.006507][T10275] R13: 00007f44969e6128 R14: 00007f44969e6090 R15: 00007ffdacb15d38 [ 535.006521][T10275] [ 535.490122][T10265] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 535.511421][T10265] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 536.772590][T10265] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 536.779830][T10265] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 538.197458][ T5887] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 538.419483][T10301] overlayfs: missing 'lowerdir' [ 539.320880][ T5887] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 539.345750][ T5887] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 539.523698][ T5887] aqc111 3-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 66:6c:1b:a8:2c:1b [ 539.835370][ T5887] usb 3-1: USB disconnect, device number 32 [ 539.872518][ T5887] aqc111 3-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 540.151409][ T5887] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 540.184589][ T5887] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 540.212265][ T5887] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 540.294455][ T5873] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 540.351145][ T5873] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 541.078566][T10324] fido_id[10324]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 541.378398][ T5887] usb 1-1: new full-speed USB device number 39 using dummy_hcd [ 542.069618][T10346] netlink: 'syz.4.1168': attribute type 30 has an invalid length. [ 542.089669][ T5887] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 542.194094][T10349] netlink: 'syz.4.1168': attribute type 30 has an invalid length. [ 542.250722][ T5920] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 542.469973][T10341] 9pnet_virtio: no channels available for device syz [ 542.476856][ T5887] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 542.492542][ T5887] usb 1-1: config 8 has no interface number 0 [ 542.498948][ T5887] usb 1-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 542.502469][ T30] audit: type=1400 audit(1767195297.731:438): avc: denied { getopt } for pid=10351 comm="syz.3.1170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 542.512088][ T5887] usb 1-1: config 8 interface 177 has no altsetting 0 [ 542.539442][ T5887] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 542.560894][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.678331][T10353] xt_recent: Unsupported userspace flags (000000b1) [ 542.740052][ T5920] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 542.748857][ T5920] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 542.760309][ T5887] ir_toy 1-1:8.177: required endpoints not found [ 542.896539][ T5920] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 542.958898][ T5920] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 542.980153][ T5920] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 543.003742][ T5920] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 543.019879][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 543.045836][ T5920] usb 3-1: Product: syz [ 543.055963][ T5920] usb 3-1: Manufacturer: syz [ 543.078988][ T5920] cdc_wdm 3-1:1.0: skipping garbage [ 543.343023][ T5920] cdc_wdm 3-1:1.0: skipping garbage [ 543.351615][ T5920] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 543.371937][ T5920] cdc_wdm 3-1:1.0: Unknown control protocol [ 543.392248][ T5920] usb 3-1: USB disconnect, device number 33 [ 543.625283][ T5823] Bluetooth: hci0: connection err: -111 [ 543.965339][ T5920] usb 1-1: USB disconnect, device number 39 [ 544.564710][T10380] ptrace attach of ""[10379] was attempted by "./syz-executor exec"[10380] [ 545.205232][ T30] audit: type=1400 audit(1767195300.431:439): avc: denied { setattr } for pid=10395 comm="syz.3.1179" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 545.270592][ T5823] Bluetooth: hci4: unexpected event for opcode 0x2011 [ 546.699916][T10442] netlink: 'syz.3.1182': attribute type 30 has an invalid length. [ 546.809632][T10444] netlink: 'syz.3.1182': attribute type 30 has an invalid length. [ 546.821954][ T5884] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 546.874830][T10445] 9pnet_virtio: no channels available for device syz [ 546.992019][ T5884] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 547.013619][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 547.036872][ T5884] usb 3-1: config 0 descriptor?? [ 547.482131][T10435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.505763][T10435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.605583][ T5884] ath6kl: Failed to submit usb control message: -71 [ 547.641520][ T5884] ath6kl: unable to send the bmi data to the device: -71 [ 547.655390][ T5884] ath6kl: Unable to send get target info: -71 [ 547.689755][ T5884] ath6kl: Failed to init ath6kl core: -71 [ 547.706098][ T5884] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 547.750491][ T5884] usb 3-1: USB disconnect, device number 34 [ 549.170385][T10469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1188'. [ 549.199573][T10469] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1188'. [ 549.222928][T10469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1188'. [ 549.270692][T10469] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1188'. [ 551.924664][T10485] netlink: 'syz.2.1194': attribute type 30 has an invalid length. [ 551.988316][T10498] netlink: 'syz.2.1194': attribute type 30 has an invalid length. [ 552.052395][T10499] 9pnet_virtio: no channels available for device syz [ 552.216808][T10500] netlink: 'syz.1.1197': attribute type 30 has an invalid length. [ 552.316267][T10502] netlink: 'syz.1.1197': attribute type 30 has an invalid length. [ 552.338767][T10503] FAULT_INJECTION: forcing a failure. [ 552.338767][T10503] name failslab, interval 1, probability 0, space 0, times 0 [ 552.396106][T10504] 9pnet_virtio: no channels available for device syz [ 552.423619][T10503] CPU: 0 UID: 0 PID: 10503 Comm: syz.4.1199 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.423649][T10503] Tainted: [L]=SOFTLOCKUP [ 552.423655][T10503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 552.423664][T10503] Call Trace: [ 552.423670][T10503] [ 552.423677][T10503] dump_stack_lvl+0x16c/0x1f0 [ 552.423703][T10503] should_fail_ex+0x512/0x640 [ 552.423728][T10503] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 552.423757][T10503] should_failslab+0xc2/0x120 [ 552.423780][T10503] kmem_cache_alloc_noprof+0x83/0x770 [ 552.423798][T10503] ? skb_clone+0x190/0x3f0 [ 552.423820][T10503] ? skb_clone+0x190/0x3f0 [ 552.423836][T10503] skb_clone+0x190/0x3f0 [ 552.423854][T10503] netlink_deliver_tap+0xabd/0xd30 [ 552.423879][T10503] netlink_unicast+0x64c/0x870 [ 552.423903][T10503] ? __pfx_netlink_unicast+0x10/0x10 [ 552.423934][T10503] netlink_sendmsg+0x8c8/0xdd0 [ 552.423957][T10503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.423987][T10503] ____sys_sendmsg+0xa5d/0xc30 [ 552.424010][T10503] ? copy_msghdr_from_user+0x10a/0x160 [ 552.424031][T10503] ? __pfx_____sys_sendmsg+0x10/0x10 [ 552.424056][T10503] ? __lock_acquire+0x436/0x2890 [ 552.424077][T10503] ? __pfx___schedule+0x10/0x10 [ 552.424101][T10503] ___sys_sendmsg+0x134/0x1d0 [ 552.424120][T10503] ? __pfx____sys_sendmsg+0x10/0x10 [ 552.424136][T10503] ? find_held_lock+0x2b/0x80 [ 552.424190][T10503] __sys_sendmsg+0x16d/0x220 [ 552.424208][T10503] ? __pfx___sys_sendmsg+0x10/0x10 [ 552.424242][T10503] do_syscall_64+0xcd/0xf80 [ 552.424265][T10503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.424282][T10503] RIP: 0033:0x7f7a2d78f749 [ 552.424296][T10503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 552.424312][T10503] RSP: 002b:00007f7a2e6eb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 552.424328][T10503] RAX: ffffffffffffffda RBX: 00007f7a2d9e5fa0 RCX: 00007f7a2d78f749 [ 552.424339][T10503] RDX: 0000000000004800 RSI: 0000200000000000 RDI: 0000000000000003 [ 552.424349][T10503] RBP: 00007f7a2e6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 552.424359][T10503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.424369][T10503] R13: 00007f7a2d9e6038 R14: 00007f7a2d9e5fa0 R15: 00007ffeaba21a68 [ 552.424393][T10503] [ 553.527159][T10526] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1203'. [ 553.732804][T10526] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1203'. [ 556.447916][ T30] audit: type=1400 audit(1767195311.671:440): avc: denied { read } for pid=10553 comm="syz.3.1213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 559.999928][T10581] ptrace attach of "./syz-executor exec"[10585] was attempted by "./syz-executor exec"[10581] [ 562.642063][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.648368][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.598398][T10624] befs: (nullb0): invalid magic header [ 564.609404][T10624] FAULT_INJECTION: forcing a failure. [ 564.609404][T10624] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 564.622625][T10624] CPU: 1 UID: 0 PID: 10624 Comm: syz.2.1229 Tainted: G L syzkaller #0 PREEMPT(full) [ 564.622651][T10624] Tainted: [L]=SOFTLOCKUP [ 564.622657][T10624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 564.622667][T10624] Call Trace: [ 564.622674][T10624] [ 564.622681][T10624] dump_stack_lvl+0x16c/0x1f0 [ 564.622708][T10624] should_fail_ex+0x512/0x640 [ 564.622735][T10624] _copy_from_iter+0x2a4/0x16c0 [ 564.622765][T10624] ? __pfx__copy_from_iter+0x10/0x10 [ 564.622788][T10624] ? _copy_from_iter+0x161/0x16c0 [ 564.622826][T10624] skb_copy_datagram_from_iter+0x124/0x740 [ 564.622852][T10624] ? dev_get_by_index+0x17c/0x380 [ 564.622875][T10624] packet_sendmsg+0x2221/0x54a0 [ 564.622902][T10624] ? security_socket_sendmsg+0x21c/0x240 [ 564.622926][T10624] ? sock_has_perm+0x7b/0x2f0 [ 564.622947][T10624] ? sock_has_perm+0x258/0x2f0 [ 564.622964][T10624] ? __pfx_sock_has_perm+0x10/0x10 [ 564.622984][T10624] ? __pfx_packet_sendmsg+0x10/0x10 [ 564.623013][T10624] __sys_sendto+0x4a3/0x520 [ 564.623039][T10624] ? __pfx___sys_sendto+0x10/0x10 [ 564.623061][T10624] ? __schedule+0x114c/0x6150 [ 564.623088][T10624] ? __rcu_read_unlock+0x2b5/0x5a0 [ 564.623123][T10624] ? rcu_is_watching+0x12/0xc0 [ 564.623141][T10624] __x64_sys_sendto+0xe0/0x1c0 [ 564.623165][T10624] ? do_syscall_64+0x91/0xf80 [ 564.623184][T10624] ? lockdep_hardirqs_on+0x7c/0x110 [ 564.623203][T10624] do_syscall_64+0xcd/0xf80 [ 564.623224][T10624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.623240][T10624] RIP: 0033:0x7f315a98f749 [ 564.623254][T10624] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 564.623269][T10624] RSP: 002b:00007f3158bd5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 564.623286][T10624] RAX: ffffffffffffffda RBX: 00007f315abe6180 RCX: 00007f315a98f749 [ 564.623296][T10624] RDX: 0000000000000011 RSI: 0000200000000180 RDI: 0000000000000005 [ 564.623306][T10624] RBP: 00007f3158bd5090 R08: 0000200000000140 R09: 0000000000000014 [ 564.623316][T10624] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 564.623326][T10624] R13: 00007f315abe6218 R14: 00007f315abe6180 R15: 00007ffc306369f8 [ 564.623349][T10624] [ 565.088201][T10626] SELinux: Context system_u:object_r:systemd_logger_exec_t:s0 is not valid (left unmapped). [ 565.565230][ T30] audit: type=1400 audit(1767195320.791:441): avc: denied { relabelto } for pid=10620 comm="syz.1.1228" name="246" dev="tmpfs" ino=1448 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 565.658297][ T30] audit: type=1400 audit(1767195320.791:442): avc: denied { associate } for pid=10620 comm="syz.1.1228" name="246" dev="tmpfs" ino=1448 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 565.760456][T10639] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1233'. [ 565.863011][ T30] audit: type=1400 audit(1767195320.881:443): avc: denied { remove_name } for pid=5818 comm="syz-executor" name="memory.swap.current" dev="tmpfs" ino=1453 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 565.892007][T10639] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1233'. [ 565.986615][T10643] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1233'. [ 565.995625][ T30] audit: type=1400 audit(1767195320.881:444): avc: denied { rmdir } for pid=5818 comm="syz-executor" name="246" dev="tmpfs" ino=1448 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 566.051516][T10643] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1233'. [ 566.082687][ T4359] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.098933][ T4359] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.126234][ T4359] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.168593][ T4359] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 568.589049][T10689] bridge1: entered promiscuous mode [ 568.612982][T10689] bridge1: entered allmulticast mode [ 569.271326][T10700] xt_ecn: cannot match TCP bits for non-tcp packets [ 569.741713][T10702] netlink: 'syz.2.1245': attribute type 30 has an invalid length. [ 569.805425][T10703] netlink: 'syz.2.1245': attribute type 30 has an invalid length. [ 569.881008][T10704] 9pnet_virtio: no channels available for device syz [ 573.293062][T10759] netlink: 'syz.3.1260': attribute type 30 has an invalid length. [ 573.362961][T10760] netlink: 'syz.3.1260': attribute type 30 has an invalid length. [ 573.499652][T10759] 9pnet_virtio: no channels available for device syz [ 573.513343][ T5884] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 573.720698][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 573.735789][ T5884] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 574.026654][ T5884] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 574.065364][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 574.104092][ T5884] usb 3-1: Product: syz [ 574.108269][ T5884] usb 3-1: Manufacturer: syz [ 574.133997][ T5884] usb 3-1: SerialNumber: syz [ 574.161985][ T5884] usb 3-1: config 0 descriptor?? [ 574.181240][T10754] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 574.235421][T10764] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1263'. [ 574.279714][T10764] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1263'. [ 576.422317][ T5866] usb 3-1: USB disconnect, device number 35 [ 577.742355][T10799] ptrace attach of "./syz-executor exec"[10800] was attempted by "./syz-executor exec"[10799] [ 578.627768][T10806] FAULT_INJECTION: forcing a failure. [ 578.627768][T10806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 578.641001][T10806] CPU: 0 UID: 0 PID: 10806 Comm: syz.2.1277 Tainted: G L syzkaller #0 PREEMPT(full) [ 578.641026][T10806] Tainted: [L]=SOFTLOCKUP [ 578.641031][T10806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 578.641038][T10806] Call Trace: [ 578.641042][T10806] [ 578.641046][T10806] dump_stack_lvl+0x16c/0x1f0 [ 578.641064][T10806] should_fail_ex+0x512/0x640 [ 578.641082][T10806] _copy_from_user+0x2e/0xd0 [ 578.641097][T10806] copy_msghdr_from_user+0x98/0x160 [ 578.641109][T10806] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 578.641125][T10806] ___sys_sendmsg+0xfe/0x1d0 [ 578.641136][T10806] ? __pfx____sys_sendmsg+0x10/0x10 [ 578.641158][T10806] ? __pfx___might_resched+0x10/0x10 [ 578.641172][T10806] __sys_sendmmsg+0x200/0x420 [ 578.641184][T10806] ? __pfx___sys_sendmmsg+0x10/0x10 [ 578.641198][T10806] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 578.641218][T10806] ? fput+0x70/0xf0 [ 578.641227][T10806] ? ksys_write+0x1ac/0x250 [ 578.641239][T10806] ? __pfx_ksys_write+0x10/0x10 [ 578.641254][T10806] __x64_sys_sendmmsg+0x9c/0x100 [ 578.641264][T10806] ? lockdep_hardirqs_on+0x7c/0x110 [ 578.641277][T10806] do_syscall_64+0xcd/0xf80 [ 578.641290][T10806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.641301][T10806] RIP: 0033:0x7f315a98f749 [ 578.641310][T10806] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 578.641320][T10806] RSP: 002b:00007f3158bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 578.641330][T10806] RAX: ffffffffffffffda RBX: 00007f315abe6090 RCX: 00007f315a98f749 [ 578.641336][T10806] RDX: 03fffffffffffe3d RSI: 0000200000003e40 RDI: 0000000000000003 [ 578.641343][T10806] RBP: 00007f3158bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 578.641348][T10806] R10: 00000000000000f5 R11: 0000000000000246 R12: 0000000000000001 [ 578.641354][T10806] R13: 00007f315abe6128 R14: 00007f315abe6090 R15: 00007ffc306369f8 [ 578.641367][T10806] [ 579.547383][T10802] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57872 sclass=netlink_route_socket pid=10802 comm=syz.0.1275 [ 579.570873][T10802] tipc: Enabling of bearer rejected, failed to enable media [ 580.302122][T10815] netlink: 'syz.1.1279': attribute type 1 has an invalid length. [ 580.441377][ T30] audit: type=1400 audit(1767195335.661:445): avc: denied { setcheckreqprot } for pid=10814 comm="syz.1.1279" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 580.445808][T10815] SELinux: syz.1.1279 (10815) set checkreqprot to 1. This is no longer supported. [ 580.630590][ T5866] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 580.748091][T10827] FAULT_INJECTION: forcing a failure. [ 580.748091][T10827] name failslab, interval 1, probability 0, space 0, times 0 [ 580.762880][T10827] CPU: 1 UID: 0 PID: 10827 Comm: syz.2.1278 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.762907][T10827] Tainted: [L]=SOFTLOCKUP [ 580.762913][T10827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 580.762922][T10827] Call Trace: [ 580.762928][T10827] [ 580.762934][T10827] dump_stack_lvl+0x16c/0x1f0 [ 580.762960][T10827] should_fail_ex+0x512/0x640 [ 580.762989][T10827] should_failslab+0xc2/0x120 [ 580.763012][T10827] kmem_cache_alloc_node_noprof+0x86/0x800 [ 580.763029][T10827] ? __alloc_skb+0x156/0x410 [ 580.763059][T10827] ? __alloc_skb+0x156/0x410 [ 580.763081][T10827] __alloc_skb+0x156/0x410 [ 580.763103][T10827] ? __alloc_skb+0x35d/0x410 [ 580.763126][T10827] ? __pfx___alloc_skb+0x10/0x10 [ 580.763160][T10827] hci_sock_sendmsg+0x1b0c/0x26b0 [ 580.763187][T10827] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 580.763214][T10827] sock_write_iter+0x566/0x610 [ 580.763237][T10827] ? __pfx_sock_write_iter+0x10/0x10 [ 580.763267][T10827] ? bpf_lsm_file_permission+0x9/0x10 [ 580.763283][T10827] ? security_file_permission+0x71/0x210 [ 580.763307][T10827] ? rw_verify_area+0xcf/0x6c0 [ 580.763329][T10827] vfs_write+0x7d3/0x11d0 [ 580.763350][T10827] ? __pfx_sock_write_iter+0x10/0x10 [ 580.763373][T10827] ? __pfx_vfs_write+0x10/0x10 [ 580.763391][T10827] ? find_held_lock+0x2b/0x80 [ 580.763433][T10827] ksys_write+0x1f8/0x250 [ 580.763453][T10827] ? __pfx_ksys_write+0x10/0x10 [ 580.763481][T10827] do_syscall_64+0xcd/0xf80 [ 580.763509][T10827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.763525][T10827] RIP: 0033:0x7f315a98f749 [ 580.763539][T10827] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 580.763554][T10827] RSP: 002b:00007f315b751038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 580.763571][T10827] RAX: ffffffffffffffda RBX: 00007f315abe5fa0 RCX: 00007f315a98f749 [ 580.763583][T10827] RDX: 000000000000000d RSI: 0000200000000000 RDI: 0000000000000004 [ 580.763593][T10827] RBP: 00007f315b751090 R08: 0000000000000000 R09: 0000000000000000 [ 580.763603][T10827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 580.763612][T10827] R13: 00007f315abe6038 R14: 00007f315abe5fa0 R15: 00007ffc306369f8 [ 580.763638][T10827] [ 581.029553][ T5866] usb 4-1: config 0 has an invalid interface number: 107 but max is 0 [ 581.038143][ T5866] usb 4-1: config 0 has no interface number 0 [ 581.046164][ T5866] usb 4-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 65535, setting to 64 [ 581.079212][ T5866] usb 4-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 581.088314][ T5866] usb 4-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 581.097761][ T5866] usb 4-1: Product: syz [ 581.112093][ T5866] usb 4-1: Manufacturer: syz [ 581.122244][ T5866] usb 4-1: SerialNumber: syz [ 581.300200][ T5866] usb 4-1: config 0 descriptor?? [ 581.312543][T10820] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 581.322954][ T5866] keyspan 4-1:0.107: Keyspan 4 port adapter converter detected [ 581.348450][ T5866] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 81 [ 581.377643][ T5866] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 1 [ 581.406883][ T5866] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 581.443095][ T5866] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 2 [ 581.467409][ T5866] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 581.501189][ T5866] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 4 [ 581.556064][ T5866] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 581.622081][ T5866] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 6 [ 581.656762][ T5866] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 581.826113][ T5866] usb 4-1: USB disconnect, device number 31 [ 582.308697][ T5866] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 582.368901][ T5866] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 582.408426][ T5866] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 582.451002][ T5866] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 582.469379][ T5866] keyspan 4-1:0.107: device disconnected [ 583.168460][T10848] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1285'. [ 585.301816][ T30] audit: type=1326 audit(1767195340.171:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10865 comm="syz.3.1292" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f449678f749 code=0x0 [ 585.572673][T10879] FAULT_INJECTION: forcing a failure. [ 585.572673][T10879] name failslab, interval 1, probability 0, space 0, times 0 [ 585.585341][T10879] CPU: 1 UID: 0 PID: 10879 Comm: syz.1.1291 Tainted: G L syzkaller #0 PREEMPT(full) [ 585.585366][T10879] Tainted: [L]=SOFTLOCKUP [ 585.585372][T10879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 585.585381][T10879] Call Trace: [ 585.585387][T10879] [ 585.585394][T10879] dump_stack_lvl+0x16c/0x1f0 [ 585.585419][T10879] should_fail_ex+0x512/0x640 [ 585.585448][T10879] should_failslab+0xc2/0x120 [ 585.585469][T10879] kmem_cache_alloc_noprof+0x83/0x770 [ 585.585487][T10879] ? skb_clone+0x190/0x3f0 [ 585.585509][T10879] ? skb_clone+0x190/0x3f0 [ 585.585525][T10879] skb_clone+0x190/0x3f0 [ 585.585542][T10879] netlink_deliver_tap+0xabd/0xd30 [ 585.585566][T10879] netlink_unicast+0x64c/0x870 [ 585.585590][T10879] ? __pfx_netlink_unicast+0x10/0x10 [ 585.585620][T10879] netlink_sendmsg+0x8c8/0xdd0 [ 585.585644][T10879] ? __pfx_netlink_sendmsg+0x10/0x10 [ 585.585673][T10879] ____sys_sendmsg+0xa5d/0xc30 [ 585.585695][T10879] ? copy_msghdr_from_user+0x10a/0x160 [ 585.585712][T10879] ? __pfx_____sys_sendmsg+0x10/0x10 [ 585.585743][T10879] ? __lock_acquire+0x436/0x2890 [ 585.585766][T10879] ___sys_sendmsg+0x134/0x1d0 [ 585.585785][T10879] ? __pfx____sys_sendmsg+0x10/0x10 [ 585.585801][T10879] ? lock_acquire+0x179/0x330 [ 585.585849][T10879] __sys_sendmsg+0x16d/0x220 [ 585.585865][T10879] ? __pfx___sys_sendmsg+0x10/0x10 [ 585.585880][T10879] ? __pfx___schedule+0x10/0x10 [ 585.585906][T10879] ? rcu_is_watching+0x12/0xc0 [ 585.585929][T10879] do_syscall_64+0xcd/0xf80 [ 585.585951][T10879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.585968][T10879] RIP: 0033:0x7f770a98f749 [ 585.585981][T10879] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 585.585997][T10879] RSP: 002b:00007f770b858038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 585.586013][T10879] RAX: ffffffffffffffda RBX: 00007f770abe6180 RCX: 00007f770a98f749 [ 585.586023][T10879] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000008 [ 585.586033][T10879] RBP: 00007f770b858090 R08: 0000000000000000 R09: 0000000000000000 [ 585.586042][T10879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 585.586051][T10879] R13: 00007f770abe6218 R14: 00007f770abe6180 R15: 00007ffc2127e3c8 [ 585.586076][T10879] [ 585.586318][T10879] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1291'. [ 586.350617][T10862] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1288'. [ 586.729825][T10890] ptrace attach of "./syz-executor exec"[10891] was attempted by "./syz-executor exec"[10890] [ 587.315943][T10898] netlink: 'syz.2.1298': attribute type 3 has an invalid length. [ 587.324246][T10898] netlink: 'syz.2.1298': attribute type 3 has an invalid length. [ 587.839773][ T30] audit: type=1400 audit(1767195343.061:447): avc: denied { setopt } for pid=10895 comm="syz.0.1297" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 587.942196][T10905] netlink: 'syz.4.1300': attribute type 30 has an invalid length. [ 588.038071][T10907] netlink: 'syz.4.1300': attribute type 30 has an invalid length. [ 588.108197][T10904] 9pnet_virtio: no channels available for device syz [ 590.118808][T10925] ptrace attach of "./syz-executor exec"[10924] was attempted by "./syz-executor exec"[10925] [ 591.071576][T10938] FAULT_INJECTION: forcing a failure. [ 591.071576][T10938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 591.143424][T10938] CPU: 1 UID: 0 PID: 10938 Comm: syz.4.1308 Tainted: G L syzkaller #0 PREEMPT(full) [ 591.143455][T10938] Tainted: [L]=SOFTLOCKUP [ 591.143461][T10938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 591.143471][T10938] Call Trace: [ 591.143477][T10938] [ 591.143484][T10938] dump_stack_lvl+0x16c/0x1f0 [ 591.143511][T10938] should_fail_ex+0x512/0x640 [ 591.143540][T10938] _copy_to_user+0x32/0xd0 [ 591.143567][T10938] simple_read_from_buffer+0xcb/0x170 [ 591.143593][T10938] proc_fail_nth_read+0x197/0x240 [ 591.143612][T10938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 591.143632][T10938] ? rw_verify_area+0xcf/0x6c0 [ 591.143650][T10938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 591.143674][T10938] vfs_read+0x1e4/0xcf0 [ 591.143696][T10938] ? __pfx___mutex_lock+0x10/0x10 [ 591.143721][T10938] ? __pfx_vfs_read+0x10/0x10 [ 591.143748][T10938] ? __fget_files+0x20e/0x3c0 [ 591.143778][T10938] ksys_read+0x12a/0x250 [ 591.143798][T10938] ? __pfx_ksys_read+0x10/0x10 [ 591.143826][T10938] do_syscall_64+0xcd/0xf80 [ 591.143849][T10938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.143866][T10938] RIP: 0033:0x7f7a2d78e15c [ 591.143880][T10938] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 591.143896][T10938] RSP: 002b:00007f7a2e6eb030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 591.143912][T10938] RAX: ffffffffffffffda RBX: 00007f7a2d9e5fa0 RCX: 00007f7a2d78e15c [ 591.143923][T10938] RDX: 000000000000000f RSI: 00007f7a2e6eb0a0 RDI: 0000000000000005 [ 591.143932][T10938] RBP: 00007f7a2e6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 591.143942][T10938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 591.143951][T10938] R13: 00007f7a2d9e6038 R14: 00007f7a2d9e5fa0 R15: 00007ffeaba21a68 [ 591.143975][T10938] [ 592.375060][T10958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1312'. [ 595.437081][T10978] netlink: 'syz.0.1317': attribute type 30 has an invalid length. [ 595.490085][T10984] netlink: 'syz.0.1317': attribute type 30 has an invalid length. [ 595.653694][T10987] 9pnet_virtio: no channels available for device syz [ 595.999297][T10985] ptrace attach of "./syz-executor exec"[10993] was attempted by "./syz-executor exec"[10985] [ 596.603351][T10999] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1322'. [ 597.530812][ T5873] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 597.791702][ T5873] usb 1-1: Using ep0 maxpacket: 16 [ 597.810244][ T5873] usb 1-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 597.845338][ T5873] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.854701][T11011] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1326'. [ 597.859979][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.887282][ T5873] usb 1-1: config 0 descriptor?? [ 597.906280][ T5873] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 598.249053][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.360839][ T5873] gspca_sonixj: reg_r err -32 [ 598.382253][ T5873] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 598.772794][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.955518][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.283710][ T30] audit: type=1400 audit(1767195354.511:448): avc: denied { read } for pid=5480 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 599.402550][ T12] bridge_slave_1: left allmulticast mode [ 599.423386][ T12] bridge_slave_1: left promiscuous mode [ 599.430125][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.531950][ T12] bridge_slave_0: left allmulticast mode [ 599.551638][ T12] bridge_slave_0: left promiscuous mode [ 599.560823][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.835354][T11046] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 599.844026][T11046] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 599.866809][T11046] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 599.874490][T11046] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 599.882040][T11046] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 600.362604][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 600.377477][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 600.409206][ T12] bond0 (unregistering): Released all slaves [ 600.449973][T11035] : entered promiscuous mode [ 601.354082][ T30] audit: type=1400 audit(1767195356.331:449): avc: denied { execute } for pid=11056 comm="syz.1.1334" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=27245 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 601.582066][T11062] netlink: 'syz.3.1335': attribute type 30 has an invalid length. [ 601.667161][ T5920] usb 1-1: USB disconnect, device number 40 [ 601.673338][T11063] netlink: 'syz.3.1335': attribute type 30 has an invalid length. [ 601.712528][T11064] 9pnet_virtio: no channels available for device syz [ 601.931517][ T5823] Bluetooth: hci2: command tx timeout [ 603.461817][T11072] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1339'. [ 603.988589][T11076] binder: BC_ACQUIRE_RESULT not supported [ 604.010586][ T5823] Bluetooth: hci2: command tx timeout [ 604.020580][T11076] binder: 11075:11076 ioctl c0306201 2000000003c0 returned -22 [ 604.051125][T11076] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8265 sclass=netlink_route_socket pid=11076 comm=syz.3.1340 [ 604.937991][T11097] netlink: 'syz.0.1341': attribute type 30 has an invalid length. [ 605.058036][T11096] netlink: 'syz.0.1341': attribute type 30 has an invalid length. [ 605.147691][T11098] 9pnet_virtio: no channels available for device syz [ 606.173029][ T5823] Bluetooth: hci2: command tx timeout [ 606.960074][T11072] syz.2.1339 (11072): drop_caches: 2 [ 607.438525][T11122] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1346'. [ 607.535698][ T12] hsr_slave_0: left promiscuous mode [ 607.568443][ T12] hsr_slave_1: left promiscuous mode [ 607.625697][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 607.645884][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 607.677326][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 607.722574][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 607.763503][ T5920] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 607.838381][ T12] veth1_macvtap: left promiscuous mode [ 607.882524][T11129] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 608.171472][ T5920] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 608.190811][ T12] veth0_macvtap: left promiscuous mode [ 608.194386][ T5920] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 608.201890][ T12] veth1_vlan: left promiscuous mode [ 608.245017][ T5920] usb 3-1: New USB device found, idVendor=0079, idProduct=1801, bcdDevice= 0.00 [ 608.260596][ T5823] Bluetooth: hci2: command tx timeout [ 608.280330][ T5920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.293143][ T12] veth0_vlan: left promiscuous mode [ 608.304568][ T5920] usb 3-1: config 0 descriptor?? [ 608.317502][ T5920] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 609.553185][ T12] team0 (unregistering): Port device team_slave_1 removed [ 609.609366][ T12] team0 (unregistering): Port device team_slave_0 removed [ 609.777336][T11148] netlink: 'syz.0.1349': attribute type 30 has an invalid length. [ 609.830517][T11147] netlink: 'syz.0.1349': attribute type 30 has an invalid length. [ 610.002595][T11149] 9pnet_virtio: no channels available for device syz [ 610.548983][ T5920] usb 3-1: USB disconnect, device number 36 [ 611.338770][ T7523] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 611.975153][ T7523] usb 3-1: unable to get BOS descriptor or descriptor too short [ 612.004723][T11044] chnl_net:caif_netlink_parms(): no params data found [ 612.012228][ T7523] usb 3-1: config 174 has an invalid interface number: 153 but max is 0 [ 612.031167][ T7523] usb 3-1: config 174 has no interface number 0 [ 612.037447][ T7523] usb 3-1: config 174 interface 153 has no altsetting 0 [ 612.065536][ T7523] usb 3-1: New USB device found, idVendor=0f3d, idProduct=68a3, bcdDevice=77.4a [ 612.135568][ T7523] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.152672][ T7523] usb 3-1: Product: syz [ 612.156850][ T7523] usb 3-1: Manufacturer: syz [ 612.193832][ T7523] usb 3-1: SerialNumber: syz [ 612.399886][T11044] bridge0: port 1(bridge_slave_0) entered blocking state [ 612.419069][T11044] bridge0: port 1(bridge_slave_0) entered disabled state [ 612.481518][T11183] loop7: detected capacity change from 0 to 7 [ 612.489078][ C1] blk_print_req_error: 25 callbacks suppressed [ 612.489094][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.504838][ C1] buffer_io_error: 23 callbacks suppressed [ 612.504851][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.519314][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.528902][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.539662][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.549259][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.557684][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.567277][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.577367][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.586954][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.608099][T11185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 612.616780][T11185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 612.628344][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.637929][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.727883][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.737510][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.745410][T11183] ldm_validate_partition_table(): Disk read failed. [ 612.769754][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.779366][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.801714][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.811315][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.822408][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 612.831985][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 612.840559][T11183] Dev loop7: unable to read RDB block 0 [ 612.847788][T11183] loop7: unable to read partition table [ 612.854398][T11183] loop7: partition table beyond EOD, truncated [ 612.860768][T11183] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 614.317996][T11044] bridge_slave_0: entered allmulticast mode [ 614.328950][T11044] bridge_slave_0: entered promiscuous mode [ 614.343385][T11044] bridge0: port 2(bridge_slave_1) entered blocking state [ 614.351183][T11044] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.358322][T11044] bridge_slave_1: entered allmulticast mode [ 614.365534][T11044] bridge_slave_1: entered promiscuous mode [ 614.609990][ T7523] sierra 3-1:174.153: Sierra USB modem converter detected [ 614.646362][T11044] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 614.656214][ T7523] usb 3-1: USB disconnect, device number 37 [ 614.710056][T11044] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 614.768535][ T7523] sierra 3-1:174.153: device disconnected [ 615.017271][T11044] team0: Port device team_slave_0 added [ 615.032763][T11044] team0: Port device team_slave_1 added [ 615.526297][T11044] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 615.541575][T11044] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 615.603927][T11044] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 615.628467][T11044] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 615.638902][T11044] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 615.689427][T11044] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 616.046476][ T7523] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 616.143954][T11044] hsr_slave_0: entered promiscuous mode [ 616.181556][T11044] hsr_slave_1: entered promiscuous mode [ 616.227325][ T7523] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 616.237560][ T7523] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.296007][ T7523] usb 4-1: config 0 descriptor?? [ 616.541281][T11217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 616.587174][T11217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 616.765152][T11233] sch_fq: defrate 0 ignored. [ 616.907431][ T7523] ath6kl: Failed to submit usb control message: -71 [ 616.917363][ T7523] ath6kl: unable to send the bmi data to the device: -71 [ 616.926087][ T7523] ath6kl: Unable to send get target info: -71 [ 616.987436][ T7523] ath6kl: Failed to init ath6kl core: -71 [ 617.007748][T11044] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 617.008468][ T7523] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 617.075509][ T7523] usb 4-1: USB disconnect, device number 32 [ 617.128079][T11044] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 617.140789][T11044] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 617.158003][T11044] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 617.536253][T11251] FAULT_INJECTION: forcing a failure. [ 617.536253][T11251] name failslab, interval 1, probability 0, space 0, times 0 [ 617.564197][T11251] CPU: 0 UID: 0 PID: 11251 Comm: syz.3.1367 Tainted: G L syzkaller #0 PREEMPT(full) [ 617.564225][T11251] Tainted: [L]=SOFTLOCKUP [ 617.564230][T11251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 617.564240][T11251] Call Trace: [ 617.564245][T11251] [ 617.564251][T11251] dump_stack_lvl+0x16c/0x1f0 [ 617.564276][T11251] should_fail_ex+0x512/0x640 [ 617.564302][T11251] should_failslab+0xc2/0x120 [ 617.564325][T11251] kmem_cache_alloc_node_noprof+0x86/0x800 [ 617.564342][T11251] ? __alloc_skb+0x156/0x410 [ 617.564371][T11251] ? __alloc_skb+0x156/0x410 [ 617.564391][T11251] __alloc_skb+0x156/0x410 [ 617.564413][T11251] ? __alloc_skb+0x35d/0x410 [ 617.564448][T11251] ? __pfx___alloc_skb+0x10/0x10 [ 617.564467][T11251] ? __asan_memset+0x23/0x50 [ 617.564491][T11251] xfrm_alloc_compat+0xb9c/0x1290 [ 617.564519][T11251] ? __pfx_xfrm_alloc_compat+0x10/0x10 [ 617.564549][T11044] 8021q: adding VLAN 0 to HW filter on device bond0 [ 617.564544][T11251] xfrm_send_state_notify+0x192d/0x1fb0 [ 617.564570][T11251] ? __pfx_xfrm_send_state_notify+0x10/0x10 [ 617.564595][T11251] ? __pfx_xfrm_send_state_notify+0x10/0x10 [ 617.564617][T11251] km_state_notify+0xab/0x230 [ 617.564636][T11251] pfkey_flush+0x2fc/0x340 [ 617.564655][T11251] ? __pfx_pfkey_flush+0x10/0x10 [ 617.564670][T11251] ? kfree_skbmem+0x1a4/0x1f0 [ 617.564689][T11251] ? sk_skb_reason_drop+0x136/0x1a0 [ 617.564705][T11251] ? pfkey_broadcast+0x2af/0x460 [ 617.564721][T11251] ? __pfx_pfkey_flush+0x10/0x10 [ 617.564738][T11251] pfkey_process+0x6dc/0x840 [ 617.564753][T11251] ? trace_contention_end+0xdd/0x110 [ 617.564772][T11251] ? __mutex_lock+0x27b/0x1ca0 [ 617.564791][T11251] ? __pfx_pfkey_process+0x10/0x10 [ 617.564829][T11251] pfkey_sendmsg+0x42c/0x850 [ 617.564850][T11251] ____sys_sendmsg+0xa5d/0xc30 [ 617.564868][T11251] ? copy_msghdr_from_user+0x10a/0x160 [ 617.564882][T11251] ? __pfx_____sys_sendmsg+0x10/0x10 [ 617.564910][T11251] ___sys_sendmsg+0x134/0x1d0 [ 617.564926][T11251] ? __pfx____sys_sendmsg+0x10/0x10 [ 617.564967][T11251] __sys_sendmsg+0x16d/0x220 [ 617.564981][T11251] ? __pfx___sys_sendmsg+0x10/0x10 [ 617.565009][T11251] do_syscall_64+0xcd/0xf80 [ 617.565029][T11251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.565043][T11251] RIP: 0033:0x7f449678f749 [ 617.565055][T11251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 617.565068][T11251] RSP: 002b:00007f44975d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 617.565082][T11251] RAX: ffffffffffffffda RBX: 00007f44969e5fa0 RCX: 00007f449678f749 [ 617.565091][T11251] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 617.565100][T11251] RBP: 00007f44975d5090 R08: 0000000000000000 R09: 0000000000000000 [ 617.565108][T11251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 617.565117][T11251] R13: 00007f44969e6038 R14: 00007f44969e5fa0 R15: 00007ffdacb15d38 [ 617.565138][T11251] [ 617.876708][T11044] 8021q: adding VLAN 0 to HW filter on device team0 [ 617.889657][ T7063] bridge0: port 1(bridge_slave_0) entered blocking state [ 617.896758][ T7063] bridge0: port 1(bridge_slave_0) entered forwarding state [ 617.936116][ T7063] bridge0: port 2(bridge_slave_1) entered blocking state [ 617.943266][ T7063] bridge0: port 2(bridge_slave_1) entered forwarding state [ 618.792427][T11044] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.820945][ T30] audit: type=1326 audit(1767195374.031:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 618.878938][ T30] audit: type=1326 audit(1767195374.031:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.033778][ T30] audit: type=1326 audit(1767195374.031:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.086221][ T30] audit: type=1400 audit(1767195374.031:453): avc: denied { kexec_image_load } for pid=11260 comm="syz.2.1369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 619.116343][ T30] audit: type=1326 audit(1767195374.031:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.182074][ T30] audit: type=1326 audit(1767195374.101:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.425592][ T30] audit: type=1326 audit(1767195374.101:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.511880][ T7523] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 619.526277][ T30] audit: type=1326 audit(1767195374.101:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.588888][ T30] audit: type=1326 audit(1767195374.131:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.670559][ T7523] usb 4-1: Using ep0 maxpacket: 32 [ 619.675799][ T30] audit: type=1326 audit(1767195374.141:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11260 comm="syz.2.1369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f315a98f749 code=0x7ffc0000 [ 619.677200][ T7523] usb 4-1: config 4 has an invalid descriptor of length 49, skipping remainder of the config [ 619.766872][ T7523] usb 4-1: config 4 has 0 interfaces, different from the descriptor's value: 9 [ 619.795002][ T7523] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 619.804778][ T7523] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.813321][ T7523] usb 4-1: Product: syz [ 619.818990][ T7523] usb 4-1: Manufacturer: syz [ 619.825859][ T7523] usb 4-1: SerialNumber: syz [ 620.308451][T11044] veth0_vlan: entered promiscuous mode [ 620.349021][ T7523] usb 4-1: USB disconnect, device number 33 [ 620.365718][T11044] veth1_vlan: entered promiscuous mode [ 620.467078][T11044] veth0_macvtap: entered promiscuous mode [ 620.495554][T11044] veth1_macvtap: entered promiscuous mode [ 620.538556][T11044] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 620.572563][T11044] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 620.667021][ T3923] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 620.677642][ T3923] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 620.703980][ T3923] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 620.739498][ T3923] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.360167][ T7063] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 621.474796][ T7063] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 621.538450][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 621.552261][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 621.836469][T11304] hfsplus: unable to find HFS+ superblock [ 623.853434][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.859814][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 623.953632][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 623.953747][ T30] audit: type=1400 audit(1767195379.181:494): avc: denied { map } for pid=11324 comm="syz.0.1383" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 624.030553][ T10] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 624.083448][ T30] audit: type=1400 audit(1767195379.311:495): avc: denied { ioctl } for pid=11324 comm="syz.0.1383" path="socket:[29845]" dev="sockfs" ino=29845 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 624.218243][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 624.227520][ T10] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 624.236768][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.260333][ T10] usb 3-1: Product: syz [ 624.264847][ T10] usb 3-1: Manufacturer: syz [ 624.299070][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 624.306257][T11334] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1384'. [ 624.314369][ T10] usb 3-1: SerialNumber: syz [ 624.385202][ T10] usb 3-1: config 0 descriptor?? [ 624.408557][T11343] serio: Serial port ttyS3 [ 624.460642][ T5884] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 624.503777][T11347] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1388'. [ 624.516488][T11347] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1388'. [ 624.591887][ T30] audit: type=1400 audit(1767195379.761:496): avc: denied { write } for pid=11339 comm="syz.0.1386" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 625.029058][T11353] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57872 sclass=netlink_route_socket pid=11353 comm=syz.1.1389 [ 625.046719][T11353] tipc: Started in network mode [ 625.051612][T11353] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 625.060716][T11353] tipc: Enabled bearer , priority 10 [ 625.439305][ T10] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 625.452844][ T5884] usb 4-1: Using ep0 maxpacket: 32 [ 625.462946][ T5884] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 625.481391][ T5884] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 625.490288][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 625.503800][ T5884] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 625.524880][ T10] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 625.536366][ T5884] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 625.547956][ T10] usb 3-1: media controller created [ 625.553174][ T5884] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 625.568384][ T5884] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 625.578736][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 625.588701][ T5884] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 625.624605][ T5884] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 625.790927][ T6437] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 625.819009][ T5884] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 625.840613][ T5884] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.861063][ T5884] usb 4-1: config 0 descriptor?? [ 625.950540][ T6437] usb 6-1: Using ep0 maxpacket: 32 [ 625.957100][ T6437] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 625.990559][ T6437] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.019962][ T6437] usb 6-1: config 0 descriptor?? [ 626.081299][ T5920] tipc: Node number set to 1 [ 626.087341][ T5884] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 34 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 626.247785][ T6437] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 626.260791][ T10] zl10353_read_register: readreg error (reg=127, ret==0) [ 626.270203][ T10] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 626.360833][ T30] audit: type=1400 audit(1767195381.581:497): avc: denied { ioctl } for pid=11337 comm="syz.3.1385" path="socket:[29898]" dev="sockfs" ino=29898 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 626.567233][T11347] ------------[ cut here ]------------ [ 626.572922][T11347] usb 3-1: BOGUS control dir, pipe 80002680 doesn't match bRequestType c0 [ 626.581469][T11347] WARNING: drivers/usb/core/urb.c:412 at usb_submit_urb+0x153e/0x1970, CPU#1: syz.5.1388/11347 [ 626.591866][T11347] Modules linked in: [ 626.595887][T11347] CPU: 1 UID: 0 PID: 11347 Comm: syz.5.1388 Tainted: G L syzkaller #0 PREEMPT(full) [ 626.606877][T11347] Tainted: [L]=SOFTLOCKUP [ 626.610223][ T6437] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 626.611248][T11347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 626.629404][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 626.630576][T11347] RIP: 0010:usb_submit_urb+0x1549/0x1970 [ 626.641109][ T6437] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 626.645474][T11347] Code: 30 48 89 7c 24 38 e8 d6 b8 a8 fa 48 8b 7c 24 38 e8 0c 77 d0 fe 48 89 c6 48 8d 3d 12 44 7e 09 48 8b 54 24 30 45 89 e8 44 89 f9 <67> 48 0f b9 3a e9 fd ed ff ff 48 89 7c 24 30 e8 a3 b8 a8 fa 48 8b [ 626.671927][T11347] RSP: 0018:ffffc90003597688 EFLAGS: 00010287 [ 626.677968][T11347] RAX: ffffffff8c545660 RBX: ffff8880540d9c00 RCX: 0000000080002680 [ 626.685941][T11347] RDX: ffff888079c3bd80 RSI: ffffffff8c545660 RDI: ffffffff90947410 [ 626.694194][T11347] RBP: ffff8880290d9058 R08: 00000000000000c0 R09: 0000000000000000 [ 626.702276][T11347] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888053a68a20 [ 626.710263][T11347] R13: 00000000000000c0 R14: 0000000000000001 R15: 0000000080002680 [ 626.715777][ T6437] usb 6-1: media controller created [ 626.718277][T11347] FS: 00007f8e1e7016c0(0000) GS:ffff8881249f5000(0000) knlGS:0000000000000000 [ 626.732377][T11347] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 626.739081][T11347] CR2: 0000001b2fff4ff8 CR3: 000000004d906000 CR4: 00000000003526f0 [ 626.747139][T11347] Call Trace: [ 626.750392][T11347] [ 626.753319][T11347] ? __init_swait_queue_head+0xca/0x150 [ 626.758844][T11347] usb_start_wait_urb+0x104/0x4e0 [ 626.763857][T11347] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 626.769379][T11347] ? __asan_memset+0x23/0x50 [ 626.773967][T11347] usb_control_msg+0x326/0x4a0 [ 626.778707][T11347] ? __pfx_usb_control_msg+0x10/0x10 [ 626.783987][T11347] dtv5100_i2c_msg+0x1fa/0x360 [ 626.788743][T11347] dtv5100_i2c_xfer+0x1e0/0x420 [ 626.793598][T11347] __i2c_transfer+0x6b6/0x2100 [ 626.798337][T11347] ? __pfx___i2c_transfer+0x10/0x10 [ 626.803535][T11347] ? lockdep_hardirqs_on+0x7c/0x110 [ 626.809325][T11347] ? finish_task_switch.isra.0+0x207/0xbd0 [ 626.815275][T11347] i2c_smbus_xfer_emulated+0x230/0x1210 [ 626.820815][T11347] ? trace_sched_exit_tp+0xd1/0x110 [ 626.825986][T11347] ? __pfx_i2c_smbus_xfer_emulated+0x10/0x10 [ 626.831960][T11347] ? preempt_schedule_thunk+0x16/0x30 [ 626.837584][T11347] __i2c_smbus_xfer+0x836/0xf60 [ 626.842495][T11347] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 626.847842][T11347] ? rt_mutex_slowtrylock+0xc9/0x100 [ 626.853156][T11347] i2c_smbus_xfer+0x200/0x3c0 [ 626.857810][T11347] ? i2cdev_ioctl_smbus+0x324/0x990 [ 626.863008][T11347] i2cdev_ioctl_smbus+0x237/0x990 [ 626.868004][T11347] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 626.873542][T11347] ? __might_fault+0xe3/0x190 [ 626.878187][T11347] ? __might_fault+0xe3/0x190 [ 626.882857][T11347] i2cdev_ioctl+0x361/0x840 [ 626.887343][T11347] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 626.892361][T11347] ? selinux_file_ioctl+0x180/0x270 [ 626.897542][T11347] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 626.902561][T11347] __x64_sys_ioctl+0x18e/0x210 [ 626.907307][T11347] do_syscall_64+0xcd/0xf80 [ 626.911811][T11347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.917674][T11347] RIP: 0033:0x7f8e1d78f749 [ 626.922076][T11347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 626.941815][T11347] RSP: 002b:00007f8e1e701038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 626.950195][T11347] RAX: ffffffffffffffda RBX: 00007f8e1d9e5fa0 RCX: 00007f8e1d78f749 [ 626.958236][T11347] RDX: 0000200000000180 RSI: 0000000000000720 RDI: 000000000000000c [ 626.966215][T11347] RBP: 00007f8e1d813f91 R08: 0000000000000000 R09: 0000000000000000 [ 626.974282][T11347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 626.982277][T11347] R13: 00007f8e1d9e6038 R14: 00007f8e1d9e5fa0 R15: 00007ffcfa7f5278 [ 626.990235][T11347] [ 626.993240][T11347] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 627.000496][T11347] CPU: 1 UID: 0 PID: 11347 Comm: syz.5.1388 Tainted: G L syzkaller #0 PREEMPT(full) [ 627.011438][T11347] Tainted: [L]=SOFTLOCKUP [ 627.015728][T11347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 627.025753][T11347] Call Trace: [ 627.029003][T11347] [ 627.031905][T11347] dump_stack_lvl+0x3d/0x1f0 [ 627.036467][T11347] vpanic+0x640/0x6f0 [ 627.040420][T11347] ? usb_submit_urb+0x153e/0x1970 [ 627.045414][T11347] panic+0xca/0xd0 [ 627.049106][T11347] ? __pfx_panic+0x10/0x10 [ 627.053497][T11347] check_panic_on_warn+0xab/0xb0 [ 627.058408][T11347] __warn+0x108/0x3c0 [ 627.062359][T11347] __report_bug+0x2a0/0x520 [ 627.066831][T11347] ? usb_submit_urb+0x153e/0x1970 [ 627.071827][T11347] ? __pfx___report_bug+0x10/0x10 [ 627.076830][T11347] ? lockdep_hardirqs_on+0x7c/0x110 [ 627.082001][T11347] ? usb_submit_urb+0x1549/0x1970 [ 627.087000][T11347] report_bug_entry+0xe1/0x290 [ 627.091732][T11347] ? usb_submit_urb+0x1549/0x1970 [ 627.096725][T11347] handle_bug+0x18a/0x260 [ 627.101027][T11347] exc_invalid_op+0x17/0x50 [ 627.105504][T11347] asm_exc_invalid_op+0x1a/0x20 [ 627.110320][T11347] RIP: 0010:usb_submit_urb+0x1549/0x1970 [ 627.115924][T11347] Code: 30 48 89 7c 24 38 e8 d6 b8 a8 fa 48 8b 7c 24 38 e8 0c 77 d0 fe 48 89 c6 48 8d 3d 12 44 7e 09 48 8b 54 24 30 45 89 e8 44 89 f9 <67> 48 0f b9 3a e9 fd ed ff ff 48 89 7c 24 30 e8 a3 b8 a8 fa 48 8b [ 627.135498][T11347] RSP: 0018:ffffc90003597688 EFLAGS: 00010287 [ 627.141531][T11347] RAX: ffffffff8c545660 RBX: ffff8880540d9c00 RCX: 0000000080002680 [ 627.149472][T11347] RDX: ffff888079c3bd80 RSI: ffffffff8c545660 RDI: ffffffff90947410 [ 627.157414][T11347] RBP: ffff8880290d9058 R08: 00000000000000c0 R09: 0000000000000000 [ 627.165354][T11347] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888053a68a20 [ 627.173292][T11347] R13: 00000000000000c0 R14: 0000000000000001 R15: 0000000080002680 [ 627.181247][T11347] ? usb_submit_urb+0x1534/0x1970 [ 627.186253][T11347] ? __init_swait_queue_head+0xca/0x150 [ 627.191772][T11347] usb_start_wait_urb+0x104/0x4e0 [ 627.196776][T11347] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 627.202299][T11347] ? __asan_memset+0x23/0x50 [ 627.206861][T11347] usb_control_msg+0x326/0x4a0 [ 627.211596][T11347] ? __pfx_usb_control_msg+0x10/0x10 [ 627.216854][T11347] dtv5100_i2c_msg+0x1fa/0x360 [ 627.221590][T11347] dtv5100_i2c_xfer+0x1e0/0x420 [ 627.226409][T11347] __i2c_transfer+0x6b6/0x2100 [ 627.231157][T11347] ? __pfx___i2c_transfer+0x10/0x10 [ 627.236332][T11347] ? lockdep_hardirqs_on+0x7c/0x110 [ 627.241502][T11347] ? finish_task_switch.isra.0+0x207/0xbd0 [ 627.247287][T11347] i2c_smbus_xfer_emulated+0x230/0x1210 [ 627.252808][T11347] ? trace_sched_exit_tp+0xd1/0x110 [ 627.257976][T11347] ? __pfx_i2c_smbus_xfer_emulated+0x10/0x10 [ 627.263945][T11347] ? preempt_schedule_thunk+0x16/0x30 [ 627.269289][T11347] __i2c_smbus_xfer+0x836/0xf60 [ 627.274117][T11347] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 627.279464][T11347] ? rt_mutex_slowtrylock+0xc9/0x100 [ 627.284725][T11347] i2c_smbus_xfer+0x200/0x3c0 [ 627.289376][T11347] ? i2cdev_ioctl_smbus+0x324/0x990 [ 627.294545][T11347] i2cdev_ioctl_smbus+0x237/0x990 [ 627.299541][T11347] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 627.305054][T11347] ? __might_fault+0xe3/0x190 [ 627.309699][T11347] ? __might_fault+0xe3/0x190 [ 627.314347][T11347] i2cdev_ioctl+0x361/0x840 [ 627.318822][T11347] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 627.323816][T11347] ? selinux_file_ioctl+0x180/0x270 [ 627.328989][T11347] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 627.333993][T11347] __x64_sys_ioctl+0x18e/0x210 [ 627.338729][T11347] do_syscall_64+0xcd/0xf80 [ 627.343204][T11347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.349074][T11347] RIP: 0033:0x7f8e1d78f749 [ 627.353482][T11347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 627.373073][T11347] RSP: 002b:00007f8e1e701038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 627.381459][T11347] RAX: ffffffffffffffda RBX: 00007f8e1d9e5fa0 RCX: 00007f8e1d78f749 [ 627.389400][T11347] RDX: 0000200000000180 RSI: 0000000000000720 RDI: 000000000000000c [ 627.397340][T11347] RBP: 00007f8e1d813f91 R08: 0000000000000000 R09: 0000000000000000 [ 627.405281][T11347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 627.413223][T11347] R13: 00007f8e1d9e6038 R14: 00007f8e1d9e5fa0 R15: 00007ffcfa7f5278 [ 627.421178][T11347] [ 627.424436][T11347] Kernel Offset: disabled [ 627.428732][T11347] Rebooting in 86400 seconds..