last executing test programs: 8m12.862189022s ago: executing program 4 (id=361): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x4010, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r2, &(0x7f0000000240)=""/102392, 0x18ff8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000019240)={@rand_addr=' \x01\x00', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, &(0x7f0000019280)=0x5, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000192c0)={0xa, 0x0, 0x380000, @loopback}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000019300)={@loopback, 0x800, 0x1}, 0x20) keyctl$instantiate(0xc, 0x0, &(0x7f0000019340)=ANY=[@ANYBLOB='new default user:s'], 0x2a, 0x0) pipe(&(0x7f0000019380)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000193c0)=[{&(0x7f0000019400)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10000008ebc, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x25a5, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000080)) mlock(&(0x7f0000520000/0x1000)=nil, 0x1000) 8m11.891148183s ago: executing program 4 (id=363): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r2, &(0x7f0000000780)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000019780)=0x7) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r5, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r4}, 0x20) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r8, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r9, r8, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r6}, &(0x7f0000019b00), &(0x7f0000019b40)=r3}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r10 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r10, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r11) 8m9.622725674s ago: executing program 4 (id=367): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x9000, &(0x7f0000000040)={0x8, 0x8a, 0x20000}, 0x20) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9, 0xa}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000018000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x80000}, 0xc4) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x8c00, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs2/binder1\x00', 0x1807, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000500)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000005c0)}) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) capset(&(0x7f00000006c0)={0x20080522}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000700)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="0700000000000000000000000c0000000c00000002000000000000"], &(0x7f0000000880)=""/226, 0x26, 0xe2, 0x2}, 0x28) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000980), 0x9) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000009c0), 0x2c2, 0x0) write$dsp(r6, &(0x7f0000000a00)='F', 0x1) 8m6.671942557s ago: executing program 4 (id=371): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000940)={@multicast2, @loopback}, 0xc) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18}]}, {0x4}, {0xc}, {0xfffffffffffffd7f, 0x8, {0x1}}}}]}]}, 0x70}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'macvlan1\x00', 0x0}) bind$packet(r3, &(0x7f0000000040)={0x11, 0x1, r5, 0x1, 0xf6}, 0x14) write(r3, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000980)={'lo\x00'}) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f00000009c0)={@multicast2, @loopback}, 0x64) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000a00)=ANY=[@ANYBLOB="e00000027f0000010000000003"], 0x1c) close(r0) 8m2.401287179s ago: executing program 4 (id=376): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r2, &(0x7f0000000780)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000019780)=0x7) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r5, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r4}, 0x20) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r8, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r9, r8, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r6}, &(0x7f0000019b00), &(0x7f0000019b40)=r3}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r10 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r10, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r11) 7m58.002528092s ago: executing program 4 (id=382): socket$phonet_pipe(0x23, 0x5, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4004800) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002380)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f00000023c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002540)={0x6, 0x3, &(0x7f0000002600)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) pselect6(0x40, &(0x7f0000002640)={0x9, 0xffffffffffff7fff, 0xa38, 0xdd43, 0x2, 0x800, 0x4a, 0x5}, 0x0, 0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002680)={0x6, 0x3, &(0x7f0000002740)=ANY=[], &(0x7f0000002780)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r3, 0x5, 0xb68, 0x0, &(0x7f0000002840)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r2, &(0x7f0000002880)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv4/vs/est_cpulist\x00', 0x2, 0x0) read$FUSE(r4, &(0x7f0000000340)={0x2020}, 0x2020) open_by_handle_at(0xffffffffffffffff, 0x0, 0x28000) read$FUSE(r4, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000024c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000002500)={'wlan1\x00', &(0x7f00000030c0)=@ethtool_ringparam={0x10, 0xfffffff8, 0x5, 0x1, 0xfffffff8, 0x8, 0x1, 0x3, 0x9}}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000040)={0x0, 0x500, &(0x7f0000000080)={&(0x7f00000000c0)={0x28, r6, 0x9c3fa077fa966179, 0x20, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) 7m42.299278529s ago: executing program 32 (id=382): socket$phonet_pipe(0x23, 0x5, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4004800) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002380)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f00000023c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002540)={0x6, 0x3, &(0x7f0000002600)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) pselect6(0x40, &(0x7f0000002640)={0x9, 0xffffffffffff7fff, 0xa38, 0xdd43, 0x2, 0x800, 0x4a, 0x5}, 0x0, 0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002680)={0x6, 0x3, &(0x7f0000002740)=ANY=[], &(0x7f0000002780)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r3, 0x5, 0xb68, 0x0, &(0x7f0000002840)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r2, &(0x7f0000002880)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv4/vs/est_cpulist\x00', 0x2, 0x0) read$FUSE(r4, &(0x7f0000000340)={0x2020}, 0x2020) open_by_handle_at(0xffffffffffffffff, 0x0, 0x28000) read$FUSE(r4, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000024c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000002500)={'wlan1\x00', &(0x7f00000030c0)=@ethtool_ringparam={0x10, 0xfffffff8, 0x5, 0x1, 0xfffffff8, 0x8, 0x1, 0x3, 0x9}}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000040)={0x0, 0x500, &(0x7f0000000080)={&(0x7f00000000c0)={0x28, r6, 0x9c3fa077fa966179, 0x20, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) 27.345492834s ago: executing program 3 (id=1158): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r3, &(0x7f0000000780)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r6, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r5}, 0x20) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r9, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r10, r9, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r7}, &(0x7f0000019b00), &(0x7f0000019b40)=r4}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r11 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r11, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) 25.974401157s ago: executing program 3 (id=1161): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r3, &(0x7f0000000780)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000019780)=0x7) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r6, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r5}, 0x20) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r9, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r10, r9, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r7}, &(0x7f0000019b00), &(0x7f0000019b40)=r4}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r11 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r11, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r12) 21.649436836s ago: executing program 5 (id=1170): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x5) r0 = epoll_create1(0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x400, 0x0) (fail_nth: 7) r1 = landlock_create_ruleset(&(0x7f0000005980)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) bind$unix(0xffffffffffffffff, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x100000000000000) 19.908921579s ago: executing program 3 (id=1173): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000340)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000ac0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000100)={0x28, 0x2, r5, 0x0, &(0x7f0000000000/0x400000)=nil, 0x400000, 0x7ffffffe}) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000090400206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x18000000000002a0, 0x8, 0x0, &(0x7f0000000580)="b9ff03316844268c", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_usb_control_io(r7, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x1000, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0e000000040000"], 0x50) r8 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000980)={r9}, 0xc) ioctl$IOMMU_HWPT_ALLOC$TEST(r4, 0x3b89, &(0x7f0000000140)={0x28, 0x0, r6, r5, 0x0, 0x0, 0xdead, 0x4, &(0x7f00000001c0)}) r11 = memfd_secret(0x80000) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYRESDEC=r6, @ANYRESDEC=r10, @ANYRESOCT=r10, @ANYRESOCT=r10, @ANYRES32=r5, @ANYRES64=r11, @ANYRES16, @ANYRESHEX=r10], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000005) 19.490248317s ago: executing program 5 (id=1175): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r5, &(0x7f0000000b00)=""/102392, 0x18ff8) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000019b00), 0x802, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000019b40)={0x3f}) timer_getoverrun(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x3) write$uinput_user_dev(r6, &(0x7f0000019b80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf51, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7fffffff], [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x0, 0x0, 0x6], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2]}, 0x45c) r7 = openat$binfmt_format(0xffffff9c, &(0x7f000001a000)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) write$binfmt_format(r7, &(0x7f000001a040)='-1\x00', 0x2) ioctl$UI_DEV_CREATE(r6, 0x5501) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f000001a080)={0x0, 0x0, &(0x7f000001a0c0)={&(0x7f000001a100)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010000000000000000001d00000020000180140002006e657464657673696d30000000000000080003"], 0x34}}, 0x44800) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r8) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0) 18.493820247s ago: executing program 5 (id=1176): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x4047c000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000007c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000197c0)=0x7) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x16f) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, 0x0, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f00000198c0)='./file0\x00', 0x0) socket$l2tp6(0xa, 0x2, 0x73) (fail_nth: 2) mount(&(0x7f0000019900)=@filename='mtd0\x00', &(0x7f0000019940)='./dev\x00', 0x0, 0x800000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000680)='./mnt\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000780)='./mnt\x00', 0x0, 0x1840022, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) 15.44795369s ago: executing program 2 (id=1182): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0xc4206000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getrlimit(0xa, &(0x7f0000000300)) connect$unix(r0, &(0x7f0000000280)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@base={0xf, 0x4, 0x4, 0x16, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) mkdir(&(0x7f0000000080)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/trace_options\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='raw', 0x3) 14.484672051s ago: executing program 3 (id=1184): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r3, &(0x7f0000000780)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000019780)=0x7) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r6, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r5}, 0x20) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r9, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r10, r9, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r7}, &(0x7f0000019b00), &(0x7f0000019b40)=r4}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r11 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r11, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r12) 12.624004356s ago: executing program 2 (id=1186): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) rename(&(0x7f00000001c0)='./file0/file0\x00', 0x0) r2 = socket(0x15, 0x5, 0x0) connect$unix(r2, &(0x7f0000002840)=@abs={0xa}, 0x6e) getsockname(r2, 0x0, &(0x7f00000028c0)) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x23, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r3, 0x1, 0x3}, 0x50) add_key(0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500), &(0x7f0000000700), 0x407f, r4, 0x4}, 0x38) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000680)={r0, r0, 0x2f, 0x0, @void}, 0x10) mq_open(&(0x7f0000000040)='#]#*\x00', 0x40, 0x2, 0x0) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000740)={0x9, [0x200, 0x8, 0x7f, 0x6, 0x5, 0x8, 0x40, 0x7ff, 0x8001]}, 0x16) recvmmsg(r6, &(0x7f0000002740)=[{{&(0x7f0000000780)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000800)=""/162, 0xa2}, {&(0x7f00000008c0)=""/17, 0x11}, {&(0x7f0000000900)=""/38, 0x26}, {&(0x7f0000000940)=""/137, 0x89}, {&(0x7f0000000a00)=""/245, 0xf5}, {&(0x7f0000000b00)=""/16, 0x10}, {&(0x7f0000000b40)=""/142, 0x8e}, {&(0x7f0000000c00)=""/189, 0xbd}], 0x8}, 0x21fcd4}, {{&(0x7f0000000d40)=@in={0x2, 0x0, @private}, 0x80, &(0x7f0000001300)=[{&(0x7f0000000dc0)=""/32, 0x20}, {&(0x7f0000000e00)=""/48, 0x30}, {&(0x7f0000000e40)=""/201, 0xc9}, {&(0x7f0000000f40)=""/80, 0x50}, {&(0x7f0000000fc0)=""/31, 0x1f}, {&(0x7f0000001000)=""/205, 0xcd}, {&(0x7f0000001100)=""/146, 0x92}, {&(0x7f00000011c0)=""/35, 0x23}, {&(0x7f0000001200)=""/241, 0xf1}], 0x9, &(0x7f00000013c0)=""/248, 0xf8}, 0x6fca24bc}, {{&(0x7f00000014c0)=@alg, 0x80, &(0x7f0000002700)=[{&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/198, 0xc6}, {&(0x7f0000002640)=""/58, 0x3a}, {&(0x7f0000002680)=""/118, 0x76}], 0x4}, 0xb9}], 0x3, 0x100, &(0x7f0000002800)) pselect6(0x900, 0x0, 0x0, &(0x7f00000000c0)={0x1f}, &(0x7f0000000100)={0x0, 0x3938700}, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002900)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002940)={@private0, 0xffa4, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002980)={@initdev={0xfe, 0x88, '\x00', 0xde, 0x0}, 0x800, 0x1, 0xff, 0x2, 0x0, 0x100}, 0x20) ioctl(r7, 0x3b8f, &(0x7f0000000700)='(\x00\x00') bpf$LINK_DETACH(0x22, &(0x7f00000006c0)=r5, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r5, r0, 0x4, r0}, 0x10) 10.404903915s ago: executing program 0 (id=1188): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) io_setup(0x6, &(0x7f0000000680)=0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x1, {0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}, 0x4}, r3}}, 0x38) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1) 10.095659461s ago: executing program 2 (id=1190): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) rename(&(0x7f00000001c0)='./file0/file0\x00', 0x0) r2 = socket(0x15, 0x5, 0x0) connect$unix(r2, &(0x7f0000002840)=@abs={0xa}, 0x6e) getsockname(r2, 0x0, &(0x7f00000028c0)) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x23, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r3, 0x1, 0x3}, 0x50) add_key(0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500), &(0x7f0000000700), 0x407f, r4, 0x4}, 0x38) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000680)={r0, r0, 0x2f, 0x0, @void}, 0x10) mq_open(&(0x7f0000000040)='#]#*\x00', 0x40, 0x2, 0x0) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000740)={0x9, [0x200, 0x8, 0x7f, 0x6, 0x5, 0x8, 0x40, 0x7ff, 0x8001]}, 0x16) recvmmsg(r6, &(0x7f0000002740)=[{{&(0x7f0000000780)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000800)=""/162, 0xa2}, {&(0x7f00000008c0)=""/17, 0x11}, {&(0x7f0000000900)=""/38, 0x26}, {&(0x7f0000000940)=""/137, 0x89}, {&(0x7f0000000a00)=""/245, 0xf5}, {&(0x7f0000000b00)=""/16, 0x10}, {&(0x7f0000000b40)=""/142, 0x8e}, {&(0x7f0000000c00)=""/189, 0xbd}], 0x8}, 0x21fcd4}, {{&(0x7f0000000d40)=@in={0x2, 0x0, @private}, 0x80, &(0x7f0000001300)=[{&(0x7f0000000dc0)=""/32, 0x20}, {&(0x7f0000000e00)=""/48, 0x30}, {&(0x7f0000000e40)=""/201, 0xc9}, {&(0x7f0000000f40)=""/80, 0x50}, {&(0x7f0000000fc0)=""/31, 0x1f}, {&(0x7f0000001000)=""/205, 0xcd}, {&(0x7f0000001100)=""/146, 0x92}, {&(0x7f00000011c0)=""/35, 0x23}, {&(0x7f0000001200)=""/241, 0xf1}], 0x9, &(0x7f00000013c0)=""/248, 0xf8}, 0x6fca24bc}, {{&(0x7f00000014c0)=@alg, 0x80, &(0x7f0000002700)=[{&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/198, 0xc6}, {&(0x7f0000002640)=""/58, 0x3a}, {&(0x7f0000002680)=""/118, 0x76}], 0x4}, 0xb9}], 0x3, 0x100, &(0x7f0000002800)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002900)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002940)={@private0, 0xffa4, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002980)={@initdev={0xfe, 0x88, '\x00', 0xde, 0x0}, 0x800, 0x1, 0xff, 0x2, 0x0, 0x100}, 0x20) ioctl(r7, 0x3b8f, &(0x7f0000000700)='(\x00\x00') bpf$LINK_DETACH(0x22, &(0x7f00000006c0)=r5, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r5, r0, 0x4, r0}, 0x10) 9.590619354s ago: executing program 5 (id=1191): mmap$IORING_OFF_SQ_RING(0x0, 0x25d1, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect(0x3, 0x40, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) setns(0xc9, 0x0) r1 = socket(0x8, 0x5, 0x7fff) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x38, &(0x7f0000000500)="900100"/56) ioctl$sock_SIOCOUTQNSD(r1, 0x4010618c, &(0x7f0000000540)) 8.01371085s ago: executing program 1 (id=1192): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000340)=0x5) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) epoll_create1(0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0) fanotify_init(0x200, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x143042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000844, &(0x7f00000001c0), 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x3d, 0x0, &(0x7f0000000200)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, 0x0, 0x1e5) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000680)={0x0, 0x5839, 0x0, 0x1, 0x7f}, &(0x7f0000000700)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2425, 0x8, 0x1000002, 0x311}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x4f4d208522887949, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x80000, 0x4003bfff, 0x69}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd183, 0x200, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 7.992870302s ago: executing program 2 (id=1193): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0xe, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x101, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x5, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf782, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x403, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'xfrm0\x00'}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000340), 0x2, 0x143102) writev(r4, &(0x7f0000000380)=[{&(0x7f00000003c0)="94", 0xf000}, {0x0}], 0x2) r5 = fsopen(&(0x7f0000000400)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000880)='nou ce\x8b\xa4S\x0f&\xc9\x8e\xbb\xa7\xe2\xc4H\xb3\x03\x1f\xbf\xfe\xd7\xcc\xf9\xd6\x92\xe0\x8d%\xcc\xb22/\x8bz\xe9y_\xacP\x14\x1f<\xeb\x17L{\xa2\xe9hU\xa8\xcd\x11\xe6,\x051\xce\a\xa5nh\xa6\xf9E!_\x82\"\xe1{\x87\x9c+\x18C\x85\x0eSx\xa24/\xf8\x8dgf\xff\x9c\x1e\xa0\xb0\xe4\xe8*\xd71\xeb\xdc\xffw0\xefA5\x10\x96\x92:#T\xf8\xf57\x12b8\x000\xd9Q\xfc\x172\xa9/\x1d\xf7\xa0\xee\x1c]G\xb33m\xaa\x9e68X', &(0x7f0000000480)='c:::\x00', 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000004c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xc}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x101, 0x8, 0x2}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x9}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x30, 0x2, [@TCA_U32_CLASSID={0x8}, @TCA_U32_SEL={0x24, 0x5, {0xc, 0x7, 0x41, 0x3d3f, 0x100, 0xfff, 0x3, 0x58f, [{0xebd, 0x5, 0x206, 0x7}]}}]}}]}, 0x5c}}, 0x24040084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x0, 0x0, 0x0) 7.926520362s ago: executing program 1 (id=1194): r0 = mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, 0x0, 0x2000007, 0x810, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000000)="aa9e38938520199b812bc0bada15ff955a622efc12ce4577", 0x0, 0x18) r1 = syz_open_dev$vbi(&(0x7f00000003c0), 0x1, 0x2) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000400)={0x0, 0x1, 0x0, r2, 0x0, &(0x7f0000000440)={0x9909d4, 0xffffbfff, '\x00', @string=&(0x7f0000000040)=0xa3}}) 7.920889919s ago: executing program 1 (id=1195): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r2, &(0x7f0000000780)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r5, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r4}, 0x20) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r8, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r9, r8, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r6}, &(0x7f0000019b00), &(0x7f0000019b40)=r3}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r10 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r10, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) 6.553796902s ago: executing program 1 (id=1196): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1e, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) symlink(&(0x7f0000000780)='.\x00', &(0x7f00000007c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000840)='./file0\x00', 0xffe, 0x0) landlock_create_ruleset(&(0x7f0000000880)={0x2001}, 0x18, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x202000, 0x13b) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000009c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00'}) ioctl$SNDCTL_DSP_SETTRIGGER(r4, 0x40045010, &(0x7f0000000a40)=0x9) socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x5, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000a80)=@v={0x93, 0x8, 0xb0, 0x1c, @generic=0xff, 0x6}) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000ac0)={{0x84, @private=0xa010101, 0x4e24, 0x3, 'lc\x00', 0x39ffc08b9a63492c, 0x8, 0x77}, {@private=0xa010102, 0x4e20, 0x4, 0x6310, 0x2}}, 0x44) lgetxattr(&(0x7f0000000b40)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000bc0)=@known='trusted.overlay.redirect\x00', &(0x7f0000000c00)=""/232, 0xe8) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r6, &(0x7f0000000d00)={0x1f, 0xfffe, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0xe) listen(r6, 0x0) clock_gettime(0x3, &(0x7f0000000d40)={0x0, 0x0}) setsockopt$sock_timeval(r6, 0x1, 0x14, &(0x7f0000000d80)={r7, r8/1000+60000}, 0x10) accept4(r6, 0x0, 0x0, 0x80000) syz_open_dev$hidraw(&(0x7f0000000dc0), 0x401, 0x80000) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000e00)=0x7) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r9, 0x3, 0x5004) 3.66646457s ago: executing program 3 (id=1197): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0xc4206000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getrlimit(0xa, &(0x7f0000000300)) connect$unix(r0, &(0x7f0000000280)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@base={0xf, 0x4, 0x4, 0x16, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) mkdir(&(0x7f0000000080)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/trace_options\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='raw', 0x3) 3.387708025s ago: executing program 2 (id=1198): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) landlock_create_ruleset(0x0, 0x0, 0x4000) sendmmsg$unix(r2, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000340), 0x10106, 0x2, 0x0) r3 = syz_open_dev$loop(&(0x7f00000003c0), 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000440)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c5500000000004000f0f9ffff0000000000ffff00", [0x80000000006, 0x6]}}) ioctl$LOOP_CHANGE_FD(r3, 0x4c03, r4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) ioctl$BLKPG(r5, 0x1269, &(0x7f0000000240)={0x1, 0x0, 0x98, &(0x7f0000000300)={0x4000300, 0x100000000800, 0x12}}) mount$afs(0x0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000680)=ANY=[]) 3.025316347s ago: executing program 0 (id=1199): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x14, &(0x7f0000000480)=@raw=[@generic={0xbf, 0x6, 0x1}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @generic={0xbf, 0x1, 0x6}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x3, 0x0, 0x0, 0xc}, @generic={0xb7, 0x4, 0x0, 0x0, 0xffffffff}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x54}, @generic={0x15, 0x0, 0x0, 0x2}, @generic={0xbf, 0x1}, @generic={0x85, 0x0, 0x0, 0x0, 0x56}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x0, 0xe, 0x0, &(0x7f0000000380)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.85186063s ago: executing program 0 (id=1200): r0 = epoll_create1(0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x400, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DONE(r1, 0x0, 0xc9, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000000060001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240080d0) r5 = landlock_create_ruleset(&(0x7f0000005980)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r5, 0xe) close_range(r0, 0xffffffffffffffff, 0x100000000000000) 2.611529823s ago: executing program 1 (id=1201): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000100)={0x0, 0x3291, 0x1000, 0x2, 0x158}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000280)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x3, 0x3b5, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000340)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000380)={0x0, 0x1, 0x0, 0x5, 0x255}, &(0x7f0000000400)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x800, 0x2100, 0x1e5, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x8026, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20000000, 0x240, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x2, 0x2, 0x301}}], 0x1, &(0x7f0000000680)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xd6286243dfe0735, '\x00', 0x0, @cgroup_sock=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) syz_pidfd_open(r2, 0x0) r11 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x163041, 0x0) write$FUSE_BMAP(r11, 0x0, 0x0) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000040)=r11, 0x4) setns(r11, 0x24020000) open_tree(0xffffffffffffff9c, &(0x7f0000000200)='\x00', 0x9902) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000c40)={{r10, &(0x7f00000000c0)='/dev/full\x00', 0x5c1801, &(0x7f00000007c0)={@_ha_fsid={[0x3, 0x5]}, {0x100, 0x8, 0x5, 0x5}}, 0x6, &(0x7f0000000800), &(0x7f0000000840)=0x5}, 0x4, &(0x7f0000000bc0)=[{0x3, 0xe3, &(0x7f0000000880)='(\x00', &(0x7f00000008c0)="19c2efc353bc29ef455af7842bcf9b7927fc9a2a8c14a9acfb9f9530730f8fd7b59e783ebeb7e276f8e2edb0a118c7c13eedc87c582b2a509efdefc3163e4e2b3e34a3289251eac3c2dd61dfd986fb93e1274e067450f6", 0x57, 0x2}, {0x1, 0x6, &(0x7f0000000940)='\x00', &(0x7f0000000980)="ed765e88cd365e5af9720376379faaa9d9846b56a1b4d836884f1f339aeb666ed1c23c8943f431890e3d8482b9ec0e6a8b2a38048d57d0e357f67a3c952194d42e7f35cce70d777718a8f049490212da2488cf1eef6eaaceb04ff267330e0c971bc9bad1c40c07ea787bf373435ea97cda1f5b11a5866080de0bde19bebcc75f0d7837267a5231236c8d51e4773b9a36dc9ee0", 0x93, 0x10}, {0x3, 0x32e, &(0x7f0000000a40)='\x00', &(0x7f0000000a80)="18614c243fd714e048667584ad0aa4eefe81d48323dfb2cfe515ec35864ce8f9ae02fb9c127320e28e8ec54fd213468e78fe76e620c102a8db6d0eeafcb9554d8ad5a617bacd1349366484bc2157bf69a6b94e6062d06d91822474abe8789c0f2a39113466f9efdc350a7812bc267231fa10a489b959e269bf99b37a658b1108d41c263dc18248e915be579db80f40edf951", 0x92, 0x22}, {0x3, 0xb, &(0x7f0000000b40)='\x00', &(0x7f0000000b80)="cc68743b5fd1e25738e572cb", 0xc, 0x38}]}) 1.942174976s ago: executing program 0 (id=1202): r0 = syz_open_procfs(0x0, &(0x7f0000002680)='net/igmp6\x00') preadv(r0, &(0x7f00000026c0)=[{&(0x7f0000002700)=""/4085, 0xff5}], 0x4b, 0x3ab3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1a8) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./bus\x00', 0x4140, 0x85) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x84) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB='+\x00\x00\x00', @ANYRES32=r1], 0x2b) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r5, &(0x7f0000003700)=""/102392, 0x18ff8) keyctl$instantiate(0xc, 0x0, &(0x7f000001c700)=ANY=[], 0x2a, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f000001c740), 0x0, 0x0) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f000001c780)={0x0, 0x0, 0x7, &(0x7f000001c7c0)={0x16, "9989c68556dd9d6197a0cb7ca9cb879a05000000000000004f9fce1aba72a7ca2d"}}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000190000/0x1000)=nil, 0x0, 0x1000000, 0x12, r2, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f000001c800)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) sendfile(r3, r1, 0x0, 0x95e2) read$nci(r1, &(0x7f000001c840)=""/84, 0x54) 1.599874906s ago: executing program 5 (id=1203): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) rename(&(0x7f00000001c0)='./file0/file0\x00', 0x0) r2 = socket(0x15, 0x5, 0x0) connect$unix(r2, &(0x7f0000002840)=@abs={0xa}, 0x6e) getsockname(r2, 0x0, &(0x7f00000028c0)) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x23, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r3, 0x1, 0x3}, 0x50) add_key(0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500), &(0x7f0000000700), 0x407f, r4, 0x4}, 0x38) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000680)={r0, r0, 0x2f, 0x0, @void}, 0x10) mq_open(&(0x7f0000000040)='#]#*\x00', 0x40, 0x2, 0x0) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000740)={0x9, [0x200, 0x8, 0x7f, 0x6, 0x5, 0x8, 0x40, 0x7ff, 0x8001]}, 0x16) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) pselect6(0x900, 0x0, 0x0, &(0x7f00000000c0)={0x1f}, &(0x7f0000000100)={0x0, 0x3938700}, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002900)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002940)={@private0, 0xffa4, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000002980)={@initdev={0xfe, 0x88, '\x00', 0xde, 0x0}, 0x800, 0x1, 0xff, 0x2, 0x0, 0x100}, 0x20) ioctl(r7, 0x3b8f, &(0x7f0000000700)='(\x00\x00') bpf$LINK_DETACH(0x22, &(0x7f00000006c0)=r5, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r5, r0, 0x4, r0}, 0x10) 1.062143068s ago: executing program 1 (id=1204): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010601bc3bd020402012c651e50102030109021200017b63200909040002"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc4b2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f00000001c0), 0x1, 0x2703) socket$nl_audit(0x10, 0x3, 0x9) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000200)={0x0, 0x1, 0x5, &(0x7f0000000240)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}}) 742.026598ms ago: executing program 0 (id=1205): ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x41, 0x0}}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x24}}, 0xaf, 0x0, 0x0, 0x0, 0x5, 0x0, 0xc5, 0x0, 0x6}) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip_vti0\x00', 0x0}) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) sendto$packet(r0, &(0x7f00000000c0)='O', 0x5c8, 0x0, &(0x7f0000000100)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a40), r3) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000580)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000030000004c00018038000400600001000a1e49bdcf01000120010000000000000000000000000001030000001400020002000000ffffffff00000000000000000d0001007564703a730fe2d3e2"], 0x60}}, 0x0) 300.510033ms ago: executing program 2 (id=1206): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r2, &(0x7f0000000780)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$ARCH_GET_CPUID(0x1e, r0, 0x0, 0x1011) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000197c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000019800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019840)={{r5, 0xffffffffffffffff}, &(0x7f0000019880), &(0x7f00000198c0)=r4}, 0x20) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000019900)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000019940)={0x6, 0x4, &(0x7f0000019a00)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f0000019a40)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', r8, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000019a80)={r9, r8, 0x25, 0x2, @void}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000019ac0)={{r6}, &(0x7f0000019b00), &(0x7f0000019b40)=r3}, 0x20) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r10 = syz_clone(0x4084111, 0x0, 0x1d, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r10, 0x1, &(0x7f0000019b80)={0x14, 0x1, 0xfee9}) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) 209.830517ms ago: executing program 5 (id=1207): socket$rds(0x15, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='2', 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="110025bd7000ffdbdf258200000008000300", @ANYRES32, @ANYBLOB="11a618d2e891dc211fcbd63613b406000000000000005769dec77549b34c927eeb38afeb7957e88ed2ceaf57648af5bb8003f157d5e5122e3fac0717bf8b6016ad62e91bdbc1456148b202a9d9b45bf168568862"], 0x1c}, 0x1, 0x0, 0x0, 0x404c0c4}, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000380), 0x2, 0x141102) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, 0x0, 0x0, &(0x7f0000000500)=0x0, &(0x7f0000000540)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r3, r4, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000840)={0x40000000, 0x0, &(0x7f0000000880)={0x0, 0x10}}, 0x0) bind$inet(r5, &(0x7f0000000900)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000940)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000980)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0x7, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r5, &(0x7f0000000a80), 0x800001d, 0x1c) syz_usb_connect(0x0, 0x2b, &(0x7f0000000e80)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a00000007058102"], 0x0) 2.081129ms ago: executing program 0 (id=1208): syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000000080)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) quotactl$Q_SETQUOTA(0xffffffff80000801, 0x0, 0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000180)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0x920, 0x12) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x3, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1802000002000500000000000000000085000000200000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) write(r2, &(0x7f0000000600)="741ae844931a6389194e440185275598ef1713f3c11b0a7dc114d78c16e318e58604e64e6d1ecc805e90b82bc7285afa5d1c3f84c8afd9672a7d4804eaf5492087a19bac4063fa31c4c962b8fba0d2d73b90ac81ccd1e7499c77bb1ac611ed6c3bcc271b4d176df114b7fd6f0fcaf6245210cddc9554377f0b45f5e1ffcae3d93006be1665cad6057eb4c376ae399a3e91bec60a09f7067462110c42c5d217fdd148ed5e1504907222f367e1230fdc45f550bade321ffc4415af2ef1e182451df507eb13ed698413d1589e8b5c9835c4f8d67f274eb48f38ee66f797c96aa4aaf57b97153289", 0xe6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r2, 0x0, 0x7, 0x0, &(0x7f0000000440)="e0b9547ed387db", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000480)={'virt_wifi0\x00', &(0x7f00000004c0)=@ethtool_coalesce={0xe, 0x5, 0xfff, 0xa5dd, 0x606, 0x2, 0xa4, 0x4, 0x7f, 0x5, 0x0, 0x47, 0x8, 0x1, 0xc2, 0x1, 0xbb, 0x3, 0x5, 0x14, 0x4, 0x8, 0x80000001}}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_open_dev$usbfs(&(0x7f0000000540), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000580)) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f00000005c0)=@usbdevfs_connect) r4 = syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x402) ioctl$I2C_FUNCS(r4, 0x705, &(0x7f0000000100)=0x3d0) 0s ago: executing program 3 (id=1209): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf2220000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r0, &(0x7f0000000640)='100', 0x3) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000680), 0x80400, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='memory.events\x00', 0x275a, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000700)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x9, 0x13, 0x1, 0x0, 0x1}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x49ba}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:mac\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x24000000}, 0x20000080) capset(0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000400)={0x1, 0x9006}, 0x4) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0x37, 0x2, 0x9}]}, 0x10) close_range(r6, r6, 0x0) kernel console output (not intermixed with test programs): ot:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 665.782102][ T9936] FAULT_INJECTION: forcing a failure. [ 665.782102][ T9936] name failslab, interval 1, probability 0, space 0, times 0 [ 665.782136][ T9936] CPU: 1 UID: 0 PID: 9936 Comm: syz.5.905 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 665.782163][ T9936] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 665.782171][ T9936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 665.782181][ T9936] Call Trace: [ 665.782187][ T9936] [ 665.782195][ T9936] dump_stack_lvl+0x100/0x190 [ 665.782225][ T9936] should_fail_ex.cold+0x5/0xa [ 665.782253][ T9936] should_failslab+0xc2/0x120 [ 665.782279][ T9936] kmem_cache_alloc_noprof+0x92/0x6a0 [ 665.782301][ T9936] ? io_submit_one+0x124/0x1fb0 [ 665.782326][ T9936] io_submit_one+0x124/0x1fb0 [ 665.782350][ T9936] ? __lock_acquire+0x5c0/0x1f40 [ 665.782373][ T9936] ? irqentry_exit+0x202/0xab0 [ 665.782399][ T9936] ? lockdep_hardirqs_on+0x7d/0x110 [ 665.782426][ T9936] ? __pfx_io_submit_one+0x10/0x10 [ 665.782450][ T9936] ? lock_acquire+0x1d1/0x380 [ 665.782475][ T9936] ? __might_fault+0xc5/0x140 [ 665.782509][ T9936] ? __x64_sys_io_submit+0x1b1/0x3a0 [ 665.782530][ T9936] __x64_sys_io_submit+0x1b1/0x3a0 [ 665.782555][ T9936] ? __pfx___x64_sys_io_submit+0x10/0x10 [ 665.782582][ T9936] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 665.782609][ T9936] do_syscall_64+0x123/0x790 [ 665.782637][ T9936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 665.782657][ T9936] RIP: 0033:0x7fe50d19f559 [ 665.782673][ T9936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 665.782690][ T9936] RSP: 002b:00007fe50df8d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 665.782709][ T9936] RAX: ffffffffffffffda RBX: 00007fe50d426090 RCX: 00007fe50d19f559 [ 665.782721][ T9936] RDX: 00002000000006c0 RSI: 00000000200001a6 RDI: 00007fe50df6c000 [ 665.782734][ T9936] RBP: 00007fe50df8d090 R08: 0000000000000000 R09: 0000000000000000 [ 665.782745][ T9936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 665.782756][ T9936] R13: 00007fe50d426128 R14: 00007fe50d426090 R15: 00007ffce2bcaac8 [ 665.782782][ T9936] [ 666.221796][ T8886] usb 6-1: USB disconnect, device number 15 [ 667.052196][ T9955] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 667.545337][ T7952] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 667.655332][ T919] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 667.695311][ T7952] usb 2-1: Using ep0 maxpacket: 8 [ 667.696901][ T7952] usb 2-1: unable to get BOS descriptor or descriptor too short [ 667.696937][ T7952] usb 2-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=1a.86 [ 667.697739][ T7952] usb 2-1: config 3 has an invalid interface number: 171 but max is 0 [ 667.697760][ T7952] usb 2-1: config 3 has no interface number 0 [ 667.699416][ T7952] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.699437][ T7952] usb 2-1: Product: syz [ 667.699451][ T7952] usb 2-1: Manufacturer: syz [ 667.699465][ T7952] usb 2-1: SerialNumber: syz [ 667.715298][ T5722] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 667.805341][ T919] usb 4-1: Using ep0 maxpacket: 32 [ 667.805799][ T919] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 667.806614][ T919] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 667.806629][ T919] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 667.806647][ T919] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.807978][ T919] usb 4-1: config 0 descriptor?? [ 667.810210][ T919] hub 4-1:0.0: USB hub found [ 667.865339][ T5722] usb 3-1: Using ep0 maxpacket: 8 [ 667.867138][ T5722] usb 3-1: unable to get BOS descriptor or descriptor too short [ 667.867193][ T5722] usb 3-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=1a.86 [ 667.868036][ T5722] usb 3-1: config 3 has an invalid interface number: 171 but max is 0 [ 667.868054][ T5722] usb 3-1: config 3 has no interface number 0 [ 667.869759][ T5722] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.869775][ T5722] usb 3-1: Product: syz [ 667.869788][ T5722] usb 3-1: Manufacturer: syz [ 667.869799][ T5722] usb 3-1: SerialNumber: syz [ 667.968139][ T7952] (null): radio-mr800 - initialization failed [ 667.968219][ T7952] radio-mr800 2-1:3.171: probe with driver radio-mr800 failed with error -22 [ 667.968340][ T7952] usbhid 2-1:3.171: couldn't find an input interrupt endpoint [ 667.972467][ T7952] usb 2-1: USB disconnect, device number 37 [ 668.023551][ T919] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 668.029345][ T919] usbhid 4-1:0.0: can't add hid device: -71 [ 668.029431][ T919] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 668.045929][ T919] usb 4-1: USB disconnect, device number 34 [ 668.119650][ T5722] (null): radio-mr800 - initialization failed [ 668.119729][ T5722] radio-mr800 3-1:3.171: probe with driver radio-mr800 failed with error -22 [ 668.119849][ T5722] usbhid 3-1:3.171: couldn't find an input interrupt endpoint [ 668.125354][ T5722] usb 3-1: USB disconnect, device number 30 [ 668.265545][ T9965] FAULT_INJECTION: forcing a failure. [ 668.265545][ T9965] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 668.265568][ T9965] CPU: 0 UID: 0 PID: 9965 Comm: syz.5.912 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 668.265585][ T9965] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 668.265589][ T9965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 668.265596][ T9965] Call Trace: [ 668.265600][ T9965] [ 668.265604][ T9965] dump_stack_lvl+0x100/0x190 [ 668.265623][ T9965] should_fail_ex.cold+0x5/0xa [ 668.265640][ T9965] _copy_from_user+0x2e/0xd0 [ 668.265652][ T9965] copy_msghdr_from_user+0x9f/0x4c0 [ 668.265667][ T9965] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 668.265684][ T9965] ? lock_acquire+0x1d1/0x380 [ 668.265698][ T9965] ? get_pid_task+0x2a/0x250 [ 668.265715][ T9965] ___sys_sendmsg+0x106/0x1e0 [ 668.265729][ T9965] ? __pfx____sys_sendmsg+0x10/0x10 [ 668.265742][ T9965] ? get_pid_task+0x106/0x250 [ 668.265762][ T9965] ? find_held_lock+0x2b/0x80 [ 668.265791][ T9965] __sys_sendmsg+0x160/0x210 [ 668.265808][ T9965] ? __pfx___sys_sendmsg+0x10/0x10 [ 668.265832][ T9965] do_syscall_64+0x123/0x790 [ 668.265849][ T9965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 668.265864][ T9965] RIP: 0033:0x7fe50d19f559 [ 668.265875][ T9965] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 668.265885][ T9965] RSP: 002b:00007fe50df8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 668.265897][ T9965] RAX: ffffffffffffffda RBX: 00007fe50d426090 RCX: 00007fe50d19f559 [ 668.265904][ T9965] RDX: 0000000000000000 RSI: 00002000000037c0 RDI: 0000000000000004 [ 668.265911][ T9965] RBP: 00007fe50df8d090 R08: 0000000000000000 R09: 0000000000000000 [ 668.265917][ T9965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 668.265924][ T9965] R13: 00007fe50d426128 R14: 00007fe50d426090 R15: 00007ffce2bcaac8 [ 668.265938][ T9965] [ 668.617299][ T9969] netlink: 2 bytes leftover after parsing attributes in process `syz.1.914'. [ 668.788666][ T30] audit: type=1400 audit(1792904804.708:2113): avc: denied { mounton } for pid=9971 comm="syz.2.916" path="/185/proc" dev="tmpfs" ino=1081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 668.812106][ T30] audit: type=1400 audit(1792904804.728:2114): avc: denied { mount } for pid=9971 comm="syz.2.916" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 668.817219][ T30] audit: type=1400 audit(1792904804.738:2115): avc: denied { ioctl } for pid=9967 comm="syz.5.913" path="/dev/raw-gadget" dev="devtmpfs" ino=814 ioctlcmd=0x80085502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 668.865582][ T30] audit: type=1400 audit(1792904804.788:2116): avc: denied { read write } for pid=9971 comm="syz.2.916" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 668.889857][ T30] audit: type=1400 audit(1792904804.788:2117): avc: denied { open } for pid=9971 comm="syz.2.916" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 668.892290][ T9972] FAULT_INJECTION: forcing a failure. [ 668.892290][ T9972] name failslab, interval 1, probability 0, space 0, times 0 [ 668.892318][ T9972] CPU: 0 UID: 0 PID: 9972 Comm: syz.2.916 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 668.892344][ T9972] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 668.892351][ T9972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 668.892361][ T9972] Call Trace: [ 668.892370][ T9972] [ 668.892377][ T9972] dump_stack_lvl+0x100/0x190 [ 668.892406][ T9972] should_fail_ex.cold+0x5/0xa [ 668.892430][ T9972] should_failslab+0xc2/0x120 [ 668.892452][ T9972] kmem_cache_alloc_noprof+0x92/0x6a0 [ 668.892472][ T9972] ? do_getname+0x35/0x390 [ 668.892492][ T9972] do_getname+0x35/0x390 [ 668.892511][ T9972] do_sys_openat2+0xc3/0x1d0 [ 668.892536][ T9972] ? __pfx_do_sys_openat2+0x10/0x10 [ 668.892560][ T9972] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 668.892591][ T9972] __x64_sys_openat+0x12d/0x210 [ 668.892617][ T9972] ? __pfx___x64_sys_openat+0x10/0x10 [ 668.892650][ T9972] do_syscall_64+0x123/0x790 [ 668.892674][ T9972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 668.892691][ T9972] RIP: 0033:0x7f8d4459f559 [ 668.892706][ T9972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 668.892721][ T9972] RSP: 002b:00007f8d453e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 668.892740][ T9972] RAX: ffffffffffffffda RBX: 00007f8d44825fa0 RCX: 00007f8d4459f559 [ 668.892752][ T9972] RDX: 0000000000040241 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 668.892763][ T9972] RBP: 00007f8d44636b20 R08: 0000000000000000 R09: 0000000000000000 [ 668.892773][ T9972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 668.892783][ T9972] R13: 00007f8d44826038 R14: 00007f8d44825fa0 R15: 00007ffcddca0ca8 [ 668.892806][ T9972] [ 668.935338][ T5722] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 669.027502][ T30] audit: type=1400 audit(1792904804.948:2118): avc: denied { unmount } for pid=5618 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 669.100840][ T5722] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 669.101673][ T5722] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.101711][ T5722] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 669.101732][ T5722] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 669.101763][ T5722] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.419246][ T9978] fuse: Bad value for 'group_id' [ 669.419279][ T9978] fuse: Bad value for 'group_id' [ 669.995523][ T5722] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 669.995546][ T5722] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 670.000232][ T5722] cxacru 6-1:1.0: probe with driver cxacru failed with error -71 [ 670.006315][ T5722] usb 6-1: USB disconnect, device number 16 [ 670.430438][ T9987] IPv6: addrconf: prefix option has invalid lifetime [ 670.691867][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 670.691890][ T30] audit: type=1400 audit(1792904806.588:2149): avc: denied { read } for pid=9988 comm="syz.3.915" name="btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 670.692007][ T30] audit: type=1400 audit(1792904806.588:2150): avc: denied { open } for pid=9988 comm="syz.3.915" path="/dev/btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 670.824029][ T30] audit: type=1400 audit(1792904806.738:2151): avc: denied { read } for pid=9988 comm="syz.3.915" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 670.824986][ T30] audit: type=1400 audit(1792904806.738:2152): avc: denied { open } for pid=9988 comm="syz.3.915" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.046069][ T30] audit: type=1400 audit(1792904806.968:2153): avc: denied { create } for pid=9986 comm="syz.2.922" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 671.244310][ T30] audit: type=1400 audit(1792904807.158:2154): avc: denied { write } for pid=9986 comm="syz.2.922" path="socket:[22077]" dev="sockfs" ino=22077 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 671.341762][ T30] audit: type=1400 audit(1792904807.258:2155): avc: denied { open } for pid=9986 comm="syz.2.922" path="/dev/ptyq9" dev="devtmpfs" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 672.100308][ T30] audit: type=1400 audit(1792904807.518:2156): avc: denied { read } for pid=9999 comm="syz.0.923" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 672.100357][ T30] audit: type=1400 audit(1792904807.518:2157): avc: denied { open } for pid=9999 comm="syz.0.923" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 672.340941][ T30] audit: type=1400 audit(1792904808.258:2158): avc: denied { create } for pid=10003 comm="syz.5.924" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 672.481791][T10007] 9p: Bad value for 'rfdno' [ 672.786550][T10015] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 673.133180][T10017] netlink: 244 bytes leftover after parsing attributes in process `syz.0.925'. [ 673.555850][ T5722] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 673.605798][ T8886] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 673.696752][ T1222] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 673.724188][ T5722] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 673.736980][ T5722] usb 1-1: config 0 has an invalid interface number: 50 but max is 0 [ 673.737006][ T5722] usb 1-1: config 0 has no interface number 0 [ 673.737026][ T5722] usb 1-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 673.744442][ T5722] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.744466][ T5722] usb 1-1: Product: syz [ 673.744480][ T5722] usb 1-1: Manufacturer: syz [ 673.744494][ T5722] usb 1-1: SerialNumber: syz [ 673.765365][ T8886] usb 6-1: Using ep0 maxpacket: 32 [ 673.765850][ T8886] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 673.766669][ T8886] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 673.766688][ T8886] usb 6-1: config 0 has no interface number 0 [ 673.766718][ T8886] usb 6-1: config 0 interface 184 has no altsetting 0 [ 673.768289][ T8886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.768307][ T8886] usb 6-1: Product: syz [ 673.768319][ T8886] usb 6-1: Manufacturer: syz [ 673.768332][ T8886] usb 6-1: SerialNumber: syz [ 673.788351][ T8886] usb 6-1: config 0 descriptor?? [ 675.534052][ T5722] usb 1-1: config 0 descriptor?? [ 675.566163][ T1222] usb 2-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 675.595367][ T1222] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 675.595393][ T1222] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 675.596814][ T1222] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.597604][ T5722] yurex 1-1:0.50: Could not find endpoints [ 675.643869][ T1222] idmouse 2-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 675.815881][ T7952] usb 1-1: USB disconnect, device number 31 [ 676.486757][ T8886] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 676.486780][ T8886] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 677.075165][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 677.075183][ T30] audit: type=1400 audit(1792904812.988:2197): avc: denied { load_policy } for pid=10024 comm="syz.5.930" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 677.109850][T10026] SELinux: truncated policydb string identifier [ 677.110013][T10026] SELinux: failed to load policy [ 677.901301][ T8886] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 677.901332][ T8886] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 677.901352][ T8886] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 677.901789][ T8886] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -32 [ 677.982154][ T1222] usb 2-1: USB disconnect, device number 38 [ 677.983883][ T1222] idmouse 2-1:1.0: disconnected [ 678.069653][ T30] audit: type=1400 audit(1792904813.988:2198): avc: denied { mount } for pid=10063 comm="syz.1.939" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 678.182877][ T30] audit: type=1400 audit(1792904814.098:2199): avc: denied { bind } for pid=10063 comm="syz.1.939" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 678.208948][ T30] audit: type=1400 audit(1792904814.128:2200): avc: denied { write } for pid=10063 comm="syz.1.939" path="socket:[22209]" dev="sockfs" ino=22209 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 678.593079][ T5722] usb 6-1: USB disconnect, device number 17 [ 679.001028][ T30] audit: type=1400 audit(1792904814.918:2201): avc: denied { unmount } for pid=5619 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 679.401384][T10080] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 679.560512][ T30] audit: type=1400 audit(1792904815.458:2202): avc: denied { name_bind } for pid=10075 comm="syz.5.943" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 679.560670][ T30] audit: type=1400 audit(1792904815.458:2203): avc: denied { node_bind } for pid=10075 comm="syz.5.943" saddr=::ffff:172.20.20.170 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 679.895027][ T30] audit: type=1400 audit(1792904815.808:2204): avc: denied { read write } for pid=10083 comm="syz.2.934" name="vhost-vsock" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 679.895082][ T30] audit: type=1400 audit(1792904815.808:2205): avc: denied { open } for pid=10083 comm="syz.2.934" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 679.895495][ T30] audit: type=1400 audit(1792904815.808:2206): avc: denied { write } for pid=10083 comm="syz.2.934" name="sda1" dev="devtmpfs" ino=1028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 681.500802][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 681.500833][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 682.414508][ T30] audit: type=1400 audit(1792904817.798:2207): avc: denied { ioctl } for pid=10091 comm="syz.3.945" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=22263 ioctlcmd=0xc018aa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 684.990566][ T30] audit: type=1400 audit(1792904820.908:2208): avc: denied { mount } for pid=10122 comm="syz.5.952" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 685.021376][ T30] audit: type=1400 audit(1792904820.938:2209): avc: denied { mounton } for pid=10122 comm="syz.5.952" path="/93/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 685.046015][ T30] audit: type=1400 audit(1792904820.958:2210): avc: denied { mount } for pid=10122 comm="syz.5.952" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 685.307788][ T30] audit: type=1400 audit(1792904821.228:2211): avc: denied { unmount } for pid=7697 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 685.335013][ T30] audit: type=1400 audit(1792904821.238:2212): avc: denied { unmount } for pid=7697 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 686.246192][ T30] audit: type=1400 audit(1792904822.168:2213): avc: denied { write } for pid=10130 comm="syz.1.947" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 686.289468][T10141] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 687.797529][ T30] audit: type=1400 audit(1792904823.718:2214): avc: denied { ioctl } for pid=10130 comm="syz.1.947" path="/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xc138fd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 687.851242][ T30] audit: type=1400 audit(1792904823.758:2215): avc: denied { sys_module } for pid=10137 comm="syz.5.957" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 688.968450][ T30] audit: type=1400 audit(1792904824.888:2216): avc: denied { create } for pid=10158 comm="syz.3.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 688.991629][ T30] audit: type=1400 audit(1792904824.908:2217): avc: denied { write } for pid=10158 comm="syz.3.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 689.011862][ T30] audit: type=1400 audit(1792904824.928:2218): avc: denied { nlmsg_write } for pid=10158 comm="syz.3.961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 689.071314][ T30] audit: type=1400 audit(1792904824.988:2219): avc: denied { setopt } for pid=10161 comm="syz.2.951" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 689.137731][ T30] audit: type=1400 audit(1792904825.058:2220): avc: denied { append } for pid=10164 comm="syz.1.962" name="dlm-monitor" dev="devtmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 689.408196][ T30] audit: type=1400 audit(1792904825.318:2221): avc: denied { mounton } for pid=10164 comm="syz.1.962" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 689.414927][T10171] netlink: 8 bytes leftover after parsing attributes in process `syz.1.962'. [ 689.415135][T10171] netlink: 'syz.1.962': attribute type 11 has an invalid length. [ 689.415196][T10171] netlink: 4 bytes leftover after parsing attributes in process `syz.1.962'. [ 689.439416][ T30] audit: type=1400 audit(1792904825.348:2222): avc: denied { create } for pid=10167 comm="syz.2.963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 689.440640][ T30] audit: type=1400 audit(1792904825.348:2223): avc: denied { create } for pid=10167 comm="syz.2.963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 690.081526][T10163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.961'. [ 690.654509][T10163] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.405029][T10200] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 692.857465][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 692.857499][ T30] audit: type=1400 audit(1792904828.308:2234): avc: denied { map } for pid=10191 comm="syz.2.971" path="socket:[22778]" dev="sockfs" ino=22778 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 693.216909][ T30] audit: type=1400 audit(1792904829.138:2235): avc: denied { getopt } for pid=10201 comm="syz.1.972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 694.167760][ T30] audit: type=1400 audit(1792904830.008:2236): avc: denied { ioctl } for pid=10205 comm="syz.2.973" path="pid:[4026532778]" dev="nsfs" ino=4026532778 ioctlcmd=0x8004b707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 695.082370][ T30] audit: type=1400 audit(1792904830.998:2237): avc: denied { connect } for pid=10211 comm="syz.5.959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 695.122740][T10193] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 695.374822][ T30] audit: type=1400 audit(1792904831.288:2238): avc: denied { block_suspend } for pid=10221 comm="syz.5.975" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 695.415365][ T5712] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 695.438831][T10225] FAULT_INJECTION: forcing a failure. [ 695.438831][T10225] name failslab, interval 1, probability 0, space 0, times 0 [ 695.438853][T10225] CPU: 1 UID: 0 PID: 10225 Comm: syz.2.976 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 695.438869][T10225] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 695.438879][T10225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 695.438885][T10225] Call Trace: [ 695.438889][T10225] [ 695.438894][T10225] dump_stack_lvl+0x100/0x190 [ 695.438913][T10225] should_fail_ex.cold+0x5/0xa [ 695.438929][T10225] should_failslab+0xc2/0x120 [ 695.438944][T10225] __kmalloc_cache_noprof+0x91/0x6d0 [ 695.438962][T10225] ? bpf_prog_alloc_no_stats+0x161/0x690 [ 695.438982][T10225] bpf_prog_alloc_no_stats+0x161/0x690 [ 695.439003][T10225] bpf_prog_alloc+0x3b/0x200 [ 695.439018][T10225] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 695.439036][T10225] bpf_prog_load+0x513/0x2ba0 [ 695.439049][T10225] ? avc_has_perm_noaudit+0x11e/0x470 [ 695.439065][T10225] ? __pfx_bpf_prog_load+0x10/0x10 [ 695.439091][T10225] __sys_bpf+0x146f/0x4b60 [ 695.439108][T10225] ? __pfx___sys_bpf+0x10/0x10 [ 695.439122][T10225] ? find_held_lock+0x2b/0x80 [ 695.439139][T10225] ? get_pid_task+0xfc/0x250 [ 695.439154][T10225] ? get_pid_task+0xfc/0x250 [ 695.439173][T10225] ? find_held_lock+0x2b/0x80 [ 695.439192][T10225] ? rcu_read_lock_any_held+0x6a/0x90 [ 695.439203][T10225] ? find_held_lock+0x2b/0x80 [ 695.439219][T10225] ? ksys_write+0x190/0x250 [ 695.439232][T10225] ? ksys_write+0x190/0x250 [ 695.439244][T10225] ? lock_acquire+0x1d1/0x380 [ 695.439266][T10225] ? fput+0x7c/0x100 [ 695.439281][T10225] ? ksys_write+0x1ac/0x250 [ 695.439295][T10225] ? __x64_sys_bpf+0xce/0x140 [ 695.439309][T10225] __x64_sys_bpf+0xce/0x140 [ 695.439323][T10225] ? do_syscall_64+0xae/0x790 [ 695.439340][T10225] do_syscall_64+0x123/0x790 [ 695.439356][T10225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.439368][T10225] RIP: 0033:0x7f8d4459f559 [ 695.439380][T10225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.439391][T10225] RSP: 002b:00007f8d453e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 695.439402][T10225] RAX: ffffffffffffffda RBX: 00007f8d44825fa0 RCX: 00007f8d4459f559 [ 695.439409][T10225] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 695.439416][T10225] RBP: 00007f8d453e0090 R08: 0000000000000000 R09: 0000000000000000 [ 695.439422][T10225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.439429][T10225] R13: 00007f8d44826038 R14: 00007f8d44825fa0 R15: 00007ffcddca0ca8 [ 695.439443][T10225] [ 695.626973][ T5712] usb 4-1: Using ep0 maxpacket: 32 [ 695.637436][ T5712] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 695.651129][ T5712] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 695.651149][ T5712] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 695.651168][ T5712] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 695.705960][ T5712] usb 4-1: config 0 descriptor?? [ 695.812263][ T5712] hub 4-1:0.0: USB hub found [ 696.020056][ T5712] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 696.039129][ T5712] usbhid 4-1:0.0: can't add hid device: -71 [ 696.039209][ T5712] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 696.060868][ T5712] usb 4-1: USB disconnect, device number 35 [ 698.588403][ T30] audit: type=1400 audit(1792904834.508:2239): avc: denied { create } for pid=10240 comm="syz.3.981" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 698.588497][T10241] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=10241 comm=syz.5.982 [ 698.723353][ T30] audit: type=1400 audit(1792904834.618:2240): avc: denied { sqpoll } for pid=10240 comm="syz.3.981" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 698.810274][ T30] audit: type=1400 audit(1792904834.698:2241): avc: denied { write } for pid=10240 comm="syz.3.981" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 699.259689][ T5712] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 699.336172][ T30] audit: type=1400 audit(1792904835.258:2242): avc: denied { create } for pid=10250 comm="syz.5.983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 699.430289][ T5712] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 699.434634][ T5712] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 699.434676][ T5712] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 699.434695][ T5712] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 699.434714][ T5712] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 699.434750][ T5712] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.495455][ T30] audit: type=1400 audit(1792904835.408:2243): avc: denied { sys_admin } for pid=10250 comm="syz.5.983" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 702.186411][ T30] audit: type=1400 audit(1792904837.928:2244): avc: denied { setopt } for pid=10259 comm="syz.1.977" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 702.186458][ T30] audit: type=1400 audit(1792904837.958:2245): avc: denied { connect } for pid=10259 comm="syz.1.977" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 702.186492][ T30] audit: type=1400 audit(1792904838.058:2246): avc: denied { read } for pid=10259 comm="syz.1.977" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 702.615626][ T5712] gud 1-1:1.0: Failed to add properties (error=-5) [ 702.615660][ T5712] gud 1-1:1.0: probe with driver gud failed with error -5 [ 704.105445][ T5837] usb 1-1: USB disconnect, device number 32 [ 704.290937][T10276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.989'. [ 704.291056][T10276] netlink: 'syz.0.989': attribute type 11 has an invalid length. [ 704.291090][T10276] netlink: 4 bytes leftover after parsing attributes in process `syz.0.989'. [ 704.461272][ T8886] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 705.065316][ T8886] usb 6-1: Using ep0 maxpacket: 32 [ 705.078127][ T8886] usb 6-1: New USB device found, idVendor=2040, idProduct=c612, bcdDevice=e5.51 [ 705.227440][ T8886] usb 6-1: config 123 interface 0 has no altsetting 0 [ 705.277837][ T8886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 705.277862][ T8886] usb 6-1: Product: syz [ 705.277886][ T8886] usb 6-1: Manufacturer: syz [ 705.277901][ T8886] usb 6-1: SerialNumber: syz [ 705.895161][T10286] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 706.480254][ T8886] usb 6-1: dvb_usb_v2: found a 'Hauppauge 126xxx' in warm state [ 706.501889][ T8886] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 706.503805][ T8886] dvbdev: DVB: registering new adapter (Hauppauge 126xxx) [ 706.503849][ T8886] usb 6-1: media controller created [ 706.563327][ T8886] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 706.665331][ T5712] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 706.677532][ T8886] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 706.677545][ T8886] error writing reg: 0xff, val: 0x00 [ 706.718638][ T8886] dvb_usb_mxl111sf 6-1:123.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 706.806305][T10279] overlayfs: failed to resolve './file2': -2 [ 706.826029][ T5712] usb 4-1: Using ep0 maxpacket: 32 [ 706.826583][ T5712] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 706.827441][ T5712] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 706.827459][ T5712] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 706.827486][ T5712] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 706.830946][ T5712] usb 4-1: config 0 descriptor?? [ 706.837163][ T5712] hub 4-1:0.0: USB hub found [ 706.917824][T10273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 706.918118][T10273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 706.962932][ T8886] usb 6-1: USB disconnect, device number 18 [ 707.048327][ T5712] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 707.058255][ T5712] usbhid 4-1:0.0: can't add hid device: -71 [ 707.058329][ T5712] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 707.088538][ T5712] usb 4-1: USB disconnect, device number 36 [ 709.159256][ T30] audit: type=1400 audit(1792904845.078:2247): avc: denied { ioctl } for pid=10299 comm="syz.2.996" path="socket:[22507]" dev="sockfs" ino=22507 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 711.659429][T10315] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1000'. [ 712.109244][ T30] audit: type=1400 audit(1792904848.028:2248): avc: denied { create } for pid=10319 comm="syz.2.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 712.272073][ T30] audit: type=1400 audit(1792904848.188:2249): avc: denied { setopt } for pid=10329 comm="syz.1.1005" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 712.711380][T10332] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 714.865731][T10343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1009'. [ 714.866294][ T7952] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 714.935388][ T5845] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 715.095455][ T5845] usb 2-1: Using ep0 maxpacket: 16 [ 715.097946][ T5845] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 715.101182][ T5845] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 715.101325][ T5845] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 715.101356][ T5845] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 715.101384][ T5845] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 715.101416][ T5845] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 715.106404][ T5845] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 715.106435][ T5845] usb 2-1: Manufacturer: syz [ 715.237296][ T5845] usb 2-1: config 0 descriptor?? [ 715.381442][ T30] audit: type=1400 audit(1792904851.248:2250): avc: denied { prog_run } for pid=10344 comm="syz.5.1010" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=bpf permissive=1 [ 715.552424][ T7952] usb 4-1: device not accepting address 37, error -71 [ 715.630338][ T30] audit: type=1400 audit(1792904851.548:2251): avc: denied { setopt } for pid=10342 comm="syz.0.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 716.155909][ T5845] rc_core: IR keymap rc-hauppauge not found [ 716.155922][ T5845] Registered IR keymap rc-empty [ 716.156186][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.178917][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.196963][ T5845] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 716.212736][ T5845] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input13 [ 716.231559][ T30] audit: type=1400 audit(1792904852.148:2252): avc: denied { read } for pid=4972 comm="acpid" name="event4" dev="devtmpfs" ino=3211 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 716.231587][ T30] audit: type=1400 audit(1792904852.148:2253): avc: denied { open } for pid=4972 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3211 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 716.231608][ T30] audit: type=1400 audit(1792904852.148:2254): avc: denied { ioctl } for pid=4972 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3211 ioctlcmd=0x80604520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 716.310305][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.325485][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.345346][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.365454][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.385599][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.405339][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.425579][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.446068][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.465338][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.485322][ T5845] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 716.508882][ T5845] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 716.508903][ T5845] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 716.552839][ T5845] usb 2-1: USB disconnect, device number 39 [ 717.240921][ T30] audit: type=1400 audit(1792904853.158:2255): avc: denied { read } for pid=10359 comm="syz.5.1014" dev="sockfs" ino=23100 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 717.275518][ T30] audit: type=1400 audit(1792904853.198:2256): avc: denied { ioctl } for pid=10359 comm="syz.5.1014" path="socket:[23100]" dev="sockfs" ino=23100 ioctlcmd=0x4020940d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 718.287213][ T30] audit: type=1400 audit(1792904853.508:2257): avc: denied { getopt } for pid=10366 comm="syz.1.1015" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 718.287260][ T30] audit: type=1400 audit(1792904853.518:2258): avc: denied { create } for pid=10366 comm="syz.1.1015" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 718.290590][ T30] audit: type=1400 audit(1792904854.208:2259): avc: denied { unlink } for pid=5619 comm="syz-executor" name="file0" dev="tmpfs" ino=1167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 718.925794][T10372] FAULT_INJECTION: forcing a failure. [ 718.925794][T10372] name failslab, interval 1, probability 0, space 0, times 0 [ 718.926640][T10372] CPU: 0 UID: 0 PID: 10372 Comm: syz.0.1016 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 718.926671][T10372] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 718.926679][T10372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 718.926690][T10372] Call Trace: [ 718.926697][T10372] [ 718.926706][T10372] dump_stack_lvl+0x100/0x190 [ 718.926738][T10372] should_fail_ex.cold+0x5/0xa [ 718.926766][T10372] should_failslab+0xc2/0x120 [ 718.926792][T10372] kmem_cache_alloc_noprof+0x92/0x6a0 [ 718.926813][T10372] ? __pfx_map_id_range_down+0x10/0x10 [ 718.926840][T10372] ? security_inode_alloc+0x3b/0x2c0 [ 718.926870][T10372] security_inode_alloc+0x3b/0x2c0 [ 718.926897][T10372] inode_init_always_gfp+0xc6f/0xfb0 [ 718.926935][T10372] alloc_inode+0x8e/0x250 [ 718.926957][T10372] new_inode+0x22/0x1c0 [ 718.926981][T10372] proc_get_inode+0x1d/0x780 [ 718.927005][T10372] proc_lookup_de+0x236/0x360 [ 718.927032][T10372] proc_lookup+0xd8/0x110 [ 718.927055][T10372] proc_root_lookup+0x3b/0x70 [ 718.927079][T10372] __lookup_slow+0x155/0x320 [ 718.927102][T10372] lookup_slow+0x54/0x80 [ 718.927123][T10372] link_path_walk+0x1381/0x1cc0 [ 718.927156][T10372] path_openat+0x1a7/0x23f0 [ 718.927187][T10372] ? __pfx_path_openat+0x10/0x10 [ 718.927212][T10372] ? __pfx___schedule+0x10/0x10 [ 718.927243][T10372] do_file_open+0x20e/0x430 [ 718.927273][T10372] ? __pfx_do_file_open+0x10/0x10 [ 718.927318][T10372] ? _raw_spin_unlock+0x28/0x50 [ 718.927340][T10372] ? alloc_fd+0x471/0x7a0 [ 718.927375][T10372] do_sys_openat2+0x163/0x1d0 [ 718.927403][T10372] ? __pfx_do_sys_openat2+0x10/0x10 [ 718.927433][T10372] ? irqentry_exit+0x202/0xab0 [ 718.927458][T10372] ? lockdep_hardirqs_on+0x7d/0x110 [ 718.927483][T10372] ? irqentry_exit+0x202/0xab0 [ 718.927511][T10372] __x64_sys_openat+0x12d/0x210 [ 718.927541][T10372] ? __pfx___x64_sys_openat+0x10/0x10 [ 718.927580][T10372] do_syscall_64+0x123/0x790 [ 718.927608][T10372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.927628][T10372] RIP: 0033:0x7f443e39f559 [ 718.927644][T10372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 718.927661][T10372] RSP: 002b:00007f443f225028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 718.927680][T10372] RAX: ffffffffffffffda RBX: 00007f443e626090 RCX: 00007f443e39f559 [ 718.927693][T10372] RDX: 0000000000000002 RSI: 0000200000019280 RDI: ffffffffffffff9c [ 718.927704][T10372] RBP: 00007f443f225090 R08: 0000000000000000 R09: 0000000000000000 [ 718.927716][T10372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.927727][T10372] R13: 00007f443e626128 R14: 00007f443e626090 R15: 00007ffdac3c8078 [ 718.927754][T10372] [ 719.126139][T10372] rxe_eth0 speed is unknown, defaulting to 1000 [ 719.803530][T10376] device-mapper: ioctl: name not supplied when creating device [ 720.936422][T10384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1008'. [ 720.936447][T10384] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1008'. [ 720.976071][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 720.976085][ T30] audit: type=1400 audit(1792904856.898:2261): avc: denied { write } for pid=10383 comm="syz.2.1008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 721.032268][T10384] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1008'. [ 721.333482][T10394] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1022'. [ 721.350889][ T30] audit: type=1400 audit(1792904857.268:2262): avc: denied { create } for pid=10393 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 721.373901][ T30] audit: type=1400 audit(1792904857.268:2263): avc: denied { bind } for pid=10393 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 721.395458][ T30] audit: type=1400 audit(1792904857.318:2264): avc: denied { connect } for pid=10393 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 721.416189][ T30] audit: type=1400 audit(1792904857.318:2265): avc: denied { write } for pid=10393 comm="syz.5.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 721.462695][ T30] audit: type=1326 audit(1792904857.378:2266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10397 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5510d9f559 code=0x7ffc0000 [ 721.462866][ T30] audit: type=1326 audit(1792904857.378:2267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10397 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5510d9f559 code=0x7ffc0000 [ 721.463058][ T30] audit: type=1326 audit(1792904857.378:2268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10397 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5510d9f2c2 code=0x7ffc0000 [ 721.463473][ T30] audit: type=1326 audit(1792904857.378:2269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10397 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5510d9f559 code=0x7ffc0000 [ 721.463585][ T30] audit: type=1326 audit(1792904857.378:2270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10397 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f5510d9f357 code=0x7ffc0000 [ 722.815429][ T5837] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 723.119613][ T5837] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 723.183763][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 723.418629][ T5837] usb 4-1: config 0 descriptor?? [ 724.449242][ T5837] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 724.632887][T10420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1028'. [ 724.633033][T10420] netlink: 'syz.2.1028': attribute type 11 has an invalid length. [ 724.633109][T10420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1028'. [ 725.584958][ T5837] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 1 [ 725.584973][ T5837] [drm] Initialized udl on minor 1 [ 725.631588][ T5837] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 725.661069][ T5837] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 725.713364][ T5837] usb 4-1: USB disconnect, device number 39 [ 726.333121][T10442] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1033'. [ 726.618218][T10449] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1034'. [ 727.265551][T10452] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1037'. [ 727.671460][ T5712] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 727.753125][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 727.753139][ T30] audit: type=1400 audit(1792904863.668:2309): avc: denied { write } for pid=10460 comm="syz.5.1038" name="usbmon7" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 727.753164][ T30] audit: type=1400 audit(1792904863.668:2310): avc: denied { open } for pid=10460 comm="syz.5.1038" path="/dev/usbmon7" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 727.810754][ T5712] usb 1-1: device descriptor read/64, error -71 [ 727.944366][T10464] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1039'. [ 728.040138][ T24] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 728.055334][ T5712] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 728.245053][ T5712] usb 1-1: device descriptor read/64, error -71 [ 728.346307][ T5712] usb usb1-port1: attempt power cycle [ 728.649868][T10469] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1040'. [ 728.665803][ T24] usb 6-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 728.666593][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.666613][ T24] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 728.668152][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.668173][ T24] usb 6-1: Product: syz [ 728.668188][ T24] usb 6-1: Manufacturer: syz [ 728.668202][ T24] usb 6-1: SerialNumber: syz [ 728.669527][ T24] usb 6-1: config 0 descriptor?? [ 728.946236][ T5712] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 728.986077][ T5712] usb 1-1: device descriptor read/8, error -71 [ 729.004113][ T30] audit: type=1400 audit(1792904864.898:2311): avc: denied { bind } for pid=10460 comm="syz.5.1038" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 729.004241][ T30] audit: type=1400 audit(1792904864.898:2312): avc: denied { name_bind } for pid=10460 comm="syz.5.1038" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 729.004381][ T30] audit: type=1400 audit(1792904864.898:2313): avc: denied { node_bind } for pid=10460 comm="syz.5.1038" saddr=::1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 729.013461][ T30] audit: type=1400 audit(1792904864.918:2314): avc: denied { ioctl } for pid=10460 comm="syz.5.1038" path="/dev/usbmon7" dev="devtmpfs" ino=736 ioctlcmd=0x80089203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 729.051458][T10474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1042'. [ 729.051570][T10474] netlink: 'syz.3.1042': attribute type 11 has an invalid length. [ 729.051593][T10474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1042'. [ 729.180483][T10461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 729.180884][T10461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 729.788757][ T5712] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 729.859620][ T5712] usb 1-1: device descriptor read/8, error -71 [ 730.007186][ T5712] usb usb1-port1: unable to enumerate USB device [ 730.325288][ T24] usb 6-1: USB disconnect, device number 19 [ 730.405394][ T30] audit: type=1400 audit(1792904866.298:2315): avc: denied { mount } for pid=10482 comm="syz.2.1044" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 730.405449][ T30] audit: type=1400 audit(1792904866.298:2316): avc: denied { write } for pid=10482 comm="syz.2.1044" name="trace_options" dev="tracefs" ino=1384 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 731.440202][ T30] audit: type=1400 audit(1792904867.358:2317): avc: denied { unmount } for pid=5618 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 732.531728][T10497] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 733.704474][ T919] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 733.935336][ T5845] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 733.980171][ T919] usb 3-1: Using ep0 maxpacket: 32 [ 733.989938][ T919] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 734.025022][ T919] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.025046][ T919] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 734.025066][ T919] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.169156][ T919] usb 3-1: config 0 descriptor?? [ 734.282989][ T919] hub 3-1:0.0: USB hub found [ 734.652832][ T919] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 734.664095][ T919] usbhid 3-1:0.0: can't add hid device: -71 [ 734.664200][ T919] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 734.730667][ T919] usb 3-1: USB disconnect, device number 31 [ 734.828182][ T5845] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 734.832565][ T5845] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 734.832594][ T5845] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 734.832629][ T5845] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.882117][ T5845] idmouse 6-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 735.366018][T10520] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1052'. [ 735.683036][ T5845] usb 6-1: USB disconnect, device number 20 [ 735.709763][ T5845] idmouse 6-1:1.0: disconnected [ 735.912406][T10529] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1051'. [ 736.309106][T10527] overlayfs: failed to resolve './file2': -2 [ 736.526950][ T5845] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 736.676308][ T5845] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 736.677342][ T5845] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 736.677385][ T5845] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 736.677411][ T5845] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 736.677447][ T5845] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 737.542685][ T5624] Bluetooth: hci6: command 0x0405 tx timeout [ 737.595441][ T5712] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 737.685584][T10536] overlayfs: failed to resolve './file2': -2 [ 737.725298][ T5712] usb 6-1: device descriptor read/64, error -71 [ 737.796565][ T5845] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 737.796581][ T5845] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 737.796590][ T5845] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 737.797428][ T5845] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 737.818043][ T5845] usb 3-1: USB disconnect, device number 32 [ 738.782479][ T30] audit: type=1400 audit(1792904874.038:2318): avc: denied { bind } for pid=10551 comm="syz.1.1062" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 738.782779][ T5712] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 738.942874][T10559] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1061'. [ 738.942968][T10559] netlink: 'syz.3.1061': attribute type 11 has an invalid length. [ 738.942997][T10559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1061'. [ 738.985306][ T5712] usb 6-1: device descriptor read/64, error -71 [ 739.244599][ T5712] usb usb6-port1: attempt power cycle [ 740.446263][ T5837] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 740.597549][ T5837] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 740.600144][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 740.600312][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 740.600372][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 740.600444][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 740.854534][T10570] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1066'. [ 740.914322][ T5837] cxacru 3-1:1.0: invalid response length to cm 0x90: 32 [ 740.924372][T10571] cxacru 3-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 740.973628][T10575] FAULT_INJECTION: forcing a failure. [ 740.973628][T10575] name failslab, interval 1, probability 0, space 0, times 0 [ 740.973661][T10575] CPU: 1 UID: 0 PID: 10575 Comm: syz.0.1060 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 740.973688][T10575] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 740.973696][T10575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 740.973707][T10575] Call Trace: [ 740.973714][T10575] [ 740.973722][T10575] dump_stack_lvl+0x100/0x190 [ 740.973754][T10575] should_fail_ex.cold+0x5/0xa [ 740.973782][T10575] should_failslab+0xc2/0x120 [ 740.973808][T10575] __kmalloc_cache_node_noprof+0x94/0x710 [ 740.973833][T10575] ? __get_vm_area_node+0x124/0x350 [ 740.973862][T10575] __get_vm_area_node+0x124/0x350 [ 740.973885][T10575] ? __pfx___might_resched+0x10/0x10 [ 740.973908][T10575] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 740.973934][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 740.973963][T10575] ? __lock_acquire+0x5c0/0x1f40 [ 740.973993][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 740.974023][T10575] ? lock_acquire+0x1d1/0x380 [ 740.974047][T10575] ? find_held_lock+0x2b/0x80 [ 740.974082][T10575] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 740.974106][T10575] ? avc_has_perm_noaudit+0x11e/0x470 [ 740.974130][T10575] ? avc_has_perm_noaudit+0x145/0x470 [ 740.974150][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 740.974176][T10575] __vmalloc_node_noprof+0xad/0xf0 [ 740.974200][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 740.974231][T10575] __vmalloc_noprof+0xa3/0x120 [ 740.974257][T10575] ? __pfx___vmalloc_noprof+0x10/0x10 [ 740.974285][T10575] ? rcu_is_watching+0x13/0xc0 [ 740.974313][T10575] ? cap_capable+0x107/0x430 [ 740.974339][T10575] bpf_prog_alloc_no_stats+0x59/0x690 [ 740.974366][T10575] ? security_capable+0x80/0x260 [ 740.974391][T10575] bpf_prog_alloc+0x3b/0x200 [ 740.974416][T10575] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 740.974443][T10575] bpf_prog_load+0x135d/0x2ba0 [ 740.974466][T10575] ? avc_has_perm_noaudit+0x11e/0x470 [ 740.974493][T10575] ? __pfx_bpf_prog_load+0x10/0x10 [ 740.974538][T10575] __sys_bpf+0x146f/0x4b60 [ 740.974568][T10575] ? __pfx___sys_bpf+0x10/0x10 [ 740.974591][T10575] ? find_held_lock+0x2b/0x80 [ 740.974617][T10575] ? get_pid_task+0xfc/0x250 [ 740.974642][T10575] ? get_pid_task+0xfc/0x250 [ 740.974675][T10575] ? find_held_lock+0x2b/0x80 [ 740.974707][T10575] ? rcu_read_lock_any_held+0x6a/0x90 [ 740.974724][T10575] ? find_held_lock+0x2b/0x80 [ 740.974754][T10575] ? ksys_write+0x190/0x250 [ 740.974776][T10575] ? ksys_write+0x190/0x250 [ 740.974798][T10575] ? lock_acquire+0x1d1/0x380 [ 740.974836][T10575] ? fput+0x7c/0x100 [ 740.974862][T10575] ? ksys_write+0x1ac/0x250 [ 740.974888][T10575] ? __x64_sys_bpf+0xce/0x140 [ 740.974911][T10575] __x64_sys_bpf+0xce/0x140 [ 740.974936][T10575] ? do_syscall_64+0xae/0x790 [ 740.974962][T10575] do_syscall_64+0x123/0x790 [ 740.974988][T10575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.975008][T10575] RIP: 0033:0x7f443e39f559 [ 740.975024][T10575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.975042][T10575] RSP: 002b:00007f443f246028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 740.975060][T10575] RAX: ffffffffffffffda RBX: 00007f443e625fa0 RCX: 00007f443e39f559 [ 740.975077][T10575] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005 [ 740.975089][T10575] RBP: 00007f443f246090 R08: 0000000000000000 R09: 0000000000000000 [ 740.975100][T10575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.975111][T10575] R13: 00007f443e626038 R14: 00007f443e625fa0 R15: 00007ffdac3c8078 [ 740.975137][T10575] [ 740.975204][T10575] syz.0.1060: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 741.150463][T10575] CPU: 0 UID: 0 PID: 10575 Comm: syz.0.1060 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 741.150490][T10575] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 741.150497][T10575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 741.150509][T10575] Call Trace: [ 741.150516][T10575] [ 741.150524][T10575] dump_stack_lvl+0x100/0x190 [ 741.150554][T10575] warn_alloc.cold+0x9e/0xb2 [ 741.150576][T10575] ? __pfx_warn_alloc+0x10/0x10 [ 741.150593][T10575] ? __kasan_kmalloc+0x8a/0xb0 [ 741.150626][T10575] ? __get_vm_area_node+0x22b/0x350 [ 741.150656][T10575] __vmalloc_node_range_noprof+0xdc6/0x1440 [ 741.150681][T10575] ? __lock_acquire+0x5c0/0x1f40 [ 741.150711][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 741.150740][T10575] ? lock_acquire+0x1d1/0x380 [ 741.150764][T10575] ? find_held_lock+0x2b/0x80 [ 741.150791][T10575] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 741.150817][T10575] ? avc_has_perm_noaudit+0x11e/0x470 [ 741.150844][T10575] ? avc_has_perm_noaudit+0x145/0x470 [ 741.150866][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 741.150893][T10575] __vmalloc_node_noprof+0xad/0xf0 [ 741.150917][T10575] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 741.150948][T10575] __vmalloc_noprof+0xa3/0x120 [ 741.150972][T10575] ? __pfx___vmalloc_noprof+0x10/0x10 [ 741.150999][T10575] ? rcu_is_watching+0x13/0xc0 [ 741.151028][T10575] ? cap_capable+0x107/0x430 [ 741.151052][T10575] bpf_prog_alloc_no_stats+0x59/0x690 [ 741.151085][T10575] ? security_capable+0x80/0x260 [ 741.151109][T10575] bpf_prog_alloc+0x3b/0x200 [ 741.151135][T10575] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 741.151162][T10575] bpf_prog_load+0x135d/0x2ba0 [ 741.151185][T10575] ? avc_has_perm_noaudit+0x11e/0x470 [ 741.151212][T10575] ? __pfx_bpf_prog_load+0x10/0x10 [ 741.151257][T10575] __sys_bpf+0x146f/0x4b60 [ 741.151288][T10575] ? __pfx___sys_bpf+0x10/0x10 [ 741.151312][T10575] ? find_held_lock+0x2b/0x80 [ 741.151339][T10575] ? get_pid_task+0xfc/0x250 [ 741.151364][T10575] ? get_pid_task+0xfc/0x250 [ 741.151397][T10575] ? find_held_lock+0x2b/0x80 [ 741.151429][T10575] ? rcu_read_lock_any_held+0x6a/0x90 [ 741.151448][T10575] ? find_held_lock+0x2b/0x80 [ 741.151474][T10575] ? ksys_write+0x190/0x250 [ 741.151495][T10575] ? ksys_write+0x190/0x250 [ 741.151516][T10575] ? lock_acquire+0x1d1/0x380 [ 741.151554][T10575] ? fput+0x7c/0x100 [ 741.151579][T10575] ? ksys_write+0x1ac/0x250 [ 741.151603][T10575] ? __x64_sys_bpf+0xce/0x140 [ 741.151626][T10575] __x64_sys_bpf+0xce/0x140 [ 741.151651][T10575] ? do_syscall_64+0xae/0x790 [ 741.151678][T10575] do_syscall_64+0x123/0x790 [ 741.151704][T10575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.151723][T10575] RIP: 0033:0x7f443e39f559 [ 741.151737][T10575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.151754][T10575] RSP: 002b:00007f443f246028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 741.151771][T10575] RAX: ffffffffffffffda RBX: 00007f443e625fa0 RCX: 00007f443e39f559 [ 741.151782][T10575] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005 [ 741.151794][T10575] RBP: 00007f443f246090 R08: 0000000000000000 R09: 0000000000000000 [ 741.151805][T10575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 741.151816][T10575] R13: 00007f443e626038 R14: 00007f443e625fa0 R15: 00007ffdac3c8078 [ 741.151840][T10575] [ 741.169179][T10575] Mem-Info: [ 741.169193][T10575] active_anon:70920 inactive_anon:22637 isolated_anon:0 [ 741.169193][T10575] active_file:4975 inactive_file:67171 isolated_file:0 [ 741.169193][T10575] unevictable:0 dirty:180 writeback:0 [ 741.169193][T10575] slab_reclaimable:13280 slab_unreclaimable:100638 [ 741.169193][T10575] mapped:31624 shmem:86708 pagetables:1285 [ 741.169193][T10575] sec_pagetables:0 bounce:0 [ 741.169193][T10575] kernel_misc_reclaimable:0 [ 741.169193][T10575] free:1172157 free_pcp:31109 free_cma:0 [ 741.169236][T10575] Node 0 active_anon:283680kB inactive_anon:90548kB active_file:19900kB inactive_file:268260kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:126360kB dirty:720kB writeback:0kB shmem:346832kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12636kB pagetables:5004kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 741.169283][T10575] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:424kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:136kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 741.169326][T10575] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 741.169375][T10575] lowmem_reserve[]: 0 2448 2450 2450 2450 [ 741.169405][T10575] Node 0 DMA32 free:734456kB boost:0kB min:33788kB low:42232kB high:50676kB reserved_highatomic:0kB free_highatomic:0kB active_anon:283552kB inactive_anon:90548kB active_file:19900kB inactive_file:268260kB unevictable:0kB writepending:720kB zspages:980kB present:3129332kB managed:2507192kB mlocked:0kB bounce:0kB free_pcp:122500kB local_pcp:55828kB free_cma:0kB [ 741.169454][T10575] lowmem_reserve[]: 0 0 1 1 1 [ 741.169483][T10575] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1784kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 741.169528][T10575] lowmem_reserve[]: 0 0 0 0 0 [ 741.169556][T10575] Node 1 Normal free:3938812kB boost:0kB min:56088kB low:70108kB high:84128kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:424kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:2048kB local_pcp:2048kB free_cma:0kB [ 741.169603][T10575] lowmem_reserve[]: 0 0 0 0 0 [ 741.169631][T10575] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 741.169729][T10575] Node 0 DMA32: 626*4kB (UME) 1755*8kB (UM) 826*16kB (UME) 805*32kB (UM) 1135*64kB (UME) 429*128kB (UM) 204*256kB (UM) 67*512kB (UME) 22*1024kB (UM) 12*2048kB (UME) 102*4096kB (UM) = 734496kB [ 741.169870][T10575] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 741.169956][T10575] Node 1 Normal: 3*4kB (M) 6*8kB (UM) 8*16kB (UM) 6*32kB (UM) 8*64kB (UM) 3*128kB (UM) 1*256kB (M) 2*512kB (M) 2*1024kB (UM) 3*2048kB (UM) 959*4096kB (UM) = 3938812kB [ 741.170648][T10575] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 741.170662][T10575] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 741.170675][T10575] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 741.170689][T10575] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 741.170702][T10575] 158750 total pagecache pages [ 741.170708][T10575] 0 pages in swap cache [ 741.170714][T10575] Free swap = 124632kB [ 741.170721][T10575] Total swap = 124996kB [ 741.170728][T10575] 2097051 pages RAM [ 741.170734][T10575] 0 pages HighMem/MovableOnly [ 741.170740][T10575] 438191 pages reserved [ 741.170746][T10575] 0 pages cma reserved [ 741.542076][ T5712] usb 3-1: USB disconnect, device number 33 [ 742.079348][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 742.079390][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 742.222567][T10592] netlink: 'syz.1.1063': attribute type 21 has an invalid length. [ 743.246781][T10599] overlayfs: missing 'workdir' [ 744.037840][ T5630] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 744.038077][ T5630] Bluetooth: hci0: command 0x0c24 tx timeout [ 744.280177][T10580] netlink: 'syz.5.1068': attribute type 16 has an invalid length. [ 744.280199][T10580] netlink: 'syz.5.1068': attribute type 17 has an invalid length. [ 744.331957][T10593] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1068'. [ 744.332094][T10605] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1068'. [ 744.375342][T10580] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.388252][T10580] bridge0: port 2(bridge_slave_1) entered disabled state [ 746.983689][T10625] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 747.689785][ T5837] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 747.841333][ T5837] usb 6-1: Using ep0 maxpacket: 32 [ 747.842343][ T5837] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 747.847332][ T5837] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 747.847366][ T5837] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 747.847431][ T5837] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.855289][ T5722] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 747.955708][ T5837] usb 6-1: config 0 descriptor?? [ 747.974207][ T5837] hub 6-1:0.0: USB hub found [ 748.030804][ T5722] usb 1-1: device descriptor read/64, error -71 [ 748.180922][ T5837] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 748.234074][ T5837] usbhid 6-1:0.0: can't add hid device: -71 [ 748.234386][ T5837] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 748.350056][ T5837] usb 6-1: USB disconnect, device number 24 [ 748.458251][ T5722] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 748.635374][ T5722] usb 1-1: device descriptor read/64, error -71 [ 748.999213][ T5722] usb usb1-port1: attempt power cycle [ 750.026476][ T5722] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 750.119841][ T5722] usb 1-1: device descriptor read/8, error -71 [ 750.656325][T10651] kAFS: No cell specified [ 750.833595][ T30] audit: type=1400 audit(1792904886.578:2319): avc: denied { read } for pid=10627 comm="syz.0.1074" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 750.833640][ T30] audit: type=1400 audit(1792904886.578:2320): avc: denied { open } for pid=10627 comm="syz.0.1074" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 750.833676][ T30] audit: type=1400 audit(1792904886.578:2321): avc: denied { ioctl } for pid=10627 comm="syz.0.1074" path="/dev/nullb0" dev="devtmpfs" ino=694 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 751.085428][ T5722] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 751.174005][ T5722] usb 1-1: device descriptor read/8, error -71 [ 751.277118][ T5722] usb usb1-port1: unable to enumerate USB device [ 751.290849][ T30] audit: type=1400 audit(1792904887.208:2322): avc: denied { read } for pid=10655 comm="syz.1.1087" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 751.291913][ T30] audit: type=1400 audit(1792904887.208:2323): avc: denied { open } for pid=10655 comm="syz.1.1087" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 751.339820][ T30] audit: type=1400 audit(1792904887.258:2324): avc: denied { ioctl } for pid=10655 comm="syz.1.1087" path="/dev/ppp" dev="devtmpfs" ino=708 ioctlcmd=0xc004743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 751.392313][ T30] audit: type=1400 audit(1792904887.308:2325): avc: denied { create } for pid=10655 comm="syz.1.1087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 751.412584][ T30] audit: type=1400 audit(1792904887.308:2326): avc: denied { connect } for pid=10655 comm="syz.1.1087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 751.455014][ T30] audit: type=1400 audit(1792904887.368:2327): avc: denied { write } for pid=10655 comm="syz.1.1087" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 751.601202][ T30] audit: type=1400 audit(1792904887.518:2328): avc: denied { setopt } for pid=10657 comm="syz.5.1082" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 753.168858][T10671] batman_adv: batadv0: Adding interface: syzkaller0 [ 753.168912][T10671] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 753.168948][T10671] batman_adv: batadv0: Interface activated: syzkaller0 [ 753.329780][T10667] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 753.538133][T10667] batman_adv: batadv0: Removing interface: syzkaller0 [ 753.718548][T10674] FAULT_INJECTION: forcing a failure. [ 753.718548][T10674] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 753.718855][T10674] CPU: 1 UID: 0 PID: 10674 Comm: syz.0.1090 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 753.718887][T10674] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 753.718896][T10674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 753.718907][T10674] Call Trace: [ 753.718914][T10674] [ 753.718922][T10674] dump_stack_lvl+0x100/0x190 [ 753.718954][T10674] should_fail_ex.cold+0x5/0xa [ 753.718983][T10674] _copy_to_user+0x32/0xd0 [ 753.719008][T10674] simple_read_from_buffer+0xcb/0x170 [ 753.719038][T10674] proc_fail_nth_read+0x1af/0x230 [ 753.719067][T10674] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 753.719097][T10674] ? rw_verify_area+0xce/0x6d0 [ 753.719117][T10674] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 753.719145][T10674] vfs_read+0x1e4/0xb40 [ 753.719171][T10674] ? __pfx_vfs_read+0x10/0x10 [ 753.719199][T10674] ? __fget_files+0x21f/0x3d0 [ 753.719234][T10674] ksys_read+0x12a/0x250 [ 753.719256][T10674] ? __pfx_ksys_read+0x10/0x10 [ 753.719286][T10674] do_syscall_64+0x123/0x790 [ 753.719316][T10674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 753.719336][T10674] RIP: 0033:0x7f443e35fd8e [ 753.719352][T10674] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 753.719371][T10674] RSP: 002b:00007f443f245fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 753.719389][T10674] RAX: ffffffffffffffda RBX: 00007f443f2466c0 RCX: 00007f443e35fd8e [ 753.719401][T10674] RDX: 000000000000000f RSI: 00007f443f2460a0 RDI: 0000000000000004 [ 753.719413][T10674] RBP: 00007f443f246090 R08: 0000000000000000 R09: 0000000000000000 [ 753.719424][T10674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 753.719435][T10674] R13: 00007f443e626038 R14: 00007f443e625fa0 R15: 00007ffdac3c8078 [ 753.719461][T10674] [ 756.134834][T10679] netlink: 4100 bytes leftover after parsing attributes in process `syz.1.1092'. [ 757.639643][T10699] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1095'. [ 760.430259][T10715] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=10715 comm=syz.3.1101 [ 760.445989][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 760.446005][ T30] audit: type=1400 audit(1792904896.368:2330): avc: denied { ioctl } for pid=10714 comm="syz.3.1101" path="/dev/vhost-net" dev="devtmpfs" ino=1271 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 760.735728][ T5722] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 760.896744][ T5722] usb 4-1: Using ep0 maxpacket: 8 [ 760.898402][ T5722] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 760.900790][ T5722] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 760.900825][ T5722] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.907347][ T5722] usb 4-1: config 0 descriptor?? [ 761.020157][ T30] audit: type=1400 audit(1792904896.938:2331): avc: denied { create } for pid=10722 comm="syz.2.1094" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 761.150362][ T5722] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 761.267137][T10729] netlink: 'syz.0.1102': attribute type 1 has an invalid length. [ 761.361048][T10729] 8021q: adding VLAN 0 to HW filter on device bond2 [ 761.381722][ T30] audit: type=1400 audit(1792904897.298:2332): avc: denied { write } for pid=10714 comm="syz.3.1101" name="iowarrior0" dev="devtmpfs" ino=3237 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 761.467732][T10731] bond2: (slave veth3): Enslaving as an active interface with a down link [ 761.696126][ T30] audit: type=1400 audit(1792904897.618:2333): avc: denied { write } for pid=10743 comm="syz.0.1105" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 761.838532][ T5845] usb 4-1: USB disconnect, device number 40 [ 761.869097][ T30] audit: type=1326 audit(1792904897.788:2334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 761.869294][ T30] audit: type=1326 audit(1792904897.788:2335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 761.871882][ T30] audit: type=1326 audit(1792904897.788:2336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 761.872380][ T30] audit: type=1326 audit(1792904897.788:2337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 761.873212][ T30] audit: type=1326 audit(1792904897.788:2338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 761.873457][ T30] audit: type=1326 audit(1792904897.788:2339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10745 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f443e39f559 code=0x7ffc0000 [ 762.038337][ T5837] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 763.086821][ T5837] usb 2-1: Using ep0 maxpacket: 8 [ 763.087577][ T5837] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 763.088540][ T5837] usb 2-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 763.088586][ T5837] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.794636][T10756] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 763.794998][T10756] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 763.835467][ T5624] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 763.835626][ T5630] Bluetooth: hci0: command 0x0c24 tx timeout [ 764.363401][T10762] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 764.845299][ T5837] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 764.850975][ T8886] usb 2-1: USB disconnect, device number 40 [ 764.925359][ T5845] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 765.010118][ T5837] usb 6-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 765.068739][ T5837] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.068790][ T5837] usb 6-1: Product: syz [ 765.068829][ T5837] usb 6-1: Manufacturer: syz [ 765.068865][ T5837] usb 6-1: SerialNumber: syz [ 765.129001][ T5845] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 765.161482][ T5845] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 765.161633][ T5845] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 765.161665][ T5845] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 765.161779][ T5845] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.215774][ T5837] ums_eneub6250 6-1:1.0: USB Mass Storage device detected [ 765.369411][ T8886] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 765.580139][ T8886] usb 1-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 765.582067][ T8886] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 765.583406][ T8886] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 765.583517][ T8886] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.999009][ T5837] usb 6-1: USB disconnect, device number 25 [ 766.011799][ T5845] cxacru 3-1:1.0: invalid response length to cm 0x90: 32 [ 766.012494][ T8886] idmouse 1-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 766.033232][T10775] cxacru 3-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 766.222958][ T5845] usb 1-1: USB disconnect, device number 41 [ 766.223985][T10778] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1115'. [ 766.242960][ T5845] idmouse 1-1:1.0: disconnected [ 766.326962][ T5837] usb 3-1: USB disconnect, device number 34 [ 766.656485][ T5712] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 766.806021][ T5712] usb 6-1: Using ep0 maxpacket: 16 [ 766.809101][ T5712] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 766.813901][ T5712] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 766.813925][ T5712] usb 6-1: config 0 has no interface number 0 [ 766.813957][ T5712] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 766.813979][ T5712] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 766.874608][ T5712] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 766.874644][ T5712] usb 6-1: Product: syz [ 766.874658][ T5712] usb 6-1: Manufacturer: syz [ 766.874671][ T5712] usb 6-1: SerialNumber: syz [ 766.903981][ T5712] usb 6-1: config 0 descriptor?? [ 766.907145][T10781] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 766.907254][T10781] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 767.045695][ T30] audit: type=1400 audit(1792904902.968:2340): avc: denied { read write } for pid=10788 comm="syz.3.1120" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 767.070868][ T30] audit: type=1400 audit(1792904902.988:2341): avc: denied { open } for pid=10788 comm="syz.3.1120" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 767.139699][T10781] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 767.139771][T10781] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 767.211448][T10796] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 767.455380][ T5712] asix 6-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 768.324047][T10781] FAULT_INJECTION: forcing a failure. [ 768.324047][T10781] name fail_futex, interval 1, probability 0, space 0, times 0 [ 768.324331][T10781] CPU: 1 UID: 60929 PID: 10781 Comm: syz.5.1116 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 768.324361][T10781] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 768.324369][T10781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 768.324380][T10781] Call Trace: [ 768.324388][T10781] [ 768.324396][T10781] dump_stack_lvl+0x100/0x190 [ 768.324430][T10781] should_fail_ex.cold+0x5/0xa [ 768.324454][T10781] ? __sys_setuid+0x29e/0x430 [ 768.324473][T10781] get_futex_key+0x1c9/0x13e0 [ 768.324506][T10781] ? __pfx_get_futex_key+0x10/0x10 [ 768.324535][T10781] ? __lock_acquire+0x5c0/0x1f40 [ 768.324565][T10781] futex_wake+0xf4/0x5e0 [ 768.324592][T10781] ? __pfx_futex_wake+0x10/0x10 [ 768.324614][T10781] ? find_held_lock+0x2b/0x80 [ 768.324651][T10781] do_futex+0x2b2/0x440 [ 768.324672][T10781] ? __pfx_do_futex+0x10/0x10 [ 768.324693][T10781] ? dec_rlimit_ucounts+0x114/0x170 [ 768.324725][T10781] __x64_sys_futex+0x34f/0x4d0 [ 768.324749][T10781] ? __pfx___x64_sys_futex+0x10/0x10 [ 768.324777][T10781] do_syscall_64+0x123/0x790 [ 768.324807][T10781] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.324827][T10781] RIP: 0033:0x7fe50d19f559 [ 768.324843][T10781] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 768.324862][T10781] RSP: 002b:00007fe50dfae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 768.324883][T10781] RAX: ffffffffffffffda RBX: 00007fe50d425fa8 RCX: 00007fe50d19f559 [ 768.324896][T10781] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe50d425fac [ 768.324908][T10781] RBP: 00007fe50d425fa0 R08: 0000000000000001 R09: 0000000000000000 [ 768.324919][T10781] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 768.324931][T10781] R13: 00007fe50d426038 R14: 00007ffce2bca9e0 R15: 00007ffce2bcaac8 [ 768.324958][T10781] [ 768.404732][ T30] audit: type=1400 audit(1792904904.318:2342): avc: denied { create } for pid=10780 comm="syz.5.1116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 768.587468][ T5712] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 768.587486][ T5712] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 768.615426][ T5712] asix 6-1:0.34: probe with driver asix failed with error -71 [ 768.617868][ T5712] usb 6-1: USB disconnect, device number 26 [ 769.828054][T10807] netlink: 'syz.2.1123': attribute type 49 has an invalid length. [ 770.125431][ T8886] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 770.278852][ T8886] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 770.282533][ T8886] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.282668][ T8886] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 770.282702][ T8886] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 770.282742][ T8886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.052163][ T30] audit: type=1400 audit(1792904906.968:2343): avc: denied { name_bind } for pid=10818 comm="syz.0.1129" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 771.189406][ T8886] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 771.189431][ T8886] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 771.189443][ T8886] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 771.190661][ T8886] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 771.227528][ T8886] usb 3-1: USB disconnect, device number 35 [ 771.860363][T10816] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 773.552699][T10831] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 773.974480][ T5845] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 774.085530][ T5837] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 774.127696][ T5845] usb 2-1: Using ep0 maxpacket: 32 [ 774.425365][ T5837] usb 6-1: device not accepting address 27, error -71 [ 775.329659][ T5845] usb 2-1: device descriptor read/all, error -71 [ 777.309214][T10856] FAULT_INJECTION: forcing a failure. [ 777.309214][T10856] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 777.309244][T10856] CPU: 1 UID: 0 PID: 10856 Comm: syz.0.1138 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 777.309271][T10856] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 777.309279][T10856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 777.309290][T10856] Call Trace: [ 777.309297][T10856] [ 777.309305][T10856] dump_stack_lvl+0x100/0x190 [ 777.309336][T10856] should_fail_ex.cold+0x5/0xa [ 777.309363][T10856] _copy_to_user+0x32/0xd0 [ 777.309386][T10856] simple_read_from_buffer+0xcb/0x170 [ 777.309415][T10856] proc_fail_nth_read+0x1af/0x230 [ 777.309444][T10856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 777.309473][T10856] ? rw_verify_area+0xce/0x6d0 [ 777.309493][T10856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 777.309520][T10856] vfs_read+0x1e4/0xb40 [ 777.309542][T10856] ? lock_acquire+0x1d1/0x380 [ 777.309564][T10856] ? __fget_files+0x34/0x3d0 [ 777.309589][T10856] ? __pfx_vfs_read+0x10/0x10 [ 777.309608][T10856] ? find_held_lock+0x2b/0x80 [ 777.309636][T10856] ? __fget_files+0x215/0x3d0 [ 777.309666][T10856] ? __fget_files+0x21f/0x3d0 [ 777.309698][T10856] ksys_read+0x12a/0x250 [ 777.309720][T10856] ? __pfx_ksys_read+0x10/0x10 [ 777.309750][T10856] do_syscall_64+0x123/0x790 [ 777.309779][T10856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.309798][T10856] RIP: 0033:0x7f443e35fd8e [ 777.309814][T10856] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 777.309831][T10856] RSP: 002b:00007f443f245fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 777.309850][T10856] RAX: ffffffffffffffda RBX: 00007f443f2466c0 RCX: 00007f443e35fd8e [ 777.309863][T10856] RDX: 000000000000000f RSI: 00007f443f2460a0 RDI: 0000000000000004 [ 777.309874][T10856] RBP: 00007f443f246090 R08: 0000000000000000 R09: 0000000000000000 [ 777.309886][T10856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 777.309897][T10856] R13: 00007f443e626038 R14: 00007f443e625fa0 R15: 00007ffdac3c8078 [ 777.309924][T10856] [ 780.609220][T10872] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1144'. [ 781.007461][ T30] audit: type=1400 audit(1792904916.928:2344): avc: denied { watch watch_reads } for pid=10873 comm="syz.1.1136" path="/222" dev="tmpfs" ino=1295 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 781.038665][ T30] audit: type=1400 audit(1792904916.958:2345): avc: denied { setopt } for pid=10873 comm="syz.1.1136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 781.569687][ T5845] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 781.577120][ T24] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 781.725350][ T5845] usb 4-1: Using ep0 maxpacket: 8 [ 781.726613][ T5845] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 781.753166][ T24] usb 2-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 781.766668][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 781.766701][ T24] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 781.766771][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.820629][ T5845] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.820690][ T5845] usb 4-1: Product: syz [ 781.820732][ T5845] usb 4-1: Manufacturer: syz [ 781.820767][ T5845] usb 4-1: SerialNumber: syz [ 781.903690][ T5845] usb 4-1: config 0 descriptor?? [ 782.012380][ T5845] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 782.012503][ T24] idmouse 2-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 782.979507][ T5845] gspca_sonixj: reg_r err -110 [ 782.982529][ T5845] sonixj 4-1:0.0: probe with driver sonixj failed with error -110 [ 783.472081][ T24] usb 2-1: USB disconnect, device number 43 [ 783.504567][ T24] idmouse 2-1:1.0: disconnected [ 785.112123][ T1099] rpcbind: server 127.0.0.1 not responding, timed out [ 785.220877][ T9] usb 4-1: USB disconnect, device number 41 [ 785.286505][T10899] netlink: 'syz.1.1149': attribute type 49 has an invalid length. [ 785.334803][ T30] audit: type=1400 audit(1792904921.248:2346): avc: denied { getattr } for pid=10902 comm="syz.2.1143" name="/" dev="failfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 785.826771][ T5845] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 785.979607][ T5845] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 785.980646][ T5845] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 785.980690][ T5845] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 785.980715][ T5845] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 785.980751][ T5845] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.049631][ T24] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 786.245902][ T24] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 786.246977][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 786.247019][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 786.247044][ T24] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 786.247099][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.300410][ T5845] cxacru 6-1:1.0: invalid response length to cm 0x90: 32 [ 786.322707][T10909] cxacru 6-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 786.525319][ T7952] usb 6-1: USB disconnect, device number 29 [ 787.036181][ T24] cxacru 2-1:1.0: send of cm 0x91 failed (-71) [ 787.036205][ T24] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 787.036216][ T24] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 787.041990][ T24] cxacru 2-1:1.0: probe with driver cxacru failed with error -71 [ 787.097441][ T24] usb 2-1: USB disconnect, device number 44 [ 789.808604][ T7952] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 790.219649][ T7952] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 790.221856][ T7952] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 790.222295][ T7952] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 790.222499][ T7952] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 790.222663][ T7952] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.256779][ T30] audit: type=1400 audit(1792904926.128:2347): avc: denied { read } for pid=10938 comm="syz.2.1162" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 790.256917][ T30] audit: type=1400 audit(1792904926.128:2348): avc: denied { open } for pid=10938 comm="syz.2.1162" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 790.601150][T10943] 9pnet_fd: p9_fd_create_unix (10943): problem connecting socket: ./cgroup: -111 [ 790.614821][ T7952] cxacru 2-1:1.0: invalid response length to cm 0x90: 48 [ 790.665561][ T5722] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 790.668357][T10944] cxacru 2-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 790.826251][ T5722] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 790.834400][ T5722] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 790.834431][ T5722] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 790.834540][ T5722] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.050654][ T5722] idmouse 6-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 791.231204][ T30] audit: type=1400 audit(1792904927.138:2349): avc: denied { ioctl } for pid=10938 comm="syz.2.1162" path="/dev/dri/card0" dev="devtmpfs" ino=627 ioctlcmd=0xc0106407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 791.481770][ T7952] usb 2-1: USB disconnect, device number 45 [ 792.536156][ T7952] usb 6-1: USB disconnect, device number 30 [ 792.547498][ T7952] idmouse 6-1:1.0: disconnected [ 792.667166][T10953] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1164'. [ 792.667195][T10953] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1164'. [ 792.669413][T10953] netlink: 'syz.1.1164': attribute type 1 has an invalid length. [ 792.730787][T10953] 8021q: adding VLAN 0 to HW filter on device bond0 [ 792.790950][T10962] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1163'. [ 792.814622][T10953] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1164'. [ 792.852484][T10959] bond0: (slave veth3): Enslaving as an active interface with a down link [ 793.478238][T10969] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1166'. [ 794.545339][T10980] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 794.545358][T10980] audit: out of memory in audit_log_start [ 794.561078][ T30] audit: type=1400 audit(1792904930.478:2350): avc: denied { open } for pid=10979 comm="syz.5.1170" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 794.629919][T10980] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 794.639535][T10980] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 794.676343][T10980] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 794.676435][T10980] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 796.280773][T10980] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 796.280868][T10980] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 796.330764][T10980] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 796.330815][T10980] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 796.349518][T10980] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 796.349571][T10980] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 796.420218][T10988] rxe_eth0 speed is unknown, defaulting to 1000 [ 796.548346][T10980] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 796.635348][ T5624] Bluetooth: hci2: command 0x0406 tx timeout [ 796.665472][ T7952] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 797.173561][T10995] input: syz1 as /devices/virtual/input/input15 [ 797.541844][ T30] audit: type=1400 audit(1792904933.058:2351): avc: denied { ioctl } for pid=10993 comm="syz.5.1175" path="/dev/uinput" dev="devtmpfs" ino=914 ioctlcmd=0x401c5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 797.574183][ T5624] Bluetooth: hci0: command 0x0c24 tx timeout [ 797.641005][ T7952] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 797.645994][ T7952] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 797.646034][ T7952] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 797.646056][ T7952] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 797.646088][ T7952] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.860490][T11000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1171'. [ 797.860588][T11000] netlink: 'syz.2.1171': attribute type 11 has an invalid length. [ 797.860648][T11000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1171'. [ 798.220625][ T7952] cxacru 2-1:1.0: invalid response length to cm 0x90: 56 [ 798.310604][T11004] cxacru 2-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 798.319758][ T5624] Bluetooth: hci3: command 0x0406 tx timeout [ 798.395855][ T5630] Bluetooth: hci4: command 0x0406 tx timeout [ 798.397808][ T5624] Bluetooth: hci6: command 0x0405 tx timeout [ 798.673381][ T7952] usb 2-1: USB disconnect, device number 46 [ 798.715774][ T5624] Bluetooth: hci2: command 0x0406 tx timeout [ 800.298855][ T5624] Bluetooth: hci0: command 0x0c24 tx timeout [ 800.312991][T11014] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 800.315052][T11017] FAULT_INJECTION: forcing a failure. [ 800.315052][T11017] name failslab, interval 1, probability 0, space 0, times 0 [ 800.315078][T11017] CPU: 0 UID: 0 PID: 11017 Comm: syz.2.1177 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 800.315103][T11017] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 800.315109][T11017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 800.315119][T11017] Call Trace: [ 800.315125][T11017] [ 800.315131][T11017] dump_stack_lvl+0x100/0x190 [ 800.315160][T11017] should_fail_ex.cold+0x5/0xa [ 800.315185][T11017] should_failslab+0xc2/0x120 [ 800.315211][T11017] __kmalloc_cache_node_noprof+0x94/0x710 [ 800.315236][T11017] ? __get_vm_area_node+0x124/0x350 [ 800.315262][T11017] __get_vm_area_node+0x124/0x350 [ 800.315284][T11017] ? __pfx___might_resched+0x10/0x10 [ 800.315306][T11017] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 800.315331][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.315357][T11017] ? __lock_acquire+0x5c0/0x1f40 [ 800.315386][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.315415][T11017] ? lock_acquire+0x1d1/0x380 [ 800.315437][T11017] ? find_held_lock+0x2b/0x80 [ 800.315465][T11017] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 800.315489][T11017] ? avc_has_perm_noaudit+0x11e/0x470 [ 800.315515][T11017] ? avc_has_perm_noaudit+0x145/0x470 [ 800.315537][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.315564][T11017] __vmalloc_node_noprof+0xad/0xf0 [ 800.315588][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.315619][T11017] __vmalloc_noprof+0xa3/0x120 [ 800.315643][T11017] ? __pfx___vmalloc_noprof+0x10/0x10 [ 800.315669][T11017] ? rcu_is_watching+0x13/0xc0 [ 800.315697][T11017] ? cap_capable+0x107/0x430 [ 800.315722][T11017] bpf_prog_alloc_no_stats+0x59/0x690 [ 800.315749][T11017] ? security_capable+0x80/0x260 [ 800.315779][T11017] bpf_prog_alloc+0x3b/0x200 [ 800.315806][T11017] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 800.315832][T11017] bpf_prog_load+0x135d/0x2ba0 [ 800.315854][T11017] ? avc_has_perm_noaudit+0x11e/0x470 [ 800.315880][T11017] ? __pfx_bpf_prog_load+0x10/0x10 [ 800.315925][T11017] __sys_bpf+0x146f/0x4b60 [ 800.315955][T11017] ? __pfx___sys_bpf+0x10/0x10 [ 800.315978][T11017] ? find_held_lock+0x2b/0x80 [ 800.316003][T11017] ? get_pid_task+0xfc/0x250 [ 800.316026][T11017] ? get_pid_task+0xfc/0x250 [ 800.316057][T11017] ? find_held_lock+0x2b/0x80 [ 800.316086][T11017] ? rcu_read_lock_any_held+0x6a/0x90 [ 800.316104][T11017] ? find_held_lock+0x2b/0x80 [ 800.316129][T11017] ? ksys_write+0x190/0x250 [ 800.316149][T11017] ? ksys_write+0x190/0x250 [ 800.316190][T11017] ? fput+0x7c/0x100 [ 800.316216][T11017] ? ksys_write+0x1ac/0x250 [ 800.316240][T11017] ? __x64_sys_bpf+0xce/0x140 [ 800.316263][T11017] __x64_sys_bpf+0xce/0x140 [ 800.316288][T11017] ? do_syscall_64+0xae/0x790 [ 800.316316][T11017] do_syscall_64+0x123/0x790 [ 800.316343][T11017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.316362][T11017] RIP: 0033:0x7f8d4459f559 [ 800.316378][T11017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.316396][T11017] RSP: 002b:00007f8d4539e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 800.316415][T11017] RAX: ffffffffffffffda RBX: 00007f8d44826180 RCX: 00007f8d4459f559 [ 800.316427][T11017] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005 [ 800.316438][T11017] RBP: 00007f8d4539e090 R08: 0000000000000000 R09: 0000000000000000 [ 800.316449][T11017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 800.316460][T11017] R13: 00007f8d44826218 R14: 00007f8d44826180 R15: 00007ffcddca0ca8 [ 800.316485][T11017] [ 800.327801][T11017] syz.2.1177: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 800.327855][T11017] CPU: 0 UID: 0 PID: 11017 Comm: syz.2.1177 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 800.327878][T11017] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 800.327885][T11017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 800.327894][T11017] Call Trace: [ 800.327900][T11017] [ 800.327906][T11017] dump_stack_lvl+0x100/0x190 [ 800.327933][T11017] warn_alloc.cold+0x9e/0xb2 [ 800.327952][T11017] ? __pfx_warn_alloc+0x10/0x10 [ 800.327968][T11017] ? __kasan_kmalloc+0x8a/0xb0 [ 800.327996][T11017] ? __get_vm_area_node+0x22b/0x350 [ 800.328022][T11017] __vmalloc_node_range_noprof+0xdc6/0x1440 [ 800.328043][T11017] ? __lock_acquire+0x5c0/0x1f40 [ 800.328070][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.328095][T11017] ? lock_acquire+0x1d1/0x380 [ 800.328115][T11017] ? find_held_lock+0x2b/0x80 [ 800.328138][T11017] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 800.328160][T11017] ? avc_has_perm_noaudit+0x11e/0x470 [ 800.328182][T11017] ? avc_has_perm_noaudit+0x145/0x470 [ 800.328201][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.328225][T11017] __vmalloc_node_noprof+0xad/0xf0 [ 800.328246][T11017] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 800.328272][T11017] __vmalloc_noprof+0xa3/0x120 [ 800.328293][T11017] ? __pfx___vmalloc_noprof+0x10/0x10 [ 800.328316][T11017] ? rcu_is_watching+0x13/0xc0 [ 800.328341][T11017] ? cap_capable+0x107/0x430 [ 800.328362][T11017] bpf_prog_alloc_no_stats+0x59/0x690 [ 800.328385][T11017] ? security_capable+0x80/0x260 [ 800.328407][T11017] bpf_prog_alloc+0x3b/0x200 [ 800.328431][T11017] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 800.328455][T11017] bpf_prog_load+0x135d/0x2ba0 [ 800.328474][T11017] ? avc_has_perm_noaudit+0x11e/0x470 [ 800.328498][T11017] ? __pfx_bpf_prog_load+0x10/0x10 [ 800.328536][T11017] __sys_bpf+0x146f/0x4b60 [ 800.328562][T11017] ? __pfx___sys_bpf+0x10/0x10 [ 800.328583][T11017] ? find_held_lock+0x2b/0x80 [ 800.328605][T11017] ? get_pid_task+0xfc/0x250 [ 800.328625][T11017] ? get_pid_task+0xfc/0x250 [ 800.328653][T11017] ? find_held_lock+0x2b/0x80 [ 800.328681][T11017] ? rcu_read_lock_any_held+0x6a/0x90 [ 800.328696][T11017] ? find_held_lock+0x2b/0x80 [ 800.328719][T11017] ? ksys_write+0x190/0x250 [ 800.328737][T11017] ? ksys_write+0x190/0x250 [ 800.328771][T11017] ? fput+0x7c/0x100 [ 800.328799][T11017] ? ksys_write+0x1ac/0x250 [ 800.328820][T11017] ? __x64_sys_bpf+0xce/0x140 [ 800.328840][T11017] __x64_sys_bpf+0xce/0x140 [ 800.328861][T11017] ? do_syscall_64+0xae/0x790 [ 800.328884][T11017] do_syscall_64+0x123/0x790 [ 800.328907][T11017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.328924][T11017] RIP: 0033:0x7f8d4459f559 [ 800.328938][T11017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.328952][T11017] RSP: 002b:00007f8d4539e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 800.328967][T11017] RAX: ffffffffffffffda RBX: 00007f8d44826180 RCX: 00007f8d4459f559 [ 800.328978][T11017] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005 [ 800.328988][T11017] RBP: 00007f8d4539e090 R08: 0000000000000000 R09: 0000000000000000 [ 800.328998][T11017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 800.329008][T11017] R13: 00007f8d44826218 R14: 00007f8d44826180 R15: 00007ffcddca0ca8 [ 800.329030][T11017] [ 800.329043][T11017] Mem-Info: [ 800.329050][T11017] active_anon:133571 inactive_anon:6266 isolated_anon:0 [ 800.329050][T11017] active_file:4975 inactive_file:67193 isolated_file:0 [ 800.329050][T11017] unevictable:0 dirty:161 writeback:0 [ 800.329050][T11017] slab_reclaimable:13293 slab_unreclaimable:100744 [ 800.329050][T11017] mapped:34360 shmem:132906 pagetables:1379 [ 800.329050][T11017] sec_pagetables:0 bounce:0 [ 800.329050][T11017] kernel_misc_reclaimable:0 [ 800.329050][T11017] free:1136198 free_pcp:20328 free_cma:0 [ 800.329088][T11017] Node 0 active_anon:534284kB inactive_anon:25064kB active_file:19900kB inactive_file:268348kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:137304kB dirty:644kB writeback:0kB shmem:531624kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12672kB pagetables:5380kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 800.329128][T11017] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:424kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:136kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 800.329165][T11017] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 800.329206][T11017] lowmem_reserve[]: 0 2448 2450 2450 2450 [ 800.330703][T11017] Node 0 DMA32 free:588572kB boost:0kB min:33788kB low:42232kB high:50676kB reserved_highatomic:0kB free_highatomic:0kB active_anon:533984kB inactive_anon:25064kB active_file:19900kB inactive_file:268348kB unevictable:0kB writepending:644kB zspages:0kB present:3129332kB managed:2507192kB mlocked:0kB bounce:0kB free_pcp:81680kB local_pcp:29492kB free_cma:0kB [ 800.330747][T11017] lowmem_reserve[]: 0 0 1 1 1 [ 800.330772][T11017] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1784kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 800.330817][T11017] lowmem_reserve[]: 0 0 0 0 0 [ 800.330842][T11017] Node 1 Normal free:3940860kB boost:0kB min:56088kB low:70108kB high:84128kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:424kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 800.330883][T11017] lowmem_reserve[]: 0 0 0 0 0 [ 800.330908][T11017] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 800.330993][T11017] Node 0 DMA32: 2*4kB (ME) 155*8kB (UME) 125*16kB (UME) 71*32kB (UE) 87*64kB (UME) 273*128kB (UME) 205*256kB (UME) 69*512kB (UME) 22*1024kB (UM) 7*2048kB (UME) 102*4096kB (UM) = 588496kB [ 800.331111][T11017] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 800.331183][T11017] Node 1 Normal: 3*4kB (M) 6*8kB (UM) 8*16kB (UM) 6*32kB (UM) 8*64kB (UM) 3*128kB (UM) 1*256kB (M) 2*512kB (M) 2*1024kB (UM) 4*2048kB (UM) 959*4096kB (UM) = 3940860kB [ 800.331302][T11017] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 800.331314][T11017] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 800.331326][T11017] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 800.331337][T11017] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 800.331349][T11017] 204995 total pagecache pages [ 800.331355][T11017] 0 pages in swap cache [ 800.331360][T11017] Free swap = 124996kB [ 800.331365][T11017] Total swap = 124996kB [ 800.331371][T11017] 2097051 pages RAM [ 800.331377][T11017] 0 pages HighMem/MovableOnly [ 800.331382][T11017] 438191 pages reserved [ 800.331388][T11017] 0 pages cma reserved [ 800.371664][T11017] 9pnet_fd: p9_fd_create_unix (11017): problem connecting socket: ./cgroup: -111 [ 800.398912][ T5630] Bluetooth: hci3: command 0x0406 tx timeout [ 800.477146][ T5630] Bluetooth: hci6: command 0x0405 tx timeout [ 800.477177][ T5630] Bluetooth: hci4: command 0x0406 tx timeout [ 800.556719][ T9] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 800.706657][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 800.707178][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 800.708133][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 800.708155][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 800.708185][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 800.731425][ T9] usb 4-1: config 0 descriptor?? [ 800.749718][ T9] hub 4-1:0.0: USB hub found [ 800.952591][ T9] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 800.977094][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 800.977165][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 801.012705][ T9] usb 4-1: USB disconnect, device number 42 [ 801.736802][T11029] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1183'. [ 801.736901][T11029] netlink: 'syz.1.1183': attribute type 11 has an invalid length. [ 801.736932][T11029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1183'. [ 802.328760][ T5624] Bluetooth: hci0: command 0x0c24 tx timeout [ 803.516812][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.516862][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 804.020195][T11044] FAULT_INJECTION: forcing a failure. [ 804.020195][T11044] name failslab, interval 1, probability 0, space 0, times 0 [ 804.020265][T11044] CPU: 0 UID: 0 PID: 11044 Comm: syz.5.1176 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 804.020293][T11044] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 804.020302][T11044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 804.020312][T11044] Call Trace: [ 804.020319][T11044] [ 804.020327][T11044] dump_stack_lvl+0x100/0x190 [ 804.020359][T11044] should_fail_ex.cold+0x5/0xa [ 804.020387][T11044] should_failslab+0xc2/0x120 [ 804.020412][T11044] kmem_cache_alloc_noprof+0x92/0x6a0 [ 804.020435][T11044] ? security_inode_alloc+0x3b/0x2c0 [ 804.020466][T11044] security_inode_alloc+0x3b/0x2c0 [ 804.020492][T11044] inode_init_always_gfp+0xc6f/0xfb0 [ 804.020524][T11044] alloc_inode+0x8e/0x250 [ 804.020546][T11044] sock_alloc+0x42/0x240 [ 804.020568][T11044] __sock_create+0xc2/0x860 [ 804.020594][T11044] __sys_socket+0x14d/0x260 [ 804.020617][T11044] ? fput+0x7c/0x100 [ 804.020643][T11044] ? __pfx___sys_socket+0x10/0x10 [ 804.020671][T11044] ? ksys_write+0x1ac/0x250 [ 804.020693][T11044] ? __pfx_ksys_write+0x10/0x10 [ 804.020720][T11044] __x64_sys_socket+0x72/0xb0 [ 804.020743][T11044] ? lockdep_hardirqs_on+0x7d/0x110 [ 804.020769][T11044] do_syscall_64+0x123/0x790 [ 804.020797][T11044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.020817][T11044] RIP: 0033:0x7fe50d19f559 [ 804.020834][T11044] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.020851][T11044] RSP: 002b:00007fe50df8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 804.020870][T11044] RAX: ffffffffffffffda RBX: 00007fe50d426090 RCX: 00007fe50d19f559 [ 804.020882][T11044] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 000000000000000a [ 804.020893][T11044] RBP: 00007fe50df8d090 R08: 0000000000000000 R09: 0000000000000000 [ 804.020904][T11044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 804.020915][T11044] R13: 00007fe50d426128 R14: 00007fe50d426090 R15: 00007ffce2bcaac8 [ 804.020942][T11044] [ 804.021160][T11044] socket: no more sockets [ 804.805705][ T9] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 804.949716][T11054] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1187'. [ 804.949968][T11054] netlink: 'syz.1.1187': attribute type 11 has an invalid length. [ 804.950014][T11054] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1187'. [ 805.142559][ T9] usb 6-1: device descriptor read/64, error -71 [ 805.794911][ T9] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 805.945465][ T9] usb 6-1: device descriptor read/64, error -71 [ 806.056399][ T9] usb usb6-port1: attempt power cycle [ 812.954679][ T30] audit: type=1400 audit(1792904948.868:2352): avc: denied { create } for pid=11094 comm="syz.0.1188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 813.165329][ T24] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 813.185486][ T29] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 813.225321][ T30] audit: type=1400 audit(1792904949.148:2353): avc: denied { listen } for pid=11098 comm="syz.1.1196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 813.226123][ T30] audit: type=1400 audit(1792904949.148:2354): avc: denied { accept } for pid=11098 comm="syz.1.1196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 813.305296][ T24] usb 3-1: device descriptor read/64, error -71 [ 813.363138][ T29] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 813.364007][ T29] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 813.364049][ T29] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 813.364075][ T29] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 813.364110][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.440538][T11102] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 813.440670][T11102] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 813.440792][T11102] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 813.440917][T11102] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 813.441043][T11102] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 813.545330][ T24] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 813.630509][ T29] cxacru 6-1:1.0: invalid response length to cm 0x90: 56 [ 813.633407][T11113] cxacru 6-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 813.675401][ T24] usb 3-1: device descriptor read/64, error -71 [ 813.785551][ T24] usb usb3-port1: attempt power cycle [ 813.887158][ T29] usb 6-1: USB disconnect, device number 34 [ 814.123810][T11102] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 814.125437][ T24] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 814.146140][ T24] usb 3-1: device descriptor read/8, error -71 [ 814.396853][ T24] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 814.416441][ T24] usb 3-1: device descriptor read/8, error -71 [ 814.525584][ T24] usb usb3-port1: unable to enumerate USB device [ 815.477471][ T5624] Bluetooth: hci2: command 0x0406 tx timeout [ 815.515340][ T5624] Bluetooth: hci6: command 0x0405 tx timeout [ 815.517739][ T5630] Bluetooth: hci3: command 0x0406 tx timeout [ 815.518713][ T5630] Bluetooth: hci0: command 0x0c24 tx timeout [ 815.519706][ T5624] Bluetooth: hci4: command 0x0406 tx timeout [ 816.065285][ T24] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 816.215421][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 816.218007][ T24] usb 2-1: New USB device found, idVendor=2040, idProduct=c612, bcdDevice=e5.51 [ 816.223229][ T24] usb 2-1: config 123 interface 0 has no altsetting 0 [ 816.253942][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.253968][ T24] usb 2-1: Product: syz [ 816.253982][ T24] usb 2-1: Manufacturer: syz [ 816.253996][ T24] usb 2-1: SerialNumber: syz [ 816.632982][ T24] usb 2-1: dvb_usb_v2: found a 'Hauppauge 126xxx' in warm state [ 816.635835][ T29] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 816.739077][ T5845] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 816.798105][ T29] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 816.804185][ T29] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 816.804244][ T29] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 816.804512][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.886398][ T5845] usb 1-1: Using ep0 maxpacket: 8 [ 816.892348][ T5845] usb 1-1: unable to get BOS descriptor or descriptor too short [ 816.892456][ T5845] usb 1-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 816.944654][ T5845] usb 1-1: config 4 interface 0 has no altsetting 0 [ 817.595443][T11130] Bluetooth: hci0: command 0x0c24 tx timeout [ 817.639590][ T24] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 817.641088][ T24] dvbdev: DVB: registering new adapter (Hauppauge 126xxx) [ 817.641273][ T24] usb 2-1: media controller created [ 817.718083][ T5845] usb 1-1: string descriptor 0 read error: -22 [ 817.718358][ T5845] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 817.763531][T11146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.813068][T11146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.845896][ T29] idmouse 6-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 817.848652][ T5845] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 817.851599][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 817.894262][ T5845] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 817.907212][T11146] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI [ 817.919256][T11146] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 817.927641][T11146] CPU: 1 UID: 0 PID: 11146 Comm: syz.1.1204 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 817.938645][T11146] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 817.944414][T11146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 817.954438][T11146] RIP: 0010:__mutex_lock+0x158/0x1c10 [ 817.959788][T11146] Code: 08 84 d2 0f 85 a8 14 00 00 44 8b 0d 42 57 dc 10 45 85 c9 75 29 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8e 14 00 00 48 3b 5b 58 0f 85 88 07 00 00 bf 01 [ 817.979365][T11146] RSP: 0018:ffffc90007b8f4b0 EFLAGS: 00010206 [ 817.985402][T11146] RAX: dffffc0000000000 RBX: 0000000000000068 RCX: 0000000000000001 [ 817.993342][T11146] RDX: 0000000000000018 RSI: ffffffff8e5eca86 RDI: 00000000000000c0 [ 818.001283][T11146] RBP: ffffc90007b8f620 R08: ffffffff884fe6f5 R09: 0000000000000000 [ 818.009228][T11146] R10: ffffc90007b8f638 R11: 0000000000000001 R12: 0000000000000000 [ 818.017180][T11146] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000001 [ 818.025136][T11146] FS: 00007f9346cf66c0(0000) GS:ffff8881225ba000(0000) knlGS:0000000000000000 [ 818.034049][T11146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 818.040621][T11146] CR2: 0000001b33e11ff8 CR3: 0000000076cc1000 CR4: 00000000003526f0 [ 818.048579][T11146] Call Trace: [ 818.051841][T11146] [ 818.054756][T11146] ? dvb_usbv2_generic_write+0x25/0x50 [ 818.060205][T11146] ? __mutex_lock+0x267/0x1c10 [ 818.064954][T11146] ? mxl111sf_ctrl_msg+0xb8/0x2b0 [ 818.069962][T11146] ? __pfx___mutex_lock+0x10/0x10 [ 818.074974][T11146] ? __pfx___mutex_lock+0x10/0x10 [ 818.079987][T11146] ? mxl111sf_i2c_xfer+0x157/0x3240 [ 818.085174][T11146] ? dvb_usbv2_generic_write+0x25/0x50 [ 818.090622][T11146] dvb_usbv2_generic_write+0x25/0x50 [ 818.095911][T11146] mxl111sf_ctrl_msg+0x179/0x2b0 [ 818.100857][T11146] mxl111sf_write_reg+0x96/0x130 [ 818.105779][T11146] ? __pfx_mxl111sf_write_reg+0x10/0x10 [ 818.111306][T11146] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 818.117097][T11146] ? stack_depot_save_flags+0x49a/0x9f0 [ 818.122628][T11146] mxl111sf_i2c_start+0x6e/0x220 [ 818.127548][T11146] mxl111sf_i2c_xfer+0x178e/0x3240 [ 818.132645][T11146] ? kmem_cache_free+0x5a0/0x6c0 [ 818.137562][T11146] ? i2c_smbus_xfer_emulated+0xa14/0x1110 [ 818.143264][T11146] ? i2cdev_ioctl_smbus+0x233/0xac0 [ 818.148447][T11146] ? i2cdev_ioctl+0x3cf/0x830 [ 818.153106][T11146] ? __x64_sys_ioctl+0x18e/0x210 [ 818.158023][T11146] ? do_syscall_64+0x123/0x790 [ 818.162769][T11146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.168817][T11146] ? __pfx_mxl111sf_i2c_xfer+0x10/0x10 [ 818.174269][T11146] __i2c_transfer+0x5d4/0x1740 [ 818.179012][T11146] ? __pfx___i2c_transfer+0x10/0x10 [ 818.184190][T11146] i2c_smbus_xfer_emulated+0x235/0x1110 [ 818.189727][T11146] ? __pfx_i2c_smbus_xfer_emulated+0x10/0x10 [ 818.195706][T11146] ? __lock_acquire+0x5c0/0x1f40 [ 818.200633][T11146] __i2c_smbus_xfer+0x612/0x10f0 [ 818.205559][T11146] ? mark_held_locks+0x40/0x70 [ 818.210312][T11146] ? lockdep_hardirqs_on+0x7d/0x110 [ 818.215497][T11146] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 818.220857][T11146] ? rt_mutex_slowtrylock+0x93/0x100 [ 818.226120][T11146] i2c_smbus_xfer+0x17e/0x3c0 [ 818.230781][T11146] i2cdev_ioctl_smbus+0x233/0xac0 [ 818.235793][T11146] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 818.241323][T11146] ? __might_fault+0xc5/0x140 [ 818.245986][T11146] ? __might_fault+0xc5/0x140 [ 818.250659][T11146] i2cdev_ioctl+0x3cf/0x830 [ 818.255161][T11146] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 818.260174][T11146] ? selinux_file_ioctl+0x1e7/0x290 [ 818.265367][T11146] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 818.270395][T11146] __x64_sys_ioctl+0x18e/0x210 [ 818.275148][T11146] do_syscall_64+0x123/0x790 [ 818.279725][T11146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.285598][T11146] RIP: 0033:0x7f9345d9f559 [ 818.289994][T11146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.309583][T11146] RSP: 002b:00007f9346cf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 818.317981][T11146] RAX: ffffffffffffffda RBX: 00007f9346026090 RCX: 00007f9345d9f559 [ 818.325933][T11146] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000006 [ 818.333891][T11146] RBP: 00007f9345e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 818.341844][T11146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.349800][T11146] R13: 00007f9346026128 R14: 00007f9346026090 R15: 00007fff70002788 [ 818.357764][T11146] [ 818.360761][T11146] Modules linked in: [ 818.365059][T11146] ---[ end trace 0000000000000000 ]--- [ 818.508657][ T5845] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 818.508689][ T5845] usb 1-1: media controller created [ 818.534301][ T5845] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 818.579692][T11146] RIP: 0010:__mutex_lock+0x158/0x1c10 [ 818.579730][T11146] Code: 08 84 d2 0f 85 a8 14 00 00 44 8b 0d 42 57 dc 10 45 85 c9 75 29 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8e 14 00 00 48 3b 5b 58 0f 85 88 07 00 00 bf 01 [ 818.579748][T11146] RSP: 0018:ffffc90007b8f4b0 EFLAGS: 00010206 [ 818.579764][T11146] RAX: dffffc0000000000 RBX: 0000000000000068 RCX: 0000000000000001 [ 818.579776][T11146] RDX: 0000000000000018 RSI: ffffffff8e5eca86 RDI: 00000000000000c0 [ 818.579786][T11146] RBP: ffffc90007b8f620 R08: ffffffff884fe6f5 R09: 0000000000000000 [ 818.579837][T11146] R10: ffffc90007b8f638 R11: 0000000000000001 R12: 0000000000000000 [ 818.579848][T11146] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000001 [ 818.579860][T11146] FS: 00007f9346cf66c0(0000) GS:ffff8881225ba000(0000) knlGS:0000000000000000 [ 818.579877][T11146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 818.579888][T11146] CR2: 00007f8d44825fac CR3: 0000000076cc1000 CR4: 00000000003526f0 [ 818.579901][T11146] Kernel panic - not syncing: Fatal exception [ 818.680198][T11146] Kernel Offset: disabled [ 818.684500][T11146] Rebooting in 86400 seconds..