last executing test programs: 6m41.216891825s ago: executing program 1 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x4001090) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f00000006c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x76, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, @void, @value}, 0x28) ioctl$KVM_RUN(r7, 0xae80, 0x0) execve(0x0, 0x0, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000000000), 0x4) write$dsp(0xffffffffffffffff, 0x0, 0xffda) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmmsg$inet6(r2, 0x0, 0x0, 0x20004855) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r10 = socket(0x10, 0x80002, 0x0) write$P9_RLERRORu(r9, &(0x7f0000000000)=ANY=[@ANYBLOB="1c00000007ffff", @ANYRES16=r10, @ANYRESDEC], 0x52) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x80, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[{@version_9p2000}]}}) 6m38.687361082s ago: executing program 1 (id=15): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x61, 0x80000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000d26a871dba07e83f34c6e27805b682"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[], 0xd0}}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$ptys(0xc, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x8, 0x2) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0xffffffffffffffff) add_key$user(0x0, &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000400)="577f2f2031df941a722903822507c7b1874e292ca445893fdefab65558aa76156da9b27c0375c23b4ec1f03174cd16f09957a881553f5a3c854d2540ff35ce188a86f2189525abafeb781a7fa398c6b3a21ebe4372adc92c85a383381888b4a4728206bc5c82d6af8d002819680bedb63b8dad261b3ddfd23023177fd29b5afa800eee8ef690b896c91e7d371ce54902c6ff4cea36844830ff86dc70ce6bd0cb0cd5f64fe2cab9d1a7cd74e703a268246a71dc0366756b52deb51a27465c0136b957b30cddbe08e8803c0124bb0d2db6496e7121c9624417a4621d9d841a8d2e9d0f803a", 0xe4, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r1, 0x0, 0xcc, &(0x7f0000000280)={@private, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23bd0f4eb500"}, 0x3c) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=@newqdisc={0x3c, 0x24, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xffff}, {0xa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_DQ_RATE_ESTIMATOR={0x8, 0xc, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, 0x0, 0x0) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000100)=0x1, 0x4) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) chdir(&(0x7f0000000540)='./cgroup\x00') r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="10000000121401002cbd7000ff98618fe39bf052194118a15996bf8edbdf25"], 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x4000) 6m36.908314767s ago: executing program 1 (id=20): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) madvise(&(0x7f0000000000/0x600000)=nil, 0xffffffffffffffff, 0x14) r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x20000, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x5, &(0x7f0000000200)={0x77359400}, 0x1, 0x8}) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000020000000000000f9ffff0b8500000007000000850000000700000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='sys_exit\x00', r6, 0x0, 0x100000000}, 0x18) rt_sigprocmask(0x1, &(0x7f0000001000)={[0x4]}, 0x0, 0x8) r7 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet6(r7, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002b40)='u', 0x1}], 0x1}}], 0x1, 0x0) 6m34.510072897s ago: executing program 1 (id=26): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) socket$kcm(0x29, 0x7, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x32) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000380)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x4, 0x4}}, 0x26) ioctl$PPPIOCGL2TPSTATS(r3, 0x80047453, 0xfffffffffffffffe) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102376, 0x18fe8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) r5 = socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r6, 0x84, 0x7, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x47bc, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="1c00000000000004000080060011802fe50000a913061589260e2b4147940636d1bfc2cb1a77e2cc55cbaa89154c685d7bad3cb8165a8c774cd76e", @ANYRESHEX, @ANYRESDEC=r6], 0x1c}], 0x1}, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe38, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 6m33.565849178s ago: executing program 1 (id=30): socket$xdp(0x2c, 0x3, 0x0) r0 = socket(0x10, 0x2, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) io_submit(r1, 0x2e, &(0x7f0000000380)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0x40, r0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x0]) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000540)={0x1, 0x0, &(0x7f0000000340)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000580)={&(0x7f0000000180)=[0x0, 0x0], &(0x7f00000003c0)=[{}, {}, {}, {}, {}], 0x0, &(0x7f0000000300)=[0x0, 0x0], 0x5, 0x0, 0x2, 0x0, r3}) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000040)={0x80, 0x30, 0x0, 0x258, 0xffff845f, 0x3000, 0x0, 0x0, {0x10, 0x4}, {0x8, 0x2, 0x2}, {0xffffffff, 0x20000, 0x2}, {0x0, 0x0, 0x8000000}, 0x0, 0x0, 0x0, 0x13fd, 0x1, 0x9, 0x0, 0xfffffffd, 0x2b6b7db2, 0x6, 0x0, 0x100000, 0x0, 0x0, 0x2, 0x4}) ftruncate(0xffffffffffffffff, 0x2007ffb) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000000201005) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000240), 0x200000, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r6 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r5, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29, r6}, './file0\x00'}) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x5, {[@local=@item_012={0x1, 0x2, 0x9, "c8"}, @global=@item_012={0x2, 0x1, 0x1, "3887"}]}}, 0x0}, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r8, 0x0, 0x0, 0x409c884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) r9 = syz_usb_connect$cdc_ncm(0x0, 0x7b, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x2, 0x1, 0x2, 0x30, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x1, "01"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x7, 0x70b, 0x2}, {0x6, 0x24, 0x1a, 0xe3c6}, [@mbim={0xc, 0x24, 0x1b, 0x9, 0x650b, 0x5, 0x3, 0x6, 0x9}]}, {{0x9, 0x5, 0x81, 0x3, 0x100, 0x5, 0x8, 0x4}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x2, 0xf, 0x6b}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x6e, 0x8, 0xc0}}}}}}}]}}, &(0x7f0000000d00)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x110, 0xbd, 0x4, 0xe, 0x40, 0x46}, 0xe7, &(0x7f0000000600)={0x5, 0xf, 0xe7, 0x6, [@generic={0xa0, 0x10, 0xb, "486567eb02ce572b792e942807faebf83639dbdb75a377deaaef606398c0dbcf80d74eebe5a80ff5007d78c87f70b9c98a479ae0e43b1febc7546319bcdd063d84475340a231b928ab8017a79b19433678623adbca33729be4a21a9cb1246b46885285f6ff49261490e3813c99bbf0c6e6aec9dad951417b885bedc3388e3953100cc7d6040ca58d4547bab32235028d168996c562b027eda627798ebe"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "b8f20f4a55e3620d76878ea9afed2237"}, @generic={0x15, 0x10, 0xb, "3cbf5e4c1e44c1ec58bc03f1bb92cf46901a"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xf, 0x78, 0x80, 0x21, 0xff}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0xe9, 0x8, 0x2, 0xfffb, 0x9}]}, 0x9, [{0x3c, &(0x7f00000002c0)=@string={0x3c, 0x3, "cb234a2179f11aede90ed0dccbc254b3aea5d340b851794ea0b3ac0b6a62b241defbedad1a42d974b6c6ca5e12cafc1839abe722249641ce5550"}}, {0x102, &(0x7f00000009c0)=@string={0x102, 0x3, "b1e579d4e10f4fbfe9e042aeaaeed591a292cc86bdc2a2e84e3c0f64fbfc29dbb52304df766d5fd9a7fb6a4dcc8c8d58da93d255c0da5fd50c97dcc50c3c97317728725ce8a3d0b20cfacff2d1acc4d32d87915a0990be244449aa3de607ab3ceda2746285ffab9bf0d33142f3333b8f9fcc4491d39eb71197ef909084754c7528151fc740c969020b296a4747678130cbaa49910e5f5dd9c9110728a1208f40c664418b8b9b2060a1fdcfc265bef7df7ba6db7221d118fa6c4a6efc9096c39da23cd672113d5bbeaca7c599bc83addd4086cee11491f2b20df5052f04c148fb204e9c4b92d642a532703cc2c8fc7e5aab18a9cafebc0545bb0808decdc54a0b"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x416}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x2008}}, {0x75, &(0x7f0000000800)=@string={0x75, 0x3, "3465b98a1e44c067580b2d1aa79e1be92dad6bf8e18eafa2a02920d803665ffd764481a8278884271311e8e6d0c4d03ccdad20f34dfabaaeb1787731a7ddbac9ad695b31cae542ef7c0c8b8d9d8ab9dc506b335bd23aac9f366d757540ff4dfa694a6692a538e1378de5652836c8a5286209f4"}}, {0xcf, &(0x7f0000000b00)=@string={0xcf, 0x3, "bf691e4e8b5d7e800335cac5f8bb794c610ccd54bdef0fd97b976bc884e1ca2aa3cc2ce9dee0ed8de4a80377e35724515d8f9e09f5d95195c2597f0727a63944f82b8a4513d925e4d7b44cd62ca5ea012a5230af05bb43d0f7dcc628589b9be90eb22677fa56631a5914dd64f8493cc800be13dd99eb10d5c2b1a16c9652c1ea7b538a4a5084952bb0ec33a829587befc2bd435cdb83a19465ab7e86337c3931aa7528e8f9ddfc52ca8f00ed23495add50554d358b3bb6a83df964f29bea00fd3beddd70fbb0ccdc0ae8b5d045"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x80a}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x861}}, {0xb4, &(0x7f0000000c40)=@string={0xb4, 0x3, "79aaf1b3c5859d26fa601f3f1d86630d2dd6432076bc03326a9e50f62251dae0b7c66b4c344b855971f280105c777e22e45359d23b9485755be6bdd4a6f3601e6e95aac8741c53de7919911d976ad5a1fc87a82514d5e0b334951acd8f01462e02227f47f783a082d24484791dd9532c1ebe393e28d488b0009288023a049ef4163f2fb1136b719997313687ee1a89ea25863265adf0365446063b1cc75ce49f788558eb3997c223d2d57966b7b134d27285"}}]}) getsockname$packet(r0, &(0x7f0000001180), &(0x7f00000011c0)=0x14) syz_usb_control_io$cdc_ncm(r9, &(0x7f0000000ec0)={0x14, &(0x7f0000000dc0)={0x0, 0x30, 0xa8, {0xa8, 0x13, "6347c01079e5892f37da7ae930f4fd4bef1522d72fc87ccb19131e49b3e5e6ce5208f720f7e1a608051abba2ba06b102d11f093f6a48cbc0f6c8e8782bade5e1f798571998efb21b1d91cb40a1ff3a294a33ce060e64f3c317e5240a6d05aff499955b88df4ef074475c6e4041b6514d2a259e16314d1480ed0dfca702c4779e545dbc50397aedb8f028df6c16a34af9e7d609fdcfc155c54a435628749568c8f94cacc0a85b"}}, &(0x7f0000000e80)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001100)={0x44, &(0x7f0000000f00)={0x20, 0x14, 0x33, "e463f0fe91f3d73c5d1009066fce63ecd2b87c132039c657874010028685516f07505d087a1d203226f4c8016f5f5c83d0a9aa"}, &(0x7f0000000f40)={0x0, 0xa, 0x1, 0xda}, &(0x7f0000000f80)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000fc0)={0x20, 0x80, 0x1c, {0x8000, 0x400, 0x3, 0x8, 0x200, 0xacc, 0x6, 0x6, 0x10, 0x7, 0x6, 0x800}}, &(0x7f0000001000)={0x20, 0x85, 0x4, 0x90000000}, &(0x7f0000001040)={0x20, 0x83, 0x2}, &(0x7f0000001080)={0x20, 0x87, 0x2, 0x4}, &(0x7f00000010c0)={0x20, 0x89, 0x2, 0x1}}) sendto$inet6(r8, &(0x7f0000000000)='I', 0x1, 0x0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 6m27.62741766s ago: executing program 1 (id=46): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_io_uring_setup(0x496, &(0x7f0000000400)={0x0, 0x448a, 0x200, 0x8000, 0xa}, &(0x7f0000000140), &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x24}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r1, r1, r1}, 0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={'hmac(sha256)\x00'}}) syz_emit_vhci(&(0x7f00000000c0)=ANY=[], 0xf) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000ffdbdf254300000008000300", @ANYRES16=r6, @ANYBLOB='\x00'/12], 0x28}, 0x1, 0x0, 0x0, 0x10004080}, 0x40000) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r5, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f00000005c0)={0x1cc, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5, 0x83, 0x1}}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x40000}, 0x4008000) sendmsg$nl_route(r3, &(0x7f0000000380)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f0000000f80)=ANY=[@ANYBLOB="ac100000180000042bbd7000fbdbdf250a142404fe00fd020000000008001700ff7f0000041008800eab844db7d645e36e24738fe43f6743b3aece8f420c7b3f90b9cff157e0e5688e63f780dc2740037d57c256f2e2b1db9eb0f14c8065eb0dd34b66c10ecd6913e623bb5438af9bced4b860b32cfcdaf7dbcbd296e8c11886a41e708da72e6b5c0d2f47c5f7309804df0b517a746946d1ff4108f36751777338fca0f94980817786d949de610f0bff59dd2ddacdfe659af3ae8adc448a93f835083e1febc9ff886aedd50d0afccc25b286b81e33869dc63efb6f0e2097eb5ff3873fd1562859a4db082884961aee979922182b11e150df94a8a9ad0bb7c88de13fe62b5aa1b4af451baf19605d1c3bb49adab39832650e4a155faa24253ffdc32d701af27f777dcfe9de34c761f36e819f56e1b5a78a3d8f84f157b3bf064a850afc0847c7d8bd550b1ff30bcc237d61f2283e118d3cd88eb58ae9930f746b649e3702c65141b2ff58eb177c1e0cc4844c4d64f79ffba286f615058303ab2511e15f7953788db0e566dc624a85f80b214065ed13d5581430e18a72d83e8a58b33902e623a7a6160ea58dd446c385ad73f9b63ce36e9fd4219d97e160ae5182de3ca81a35136d8a169b6435b26af77fb5bbe0b25fe08ed343a84e27688c8742d70c18565556137c9ac3cb20c7b49b602524a87559aa2491c452b36ccad6a2d2800a568e4266cb0379e805fd66f8c8df89175a1a055c47cb379ae66fe20ca35b0204ac5a7a6009f00dfcb9d1467035f419203b3e6b65ed606e17739241adfb637e060843f38944b6320869db5ed7dfb11d9f217524dd62fb351202ce31878ab93bce01ca3f9964d7fad6ce116721e9e0f189aea13d54708074972e23410fc8aed8c9842ecc6a650a4d0a44ccdcc8e71a49857044b8babb405eb3f51e6ec5c488c5f132bccef83de67827626699184107af768ff4c9d58244c6fff20e3a32d159f8d9bac50a4c8285f8dcf2cf91fc7c263a3fefd5160f0b4955e8314cf6cbf19b9e264888e0ca3d9c028b6e46580190674d28878dc09b2813bea3b732713f27d35cc61ef1f6da22aa6b0e30147bd6d5fbafaee4238da800beb203c44987faf1fde7c73645e304e4b1b80ca8f06cae3255e1ba22e0e0172648eb7d0bd96931cf297b58f19167c50ac969979b0aac30459485963219244468d85fdbb674932664c1f104cb7b16d88da716e42c622c4ec33f54158299fca5a7afec5a80f336a61eac0e61a4a021b4d23f6953ccf685357e4a4d2eaa3ad556a8f58e3f62f88ce3136c25468eb70b9178114c7da701ea9243267aed30434a0ad0cb9c0211f5750e83a5a5e67855460b87819db1166f2c47f756a6453db26406ee087c0de276d33c218e079ab8434da4bff0af314b7bd1eed613dc03135b5d38df6d7d8dfd4684e25944a04f0faa3467b136b84b78fef6f7ec9acd1303016095af434702ef91c2cd59b43858c81936fb321759173976b47e79a7b8c879962572d7285a0633107cf3f00961f9117736f493c10cb69ed28d0491f54e24ce4b3c8b57ce1b1c0466e04f02c69edb257580ef47e2c064d81c6d5c06edd84b1ed0d75da3c442fd540f6fcfa9c5430170fdfa0695b5aba52bc6636c9a37cc49a00f060f154157dde60ea38098fc5056719ec31a0cdafef71bc0cf6c94310c46bcb3956d8cad234e4bd988754c7ff57bb870ddafe1cba16b1378165eef742f5388b5aab68bfc19ccd5577ef5f5cf1f2a74091dca103c13c1dabe3eba566b1478de71fd09e51ea4a550ba4196779b040ec0e2539b1f5795dff3965fc6ea08ba2f44d980b7ab7835ab59b331c751e47387d80e4ee21ba7203ad2808e3ff394f4272ddf29424488ff8a633042a51917cd00505a61630fdab3c94c8c110d5a3e32e886d2135e075164c3e81012b4d8eebc6d15c4255e35c2dd4c317f3db64ab27483feb21d80aefae685ae60165f59eeb50e9002d5bc0f5cd0eaeec0bda1258a8065e15114214e8032b77f94f83396168fbddb07d510d87fd8f3e8933ee9151d93836f95e22cf36cb6b46caee7332d8635d7c2d28b2315a39250b177274bb4a0947715b415845ece25225e491f350afdd6d3f4aa6a7cf5f550e5c25b8dfc3f43fdca654a60c6bf9f7b75b967a252277bb2a230ea02761a319c4ca63a4c85bdf18935520bed2466bc59a7d569a4e36b8fef33858ae50838492a4b1a86fa281ef82ab03a3c143deb97b503b0a5bdb0cdfa2eac6b7b83e932f4ba4a06351f18b8f61be15cae9340d08d67b010d16f6a52fb8e4193bb39c495c09dddc2de08fe4fa501bf6f7659d5a27dc4ccdef44c966a820a3c9d35ad509807111ffb62de900612b62fa5b675ace56a6304fb6ab4aeaa868392dd1846a8e25a37d0890c998a29e43a5e0818932cdff49bdc59c8e240afb4f9b8f8ef852a0eb3d08fd1da0aed2105d154a89a302fe758a1e6602047d011f7a105750fbaab3a0a7451e9c2b6ba6dd74776e3fbb97fbd4dd336f366dc25f990996f6829646da1be96963688d3378434c26e56c6578f233e80e8262faf9904b26d41a52fbbceef08276d20ecc793579be378e930407004521600a3987bf0f83e229eba5707257afe588fc2ef60141be2730c1d68846807d7990a0548cc96b4bd04dcc4af49b397656c5b476f975a730c2bd21b1472e53dca6bf790f3a659e3c22dd9cebd58747dc3b8964d6d33402b5faa381bc677f1d9979275503e08f8a8d4130789061984879833af910d780fecdd6f0a65f0774dfa471e20e09cc17178e65250222e76c9eebc41cd5c977f2df32337f76a16703325f5397fefe73964dbd71461567d56408bb8438fa71dc26c5b925d83568930092c6cc1f3e6e2f64cd0fc94237db80b92ff9640bbca324ff2428c1309054a5557d9577303451dbc01bdba0c8441e1e96d33b58f31604d7b6439992a82f6bbb3199d152b86b63f21d2912d6ed82253ad36665538d85c3094bb34f50888e81a1ec7c4f57412f764428790cd85a3f720de9e9aa423404552ce8a883ef357e8b1d3b06ff10d41c4eb5203ea6340b05c001cab2e6716857d8a1cc4510e736716e2fb440c33c6683c0b1d013b590b16b39fb0aae594e299ab6f57c1eec3b66fb51d46e911ef4943810178ca0a7b1e03c59eb50c0e9824e0fee99a11167aa5c1c67b041947b38920c1a92eeab0fe60d52d1866083b361434e2ce7740769206ba18cc2a3caaeebd3efa5ccc6df3df253a9b9c321263633d4b007f6c1f300b5a9d3b11e5ea879b739a83ad73fea63b440cf98a75640baae744de500bdd078e0eb41e7111d1c5d49cef52a71e8c5cdb9e9f91b166ed23126614496cf98eaad9a452d3dcd36b84398c2c3f38558e4cce6570b14d87bf855b8caa9aca9bc6bb523cdb694faf02dd1a8c496ff5ebd23cf5809886a380c3b8975e2d2e8c7eaa9ecddb29e19d7121fd4468b91ef97b140274ad2dbf1d07754264c288589c1f38e3ae66297e3707b8817f9fe7e278060c7ff3a07a1efed0de4f7e4a90b3185bebd7354d3a173884f2d67a8fb4d4a5427ed44454747f1fef82dcff4ad78df5e959495b367c9ba50940a0cdac6573eac72015899990c03151b2d4dd9e4e4b726bb94a63e98a2b12ea2c5981831ee7c2f0e505825b7dcbb2dad4a7c968d031fad96622de33af226abe9a594429d72c17b5e6b41cf0653275b19c890863440d14147a1fb95ef529c1ba935ae5064df63fb8ca8b3efc210adf6fd201c4f4565e8e2a981a60d76abb07a46016f85ed2c856cc5880c7d77dbc52bce2b86c4bec97ea5a246c6777765339bc1ed8e41e156c4f5f10d80da6fe7c8ed4d776361dc4eab3b5af0a0bfd9648dde4cb6bb776b9ec9a24af0668515d4a5dd6a15ca4bfe43ab0028e4a724a892cf2ae3fcf5cc00e7c051c454f17e6aa3a34e3b35aecff0c3ef16a948d47ac6a567a63fbb5a36887e2aaf624b35571e91b4b4fefd4836758d4caacb5e4ccf94ead061b63a11e212050c33d76346967af29e01ef8c47d62820782d3075fab4422f8d0cb228730ea2a795fed8b6482b360c78973f9d16e790ba5a4582c78bbd608315db15c8b47475da0d982075944f4fa925bd41df6983106cc635fe9d6e6dc3833f0caf76d755e7803d18dd1d45f6cd1f4306baf0afe3d3c23d334d4e78f7cf6efcd2382b7545b9e94b677b6000a070827ba27e0303ff9678166de09e97c5f7ada50f9581002625cfc4041017d6f7caee3cf9d6a26f86111848861df014243bbacf960b3bbe8ee2fda25823e83ca0bd02cacb567d72d8aee9afbafba132b41c748ab55e0f8c2a61e06ba056d093a756b885eefa660782cc12301e3dad2197ef0212203d16f746b49d0dbd62ba98446174c7de46be1ecafd439abaf14ac82a37ee7add2f573533236284a00a84bb31fc341e852a821d208771f63b936e69bfe4f06d1c913c77dd3ecf66dc46eb6124c963a830f863a2a9693d00c92cc6b43ce1f0c7c882d9f7ab618c9bd48656c3263a8ea0ec471c0d645907bde38afaf070f8e3bb3cbc5f434d66954d8b9e9f1d7f4ae6ba06aad8b1b9969b3a83096705e0031cae24d82c6368cefa73a306948e69e6a594a23fb1d0459c0eb27d95b6255d937b58830b36285ca296851e1e2a7d8c0000e69dc182007d58519344aeea6fa415e0ae9ca8d4bf542f63efa0b88c8b929be561d82cb17158691d1bb69107807d0be496c295a5dd731195b47b1e9432477c94df7c460762e59a5f9d269219ef40e7209fabdb3c8a2fa2bda55f0ff2c932cddb2ca602de27260712792df8deff81e763da4e4074c8a59ea2216876c8b5784199a56c19e972fd5a8b6a222a83aaf60fa9d56e6b1a55b4ae6560d83c735d2f2f8002b754dab01fdbe9b9dc5a811b1545c78b6304ba2ab00bff068699c326268d618afac9c336d3f7b0dad0432a5c7e0260c1dfdf6f4d378394235b089da6458928c9eff441af73d595307240750241ed15a234191707b7c5d9279f8adbbcf26ce6821383bb2a0c2eefd9c26c87123ceafce31ec946d7ca6693b90ea4af9ad03691932cafacd445dc45d1c03f4042733040e4f7592ce797283d212bde680f4b6b48ee6d75052bee9b6a1bd27b22c86df24c3adab8049645d33ca7c11edeba9c53a1fbe6294e1529095268910032a6d5b758908ab59ef8991672b2dffe9c86563a6d42c4b457f784b7dec05f05a860a47a53c9e2730120278a6838dcdcc2c81c6ac7882c1c89d5430839106ad008f223049d851daa5d221e8a1de3725089c45115c31749645cb5f511eaa222022a99e4f3730b16fa8e2c2741a075935e9d11cba44f15e1ba91ca337218a664945d5011bcca984650f15cc9ebed11007169b6c9139b3cc09df1e950167b60bf73bca28a8b5ca5e628133e62c6f880916c6b78617a066d23a5038df77af06e559126c275ba8fadfcd4b66b590315a3405ff8e864bdba2928c4e324b9297273a5eabab6e203c5a2c6c3cbe9a3ad61de85108829fce8bec87ed8d9fc6cc881eea7768146bb7e82d07d024e94cad8a2348cf8f3112d8bd532bb1920cd3c36e761b6222943d78f09923ad13fe87a81cb191a7c49def347ffdd3959d01ff9d5e6ca77278ecae6bc13bf4d0a73536896a987f0ad982054fc376b603a50600035b024f5fb7e72935097aa7b13a29d2abdc78954536aa1629a7bc4a4cc569815aa3f0af10d80c7a566aa5ebfc728fcd48936c71bd57c89d37edbfa184918563789fbc8faba4dc447e428d1045bf106a37ad6875fb5fa5675b0b1ea176112ed01a99af0417c4cbe92bde818cde584d2ed44a283f278fc2f502bf018c6b6c4baad0876e0600150005000000080010000a00000008", @ANYRES32=r4, @ANYBLOB="0600150000000000620008806565eb962103eee419f2e7e7a6eb93261700f0583a01079ea23ce1f9ed74e008000000000000004fda6705683364ec501cba5f22964349814802bc9f71ee89da9a148775138f09ca17dbfb2ea594e9862fbd1eeb3f0b515fee8dec697b8c0001"], 0x10ac}, 0x1, 0x0, 0x0, 0x4}, 0x10) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r2, 0x0, 0x0, 0x80800) sendmsg$nl_netfilter(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0xffffff70}, 0x1, 0x0, 0x0, 0x200050c0}, 0x20000080) recvmmsg(r7, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000900), 0x3}, 0x17ba}], 0x1e, 0x2000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) 6m11.745097336s ago: executing program 32 (id=46): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_io_uring_setup(0x496, &(0x7f0000000400)={0x0, 0x448a, 0x200, 0x8000, 0xa}, &(0x7f0000000140), &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x24}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r1, r1, r1}, 0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={'hmac(sha256)\x00'}}) syz_emit_vhci(&(0x7f00000000c0)=ANY=[], 0xf) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000ffdbdf254300000008000300", @ANYRES16=r6, @ANYBLOB='\x00'/12], 0x28}, 0x1, 0x0, 0x0, 0x10004080}, 0x40000) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r5, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f00000005c0)={0x1cc, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5, 0x83, 0x1}}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x40000}, 0x4008000) sendmsg$nl_route(r3, &(0x7f0000000380)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f0000000f80)=ANY=[@ANYBLOB="ac100000180000042bbd7000fbdbdf250a142404fe00fd020000000008001700ff7f0000041008800eab844db7d645e36e24738fe43f6743b3aece8f420c7b3f90b9cff157e0e5688e63f780dc2740037d57c256f2e2b1db9eb0f14c8065eb0dd34b66c10ecd6913e623bb5438af9bced4b860b32cfcdaf7dbcbd296e8c11886a41e708da72e6b5c0d2f47c5f7309804df0b517a746946d1ff4108f36751777338fca0f94980817786d949de610f0bff59dd2ddacdfe659af3ae8adc448a93f835083e1febc9ff886aedd50d0afccc25b286b81e33869dc63efb6f0e2097eb5ff3873fd1562859a4db082884961aee979922182b11e150df94a8a9ad0bb7c88de13fe62b5aa1b4af451baf19605d1c3bb49adab39832650e4a155faa24253ffdc32d701af27f777dcfe9de34c761f36e819f56e1b5a78a3d8f84f157b3bf064a850afc0847c7d8bd550b1ff30bcc237d61f2283e118d3cd88eb58ae9930f746b649e3702c65141b2ff58eb177c1e0cc4844c4d64f79ffba286f615058303ab2511e15f7953788db0e566dc624a85f80b214065ed13d5581430e18a72d83e8a58b33902e623a7a6160ea58dd446c385ad73f9b63ce36e9fd4219d97e160ae5182de3ca81a35136d8a169b6435b26af77fb5bbe0b25fe08ed343a84e27688c8742d70c18565556137c9ac3cb20c7b49b602524a87559aa2491c452b36ccad6a2d2800a568e4266cb0379e805fd66f8c8df89175a1a055c47cb379ae66fe20ca35b0204ac5a7a6009f00dfcb9d1467035f419203b3e6b65ed606e17739241adfb637e060843f38944b6320869db5ed7dfb11d9f217524dd62fb351202ce31878ab93bce01ca3f9964d7fad6ce116721e9e0f189aea13d54708074972e23410fc8aed8c9842ecc6a650a4d0a44ccdcc8e71a49857044b8babb405eb3f51e6ec5c488c5f132bccef83de67827626699184107af768ff4c9d58244c6fff20e3a32d159f8d9bac50a4c8285f8dcf2cf91fc7c263a3fefd5160f0b4955e8314cf6cbf19b9e264888e0ca3d9c028b6e46580190674d28878dc09b2813bea3b732713f27d35cc61ef1f6da22aa6b0e30147bd6d5fbafaee4238da800beb203c44987faf1fde7c73645e304e4b1b80ca8f06cae3255e1ba22e0e0172648eb7d0bd96931cf297b58f19167c50ac969979b0aac30459485963219244468d85fdbb674932664c1f104cb7b16d88da716e42c622c4ec33f54158299fca5a7afec5a80f336a61eac0e61a4a021b4d23f6953ccf685357e4a4d2eaa3ad556a8f58e3f62f88ce3136c25468eb70b9178114c7da701ea9243267aed30434a0ad0cb9c0211f5750e83a5a5e67855460b87819db1166f2c47f756a6453db26406ee087c0de276d33c218e079ab8434da4bff0af314b7bd1eed613dc03135b5d38df6d7d8dfd4684e25944a04f0faa3467b136b84b78fef6f7ec9acd1303016095af434702ef91c2cd59b43858c81936fb321759173976b47e79a7b8c879962572d7285a0633107cf3f00961f9117736f493c10cb69ed28d0491f54e24ce4b3c8b57ce1b1c0466e04f02c69edb257580ef47e2c064d81c6d5c06edd84b1ed0d75da3c442fd540f6fcfa9c5430170fdfa0695b5aba52bc6636c9a37cc49a00f060f154157dde60ea38098fc5056719ec31a0cdafef71bc0cf6c94310c46bcb3956d8cad234e4bd988754c7ff57bb870ddafe1cba16b1378165eef742f5388b5aab68bfc19ccd5577ef5f5cf1f2a74091dca103c13c1dabe3eba566b1478de71fd09e51ea4a550ba4196779b040ec0e2539b1f5795dff3965fc6ea08ba2f44d980b7ab7835ab59b331c751e47387d80e4ee21ba7203ad2808e3ff394f4272ddf29424488ff8a633042a51917cd00505a61630fdab3c94c8c110d5a3e32e886d2135e075164c3e81012b4d8eebc6d15c4255e35c2dd4c317f3db64ab27483feb21d80aefae685ae60165f59eeb50e9002d5bc0f5cd0eaeec0bda1258a8065e15114214e8032b77f94f83396168fbddb07d510d87fd8f3e8933ee9151d93836f95e22cf36cb6b46caee7332d8635d7c2d28b2315a39250b177274bb4a0947715b415845ece25225e491f350afdd6d3f4aa6a7cf5f550e5c25b8dfc3f43fdca654a60c6bf9f7b75b967a252277bb2a230ea02761a319c4ca63a4c85bdf18935520bed2466bc59a7d569a4e36b8fef33858ae50838492a4b1a86fa281ef82ab03a3c143deb97b503b0a5bdb0cdfa2eac6b7b83e932f4ba4a06351f18b8f61be15cae9340d08d67b010d16f6a52fb8e4193bb39c495c09dddc2de08fe4fa501bf6f7659d5a27dc4ccdef44c966a820a3c9d35ad509807111ffb62de900612b62fa5b675ace56a6304fb6ab4aeaa868392dd1846a8e25a37d0890c998a29e43a5e0818932cdff49bdc59c8e240afb4f9b8f8ef852a0eb3d08fd1da0aed2105d154a89a302fe758a1e6602047d011f7a105750fbaab3a0a7451e9c2b6ba6dd74776e3fbb97fbd4dd336f366dc25f990996f6829646da1be96963688d3378434c26e56c6578f233e80e8262faf9904b26d41a52fbbceef08276d20ecc793579be378e930407004521600a3987bf0f83e229eba5707257afe588fc2ef60141be2730c1d68846807d7990a0548cc96b4bd04dcc4af49b397656c5b476f975a730c2bd21b1472e53dca6bf790f3a659e3c22dd9cebd58747dc3b8964d6d33402b5faa381bc677f1d9979275503e08f8a8d4130789061984879833af910d780fecdd6f0a65f0774dfa471e20e09cc17178e65250222e76c9eebc41cd5c977f2df32337f76a16703325f5397fefe73964dbd71461567d56408bb8438fa71dc26c5b925d83568930092c6cc1f3e6e2f64cd0fc94237db80b92ff9640bbca324ff2428c1309054a5557d9577303451dbc01bdba0c8441e1e96d33b58f31604d7b6439992a82f6bbb3199d152b86b63f21d2912d6ed82253ad36665538d85c3094bb34f50888e81a1ec7c4f57412f764428790cd85a3f720de9e9aa423404552ce8a883ef357e8b1d3b06ff10d41c4eb5203ea6340b05c001cab2e6716857d8a1cc4510e736716e2fb440c33c6683c0b1d013b590b16b39fb0aae594e299ab6f57c1eec3b66fb51d46e911ef4943810178ca0a7b1e03c59eb50c0e9824e0fee99a11167aa5c1c67b041947b38920c1a92eeab0fe60d52d1866083b361434e2ce7740769206ba18cc2a3caaeebd3efa5ccc6df3df253a9b9c321263633d4b007f6c1f300b5a9d3b11e5ea879b739a83ad73fea63b440cf98a75640baae744de500bdd078e0eb41e7111d1c5d49cef52a71e8c5cdb9e9f91b166ed23126614496cf98eaad9a452d3dcd36b84398c2c3f38558e4cce6570b14d87bf855b8caa9aca9bc6bb523cdb694faf02dd1a8c496ff5ebd23cf5809886a380c3b8975e2d2e8c7eaa9ecddb29e19d7121fd4468b91ef97b140274ad2dbf1d07754264c288589c1f38e3ae66297e3707b8817f9fe7e278060c7ff3a07a1efed0de4f7e4a90b3185bebd7354d3a173884f2d67a8fb4d4a5427ed44454747f1fef82dcff4ad78df5e959495b367c9ba50940a0cdac6573eac72015899990c03151b2d4dd9e4e4b726bb94a63e98a2b12ea2c5981831ee7c2f0e505825b7dcbb2dad4a7c968d031fad96622de33af226abe9a594429d72c17b5e6b41cf0653275b19c890863440d14147a1fb95ef529c1ba935ae5064df63fb8ca8b3efc210adf6fd201c4f4565e8e2a981a60d76abb07a46016f85ed2c856cc5880c7d77dbc52bce2b86c4bec97ea5a246c6777765339bc1ed8e41e156c4f5f10d80da6fe7c8ed4d776361dc4eab3b5af0a0bfd9648dde4cb6bb776b9ec9a24af0668515d4a5dd6a15ca4bfe43ab0028e4a724a892cf2ae3fcf5cc00e7c051c454f17e6aa3a34e3b35aecff0c3ef16a948d47ac6a567a63fbb5a36887e2aaf624b35571e91b4b4fefd4836758d4caacb5e4ccf94ead061b63a11e212050c33d76346967af29e01ef8c47d62820782d3075fab4422f8d0cb228730ea2a795fed8b6482b360c78973f9d16e790ba5a4582c78bbd608315db15c8b47475da0d982075944f4fa925bd41df6983106cc635fe9d6e6dc3833f0caf76d755e7803d18dd1d45f6cd1f4306baf0afe3d3c23d334d4e78f7cf6efcd2382b7545b9e94b677b6000a070827ba27e0303ff9678166de09e97c5f7ada50f9581002625cfc4041017d6f7caee3cf9d6a26f86111848861df014243bbacf960b3bbe8ee2fda25823e83ca0bd02cacb567d72d8aee9afbafba132b41c748ab55e0f8c2a61e06ba056d093a756b885eefa660782cc12301e3dad2197ef0212203d16f746b49d0dbd62ba98446174c7de46be1ecafd439abaf14ac82a37ee7add2f573533236284a00a84bb31fc341e852a821d208771f63b936e69bfe4f06d1c913c77dd3ecf66dc46eb6124c963a830f863a2a9693d00c92cc6b43ce1f0c7c882d9f7ab618c9bd48656c3263a8ea0ec471c0d645907bde38afaf070f8e3bb3cbc5f434d66954d8b9e9f1d7f4ae6ba06aad8b1b9969b3a83096705e0031cae24d82c6368cefa73a306948e69e6a594a23fb1d0459c0eb27d95b6255d937b58830b36285ca296851e1e2a7d8c0000e69dc182007d58519344aeea6fa415e0ae9ca8d4bf542f63efa0b88c8b929be561d82cb17158691d1bb69107807d0be496c295a5dd731195b47b1e9432477c94df7c460762e59a5f9d269219ef40e7209fabdb3c8a2fa2bda55f0ff2c932cddb2ca602de27260712792df8deff81e763da4e4074c8a59ea2216876c8b5784199a56c19e972fd5a8b6a222a83aaf60fa9d56e6b1a55b4ae6560d83c735d2f2f8002b754dab01fdbe9b9dc5a811b1545c78b6304ba2ab00bff068699c326268d618afac9c336d3f7b0dad0432a5c7e0260c1dfdf6f4d378394235b089da6458928c9eff441af73d595307240750241ed15a234191707b7c5d9279f8adbbcf26ce6821383bb2a0c2eefd9c26c87123ceafce31ec946d7ca6693b90ea4af9ad03691932cafacd445dc45d1c03f4042733040e4f7592ce797283d212bde680f4b6b48ee6d75052bee9b6a1bd27b22c86df24c3adab8049645d33ca7c11edeba9c53a1fbe6294e1529095268910032a6d5b758908ab59ef8991672b2dffe9c86563a6d42c4b457f784b7dec05f05a860a47a53c9e2730120278a6838dcdcc2c81c6ac7882c1c89d5430839106ad008f223049d851daa5d221e8a1de3725089c45115c31749645cb5f511eaa222022a99e4f3730b16fa8e2c2741a075935e9d11cba44f15e1ba91ca337218a664945d5011bcca984650f15cc9ebed11007169b6c9139b3cc09df1e950167b60bf73bca28a8b5ca5e628133e62c6f880916c6b78617a066d23a5038df77af06e559126c275ba8fadfcd4b66b590315a3405ff8e864bdba2928c4e324b9297273a5eabab6e203c5a2c6c3cbe9a3ad61de85108829fce8bec87ed8d9fc6cc881eea7768146bb7e82d07d024e94cad8a2348cf8f3112d8bd532bb1920cd3c36e761b6222943d78f09923ad13fe87a81cb191a7c49def347ffdd3959d01ff9d5e6ca77278ecae6bc13bf4d0a73536896a987f0ad982054fc376b603a50600035b024f5fb7e72935097aa7b13a29d2abdc78954536aa1629a7bc4a4cc569815aa3f0af10d80c7a566aa5ebfc728fcd48936c71bd57c89d37edbfa184918563789fbc8faba4dc447e428d1045bf106a37ad6875fb5fa5675b0b1ea176112ed01a99af0417c4cbe92bde818cde584d2ed44a283f278fc2f502bf018c6b6c4baad0876e0600150005000000080010000a00000008", @ANYRES32=r4, @ANYBLOB="0600150000000000620008806565eb962103eee419f2e7e7a6eb93261700f0583a01079ea23ce1f9ed74e008000000000000004fda6705683364ec501cba5f22964349814802bc9f71ee89da9a148775138f09ca17dbfb2ea594e9862fbd1eeb3f0b515fee8dec697b8c0001"], 0x10ac}, 0x1, 0x0, 0x0, 0x4}, 0x10) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r2, 0x0, 0x0, 0x80800) sendmsg$nl_netfilter(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0xffffff70}, 0x1, 0x0, 0x0, 0x200050c0}, 0x20000080) recvmmsg(r7, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000900), 0x3}, 0x17ba}], 0x1e, 0x2000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) 49.991153358s ago: executing program 5 (id=963): socket$inet6(0xa, 0x2, 0x3a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000001280)="b7f2288d3aaea2bc0000def1260a00"/32, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x449b}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 49.845939466s ago: executing program 2 (id=965): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000080)=""/118) r1 = shmat(r0, &(0x7f0000ff7000/0x3000)=nil, 0x400c) shmdt(r1) shmdt(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x181801) ioctl$SNDRV_TIMER_IOCTL_TREAD(r5, 0x40045402, &(0x7f0000000040)=0x1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f00000001c0)=0xb2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r6, 0x541b, &(0x7f0000000040)={0xffffffffffffffff, 0xfffffffffffffffe, 0x9, 0xfffffffffffffffc}) 48.073042294s ago: executing program 0 (id=968): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val, @void}, 0x20) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)={0x44, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x1}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}]}, 0x44}}, 0x0) 47.939019299s ago: executing program 2 (id=970): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002078316e00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000008500000006000000850000000500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x0, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_getparam(0x0, &(0x7f0000000080)) 46.59054857s ago: executing program 5 (id=971): accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x40800) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r3, 0x0, 0x1}, 0x18) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000240)='contention_end\x00', r4}, 0x18) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000300)={0x0, 0x2, 0x2, 0x0, 0x40}) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r6 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x4, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r7, r8, &(0x7f0000000140)=@IORING_OP_RECVMSG={0xa, 0x10, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100, 0x1, {0x23}}) io_uring_enter(r6, 0x47bc, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000340), 0x4bcc, 0x80) 40.371285764s ago: executing program 2 (id=974): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='contention_end\x00', r0}, 0x18) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/address_bits', 0x0, 0x0) fchmod(r1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x140b, 0x100, 0x70bd2d, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x5}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x404c805}, 0x60001051) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_MSRS(r4, 0xc048aeca, &(0x7f0000000200)) 40.177845578s ago: executing program 0 (id=975): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) r1 = socket(0x18, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, 0x0, 0x0) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) shmctl$IPC_STAT(0x0, 0x2, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r5 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x15) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000280)=0x15) openat$sysfs(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/crash_elfcorehdr_size', 0x270000, 0x100) close_range(r6, r6, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) close_range(r2, 0xffffffffffffffff, 0x0) write$qrtrtun(r2, &(0x7f0000000300)="0b8393b6167aa5d73dad0a66a7c9277d481343d806b77c2ca991d28a336cca04457118d40ecc80b9e740666d460730b94c5c0f5ade0536edc69b7b01a28dac44547b236e712cfeef6b66091959ab54409799dc141471577771cafeb2", 0x5c) 40.151185225s ago: executing program 4 (id=976): capset(&(0x7f0000000040)={0x19980330}, &(0x7f00000005c0)={0x0, 0x40000000, 0x0, 0x0, 0xffffffff}) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) capget(&(0x7f0000000080)={0x20080522, r0}, &(0x7f00000000c0)={0xa, 0x3, 0x9, 0xfffffffd, 0x400, 0x9701}) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, &(0x7f0000000140)) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r3) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000440)=ANY=[@ANYBLOB="b7000000fdffffffbfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff000000000f040000000000001d4002000000000065040000000000000f030000000000001d440000000000007a0a00fe000000000f00000000000000b5000000000000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b1100886475923906f88b53987ad0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d64360f56e24e6d2105bd901128c7e0ec82770c8204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7dfcb59b854e9d5a17f48a7382f1b3fa4526650ea6cef13d000000225d85ae49cee383f936ad657b303ab841dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c1070bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c22ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fd03000000022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b884114f244a9bf93f04bf072f0861f5c0b000000004000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99705cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae315c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0706a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c2811e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96735600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922923806ca84d69ea370db27a5ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca311a28ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da7418fd3aa81cff202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c829aaf375e904bbe52691a4120260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0d0274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f4441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbf34c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cbf5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d9436220000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd9000000000000f05fe239d3d6dafc367f12689b6700000000bd4990d9dc174a69aadffdea5445fd3c13350af85d308caee689736c06417b52541eb5871d820b850dcb00877bbe2ed19d911564f11adeb52ec3047cfdcac8a8bab6ee365941cf792155f589226758e9c8bec8289b3012ca74bfe210e0315b384ce982e16f93f3e0b1385cfaab63bd36b141dfbc7f96ee549b8b52c311e5c657943f2a5d177f03e10b3595ed13458472a2eab1ea987a0668e52fff5c716fb5950852186649ce7362b45225f050c1c37327b6833025cc1dff2d57df674be03bab30901188386d248370"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000100)={r1, 0x9, 0x3ff, 0x7}) getpid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x20020, &(0x7f00000003c0)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r5]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) fcntl$getownex(r4, 0x10, &(0x7f0000001600)) getresgid(&(0x7f0000001640), &(0x7f0000001680), &(0x7f00000016c0)) openat$uhid(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) openat$selinux_access(0xffffffffffffff9c, &(0x7f00000011c0), 0x2, 0x0) r7 = syz_io_uring_setup(0x1457, &(0x7f0000000140)={0x0, 0xaef2, 0x1000, 0x2, 0x20d}, &(0x7f0000000300), &(0x7f00000002c0)) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x8, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r9}, 0x10) r10 = io_uring_setup(0x7ac1, &(0x7f0000000080)={0x0, 0x6, 0x100, 0x1, 0x128}) syz_io_uring_setup(0x2fc7, &(0x7f0000000580)={0x0, 0x387f, 0x4a2, 0x1, 0x39c, 0x0, r10}, 0x0, 0x0) io_uring_enter(r7, 0x47f6, 0x0, 0x2, 0x0, 0x0) 38.108980446s ago: executing program 3 (id=977): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020a0702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x393, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000240)='sys_enter\x00', r0}, 0x18) open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) llistxattr(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) 37.90417731s ago: executing program 5 (id=978): r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000200)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000000000000002000000", 0x57}], 0x1) 37.793285672s ago: executing program 0 (id=979): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r3, &(0x7f0000000740)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x7, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a\xdd\x05\xdc\xb8\xc7\xb4v\x1f\xe3\xb6)\x1dM\x1e\xf9\x97\xffLW\x82\t\xf7\xb4\xe2fP\b\n\xdd\x03\x9d&\xd2\xce0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x181801) ioctl$SNDRV_TIMER_IOCTL_TREAD(r5, 0x40045402, &(0x7f0000000040)=0x1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f00000001c0)=0xb2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r6, 0x541b, &(0x7f0000000040)={0xffffffffffffffff, 0xfffffffffffffffe, 0x9, 0xfffffffffffffffc}) 37.671713485s ago: executing program 3 (id=981): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x3a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x449b}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 37.270575856s ago: executing program 5 (id=982): sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x40000000, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="01000000"], 0x14}}, 0x0) syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a00030100000009040000000101"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000080), 0x11000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000780)={@broadcast, @random="6487a2bed3d6", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @private}}}}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x0) readv(r2, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/79, 0x4f}], 0x1) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8e383, 0x0) readv(r1, &(0x7f00000018c0)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0x10, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000000000001811000055ed167d6f499a7505bc42f500a46553eea932ec22000d467c3c33bbdda0aec0c65f89c9f2927fb0d761c0b3473e942aee336f8c0f767d", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000085100000f5ffffffbf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002980)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000000100)='_', 0x1}], 0x1}, 0x4000000) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socket$kcm(0x10, 0x2, 0x4) 36.547380438s ago: executing program 4 (id=983): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x7, &(0x7f0000000280)=@raw=[@cb_func={0x18, 0xc, 0x4, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}, @alu={0x7, 0x1, 0x6, 0x9, 0x8, 0x20, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000340)='syzkaller\x00', 0x3, 0x0, 0x0, 0x60700, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5df6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) getpid() ioctl$VIDIOC_G_EDID(0xffffffffffffffff, 0xc0285628, &(0x7f0000000140)={0x0, 0x10, 0x7, '\x00', &(0x7f0000000040)=0x5}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a7260180"], 0x26c0}}, 0x4010) 36.040288275s ago: executing program 0 (id=984): timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) r0 = dup(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_smc(0x2b, 0x1, 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r4 = memfd_create(&(0x7f0000000300)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) fcntl$addseals(r4, 0x409, 0x7) r5 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f00000002c0)={r4, 0x0, 0x0, 0x1000}) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000000)=0x1) write$FUSE_GETXATTR(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) syz_io_uring_setup(0x4fb0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000280)={0x0, 0x4f}, 0x8) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) r8 = fcntl$dupfd(r5, 0x406, r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r8}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timerfd_settime(0xffffffffffffffff, 0x2, &(0x7f0000000080)={{}, {r9, r10+60000000}}, 0x0) 35.872311226s ago: executing program 2 (id=985): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x7, &(0x7f0000000280)=@raw=[@cb_func={0x18, 0xc, 0x4, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}, @alu={0x7, 0x1, 0x6, 0x9, 0x8, 0x20, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000340)='syzkaller\x00', 0x3, 0x0, 0x0, 0x60700, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5df6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/mcfilter\x00') preadv(r3, &(0x7f0000000240)=[{&(0x7f0000000100)=""/79, 0x4f}, {&(0x7f0000000080)=""/57, 0x39}, {&(0x7f00000002c0)=""/72, 0x48}], 0x3, 0x5, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x184) socket$inet6(0xa, 0x2, 0x0) r4 = getpid() sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="24010000400107010080000008000000027c00000f01f380c91bd1a3a1cded50770f5b3b415c98e090184befaffa3e76e9d2457adcbaf5c440966fa8bfbf3f9c8363e3107268acd336cb836ce99bea65ee9cd0c4c9994a24b4d6db1d52e84dc97fb98e48e010060c8d04ac7fda0ff955985bf5d67981c446cac6b0ad3b663fdf7924dffec00c3c22f631fa9f3d140039002001000000000000000000000000000108002c00", @ANYRES32=r4, @ANYBLOB="08007600fe1a0000b517cf62cf2c0c5a5a2063ac2e5530bb1c689312a004788126517583fd45b711d623c225a43a981d17b99092bbd7de526c54c97c108c96046412b49a81510914913b1f8768815d89a8f8cca46640eadba458e77e14aa08004200000000001400d900fe800000000000000000000000000030dd"], 0x124}, 0x1, 0x0, 0x0, 0x4091}, 0xc000) ioctl$VIDIOC_G_EDID(0xffffffffffffffff, 0xc0285628, &(0x7f0000000140)={0x0, 0x10, 0x7, '\x00', &(0x7f0000000040)=0x5}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a7260180"], 0x26c0}}, 0x4010) 35.733792844s ago: executing program 3 (id=986): ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x67) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x16fa, 0x800, 0x4, 0x8}, &(0x7f0000000340)=0x0, &(0x7f0000000140)=0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_opts(r5, 0x0, 0xd, &(0x7f0000000180)="60b6cc8f2436f89b616ffa32e793f86065b66e5dbb7619a6bc15a624f9f9740732854c445516012fe918899fef432df53ed7013ba8f643aaf6743fed44188ae531e3b5c2058e", 0x46) gettid() timer_create(0x9, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) timer_gettime(0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x4, 0x0, 0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff, 0x400, 0x1}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0xfe8e, 0x12) accept4$rose(0xffffffffffffffff, &(0x7f00000003c0)=@short={0xb, @dev, @netrom, 0x1, @netrom}, &(0x7f0000000100)=0x1c, 0x80800) io_uring_enter(r2, 0x3516, 0x0, 0x4, 0x0, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$FS_IOC_READ_VERITY_METADATA(r6, 0x2284, &(0x7f00000000c0)={0x0, 0x2083, 0x0, 0x0}) r7 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fffffffffffffff, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r7, 0xc0585605, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) r8 = fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0) 35.600024319s ago: executing program 4 (id=987): socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdir(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x54) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) splice(r2, 0x0, r3, 0x0, 0x10000000000016, 0x0) r4 = open(&(0x7f0000000300)='./bus\x00', 0x14103e, 0x18a) r5 = open(&(0x7f00000001c0)='./file0\x00', 0x14b042, 0x83) ftruncate(r5, 0x3000000) sendfile(r4, r5, 0x0, 0x80000001) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000380), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) 31.663609631s ago: executing program 0 (id=988): r0 = socket$inet6(0xa, 0x80002, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8937, &(0x7f0000000000)={'netdevsim0\x00', @random="010000201000"}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prctl$PR_SET_MM(0x23, 0x8, &(0x7f00007d8000/0x1000)=nil) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x400}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4054) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 31.66294219s ago: executing program 2 (id=989): keyctl$get_security(0x11, 0x0, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)}], 0x3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00'}) r1 = add_key(&(0x7f0000000080)='blacklist\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000140)="e1d44f54a80b2434cbbfbfb5f873f5f279bf15f05d46359623eef4bade9a4a1d5ee84edc8fd42486c753f3baee3ccedb89239ecc05f9d7c3b570aebef767df3bd25086aa2cde67857046d12782076d2f4a849861de67d48f7b30670370e02610b7a05d1e78d67f", 0x67, 0x0) r2 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r3 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) r4 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000001100)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="20120100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000100)={0x40, 0x18, 0x2, '8\\'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x200880) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000300)={0x40, 0xe, 0x3, "39ed9e"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000500), 0x0}) syz_usb_control_io$printer(r4, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000440)=ANY=[@ANYBLOB="4018a8"], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) r5 = fsopen(&(0x7f0000000000)='pipefs\x00', 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000084000000040"]) close_range(r5, 0xffffffffffffffff, 0x0) 28.613033962s ago: executing program 3 (id=990): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4080c}, 0x2000c845) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x17) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, 0x0, &(0x7f0000000540)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000400)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001580)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) read(r5, 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f00000001c0)={0x3, 0xa07, 0x2}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYRESOCT, @ANYRES32=r0, @ANYRES8=r5, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES8], 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000880)="22cff58056ac", 0xffd7, 0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') write$proc_mixer(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xd3) syz_io_uring_setup(0x4000592, &(0x7f0000000880)={0x0, 0xa943, 0x800, 0x0, 0x321}, &(0x7f0000000900), &(0x7f0000000940)) r6 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_ifreq(r6, 0x89a2, &(0x7f0000000280)={'bridge0\x00', @ifru_settings={0x43, 0x0, @sync=0x0}}) 28.468045669s ago: executing program 5 (id=991): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x14) epoll_create1(0x0) r1 = syz_open_dev$loop(&(0x7f0000000440), 0x80, 0x60001) ioctl$LOOP_CHANGE_FD(r1, 0x4c03, 0xffffffffffffffff) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) openat$fb0(0xffffffffffffff9c, &(0x7f00000004c0), 0x40000, 0x0) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r7, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4f549b, 0x0, [0x80000001081, 0x7, 0xfffffffffffffffd, 0x0, 0x4, 0x80000000, 0xfffffffffffffffc, 0x800006]}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x18, 0x0, 0x60}}) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='sched\x00') writev(r8, &(0x7f00000001c0)=[{&(0x7f0000000240)="e869", 0x2}], 0x1) read$FUSE(0xffffffffffffffff, &(0x7f0000003e80)={0x2020}, 0x2020) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r10 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)={0x101180, 0x45, 0x2b}, 0x18) setsockopt$inet6_buf(r9, 0x29, 0xcd, &(0x7f0000000500)="ee328cc55455fc4848c7db136f093cffef1a5896b894f649627200f425f5bb5d26a0d744c2b915fccd4f8ce4d2a2078e87f164f03be307d6537a86920bffdaa45b70330288df8ef5f804cffc0000003e9cef5163107fe4ddbe4350088d9d040ac9d142dc07dc408452906f49b4dc325ae0c671f97080beaced750410fff512a86c52ad88c22356552c25e88c9bb74353073bafdd60b9295091e2acdffd16158121c06e4c137a27da12035cd8adfc4569e66c66458a7366f6553f7cbb2b65d50083d49fe40761f4fd2016ad94d986becc9d923084b68f389bcbb81ee5363013cce1f93b9ebb", 0xe5) renameat2(r9, &(0x7f0000000200)='./file0\x00', r10, &(0x7f0000000380)='./file0\x00', 0x6) 28.1026599s ago: executing program 4 (id=992): accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x40800) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @result={0x1, 0x2}}, {0x0, 0x0, 0xff, 0x3, @tick=0xf27, {0x1}, {}, @addr={0x2a, 0x5}}], 0x38) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002a80)={0x53, 0x1, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffff, 0x10024, 0xffffffffffffffff, 0x0}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000000c0), &(0x7f0000000100)=0x4) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r3 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x4, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100, 0x1, {0x3}}) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) 24.747697993s ago: executing program 2 (id=993): mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000300), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x6ffffffffffffffe, 0x0) read$msr(r0, &(0x7f000001b000)=""/102400, 0x19000) rseq(&(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x3, 0x2}, 0x1}, 0x20, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x80) r1 = openat$rdma_cm(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r4, 0x80045505, &(0x7f0000002a40)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r3, r2, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10b}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x201, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1440}], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000380)={0xc, 0x8, 0xfa00, {&(0x7f0000001140)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000600)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x3, @loopback, 0xffffffff}, {0xa, 0x0, 0x5, @mcast1}}}, 0x48) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) timer_delete(0x0) syz_open_dev$dri(0x0, 0x0, 0x2) pread64(r7, &(0x7f0000000000)=""/47, 0x2f, 0x5) 24.735052965s ago: executing program 3 (id=994): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x8200, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x4, "d2c4924f5689213dc64c3b6e6ff82a75e5318fca4288c20600000072020bcd2c"}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000000)=0x409, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'xfrm0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b03", 0x2, 0x0, &(0x7f0000000100)={0x11, 0x7, r3, 0x1, 0x9, 0x6, @broadcast}, 0x14) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x80) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000100)={0x4, r4}) ioctl$DMA_BUF_SET_NAME_A(r6, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r7 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r7, 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f0000000040)=0x1) close_range(r0, r6, 0x0) 24.152732386s ago: executing program 4 (id=995): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) socket$nl_route(0x10, 0x3, 0x0) r1 = accept$alg(r0, 0x0, 0x0) dup(r1) userfaultfd(0x80001) getsockopt$SO_J1939_ERRQUEUE(0xffffffffffffffff, 0x6b, 0x4, &(0x7f0000000140), &(0x7f0000000380)=0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, @void, @value}, 0x20) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x3, &(0x7f0000000640)=@framed, &(0x7f0000000d40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x80}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket(0x1d, 0x2, 0x6) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000373010b000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r3, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 23.962683838s ago: executing program 5 (id=996): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x3a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x449b}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 18.650191698s ago: executing program 0 (id=997): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x7, &(0x7f0000000280)=@raw=[@cb_func={0x18, 0xc, 0x4, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}, @alu={0x7, 0x1, 0x6, 0x9, 0x8, 0x20, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000340)='syzkaller\x00', 0x3, 0x0, 0x0, 0x60700, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5df6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) getpid() ioctl$VIDIOC_G_EDID(0xffffffffffffffff, 0xc0285628, &(0x7f0000000140)={0x0, 0x10, 0x7, '\x00', &(0x7f0000000040)=0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a7260180"], 0x26c0}}, 0x4010) 18.636350789s ago: executing program 3 (id=998): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, 0x0, 0x2) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000180)=r0, 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000380)='fsi_master_rw_result\x00', r3}, 0x18) timer_settime(0x0, 0x0, 0x0, 0x0) pipe2$9p(0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000001c0)={&(0x7f00000002c0)={0x2c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_SETSEL(r8, 0x541c, &(0x7f0000001900)={0x2, {0xe, 0x6, 0x1, 0x2, 0x340}}) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r9 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r9, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r10 = dup2(r9, r9) writev(r9, &(0x7f00000003c0)=[{&(0x7f0000000300)="6bf71c9e98581637335d30ea5c633dde0d99e98def0ffa414da84bd0c849ceaa0813840d901c8bd1e011a14de3705dba7a3130a1b59aba", 0x37}], 0x1) sendmmsg$unix(r10, &(0x7f0000008380), 0x400000000000174, 0x4008890) 8.91989077s ago: executing program 33 (id=993): mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000300), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x6ffffffffffffffe, 0x0) read$msr(r0, &(0x7f000001b000)=""/102400, 0x19000) rseq(&(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x3, 0x2}, 0x1}, 0x20, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x80) r1 = openat$rdma_cm(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r4, 0x80045505, &(0x7f0000002a40)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r3, r2, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10b}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x201, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1440}], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000380)={0xc, 0x8, 0xfa00, {&(0x7f0000001140)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000600)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x3, @loopback, 0xffffffff}, {0xa, 0x0, 0x5, @mcast1}}}, 0x48) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) timer_delete(0x0) syz_open_dev$dri(0x0, 0x0, 0x2) pread64(r7, &(0x7f0000000000)=""/47, 0x2f, 0x5) 1.743612771s ago: executing program 34 (id=996): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x3a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x449b}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.350236463s ago: executing program 35 (id=995): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) socket$nl_route(0x10, 0x3, 0x0) r1 = accept$alg(r0, 0x0, 0x0) dup(r1) userfaultfd(0x80001) getsockopt$SO_J1939_ERRQUEUE(0xffffffffffffffff, 0x6b, 0x4, &(0x7f0000000140), &(0x7f0000000380)=0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, @void, @value}, 0x20) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x3, &(0x7f0000000640)=@framed, &(0x7f0000000d40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x80}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket(0x1d, 0x2, 0x6) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000373010b000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r3, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 191.391096ms ago: executing program 36 (id=997): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x7, &(0x7f0000000280)=@raw=[@cb_func={0x18, 0xc, 0x4, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}, @alu={0x7, 0x1, 0x6, 0x9, 0x8, 0x20, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000340)='syzkaller\x00', 0x3, 0x0, 0x0, 0x60700, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5df6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) getpid() ioctl$VIDIOC_G_EDID(0xffffffffffffffff, 0xc0285628, &(0x7f0000000140)={0x0, 0x10, 0x7, '\x00', &(0x7f0000000040)=0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a7260180"], 0x26c0}}, 0x4010) 0s ago: executing program 37 (id=998): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, 0x0, 0x2) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000180)=r0, 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000380)='fsi_master_rw_result\x00', r3}, 0x18) timer_settime(0x0, 0x0, 0x0, 0x0) pipe2$9p(0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000001c0)={&(0x7f00000002c0)={0x2c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_SETSEL(r8, 0x541c, &(0x7f0000001900)={0x2, {0xe, 0x6, 0x1, 0x2, 0x340}}) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r9 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r9, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r10 = dup2(r9, r9) writev(r9, &(0x7f00000003c0)=[{&(0x7f0000000300)="6bf71c9e98581637335d30ea5c633dde0d99e98def0ffa414da84bd0c849ceaa0813840d901c8bd1e011a14de3705dba7a3130a1b59aba", 0x37}], 0x1) sendmmsg$unix(r10, &(0x7f0000008380), 0x400000000000174, 0x4008890) kernel console output (not intermixed with test programs): class=xdp_socket permissive=1 [ 279.385180][ T8431] netlink: 12 bytes leftover after parsing attributes in process `syz.2.582'. [ 279.506122][ T8435] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 279.537894][ T5908] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 279.561076][ T5908] usb 5-1: USB disconnect, device number 15 [ 281.109435][ T8452] dlm: no locking on control device [ 281.322377][ T30] audit: type=1400 audit(1748311189.706:712): avc: denied { map } for pid=8454 comm="syz.4.588" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 281.345764][ C0] vkms_vblank_simulate: vblank timer overrun [ 281.515935][ T8458] syz.5.589: attempt to access beyond end of device [ 281.515935][ T8458] nbd5: rw=0, sector=64, nr_sectors = 1 limit=0 [ 281.548235][ T8458] syz.5.589: attempt to access beyond end of device [ 281.548235][ T8458] nbd5: rw=0, sector=256, nr_sectors = 1 limit=0 [ 281.628636][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 281.642439][ T30] audit: type=1400 audit(1748311189.706:713): avc: denied { execute } for pid=8454 comm="syz.4.588" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 281.683564][ T8458] syz.5.589: attempt to access beyond end of device [ 281.683564][ T8458] nbd5: rw=0, sector=512, nr_sectors = 1 limit=0 [ 281.703077][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 281.825752][ T8458] syz.5.589: attempt to access beyond end of device [ 281.825752][ T8458] nbd5: rw=0, sector=64, nr_sectors = 2 limit=0 [ 282.590033][ T8458] syz.5.589: attempt to access beyond end of device [ 282.590033][ T8458] nbd5: rw=0, sector=512, nr_sectors = 2 limit=0 [ 282.597057][ T8462] C: renamed from team_slave_0 (while UP) [ 282.615812][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 282.628632][ T8462] netlink: 'syz.3.590': attribute type 3 has an invalid length. [ 282.638135][ T8458] syz.5.589: attempt to access beyond end of device [ 282.638135][ T8458] nbd5: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 282.656933][ T8462] netlink: 152 bytes leftover after parsing attributes in process `syz.3.590'. [ 282.668665][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 282.683737][ T8462] net_ratelimit: 66 callbacks suppressed [ 282.683753][ T8462] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 282.706276][ T8458] syz.5.589: attempt to access beyond end of device [ 282.706276][ T8458] nbd5: rw=0, sector=64, nr_sectors = 4 limit=0 [ 282.734097][ T8458] syz.5.589: attempt to access beyond end of device [ 282.734097][ T8458] nbd5: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 282.802582][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 282.808962][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 282.837807][ T8458] syz.5.589: attempt to access beyond end of device [ 282.837807][ T8458] nbd5: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 282.862439][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 282.967762][ T10] usb 5-1: config 91 has an invalid interface number: 89 but max is 0 [ 282.983435][ T8458] syz.5.589: attempt to access beyond end of device [ 282.983435][ T8458] nbd5: rw=0, sector=64, nr_sectors = 8 limit=0 [ 282.986027][ T10] usb 5-1: config 91 has no interface number 0 [ 283.018477][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 283.029820][ T8458] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 283.040031][ T8458] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 283.091327][ T10] usb 5-1: config 91 interface 89 has no altsetting 0 [ 283.556656][ T10] usb 5-1: New USB device found, idVendor=0c45, idProduct=60af, bcdDevice= 6.f5 [ 283.973463][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.981533][ T10] usb 5-1: Product: syz [ 283.985871][ T10] usb 5-1: Manufacturer: syz [ 283.990478][ T10] usb 5-1: SerialNumber: syz [ 284.356247][ T8473] syz.2.592 (8473): drop_caches: 2 [ 284.433713][ T10] gspca_main: sonixb-2.14.0 probing 0c45:60af [ 284.447819][ T10] sonixb 5-1:91.89: Error reading register 00: -71 [ 284.576758][ T8478] netlink: zone id is out of range [ 284.581936][ T8478] netlink: zone id is out of range [ 284.591083][ T8478] netlink: zone id is out of range [ 284.596418][ T8478] netlink: zone id is out of range [ 284.601631][ T8478] netlink: zone id is out of range [ 284.607036][ T8478] netlink: zone id is out of range [ 284.610711][ T30] audit: type=1400 audit(1748311193.006:714): avc: denied { ioctl } for pid=8477 comm="syz.4.596" path="socket:[19348]" dev="sockfs" ino=19348 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 284.639168][ T8478] netlink: zone id is out of range [ 284.652328][ T8478] netlink: zone id is out of range [ 284.657582][ T8478] netlink: zone id is out of range [ 284.709864][ T10] usb 5-1: USB disconnect, device number 16 [ 284.832239][ T30] audit: type=1400 audit(1748311193.096:715): avc: denied { checkpoint_restore } for pid=8477 comm="syz.4.596" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 286.727868][ T5866] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 286.807484][ T8518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.831249][ T8518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.865235][ T8518] netlink: 'syz.0.605': attribute type 10 has an invalid length. [ 286.875734][ T8518] veth0_macvtap: left promiscuous mode [ 286.902357][ T5866] usb 5-1: Using ep0 maxpacket: 16 [ 286.915128][ T8518] batman_adv: batadv0: Adding interface: macvtap0 [ 286.928094][ T8518] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 286.928208][ T5866] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 286.964760][ T8518] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 286.987126][ T5866] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 287.030593][ T5866] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 287.087598][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.195435][ T30] audit: type=1400 audit(1748311195.576:716): avc: denied { map } for pid=8526 comm="syz.2.607" path="socket:[19402]" dev="sockfs" ino=19402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 287.296107][ T5866] usb 5-1: Product: syz [ 287.300312][ T5866] usb 5-1: Manufacturer: syz [ 287.306833][ T5866] usb 5-1: SerialNumber: syz [ 287.316924][ T30] audit: type=1400 audit(1748311195.576:717): avc: denied { read } for pid=8526 comm="syz.2.607" path="socket:[19402]" dev="sockfs" ino=19402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 288.892225][ T5908] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 289.026327][ T8549] dlm: no locking on control device [ 289.062502][ T5908] usb 1-1: Using ep0 maxpacket: 32 [ 289.077598][ T5908] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 289.082343][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 289.155233][ T5908] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 289.165449][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 289.416244][ T8554] net_ratelimit: 29 callbacks suppressed [ 289.416311][ T8554] netlink: zone id is out of range [ 289.427639][ T8554] netlink: zone id is out of range [ 289.433273][ T8554] netlink: zone id is out of range [ 289.438637][ T8554] netlink: zone id is out of range [ 289.444133][ T8554] netlink: zone id is out of range [ 289.449306][ T8554] netlink: zone id is out of range [ 289.455772][ T8554] netlink: zone id is out of range [ 289.463787][ T8554] netlink: zone id is out of range [ 289.469035][ T8554] netlink: zone id is out of range [ 289.474474][ T8554] netlink: zone id is out of range [ 289.502604][ T5866] usb 5-1: cannot find UAC_HEADER [ 289.521926][ T5866] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 289.545573][ T5866] usb 5-1: USB disconnect, device number 17 [ 289.572218][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 289.582855][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 289.598311][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 289.603167][ T5908] usb 1-1: Product: syz [ 289.615554][ T5908] usb 1-1: Manufacturer: syz [ 289.620354][ T5908] usb 1-1: SerialNumber: syz [ 289.644369][ T5908] usb 1-1: config 0 descriptor?? [ 289.655401][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 289.683624][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 289.694555][ T8540] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 289.720806][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.788619][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 289.807578][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.873968][ T30] audit: type=1400 audit(1748311198.256:718): avc: denied { name_bind } for pid=8555 comm="syz.4.616" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 289.894712][ C0] vkms_vblank_simulate: vblank timer overrun [ 289.942282][ T5125] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 289.948765][ T5125] Bluetooth: hci0: command 0x0c1a tx timeout [ 290.028850][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 290.034758][ T10] usbtmc 3-1:16.0: can't read capabilities [ 290.619930][ T1203] usb 1-1: USB disconnect, device number 12 [ 290.632205][ T24] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 290.793698][ T10] usb 3-1: USB disconnect, device number 16 [ 291.346649][ T24] usb 4-1: device descriptor read/64, error -71 [ 291.635089][ T24] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 291.651228][ T8575] dlm: no locking on control device [ 291.775011][ T24] usb 4-1: device descriptor read/64, error -71 [ 291.908865][ T24] usb usb4-port1: attempt power cycle [ 292.006364][ T30] audit: type=1400 audit(1748311200.396:719): avc: denied { ioctl } for pid=8584 comm="syz.0.625" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 292.029378][ C0] vkms_vblank_simulate: vblank timer overrun [ 292.046475][ T8586] /dev/nullb0: Can't open blockdev [ 292.416115][ T24] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 292.824782][ T24] usb 4-1: device descriptor read/8, error -71 [ 293.089782][ T8603] usb usb9: usbfs: interface 0 claimed by hub while 'syz.2.630' sets config #0 [ 293.238523][ T8605] tipc: Started in network mode [ 293.247272][ T8605] tipc: Node identity ac14140f, cluster identity 4711 [ 293.253061][ T24] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 293.258359][ T8605] tipc: New replicast peer: 5.0.255.255 [ 293.278237][ T8605] tipc: Enabled bearer , priority 10 [ 293.397712][ T24] usb 4-1: device descriptor read/8, error -71 [ 293.440158][ T30] audit: type=1400 audit(1748311201.826:720): avc: denied { read } for pid=8599 comm="syz.5.629" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 293.461992][ C0] vkms_vblank_simulate: vblank timer overrun [ 293.462835][ T8600] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd c058534f, magic 53 != 6b] [ 293.509499][ T8600] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 80084503, magic 45 != 6b] [ 293.512194][ T30] audit: type=1400 audit(1748311201.826:721): avc: denied { open } for pid=8599 comm="syz.5.629" path="/91/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 293.544443][ C0] vkms_vblank_simulate: vblank timer overrun [ 293.552838][ T24] usb usb4-port1: unable to enumerate USB device [ 293.589945][ T30] audit: type=1400 audit(1748311201.856:722): avc: denied { ioctl } for pid=8599 comm="syz.5.629" path="/91/file0/file0" dev="fuse" ino=0 ioctlcmd=0x534f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 293.614105][ C0] vkms_vblank_simulate: vblank timer overrun [ 293.946001][ T5125] Bluetooth: hci0: command 0x0c1a tx timeout [ 293.952330][ T5817] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 294.716089][ T24] tipc: Node number set to 2886997007 [ 295.516237][ T30] audit: type=1400 audit(1748311203.896:723): avc: denied { bind } for pid=8630 comm="syz.0.631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 296.804375][ T8653] binder: 8652:8653 ioctl c0306201 0 returned -14 [ 296.832478][ T10] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 297.020630][ T10] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 297.029995][ T10] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 297.037737][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 297.052683][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 297.092822][ T10] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 297.111360][ T10] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 297.124322][ T10] usb 1-1: Product: syz [ 297.128781][ T10] usb 1-1: Manufacturer: syz [ 297.302974][ T8661] usb usb9: usbfs: interface 0 claimed by hub while 'syz.5.647' sets config #0 [ 297.409841][ T10] cdc_wdm 1-1:1.0: skipping garbage [ 297.420719][ T10] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 297.781497][ T24] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 297.980196][ T8667] bridge0: port 4(netdevsim0) entered blocking state [ 297.990083][ T8667] bridge0: port 4(netdevsim0) entered disabled state [ 297.999088][ T8667] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 298.047022][ T8667] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 298.069242][ T8667] bridge0: port 4(netdevsim0) entered blocking state [ 298.076053][ T8667] bridge0: port 4(netdevsim0) entered forwarding state [ 298.472200][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 298.487747][ T24] usb 3-1: config 0 has an invalid interface number: 193 but max is 0 [ 298.497984][ T24] usb 3-1: config 0 has no interface number 0 [ 298.508384][ T24] usb 3-1: New USB device found, idVendor=06cd, idProduct=011a, bcdDevice=39.7d [ 298.539341][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.576652][ T24] usb 3-1: config 0 descriptor?? [ 298.611893][ T24] keyspan 3-1:0.193: Keyspan - (without firmware) converter detected [ 298.678341][ T24] usb 3-1: USB disconnect, device number 17 [ 298.696210][ T24] keyspan 3-1:0.193: device disconnected [ 298.821629][ T8674] netlink: 44 bytes leftover after parsing attributes in process `syz.4.651'. [ 299.064276][ T8682] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8682 comm=syz.2.652 [ 299.467396][ T8684] kexec: Could not allocate control_code_buffer [ 299.536489][ T5864] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 299.546495][ T5908] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 299.555349][ T24] usb 1-1: USB disconnect, device number 13 [ 299.712579][ T5864] usb 5-1: Using ep0 maxpacket: 8 [ 299.717756][ T5908] usb 4-1: Using ep0 maxpacket: 16 [ 299.729399][ T5864] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 299.757787][ T5908] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 299.838994][ T5864] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 299.868806][ T5908] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 299.881098][ T5864] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.907472][ T5908] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 299.943561][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.964161][ T5864] usb 5-1: config 0 descriptor?? [ 299.989530][ T5908] usb 4-1: Product: syz [ 300.004594][ T5908] usb 4-1: Manufacturer: syz [ 300.009321][ T5908] usb 4-1: SerialNumber: syz [ 300.124231][ T10] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 300.194228][ T5864] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 300.282226][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 300.660026][ T5864] usb 5-1: USB disconnect, device number 18 [ 300.662217][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 300.703711][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 300.743345][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 300.796382][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.820890][ T10] usb 3-1: Product: syz [ 300.842308][ T10] usb 3-1: Manufacturer: syz [ 300.846946][ T10] usb 3-1: SerialNumber: syz [ 300.974485][ T8704] usb usb9: usbfs: interface 0 claimed by hub while 'syz.0.658' sets config #0 [ 302.720478][ T5908] usb 4-1: cannot find UAC_HEADER [ 302.768124][ T5908] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 302.779349][ T5908] usb 4-1: USB disconnect, device number 29 [ 302.891945][ T10] usb 3-1: cannot find UAC_HEADER [ 303.434605][ T8717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.660'. [ 303.539667][ T8719] netlink: 20 bytes leftover after parsing attributes in process `syz.0.660'. [ 303.812735][ T10] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 303.815257][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 303.844172][ T10] usb 3-1: USB disconnect, device number 18 [ 303.907151][ T30] audit: type=1400 audit(1748311212.296:724): avc: denied { write } for pid=8725 comm="syz.3.663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 304.041424][ T8729] netlink: 20 bytes leftover after parsing attributes in process `syz.3.663'. [ 304.096086][ T6629] udevd[6629]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 304.392350][ T5908] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 304.582151][ T5908] usb 5-1: Using ep0 maxpacket: 16 [ 304.630565][ T5908] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 304.652327][ T8737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.665'. [ 304.693523][ T5908] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 304.707075][ T8737] netlink: 4 bytes leftover after parsing attributes in process `syz.0.665'. [ 304.709194][ T5908] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 304.727740][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.737655][ T5908] usb 5-1: Product: syz [ 304.769838][ T5908] usb 5-1: Manufacturer: syz [ 304.835369][ T5908] usb 5-1: SerialNumber: syz [ 305.267042][ T8737] batman_adv: batadv0: Removing interface: macvtap0 [ 305.465496][ T8748] bio_check_eod: 2 callbacks suppressed [ 305.465530][ T8748] syz.3.667: attempt to access beyond end of device [ 305.465530][ T8748] loop7: rw=0, sector=0, nr_sectors = 1 limit=0 [ 305.484713][ T8748] FAT-fs (loop7): unable to read boot sector [ 306.229415][ T8739] net_ratelimit: 28 callbacks suppressed [ 306.229429][ T8739] netlink: zone id is out of range [ 306.240457][ T8739] netlink: zone id is out of range [ 306.245589][ T8739] netlink: zone id is out of range [ 306.250693][ T8739] netlink: zone id is out of range [ 306.255988][ T8739] netlink: zone id is out of range [ 306.261487][ T8739] netlink: zone id is out of range [ 306.267281][ T8739] netlink: zone id is out of range [ 306.273403][ T8739] netlink: zone id is out of range [ 306.278768][ T8739] netlink: zone id is out of range [ 306.295056][ T8739] netlink: set zone limit has 4 unknown bytes [ 306.355167][ T8747] netlink: 8 bytes leftover after parsing attributes in process `syz.3.667'. [ 308.382808][ T5908] usb 5-1: cannot find UAC_HEADER [ 308.684051][ T30] audit: type=1400 audit(1748311216.966:725): avc: denied { connect } for pid=8762 comm="syz.3.672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 308.716208][ T5908] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 308.751282][ T5908] usb 5-1: USB disconnect, device number 19 [ 309.730393][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 309.903112][ T12] Bluetooth: hci1: Frame reassembly failed (-84) [ 310.172868][ T10] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 310.882188][ T5866] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 310.915566][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 310.982684][ T10] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 311.079801][ T10] usb 3-1: config 0 has no interface number 0 [ 311.122414][ T5866] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 311.196756][ T10] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 311.248765][ T5866] usb 5-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 311.343356][ T10] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 311.359737][ T5866] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 311.449162][ T5866] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 311.470104][ T10] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 311.550070][ T10] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 311.579489][ T5866] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 311.610037][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 311.647830][ T5866] usb 5-1: Product: syz [ 311.652985][ T10] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 311.681907][ T5866] usb 5-1: Manufacturer: syz [ 311.689410][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.700448][ T10] usb 3-1: Product: syz [ 311.714829][ T5866] cdc_wdm 5-1:1.0: skipping garbage [ 311.731371][ T10] usb 3-1: Manufacturer: syz [ 311.752636][ T5866] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 311.768931][ T10] usb 3-1: SerialNumber: syz [ 311.788068][ T10] usb 3-1: config 0 descriptor?? [ 311.843278][ T8826] input: syz0 as /devices/virtual/input/input11 [ 311.951329][ T5817] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 312.267684][ T10] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 312.349123][ T8834] bridge0: port 3(netdevsim0) entered blocking state [ 312.356119][ T8834] bridge0: port 3(netdevsim0) entered disabled state [ 312.363571][ T8834] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 312.379768][ T8834] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 313.240631][ T8773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.434609][ T8773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.998892][ T5908] usb 5-1: USB disconnect, device number 20 [ 314.399867][ T8773] Bluetooth: hci1: Frame reassembly failed (-84) [ 314.550617][ T5817] Bluetooth: hci0: unexpected event for opcode 0x2012 [ 314.569779][ T30] audit: type=1400 audit(1748311222.956:726): avc: denied { accept } for pid=8847 comm="syz.5.686" laddr=fe80::e lport=37843 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 314.993902][ T30] audit: type=1400 audit(1748311222.986:727): avc: denied { setcheckreqprot } for pid=8851 comm="syz.3.688" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 315.062247][ T5125] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 315.416648][ T30] audit: type=1400 audit(1748311223.796:728): avc: denied { mount } for pid=8857 comm="syz.4.690" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 315.510932][ T5866] usb 3-1: USB disconnect, device number 19 [ 315.605915][ T8859] netlink: 132 bytes leftover after parsing attributes in process `syz.0.689'. [ 315.695097][ T8863] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.692'. [ 315.738763][ T8863] net_ratelimit: 38 callbacks suppressed [ 315.738781][ T8863] openvswitch: netlink: Message has 5 unknown bytes. [ 316.092303][ T5908] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 316.748242][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.754696][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.852167][ T24] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 316.880115][ T5908] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 316.893326][ T5908] usb 1-1: config 0 interface 0 has no altsetting 0 [ 316.912577][ T5908] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 316.934940][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 317.216964][ T5908] usb 1-1: Product: syz [ 317.229768][ T5908] usb 1-1: Manufacturer: syz [ 317.239666][ T5908] usb 1-1: SerialNumber: syz [ 317.249166][ T5908] usb 1-1: config 0 descriptor?? [ 317.269005][ T5908] usb 1-1: selecting invalid altsetting 0 [ 317.274968][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 317.288158][ T24] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 317.327804][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 317.346227][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 317.407080][ T24] usb 6-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 317.425630][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.440210][ T24] usb 6-1: config 0 descriptor?? [ 317.452382][ T5864] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 317.494380][ T10] usb 1-1: USB disconnect, device number 14 [ 317.624317][ T5864] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 317.636786][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 317.652321][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 317.690562][ T5864] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 317.712477][ T5864] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 317.749206][ T5864] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.820636][ T5864] usb 4-1: config 0 descriptor?? [ 318.190978][ T8887] syz.4.699 (8887): drop_caches: 2 [ 318.199688][ T24] redragon 0003:0C45:760B.0007: unknown main item tag 0x6 [ 318.207974][ T24] redragon 0003:0C45:760B.0007: item fetching failed at offset 7/133 [ 318.279327][ T24] redragon 0003:0C45:760B.0007: probe with driver redragon failed with error -22 [ 318.354086][ T24] usb 6-1: USB disconnect, device number 21 [ 318.381890][ T5864] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 318.400510][ T5864] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 318.431691][ T5864] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 318.482363][ T5817] Bluetooth: hci0: unexpected event for opcode 0x2012 [ 318.859481][ T8898] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.994430][ T24] IPVS: starting estimator thread 0... [ 319.000578][ T8901] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 319.023233][ T10] usb 4-1: USB disconnect, device number 30 [ 319.037958][ T5866] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 319.092202][ T8904] IPVS: using max 41 ests per chain, 98400 per kthread [ 319.346189][ T5866] usb 1-1: Using ep0 maxpacket: 16 [ 319.364284][ T5866] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 319.390811][ T5866] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 319.414425][ T5866] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 319.423885][ T5125] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 319.447800][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.485483][ T5866] usb 1-1: Product: syz [ 319.497005][ T5866] usb 1-1: Manufacturer: syz [ 319.643449][ T5866] usb 1-1: SerialNumber: syz [ 319.786718][ T8915] ptrace attach of "./syz-executor exec"[5807] was attempted by " \x09 \x0a Œ Ðÿ ð¥ Àÿ Àÿ Ðÿ À• ðÿ °ÿ Àÿ ÿÿÿÿ"[8915] [ 319.904722][ T8915] netlink: 92 bytes leftover after parsing attributes in process `syz.4.705'. [ 319.914618][ T8915] netlink: 92 bytes leftover after parsing attributes in process `syz.4.705'. [ 319.964116][ T8915] macvlan2: entered allmulticast mode [ 319.973072][ T8915] bond_slave_0: entered promiscuous mode [ 319.978906][ T8915] bond_slave_1: entered promiscuous mode [ 319.984710][ T8915] bond0: entered allmulticast mode [ 319.990044][ T8915] bond_slave_0: entered allmulticast mode [ 319.995885][ T8915] bond_slave_1: entered allmulticast mode [ 320.010251][ T8915] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 320.021618][ T8915] team0: Port device macvlan2 added [ 320.136000][ T8916] binder: 8912:8916 ioctl 4018620d 0 returned -22 [ 320.151128][ T8916] usb usb9: usbfs: interface 0 claimed by hub while 'syz.5.706' sets config #0 [ 320.479343][ T10] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 320.724644][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 320.791626][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 320.821772][ T10] usb 5-1: config index 0 descriptor too short (expected 30809, got 89) [ 320.844588][ T10] usb 5-1: config 4 has an invalid interface number: 147 but max is 0 [ 320.871177][ T10] usb 5-1: config 4 has an invalid descriptor of length 249, skipping remainder of the config [ 320.937689][ T10] usb 5-1: config 4 has no interface number 0 [ 320.967712][ T10] usb 5-1: string descriptor 0 read error: -22 [ 320.987478][ T10] usb 5-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 321.109826][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.178977][ T30] audit: type=1400 audit(1748311229.566:729): avc: denied { accept } for pid=8925 comm="syz.5.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 322.209683][ T30] audit: type=1400 audit(1748311230.536:730): avc: denied { name_bind } for pid=8928 comm="syz.3.711" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 322.315501][ T8931] netlink: 300 bytes leftover after parsing attributes in process `syz.3.711'. [ 322.315572][ T10] usb 5-1: Found UVC 0.00 device (04f2:b746) [ 322.345949][ T10] usb 5-1: No valid video chain found. [ 322.354599][ T5866] usb 1-1: cannot find UAC_HEADER [ 322.488165][ T5866] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 322.532288][ T5864] usb 5-1: USB disconnect, device number 21 [ 322.629725][ T5866] usb 1-1: USB disconnect, device number 15 [ 322.752292][ T10] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 322.814598][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 322.902211][ T5817] Bluetooth: hci0: command 0x0c1a tx timeout [ 322.909058][ T5817] Bluetooth: hci3: unexpected event for opcode 0x2012 [ 322.912117][ T5125] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 323.123761][ T10] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 323.140026][ T10] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 323.167547][ T10] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 323.186024][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 323.212424][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 323.236634][ T10] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 323.248306][ T10] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 323.278937][ T10] usb 6-1: Product: syz [ 323.372702][ T8951] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 323.381499][ T8951] audit: out of memory in audit_log_start [ 323.519043][ T5866] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 323.534355][ T10] usb 6-1: Manufacturer: syz [ 323.546996][ T10] cdc_wdm 6-1:1.0: skipping garbage [ 323.552605][ T10] cdc_wdm 6-1:1.0: skipping garbage [ 323.561920][ T10] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 323.569819][ T10] cdc_wdm 6-1:1.0: Unknown control protocol [ 323.700383][ T8955] netlink: 12 bytes leftover after parsing attributes in process `syz.3.720'. [ 323.763127][ T5866] usb 1-1: Using ep0 maxpacket: 32 [ 323.786568][ T5866] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 323.809938][ T5866] usb 1-1: config 0 has no interface number 0 [ 323.837405][ T5866] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 323.869650][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.901395][ T5866] usb 1-1: Product: syz [ 323.944610][ T5866] usb 1-1: Manufacturer: syz [ 324.096146][ T5866] usb 1-1: SerialNumber: syz [ 324.638124][ T5866] usb 1-1: config 0 descriptor?? [ 325.230712][ T5866] radio-si470x 1-1:0.35: this is not a si470x device. [ 325.666905][ T24] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 326.248533][ T5817] Bluetooth: hci0: command 0x0c1a tx timeout [ 326.251577][ T5864] usb 6-1: USB disconnect, device number 22 [ 326.276185][ T5125] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 326.374743][ T8984] netlink: 28 bytes leftover after parsing attributes in process `syz.5.726'. [ 326.422375][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 326.715253][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 326.774589][ T24] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 326.792598][ T5866] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 326.867279][ T24] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 326.949918][ T8997] lo speed is unknown, defaulting to 1000 [ 326.956297][ T8997] lo speed is unknown, defaulting to 1000 [ 326.965101][ T8997] lo speed is unknown, defaulting to 1000 [ 327.021198][ T8997] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 327.122165][ T8997] lo speed is unknown, defaulting to 1000 [ 327.134978][ T8997] lo speed is unknown, defaulting to 1000 [ 327.147212][ T8997] lo speed is unknown, defaulting to 1000 [ 327.159553][ T8997] lo speed is unknown, defaulting to 1000 [ 327.172086][ T8997] lo speed is unknown, defaulting to 1000 [ 327.220929][ T8999] batadv_slave_0: mtu less than device minimum [ 327.377711][ T5908] usb 1-1: USB disconnect, device number 16 [ 327.411167][ T30] audit: type=1400 audit(1748311235.606:731): avc: denied { ioctl } for pid=8989 comm="syz.4.729" path="socket:[21819]" dev="sockfs" ino=21819 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 327.457067][ T24] usb 4-1: Product: syz [ 327.469448][ T24] usb 4-1: Manufacturer: syz [ 327.476652][ T24] usb 4-1: SerialNumber: syz [ 327.487449][ T24] usb 4-1: config 0 descriptor?? [ 327.497075][ T8969] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 327.703078][ T9006] overlay: filesystem on ./bus not supported as upperdir [ 328.109573][ T1203] usb 4-1: USB disconnect, device number 31 [ 329.719786][ T1203] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 329.932315][ T5866] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 329.952131][ T1203] usb 6-1: Using ep0 maxpacket: 16 [ 329.966058][ T1203] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 329.991348][ T1203] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 330.012752][ T30] audit: type=1400 audit(1748311238.396:732): avc: denied { write } for pid=9034 comm="syz.3.739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 330.024145][ T1203] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 330.148884][ T5866] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 330.162199][ T1203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.168065][ T5866] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 330.170194][ T1203] usb 6-1: Product: syz [ 330.230028][ T1203] usb 6-1: Manufacturer: syz [ 330.321417][ T1203] usb 6-1: SerialNumber: syz [ 330.962134][ T5866] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 330.972376][ T5866] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 330.983701][ T5866] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 330.996592][ T5866] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 331.005778][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 331.013905][ T5866] usb 1-1: Product: syz [ 331.018149][ T5866] usb 1-1: Manufacturer: syz [ 331.058221][ T5866] cdc_wdm 1-1:1.0: skipping garbage [ 331.063731][ T5866] cdc_wdm 1-1:1.0: skipping garbage [ 331.112724][ T5866] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 331.133275][ T5866] cdc_wdm 1-1:1.0: Unknown control protocol [ 332.526559][ T30] audit: type=1400 audit(1748311240.916:733): avc: denied { shutdown } for pid=9056 comm="syz.3.743" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 332.703599][ T9061] ubi31: detaching mtd0 [ 332.755597][ T9062] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=9062 comm=syz.4.742 [ 332.796411][ T5125] Bluetooth: hci0: unexpected event for opcode 0x2016 [ 333.010558][ T24] usb 1-1: USB disconnect, device number 17 [ 333.020574][ T9061] ubi31: mtd0 is detached [ 333.530650][ T1203] usb 6-1: cannot find UAC_HEADER [ 333.538718][ T9080] overlay: ./bus is not a directory [ 333.732245][ T5866] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 333.822745][ T1203] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 333.867976][ T1203] usb 6-1: USB disconnect, device number 23 [ 333.877711][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 334.045115][ T5866] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 334.071641][ T5866] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 334.094042][ T5866] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.171228][ T5866] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 334.212181][ T5908] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 334.423284][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 335.162863][ T5908] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 335.184297][ T5908] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 335.202458][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 335.211412][ T5908] usb 3-1: Product: syz [ 335.215691][ T5908] usb 3-1: Manufacturer: syz [ 335.220290][ T5908] usb 3-1: SerialNumber: syz [ 335.313208][ T5908] usb 3-1: config 0 descriptor?? [ 335.319067][ T9083] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 335.382357][ T5866] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 335.494160][ T9102] FAULT_INJECTION: forcing a failure. [ 335.494160][ T9102] name failslab, interval 1, probability 0, space 0, times 0 [ 335.507186][ T9102] CPU: 0 UID: 0 PID: 9102 Comm: syz.3.756 Not tainted 6.15.0-syzkaller #0 PREEMPT(full) [ 335.507210][ T9102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 335.507220][ T9102] Call Trace: [ 335.507226][ T9102] [ 335.507234][ T9102] dump_stack_lvl+0x16c/0x1f0 [ 335.507263][ T9102] should_fail_ex+0x512/0x640 [ 335.507293][ T9102] ? flow_action_cookie_create+0x21/0x80 [ 335.507309][ T9102] should_failslab+0xc2/0x120 [ 335.507328][ T9102] __kmalloc_noprof+0xd2/0x510 [ 335.507353][ T9102] flow_action_cookie_create+0x21/0x80 [ 335.507372][ T9102] tc_setup_action+0x1e9/0x9d0 [ 335.507402][ T9102] ? tc_setup_action+0xa1/0x9d0 [ 335.507426][ T9102] ? __pfx_tc_setup_action+0x10/0x10 [ 335.507448][ T9102] ? __kmalloc_noprof+0x242/0x510 [ 335.507465][ T9102] ? tcf_exts_validate_ex+0x401/0x550 [ 335.507485][ T9102] tc_setup_offload_action+0xb8/0x100 [ 335.507512][ T9102] mall_replace_hw_filter+0x273/0x4c0 [ 335.507536][ T9102] ? __pfx_mall_replace_hw_filter+0x10/0x10 [ 335.507573][ T9102] mall_change+0x9a7/0x1090 [ 335.507597][ T9102] ? __pfx_mall_change+0x10/0x10 [ 335.507615][ T9102] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 335.507651][ T9102] ? __pfx_mall_change+0x10/0x10 [ 335.507669][ T9102] tc_new_tfilter+0xa35/0x2340 [ 335.507714][ T9102] ? __pfx_tc_new_tfilter+0x10/0x10 [ 335.507748][ T9102] ? __lock_acquire+0x5ca/0x1ba0 [ 335.507789][ T9102] ? find_held_lock+0x2b/0x80 [ 335.507810][ T9102] ? __pfx_tc_new_tfilter+0x10/0x10 [ 335.507831][ T9102] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 335.507853][ T9102] ? __pfx_tc_new_tfilter+0x10/0x10 [ 335.507878][ T9102] rtnetlink_rcv_msg+0x95e/0xe90 [ 335.507901][ T9102] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 335.507936][ T9102] netlink_rcv_skb+0x16d/0x440 [ 335.507959][ T9102] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 335.507983][ T9102] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 335.508021][ T9102] ? netlink_deliver_tap+0x1ae/0xd30 [ 335.508048][ T9102] netlink_unicast+0x53a/0x7f0 [ 335.508073][ T9102] ? __pfx_netlink_unicast+0x10/0x10 [ 335.508104][ T9102] netlink_sendmsg+0x8d1/0xdd0 [ 335.508131][ T9102] ? __pfx_netlink_sendmsg+0x10/0x10 [ 335.508163][ T9102] ____sys_sendmsg+0xa95/0xc70 [ 335.508190][ T9102] ? copy_msghdr_from_user+0x10a/0x160 [ 335.508210][ T9102] ? __pfx_____sys_sendmsg+0x10/0x10 [ 335.508248][ T9102] ___sys_sendmsg+0x134/0x1d0 [ 335.508269][ T9102] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.508324][ T9102] __sys_sendmsg+0x16d/0x220 [ 335.508344][ T9102] ? __pfx___sys_sendmsg+0x10/0x10 [ 335.508372][ T9102] ? rcu_is_watching+0x12/0xc0 [ 335.508401][ T9102] do_syscall_64+0xcd/0x260 [ 335.508430][ T9102] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.508447][ T9102] RIP: 0033:0x7f0e9398e969 [ 335.508463][ T9102] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 335.508479][ T9102] RSP: 002b:00007f0e9478c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 335.508496][ T9102] RAX: ffffffffffffffda RBX: 00007f0e93bb5fa0 RCX: 00007f0e9398e969 [ 335.508507][ T9102] RDX: 0000000004000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 335.508517][ T9102] RBP: 00007f0e9478c090 R08: 0000000000000000 R09: 0000000000000000 [ 335.508527][ T9102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 335.508537][ T9102] R13: 0000000000000000 R14: 00007f0e93bb5fa0 R15: 00007ffe40368878 [ 335.508562][ T9102] [ 335.895257][ T5866] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -110 [ 335.903576][ T5866] stv0680 1-1:4.0: last error: 0, command = 0x0 [ 335.947887][ T5866] usb 1-1: USB disconnect, device number 18 [ 335.965100][ T5818] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 336.123416][ T5818] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 336.128303][ T80] usb 3-1: USB disconnect, device number 20 [ 336.132037][ T5818] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 336.132107][ T5818] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 336.132149][ T5818] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 336.132172][ T5818] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 336.191130][ T5818] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 336.201521][ T5818] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 336.209755][ T5818] usb 6-1: Product: syz [ 336.222175][ T5818] usb 6-1: Manufacturer: syz [ 336.235572][ T5818] cdc_wdm 6-1:1.0: skipping garbage [ 336.242107][ T5818] cdc_wdm 6-1:1.0: skipping garbage [ 336.258942][ T5818] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 336.272143][ T5818] cdc_wdm 6-1:1.0: Unknown control protocol [ 336.344990][ T9115] netlink: 'syz.3.757': attribute type 1 has an invalid length. [ 336.835261][ T5125] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 336.845273][ T5125] Bluetooth: hci0: Injecting HCI hardware error event [ 336.859114][ T5125] Bluetooth: hci0: hardware error 0x00 [ 337.792726][ T9123] fuse: Bad value for 'group_id' [ 337.797919][ T9123] fuse: Bad value for 'group_id' [ 338.151512][ T9131] netlink: 28 bytes leftover after parsing attributes in process `syz.4.760'. [ 338.170223][ T9131] af_packet: tpacket_rcv: packet too big, clamped from 88 to 4294967272. macoff=96 [ 338.250652][ T9136] netlink: 28 bytes leftover after parsing attributes in process `syz.2.762'. [ 338.313904][ T826] usb 6-1: USB disconnect, device number 24 [ 338.622379][ T9155] overlay: ./bus is not a directory [ 338.848320][ T30] audit: type=1400 audit(1748311247.236:734): avc: denied { bind } for pid=9152 comm="syz.2.767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 339.468917][ T5125] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 339.482155][ T5908] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 339.722161][ T5908] usb 4-1: Using ep0 maxpacket: 32 [ 339.745522][ T9170] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 339.767755][ T5908] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 340.427611][ T5908] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 340.468346][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 340.529807][ T5908] usb 4-1: Product: syz [ 340.539468][ T5908] usb 4-1: Manufacturer: syz [ 340.549595][ T5908] usb 4-1: SerialNumber: syz [ 340.575167][ T5908] usb 4-1: config 0 descriptor?? [ 340.598335][ T9163] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 341.151934][ T9200] netlink: 16 bytes leftover after parsing attributes in process `syz.5.776'. [ 341.228780][ T5908] usb 4-1: USB disconnect, device number 32 [ 341.239002][ T30] audit: type=1400 audit(1748311249.626:735): avc: denied { read } for pid=9197 comm="syz.5.776" path="socket:[22823]" dev="sockfs" ino=22823 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 341.292238][ T826] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 341.540686][ T826] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 341.549820][ T826] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 341.560398][ T826] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 341.569943][ T826] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 341.582909][ T826] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 341.703444][ T826] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 341.717327][ T826] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 341.732248][ T826] usb 1-1: Product: syz [ 341.736882][ T826] usb 1-1: Manufacturer: syz [ 341.807538][ T826] cdc_wdm 1-1:1.0: skipping garbage [ 341.819661][ T826] cdc_wdm 1-1:1.0: skipping garbage [ 341.828602][ T826] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 341.835405][ T826] cdc_wdm 1-1:1.0: Unknown control protocol [ 344.454633][ T1203] usb 1-1: USB disconnect, device number 19 [ 344.867534][ T5125] Bluetooth: hci5: unexpected event for opcode 0x2012 [ 346.822256][ T1203] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 347.042224][ T1203] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 347.439935][ T1203] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.710672][ T1203] usb 1-1: config 0 descriptor?? [ 348.005601][ T1203] cp210x 1-1:0.0: cp210x converter detected [ 348.314525][ T1203] cp210x 1-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 348.353111][ T1203] usb 1-1: cp210x converter now attached to ttyUSB0 [ 348.442255][ T80] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 348.569497][ T5125] Bluetooth: hci2: unknown advertising packet type: 0x07 [ 348.573043][ T826] usb 1-1: USB disconnect, device number 20 [ 348.613739][ T80] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 348.623423][ T826] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 348.652183][ T80] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 348.687797][ T80] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 348.704827][ T826] cp210x 1-1:0.0: device disconnected [ 348.727686][ T80] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 348.762137][ T80] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 348.883500][ T9266] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 349.014798][ T80] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 349.024400][ T80] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 349.042166][ T80] usb 5-1: Product: syz [ 349.048706][ T80] usb 5-1: Manufacturer: syz [ 349.049060][ T30] audit: type=1400 audit(1748311257.246:736): avc: denied { mount } for pid=9263 comm="syz.3.796" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 349.065785][ T80] cdc_wdm 5-1:1.0: skipping garbage [ 349.140398][ T80] cdc_wdm 5-1:1.0: skipping garbage [ 349.161241][ T80] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 349.172545][ T80] cdc_wdm 5-1:1.0: Unknown control protocol [ 351.862428][ T30] audit: type=1400 audit(1748311260.226:737): avc: denied { unmount } for pid=5813 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 351.944908][ T9274] bridge0: port 3(netdevsim0) entered blocking state [ 351.951981][ T9274] bridge0: port 3(netdevsim0) entered disabled state [ 351.959375][ T9274] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 351.974247][ T9274] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 352.679943][ T9278] syz.0.800 (9278): drop_caches: 2 [ 353.236019][ T80] usb 5-1: USB disconnect, device number 22 [ 354.228265][ T9297] lo speed is unknown, defaulting to 1000 [ 355.670067][ T9313] input: syz0 as /devices/virtual/input/input12 [ 355.682777][ T9313] input: failed to attach handler leds to device input12, error: -6 [ 355.765587][ T9318] overlay: ./bus is not a directory [ 356.185037][ T9322] netlink: zone id is out of range [ 356.237798][ T9322] netlink: zone id is out of range [ 356.258145][ T9322] netlink: zone id is out of range [ 356.404230][ T9322] netlink: zone id is out of range [ 356.407740][ T9332] syz.5.813 (9332): drop_caches: 2 [ 356.771735][ T1203] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 357.304584][ T9322] netlink: zone id is out of range [ 357.356630][ T9322] netlink: set zone limit has 4 unknown bytes [ 357.452135][ T1203] usb 1-1: Using ep0 maxpacket: 32 [ 357.459079][ T1203] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 357.512824][ T1203] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 357.521906][ T1203] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 357.558243][ T1203] usb 1-1: Product: syz [ 357.577793][ T1203] usb 1-1: Manufacturer: syz [ 357.604071][ T1203] usb 1-1: SerialNumber: syz [ 357.639119][ T1203] usb 1-1: config 0 descriptor?? [ 357.648401][ T9324] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 357.744548][ T9342] netlink: 28 bytes leftover after parsing attributes in process `syz.4.816'. [ 357.812468][ T24] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 358.902850][ T5818] usb 1-1: USB disconnect, device number 21 [ 358.932152][ T24] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 358.951069][ T24] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 358.982257][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 358.991274][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 359.030640][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 359.137047][ T24] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 359.181323][ T24] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 359.433953][ T24] usb 6-1: Product: syz [ 359.495889][ T24] usb 6-1: Manufacturer: syz [ 359.536457][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 359.659384][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 359.979942][ T24] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 359.991172][ T24] cdc_wdm 6-1:1.0: Unknown control protocol [ 362.173862][ T5864] usb 6-1: USB disconnect, device number 25 [ 362.733751][ T5864] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 362.737223][ T30] audit: type=1400 audit(1748311271.106:738): avc: denied { write } for pid=9382 comm="syz.5.825" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 362.836814][ T9392] netlink: zone id is out of range [ 362.837915][ T9392] netlink: zone id is out of range [ 362.838350][ T9392] netlink: zone id is out of range [ 362.839062][ T9392] netlink: zone id is out of range [ 362.840104][ T9392] netlink: zone id is out of range [ 362.840113][ T9392] netlink: zone id is out of range [ 362.845996][ T9392] netlink: zone id is out of range [ 362.857378][ T9392] netlink: zone id is out of range [ 362.857410][ T9392] netlink: zone id is out of range [ 362.857418][ T9392] netlink: zone id is out of range [ 362.941799][ T5864] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 362.941998][ T5864] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 362.962917][ T5864] usb 1-1: New USB device found, idVendor=0525, idProduct=e4a1, bcdDevice= 0.40 [ 362.963007][ T5864] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.963069][ T5864] usb 1-1: Product: syz [ 362.963130][ T5864] usb 1-1: Manufacturer: syz [ 362.963186][ T5864] usb 1-1: SerialNumber: syz [ 363.254273][ T9400] overlay: ./bus is not a directory [ 363.282775][ T9386] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 364.313882][ T9381] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 364.518335][ T5864] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 364.525153][ T5864] cdc_ncm 1-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 364.533328][ T5864] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 364.709754][ T9414] syz.2.831 (9414): drop_caches: 2 [ 364.715475][ T9414] syz.2.831 (9414): drop_caches: 2 [ 364.961606][ T5864] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 365.038342][ T5864] usb 1-1: USB disconnect, device number 22 [ 365.055685][ T5864] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 365.711732][ T9424] syz.5.833 (9424): drop_caches: 2 [ 366.069830][ T9432] kexec: Could not allocate control_code_buffer [ 366.472232][ T80] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 366.622212][ T80] usb 3-1: Using ep0 maxpacket: 32 [ 366.912795][ T80] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 366.962571][ T5866] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 366.977650][ T80] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 367.015576][ T80] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 367.057939][ T80] usb 3-1: Product: syz [ 367.069456][ T80] usb 3-1: Manufacturer: syz [ 367.105458][ T80] usb 3-1: SerialNumber: syz [ 367.130155][ T5866] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 367.166098][ T5866] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 367.180784][ T80] usb 3-1: config 0 descriptor?? [ 367.211253][ T5866] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 367.221914][ T9429] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 367.288967][ T5866] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 367.351887][ T5866] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 367.414604][ T5866] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 367.751538][ T5866] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 367.770986][ T5866] usb 6-1: Product: syz [ 367.783124][ T10] usb 3-1: USB disconnect, device number 21 [ 367.795612][ T5866] usb 6-1: Manufacturer: syz [ 367.855900][ T5866] cdc_wdm 6-1:1.0: skipping garbage [ 367.875391][ T5866] cdc_wdm 6-1:1.0: skipping garbage [ 367.899283][ T5866] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 367.915315][ T5866] cdc_wdm 6-1:1.0: Unknown control protocol [ 370.087110][ T5908] usb 6-1: USB disconnect, device number 26 [ 371.316260][ T30] audit: type=1400 audit(1748311279.686:739): avc: denied { write } for pid=9478 comm="syz.0.841" path="socket:[23394]" dev="sockfs" ino=23394 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 371.339619][ C1] vkms_vblank_simulate: vblank timer overrun [ 371.411258][ T9488] overlay: ./bus is not a directory [ 371.640746][ T5908] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 371.865218][ T5908] usb 5-1: Using ep0 maxpacket: 16 [ 371.893162][ T5908] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 371.966042][ T5908] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 372.634494][ T5908] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 372.652103][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.672440][ T5908] usb 5-1: Product: syz [ 372.676640][ T5908] usb 5-1: Manufacturer: syz [ 372.687749][ T5908] usb 5-1: SerialNumber: syz [ 373.164000][ T5818] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 373.733543][ T5818] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 373.768553][ T5818] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 373.829213][ T5818] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.892765][ T5818] usb 1-1: config 0 descriptor?? [ 373.980613][ T5818] pwc: Askey VC010 type 2 USB webcam detected. [ 374.212186][ T5864] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 374.231283][ T5818] pwc: send_video_command error -71 [ 374.314325][ T5818] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 374.353936][ T5818] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 374.378287][ T5818] usb 1-1: USB disconnect, device number 23 [ 374.455352][ T5864] usb 3-1: Using ep0 maxpacket: 32 [ 374.470532][ T5864] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 374.488368][ T5864] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 374.508454][ T5864] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 374.527782][ T5864] usb 3-1: Product: syz [ 374.532430][ T5864] usb 3-1: Manufacturer: syz [ 374.537178][ T5864] usb 3-1: SerialNumber: syz [ 374.548163][ T5864] usb 3-1: config 0 descriptor?? [ 374.576026][ T9513] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 374.742434][ T5818] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 374.821696][ T5908] usb 5-1: cannot find UAC_HEADER [ 374.907275][ T5818] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 375.050409][ T9537] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.058397][ T9537] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.070901][ T9537] bridge0: entered allmulticast mode [ 375.139766][ T9537] bridge_slave_1: left allmulticast mode [ 375.145882][ T9537] bridge_slave_1: left promiscuous mode [ 375.156916][ T9537] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.222112][ T5866] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 375.228374][ T5908] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 375.292314][ T5818] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 375.304263][ T5818] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.323567][ T5908] usb 5-1: USB disconnect, device number 23 [ 375.330320][ T9537] bridge_slave_0: left allmulticast mode [ 375.355973][ T9537] bridge_slave_0: left promiscuous mode [ 375.357197][ T5818] usb 1-1: config 0 descriptor?? [ 375.368079][ T9537] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.378304][ T5818] pwc: Askey VC010 type 2 USB webcam detected. [ 375.407293][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 375.467152][ T5866] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 375.489677][ T5866] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 375.529203][ T5866] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 375.569341][ T5866] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 375.581757][ T5866] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 375.597846][ T5866] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 375.622666][ T5866] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 375.631008][ T5866] usb 6-1: Product: syz [ 375.636546][ T5866] usb 6-1: Manufacturer: syz [ 375.647803][ T5866] cdc_wdm 6-1:1.0: skipping garbage [ 375.653524][ T5908] usb 3-1: USB disconnect, device number 22 [ 375.659785][ T5866] cdc_wdm 6-1:1.0: skipping garbage [ 375.690992][ T5866] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 375.704971][ T5866] cdc_wdm 6-1:1.0: Unknown control protocol [ 375.796893][ T5818] pwc: recv_control_msg error -32 req 02 val 2b00 [ 375.804796][ T5818] pwc: recv_control_msg error -32 req 02 val 2700 [ 375.815303][ T5818] pwc: recv_control_msg error -32 req 02 val 2c00 [ 375.823507][ T5818] pwc: recv_control_msg error -32 req 04 val 1000 [ 375.831037][ T5818] pwc: recv_control_msg error -32 req 04 val 1300 [ 375.840747][ T5818] pwc: recv_control_msg error -32 req 04 val 1400 [ 375.963361][ T5818] pwc: recv_control_msg error -32 req 02 val 2000 [ 375.970779][ T5818] pwc: recv_control_msg error -32 req 02 val 2100 [ 375.980866][ T5818] pwc: recv_control_msg error -32 req 04 val 1500 [ 375.988676][ T5818] pwc: recv_control_msg error -32 req 02 val 2500 [ 376.447027][ T5818] pwc: recv_control_msg error -32 req 02 val 2400 [ 376.455218][ T5818] pwc: recv_control_msg error -32 req 02 val 2600 [ 376.465298][ T5818] pwc: recv_control_msg error -32 req 02 val 2900 [ 376.680106][ T5818] pwc: recv_control_msg error -71 req 04 val 1100 [ 376.779767][ T5818] pwc: recv_control_msg error -71 req 04 val 1200 [ 376.805271][ T5818] pwc: Registered as video103. [ 377.306370][ T5818] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input13 [ 377.333005][ T5818] usb 1-1: USB disconnect, device number 24 [ 377.672144][ T5864] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 377.773587][ T9568] net_ratelimit: 8 callbacks suppressed [ 377.773623][ T9568] netlink: zone id is out of range [ 377.775346][ T1203] usb 6-1: USB disconnect, device number 27 [ 377.809032][ T9568] netlink: zone id is out of range [ 377.861569][ T5864] usb 3-1: Using ep0 maxpacket: 16 [ 377.869263][ T9568] netlink: zone id is out of range [ 377.892675][ T9568] netlink: zone id is out of range [ 377.899799][ T9568] netlink: zone id is out of range [ 378.014968][ T9568] netlink: set zone limit has 4 unknown bytes [ 378.064889][ T5864] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 378.113416][ T5864] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 378.126841][ T5864] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 378.137879][ T5864] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.187937][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.315479][ T5864] usb 3-1: config 0 descriptor?? [ 378.501561][ T9578] overlay: ./bus is not a directory [ 379.190278][ T5864] konepure 0003:1E7D:2DB4.0009: unknown main item tag 0x0 [ 379.269155][ T5864] konepure 0003:1E7D:2DB4.0009: unknown main item tag 0x0 [ 379.300909][ T5864] konepure 0003:1E7D:2DB4.0009: unknown main item tag 0x0 [ 379.626900][ T5864] konepure 0003:1E7D:2DB4.0009: unknown main item tag 0x0 [ 379.637515][ T5864] konepure 0003:1E7D:2DB4.0009: hidraw0: USB HID v0.00 Device [HID 1e7d:2db4] on usb-dummy_hcd.2-1/input0 [ 379.700130][ T5864] usb 3-1: USB disconnect, device number 23 [ 379.945581][ T9589] fido_id[9589]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 380.878489][ T9592] syz.4.864 (9592): drop_caches: 2 [ 381.428982][ T30] audit: type=1400 audit(1748311289.746:740): avc: denied { map } for pid=9603 comm="syz.3.866" path="socket:[24711]" dev="sockfs" ino=24711 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 381.451928][ C1] vkms_vblank_simulate: vblank timer overrun [ 382.182764][ T30] audit: type=1400 audit(1748311289.776:741): avc: denied { map } for pid=9603 comm="syz.3.866" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 382.662175][ T5822] Bluetooth: hci5: command 0x0406 tx timeout [ 383.753861][ T9625] netlink: zone id is out of range [ 383.759071][ T9625] netlink: zone id is out of range [ 383.764401][ T9625] netlink: zone id is out of range [ 383.769624][ T9625] netlink: zone id is out of range [ 383.774902][ T9625] netlink: zone id is out of range [ 383.780073][ T9625] netlink: zone id is out of range [ 383.785328][ T9625] netlink: zone id is out of range [ 383.791684][ T9625] netlink: zone id is out of range [ 383.799087][ T9625] netlink: zone id is out of range [ 383.805295][ T9625] netlink: zone id is out of range [ 384.042430][ T9] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 384.514940][ T9] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 384.530355][ T9] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 384.570222][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 384.605271][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 384.650758][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 384.783312][ T9] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 384.794123][ T9] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 384.814276][ T9] usb 5-1: Product: syz [ 384.821279][ T9] usb 5-1: Manufacturer: syz [ 384.866763][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 384.889075][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 384.901075][ T30] audit: type=1400 audit(1748311293.296:742): avc: denied { ioctl } for pid=9636 comm="syz.3.875" path="socket:[23939]" dev="sockfs" ino=23939 ioctlcmd=0x8b19 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 384.944161][ T9] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 384.956547][ T9] cdc_wdm 5-1:1.0: Unknown control protocol [ 385.422381][ T80] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 385.671064][ T80] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 386.151131][ T9641] syz.3.877 (9641): drop_caches: 2 [ 386.163196][ T80] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 386.190435][ T80] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 386.230350][ T80] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 386.241878][ T80] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.260179][ T80] usb 6-1: config 0 descriptor?? [ 386.803676][ T9653] lo speed is unknown, defaulting to 1000 [ 387.041331][ T80] plantronics 0003:047F:FFFF.000A: reserved main item tag 0xd [ 387.266038][ T5866] usb 5-1: USB disconnect, device number 24 [ 387.294839][ T80] plantronics 0003:047F:FFFF.000A: No inputs registered, leaving [ 387.406102][ T80] plantronics 0003:047F:FFFF.000A: hiddev1,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 388.198646][ T80] usb 6-1: USB disconnect, device number 28 [ 389.132134][ T826] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 389.287880][ T30] audit: type=1326 audit(1748311297.676:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 389.480007][ T9679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.886'. [ 389.666107][ T30] audit: type=1326 audit(1748311297.676:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 389.706883][ T826] usb 6-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 389.744191][ T826] usb 6-1: config 0 interface 0 has no altsetting 0 [ 389.773524][ T826] usb 6-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 389.782798][ T30] audit: type=1326 audit(1748311297.696:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=266 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 389.806095][ T826] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.847693][ T826] usb 6-1: config 0 descriptor?? [ 389.864163][ T30] audit: type=1326 audit(1748311297.696:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 389.919510][ T30] audit: type=1326 audit(1748311297.696:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 389.958714][ T30] audit: type=1326 audit(1748311297.696:748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 390.099760][ T9669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.133831][ T30] audit: type=1326 audit(1748311297.696:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff04d785927 code=0x7ffc0000 [ 390.163656][ T9669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.181287][ T9669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.194710][ T9669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.214339][ T30] audit: type=1326 audit(1748311297.696:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff04d72ab39 code=0x7ffc0000 [ 390.239742][ T9669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.291417][ T9669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.661975][ T30] audit: type=1326 audit(1748311297.696:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7ff04d78e969 code=0x7ffc0000 [ 390.688869][ T30] audit: type=1326 audit(1748311297.746:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.4.886" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff04d785927 code=0x7ffc0000 [ 390.717821][ T9669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.737242][ T9669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.854247][ T9669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.867418][ T9669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.168957][ T826] usbhid 6-1:0.0: can't add hid device: -71 [ 391.175767][ T826] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 391.211643][ T826] usb 6-1: USB disconnect, device number 29 [ 391.874139][ T9695] syz.4.890 (9695): drop_caches: 2 [ 393.518152][ T9700] capability: warning: `syz.2.892' uses deprecated v2 capabilities in a way that may be insecure [ 394.446049][ T9710] syz.4.894 (9710): drop_caches: 2 [ 396.039321][ T9725] net_ratelimit: 33 callbacks suppressed [ 396.039334][ T9725] netlink: zone id is out of range [ 396.050614][ T9725] netlink: zone id is out of range [ 396.056365][ T9725] netlink: zone id is out of range [ 396.070400][ T9725] netlink: set zone limit has 4 unknown bytes [ 396.256494][ T826] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 397.060237][ T826] usb 4-1: Using ep0 maxpacket: 16 [ 397.278621][ T826] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 397.293613][ T826] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 397.328734][ T826] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 397.472165][ T5818] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 397.949764][ T5818] usb 6-1: Using ep0 maxpacket: 16 [ 398.128609][ T826] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.773757][ T826] usb 4-1: Product: syz [ 398.778454][ T826] usb 4-1: Manufacturer: syz [ 398.783327][ T826] usb 4-1: SerialNumber: syz [ 398.788611][ T5818] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 398.799754][ T5818] usb 6-1: New USB device found, idVendor=060b, idProduct=0001, bcdDevice= 0.00 [ 398.813197][ T5818] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.865356][ T5818] usb 6-1: config 0 descriptor?? [ 399.009643][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 399.009657][ T30] audit: type=1400 audit(1748311307.396:790): avc: denied { append } for pid=9742 comm="syz.4.904" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 399.199018][ T826] usb 4-1: cannot find UAC_HEADER [ 399.360726][ T9750] syz.2.905 (9750): drop_caches: 2 [ 399.552809][ T9751] SELinux: Context system_u:object_r:fsadm_ex is not valid (left unmapped). [ 399.734848][ T30] audit: type=1400 audit(1748311307.936:791): avc: denied { ioctl } for pid=9731 comm="syz.5.901" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x541c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 400.366553][ T30] audit: type=1400 audit(1748311307.956:792): avc: denied { relabelto } for pid=9731 comm="syz.5.901" name="139" dev="tmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_ex" [ 400.435253][ T826] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 400.545486][ T30] audit: type=1400 audit(1748311307.956:793): avc: denied { associate } for pid=9731 comm="syz.5.901" name="139" dev="tmpfs" ino=752 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fsadm_ex" [ 400.717670][ T826] usb 4-1: USB disconnect, device number 33 [ 400.756374][ T9732] lo speed is unknown, defaulting to 1000 [ 400.920796][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 400.961129][ T9762] FAULT_INJECTION: forcing a failure. [ 400.961129][ T9762] name failslab, interval 1, probability 0, space 0, times 0 [ 400.975885][ T9762] CPU: 0 UID: 0 PID: 9762 Comm: syz.0.903 Not tainted 6.15.0-syzkaller #0 PREEMPT(full) [ 400.975900][ T9762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 400.975907][ T9762] Call Trace: [ 400.975911][ T9762] [ 400.975915][ T9762] dump_stack_lvl+0x16c/0x1f0 [ 400.975937][ T9762] should_fail_ex+0x512/0x640 [ 400.975953][ T9762] ? __kmalloc_node_track_caller_noprof+0xc3/0x510 [ 400.975967][ T9762] should_failslab+0xc2/0x120 [ 400.975979][ T9762] __kmalloc_node_track_caller_noprof+0xd6/0x510 [ 400.975991][ T9762] ? __pfx_down_read+0x10/0x10 [ 400.976001][ T9762] ? __might_fault+0xe3/0x190 [ 400.976011][ T9762] ? dh_data_from_key+0x164/0x2d0 [ 400.976024][ T9762] kmemdup_noprof+0x29/0x60 [ 400.976037][ T9762] dh_data_from_key+0x164/0x2d0 [ 400.976049][ T9762] __keyctl_dh_compute+0xc6c/0x10e0 [ 400.976061][ T9762] ? get_pid_task+0xfc/0x250 [ 400.976072][ T9762] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 400.976083][ T9762] ? get_pid_task+0x106/0x250 [ 400.976093][ T9762] ? proc_fail_nth_write+0x9f/0x250 [ 400.976110][ T9762] ? find_held_lock+0x2b/0x80 [ 400.976129][ T9762] ? ksys_write+0x190/0x240 [ 400.976151][ T9762] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 400.976170][ T9762] keyctl_dh_compute+0xd2/0x140 [ 400.976180][ T9762] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 400.976193][ T9762] ? ksys_write+0x1b9/0x240 [ 400.976210][ T9762] ? __pfx_ksys_write+0x10/0x10 [ 400.976229][ T9762] __do_sys_keyctl+0x4df/0x590 [ 400.976244][ T9762] do_syscall_64+0xcd/0x260 [ 400.976261][ T9762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.976272][ T9762] RIP: 0033:0x7f06b318e969 [ 400.976282][ T9762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 400.976293][ T9762] RSP: 002b:00007f06b3fd4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 400.976304][ T9762] RAX: ffffffffffffffda RBX: 00007f06b33b6160 RCX: 00007f06b318e969 [ 400.976311][ T9762] RDX: 0000200000000440 RSI: 00002000000001c0 RDI: 0000000000000017 [ 400.976317][ T9762] RBP: 00007f06b3fd4090 R08: 0000000000000000 R09: 0000000000000000 [ 400.976324][ T9762] R10: 00000000000000fb R11: 0000000000000246 R12: 0000000000000001 [ 400.976330][ T9762] R13: 0000000000000000 R14: 00007f06b33b6160 R15: 00007ffe76d71978 [ 400.976344][ T9762] [ 401.669460][ T5818] usbhid 6-1:0.0: can't add hid device: -71 [ 401.672621][ T5908] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 401.675691][ T5818] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 401.746166][ T30] audit: type=1400 audit(1748311310.136:794): avc: denied { write } for pid=6293 comm="syz-executor" name="139" dev="tmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_ex" [ 401.778347][ T5818] usb 6-1: USB disconnect, device number 30 [ 401.817620][ T5908] usb 3-1: device descriptor read/64, error -71 [ 401.851874][ T9777] FAULT_INJECTION: forcing a failure. [ 401.851874][ T9777] name failslab, interval 1, probability 0, space 0, times 0 [ 401.887225][ T30] audit: type=1400 audit(1748311310.136:795): avc: denied { remove_name } for pid=6293 comm="syz-executor" name="binderfs" dev="tmpfs" ino=756 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_ex" [ 401.902198][ T9777] CPU: 1 UID: 0 PID: 9777 Comm: syz.5.912 Not tainted 6.15.0-syzkaller #0 PREEMPT(full) [ 401.902224][ T9777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 401.902235][ T9777] Call Trace: [ 401.902240][ T9777] [ 401.902247][ T9777] dump_stack_lvl+0x16c/0x1f0 [ 401.902276][ T9777] should_fail_ex+0x512/0x640 [ 401.902297][ T9777] ? fs_reclaim_acquire+0xae/0x150 [ 401.902321][ T9777] ? tomoyo_encode2+0x100/0x3e0 [ 401.902343][ T9777] should_failslab+0xc2/0x120 [ 401.902360][ T9777] __kmalloc_noprof+0xd2/0x510 [ 401.902376][ T9777] ? d_absolute_path+0x136/0x1a0 [ 401.902399][ T9777] tomoyo_encode2+0x100/0x3e0 [ 401.902426][ T9777] tomoyo_encode+0x29/0x50 [ 401.902447][ T9777] tomoyo_realpath_from_path+0x18f/0x6e0 [ 401.902477][ T9777] tomoyo_path_number_perm+0x245/0x580 [ 401.902496][ T9777] ? tomoyo_path_number_perm+0x237/0x580 [ 401.902519][ T9777] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 401.902540][ T9777] ? find_held_lock+0x2b/0x80 [ 401.902581][ T9777] ? find_held_lock+0x2b/0x80 [ 401.902598][ T9777] ? hook_file_ioctl_common+0x145/0x410 [ 401.902620][ T9777] ? __fget_files+0x20e/0x3c0 [ 401.902639][ T9777] security_file_ioctl+0x9b/0x240 [ 401.902665][ T9777] __x64_sys_ioctl+0xb7/0x200 [ 401.902688][ T9777] do_syscall_64+0xcd/0x260 [ 401.902712][ T9777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.902728][ T9777] RIP: 0033:0x7f2c79b8e969 [ 401.902747][ T9777] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 401.902763][ T9777] RSP: 002b:00007f2c779f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 401.902779][ T9777] RAX: ffffffffffffffda RBX: 00007f2c79db5fa0 RCX: 00007f2c79b8e969 [ 401.902789][ T9777] RDX: 00002000000000c0 RSI: 0000000040189206 RDI: 0000000000000004 [ 401.902798][ T9777] RBP: 00007f2c779f6090 R08: 0000000000000000 R09: 0000000000000000 [ 401.902807][ T9777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.902816][ T9777] R13: 0000000000000000 R14: 00007f2c79db5fa0 R15: 00007ffe22fac998 [ 401.902838][ T9777] [ 401.902854][ T9777] ERROR: Out of memory at tomoyo_realpath_from_path. [ 401.913547][ C0] vkms_vblank_simulate: vblank timer overrun [ 402.013438][ T30] audit: type=1400 audit(1748311310.136:796): avc: denied { rmdir } for pid=6293 comm="syz-executor" name="139" dev="tmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_ex" [ 402.153709][ T5908] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 402.322237][ T5908] usb 3-1: device descriptor read/64, error -71 [ 402.646216][ T5908] usb usb3-port1: attempt power cycle [ 403.110720][ T9788] netlink: zone id is out of range [ 403.135766][ T9788] netlink: zone id is out of range [ 403.173243][ T9788] netlink: zone id is out of range [ 403.371567][ T9788] netlink: set zone limit has 4 unknown bytes [ 403.382286][ T5908] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 403.404371][ T5908] usb 3-1: device descriptor read/8, error -71 [ 404.472234][ T5908] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 405.214917][ T5908] usb 3-1: device not accepting address 27, error -71 [ 405.230860][ T5908] usb usb3-port1: unable to enumerate USB device [ 407.789435][ T9822] kexec: Could not allocate control_code_buffer [ 411.383079][ T9845] netlink: zone id is out of range [ 411.388313][ T9845] netlink: zone id is out of range [ 411.393672][ T9845] netlink: zone id is out of range [ 411.398858][ T9845] netlink: zone id is out of range [ 411.404098][ T9845] netlink: zone id is out of range [ 411.409249][ T9845] netlink: zone id is out of range [ 411.415677][ T9845] netlink: zone id is out of range [ 411.423317][ T9845] netlink: zone id is out of range [ 411.428492][ T9845] netlink: zone id is out of range [ 411.433862][ T9845] netlink: zone id is out of range [ 413.328565][ T9852] syz.0.930 (9852): drop_caches: 2 [ 413.348996][ T9852] syz.0.930 (9852): drop_caches: 2 [ 415.541435][ T5818] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 416.616116][ T5818] usb 6-1: Using ep0 maxpacket: 32 [ 416.631188][ T5818] usb 6-1: device descriptor read/all, error -71 [ 416.862608][ T826] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 416.952475][ T80] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 416.981558][ T9886] lo speed is unknown, defaulting to 1000 [ 417.021243][ T30] audit: type=1400 audit(1748311325.406:797): avc: denied { create } for pid=9885 comm="syz.4.941" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 417.042280][ T30] audit: type=1400 audit(1748311325.416:798): avc: denied { write } for pid=9885 comm="syz.4.941" path="socket:[24448]" dev="sockfs" ino=24448 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 417.084753][ T826] usb 3-1: Using ep0 maxpacket: 16 [ 417.098697][ T826] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 417.110125][ T826] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 417.124344][ T80] usb 4-1: Using ep0 maxpacket: 16 [ 417.130171][ T826] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 417.148617][ T826] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.157068][ T80] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 417.167751][ T826] usb 3-1: Product: syz [ 417.172464][ T826] usb 3-1: Manufacturer: syz [ 417.177275][ T826] usb 3-1: SerialNumber: syz [ 417.188917][ T9891] net_ratelimit: 28 callbacks suppressed [ 417.188928][ T9891] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 417.211649][ T80] usb 4-1: config 0 has no interface number 0 [ 417.240972][ T80] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 417.253299][ T24] lo speed is unknown, defaulting to 1000 [ 417.259576][ T80] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 417.270785][ T80] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 417.284294][ T80] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 417.292613][ T80] usb 4-1: Product: syz [ 417.297506][ T80] usb 4-1: SerialNumber: syz [ 417.304720][ T80] usb 4-1: config 0 descriptor?? [ 417.328751][ T80] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 417.337994][ T80] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input15 [ 417.613104][ T9876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.667829][ T30] audit: type=1400 audit(1748311326.056:799): avc: denied { create } for pid=9897 comm="syz.4.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 417.697322][ T9898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 417.833131][ T9876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.838187][ T30] audit: type=1400 audit(1748311326.086:800): avc: denied { ioctl } for pid=9897 comm="syz.4.944" path="socket:[25275]" dev="sockfs" ino=25275 ioctlcmd=0x8990 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 417.854197][ T9898] bond0: (slave rose0): Enslaving as an active interface with an up link [ 417.891678][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 417.904866][ T30] audit: type=1400 audit(1748311326.226:801): avc: denied { bind } for pid=9897 comm="syz.4.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 418.096493][ T9876] xt_CT: You must specify a L4 protocol and not use inversions on it [ 418.533340][ T5866] usb 4-1: USB disconnect, device number 34 [ 418.559449][ T5866] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 420.000385][ T826] usb 3-1: cannot find UAC_HEADER [ 420.497990][ T9949] netlink: zone id is out of range [ 420.504826][ T9949] netlink: zone id is out of range [ 420.510022][ T9949] netlink: zone id is out of range [ 420.515329][ T9949] netlink: zone id is out of range [ 420.520479][ T9949] netlink: zone id is out of range [ 420.525830][ T9949] netlink: zone id is out of range [ 420.562058][ T9949] netlink: zone id is out of range [ 420.578449][ T9949] netlink: zone id is out of range [ 420.583845][ T9949] netlink: zone id is out of range [ 420.689499][ T826] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 420.748381][ T826] usb 3-1: USB disconnect, device number 28 [ 421.227329][ T6629] udevd[6629]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 421.780744][ T9953] syz_tun: entered promiscuous mode [ 421.922347][ T9953] batadv_slave_0: entered promiscuous mode [ 423.564752][ T9953] hsr1: entered allmulticast mode [ 423.639820][ T9953] syz_tun: entered allmulticast mode [ 423.655012][ T9953] batadv_slave_0: entered allmulticast mode [ 423.985053][ T9974] netlink: 11 bytes leftover after parsing attributes in process `syz.5.958'. [ 424.842381][ T9966] net_ratelimit: 29 callbacks suppressed [ 424.842396][ T9966] netlink: zone id is out of range [ 424.853192][ T9966] netlink: zone id is out of range [ 424.858277][ T9966] netlink: zone id is out of range [ 424.863387][ T9966] netlink: zone id is out of range [ 424.868622][ T9966] netlink: zone id is out of range [ 424.874501][ T9966] netlink: zone id is out of range [ 424.880366][ T9966] netlink: zone id is out of range [ 424.885808][ T9966] netlink: zone id is out of range [ 424.890892][ T9966] netlink: zone id is out of range [ 424.896016][ T9966] netlink: zone id is out of range [ 425.253454][ T9976] binder: BINDER_SET_CONTEXT_MGR already set [ 425.259526][ T9976] binder: 9971:9976 ioctl 4018620d 200000000040 returned -16 [ 426.496793][ T9989] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 427.880404][ T9] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 428.042239][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 428.118303][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.192467][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 428.226023][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 428.255629][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.284168][ T9] usb 5-1: Product: syz [ 428.298611][ T9] usb 5-1: Manufacturer: syz [ 428.339645][ T9] usb 5-1: SerialNumber: syz [ 429.926739][T10014] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.865835][T10028] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 433.252965][ T9] usb 5-1: cannot find UAC_HEADER [ 435.511906][T10017] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 435.533699][T10019] net_ratelimit: 20 callbacks suppressed [ 435.533719][T10019] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 435.575541][ T9] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 435.659787][ T9] usb 5-1: USB disconnect, device number 25 [ 435.745030][ T5811] udevd[5811]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 436.620574][T10046] overlay: ./bus is not a directory [ 436.642278][T10045] syz.0.975 (10045): drop_caches: 2 [ 437.852820][ T30] audit: type=1400 audit(1748311346.236:802): avc: denied { getopt } for pid=10042 comm="syz.4.976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 439.751653][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.772112][ T826] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 440.462157][ T826] usb 6-1: Using ep0 maxpacket: 16 [ 440.542836][ T826] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 440.597735][ T826] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 440.683440][T10080] netlink: zone id is out of range [ 440.689054][T10080] netlink: zone id is out of range [ 440.722358][T10080] netlink: set zone limit has 4 unknown bytes [ 440.794986][ T826] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 441.655603][ T826] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.622657][ T826] usb 6-1: Product: syz [ 444.652129][ T826] usb 6-1: Manufacturer: syz [ 444.656762][ T826] usb 6-1: SerialNumber: syz [ 445.226752][T10094] overlay: ./bus is not a directory [ 446.521473][ T826] usb 6-1: can't set config #1, error -71 [ 447.913989][ T826] usb 6-1: USB disconnect, device number 33 [ 448.652239][ T5866] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 448.674155][ T5818] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 448.843918][ T5866] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 450.601182][ T5866] usb 3-1: config 0 has no interface number 0 [ 450.867043][ T5818] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 451.253241][ T5818] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 451.272232][ T5866] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 451.321182][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.334063][ T5818] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 451.387611][ T5866] usb 3-1: Product: syz [ 451.450401][ T5864] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 451.485206][ T5818] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 451.514403][ T5866] usb 3-1: Manufacturer: syz [ 451.550322][ T5866] usb 3-1: SerialNumber: syz [ 451.659109][ T5818] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 451.692916][ T5866] usb 3-1: config 0 descriptor?? [ 451.752430][ T5866] usb 3-1: can't set config #0, error -71 [ 451.780769][ T5818] usb 4-1: string descriptor 0 read error: -71 [ 452.010297][ T5866] usb 3-1: USB disconnect, device number 29 [ 452.034534][ T5818] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 452.156728][ T5818] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 452.173733][ T5864] usb 6-1: device not accepting address 34, error -71 [ 452.342619][T10120] usb usb9: usbfs: interface 0 claimed by hub while 'syz.2.993' sets config #0 [ 452.391930][T10120] binder: BINDER_SET_CONTEXT_MGR already set [ 452.398109][T10120] binder: 10117:10120 ioctl 4018620d 200000000040 returned -16 [ 452.735350][ T5818] usb 4-1: can't set config #1, error -71 [ 466.987731][ C1] sched: DL replenish lagged too much [ 467.002183][ T5818] usb 4-1: USB disconnect, device number 35 [ 474.612223][T10130] netlink: zone id is out of range [ 474.618092][T10130] netlink: zone id is out of range [ 474.624292][T10130] netlink: zone id is out of range [ 474.643960][T10130] netlink: set zone limit has 4 unknown bytes [ 492.559764][ T5817] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 492.569603][ T5817] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 492.578383][ T5817] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 492.586634][ T5817] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 492.594523][ T5817] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 493.070748][ T5125] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 493.096602][ T5825] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 493.132133][ T5825] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 493.141540][ T5825] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 493.153037][ T5825] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 494.106080][ T5125] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 494.128119][ T5825] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 494.136977][ T5825] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 494.145931][ T5825] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 494.226979][ T5825] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 494.282139][ T5822] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 494.294487][ T5822] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 494.303242][ T5125] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 494.328784][ T5822] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 494.350753][ T5822] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 494.359929][ T5822] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 494.368588][ T5822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 494.379087][ T5822] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 494.389192][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 494.398226][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 495.485489][ T5822] Bluetooth: hci1: command tx timeout [ 496.487910][ T5822] Bluetooth: hci4: command tx timeout [ 496.494226][ T5822] Bluetooth: hci0: command tx timeout [ 496.500169][ T5822] Bluetooth: hci2: command tx timeout [ 496.510579][ T5825] Bluetooth: hci5: command tx timeout [ 497.114006][T10118] syz_tun (unregistering): left promiscuous mode [ 497.542261][ T5825] Bluetooth: hci1: command tx timeout [ 497.698071][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.749190][T10161] lo speed is unknown, defaulting to 1000 [ 497.780063][T10156] lo speed is unknown, defaulting to 1000 [ 497.813143][T10149] lo speed is unknown, defaulting to 1000 [ 497.936447][T10155] lo speed is unknown, defaulting to 1000 [ 498.007466][T10160] lo speed is unknown, defaulting to 1000 [ 498.471117][T10156] chnl_net:caif_netlink_parms(): no params data found [ 498.521345][T10161] chnl_net:caif_netlink_parms(): no params data found [ 498.585460][ T5825] Bluetooth: hci5: command tx timeout [ 498.590890][ T5825] Bluetooth: hci2: command tx timeout [ 498.596646][ T5822] Bluetooth: hci0: command tx timeout [ 498.606791][ T5817] Bluetooth: hci4: command tx timeout [ 498.803768][T10149] chnl_net:caif_netlink_parms(): no params data found [ 498.997614][T10155] chnl_net:caif_netlink_parms(): no params data found [ 499.286196][T10160] chnl_net:caif_netlink_parms(): no params data found [ 499.433785][T10156] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.440925][T10156] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.467528][T10156] bridge_slave_0: entered allmulticast mode [ 499.507925][T10156] bridge_slave_0: entered promiscuous mode [ 499.529754][T10156] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.544648][T10156] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.569116][T10156] bridge_slave_1: entered allmulticast mode [ 499.596335][T10156] bridge_slave_1: entered promiscuous mode [ 499.622227][ T5825] Bluetooth: hci1: command tx timeout [ 499.799603][T10161] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.815645][T10161] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.853765][T10161] bridge_slave_0: entered allmulticast mode [ 499.864779][T10161] bridge_slave_0: entered promiscuous mode [ 500.179635][T10156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 500.218173][T10161] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.226903][T10161] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.234421][T10161] bridge_slave_1: entered allmulticast mode [ 500.243212][T10161] bridge_slave_1: entered promiscuous mode [ 500.250102][T10149] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.257900][T10149] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.271734][T10149] bridge_slave_0: entered allmulticast mode [ 500.281595][T10149] bridge_slave_0: entered promiscuous mode [ 500.331207][T10156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 500.372677][T10149] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.381708][T10149] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.391894][T10149] bridge_slave_1: entered allmulticast mode [ 500.408028][T10149] bridge_slave_1: entered promiscuous mode [ 500.471318][T10155] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.479156][T10155] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.493405][T10155] bridge_slave_0: entered allmulticast mode [ 500.501763][T10155] bridge_slave_0: entered promiscuous mode [ 500.633190][T10155] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.641339][T10155] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.656139][T10155] bridge_slave_1: entered allmulticast mode [ 500.662321][ T5125] Bluetooth: hci4: command tx timeout [ 500.668926][ T5817] Bluetooth: hci0: command tx timeout [ 500.675018][ T5125] Bluetooth: hci5: command tx timeout [ 500.680559][ T5825] Bluetooth: hci2: command tx timeout [ 500.688159][T10155] bridge_slave_1: entered promiscuous mode [ 500.698982][T10156] team0: Port device team_slave_0 added [ 500.707883][T10161] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 500.720730][T10161] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 500.734600][T10149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 500.747198][T10149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 500.865040][T10156] team0: Port device team_slave_1 added [ 501.069563][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.093170][T10149] team0: Port device team_slave_0 added [ 501.099489][T10160] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.117933][T10160] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.127679][T10160] bridge_slave_0: entered allmulticast mode [ 501.140835][T10160] bridge_slave_0: entered promiscuous mode [ 501.182329][T10155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 501.225660][T10156] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 501.237837][T10156] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 501.271745][T10156] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 501.319304][T10161] team0: Port device team_slave_0 added [ 501.337654][T10149] team0: Port device team_slave_1 added [ 501.347051][T10160] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.354875][T10160] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.362562][T10160] bridge_slave_1: entered allmulticast mode [ 501.374561][T10160] bridge_slave_1: entered promiscuous mode [ 501.384989][T10155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 501.418594][T10156] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 501.426135][T10156] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 501.466517][T10156] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 501.483645][T10161] team0: Port device team_slave_1 added [ 501.579278][T10155] team0: Port device team_slave_0 added [ 501.702944][T10226] Bluetooth: hci1: command tx timeout [ 501.747880][T10160] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 501.765269][T10155] team0: Port device team_slave_1 added [ 501.825406][T10161] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 501.836642][T10161] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 501.912194][T10161] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 501.935343][T10149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 501.948072][T10149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 501.980596][T10149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 501.999942][T10149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 502.009959][T10149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.044940][T10149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 502.062646][T10160] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.139851][T10161] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 502.150893][T10161] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.195740][T10161] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 502.336984][T10155] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 502.352148][T10155] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.386341][T10155] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 502.441259][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.475191][T10156] hsr_slave_0: entered promiscuous mode [ 502.481733][T10156] hsr_slave_1: entered promiscuous mode [ 502.496877][T10156] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 502.507651][T10156] Cannot create hsr debugfs directory [ 502.561804][T10160] team0: Port device team_slave_0 added [ 502.578372][T10160] team0: Port device team_slave_1 added [ 502.588181][T10155] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 502.606847][T10155] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 502.640215][T10155] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 502.674766][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.742262][T10226] Bluetooth: hci2: command tx timeout [ 502.747707][T10226] Bluetooth: hci0: command tx timeout [ 502.753308][ T5822] Bluetooth: hci5: command tx timeout [ 502.758703][ T5822] Bluetooth: hci4: command tx timeout [ 502.922500][ T12] bridge0: port 3(netdevsim0) entered disabled state [ 502.969206][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 502.982749][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): left promiscuous mode [ 502.993059][ T12] bridge0: port 3(netdevsim0) entered disabled state [ 503.017373][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.059062][T10149] hsr_slave_0: entered promiscuous mode [ 503.083186][T10149] hsr_slave_1: entered promiscuous mode [ 503.089499][T10149] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 503.106936][T10149] Cannot create hsr debugfs directory [ 503.114867][T10160] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 503.121823][T10160] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.161998][T10160] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 503.309981][T10160] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 503.319601][T10160] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.354412][T10160] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 503.466475][T10155] hsr_slave_0: entered promiscuous mode [ 503.486801][T10155] hsr_slave_1: entered promiscuous mode [ 503.497513][T10155] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 503.505994][T10155] Cannot create hsr debugfs directory [ 503.526610][T10161] hsr_slave_0: entered promiscuous mode [ 503.550425][T10161] hsr_slave_1: entered promiscuous mode [ 503.561373][T10161] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 503.569375][T10161] Cannot create hsr debugfs directory [ 504.158193][T10160] hsr_slave_0: entered promiscuous mode [ 504.186905][T10160] hsr_slave_1: entered promiscuous mode [ 504.206682][T10160] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 504.216005][T10160] Cannot create hsr debugfs directory [ 504.512579][ T12] bridge_slave_1: left allmulticast mode [ 504.518254][ T12] bridge_slave_1: left promiscuous mode [ 504.540782][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 504.577062][ T12] bridge_slave_0: left allmulticast mode [ 504.586997][ T12] bridge_slave_0: left promiscuous mode [ 504.602726][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.792585][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 505.851842][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 505.875993][ T12] bond0 (unregistering): Released all slaves [ 505.891689][ T12] bond1 (unregistering): Released all slaves [ 506.361481][T10156] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 506.528924][T10156] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 506.541930][T10156] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 506.638367][ T12] hsr_slave_0: left promiscuous mode [ 506.650406][ T12] hsr_slave_1: left promiscuous mode [ 506.662930][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 506.670391][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 506.706309][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 506.724686][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 506.784564][ T12] veth1_macvtap: left promiscuous mode [ 506.790119][ T12] veth0_macvtap: left promiscuous mode [ 506.802507][ T12] veth1_vlan: left promiscuous mode [ 506.807829][ T12] veth0_vlan: left promiscuous mode [ 508.071940][ T12] team0 (unregistering): Port device team_slave_1 removed [ 508.154071][ T12] team0 (unregistering): Port device C removed [ 509.012175][T10156] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 509.306769][T10149] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 509.358786][T10149] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 509.487183][T10149] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 509.569730][T10149] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 509.729356][T10156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.803151][T10161] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 509.988812][T10161] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 510.038652][T10156] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.077074][ T1142] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.084235][ T1142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 510.251485][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.258657][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 510.340717][T10161] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 510.576955][T10161] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 510.748396][T10149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.756854][T10155] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 510.767858][T10155] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 510.860464][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.014885][T10155] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 511.029595][T10155] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 511.214894][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.356040][T10149] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.409273][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.516718][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): left allmulticast mode [ 511.527639][ T12] bridge0: port 3(netdevsim0) entered disabled state [ 511.538800][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.556745][ T8808] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.563861][ T8808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.606284][T10161] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.624760][ T8813] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.631841][ T8813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.659791][T10156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 511.759534][T10161] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.938957][ T8813] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.946129][ T8813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 512.036538][ T8810] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.043710][ T8810] bridge0: port 2(bridge_slave_1) entered forwarding state [ 512.105423][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.162746][T10160] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 512.175492][T10160] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 512.236512][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.276766][T10160] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 512.311620][T10160] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 512.395422][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.449829][T10155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 512.523574][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.560831][T10161] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 512.640222][T10149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 512.680036][T10155] 8021q: adding VLAN 0 to HW filter on device team0 [ 512.719161][T10156] veth0_vlan: entered promiscuous mode [ 512.748511][ T1142] bridge0: port 1(bridge_slave_0) entered blocking state [ 512.755666][ T1142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 512.821506][T10156] veth1_vlan: entered promiscuous mode [ 512.851661][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.858833][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 513.046256][T10161] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 513.116909][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.204552][T10156] veth0_macvtap: entered promiscuous mode [ 513.278396][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.305320][T10160] 8021q: adding VLAN 0 to HW filter on device bond0 [ 513.325671][T10156] veth1_macvtap: entered promiscuous mode [ 513.367362][T10160] 8021q: adding VLAN 0 to HW filter on device team0 [ 513.468571][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.516144][ T8813] bridge0: port 1(bridge_slave_0) entered blocking state [ 513.523311][ T8813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 513.577126][T10156] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 513.618509][ T12] bridge0: port 4(netdevsim0) entered disabled state [ 513.665849][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): left allmulticast mode [ 513.694657][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): left promiscuous mode [ 513.710057][ T12] bridge0: port 4(netdevsim0) entered disabled state [ 513.721756][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.742989][ T8813] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.750171][ T8813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 513.775477][T10149] veth0_vlan: entered promiscuous mode [ 513.798061][T10156] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 513.815716][T10149] veth1_vlan: entered promiscuous mode [ 513.839259][T10155] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 513.853599][T10156] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.868489][T10156] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.877269][T10156] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.886053][T10156] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.027418][T10149] veth0_macvtap: entered promiscuous mode [ 514.041379][T10149] veth1_macvtap: entered promiscuous mode [ 514.178974][T10149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 514.241397][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.266903][T10149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 514.288886][T10161] veth0_vlan: entered promiscuous mode [ 514.325799][T10149] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.344689][T10149] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.358196][T10149] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.367134][T10149] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.423912][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.441944][T10161] veth1_vlan: entered promiscuous mode [ 514.486701][ T8810] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.498324][ T8810] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.541766][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.609671][ T12] bridge0: port 3(netdevsim0) entered disabled state [ 514.630532][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): left allmulticast mode [ 514.639601][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): left promiscuous mode [ 514.653170][ T12] bridge0: port 3(netdevsim0) entered disabled state [ 514.671290][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.728734][T10160] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 514.756952][T10155] veth0_vlan: entered promiscuous mode [ 514.794710][ T8813] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.808022][ T8813] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.846332][T10155] veth1_vlan: entered promiscuous mode [ 514.868548][T10161] veth0_macvtap: entered promiscuous mode [ 514.900435][ T3565] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.913928][ T30] audit: type=1400 audit(1748311423.306:803): avc: denied { mounton } for pid=10156 comm="syz-executor" path="/root/syzkaller.u2QNk3/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=29236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 514.925597][ T3565] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.978444][ T8813] ================================================================== [ 514.986532][ T8813] BUG: KASAN: global-out-of-bounds in fib6_add+0x3ced/0x4b60 [ 514.992615][ T30] audit: type=1400 audit(1748311423.356:804): avc: denied { mount } for pid=10156 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 514.993881][ T8813] Read of size 4 at addr ffffffff9af9f590 by task kworker/u8:19/8813 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 515.016814][ T30] audit: type=1400 audit(1748311423.376:805): avc: denied { mounton } for pid=10156 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 515.024387][ T8813] [ 515.024399][ T8813] CPU: 0 UID: 0 PID: 8813 Comm: kworker/u8:19 Not tainted 6.15.0-syzkaller #0 PREEMPT(full) [ 515.024419][ T8813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 515.024430][ T8813] Workqueue: events_unbound linkwatch_event [ 515.024458][ T8813] Call Trace: [ 515.024465][ T8813] [ 515.024471][ T8813] dump_stack_lvl+0x116/0x1f0 [ 515.024498][ T8813] print_report+0xc3/0x670 [ 515.024515][ T8813] ? __virt_addr_valid+0x5e/0x590 [ 515.024537][ T8813] ? __phys_addr+0xc6/0x150 [ 515.024558][ T8813] ? fib6_add+0x3ced/0x4b60 [ 515.024574][ T8813] kasan_report+0xe0/0x110 [ 515.024590][ T8813] ? fib6_add+0x3ced/0x4b60 [ 515.024609][ T8813] fib6_add+0x3ced/0x4b60 [ 515.024631][ T8813] ? __pfx_fib6_add+0x10/0x10 [ 515.024646][ T8813] ? do_raw_spin_lock+0x12c/0x2b0 [ 515.024663][ T8813] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 515.024683][ T8813] ? ip6_route_add+0x8d/0x1c0 [ 515.024702][ T8813] ip6_route_add+0x8d/0x1c0 [ 515.024724][ T8813] addrconf_prefix_route+0x2fd/0x510 [ 515.024740][ T8813] ? __pfx_addrconf_prefix_route+0x10/0x10 [ 515.024754][ T8813] ? atomic_notifier_call_chain+0xa8/0x1c0 [ 515.024784][ T8813] ? __local_bh_enable_ip+0xa4/0x120 [ 515.024803][ T8813] ? lockdep_hardirqs_on+0x7c/0x110 [ 515.024823][ T8813] ? ip6_route_add+0x97/0x1c0 [ 515.024845][ T8813] addrconf_add_linklocal+0x329/0x500 [ 515.024863][ T8813] ? __pfx_addrconf_add_linklocal+0x10/0x10 [ 515.024883][ T8813] ? __asan_memcpy+0x3c/0x60 [ 515.024909][ T8813] addrconf_addr_gen+0x36d/0x3c0 [ 515.024926][ T8813] ? __pfx_addrconf_addr_gen+0x10/0x10 [ 515.024946][ T8813] ? addrconf_init_auto_addrs+0x4b9/0x8f0 [ 515.024963][ T8813] addrconf_init_auto_addrs+0x4b9/0x8f0 [ 515.024980][ T8813] addrconf_notify+0x6e2/0x19e0 [ 515.025000][ T8813] ? ip6mr_device_event+0x1bc/0x230 [ 515.025023][ T8813] notifier_call_chain+0xbc/0x410 [ 515.025043][ T8813] ? __pfx_addrconf_notify+0x10/0x10 [ 515.025064][ T8813] call_netdevice_notifiers_info+0xbe/0x140 [ 515.025087][ T8813] netif_state_change+0x165/0x3b0 [ 515.025107][ T8813] ? __pfx_netif_state_change+0x10/0x10 [ 515.025128][ T8813] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 515.025146][ T8813] linkwatch_do_dev+0x12b/0x160 [ 515.025167][ T8813] __linkwatch_run_queue+0x2aa/0x8a0 [ 515.025190][ T8813] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 515.025215][ T8813] linkwatch_event+0x8f/0xc0 [ 515.025235][ T8813] ? __pfx_linkwatch_event+0x10/0x10 [ 515.025256][ T8813] ? rcu_is_watching+0x12/0xc0 [ 515.025274][ T8813] process_one_work+0x9cf/0x1b70 [ 515.025294][ T8813] ? __pfx_update_gid_event_work_handler+0x10/0x10 [ 515.025315][ T8813] ? __pfx_process_one_work+0x10/0x10 [ 515.025335][ T8813] ? assign_work+0x1a0/0x250 [ 515.025350][ T8813] worker_thread+0x6c8/0xf10 [ 515.025371][ T8813] ? __pfx_worker_thread+0x10/0x10 [ 515.025387][ T8813] kthread+0x3c2/0x780 [ 515.025402][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025415][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025429][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025442][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025456][ T8813] ? rcu_is_watching+0x12/0xc0 [ 515.025473][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025488][ T8813] ret_from_fork+0x45/0x80 [ 515.025503][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.025517][ T8813] ret_from_fork_asm+0x1a/0x30 [ 515.025544][ T8813] [ 515.025550][ T8813] [ 515.366715][ T8813] The buggy address belongs to the variable: [ 515.372687][ T8813] __key.0+0x10/0x40 [ 515.376581][ T8813] [ 515.378888][ T8813] The buggy address belongs to the physical page: [ 515.385277][ T8813] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af9f [ 515.394023][ T8813] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 515.401908][ T8813] raw: 00fff00000002000 ffffea00006be7c8 ffffea00006be7c8 0000000000000000 [ 515.410473][ T8813] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 515.419034][ T8813] page dumped because: kasan: bad access detected [ 515.425420][ T8813] page_owner info is not present (never set?) [ 515.431459][ T8813] [ 515.433762][ T8813] Memory state around the buggy address: [ 515.439378][ T8813] ffffffff9af9f480: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 [ 515.447419][ T8813] ffffffff9af9f500: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 [ 515.455459][ T8813] >ffffffff9af9f580: 00 00 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 [ 515.463506][ T8813] ^ [ 515.468071][ T8813] ffffffff9af9f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 [ 515.476110][ T8813] ffffffff9af9f680: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 [ 515.484149][ T8813] ================================================================== [ 515.492254][ T8813] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 515.499447][ T8813] CPU: 0 UID: 0 PID: 8813 Comm: kworker/u8:19 Not tainted 6.15.0-syzkaller #0 PREEMPT(full) [ 515.509608][ T8813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 515.519670][ T8813] Workqueue: events_unbound linkwatch_event [ 515.525565][ T8813] Call Trace: [ 515.528825][ T8813] [ 515.531740][ T8813] dump_stack_lvl+0x3d/0x1f0 [ 515.536323][ T8813] panic+0x71c/0x800 [ 515.540228][ T8813] ? __pfx_panic+0x10/0x10 [ 515.544644][ T8813] ? mark_held_locks+0x49/0x80 [ 515.549400][ T8813] ? fib6_add+0x3ced/0x4b60 [ 515.553893][ T8813] ? check_panic_on_warn+0x1f/0xb0 [ 515.558985][ T8813] ? fib6_add+0x3ced/0x4b60 [ 515.563468][ T8813] check_panic_on_warn+0xab/0xb0 [ 515.568386][ T8813] end_report+0x107/0x170 [ 515.572715][ T8813] kasan_report+0xee/0x110 [ 515.577122][ T8813] ? fib6_add+0x3ced/0x4b60 [ 515.581613][ T8813] fib6_add+0x3ced/0x4b60 [ 515.585932][ T8813] ? __pfx_fib6_add+0x10/0x10 [ 515.590595][ T8813] ? do_raw_spin_lock+0x12c/0x2b0 [ 515.595606][ T8813] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 515.600965][ T8813] ? ip6_route_add+0x8d/0x1c0 [ 515.605648][ T8813] ip6_route_add+0x8d/0x1c0 [ 515.610154][ T8813] addrconf_prefix_route+0x2fd/0x510 [ 515.615431][ T8813] ? __pfx_addrconf_prefix_route+0x10/0x10 [ 515.621217][ T8813] ? atomic_notifier_call_chain+0xa8/0x1c0 [ 515.627022][ T8813] ? __local_bh_enable_ip+0xa4/0x120 [ 515.632302][ T8813] ? lockdep_hardirqs_on+0x7c/0x110 [ 515.637489][ T8813] ? ip6_route_add+0x97/0x1c0 [ 515.642154][ T8813] addrconf_add_linklocal+0x329/0x500 [ 515.647510][ T8813] ? __pfx_addrconf_add_linklocal+0x10/0x10 [ 515.653388][ T8813] ? __asan_memcpy+0x3c/0x60 [ 515.657969][ T8813] addrconf_addr_gen+0x36d/0x3c0 [ 515.662892][ T8813] ? __pfx_addrconf_addr_gen+0x10/0x10 [ 515.668343][ T8813] ? addrconf_init_auto_addrs+0x4b9/0x8f0 [ 515.674045][ T8813] addrconf_init_auto_addrs+0x4b9/0x8f0 [ 515.679573][ T8813] addrconf_notify+0x6e2/0x19e0 [ 515.684410][ T8813] ? ip6mr_device_event+0x1bc/0x230 [ 515.689599][ T8813] notifier_call_chain+0xbc/0x410 [ 515.694611][ T8813] ? __pfx_addrconf_notify+0x10/0x10 [ 515.699888][ T8813] call_netdevice_notifiers_info+0xbe/0x140 [ 515.705776][ T8813] netif_state_change+0x165/0x3b0 [ 515.710792][ T8813] ? __pfx_netif_state_change+0x10/0x10 [ 515.716326][ T8813] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 515.722203][ T8813] linkwatch_do_dev+0x12b/0x160 [ 515.727043][ T8813] __linkwatch_run_queue+0x2aa/0x8a0 [ 515.732321][ T8813] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 515.738116][ T8813] linkwatch_event+0x8f/0xc0 [ 515.742694][ T8813] ? __pfx_linkwatch_event+0x10/0x10 [ 515.747968][ T8813] ? rcu_is_watching+0x12/0xc0 [ 515.752716][ T8813] process_one_work+0x9cf/0x1b70 [ 515.757641][ T8813] ? __pfx_update_gid_event_work_handler+0x10/0x10 [ 515.764137][ T8813] ? __pfx_process_one_work+0x10/0x10 [ 515.769494][ T8813] ? assign_work+0x1a0/0x250 [ 515.774076][ T8813] worker_thread+0x6c8/0xf10 [ 515.778654][ T8813] ? __pfx_worker_thread+0x10/0x10 [ 515.783754][ T8813] kthread+0x3c2/0x780 [ 515.787809][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.792379][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.796950][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.801605][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.806176][ T8813] ? rcu_is_watching+0x12/0xc0 [ 515.810925][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.815500][ T8813] ret_from_fork+0x45/0x80 [ 515.819902][ T8813] ? __pfx_kthread+0x10/0x10 [ 515.824473][ T8813] ret_from_fork_asm+0x1a/0x30 [ 515.829232][ T8813] [ 515.832482][ T8813] Kernel Offset: disabled [ 515.836793][ T8813] Rebooting in 86400 seconds..