last executing test programs: 5m20.253648497s ago: executing program 0 (id=2094): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x20, 0x14, 0x509, 0x70bd2c, 0x25dfdbfd, {0x2, 0x20, 0x0, 0xcb, r2}, [@IFA_LOCAL={0x8, 0x2, @remote}]}, 0x20}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f0000000900)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000280)='Q', 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e23, 0xa2cc, @local, 0xf}, 0x1c, &(0x7f0000000880)=[{&(0x7f0000000080)='\\', 0x1}], 0x1}}], 0x2, 0x4000840) shutdown(r3, 0x1) syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) preadv(r4, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/40, 0x28}], 0x1, 0x2, 0x9c) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000980)={0x0, 0x5}, &(0x7f00000009c0)=0x8) 5m17.170193007s ago: executing program 0 (id=2111): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffffffe}, [@alu={0x4, 0x0, 0xd, 0xa, 0x0, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x4}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000ff7f00000000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000a4000000060a01020000000000000000fe00000708000a40000000020900010073797a300000000008000940000000020900020073797a3100000000480004801c0001800c00010062697477697365000c000280080002400000000c2800018007000100637400001c0002800800024000000015080004400000000f080002400000000c08000940000000030c00034000000000000000020c0006400000000000000002140000001100010000000000000000000700000a"], 0x118}}, 0x0) 5m17.053474313s ago: executing program 0 (id=2112): openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r2, 0x0, 0x0, 0xfff, 0x0) read$msr(r2, &(0x7f0000000180)=""/144, 0x90) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x28, 0x8001, 0x4, 0x9, 0x0, 0xeffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) socket$l2tp6(0xa, 0x2, 0x73) (async) socket$l2tp6(0xa, 0x2, 0x73) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000200)={0x1, 0x9, 0x4, 0x7, 0xe, 0x6, 0x6, 0x5, 0x9, 0x4, 0x9, 0x8, 0x5, 0x7}, 0xe) (async) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000200)={0x1, 0x9, 0x4, 0x7, 0xe, 0x6, 0x6, 0x5, 0x9, 0x4, 0x9, 0x8, 0x5, 0x7}, 0xe) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) clock_adjtime(0x0, &(0x7f0000000100)={0x362, 0x6a, 0x55cd, 0x8000000000000001, 0x48c, 0x5, 0xd, 0x424, 0x2, 0xffffffffffffffff, 0xf423f, 0xfffffffffffffff9, 0x4, 0x2, 0x1000000081, 0x5, 0xfffffffffffffffe, 0x5, 0x8, 0x9220000000000000, 0x3, 0x0, 0x80000001, 0x0, 0x5, 0x7}) (async) clock_adjtime(0x0, &(0x7f0000000100)={0x362, 0x6a, 0x55cd, 0x8000000000000001, 0x48c, 0x5, 0xd, 0x424, 0x2, 0xffffffffffffffff, 0xf423f, 0xfffffffffffffff9, 0x4, 0x2, 0x1000000081, 0x5, 0xfffffffffffffffe, 0x5, 0x8, 0x9220000000000000, 0x3, 0x0, 0x80000001, 0x0, 0x5, 0x7}) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) (async) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() (async) munlockall() syz_open_dev$sndmidi(0x0, 0x2, 0x141101) (async) r4 = syz_open_dev$sndmidi(0x0, 0x2, 0x141101) dup(r4) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='1', 0x1) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x8a}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f000010d000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0c000000040000040400000001800020fea798004aa923edc8000000", @ANYRES32=r6, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000feffffff00"/28], 0x50) 5m16.101309161s ago: executing program 0 (id=2113): r0 = syz_open_dev$cec(&(0x7f0000000340), 0x0, 0x0) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) ioctl$IOC_PR_PREEMPT(r0, 0x40046109, &(0x7f0000000040)={0xd0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) getsockopt(r3, 0x111, 0x6, 0x0, &(0x7f0000000080)) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x16, 0x0, 0x4, 0x8001, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r6}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r7}, 0x10) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r8, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) 5m14.582853088s ago: executing program 0 (id=2121): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f00000004c0)={{0x1, 0x1, 0xffffffffffffff75, r1, {0x8000009}}, './cgroup/../file0/../file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) openat$cgroup(r3, &(0x7f0000000440)='syz1\x00', 0x200002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32, @ANYBLOB="08000100", @ANYRES32], 0x90}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5m14.111075445s ago: executing program 0 (id=2125): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r0, 0x0) 5m12.965119769s ago: executing program 32 (id=2125): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r0, 0x0) 4m57.547091118s ago: executing program 1 (id=2168): socket$alg(0x26, 0x5, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x580, 0x0) getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) ftruncate(r3, 0x2007ffc) sendfile(r3, r3, 0x0, 0x800000009) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000002480)=[{0x0}], 0x1}, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x3) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000009, 0x8012, r0, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000d76000/0x1000)=nil) 4m55.945888829s ago: executing program 1 (id=2171): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000780)='devpts\x00', 0x0, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}, {0x0}], 0x2}, 0x2000) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x1a9041, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000100013070000000000000000fc020000000000000000000000000000fe8000000000000000000000000000100004000000000000000000202c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe"], 0xf0}, 0x1, 0xe}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 4m54.329995596s ago: executing program 1 (id=2175): open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, r3, {0x7, 0x1f, 0xffffc000, 0x8000}}, 0x50) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r6 = dup(r5) write$FUSE_BMAP(r6, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r6, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) dup3(r7, r0, 0x0) r8 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0x21, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r8, 0x3516, 0x0, 0x0, 0x0, 0x0) 4m49.440084637s ago: executing program 1 (id=2184): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c1) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x2a05004, 0x0) mlockall(0x7) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) recvmmsg(r1, &(0x7f0000001840)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001400)=""/92, 0x5c}], 0x1, 0x0, 0x49a508c7bdd7a516}}], 0x1, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x10, 0x0, &(0x7f0000000000)=[@enter_looper, @free_buffer], 0xf7, 0x0, &(0x7f0000000180)="6e1d96f3d907275f07a49d9d3fd6e0b91fbd4a7dfbc92e06cd3a4b6151c5bc5618089291590f951ff8b7798043824708b24ab55b2ecccd8d6b02b737d797634d07c986f04039144a6249227380dee749cf3026f23e2d151b1e74168a75bd87babef46e0c2a86c53dc2a3781a7a6a8b1296c3cbb882e514e0c856b5f84915fa931c675334f8cc8ad6f147b20837fc1b03796b7078b77664f921d2672f95be1a89c4419930ea6f548ba659a5036718f82ad00e8417966132ba85973edf00f8b51aaa6222cbff1db831afa168df0fafbfdf466c29613100fee4cd6005ef238aec5d05ff0c1a0273519755642dd14a9ac13efde040b6b4b94b"}) syz_usb_connect(0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000003700)=[{{&(0x7f0000000380)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000840)=[{&(0x7f0000000400)="9e52e90689cbab55f5b66b9b2e304bc3dc86d7c70b53b3f9406f56b788147163151463905a900033024419dd54bbf4696120b2c56d4ad47d719b0f08052eb678ca34b11d8165ef8df037db07b1d02933bdc73f0e440b066ae2f75555174ae46fd7179b418bde4ac5a13fc907d6ec8eeac9277b523abe9de17b3290a9c43c8c2f2d96191133ff4186bb0781ad7f9040c5bf2da6be65cf94658579cfbc6a38f50235fa97cfbd61a8d2ee7358", 0xab}, {&(0x7f00000004c0)="36e0d66114dce1afd56c5d8fb9179584107669f414fa3a2bedc4889631d6ab31893785f8a3fa2ce7fece4aa0915e2079106873a2e3ccce43794cfa50ad77397becfd05b17b50055c23724799ac033bd14bf6912f326a1b20b88f930955d931890fe32509defb9c4c9664d8dbca4b6384", 0x70}, {&(0x7f0000000540)="f1816ae372a7e8f10df92da8d0", 0xd}, {&(0x7f0000000580)="11306609c60178eb79a912ff262224fe203b3b89afe30468e1ef9aae5ed3b9e0e22ddced90ea06235269958d490e0833b57d5ab8a62dd26affb08604b9b3c47e87d67b87f807acf7a13daed437f17e0d5314d85839cbb8e4ee8328ff29695d7ac858570e1340f73a74523f124b32f82d7b08812d649f3b12cf5eb9553a43551119770bcff3f46a80546cff7c88f7e2e68b01ef863461b20ea436", 0x9a}, {&(0x7f0000000640)="3a20f6fc5d26d83f239a9f3156639d9236cb56c92a0cd87055dee5f8f32ecc3dcc26c6", 0x23}, {&(0x7f0000000680)="ddae57e67cce3979107c12773128746ddbf4bee8fd5961f6c951e97a4e345055c54e4f3e2b4abc", 0x27}, {&(0x7f00000006c0)="cc853f17837b450f686b28a99042a49421f0c48cb8fa5d3f2dbe811ee42bf73355990ea2475b6289ce6d0fd39706476b4294cfaf7d67850c176695044fd531770a720ccae9b6a799e6e0bc8fed98c6d90cea8f0b7d88ae6c9f6e41c1b7399a761cc8d8e217310b872c09f1107f9269c8a0539ec01882222cb73c54f3f78956b5a134912ce5d9bdfea0312f157c040f3c7eefc06d8a4d8d33ce8133682576043aa91b6cac5a02e91ab996a94a5c42eb0b72c10a61dd3cae2416dde59f4efb3f005367b6100d912619c5dea220ded5f4dd57f5f9fd878fdc6cd6db57b5b55d67c13f01215e1bae8986", 0xe8}, {&(0x7f00000007c0)="d50229ea475de9d84505561db1601c77b670f67adac8526f632f8a80b213d7d55d2067017120517ee211af6343ddb30cba07b1bbb4fd9592a858873dd78b280e2e951ea7e4305b4b8af24db785fb1606bcd6d3d89261d3c302", 0x59}], 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r3, @ANYRES32, @ANYRES32=r4, @ANYRES32=r1, @ANYBLOB="300000000000a50000fffa0001000000", @ANYRES32, @ANYRES32=r3, @ANYRES32=r0, @ANYRES32=r4, @ANYRES32=r3, @ANYRES32, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYRES32=r4, @ANYRES32=r0, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r4], 0x100, 0x8004}}, {{&(0x7f0000000c80)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001200)=[{&(0x7f0000000f00)="8aef007c5b73298fa7e0bf81ed05e5fb06d68e7c5ac3c0419890cf942bf21e2e649ccc7aa3990c95fd221c1b658cf44a609376a942c9f3e11a12134eea93fa048971aa42fcf1b51f01270ab00dc36fb6eea8a0598d9ed3f15aef71fb44974e8b032010acf9dc60dfefa50234f28b005d4eb134f3359a6e3bdaef3c3f32ab663dc2ba9756acd24c0832e3edbba3b4e4c487ce7c92bc93e4a21ba7065a2fb769c4e50025cd6b273f292cb8e91958193630946351ac58abddbd513e329e14be48d15851cb65bd246a047dd71d650a43bd250b977fa27d30d4e32bb6c707bcac0f04634832c61b86b59da49451779bfdde2da8d94d7d3e1148e122d8d16dfb1188", 0xff}, {&(0x7f0000001000)="f5d0e9b8a81637c2687bc43333fadfbc9cc6bab38c818c58f8ad8e183048bc2817b27e30f45de3c0e933b72e72a5c80e46c8c6fb557531f5dd5ecbfb18ac4a01", 0x40}, {&(0x7f0000001040)="03ac4b7902048ee9005c0f1e44ac42d07766fc028dc70718d5239dcd0c8f68d9208a5092ce6a75df5bf58ee5c9bac4ea6951f0f8ea9b1b268cd9f3c865782aae01cfee3fe94f04ae7e2f829edffc8cb3179abe0af770e8f07160d6956f7c2259c9a2da276503fb80efef405ad81010fc0e25d79bbade4fed94779ee2cd2b60e12d2b6751a22271940e6467ceef07d492d54a5bb39a9975000f9bbfb83ec845e59a0793594cf036eb0f5350e6b958e61ac547884a36ad1ac2abc3293930352e742ea7e8737d80e0", 0xc7}, {&(0x7f0000001140)="91ea48af5f93", 0x6}, {&(0x7f00000008c0)="2641bddec68103b3764c7ec6d546e53920d52e7487f2c063454055081e6adb34700be95aa08b49feca6250104e473db8f818fa65a3f4b4fcc3bef6c38a1b0072a7d9a6aaab4639446c2cd3f7d2397e00000000000000b60065d978d66240c1db3aa8ffe77d1fc108b6fa070eddc20eb50cfdd129745c88ea0000", 0x7a}], 0x5, &(0x7f0000000940)=ANY=[@ANYBLOB="00000200"/16, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32], 0x38, 0x8c1}}, {{&(0x7f0000001480)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000029c0)=[{&(0x7f0000001500)="1557779ab8a04a7d24b0d4d1fcac4670a0c0fae9865341b493ad39b1734ba9db74525b9cce51ee8ad4dfaa5005d8ed92d6118f10175b3d094e596d6e5e3e1183488317ca5af1660ec836562731ef5e4f4192fa09825db2a0da927db894a11cd91724d0b53e2c0a2eabc658ba8ab3c45209e49c3d5a4175297ea0a1b3d75acd4eb35677556bc1e42587ecadb14986e4f5c3667d9a31cd46d871191490d9016fedc3da08e85ff8a3b65858d7729e5ea3b63c459154ecead57ee0d0bd22b2c73136dc89fee61eafa11f745d32ca5c9d7545ef4e7403addf0f395086aad51f1f3a29a8fa0c1b205aa702", 0xe8}, {&(0x7f0000001640)="5fde7d0c035b18aa05045d155d6b1c1eb4fb675028544395d730f3274c1556d31650ada5ed85fc405e16cd0e830dd801ad4977e5859402db5bf57511f6f444", 0x3f}, {&(0x7f0000001680)="8ff9bb2f0fcbc250ad1a2660f83781e06228fa29d593c0bb37839738da5ca91adf26fa834333318bbbabb9d27e3c6be612cb90acf39c3e3df31b855e143cfba55502968f98d5ae5c463cd7cdd337ce9bf0dfd5a4ef1a84a2203fb86e294977236d9f980207423728f5910de24c366f2772191c4413efceb5a557ed384f07a4503c09bef328b36d8e6252874d98907a24bff104531536d2d75f6d0f0ad1299feeb7fc4ea191ef81346e176b635bd2f36c37b1e0", 0xb3}, {&(0x7f0000001740)="092fb5509cb22807e5e79cc1e6c83b28e6331558294de4d6aef0375b732e23b1949fdd449b64fd0c6e45fd5f473f4213526ac077a3fc992ae15042948d43e58a07aec6a293ba3118861987e010", 0x4d}, {&(0x7f00000017c0)="3e4650a37532f342470415414d34e7494e68be19b14dde8975730b2e09accff27058fd0250abbdaf9e4897c73c51fbddecd2d639d06aa65038182c826c51a7dd23927ea8af3398c5b0474f3077e9eb35a3ff4ad011b678243ca78883b5e6340032e0df", 0x63}, {&(0x7f0000002800)="dc98a8b534f0e71c19d29d288e045a4438", 0x11}, {&(0x7f0000002840)="85c25baf3f1d712c67463180b5079b456d1520e3c4def1999891fd4ea6521a2ee911fae9f05391144c88ebafab8500fabb06b0a419e75b4318949e57110c1c7a512d74476eaf7fd7758dc1b6c6b8e1e6578a85c0d12387dfd7cbb082255775", 0x5f}, {&(0x7f00000028c0)="97b8c0789e7f745c246b2120be3577343cd03d2831020bdfec002f64867ec68784dbb8e838e7bd00f21a640737a654b1890bb15a8498ee53e374725221c411199d66deed4eac7d1c84ce6b9284ddc334834c41a62364804918a67fd3004bed844d39925af3b9e05a46a96b5399b0fdb1176e2c02d298a4759cf401ea793f400a6086b5ad85511a713109edf9049fcf83ac8b7af5bc69647662686e86b287dc2e742a4f4a5e58d447d6d980a45b792a156f4f4b7e5a6547eda446bcb1adf04703a5b9b9723a38d6705ed18575ee0b0dbeb6ea0474f5b25305f715f923a86d995408b8e7501051d52576eb8d81338e", 0xee}], 0x8, &(0x7f0000002a40)=[@rights={{0x14, 0x1, 0x1, [r1]}}], 0x18, 0x20008000}}, {{&(0x7f0000002a80)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002e40), 0x0, &(0x7f0000002b00)=ANY=[@ANYBLOB="280000000000040000000000000000000a99dfdc060165dda10d0c1c571dfc0e1bd9656a90dbe541e030a842a8b1de5983e272c6c7969cab27df600cbbf6372db74619fb743af9a483abe7e7fe7abc445483f9b06a809e54eccf0e6bcfaf1302d8f24c342ac52bc9a2705ff09c4a6d6f1a1f8532e12f76e823dadef5b758770b3cffd692b5bd12fa03388dc9cf10bfc56899d8b1d9a178db3a702843ef45136907beefe14eed5efc6730bbda381f517875ea0977a4a502af1574712f3c5bdbbd656f93f7d2e73f244d059e398202cc0058f902fed5c51746091b4ac68b556daa864f36e10eefd54b1fd039b40c4d602de4e5e48ecc0f3ad88cc11660839af76cb21cb32fb9997ed4831f3b06c881d2344a345ec9ab01d52b2b430000000000", @ANYRES32, @ANYRES32, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYRES32=r1, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r4, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130, 0x10}}, {{&(0x7f00000031c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003440)=[{&(0x7f0000003240)="9ffefb585ad89b1beef2c1356cfb115b9500b08b5cdd970c977096e43a59286836d09776417498ce367f52680a6bcbd20e41838239fa3b00a349c036629c6cbe5e64c84ba529cfee493e21f6893e3fa16aeac2b39be3703958208b8dc81f6d6058d90cad7e2fa97f1ce43b5b5cfe174c4b9c04815a", 0x75}, {&(0x7f000000c280)="463eb36f89e340d4b238db3a3d1be7078e852c0dcf5649b2c236dd032f0d3cc7d51e2805e8e1bc1b313efe773a3a099c40ded7a16c1644ec08f956ca99b4205568aa1bf8161dbb07d53b23a5803f17bff516372f5f575bd01bc8d9e29ccfbcefe1d9fc4423e46fe9948c90c9c9a494fe67b385ad703b2ea85839c08f5342b590fb831be240ce0c59a53e0a30dd224702690b39ddcd67a1c09c3346f6ad7a99850a4cef58800809c724c1f120c1459f6061bee2f5107ca99f63cc03b5286d3b10d995e2662d28b531943bbf7b63354f83df63f9b28043aa8dbcf02923a09b3e13af1732954ef555d0937e8e6c6de6ed1f08aaad3121115e0ee004c88b30fe3dbc8be5419943b99d3d8fbc45b45e8cefbac6fadcd3dfcc7560d5ad6440e07c06fbd805a4c2924513a007957c88de908a237a4be190a047d0c67046888d4d90fee027652669c65b2ccfae25f58e69f589c890d6b0b0c1b82e15a58b9b026340c5f9c3403aa697b832e42b0920cf443d5ba8045c8ee5db4564b4384431a2c39b7f2bbcdb11b8db49cb90723baa36fa2baa6420994f24b8b2c04db9e08566a578b94dc2d45890196434bf0d9e4aa8a77b710f001f947d74e42fe4b1400b52a08564433eec0cf73b61806d99caa795b0ab5a156433090b4d7b49f9b576fda6650668d5043b7bf550ccb84a8bb84984fb3cb62c05704c9f906051ead0440aea4a04f284909f8ee88b4a7995df777b0900c9cc733cdd4d4c050f8bab7f123e7fae9a8c930387313f704b8ad4c49df9096ab06b503afafb2d01d2e77d8bca48176c4fcae34305d9a9af0da829a07df307bcf70f1ac562c18367dea8776bb3a650a90101d00643453994028de14d81c5d81e4a47537fef4d09fce16af51a090c50dd810531c72d6277c6986196f337bb6cddcd37bf0a947d7dce2035d389c80643eb1a80120e3b91664174ba9588dd8606a6bc38ae64f903b7e774345088e680e777636b52e9fd64b762e3cec471420ad5f63584cbf6c39a7d336a09d8a6595afbd7663c56987f164ada59d5ef38c0a7dbc9ac08d2e13d18495df18c547dd1aef7fe95c2c079f4c9cda79a2775acc265cb30e965534272959f6435eadc61e32da4773cd9a6081e447a74bb4020e63f8da1b4fd1d6bf6fd39b1821bd946c5eec19aa4a8c41a676d8f4a2256a27afc1937b6fd596ed28df137faba0e1c892d68092405f9b49aff07fc043d041b3733b16705dc98bbc7cae31725050962628fb1c1a6542546205923b2df4f0f81728b9791ebe068a4807ca8bd02be975fd2dd7bc409fcdbae5e2430fd43d9faefe4f97f576f3974e211e8beec531e70895f2123dfea466bb6fbee9ea09b6f1a596059a8b6c424d30c6fae78e240fdc7980708a3e4ce70766141a7087b76c7fefa7b145090542681ca5cefe7a4cefc9aa68fd0bd274c5382facba639cd32ad91b199f2c87955736fa5c2e00d723db2d77fd9b6b8140551942da3404f6ad100e5a283a70878dd4fd1513eda112a92f6beb5f696e4e6f3a71dd321a671f3897d3a6664fe0e73bcd75ad5c98bb40d1faa734172be060482baefddff721bd9c34534a3fb01a9710aedd26df0784d530214c9b09b497130159f682bbf4ffc2388718fde270088bb2c57c075811a5450b3b1368d0d3cd3affe3aab4be88655516d1067c0004fd08381000bf673c1e5b4652182715b97a0cf00703a44e9542ef88055ac52d7e0e7fbfe348ebf36eb3ca79c7cda0f746966f893452a04d49d11efa8d95e5d8b3ec40fc29ba7356bd624864a96fcd284441a947b6fa794d898814de643b72f2f6c56c3cd088b315ec5aaf0b5a7e1e2398073aff1b9dec18ebf45c4d521819cf01bc08d0a3bd6602367dbcd9d3b0abd48dd01044f438c27e9bef05c04ecccadedb63dbfafa0b0efb45fbfbb507b0a8fe336ad067152991b4ebe5582b4bad2e9ed3423d2346c2043207107ba3df92f1005df2e4de946c779750fbdc7c8bd55e996dad713e513bdd421bc89ada5a44ad6a315c1225fd41bdadcefa99f730a53b08a277489ac58a97dd9d9bd4f0c7b2cf0ee6859f5897bb4a6f67abeeaf1693db9a50cfea6ac982c020fcd6c53fd8ab80ee189a28e50237bae18599e1bf6acfe4c9a0cfb51d9fbeaab817c5a13ad4039313a0703ce0b9e49065a9cd468604486e0cc039c89cdf052b87d9784d56c57cd1651524c400a39bf8720fc654560cf00423ce23738d4c5c64e7006a185c29db988a594008efe809c18082ce251949c3686d1996d552ad10de817d062bf589e935b7eaadd8913329a7b95ed2cf168e22ca482acb00279e1f75bfc5b3192358c39ac9fa6492924c999c3846fdcd8bb239bb3b70e570c9dba97055387394fbe86724b807bc1cbbb03e6df7b93af122be00aafd5b1887ef9baa9e56590fcc94ae74bc66e912cf6449c35a8f0f5b38195401f28f197da63e25be8a51e43cdc0ffba19d903163d144614c3eb510bf1f5c48d68df0e6944cfe51099fdc86daa52cd2c3a0c896ebbf98b8447d231d6cec823150039810b8a85cf1695bdc74050398ae2b6e1786cd39cfa08343c0dab8f042b18a9a4f7384e4b7598f8f5735ca402c23ade75aba3dbca7efeca9aeb81f54a5f20fa44c769a3c32aa6b608ef2db22ce8906ebbcbec2de8c4d266e681981e480210cec2c8d46eab929f63f94040dde2994ac56625f55ba1bc57a3861b412007b3b6292ac75f335364fb2abc2b5f3c7914c5e0e490b812a65029e280c344e33e3c8a345f02bd3b706b6cf29a3e3a4e008e366feee582b7fad093d6f8a4bb13b1831dd038fb9163616264e0561af7aff17ac451250720e5c3a9a9d45eb4dc0b957e54a4b0b4db2a232703e9e5a7dab996990f640bf5d08ca4a300eb75ec720c1e5c20ddc434fef86751350220acef26db435005eea1da00140084bd8c37862b42a3c79c5bee77137f35260a440a7aff8c8fe3278a2d9ac79e6ef146104f11789baec1877981a7f4b4c668a94b174594a38a9852354ccb38af6174ac10a4c39513716e713abe6775fbd9178ae37d056e8b9fcf272014141578e4522683f6a6863eb1998c01485c2d2f6783a6138cbdc7e2a46d3fcebec8ed32d4011332e80eb0d0164b4bb27dfd0e3d785e12fa5126043cddcfe6b20adf474ea206e788876b2cb7e2badbf19a958531dbc7eed354d54d483ebcc970de44ba882afc2864c5f6d06b14167709335f2c827e41af28e6ee2cca1cf1a0242b75a6e5260ee2647857ede577a3be39bd7d4e865f4de65106e83b5705a7e74b5560f43c0487ddf2156070bb1c6379f7867c3ee36fe829dccf05472afdbca19f722b8b5994f8125c50fb6fc41af7c235f47269acaf08ee0f7df96345c7e8ce11e73da080390e3bdb21e60eb8b98bd1d340d75007c6f7317451f5fd1ff5284feaa7910370030d53988f0c0a99a349741e5962608b11dd479ae09aa84979900f38a42327ab2e311e9195820826039fb10737628b17d88b09025f9b3a98618406169eabe6d30fde449393706f064cac91ae87788bdaed050028c8654dc502a72001e7f53742897e4d0a1574dd01fe67e691cf12981f8355b854c30170e530f5fb07c245067dac60c1736dc92d68545150a3e267e5125119a8209ec7577b1ce692a3bc75781e1935468a0c1999bf74d6e0e2ddb9c157a1e4ddf8eac551eb806d8881176c3fe78c4447deb8db9bc57fa16c557b9c4fb35d7ddeb937099208d37e03b70581160dad9b7edb818a17c066a5ad020fdfa5f2b53b2fe8ca48c15109be7a73ad41eb508b838369fa7c38a0e791843e61ba1139960e525d128e99997ccad3a2b92001cf7d57ed96ab5836560a000991df99d8ee14d87c35d7292693bf55d4fdd27011ed8b849caec6f5aeac07d3bfc47d14a6bfea9ac1c29801fb0fd673cca6c39df1702c1489f6ce4ea4ff5f8ea9695d14259ec52f91dac7dc56816e3e35a55abc446d209787a16274d286307ca87905d0827edbbe5b139971060a373a045b8229b5871839a1308ccb7e3936f7d82c3941a753e608089a5f5a61d87c3e46bf279841ec53ca48a3eebb316502f776bce044eebe293c6d2dcde4a5b7b620c598ca218176c13fe1561124ef09ac91b8c1355407765b93ec84c3bde11d674df00362031ca97a932e45483b03ddb583b600f0ec245b39b55f536e42a7355c8831f669ec14a532a86ba2598253b3903e00c81523ccb1d76b666b900f9dfe3fd911f1ce801a11fc50b39e1ce5e2df1e912815d52277d7e4bdf9eda3c314a4d557bd67568184aacd3e3251cfa29a9e584b9225092329024d73af699177971d8f6fc74e8d85c053d0e3c0275dd0035a2120456d07e5d41df82a99e73d9d0c330b36924724eca4925d2051ee83087853b6c9e88cd40e04a38d18616a96d99181e156f9bf22718430d134121d0e3d5b603f63cf16d1c0b7c5410c1e0ca55fa0615bfdff3902e6c29a1feaafdaf7fa4dfa0907c3a7ffaf33d38f6a60801e69a00cf03e357437ad7221aba11df89e5d7c55f44730cebc245bbd8e588c190b9926844b3e04ce6d30d4b19f8093172e090726d6c9ddac93b9a071221062a2aceb8a263294f606492c307a4c5546e8f6a8d004a3eddc21d17373d04d2c387ee6dd37ec9e9804d656c073035a6826f469db63fb3559951e2267ba1bb81f9c45df683b16692ced4c450bf2a65a3b0a5ac1c7cea21e9900a7e76573d52b4d1997518363c2aff61e18dd18d360a194d85fdceb491306cbfb105bcbac8f2c1ee3eaef7e184ec7826fac2ac57e30b8160f30b83ad8f00f8ac056d44710495f630fdafa65bfca9e740829d3162dd85cc9ae808077e6d0dd0376050985659e597afd494bfd0484340e6346d1b5374c0c309aec4c9da3d603c96a6fb6de015929b43b7d520035f8933b075866fe10af88d7fb7bd53cff297cc2fae5135beefded0dae60fcd4c1be469b62a7ce152f61b1046774c79bf536b8ea552c5a51a28c0d38da0aa5d7c6375293f03f25ee1ded647c7181b9eabbec6f5499f5c27a1bacb8b9bb94361010c0846750ff0b370dedc424c2f5c7331ccc5569f4036f11bcc912c0a79b6a5fc50e7c308bcf2702777025deec357d33628253d80bf33a55f0b81d9b827c23f18f1e6ac3335191e0757acd5f70b28d891d709a5aa778cf53c8cba46780a0a750576860d7d84ddb959ae02d208a6cabfdbfe0ebe4e2100fa7332602f6b0eb1d8dabf106704a9af2ae17c2beaa688151c450bb4e1d9a3754d559c5646e9b30c6dd1e842dfc888de03a0ed38d3cd249bbae61745b6351d8181ec451bba6e3a0da759e5a267bfbfcccd5f60de79de8a55a49cfcac60a43615701e8becb118485dd68a8e575ee5e8cd9cd724d2d2b317968212dba7f8362ad6380acab46f0967c1be06f072b74220625962cbb2d4bd1ea9d3e37e78a6114e3b8aba830fd27c66ee152594e604c703e2fa08c091f59a99d433a6368fb58515c439bd2c59c5e5cd313b41f011a58ae62b3ae584b20438fec5787edc578ffe256b94cfc2e9a6aa44f1ac9a0869d88a6ed84c1f92206afc2426875f27501607ec0b34f6bc62d46b7dbf00ec06fd609fcbf28e308d5bbdb558cd767a0b1bd0280a6669f3d43e1a19557ff6a12183dbdc9c4fdd20611dc739f536a9fce2e0eed535dd4f0836e369c17cdaf7a79ffe9648d24ef46f7201a6a276318c0467b5d9c81058131734f87e5e634a25fce03d8295014178f4df5ef66fed022803eabaee05d156bda269c0269a984799d1ac1f686dbc9ab73303482426b6bb9", 0x1000}, {&(0x7f00000032c0)="c926593562139319c9dbaccebf5ffc7e83ec09e2f8e70d5934649b8e0ad6891239b678ca8fd12c9942f9634e740972b6fcec97764a608836420de016bdcfa18f55b44d71ddcf5b1005dbd8c6fd6847712dc8feed8dc739c1525c606c833795f6f0928b16ff408b0be3ae4a2da12e836ea68c30a6c22bbf91a5197b350f53901447e2fd3715199b26703d57797e67860b75f0531287db1a0ba2515322e11ddbad72e5369917c59eab795c1447a4c2072e05e73b2ff36fd1b08ec109c2cb6f5a64e3cb749dcc236cfa16cb5544f0c3b24deca83774b399f332faf06737f8f31a1c217360a4ea7055b2638a96", 0xeb}, {&(0x7f00000033c0)="046ca8376d3d4f79adb4d8d5b36433da127624485ff4e770c5ebda66e246e157752f66c523250b59217bb6b18107188e2ac288c64e61e4e1a6d86bb9ea79f6b2bc", 0x41}], 0x4, &(0x7f0000003640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff]}}], 0xb8, 0x4000800}}], 0x5, 0x2) syz_open_dev$usbfs(&(0x7f0000000340), 0x307, 0x1) recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x42, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) r6 = inotify_init() inotify_add_watch(r6, &(0x7f00000000c0)='.\x00', 0x5000009) fallocate(r5, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff9, 0x4012011, 0xffffffffffffffff, 0xd76ef000) fstatfs(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000002c0)=0x7e) sendto$inet(r1, &(0x7f0000001880)="dcb1203a57e748b4c92812dd8a2361bfb0589f947c79d0e73e269b56c604ac9ea6e244c929b8bc152d316aa1db673d8c9fdf268d181f3d12f24ba56ff27c74ea9725eded1e7220a2749984af3b84debf26caca5881110f42c092fa4c3bff221bbe4f0d80c10c9470524495b6719f0a36ce4d35bd114e20c18f896a695914e6bec3d55c5e6a1e0acbb186c30b75178f77eb3d0477fa0249bb442fc4f82ab9196fcea93a60f116477d0151cb45e12bc5ee20ebb3c84dc2573cbebfd03edeb0d038c70e3106e67d2c2ba439e1b501915fd959269c266ff60c57ae7052c90e749581d58d8c271fc600684362b5be5a5d8aa3d2adb4d9f79d811fbbdbf430952fef2df34e602a59d14e24606aba1a08c97e8b517c2d954bcc274224fa916f4a87034e19f06d84fc8582a420cac5dabd74083f2777e2739bb2cdea9dac0f9e3eb2d1e7c4bc758c26e731aeffaa3af89a161a359f558984e9953e34a3f976c6b41a8d921d62e65faca942ff32e55330ad16c609217d180caf6e0fc719e4426f3d80a072d3404ed3f46ad0a8c952d6daca87f0f6c9fdbc2a6f00792e351ac7c1b1dcb97e0cfb9cf9e104f4ed23b5d30454df2bba5a018bb12d85c610fb1632b60c12e4d0f14e6ed39a52fd5797ac5c42a4a08487be939dcf1c68c6ae94bf9f159b52ae6ec2158670a81e959443957fb985fff1ad5b9eaf869f978c213385c4b1f69b723d64b841e0aaf63f045656e4052b4154337a27b69addf4a67f80979ffdb225e15c471f0d083f33b539412cbb72b52ed286b9fac8ff8caf2dc2ebfaea6fcf24da846e4eeed03f12906e3120e579f4bb42e65eb163c1b4e64e32fe4b3d2f1a5d86f6e6bf90e06c3149075cb5d701ea15da3debbdf662d87c918126ce3b1a355ab56ceb654742c46c843cf983861dd77b0c3f52f9ce67f3317dc2f36ec2c9563e71881cb7eadb9c90a2edc7bac903468f9be049d7531d0af146b5801e010f0377faea0968824dbec1f5195491cca4551649b31e270b7f21bb138de10216b5578b5f475d1af108ee2634783558cb152d2ac99aabc68d8172f1d9dac3088eaa729e6ec05796fea09ce6158e73ffcaa6ddbc8a922918808ea30233fec32695c3b6fb791b41ab2e9d170a1f4bb8614ca18f12ff3b82e3467cff4c8b64aa93f5c9e64aafa7144522e8c68c187024a0b845cd5ac7ad322327e56ec0314b4926517aa9e4e83534bedcbd93030aaf9db86646f899e8d8731455dbad93736d02ee242288ed63f42e5842f2e75a20b14ceba8f88f3e99dce4cdd9e2f4925621e80822c4d0a862d0fcc885f44f24df7c6d2e675ddf707310dea63cd370dac445e73d817d1ed322b8422f36ffc74df1799ad44faf25ca801b67217431bccd890ffe96000a24f6891cf46cfa00eaf163dde0b8dde13d488229451945610867546992fd1a7cf1e6a9d69548bf6e8567dffd8f970ce2899e58c9c2e3472c2662f610a4a5b5d7b8c28c7be197eb1be1a159cbab206939643a8338aedf7b4a06deb9b40b5877e8f33e80c1510954ee9b95e1cef9294c7ac8d8f80b45c3cbc17f53ad4cf5e852afe13f972c657304d2dcaec588a22e2b7dbcfe17625deb58bab13a838a463db6186cdaf530f7801c950f62cdb59abd60da505a741deef658cea2141c0cab365b781c69c2082bd39e18f584018842ce82167f128ec18260893adb9e57ddc8aa5d81ba66675ad06e86a804b9e220fbbf3f6b93f8110d7638920f7b58ce1747d6ee8409db366c81af64399e4009829384b4d7863135dc16c2d4ee3167b4574ca2813320afd09fe02ff4e1f1ab551c245c00600c8dc6f3ade866c960cc1c5f1b91a6105984886231453005ee1c7b4ba1714a0bee0175aba2ed170cd6f52e3bcdc1d5c0c5c382e053a0e869703a56ee0cd66ea413bcd82b87de8ac6df746fa4d787d4bf1937984fa2446468a794e1214bc08e2f6c6bd2c145e602a7d510ac88af37f2e1793619590e8b8970c4d0853cec93de462a6b1577143dfd1be19ac777488f8747250002886310de1f5abb8541ad647c28d2e416f52b53b90dd926d04aaf94492cfa6848c37f5e1d1d3ee54df4962ef1561aa33eda6f254a333c7827e50e20e2c758f6ed3f66b82b796a9c0a1b02f0ce7dc2a2b81b3a5a9158cbf561f28ab5498480e80132a49cb7241311e42185b3ff61a494bfae451d0365bcb5f13d59a5da1e342e460823e4e82d165146b6336a40ccdadaa0f084a576ecd3772b79e1a27c6e01771e6a189ded02fe39d20ef3aaa2120848ecc7f99801f0d1c5a4e9eb2653608bbd936d73474d102ebe72ff3be36a5d5d72015b33e9718aca9ea486c7019747f1f8e6b3593001e3482edb57a81871561bfc6ec83989d68f4f7e859094647bd184ab2c6780692b98b0c369c0a1950a501f1e0c484b2fd25d7208087b29ff145d676a117c682f2595bb9eae7279da11052a12caa5aed818ce57c17093324d475d3010d4355b8bbb5a960a2dc1a36ffb3322cd14dc36bf86ce8e87a9b6525d68ebe785abe3eed97286ddcc7da4c00dccc8970fa984922ed692c26befadcce335bac70cee901dccc6081f9fd6edfd99106d17463cbc41b5f36486e5688e8c21ef49a71146219fe8df152dddf9befe957a029f3754342cec8c1e6ab2911fb175dec2c1d9e7cdf7ee7af29c27e1c845ec875fed51b04056da11addc4a1d8e90e2f4c4e2e6d432a064ef5fa746e946f8110c864967a389a0703dd7d9776aa9187ed9361a9dddc26821f246c9a56c926603098f8e5dd7b4450b2f0b0d2068404875542488b86eae8daf9779f25429543bb82f80c8392b56626bd7faa668275daa6bbc8b3c446cd8313749dd9fdcfd5d26109372c84688e97358a79df55d8276512ab62034255577ed14dee18913c8561ace863bd0fe7ad636a7e64cadad172d380a3ac731e0d229e2b04c1578106085dcbd39505d06e75eb668ff03814684e40ddf6068640485a3756d2e5d0190016b7e5b9fb1ec5f2c817b3041aa0a8fcf8474471afaeba169f9d1e3109f2f4fd417d2b0d6835681872cebfa5336a88e643b6d200abb8e335ad3243f0827fe230151f8d1aece9e83d659d81751c3d6d2c0cbe8747f0efd67d1bb278d733b11ab855d54bb91e27f0765d75a6a12c40c6e8f58b8b963944c21cb4bfb921b5ec97f1fa424b2d3b2978913a198fe3a621897daf155d3ff2079afed8587644f1f2982bfd0761bc2d888ab0da56207c6985b246d92c2a2e1181df5ad08529ef158605e1e230b5c7bd53f406da1a6bf7250e9918ef2562f2beda5e27be3055c3da2eb5c2090074a1064d9fc858002fb7ea3d6e8a392d3241b6a60313c42ea71c2960daf0827540813833678e0bc62fb3bbde5aa4653c9e647873798431a5aeeb71e77883390914010b2099525fc27a776d30a1ffca1fa086a9e904512a5f8b20372d67e7b62d47d8d2201caef9c8818a38e0d67b18e73e81b56e0e5a47541b82c7ea0d091be6063761f45529cfea8b3acddeea3cb36d2337d53bc66d55cc5d45caeebed36d544401950e6fc6222250c40f8a8e70daf861876b6996bbcb405885de1a801ddd302625948871d398df6c53c2897942cd84f5052dd75656d75c6554e903ec8b6d495cb317075f4aaf31482a9fe78c89f66986081038eadeffa513e3865a513e5caaa85b0f427d139de4edd57e30a13bacafcc4d54ca946d4b6b84bd81e80d446caa26696e4b0e81baf9b910eb7f48f2559520a2947a98bf0cdd140ddc5d0ad0161224f221886b16e79c1403b65cc8fb56b9acc084192dcbe08ad73bdeee36aa5d85f3459c8a477a3c80df8b584b95b63884235e6f226876d6509b776a51f0ed22fea139a08b60c6620a68262360d6f5406057b5d61c0af4b6de2b953db2cc3ba9ee7a9b6d4d54392c156190b043d4f29a3f54efba78441cf87612d343e1baa38068134e715396fc595cc564b34b468ccc647827057b059d9601a69014dd41df18094e033d1e5da3dc7e0d8195afecd206f8ef9607d91403fa6852fe0737e976cc4186c13188ca14f88f98ba051fc80043b9eaaa629a31457c1429dfc8165cae330e6be9c5ef7b6eb37be7fe33343ed66086d847eb4d95ef16d4e8cea6e1612b231b6cde06888162d968d4391c6575f9f58914e3cc8fb019474d5fee326c1ed20bdb6aa30e23d185dc1032b1793d787fc78fc7a9eb9fae0b98e39cf8fc233c183b79055b91c6a0743d06045745b4f66629b16329ad1a0f926c00f5ea1dabe4000e646152d67f6e6ac7315588c5dfb2964b5a652474619e7e98b73598be183b8b2fe218371fd7274dd589f05bc42a6cc39acee9c8bc7fadee5064df8d5eb0445262d2abda1b5a94d578114c646f0f19f54c4b31234ef37ba37039c3c87044834a264b0a749477af46265b3c527895b8b47f2dd8f22ac8449565410576c4852da53079df7f22e47dda14d867ec5941591a33381399c12c4652cb18c0c0f21fbfac1fcd49ff4f3a9835106eff88a6237b6784b9237d16e1577117ed4c6a936da3c2949dd4142639a34dfe2512ce2ed397bb81c818cf6da2812ce150cdb4997671d519fdf935e4ea21590541f47878352581bd5c1ba9c62a85ad514113e0a450850c884ea384a21820f72e8014ac36d6974ac9ab24e57c043b5ee59e6d2466fc8a002c3e9ff1aecbebdaff68428de453de640f43307759784e0d9e70f15aadb5078fb23bf89a541d461fe8b89b02fe25b594c2ca9881f6265f4ba393b67a273b3ab3d3b6d6ae60933ca7b8d1ca741c45471d897b3ab4ece88497bc492e70442339492c827c5a45b1c49de22ab5c8b21b11fa19a890e4fa387203dbcb687cc9ab107123713b40a81ed012d0c8aa5670eee1c694ff5351c8634e929d635cf6b09faa37b91b8a54f5d1064ff0b0a7517a5b7df78c7f3846be678f1f522804eae47b71dac9edb1deaee9013498d94f00f8c85ce26bf235d4738ac9482dee00ab69d95058ad1a3a1222479d5f16258a20561a4a8a859d327004523178348e7e471845b89316245e33194d8a176f185fe661df6c518ff3d88b915cd774be8c613eb1106c09dd149ed24e09fc8b03a2c8371fa42b21311565a5a453bfb220eea2a8aee225c3f9242d7ef16481167d091c7c59d9c1761e48eb5b100f01c55efe7a889c47c0670f91a24a8c04266a11ac94e29ab0e6d408165b28d9f3901502b1b80478f66d84dcb582bc4f8f0dfa25183fd77be3905cbc54948a4423b2404c94912a9af42918119f73f7c967a964edd9c5d59c69441965820da52d4a766b9106276be6a800ae616bfe6b2b2c3193e7ca146e2c3d95a502dd8772fae53bcc5d59aa4120b8647cbfb5e1851f1bbfe9a72d66b6ced540d501c08740f379c8b54c62901d9df9ecef2869b168b9b7a02fad575c9d2ab0013a6b2ee3cbd59a7a7b683cdce95ce3b4864f7929cd75c2a5dcc6b304d963d6a21955f8be64fcc3a75dcc17837c8794b0a37fe4aa17bdd54aee32459ad98f462cff6f1e1999733cc376a4ea3d7378d3d9edb4be4a8a16fbe9f13d917c6edc6aabdfaa3018fbc2da01b4db130742a7a230a91ff0a0af46100388dd9dc4b63a3", 0xf74, 0x8081, 0x0, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 4m47.278962441s ago: executing program 1 (id=2190): openat$autofs(0xffffffffffffff9c, 0x0, 0x204000, 0x0) syz_clone(0x24088000, &(0x7f0000000ac0)="47e55be712af9c9f9ed3b26e30333990a9705924947f1233d9ebb2c52b219b7ad18ca914635c68bca9a29a79ec84f939f1e47fdc7b8dff3907188e4c8625da9848607f6b8113fc9f6f8b5f1cf0923ee2c8a82f53ff72d5b9e93b4818e217920f1511e0d4be1ee6d8fc1dd29c87f79d06d94e33c9415e080c7e62508646d511113ebef942607dee1fe64c4ee6f667de36358cb78ae90ad660159979325dd6a8b2e161824965abe651f0cfffe2818eef81ca700cbff69936878083e216a21ca4d97116ff622e320c1b516aecff6ffefa09307d13511945b39f7be931707578231ed034ebbcacaf2d07e03b51daf50ba0131427b6231a420279af81d3d032e558fe0eb32a2d560f39070951a222212d87994da3cd0f13287e7dd290f032ac6497bed808992aa5c414e253a420e6cbce318d5a5c6ccffae71d351a81d325eb0aa58ea2252967f28ee55cc6f2b9c6da66c21f7274d123415f7f8d140c908f18fde93b7c87a267cd32b564a6be7e10804337353d14ff139a49c02e7da479edbf5c030801c996ebf3eb009d342932dcb3c36ab67d47b50d679d32dd33fb1af95d0482d63f4be9a171e241b83adbd9755032e20063a048f9cc98ae3ab4bdb5a34b82105e6ed9168168438cdaf7f25e83cbb43b078e0c5181fdacac36e0a8b1bf5f91f72f99176d52ea0c78f06455bdd28d9c0b093dc7bc38b8347bf20f1956d8c297e111b171c444107341d3eda0431bc07bbe57735126e6b99f48640c5d1beb607903a4b9ad75f244f60aff5903874daac92baf7c9146d900d56696124b243c08adbfba874e74737e24626bcc3aecbb965749953e4bd23f7ed2d6f3098e90c2abbca50a04ce5ce4d2ddff1d61c77ac0c2528e92acd6ab37e7df658f505883aa321cbd09c2e728626f03056ad0181e6571b995f5ec80a61178f22507b6c276b8028d5cb316fcb23720633da26893170b8c9ce64b7e6e9ee813469b2bf383f3bb8ce241f71244750618b270aa57875a3d9be988e9aca2a258e0704f0b3c4878a559dcc67ac5884eb1feebcc93822f8fa7273ec72cbb51a1565dc16d8e89dd881aa9364fec6bbf1022e39f856cc10efbd766b218ab82bd31bbdd47fac257cfb7e5376555306d73b35419c5bb9acef85c8ae95a833321ccfe8f37f79685e98b74fdc5cde8fbe4684df3892ddc47d264251a47a9c1d3e13d718fb5819d12eda00b1ea0ef5658486979284eb8dadf45abb1b2f03256f2add2dd6f0c515bd1ae51f927255a10679a450151fbfcc2b933703f4e7963a918662eb723498d3820eca43e09701748381a16e8989f5e4fecf96f88511fc4adcf28e720f397a0f051aef922300976d762d321d66b1ac9ab42e9729374ffc4187f0c11581050d9e1ee4fd17419999ef18ab3438d9644e00e83346f242c68c49243c17b95b54f30c8ff8f9d28edabaa140778a4f213389f79a76a6352d84c8c36b28db3b9dcba91d9392977b2475977108685993f9afe6a21f2b4b553829a736ce33cbff4b101c6fc9b4380b8bb1ce0891c4b8e1ee99cb0e8fadba65e0199d1d725c3a0a00627041feb60283ce8b128bb7245a6828202f7558bb231bbcb9a5e47c9aa6f5032c8971ce63c6096112cf3d70f9f23c422661650b4d5369ea4f1500a8cf8e11f01266293d50458ad48fc381e3166dba13548acf9055bd85fd461baac8784ec55666a7651587b8a31340ec4ceb29d84ccf3d196be521828b9e582970883387f58bd4b8058fc9b6d1cc590bdceda663474c8135643b2076d36e6d32f93de0b5a5405886ae7c445ab2726b9c477a94074b2b6198cd23193a7a9b58992f69376168d055ad3ca6c2a5e1fdfbb8e8349f702b9d18f2b3c30c084b44e30e261bd2828f11f0b4d755e3a2d5aac5f60ee326b8b71f29ccd597fcad228dff9e40d456dede57cab093f72d863c00737e8bd42e5d4c284a5ad71e1fa5c00a39ac9d43d3077615fc9fdb9ac5b6a17f331ef8fb53c5ec469f88331ebde98eb806caf27f9dc9eb2fb1afc9c3a3f49336471d94ceef545d4a82e02a965392a72f5f1bd0cff6fd76a57b7e6bee7a567f6ffc4b712f5f0fd15a41e445596032c3c226664b77c847bf4d8442d676ca31250df4092fea3c939d054b90d398c6cdabb952939d534091d58bd564c762f564576a7fd1b68aef4f3f2f464d856e134cefc47eb67939f91606749570add812ab6d7b22b60f5c9b54c82a8cf0516b4dfbdd21ea4d30d905b4f130aab701a8b01359e4eec226d1400b6be36ff19d1aace5e59c370f2a4afae0140c02364cde91cf3bfd48a0eeb85ea5f001d1b24b1a9d52a3c0d936e9b4af69eb17d157ee79b58aca45a1aaa5059d770115fc9ebef6e62aeedb1669dd3cb74300fc52ff51f746b96540760f6cb7288fa884fac02f677e09d4bcd3549ff0f8f954bfcad4eee0a8e7612231ead3051a6f1596c4f0c7171186132915e0b80bc64402fdd3b3b2b91f79a3e68153e74579f489d5aef95e13da242b6412f4a1ef684e83bf7b74de33ee41a23b8ce476b3c0faa52a0695051d208b51ad761aaa3ec9a4a5a5d6ab530d16b66020b0cba1931245d5339df155cf6a9e49b594a34e42e490d0acd282701b121fb8362db73ae73c4cf182660ee2221f8381b717d8001786e55bb47a0e7dd1756f6851387e89ce42360b85a4cf6966090c5a9496681a1619b77655bf1e591db07f50af79c17b8934daf7040a852afa81f0cfad53d7b687982c88f1cad3e4a299cbc5b4c1254d03e56e523ab928974ea4794764dec6d3b39606d763358eb74cedba1a582b5f38be4e45219f1aa1e2fe8678e1aacedf2eb61c90751236a08b8ccdb2f546480edc0bd1a29a928616d26092ae21aaa173c3750f65244b7568bcf2186d6a7281a7c39133c599169fa61b21d68560f1576da47db137a0209862837f739feb5de8f749f93e9b0ee79a2c04c34fea788696fc3369eac183598664781ff09fac3dceb48d7ae681962c3db62b36e8cdd91ad9cb1a7b7901d8d6e73d71e79666fe0198de62ff56c6149201ff7c811e6523d707a1b882d458baa0f642a77c1166778d5a95b4a56ad1d1f346007997099d914afcba9a713e360ba1bb0c3ddb1ddbd5be7f7aa90682f40ff8f367fe91888f580cc3fb6047e4097a646105f7290de0768015cd7f22599618b92580a954af917af39f1513e818295cf2f6f91b987940be934573e4cc2d1db671a0f59771a7ac8e0bb0153b934ed2aeed81d80e192a07eea7ba0e3afbf4b7fa1f1b94d03afbfd1a3dc711a8cc9a988563eb7e86b40937b7a2dc2a62ceecc6de75116f7994f596c9013e9103003d3198d2ab4cd5243cf3c0f9da7e41bd5e64973252d48842442bf3bf3270a3f5c97a3101910bea19888af955ff407edb762e3bdf7bec4a9272f814741c330d2ca40c6bfb4d64fc93377e85d492a944cac8a99c58a24c02121a5b2c0c20a8e899364b7eb485c62b8bb6b1d3cf022791d6ce2fb871a0ad3e4d6eaf92ed968f823ffbdeb879f7713973f0e0d0907b4db9b28def9f1f23da6c002568850ce82fd398e9cfebc7c78e9e59d3f040f4b51a9e48c31f2d578811e39d9948fe026b0c0b8ce8a61f71559598213d7d615f310d192101a11d58161916b292617ccd6e9dc1c102cc2b3fadd2e1cde50645459cffdfe701bc379005de6d1d2cead28671fad08f5f61d91515acec3747eadd01101aacd4b2c7d41ee97dbd77c26e9e727dade3511272b01cab0fd6a0bfbe9e75670611e7cb6280c0b7bc3dc0aee98c40b393ce2013164ed441ff5bce225e45fd6b562c3bc7a2e4061752384c7daff52cd0d6132f8c5c0312cd2a6c02a1b698eac0be23cf1adc77bc6aa10d14498fccad8a1ca30ae8a6f69faf1294d4b45ca12bcbf97ee8f61070ba6963f257d924c7e83233d09e1b48908551db568d76acf5dfa2acd54e7acbc331d84115a7f7753b3daf4f9bcc7edeb0e863b5fcf1796ef76d8d14028e70f89f12e9442720b0957a254aa154fd3a7c058e6e1d32249308f1828aedc02b671b7540b04727816f6ff9e45aa0e7e8105ebf3e992176e66deb8e280a66c6fdad05d38a0aad1e83e3d5f69d265badfbb751b565f6f786e77fb1065880a8a9e8190c91cba18b4ad29dc9fc65870fc2ac7050c67c4f3e6036f8569c587b2662aaf6f19b5033bb844154fb6f849e7e66697d60758f52fc7665304ea9df9b22937194239e65f7456cb02e9575db6b64b3ed395bee08c854ca85af42d5cbfdf8f829291476628bf9b507ccc8c0bd6ec92612f5620bce2f65f729d66f096a9186fea947a79142d163ed60d892b916788b461b89f97048f803dccc59cb344d65411669ec27406185a2035b911c5c8dfd1f440e6d3962968422b828118125f5730463e2ecc99b3958ca1d679d1805d9b26e76a9fb42d34ccf5e910b81a064befee8f9ab074da647508ccf003f5bfde93405e3bfa3cc87391fa2de5c01452527aa3f7caf9cc4b9cb7f0daa1958fc8e64e65279acb4343c3fae93593fe8e30f896566f6c468b7f0dc4abc4b9d21dadd1e534ba5b21cd006a0fd2ff2dc3c31fc7f9f3b432931417f6efd106448d3dec1178d8e83a5e444303965cde61c6ecd1adcd17d4c7f4fca1c95b50625696f2b93995fcc291b4f77f8b851d7c7e75612c63c139b04fdc5d968132057b274d9db8bea40a4a68af55aca5e6d3d669f27718d79d49c5a60e7f1b5eaf9f518265c2668be5a085bff00e2c6ff741a76b7b8424818877c083a1eedf3dc0a867a914ce979682943927f2b8d5efd14af57840482f7b88687ace175be74bb8de4f69880ccee13fe8aa56879c8261a0d4d8e387f26c98afd469464a842df607d46d38ee17b7a6fd8ff3cb72ba24317e8b1324d224a8f0942a67dd0c83984fc76d624b8afe2c76a3a4d4f171327e689fdc192a988a002e7751a4952c7e05a114e1bb3e6a222df12cb4d270a7ae6a7666683f7e409da2741c037769cb2861fe1b4b0a083e65b22a1ec9419ccd016366bd4253d1dbffb740ebfc267100cdac83c73e6291cd2c59754aa89f4825e3b68bb0fa6cce2b383bb270cd4163aae83b0b1a3d9ed95349d4cf8ee888993bcd60a8e4fb47ab76921e266b752218513875542f92912437088ffa6e1bd9efd9c1abc134201b050f046441aef27ecda16ccc02050f2103026cda97043cc9336dae5f77cbf5ab15053b50a435514e4919fca29abbc00a91f44cbb4b69a3144f19e1ae96383356ee5101760ed743ce22980b6ebabe1f628cf6538243167b9506923ab76544b17d1a6690491b64323e85654c96f4706bcc1c205769936ed58d9fd1f5f2979c41c67b53bc75a795247fcc3cf34b2267410ad50d0884f1d9439d42ad0feb5be750de08966f5e48808d3688284c0e281182fc26ef89d09d75a658483f0137bb55c76c2555edf35368ffda335d3ddaa65cb73ef90b1749b38a5907a0a8eeecd168f99f65c624f6a2e662b07d95dd97bcf84651de9e2fccb4222d06d60fd1c3fa72ab100785636c51331f6ab54d6f43ddc6af4769a2c7c2084bf95a2e224d12b3d6dc79137a1b4377e0c9e3d8b2880d0f161c7710d76cc73644ba103f58466b9adb632b851618ce44c22926b53ef91f6e3ea0dc6bbce897f8a2106ac0da6dfb3f05b398a3d425ce0bac914aac617a857044941a0527357188040f89c622e8ad36c8484f530f8cef1867d81bd723feecfa6c097ab5920a63723788eff1866124c9ae7a65ddfab5f9191b4021aac5465eb3c8499c6806c2e501ed557ea7baa7b4ae042aac95b1f0b848ee1a3b84c6", 0x1000, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f00000001c0)="06d64882df1f083b6f82e2c8b3410f9c35") syz_init_net_socket$ax25(0x3, 0x3, 0xf0) setpriority(0x0, 0x0, 0x2a14b58) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008080}, 0x4810) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$kcm(0x10, 0x2, 0x0) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x10) r2 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x200c8004, &(0x7f0000000280)={0xa, 0xe20, 0x0, @remote}, 0x1c) sendto$inet6(r2, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) socket$inet6(0xa, 0xa, 0x1) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000640)=0x2, 0x4) setsockopt$inet6_udp_int(r2, 0x88, 0x1, &(0x7f0000000080), 0x4) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, 0x0, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x0) 4m46.788316419s ago: executing program 1 (id=2191): ioctl$VIDIOC_G_PRIORITY(0xffffffffffffffff, 0x80045643, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0xe, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdfaa}, [@map_idx={0x18, 0x4, 0x5, 0x0, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x80800, 0x0) unshare(0x6a040000) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000080)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f0000000180)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r7, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r8, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010600000000000000000900000024000480130001"], 0x38}}, 0x0) r11 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r11, 0x4610, &(0x7f0000000000)={0x9}) write$uinput_user_dev(r5, &(0x7f0000000980)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_GET_SYSNAME(r5, 0x8040552c, &(0x7f0000006480)) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 4m45.912017387s ago: executing program 33 (id=2191): ioctl$VIDIOC_G_PRIORITY(0xffffffffffffffff, 0x80045643, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0xe, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdfaa}, [@map_idx={0x18, 0x4, 0x5, 0x0, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x80800, 0x0) unshare(0x6a040000) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000080)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f0000000180)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r7, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r8, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010600000000000000000900000024000480130001"], 0x38}}, 0x0) r11 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r11, 0x4610, &(0x7f0000000000)={0x9}) write$uinput_user_dev(r5, &(0x7f0000000980)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_GET_SYSNAME(r5, 0x8040552c, &(0x7f0000006480)) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 2m30.231033939s ago: executing program 4 (id=2671): r0 = socket$kcm(0x10, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4004094) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000003c0)}, 0x20000880) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e000000100"/30, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}}, 0x20040880) sendmmsg$inet6(r1, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) unshare(0x8020540) ptrace$ARCH_GET_FS(0x1e, r2, &(0x7f0000000100), 0x1003) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64-generic\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f0000004600)=[{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)="98", 0x1}], 0x1, 0x0, 0x0, 0x1}], 0x1, 0x20048889) recvmsg$can_j1939(r8, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40000223) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 2m28.931705622s ago: executing program 4 (id=2673): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c00"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f00000004c0)={{0x1, 0x1, 0xffffffffffffff75, r1, {0x8000009}}, './cgroup/../file0/../file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) openat$cgroup(r3, &(0x7f0000000440)='syz1\x00', 0x200002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32, @ANYBLOB="08000100", @ANYRES32], 0x90}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m27.759322295s ago: executing program 4 (id=2679): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) unshare(0x28000600) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000200)={0x0, '\x00', {0x2}, 0x5}) fcntl$lock(r1, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x5, 0x6}) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='fdinfo/3\x00') read$FUSE(r2, &(0x7f0000000e00)={0x2020}, 0x2020) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @none, 0x4}, 0xe) listen(r0, 0x3) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2202001}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x1cc, r3, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1ba}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_BEARER={0x10c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x3, 0x55, @dev={0xfe, 0x80, '\x00', 0x16}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e24, @private=0xa010101}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8001}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xea}]}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1b6085e0}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x4020055}, 0x8054) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2m27.195370003s ago: executing program 4 (id=2681): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000300)=@ethtool_rxfh={0x1, 0x0, 0x4}}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x4}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb0}}, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x1000, 0xd703}, 0x90) sendmsg$inet_sctp(r2, &(0x7f0000000640)={&(0x7f00000000c0)=@in6={0xa, 0x4e24, 0xffffffff, @loopback, 0x8}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000100)="be", 0x1}], 0x1}, 0x8000) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f00000007c0), 0x800) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r6, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) recvmmsg(r6, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x2, 0x0) 2m26.332235841s ago: executing program 4 (id=2685): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x100, 0x3) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f0000000480)={0x18}, 0x18) write$FUSE_INIT(r2, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x772, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x6cc42, 0x0) read$FUSE(r3, 0x0, 0xeffd) (fail_nth: 4) 2m25.614287486s ago: executing program 4 (id=2687): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000000090400000103000000092105000001220500090581030002"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)="ab", 0x1, 0x40c4, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) ioctl(r4, 0x9, &(0x7f0000000140)="acf4ead969d99962e02477448cd709ae31c7cbe552e238f945447acbe1704912e6ec86a47e4c47f61ee3bb1fc639905a2ffa435f4bcb0c8ac876581849b05d11140d01f7cad16369c943bd55cb025e31cfdce92b7b5422e50c12b1d2d84ac428ee87d1be5a9e25e89fec86dcf7b71c") sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000000201005) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) 2m10.52850086s ago: executing program 34 (id=2687): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000000090400000103000000092105000001220500090581030002"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)="ab", 0x1, 0x40c4, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) ioctl(r4, 0x9, &(0x7f0000000140)="acf4ead969d99962e02477448cd709ae31c7cbe552e238f945447acbe1704912e6ec86a47e4c47f61ee3bb1fc639905a2ffa435f4bcb0c8ac876581849b05d11140d01f7cad16369c943bd55cb025e31cfdce92b7b5422e50c12b1d2d84ac428ee87d1be5a9e25e89fec86dcf7b71c") sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000000201005) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) 51.252090407s ago: executing program 7 (id=3006): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0x0, 0x2, {0x6, 0x0, 0x0, 0x3, 0x4000, 0x0, {0x3, 0x7ff, 0x1, 0xffffffffffffffff, 0x403, 0x6, 0x20, 0x1, 0x2, 0x8000, 0x6, 0x0, 0x0, 0x800, 0x3}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) flistxattr(r4, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB, @ANYRES32, @ANYBLOB="0a00f500ffffffffffff0000"], 0x28}, 0x1, 0x0, 0x0, 0x805}, 0x40084) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) 50.104228597s ago: executing program 7 (id=3009): socket$inet(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0xf00) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x441, 0x1c0) fallocate(r1, 0x20, 0x0, 0x2000008000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5f7, @value=0x1}) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000240)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b0204dc55ea62d43c809e0ed6e561eb1bcb4a046d00825a02a373c4cd08785e4e69234ffbff79f36d5949767ec9ab9342262268333a390a88da195cb8fd851585cd", 0xa1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x4000, &(0x7f0000000180)={&(0x7f0000000040)={'sha3-512-generic\x00'}}) 49.046944s ago: executing program 7 (id=3013): r0 = gettid() prlimit64(r0, 0xe, &(0x7f0000000140)={0xc, 0x20000008b}, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x20d00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) exit(0x9) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) unshare(0x2c020400) r4 = syz_io_uring_setup(0x10a, &(0x7f0000000380)={0x0, 0x5885, 0x100, 0x0, 0x25}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r1, 0x32, &(0x7f00000000c0)=@un=@abs={0x1, 0x0, 0x4e20}}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={&(0x7f0000000440)="9f870afe3c1c6c10e8151d5199ab11e66b4e0de2f79ac8c65d6356e0a3c9b442cb8f41714283537855459f278b4c40ffbbb0276601e31659ed38b92295a32b9176cdd102befb3f850a53dff73233018be37d1b733f846dfb90a13e6d996c5e5c5daff386dab026dde5d4a1dd8cce432f6d176ce09c154074b59b4d4ca3d8d9a1e17163e674bf94a39f7cabcc32c7d51acf426a0d88b42ebee7ad532c08b274e5424e09d9916f34527d4161fcbdbd980aa9ddb0812d6a71facf6ef400000000", &(0x7f0000000000)=""/48, &(0x7f0000000500)="5765525c5b192f2cd7170943adc7ff1ccd9237881a0aef4fb8cae2a2e948635893ec14ba14fc20c3f06ab2c209aad8ff0b3e1d575480cb8157d8742521a64f8d9bf38db5f70d6b0d1a1ed9fb556a6a612e248e79d6cfcf5651e44fa58e04f9a4a9491766b76275ebb1558aa495e421360b7458c438ecb7ae1a3f39791441eb1c24c913262bdffc37ab822d957e35b4a1be54a88aa9aa7b5d5d74f1c687ea0223ecda2aabb9122d0c1529933e987e7d7d07d411c8aa43f2e91ddffdc2a5037680da8372ed3f32ba2aab5c1683d6b9c4aa757f3a83a4ed208a130194074dcd8079e260f715f71a7a9e1bf4c7a84cd7fbc1613bb3f3", &(0x7f0000000680)="972bd846362b299efc0d8bf9e57d27320000fedfd727f3dddd64f7b91eee4a42b28ef7e8e6cf076bbb0c84d3a4ca13a20c4169ebc6e94684b4f09e9acb08b34fd0e0f975f2c66965ed95dc3912f846ae18ba5f22ccec65edd84e9de927976ba8", 0x9f4a, r3}, 0x38) unshare(0x400) io_uring_enter(r4, 0x351e, 0x483, 0x0, 0x0, 0x0) getpid() openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r7 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r7, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e1d, 0x280000, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c0000002b0000000000000718"], 0x30}, 0x4000010) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="4400000011002901800000000000000007000000", @ANYRES32=r9, @ANYBLOB="00000000000000001c001a800800058004000500080000003e"], 0x44}}, 0x0) 46.189484344s ago: executing program 7 (id=3018): socket$kcm(0x2b, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x4800) (async) prlimit64(0x0, 0xa, &(0x7f0000000080)={0x3177, 0x8}, 0x0) r0 = gettid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) (async) r1 = getpid() (async, rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (rerun: 32) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x100010, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async, rerun: 64) sendmmsg$unix(r3, &(0x7f0000000000), 0x0, 0x20000000) (async, rerun: 64) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000380)='somrcc\xd5\x8f\x86\x94\x1a\x14\x15R\xcc\xefS\xa9l^\xf3\nL\x84\xca \xec\xcfZ\xd3)\x03\xa5\xd2\xe0\xd4l\xf4\xf0\xdc\x84\xf6\xd4\x8a\x01x\x90\xf2t\xa15\x8c\b\xd6Y\xd5C\xdf\x84\xadd\x8c/\x9f\x86\x12\xe7\x01Yb\xf7\x98\xaa\xc7\xf0E\xac', &(0x7f0000000040)='c:::\x00', 0x0) (async) gettid() (async) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) open$dir(&(0x7f0000000000)='./file0\x00', 0x200000, 0x22) openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)={0xa6180, 0x0, 0x2}, 0x18) r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x189) utimensat(r5, &(0x7f0000000140)='./file0\x00', 0x0, 0x100) (async) r6 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) (async) r7 = socket$l2tp(0x2, 0x2, 0x73) sendmmsg(r7, &(0x7f0000000100)=[{{&(0x7f0000000ac0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0xfffe, 0x2, 0x4, {0xa, 0x4e21, 0x1801, @mcast1, 0x8003}}}, 0x80, 0x0}}], 0x1, 0x4000000) (async, rerun: 64) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) bind$bt_hci(r8, 0x0, 0x0) 46.026915904s ago: executing program 7 (id=3019): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x103182, 0x0) r0 = socket(0x1d, 0x2, 0x6) socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(r0, 0x89a0, &(0x7f0000000200)={@rand_addr=0x64010100, @empty}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) setpgid(0x0, r1) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x901) mount(0x0, 0x0, 0x0, 0x2000, 0x0) bind$can_j1939(r0, 0x0, 0x0) epoll_create(0x2) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000a3348484bb8df93fe521fe1040f858fb0192fdb61165ae96e54e95f986e1991666a28ea84021377f854fb46b740fc923244159bca8f8f9df6582f8c01dc05733e2e55fc52557ead879afe7c49146aea5741c8105fe87b521f427bf000000000000000000000000000000000000000000000000000000000000004f701390124865885190ca06cb4f206ba657fc27bf050e5038735848f0cf75411468e4dfe3b6b09f3604b8e53e9e597e20f046c1cd9dcbced8b86658007017e0"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000300"/28], 0x50) pread64(r2, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) 44.992658536s ago: executing program 7 (id=3024): mount(0x0, 0x0, 0x0, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}], 0x1}, 0x2000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x1a9041, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000100013070000000000000000fc020000000000000000000000000000fe8000000000000000000000000000100004000000000000000000202c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe"], 0xf0}, 0x1, 0xe}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 29.679847709s ago: executing program 35 (id=3024): mount(0x0, 0x0, 0x0, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}], 0x1}, 0x2000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x1a9041, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000100013070000000000000000fc020000000000000000000000000000fe8000000000000000000000000000100004000000000000000000202c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe"], 0xf0}, 0x1, 0xe}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 9.977215898s ago: executing program 6 (id=3136): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x2c) r1 = syz_io_uring_setup(0x1e1e, &(0x7f0000000380)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r1, 0x48e9, 0x0, 0x2, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x1b, &(0x7f0000001800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000017000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000700)={r4, r6, 0x25, 0x0, @val=@perf_event}, 0x18) syz_emit_ethernet(0xfdef, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x300, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@response={0x2, 0x0, 0x0, "82d18160f7d8dda36479a6b179161b4bbff2d0508977b3928ebd2dee05607d17", "0194bd7b1b0303c5ba7f602606a285b3", {"30da2d58da817f8a5f77a23de36a2164", "3b33cfa231a427159c7b9f0eceb155f0"}}}}}}}, 0x0) 9.387077509s ago: executing program 6 (id=3138): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x103182, 0x0) r2 = socket(0x1d, 0x2, 0x6) socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(r2, 0x89a0, &(0x7f0000000200)={@rand_addr=0x64010100, @empty}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) setpgid(0x0, r3) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x901) mount(0x0, 0x0, 0x0, 0x2000, 0x0) bind$can_j1939(r2, 0x0, 0x0) epoll_create(0x2) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000a3348484bb8df93fe521fe1040f858fb0192fdb61165ae96e54e95f986e1991666a28ea84021377f854fb46b740fc923244159bca8f8f9df6582f8c01dc05733e2e55fc52557ead879afe7c49146aea5741c8105fe87b521f427bf000000000000000000000000000000000000000000000000000000000000004f701390124865885190ca06cb4f206ba657fc27bf050e5038735848f0cf75411468e4dfe3b6b09f3604b8e53e9e597e20f046c1cd9dcbced8b86658007017e0"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000300"/28], 0x50) pread64(r4, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) 8.823388163s ago: executing program 3 (id=3139): r0 = gettid() prlimit64(r0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$ptmx(0xffffffffffffff9c, 0x0, 0x20d00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) exit(0x9) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) unshare(0x2c020400) r4 = syz_io_uring_setup(0x10a, &(0x7f0000000380)={0x0, 0x5885, 0x100, 0x0, 0x25}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r1, 0x32, &(0x7f00000000c0)=@un=@abs={0x1, 0x0, 0x4e20}}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={&(0x7f0000000440)="9f870afe3c1c6c10e8151d5199ab11e66b4e0de2f79ac8c65d6356e0a3c9b442cb8f41714283537855459f278b4c40ffbbb0276601e31659ed38b92295a32b9176cdd102befb3f850a53dff73233018be37d1b733f846dfb90a13e6d996c5e5c5daff386dab026dde5d4a1dd8cce432f6d176ce09c154074b59b4d4ca3d8d9a1e17163e674bf94a39f7cabcc32c7d51acf426a0d88b42ebee7ad532c08b274e5424e09d9916f34527d4161fcbdbd980aa9ddb0812d6a71facf6ef400000000", &(0x7f0000000000)=""/48, &(0x7f0000000500)="5765525c5b192f2cd7170943adc7ff1ccd9237881a0aef4fb8cae2a2e948635893ec14ba14fc20c3f06ab2c209aad8ff0b3e1d575480cb8157d8742521a64f8d9bf38db5f70d6b0d1a1ed9fb556a6a612e248e79d6cfcf5651e44fa58e04f9a4a9491766b76275ebb1558aa495e421360b7458c438ecb7ae1a3f39791441eb1c24c913262bdffc37ab822d957e35b4a1be54a88aa9aa7b5d5d74f1c687ea0223ecda2aabb9122d0c1529933e987e7d7d07d411c8aa43f2e91ddffdc2a5037680da8372ed3f32ba2aab5c1683d6b9c4aa757f3a83a4ed208a130194074dcd8079e260f715f71a7a9e1bf4c7a84cd7fbc1613bb3f3", &(0x7f0000000680)="972bd846362b299efc0d8bf9e57d27320000fedfd727f3dddd64f7b91eee4a42b28ef7e8e6cf076bbb0c84d3a4ca13a20c4169ebc6e94684b4f09e9acb08b34fd0e0f975f2c66965ed95dc3912f846ae18ba5f22ccec65edd84e9de927976ba8", 0x9f4a, r3}, 0x38) unshare(0x400) io_uring_enter(r4, 0x351e, 0x483, 0x0, 0x0, 0x0) getpid() openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r7 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r7, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e1d, 0x280000, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c0000002b0000000000000718"], 0x30}, 0x4000010) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="4400000011002901800000000000000007000000", @ANYRES32=r9, @ANYBLOB="00000000000000001c001a800800058004000500080000003e"], 0x44}}, 0x0) 8.550882501s ago: executing program 8 (id=3076): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000000000010000000a000000090002008d001f106f194eb3050001"], 0x30}}, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[], 0x30}}, 0x0) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0xfffffffb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x80}, 0x8) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x0, 0x20000000) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, 0x0, 0x1, {0x2, 0xf0, 0x4}, 0xff}, 0x18) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r9, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendfile(r9, r8, 0x0, 0x40008) 7.204493811s ago: executing program 3 (id=3144): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x10, 0x5, 0x0, 0x8001, 0x0, 0xffffffffffffffff, 0x2, 0xfffffe0000000001, 0xfa0e, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000000c0)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r5, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r6}], 0x1, 0x0, 0x0, 0x0) close_range(r2, r5, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x16200, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000280), 0x3a1300, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x7f, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='kfree\x00', r7}, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r8 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r9 = dup2(r8, r8) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x76c4, 0x7, 0x7}) 7.11076059s ago: executing program 2 (id=3145): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x70e4, &(0x7f0000000800)={0x0, 0x0, 0x10100}, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x693}, 0xdd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$sock_rose_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6, @null, @bpq0, 0x1, [@bcast, @default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}) 6.982070913s ago: executing program 6 (id=3146): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, 0x0, &(0x7f00000000c0)=@tcp6}, 0x20) bind$unix(0xffffffffffffffff, 0x0, 0x0) r3 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r4 = openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) close(r4) execveat$binfmt(0xffffffffffffff9c, r3, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r3, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r3, &(0x7f00000004c0)={[0x0, &(0x7f00000003c0)=')!}\x00']}, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sync_file_range(r0, 0xffffffffffffa525, 0x7, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESHEX=0x0]) read$FUSE(r8, &(0x7f0000002480)={0x2020}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80002, 0x0) 6.866502307s ago: executing program 5 (id=3147): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f00000004c0)={{0x1, 0x1, 0xffffffffffffff75, r1, {0x8000009}}, './cgroup/../file0/../file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) openat$cgroup(r3, &(0x7f0000000440)='syz1\x00', 0x200002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32, @ANYBLOB="08000100", @ANYRES32], 0x90}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.906482725s ago: executing program 2 (id=3148): pipe2$9p(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1c, 0x2000000000000329, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1809001ecb74f11e47810000000000000068d90341"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002, 0x2000}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x22004001, &(0x7f0000000180)={0xa, 0x2, 0x3, @empty, 0xd4e}, 0x1c) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x406f413, 0x0) openat(r0, 0x0, 0x145800, 0x100) syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r3, &(0x7f0000000080)={0x3000000, 0x0, 0x3, 0x1}, 0x8) 5.081264898s ago: executing program 5 (id=3149): pipe2$9p(0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000000c0)={@loopback, 0x0}, &(0x7f0000000100)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1c, 0x2000000000000329, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', r0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1809001ecb74f11e47810000000000000068d90341"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002, 0x2000}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x22004001, &(0x7f0000000180)={0xa, 0x2, 0x3, @empty, 0xd4e}, 0x1c) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x406f413, 0x0) openat(r1, 0x0, 0x145800, 0x100) syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) 4.672837671s ago: executing program 8 (id=3150): socket$nl_generic(0x10, 0x3, 0x10) r0 = fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, &(0x7f0000000580)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x3000000, 0x0, 0x0) 3.655003248s ago: executing program 8 (id=3151): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESHEX=0x0]) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x21831002, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x20}}, 0x50) read$FUSE(r0, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup3(r3, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x18d042, 0x140) (fail_nth: 9) 3.510503598s ago: executing program 3 (id=3152): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x2, 0x0) 3.406276053s ago: executing program 3 (id=3153): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x103182, 0x0) socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, &(0x7f0000000200)={@rand_addr=0x64010100, @empty}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) setpgid(0x0, r2) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x901) mount(0x0, 0x0, 0x0, 0x2000, 0x0) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000a3348484bb8df93fe521fe1040f858fb0192fdb61165ae96e54e95f986e1991666a28ea84021377f854fb46b740fc923244159bca8f8f9df6582f8c01dc05733e2e55fc52557ead879afe7c49146aea5741c8105fe87b521f427bf000000000000000000000000000000000000000000000000000000000000004f701390124865885190ca06cb4f206ba657fc27bf050e5038735848f0cf75411468e4dfe3b6b09f3604b8e53e9e597e20f046c1cd9dcbced8b86658007017e0"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000300"/28], 0x50) pread64(r3, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) 2.954827276s ago: executing program 6 (id=3154): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000020601081600000000000000000000000900020073797a3000000000"], 0x20}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x3, 0xa2a23000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000063e000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000240)="360f01f8c744240034000000c744240200000000ff2c2466baf80cb8b4ad6688ef66bafc0ced66450f3814356b000000460f01c9650fc71c260f09b8010000000f01c10f20d835080000000f22d8b96b090000b82e8e0000ba000000000f30", 0x5f}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r3, 0x8982, 0x0) socket$alg(0x26, 0x5, 0x0) socket(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000007c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f0000003840)=[{{&(0x7f0000000300)=@nfc, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000000380)=""/94, 0x5e}], 0x3, &(0x7f0000000500)=""/134, 0x86}, 0x80000000}, {{&(0x7f0000000440)=@ax25={{0x3, @rose}, [@netrom, @rose, @default, @default, @remote, @rose, @bcast]}, 0x80, &(0x7f00000038c0)=[{&(0x7f0000003900)=""/129, 0x81}, {&(0x7f0000002840)=""/4096, 0x1000}], 0x2, &(0x7f0000000700)=""/188, 0xbc}, 0xfffff75b}], 0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r7, 0x890b, &(0x7f0000000080)={@private1={0xfc, 0x1, '\x00', 0x1}, @private1, @mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x280}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f0000000240), 0x0, 0x40010102, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x501a, 0x0, 0x0, 0x0, 0x7, 0x1004, 0xffeff2bd}, 0x0) r10 = socket(0x10, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r10, 0x84, 0x81, &(0x7f00000002c0)="388e3cf598fc01c7000400008a85a30201bb052d61000000", 0x18) 2.734100237s ago: executing program 8 (id=3155): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) read(r0, &(0x7f0000000080)=""/146, 0x92) socket$netlink(0x10, 0x3, 0x9) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="1c00000014000100000080000000000007000080080002"], 0x1c}], 0x1}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_tracing={0x1a, 0x1e, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xe2bd}, [@exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @exit, @alu={0x7, 0x0, 0xb, 0x5, 0x8, 0xffffffffffffffff, 0xffffffffffffffff}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @jmp={0x5, 0x1, 0x0, 0x9, 0x3, 0x30, 0xffffffffffffffff}, @tail_call, @func={0x85, 0x0, 0x1, 0x0, 0x3}]}, &(0x7f0000000580)='syzkaller\x00', 0x48980000, 0x98, &(0x7f0000000780)=""/152, 0x40f00, 0x12, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000000940)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000980)={0x0, 0x10, 0x48, 0xaa00}, 0x10, 0x28c21, r2, 0x6, &(0x7f00000009c0)=[r1, 0xffffffffffffffff, 0xffffffffffffffff, r2, r2, r2], &(0x7f0000000a00)=[{0x3, 0x2, 0x9, 0xc}, {0x1, 0x5, 0x2, 0x9}, {0x2, 0x1, 0xc, 0xc}, {0x2, 0x5, 0xe, 0x8}, {0x3, 0x2, 0xb, 0x2}, {0x3, 0x3, 0xb, 0x1}], 0x10, 0xffffffff}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) 2.715244149s ago: executing program 5 (id=3156): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@getlink={0x28, 0x12, 0xb23, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x8, 0x12, 0x0, 0x1, [{0x4}]}]}, 0x28}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) write$P9_RGETLOCK(r4, &(0x7f0000000640)=ANY=[], 0x200002e6) fcntl$setpipe(r4, 0x407, 0x7000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0xf2de1000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) io_setup(0x8003, &(0x7f0000000600)=0x0) sendmsg$nl_route(r1, 0x0, 0x8000) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r7, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r8}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d6fe682c6100000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) socket$can_j1939(0x1d, 0x2, 0x7) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/4\x00') read$FUSE(r11, &(0x7f0000004000)={0x2020}, 0x204d) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4400000010000124fcffffff8000004600000039f2bf0683ef68502c46b78a177d44ff98490f0098b54c95f39bd6fb8dbb36047080ad3cfd66e1fc9c5cbe4f7cc960ab4e1b53c23ed206b51039607165d3d7c58368b7167a81c47c938c6cebef14ea621b2bfd5a38cc08393d8383a2d2e77514589242f3652db70aa551077854014cc30f8eca5e882a217f9d1686e60dc300750d0ef506c93d113a69ce4c7c2aec032dd1bb702bb90674880df85b451f714ec2ae5ea9a3bbfbf45803ccb5db97553025f0c11212b0a675839d63603a0b3bd98bd0291202c1c4ebceac70fdfa", @ANYRES32=0x0, @ANYBLOB="03150000000000001c0012800b0001006970766c616e00000c000280060001000000000008000500", @ANYRESOCT=r3, @ANYRES8=r6], 0x44}, 0x1, 0x0, 0x0, 0x8840}, 0x0) io_uring_register$IORING_REGISTER_FILES(r9, 0x2, &(0x7f0000000100)=[r10, r0, r12, r4], 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$can_bcm(r7, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4044001) 2.646889226s ago: executing program 2 (id=3157): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x70e4, &(0x7f0000000800)={0x0, 0x0, 0x10100}, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x693}, 0xdd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x1, 0xfffffffffffffe3d}, &(0x7f0000000080)={&(0x7f0000000040)}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$sock_rose_SIOCDELRT(r3, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6, @null, @bpq0, 0x1, [@bcast, @default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}) 2.229621746s ago: executing program 5 (id=3158): ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, 0x0, 0x0) pipe(0x0) socket$inet6(0xa, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x0, 0x2}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x800452d2, &(0x7f0000000100)) 1.428954489s ago: executing program 2 (id=3159): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$xdp(0x2c, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = syz_io_uring_setup(0x233, &(0x7f00000002c0)={0x0, 0x0, 0x10100, 0x0, 0x30}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r3, 0x207a98, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r7, 0xc08c5334, &(0x7f0000000000)={0x2ad5, 0x2ed, 0x1, 'queue0\x00', 0xfffffffa}) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r8}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="180008002de20100cbbdf000fcd92becd59caea9f46e950ddbdf250400000004000f80"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000004) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) 1.303958684s ago: executing program 5 (id=3160): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f00000004c0)={{0x1, 0x1, 0xffffffffffffff75, r1, {0x8000009}}, './cgroup/../file0/../file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) openat$cgroup(r3, &(0x7f0000000440)='syz1\x00', 0x200002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32, @ANYBLOB="08000100", @ANYRES32], 0x90}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.303662968s ago: executing program 6 (id=3161): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a80)={'syz1\x00', {0x0, 0x0, 0x0, 0x1000}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x2) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$UI_DEV_DESTROY(r1, 0x5502) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) recvfrom(r2, 0x0, 0x0, 0x2120, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 1.302765284s ago: executing program 8 (id=3162): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap(&(0x7f0000529000/0x4000)=nil, 0x4000, 0xb635773f06ebbeef, 0x11, r0, 0xfffff000) 1.150978454s ago: executing program 3 (id=3163): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x2, 0x0) 407.441264ms ago: executing program 2 (id=3164): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap(&(0x7f0000529000/0x4000)=nil, 0x4000, 0xb635773f06ebbeef, 0x11, r0, 0xfffff000) (fail_nth: 1) 128.764248ms ago: executing program 8 (id=3165): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x10, 0x5, 0x0, 0x8001, 0x0, 0xffffffffffffffff, 0x2, 0xfffffe0000000001, 0xfa0e, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000000c0)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r5, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r6}], 0x1, 0x0, 0x0, 0x0) close_range(r2, r5, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x16200, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000280), 0x3a1300, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x7f, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r8 = dup2(r7, r7) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x76c4, 0x7, 0x7}) 105.337528ms ago: executing program 2 (id=3166): ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_provisioning(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)={0x1, 0x0, @c}, 0x29, r2) add_key$user(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)='P', 0x1, r2) keyctl$read(0xb, r2, &(0x7f0000002e40)=""/72, 0x4) pipe(0x0) socket$inet6(0xa, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x0, 0x2}, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, &(0x7f0000000100)) 100.3783ms ago: executing program 3 (id=3167): sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x18, 0x140c, 0x4, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20000056) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50000000000101040000000000000000020000001800018014000180080001000000000008000200ac141400240002800c0002800500010000000000140001"], 0x50}}, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB=' @\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fbdbdf25050000000c000980080002000300000004"], 0x24}}, 0x4004) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0xa0, 0x30, 0x51b, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_skbmod={0x5c, 0x1, 0x0, 0x0, {{0xb}, {0x30, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x6}]}, {0x4, 0x14}, {0xc}, {0xc, 0x6}}}, @m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0xa0}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r1, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000280)={'gre0\x00', &(0x7f0000000200)={'ip_vti0\x00', 0x0, 0x8000, 0x10, 0x40, 0x2, {{0xd, 0x4, 0x0, 0x6, 0x34, 0x67, 0x0, 0x1, 0x29, 0x0, @multicast1, @private=0xa010102, {[@ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x1c, 0x90, 0x3, 0xc, [{@loopback}, {@rand_addr=0x64010102, 0x86fa}, {@remote, 0x1000}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vxcan0\x00', 0x0}) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r6) getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="64000000100037040400000000fdffffff000000", @ANYRES32=r7, @ANYBLOB="8304050000000000440012800b000100697036746e6c00003400028014000300fe880000000000000000000000000101050009000400"], 0x64}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) sendmmsg$inet(r5, &(0x7f0000000880)=[{{&(0x7f0000000580)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000540)={'syztnl0\x00', 0x0, 0x4, 0x40, 0x3, 0x9, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x2f}, 0x20, 0x8, 0x0, 0x3}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000440)={'wg0\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000005c0)={@local, @local, 0x0}, &(0x7f0000000600)=0xc) r11 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r12, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000200ac1414bb080004"], 0x44}, 0x1, 0x2}, 0x4000040) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000006c0)={'syztnl0\x00', &(0x7f0000000640)={'syztnl1\x00', 0x0, 0x2f, 0x0, 0xf4, 0xe, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, 0x8000, 0x7800, 0x9, 0x7}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000700)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000740)={'vcan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000800)={'syztnl1\x00', &(0x7f0000000780)={'syztnl2\x00', 0x0, 0x2f, 0x4, 0x3, 0x280000, 0x0, @mcast2, @loopback, 0x700, 0x8000, 0xb4c3, 0x9}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'ip6_vti0\x00', &(0x7f0000000840)={'syztnl0\x00', 0x0, 0x4, 0x6, 0xbe, 0x3, 0x0, @mcast2, @mcast1, 0x1, 0x700, 0x9, 0xfffffffa}}) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000b80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000b40)={&(0x7f0000000900)={0x208, 0x0, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xb49e0d5f45cbb458}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}]}, 0x208}, 0x1, 0x0, 0x0, 0x20000040}, 0x4041) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="180100002e0001"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 51.235545ms ago: executing program 5 (id=3168): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000006111d00000e30ab4b853639d1d0000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x3, 0x4) gettid() 0s ago: executing program 6 (id=3169): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x70e4, &(0x7f0000000800)={0x0, 0x0, 0x10100}, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x693}, 0xdd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$sock_rose_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6, @null, @bpq0, 0x1, [@bcast, @default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}) kernel console output (not intermixed with test programs): 4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2685" name="/" dev="9p" ino=2 res=0 errno=0 [ 875.876142][T16311] CPU: 0 UID: 0 PID: 16311 Comm: syz.4.2685 Not tainted syzkaller #0 PREEMPT(full) [ 875.876166][T16311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 875.876177][T16311] Call Trace: [ 875.876183][T16311] [ 875.876191][T16311] dump_stack_lvl+0x16c/0x1f0 [ 875.876216][T16311] should_fail_ex+0x512/0x640 [ 875.876241][T16311] _copy_from_user+0x2e/0xd0 [ 875.876265][T16311] kstrtouint_from_user+0xd6/0x1d0 [ 875.876282][T16311] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 875.876299][T16311] ? __lock_acquire+0xb97/0x1ce0 [ 875.876339][T16311] proc_fail_nth_write+0x83/0x220 [ 875.876362][T16311] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 875.876390][T16311] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 875.876410][T16311] vfs_write+0x29d/0x11d0 [ 875.876433][T16311] ? __pfx___mutex_lock+0x10/0x10 [ 875.876453][T16311] ? __pfx_vfs_write+0x10/0x10 [ 875.876479][T16311] ? __fget_files+0x20e/0x3c0 [ 875.876506][T16311] ksys_write+0x12a/0x250 [ 875.876524][T16311] ? __pfx_ksys_write+0x10/0x10 [ 875.876550][T16311] do_syscall_64+0xcd/0x4c0 [ 875.876572][T16311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.876590][T16311] RIP: 0033:0x7fb04358d69f [ 875.876605][T16311] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 875.876622][T16311] RSP: 002b:00007fb04443a030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 875.876639][T16311] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb04358d69f [ 875.876650][T16311] RDX: 0000000000000001 RSI: 00007fb04443a0a0 RDI: 0000000000000007 [ 875.876661][T16311] RBP: 00007fb04443a090 R08: 0000000000000000 R09: 0000000000000000 [ 875.876672][T16311] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 875.876683][T16311] R13: 00007fb0437b6038 R14: 00007fb0437b5fa0 R15: 00007ffdce669228 [ 875.876709][T16311] [ 876.446855][ T30] audit: type=1400 audit(1755910273.364:1071): avc: denied { read } for pid=5203 comm="acpid" name="event9" dev="devtmpfs" ino=3533 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 876.792749][ T30] audit: type=1400 audit(1755910273.364:1072): avc: denied { open } for pid=5203 comm="acpid" path="/dev/input/event9" dev="devtmpfs" ino=3533 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 877.005941][ T30] audit: type=1400 audit(1755910273.364:1073): avc: denied { ioctl } for pid=5203 comm="acpid" path="/dev/input/event9" dev="devtmpfs" ino=3533 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 877.192448][T16317] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 877.200311][T16317] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 877.208863][T16317] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 877.223533][T16317] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 877.542033][T16317] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2686'. [ 878.367148][T16350] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2696'. [ 882.783888][T16390] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2708'. [ 883.094051][T16392] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 883.107276][T16392] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 883.128600][T16392] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 883.139216][T16392] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 883.163431][T16392] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2707'. [ 883.425642][T16402] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2709'. [ 883.936095][T16407] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 884.741350][T16424] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 884.751943][T16424] SELinux: failed to load policy [ 885.717587][T16437] validate_nla: 33 callbacks suppressed [ 885.717610][T16437] netlink: 'syz.6.2718': attribute type 12 has an invalid length. [ 885.731087][T16437] netlink: 9472 bytes leftover after parsing attributes in process `syz.6.2718'. [ 885.741249][ T24] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 886.006203][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 886.016988][ T24] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 886.028479][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.054833][ T24] usb 3-1: config 0 descriptor?? [ 886.091042][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 886.204952][ T30] audit: type=1400 audit(1755910283.274:1074): avc: denied { accept } for pid=16440 comm="syz.3.2722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 886.546383][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 886.553780][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 886.561710][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 886.571013][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 886.578396][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 886.587830][ T24] pwc: recv_control_msg error -32 req 04 val 1400 [ 886.595057][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 886.601991][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 886.611054][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 886.619442][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 886.650924][ T24] pwc: recv_control_msg error -32 req 02 val 2400 [ 886.845316][T16451] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 886.853531][T16451] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 886.863163][T16451] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 886.883418][T16451] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 886.924561][T16453] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2723'. [ 887.044530][ T24] pwc: recv_control_msg error -32 req 02 val 2900 [ 887.505278][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 887.515667][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 887.572079][ T24] pwc: Registered as video103. [ 887.595718][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input57 [ 887.693027][ T24] usb 3-1: USB disconnect, device number 63 [ 890.271477][ T30] audit: type=1400 audit(1755910287.334:1075): avc: denied { module_load } for pid=16478 comm="syz.2.2730" path="/sys/kernel/notes" dev="sysfs" ino=1406 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 890.297214][T16481] Invalid ELF header magic: != ELF [ 890.307311][T16481] overlayfs: missing 'lowerdir' [ 890.324061][T16481] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2730'. [ 891.072413][T16495] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 891.901305][ T24] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 892.128589][T16518] F2FS-fs (loop6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 892.137440][T16518] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 892.149075][T16518] F2FS-fs (loop6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 892.159441][T16518] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 892.173219][T16522] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2740'. [ 892.214346][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 892.228722][ T24] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 892.243012][T12723] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 892.265648][ T30] audit: type=1400 audit(1755910289.334:1076): avc: denied { setopt } for pid=16524 comm="syz.3.2742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 892.285685][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.296794][ T24] usb 3-1: config 0 descriptor?? [ 892.344633][T12723] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 892.386057][T12723] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 892.388057][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 892.395548][T12723] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 892.406885][T12723] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 892.530442][T16526] wlan1 speed is unknown, defaulting to 1000 [ 892.602162][T16531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.612143][T16531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.633526][T16526] wg2 speed is unknown, defaulting to 1000 [ 892.774478][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 892.781724][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 892.790904][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 892.798282][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 892.807268][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 892.817448][ T24] pwc: recv_control_msg error -32 req 04 val 1400 [ 892.825095][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 892.833025][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 892.840764][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 892.850032][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 892.858777][ T24] pwc: recv_control_msg error -32 req 02 val 2400 [ 893.068914][ T24] pwc: recv_control_msg error -32 req 02 val 2900 [ 893.258129][T16526] chnl_net:caif_netlink_parms(): no params data found [ 893.278867][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 893.286015][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 893.324924][ T24] pwc: Registered as video103. [ 893.340997][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input58 [ 893.398955][ T24] usb 3-1: USB disconnect, device number 64 [ 893.437780][T16526] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.445405][T16526] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.452678][T16526] bridge_slave_0: entered allmulticast mode [ 893.461300][T16526] bridge_slave_0: entered promiscuous mode [ 893.469239][T16526] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.476608][T16526] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.485462][T16526] bridge_slave_1: entered allmulticast mode [ 893.492791][T16526] bridge_slave_1: entered promiscuous mode [ 893.520388][T16526] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 893.531267][T16526] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 893.688733][T16526] team0: Port device team_slave_0 added [ 893.697337][T16526] team0: Port device team_slave_1 added [ 893.763923][T16526] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 893.771162][T16526] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 893.827528][T16526] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 893.860194][T16526] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 893.870240][T16526] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 893.897037][T16526] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 894.043214][T16526] hsr_slave_0: entered promiscuous mode [ 894.114595][T16541] netlink: 44 bytes leftover after parsing attributes in process `syz.6.2743'. [ 894.123653][T16541] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2743'. [ 894.465420][T16526] hsr_slave_1: entered promiscuous mode [ 894.471740][T16526] debugfs: 'hsr0' already exists in 'hsr' [ 894.477587][T16526] Cannot create hsr debugfs directory [ 894.494399][T12723] Bluetooth: hci2: command 0x0c1a tx timeout [ 894.494820][T16529] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 894.506637][T12723] Bluetooth: hci5: command tx timeout [ 894.524437][T16529] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 896.207255][T16550] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 896.443745][T16526] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 896.574483][ T5863] Bluetooth: hci5: command tx timeout [ 896.577476][T12723] Bluetooth: hci1: command 0x0c1a tx timeout [ 896.591575][T16526] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 896.591890][T16529] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 896.609689][T16526] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 896.818606][T16526] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 897.048770][T16529] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 897.080098][T16529] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 897.086360][T16529] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 897.390458][T16564] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2748'. [ 897.813259][T16526] 8021q: adding VLAN 0 to HW filter on device bond0 [ 897.849774][T16526] 8021q: adding VLAN 0 to HW filter on device team0 [ 897.867270][T15922] bridge0: port 1(bridge_slave_0) entered blocking state [ 897.875665][T15922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 897.896590][T15919] bridge0: port 2(bridge_slave_1) entered blocking state [ 897.903746][T15919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 897.943538][T16526] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 897.957632][T16526] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 898.698747][T16583] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 898.708239][T16583] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 898.716739][T16583] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 898.727129][T16585] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2752'. [ 898.748165][T16583] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 898.999713][T16589] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2753'. [ 899.578096][ T30] audit: type=1400 audit(1755910296.644:1077): avc: denied { ioctl } for pid=16590 comm="syz.5.2754" path="pid:[4026532885]" dev="nsfs" ino=4026532885 ioctlcmd=0xb702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 899.613644][T16594] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 899.713324][T16594] UDF-fs: Scanning with blocksize 512 failed [ 899.731141][T16594] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 899.767623][T16526] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 899.794432][T16594] UDF-fs: Scanning with blocksize 1024 failed [ 899.811124][T16594] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 899.844495][T16594] UDF-fs: Scanning with blocksize 2048 failed [ 899.850999][T16594] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 899.894443][T16594] UDF-fs: Scanning with blocksize 4096 failed [ 900.118219][T16606] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2756'. [ 900.127348][T16606] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2756'. [ 900.497946][T16609] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2757'. [ 900.532011][T16526] veth0_vlan: entered promiscuous mode [ 900.701808][T16526] veth1_vlan: entered promiscuous mode [ 900.814288][ T5968] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 900.990986][ T5968] usb 6-1: Using ep0 maxpacket: 16 [ 901.008602][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 901.095484][T16526] veth0_macvtap: entered promiscuous mode [ 901.153049][ T5968] usb 6-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 901.176550][ T5968] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.178594][T16526] veth1_macvtap: entered promiscuous mode [ 901.187408][ T5968] usb 6-1: Product: syz [ 901.196562][ T5968] usb 6-1: Manufacturer: syz [ 901.203198][ T5968] usb 6-1: SerialNumber: syz [ 901.229020][ T5968] usb 6-1: config 0 descriptor?? [ 901.232051][T16526] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 901.242560][ T5968] ftdi_sio 6-1:0.0: FTDI USB Serial Device converter detected [ 901.247949][T16526] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 901.259300][ T5968] usb 6-1: Detected FT232R [ 901.297913][T15921] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.310188][T15921] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.323844][T15921] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.327423][ T30] audit: type=1400 audit(1755910298.394:1078): avc: denied { ioctl } for pid=16621 comm="syz.2.2762" path="socket:[60067]" dev="sockfs" ino=60067 ioctlcmd=0x3ba0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 901.343690][T16622] binder: 16621:16622 ioctl c0306201 200000000440 returned -14 [ 901.458971][T15921] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.469235][ T5968] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 901.482910][ T5968] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 901.491209][ T5968] ftdi_sio 6-1:0.0: GPIO initialisation failed: -71 [ 901.493289][T16622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2762'. [ 901.515447][ T5968] usb 6-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 901.539997][ T5968] usb 6-1: USB disconnect, device number 14 [ 901.587409][ T5968] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 902.144706][ T5968] ftdi_sio 6-1:0.0: device disconnected [ 902.434197][ T5987] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 902.543569][ T30] audit: type=1400 audit(1755910299.604:1079): avc: denied { map } for pid=16631 comm="syz.3.2765" path="/dev/comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 902.592611][T15927] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.627779][ T30] audit: type=1400 audit(1755910299.604:1080): avc: denied { read } for pid=16631 comm="syz.3.2765" path="socket:[60154]" dev="sockfs" ino=60154 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 902.654781][ T5987] usb 3-1: device descriptor read/64, error -71 [ 902.946280][T15927] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.994312][ T5987] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 903.117191][T16641] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2767'. [ 903.126291][T16641] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2767'. [ 903.145375][ T5987] usb 3-1: device descriptor read/64, error -71 [ 903.285169][ T5987] usb usb3-port1: attempt power cycle [ 903.458349][T15927] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 903.552607][T16643] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2768'. [ 903.658525][ T5987] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 903.751737][ T5987] usb 3-1: device descriptor read/8, error -71 [ 903.760483][T15927] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 903.849564][T16645] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2768'. [ 904.015130][ T5987] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 904.029960][ T5863] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 904.119950][ T5863] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 904.134178][ T5863] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 905.109415][T15927] bridge_slave_1: left allmulticast mode [ 905.115174][T15927] bridge_slave_1: left promiscuous mode [ 905.120995][ T5863] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 905.132795][ T5987] usb 3-1: device descriptor read/8, error -71 [ 905.140653][ T5863] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 905.158323][T15927] bridge0: port 2(bridge_slave_1) entered disabled state [ 905.254388][ T5987] usb usb3-port1: unable to enumerate USB device [ 905.285666][T15927] bridge_slave_0: left allmulticast mode [ 905.434665][T15927] bridge_slave_0: left promiscuous mode [ 905.444699][T15927] bridge0: port 1(bridge_slave_0) entered disabled state [ 905.494557][ T5908] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 905.681097][ T5908] usb 6-1: Using ep0 maxpacket: 8 [ 905.712139][ T5908] usb 6-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 905.722077][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.744173][ T5908] usb 6-1: Product: syz [ 905.752526][ T5908] usb 6-1: Manufacturer: syz [ 905.771541][ T5908] usb 6-1: SerialNumber: syz [ 905.794919][ T5908] usb 6-1: config 0 descriptor?? [ 905.884725][ T5908] usb 6-1: selecting invalid altsetting 3 [ 905.919496][ T5908] comedi comedi5: could not set alternate setting 3 in high speed [ 906.074331][ T5908] usbdux 6-1:0.0: driver 'usbdux' failed to auto-configure device. [ 906.107110][ T5908] usbdux 6-1:0.0: probe with driver usbdux failed with error -22 [ 906.122413][ T5908] usb 6-1: USB disconnect, device number 15 [ 906.354806][T15927] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 906.390898][T15927] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 906.418284][T15927] bond0 (unregistering): Released all slaves [ 906.502348][T16654] wlan1 speed is unknown, defaulting to 1000 [ 906.522077][T16654] wg2 speed is unknown, defaulting to 1000 [ 907.272220][T12723] Bluetooth: hci5: command tx timeout [ 907.978769][ T30] audit: type=1400 audit(1755910305.044:1081): avc: denied { connect } for pid=16688 comm="syz.3.2780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 908.062168][T15927] hsr_slave_0: left promiscuous mode [ 908.072561][T15927] hsr_slave_1: left promiscuous mode [ 908.078567][T15927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 908.085976][T15927] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 908.153756][T15927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 908.164316][T15927] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 908.304960][T15927] veth1_macvtap: left promiscuous mode [ 908.352144][T15927] veth0_macvtap: left promiscuous mode [ 908.373155][T15927] veth1_vlan: left promiscuous mode [ 908.391687][T15927] veth0_vlan: left promiscuous mode [ 908.870469][T16709] F2FS-fs (loop6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 908.879239][T16709] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 908.890569][T16709] F2FS-fs (loop6): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 908.900267][T16709] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 908.930105][T16709] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2783'. [ 909.150356][T16713] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 909.161840][T16713] SELinux: failed to load policy [ 909.354760][T12723] Bluetooth: hci5: command tx timeout [ 911.407278][T12723] Bluetooth: hci5: command tx timeout [ 912.650004][T15927] team0 (unregistering): Port device team_slave_1 removed [ 912.731839][T15927] team0 (unregistering): Port device team_slave_0 removed [ 913.462105][T12723] Bluetooth: hci5: command tx timeout [ 913.474350][T16654] chnl_net:caif_netlink_parms(): no params data found [ 913.874312][ T1674] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 913.882066][T16749] atomic_op ffff88804e1b9198 conn xmit_atomic 0000000000000000 [ 914.113011][T16749] netlink: 'syz.6.2793': attribute type 1 has an invalid length. [ 914.138332][T16749] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2793'. [ 914.252145][ T1674] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 914.314261][ T1674] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 914.357454][ T1674] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 914.366572][ T1674] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 914.386163][ T1674] usb 6-1: config 0 descriptor?? [ 914.396037][ T1674] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 914.402674][ T1674] dvb-usb: bulk message failed: -22 (3/0) [ 914.409901][ T1674] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 914.422857][ T1674] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 914.494237][ T1674] usb 6-1: media controller created [ 914.508157][T16654] bridge0: port 1(bridge_slave_0) entered blocking state [ 914.516028][T16654] bridge0: port 1(bridge_slave_0) entered disabled state [ 914.523318][T16654] bridge_slave_0: entered allmulticast mode [ 914.534567][T16654] bridge_slave_0: entered promiscuous mode [ 914.554560][ T1674] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 914.555065][T16654] bridge0: port 2(bridge_slave_1) entered blocking state [ 914.660596][T16654] bridge0: port 2(bridge_slave_1) entered disabled state [ 914.668306][T16654] bridge_slave_1: entered allmulticast mode [ 914.675909][T16654] bridge_slave_1: entered promiscuous mode [ 914.711027][T16744] dibusb: i2c wr: len=61 is too big! [ 914.711027][T16744] [ 915.225928][ T1674] dvb-usb: bulk message failed: -22 (6/0) [ 915.236488][ T1674] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 915.245663][ T1674] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input59 [ 915.260014][ T1674] dvb-usb: schedule remote query interval to 150 msecs. [ 915.279703][ T1674] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 915.321045][T16654] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 915.417958][T16654] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 915.434928][T16765] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 915.442430][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 915.478678][T14225] dvb-usb: error while querying for an remote control event. [ 915.656269][T16654] team0: Port device team_slave_0 added [ 915.664450][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 915.665734][T16654] team0: Port device team_slave_1 added [ 915.675945][ T1674] dvb-usb: error while querying for an remote control event. [ 915.774395][T14225] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 915.810778][T16654] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.817788][T16654] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 915.854732][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 915.881561][ T1674] dvb-usb: error while querying for an remote control event. [ 915.908385][T14225] usb 7-1: device descriptor read/64, error -71 [ 916.095968][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 916.102240][ T1674] dvb-usb: error while querying for an remote control event. [ 916.174868][T14225] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 916.264407][T16654] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 916.276940][T16654] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 916.284575][T16654] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 916.311009][T16654] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 916.372709][T16654] hsr_slave_0: entered promiscuous mode [ 916.381137][T16654] hsr_slave_1: entered promiscuous mode [ 916.390527][T16654] debugfs: 'hsr0' already exists in 'hsr' [ 916.396931][T16654] Cannot create hsr debugfs directory [ 916.427375][T14225] usb 7-1: device descriptor read/64, error -71 [ 916.464836][ T1674] usb 6-1: USB disconnect, device number 16 [ 916.516198][ T1674] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 916.549299][T14225] usb usb7-port1: attempt power cycle [ 916.643563][ T30] audit: type=1400 audit(1755910313.704:1082): avc: denied { map } for pid=16780 comm="syz.2.2802" path="/proc/sys/net/ipv4/vs/sync_version" dev="proc" ino=61713 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 916.674838][ T30] audit: type=1400 audit(1755910313.734:1083): avc: denied { bind } for pid=16778 comm="syz.3.2801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 916.702739][ T30] audit: type=1400 audit(1755910313.734:1084): avc: denied { write } for pid=16778 comm="syz.3.2801" path="socket:[61381]" dev="sockfs" ino=61381 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 916.894454][T14225] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 916.934793][T14225] usb 7-1: device descriptor read/8, error -71 [ 917.174511][T14225] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 917.246781][T14225] usb 7-1: device descriptor read/8, error -71 [ 917.575169][T14225] usb usb7-port1: unable to enumerate USB device [ 917.680104][T16654] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 917.695564][T16654] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 917.705712][T16654] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 917.718300][T16654] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 918.183536][T16654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.212256][T16654] 8021q: adding VLAN 0 to HW filter on device team0 [ 918.249438][T16654] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 918.603442][T16809] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 918.624610][T16654] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 918.648511][T15922] bridge0: port 1(bridge_slave_0) entered blocking state [ 918.655689][T15922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 918.740779][ T30] audit: type=1400 audit(1755910315.804:1085): avc: denied { map } for pid=16805 comm="syz.2.2807" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 918.788922][T15922] bridge0: port 2(bridge_slave_1) entered blocking state [ 918.796103][T15922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 920.096860][T16654] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 920.275360][T16835] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2815'. [ 920.285223][T16835] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2815'. [ 920.382087][T16840] overlayfs: failed to resolve './file0': -2 [ 920.481130][T16835] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2815'. [ 920.559249][T16835] netlink: 348 bytes leftover after parsing attributes in process `syz.3.2815'. [ 921.036554][ T24] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 921.385278][T16858] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 921.404380][ T24] usb 3-1: device descriptor read/64, error -71 [ 921.496332][T16654] veth0_vlan: entered promiscuous mode [ 921.516171][T16654] veth1_vlan: entered promiscuous mode [ 921.568621][T16654] veth0_macvtap: entered promiscuous mode [ 921.579225][T16654] veth1_macvtap: entered promiscuous mode [ 921.601151][T16654] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 921.719247][ T24] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 921.722088][T16654] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 921.740778][T15924] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.750317][T15924] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.774074][T15924] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.825430][T15924] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.894527][ T24] usb 3-1: device descriptor read/64, error -71 [ 922.000699][T16865] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2822'. [ 922.010942][ T24] usb usb3-port1: attempt power cycle [ 922.052608][T15924] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.065103][T15924] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.124051][T15923] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.132779][T15923] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.405853][ T24] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 922.437134][ T24] usb 3-1: device descriptor read/8, error -71 [ 922.763200][ T24] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 922.794724][ T24] usb 3-1: device descriptor read/8, error -71 [ 922.950854][ T24] usb usb3-port1: unable to enumerate USB device [ 925.482658][ T5968] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 925.716858][ T5968] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 925.754664][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 925.770870][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 925.782699][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 925.836004][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 925.873366][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 925.902490][T16939] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 925.910650][T16939] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 925.928006][T16939] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 925.939909][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 925.999919][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 926.008991][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 926.089481][T16940] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2841'. [ 926.124642][T16939] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 926.287782][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 926.752603][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 926.881303][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 927.132253][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 927.172562][ T30] audit: type=1400 audit(1755910324.234:1086): avc: denied { ioctl } for pid=16944 comm="syz.2.2842" path="/589/file0" dev="tmpfs" ino=3107 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 927.205867][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 927.308618][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 927.347954][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 927.373664][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 927.423064][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 927.481473][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 927.564244][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 927.584156][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 927.595552][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 927.604710][ T5968] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 927.613709][ T5968] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 927.644197][ T5968] usb 6-1: config 0 interface 0 has no altsetting 0 [ 927.661930][ T5968] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 927.684332][ T5968] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 927.712942][ T5968] usb 6-1: Product: syz [ 927.757768][ T5968] usb 6-1: Manufacturer: syz [ 927.762640][ T5968] usb 6-1: SerialNumber: syz [ 927.824867][ T5968] usb 6-1: config 0 descriptor?? [ 927.834647][ T5968] usb 6-1: can't set config #0, error -71 [ 927.863738][ T5968] usb 6-1: USB disconnect, device number 17 [ 929.649484][T16997] bpq0: left allmulticast mode [ 931.160408][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.705554][T17025] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 931.713487][T17025] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 931.721744][ T24] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 931.739955][T17025] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 931.807021][T17025] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 931.807553][T17030] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2860'. [ 932.064227][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 932.077326][ T24] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 932.089094][ T24] usb 7-1: config 0 has no interface number 0 [ 932.101228][ T24] usb 7-1: config 0 interface 41 has no altsetting 0 [ 932.113577][ T24] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 932.122860][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.211817][ T24] usb 7-1: Product: syz [ 932.218329][ T24] usb 7-1: Manufacturer: syz [ 932.222963][ T24] usb 7-1: SerialNumber: syz [ 932.406200][ T24] usb 7-1: config 0 descriptor?? [ 932.413184][ T24] CoreChips 7-1:0.41: probe with driver CoreChips failed with error -22 [ 932.980495][T14225] usb 7-1: USB disconnect, device number 15 [ 934.537855][T17081] FAULT_INJECTION: forcing a failure. [ 934.537855][T17081] name failslab, interval 1, probability 0, space 0, times 0 [ 934.669939][T17087] CIFS mount error: No usable UNC path provided in device string! [ 934.669939][T17087] [ 934.680209][T17087] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 935.389422][T17081] CPU: 0 UID: 0 PID: 17081 Comm: syz.5.2883 Not tainted syzkaller #0 PREEMPT(full) [ 935.389447][T17081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 935.389457][T17081] Call Trace: [ 935.389463][T17081] [ 935.389470][T17081] dump_stack_lvl+0x16c/0x1f0 [ 935.389493][T17081] should_fail_ex+0x512/0x640 [ 935.389512][T17081] ? kmem_cache_alloc_lru_noprof+0x5f/0x3b0 [ 935.389532][T17081] should_failslab+0xc2/0x120 [ 935.389553][T17081] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 935.389573][T17081] ? ovl_alloc_inode+0x25/0x190 [ 935.389593][T17081] ? __pfx_ovl_inode_set+0x10/0x10 [ 935.389611][T17081] ? __pfx_ovl_alloc_inode+0x10/0x10 [ 935.389627][T17081] ovl_alloc_inode+0x25/0x190 [ 935.389644][T17081] alloc_inode+0x61/0x240 [ 935.389666][T17081] iget5_locked+0x338/0x3d0 [ 935.389690][T17081] ? __pfx_ovl_inode_test+0x10/0x10 [ 935.389707][T17081] ? __pfx_ovl_inode_set+0x10/0x10 [ 935.389726][T17081] ? __pfx_iget5_locked+0x10/0x10 [ 935.389763][T17081] ovl_get_inode+0xce9/0x13d0 [ 935.389790][T17081] ? __pfx_ovl_get_inode+0x10/0x10 [ 935.389812][T17081] ? kfree+0x2b4/0x4d0 [ 935.389833][T17081] ? ovl_lookup+0x1a7d/0x21a0 [ 935.389857][T17081] ovl_lookup+0xda8/0x21a0 [ 935.389875][T17081] ? avc_has_perm_noaudit+0x149/0x3b0 [ 935.389905][T17081] ? __pfx_ovl_lookup+0x10/0x10 [ 935.389928][T17081] ? selinux_determine_inode_label+0x2b8/0x400 [ 935.389959][T17081] ? may_create+0x286/0x440 [ 935.389992][T17081] ? __pfx_ovl_permission+0x10/0x10 [ 935.390010][T17081] ? bpf_lsm_inode_permission+0x9/0x10 [ 935.390030][T17081] ? security_inode_permission+0xbf/0x260 [ 935.390059][T17081] ? __pfx_ovl_lookup+0x10/0x10 [ 935.390079][T17081] lookup_open.isra.0+0x4d7/0x1580 [ 935.390104][T17081] ? __pfx_lookup_open.isra.0+0x10/0x10 [ 935.390146][T17081] ? __pfx_down_write+0x10/0x10 [ 935.390167][T17081] ? mnt_get_write_access+0x20c/0x300 [ 935.390198][T17081] path_openat+0x893/0x2cb0 [ 935.390227][T17081] ? __pfx_path_openat+0x10/0x10 [ 935.390249][T17081] ? __lock_acquire+0xb97/0x1ce0 [ 935.390280][T17081] do_filp_open+0x20b/0x470 [ 935.390301][T17081] ? __pfx_do_filp_open+0x10/0x10 [ 935.390340][T17081] ? _raw_spin_unlock+0x28/0x50 [ 935.390376][T17081] ? alloc_fd+0x471/0x7d0 [ 935.390405][T17081] do_sys_openat2+0x11b/0x1d0 [ 935.390431][T17081] ? __pfx_do_sys_openat2+0x10/0x10 [ 935.390458][T17081] ? __fget_files+0x20e/0x3c0 [ 935.390485][T17081] __x64_sys_open+0x153/0x1e0 [ 935.390509][T17081] ? __pfx___x64_sys_open+0x10/0x10 [ 935.390542][T17081] ? rcu_is_watching+0x12/0xc0 [ 935.390566][T17081] do_syscall_64+0xcd/0x4c0 [ 935.390588][T17081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.390606][T17081] RIP: 0033:0x7fb4f998ebe9 [ 935.390622][T17081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 935.390641][T17081] RSP: 002b:00007fb4fa7af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 935.390660][T17081] RAX: ffffffffffffffda RBX: 00007fb4f9bb5fa0 RCX: 00007fb4f998ebe9 [ 935.390673][T17081] RDX: 0000000000000000 RSI: 00000000001612c2 RDI: 0000200000000200 [ 935.390683][T17081] RBP: 00007fb4fa7af090 R08: 0000000000000000 R09: 0000000000000000 [ 935.390692][T17081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 935.390700][T17081] R13: 00007fb4f9bb6038 R14: 00007fb4f9bb5fa0 R15: 00007ffda136cae8 [ 935.390724][T17081] [ 935.390973][T17081] overlayfs: failed to get inode (-12) [ 936.807144][T17103] netlink: 146872 bytes leftover after parsing attributes in process `syz.5.2889'. [ 937.412509][ T5863] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 937.422832][ T5863] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 937.431202][ T5863] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 937.440051][ T5863] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 937.449648][ T5863] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 937.562172][ T24] usb 4-1: USB disconnect, device number 56 [ 938.125959][T15924] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 938.143681][T15924] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 938.191614][T17114] wlan1 speed is unknown, defaulting to 1000 [ 938.212716][T17114] wg2 speed is unknown, defaulting to 1000 [ 938.218684][T17134] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 938.285013][T17137] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 938.295325][T17137] SELinux: failed to load policy [ 938.321519][T15924] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 938.345817][T15924] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.075804][T15924] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 939.091686][T15924] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.110775][T17150] syz.7.2901 (17150): drop_caches: 4 [ 939.310386][T15924] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 939.356734][T15924] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.535793][ T5863] Bluetooth: hci3: command tx timeout [ 939.956189][ T30] audit: type=1400 audit(1755910337.024:1087): avc: denied { map } for pid=17169 comm="syz.5.2906" path="socket:[64703]" dev="sockfs" ino=64703 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 940.145801][T17175] FAULT_INJECTION: forcing a failure. [ 940.145801][T17175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 940.184297][T17175] CPU: 1 UID: 0 PID: 17175 Comm: syz.5.2906 Not tainted syzkaller #0 PREEMPT(full) [ 940.184323][T17175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 940.184334][T17175] Call Trace: [ 940.184341][T17175] [ 940.184348][T17175] dump_stack_lvl+0x16c/0x1f0 [ 940.184374][T17175] should_fail_ex+0x512/0x640 [ 940.184399][T17175] _copy_to_user+0x32/0xd0 [ 940.184425][T17175] simple_read_from_buffer+0xcb/0x170 [ 940.184447][T17175] proc_fail_nth_read+0x197/0x240 [ 940.184469][T17175] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 940.184492][T17175] ? rw_verify_area+0xcf/0x6c0 [ 940.184517][T17175] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 940.184537][T17175] vfs_read+0x1e1/0xcf0 [ 940.184558][T17175] ? __pfx___mutex_lock+0x10/0x10 [ 940.184579][T17175] ? __pfx_vfs_read+0x10/0x10 [ 940.184603][T17175] ? __fget_files+0x20e/0x3c0 [ 940.184630][T17175] ksys_read+0x12a/0x250 [ 940.184647][T17175] ? __pfx_ksys_read+0x10/0x10 [ 940.184672][T17175] do_syscall_64+0xcd/0x4c0 [ 940.184694][T17175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.184712][T17175] RIP: 0033:0x7fb4f998d5fc [ 940.184726][T17175] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 940.184743][T17175] RSP: 002b:00007fb4fa78e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 940.184760][T17175] RAX: ffffffffffffffda RBX: 00007fb4f9bb6090 RCX: 00007fb4f998d5fc [ 940.184771][T17175] RDX: 000000000000000f RSI: 00007fb4fa78e0a0 RDI: 0000000000000008 [ 940.184782][T17175] RBP: 00007fb4fa78e090 R08: 0000000000000000 R09: 0000000000000000 [ 940.184792][T17175] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 940.184803][T17175] R13: 00007fb4f9bb6128 R14: 00007fb4f9bb6090 R15: 00007ffda136cae8 [ 940.184827][T17175] [ 940.380447][ T5863] Bluetooth: hci0: command tx timeout [ 940.528841][T17177] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 941.614193][ T5863] Bluetooth: hci3: command tx timeout [ 942.555939][T17202] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2913'. [ 943.179012][T15924] bond0 (unregistering): Released all slaves [ 943.190812][T15924] bond1 (unregistering): Released all slaves [ 943.207626][T17114] chnl_net:caif_netlink_parms(): no params data found [ 943.246883][T15924] : left promiscuous mode [ 943.381302][T15924] tipc: Left network mode [ 943.571752][T17222] netlink: 244 bytes leftover after parsing attributes in process `syz.5.2919'. [ 943.670927][T17222] FAULT_INJECTION: forcing a failure. [ 943.670927][T17222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 943.685989][T17222] CPU: 1 UID: 0 PID: 17222 Comm: syz.5.2919 Not tainted syzkaller #0 PREEMPT(full) [ 943.686006][T17222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 943.686013][T17222] Call Trace: [ 943.686017][T17222] [ 943.686021][T17222] dump_stack_lvl+0x16c/0x1f0 [ 943.686038][T17222] should_fail_ex+0x512/0x640 [ 943.686053][T17222] _copy_to_user+0x32/0xd0 [ 943.686069][T17222] simple_read_from_buffer+0xcb/0x170 [ 943.686083][T17222] proc_fail_nth_read+0x197/0x240 [ 943.686097][T17222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 943.686111][T17222] ? rw_verify_area+0xcf/0x6c0 [ 943.686128][T17222] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 943.686140][T17222] vfs_read+0x1e1/0xcf0 [ 943.686153][T17222] ? __pfx___mutex_lock+0x10/0x10 [ 943.686166][T17222] ? __pfx_vfs_read+0x10/0x10 [ 943.686181][T17222] ? __fget_files+0x20e/0x3c0 [ 943.686197][T17222] ksys_read+0x12a/0x250 [ 943.686208][T17222] ? __pfx_ksys_read+0x10/0x10 [ 943.686223][T17222] do_syscall_64+0xcd/0x4c0 [ 943.686236][T17222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.686248][T17222] RIP: 0033:0x7fb4f998d5fc [ 943.686257][T17222] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 943.686268][T17222] RSP: 002b:00007fb4fa7af030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 943.686285][T17222] RAX: ffffffffffffffda RBX: 00007fb4f9bb5fa0 RCX: 00007fb4f998d5fc [ 943.686292][T17222] RDX: 000000000000000f RSI: 00007fb4fa7af0a0 RDI: 0000000000000003 [ 943.686298][T17222] RBP: 00007fb4fa7af090 R08: 0000000000000000 R09: 0000000000000000 [ 943.686305][T17222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 943.686312][T17222] R13: 00007fb4f9bb6038 R14: 00007fb4f9bb5fa0 R15: 00007ffda136cae8 [ 943.686326][T17222] [ 943.871948][ C1] vkms_vblank_simulate: vblank timer overrun [ 943.882609][T17114] bridge0: port 1(bridge_slave_0) entered blocking state [ 943.892869][T17114] bridge0: port 1(bridge_slave_0) entered disabled state [ 943.984204][ T5863] Bluetooth: hci3: command tx timeout [ 944.026563][T17114] bridge_slave_0: entered allmulticast mode [ 944.050059][T17114] bridge_slave_0: entered promiscuous mode [ 944.073757][T17223] pim6reg1: entered promiscuous mode [ 944.087017][T17223] pim6reg1: entered allmulticast mode [ 944.102775][T17233] netlink: 25 bytes leftover after parsing attributes in process `syz.6.2920'. [ 944.122737][T17114] bridge0: port 2(bridge_slave_1) entered blocking state [ 944.130160][T17114] bridge0: port 2(bridge_slave_1) entered disabled state [ 944.137418][T17114] bridge_slave_1: entered allmulticast mode [ 944.159971][T17114] bridge_slave_1: entered promiscuous mode [ 944.251529][T17114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 944.272528][T17114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 944.294384][ T5968] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 944.499709][T17239] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2923'. [ 944.614500][ T5968] usb 3-1: Using ep0 maxpacket: 8 [ 944.626826][ T5968] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 944.642535][ T5968] usb 3-1: config 0 has no interface number 0 [ 944.655789][T17114] team0: Port device team_slave_0 added [ 944.729013][ T5968] usb 3-1: config 0 interface 38 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 944.753146][T17114] team0: Port device team_slave_1 added [ 944.764163][T15069] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 944.776191][ T5968] usb 3-1: config 0 interface 38 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 944.846876][ T5968] usb 3-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=f8.63 [ 944.860561][ T5968] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.880747][ T5968] usb 3-1: Product: syz [ 944.884055][T17114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 944.899898][ T5968] usb 3-1: Manufacturer: syz [ 944.911220][ T5968] usb 3-1: SerialNumber: syz [ 944.916067][T15069] usb 6-1: Using ep0 maxpacket: 16 [ 944.916105][T17114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 944.922992][T15069] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 944.947083][ C1] vkms_vblank_simulate: vblank timer overrun [ 944.984649][ T5968] usb 3-1: config 0 descriptor?? [ 944.998790][ T5968] xbox_remote_probe: Unexpected endpoint_in [ 945.017359][T15069] usb 6-1: config 0 has no interface number 0 [ 945.025082][T17114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 945.031164][T15069] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 55, changing to 9 [ 945.066663][T15069] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 49198, setting to 1024 [ 945.067805][T17114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 945.085899][T17114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 945.114279][T17114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 945.126130][T15069] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 945.135497][T15069] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 945.152073][T15069] usb 6-1: Product: syz [ 945.160773][T15069] usb 6-1: SerialNumber: syz [ 945.182159][T15069] usb 6-1: config 0 descriptor?? [ 945.191059][T15069] cm109 6-1:0.8: invalid payload size 1024, expected 4 [ 945.219912][T15069] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input60 [ 945.249559][T17114] hsr_slave_0: entered promiscuous mode [ 945.294730][T17114] hsr_slave_1: entered promiscuous mode [ 945.315325][T17114] debugfs: 'hsr0' already exists in 'hsr' [ 945.370444][T17114] Cannot create hsr debugfs directory [ 945.599513][ C0] cm109 6-1:0.8: cm109_urb_irq_callback: urb status -71 [ 945.600219][T14225] usb 6-1: USB disconnect, device number 18 [ 945.606489][ C0] cm109 6-1:0.8: cm109_submit_ctl: usb_submit_urb (urb_ctl) failed -19 [ 945.638216][T14225] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 946.021811][ T5863] Bluetooth: hci3: command tx timeout [ 946.212946][ T30] audit: type=1400 audit(1755910343.274:1088): avc: denied { read write } for pid=17261 comm="syz.6.2928" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 946.240451][ T30] audit: type=1400 audit(1755910343.274:1089): avc: denied { open } for pid=17261 comm="syz.6.2928" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 946.391290][T17266] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2928'. [ 946.592302][T17114] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 946.644259][ T5968] usb 3-1: USB disconnect, device number 73 [ 946.653677][T17114] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 946.732530][T17114] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 946.854169][T17114] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 946.958178][T17282] netlink: zone id is out of range [ 946.963577][T17282] netlink: zone id is out of range [ 946.968884][T17282] netlink: zone id is out of range [ 946.983241][T17282] netlink: set zone limit has 4 unknown bytes [ 947.093858][T17114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 947.145319][ T5968] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 947.187608][T17114] 8021q: adding VLAN 0 to HW filter on device team0 [ 947.208050][T17288] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 947.218177][T17288] FAULT_INJECTION: forcing a failure. [ 947.218177][T17288] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 947.232801][T17288] CPU: 0 UID: 0 PID: 17288 Comm: syz.5.2934 Not tainted syzkaller #0 PREEMPT(full) [ 947.232827][T17288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 947.232837][T17288] Call Trace: [ 947.232843][T17288] [ 947.232850][T17288] dump_stack_lvl+0x16c/0x1f0 [ 947.232873][T17288] should_fail_ex+0x512/0x640 [ 947.232897][T17288] _copy_from_user+0x2e/0xd0 [ 947.232921][T17288] kstrtouint_from_user+0xd6/0x1d0 [ 947.232937][T17288] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 947.232953][T17288] ? __lock_acquire+0xb97/0x1ce0 [ 947.232989][T17288] proc_fail_nth_write+0x83/0x220 [ 947.233010][T17288] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 947.233036][T17288] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 947.233053][T17288] vfs_write+0x29d/0x11d0 [ 947.233077][T17288] ? __pfx___mutex_lock+0x10/0x10 [ 947.233095][T17288] ? __pfx_vfs_write+0x10/0x10 [ 947.233118][T17288] ? __fget_files+0x20e/0x3c0 [ 947.233144][T17288] ksys_write+0x12a/0x250 [ 947.233161][T17288] ? __pfx_ksys_write+0x10/0x10 [ 947.233187][T17288] do_syscall_64+0xcd/0x4c0 [ 947.233215][T17288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 947.233233][T17288] RIP: 0033:0x7fb4f998d69f [ 947.233248][T17288] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 947.233265][T17288] RSP: 002b:00007fb4fa7af030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 947.233283][T17288] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb4f998d69f [ 947.233295][T17288] RDX: 0000000000000001 RSI: 00007fb4fa7af0a0 RDI: 0000000000000004 [ 947.233305][T17288] RBP: 00007fb4fa7af090 R08: 0000000000000000 R09: 0000000000000000 [ 947.233316][T17288] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 947.233326][T17288] R13: 00007fb4f9bb6038 R14: 00007fb4f9bb5fa0 R15: 00007ffda136cae8 [ 947.233351][T17288] [ 947.418630][ C0] vkms_vblank_simulate: vblank timer overrun [ 947.428870][ T5968] usb 8-1: device descriptor read/64, error -71 [ 947.491859][T15922] bridge0: port 1(bridge_slave_0) entered blocking state [ 947.499001][T15922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 947.787218][T17294] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 947.797735][T17294] SELinux: failed to load policy [ 947.868623][T17114] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 947.894282][ T5968] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 947.917754][T17114] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 948.046185][T15922] bridge0: port 2(bridge_slave_1) entered blocking state [ 948.053257][T15922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 948.064316][ T5968] usb 8-1: device descriptor read/64, error -71 [ 948.175176][ T5968] usb usb8-port1: attempt power cycle [ 948.364386][ T24] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 948.516028][ T5968] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 948.531544][ T24] usb 6-1: config 0 interface 0 has no altsetting 0 [ 948.538317][ T24] usb 6-1: New USB device found, idVendor=1ea7, idProduct=0907, bcdDevice= 0.00 [ 948.578542][ T5968] usb 8-1: device descriptor read/8, error -71 [ 948.592574][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 948.621651][T15924] hsr_slave_0: left promiscuous mode [ 948.626217][ T24] usb 6-1: config 0 descriptor?? [ 948.636050][T15924] hsr_slave_1: left promiscuous mode [ 948.769327][T15924] veth1_macvtap: left promiscuous mode [ 948.794356][T15924] veth0_macvtap: left promiscuous mode [ 948.820717][T15924] veth1_vlan: left promiscuous mode [ 948.844270][ T5968] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 948.905541][ T5968] usb 8-1: device descriptor read/8, error -71 [ 949.004456][ T1674] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 949.018893][ T5968] usb usb8-port1: unable to enumerate USB device [ 949.220660][ T1674] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 949.231110][ T1674] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 949.244719][ T1674] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 949.256397][ T1674] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.268658][ T1674] usb 7-1: config 0 descriptor?? [ 949.277220][ T1674] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 949.284039][ T1674] dvb-usb: bulk message failed: -22 (3/0) [ 949.291209][ T1674] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 949.301564][ T1674] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 949.309798][ T1674] usb 7-1: media controller created [ 949.317428][ T1674] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 949.329703][ T1674] dvb-usb: bulk message failed: -22 (6/0) [ 949.336284][ T1674] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 949.346592][ T1674] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input61 [ 949.361391][ T1674] dvb-usb: schedule remote query interval to 150 msecs. [ 949.370714][ T1674] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 949.524817][T17308] dibusb: i2c wr: len=61 is too big! [ 949.524817][T17308] [ 949.534294][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 949.543699][ T1674] dvb-usb: error while querying for an remote control event. [ 949.744263][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 949.750184][ T1674] dvb-usb: error while querying for an remote control event. [ 949.914822][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 949.924166][ T1674] dvb-usb: error while querying for an remote control event. [ 950.078340][ T1674] dvb-usb: bulk message failed: -22 (1/0) [ 950.089299][ T1674] dvb-usb: error while querying for an remote control event. [ 950.267101][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 950.273002][T14225] dvb-usb: error while querying for an remote control event. [ 950.471843][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 950.483347][T14225] dvb-usb: error while querying for an remote control event. [ 950.684367][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 950.691885][T14225] dvb-usb: error while querying for an remote control event. [ 950.854780][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 950.866280][T14225] dvb-usb: error while querying for an remote control event. [ 951.025487][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 951.033462][T14225] dvb-usb: error while querying for an remote control event. [ 951.047813][ T24] usbhid 6-1:0.0: can't add hid device: -71 [ 951.053925][ T24] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 951.070997][ T24] usb 6-1: USB disconnect, device number 19 [ 951.093822][T17114] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 951.190697][T17114] veth0_vlan: entered promiscuous mode [ 951.205234][T17114] veth1_vlan: entered promiscuous mode [ 951.206369][T14225] dvb-usb: bulk message failed: -22 (1/0) [ 951.231369][T14225] dvb-usb: error while querying for an remote control event. [ 951.266182][T17114] veth0_macvtap: entered promiscuous mode [ 951.282478][T17114] veth1_macvtap: entered promiscuous mode [ 951.328899][T17114] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 951.350520][T17114] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 951.372942][T15925] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.383418][T15925] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.404777][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 951.410538][ T24] dvb-usb: error while querying for an remote control event. [ 951.425766][ T5968] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 951.503163][T15925] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.529310][T15925] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.543541][T15925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 951.558117][T15925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 951.574265][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 951.582764][ T24] dvb-usb: error while querying for an remote control event. [ 951.592942][T15919] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 951.606299][T15919] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 951.627272][ T5968] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 951.655404][ T5968] usb 8-1: config 0 has no interface number 0 [ 951.666722][ T5968] usb 8-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 951.676074][ T5968] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 951.698781][ T5968] usb 8-1: Product: syz [ 951.705320][ T24] usb 7-1: USB disconnect, device number 16 [ 951.715184][ T5968] usb 8-1: Manufacturer: syz [ 951.891740][ T5968] usb 8-1: SerialNumber: syz [ 951.903861][ T5968] usb 8-1: config 0 descriptor?? [ 951.907638][ T24] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 952.112533][ T5968] usb 8-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 952.125040][ T5968] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 952.355290][ T5968] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 952.371283][ T5968] usb 8-1: media controller created [ 952.487287][T17341] netlink: 'syz.7.2942': attribute type 2 has an invalid length. [ 952.532548][T17341] : entered promiscuous mode [ 952.607026][T17342] bpq0: entered allmulticast mode [ 952.698299][ T5968] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 952.698747][T17341] comedi comedi0: pcl724: I/O port conflict (0x3,4) [ 952.920136][T17347] input: syz0 as /devices/virtual/input/input62 [ 953.716566][ T5968] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 953.857223][ T5968] usb 8-1: USB disconnect, device number 6 [ 954.078035][T17354] IPVS: set_ctl: invalid protocol: 44 10.1.1.1:20004 [ 954.237053][ T9] IPVS: starting estimator thread 0... [ 954.324447][T17355] IPVS: using max 74 ests per chain, 177600 per kthread [ 954.617256][ T30] audit: type=1400 audit(1755910351.564:1090): avc: denied { setopt } for pid=17356 comm="syz.5.2950" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 954.654175][ T30] audit: type=1400 audit(1755910351.594:1091): avc: denied { ioctl } for pid=17356 comm="syz.5.2950" path="socket:[65981]" dev="sockfs" ino=65981 ioctlcmd=0x89e8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 954.750926][T12723] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 954.762897][T12723] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 954.771653][T12723] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 954.791205][T12723] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 954.800802][T12723] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 955.119796][T15921] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 955.169676][T17364] wlan1 speed is unknown, defaulting to 1000 [ 955.482107][T15921] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 955.534347][T17364] wg2 speed is unknown, defaulting to 1000 [ 955.591557][T15921] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 955.720011][T15921] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 956.117120][T15921] bridge_slave_0: left allmulticast mode [ 956.124698][T15921] bridge_slave_0: left promiscuous mode [ 956.158888][T15921] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.234205][ T30] audit: type=1400 audit(1755910353.244:1092): avc: denied { execute } for pid=17376 comm="syz.6.2955" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=66044 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 956.904064][T12723] Bluetooth: hci4: command tx timeout [ 956.943873][T17392] netlink: zone id is out of range [ 956.949600][T17392] netlink: zone id is out of range [ 956.954806][T17392] netlink: zone id is out of range [ 956.968066][T17392] netlink: set zone limit has 4 unknown bytes [ 957.158145][T17399] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 957.166009][T17399] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 957.174436][T17399] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 957.182239][T17399] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 957.203452][T17399] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2960'. [ 957.222667][ T24] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 957.379147][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 957.395062][ T24] usb 7-1: config 0 has no interfaces? [ 957.408206][ T24] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 957.447793][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 957.512912][ T24] usb 7-1: Product: syz [ 957.517187][ T24] usb 7-1: Manufacturer: syz [ 957.544167][ T24] usb 7-1: SerialNumber: syz [ 957.602910][ T24] usb 7-1: config 0 descriptor?? [ 958.028899][T15921] bond1 (unregistering): Released all slaves [ 958.112415][T17413] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 958.132070][T15921] : left promiscuous mode [ 958.286290][T15921] tipc: Disabling bearer [ 958.296422][T15921] tipc: Left network mode [ 958.301296][T17421] FAULT_INJECTION: forcing a failure. [ 958.301296][T17421] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 958.317417][T17421] CPU: 0 UID: 0 PID: 17421 Comm: syz.7.2968 Not tainted syzkaller #0 PREEMPT(full) [ 958.317442][T17421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 958.317453][T17421] Call Trace: [ 958.317459][T17421] [ 958.317465][T17421] dump_stack_lvl+0x16c/0x1f0 [ 958.317489][T17421] should_fail_ex+0x512/0x640 [ 958.317511][T17421] _copy_to_user+0x32/0xd0 [ 958.317536][T17421] simple_read_from_buffer+0xcb/0x170 [ 958.317558][T17421] proc_fail_nth_read+0x197/0x240 [ 958.317582][T17421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 958.317606][T17421] ? rw_verify_area+0xcf/0x6c0 [ 958.317633][T17421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 958.317655][T17421] vfs_read+0x1e1/0xcf0 [ 958.317677][T17421] ? __pfx___mutex_lock+0x10/0x10 [ 958.317697][T17421] ? __pfx_vfs_read+0x10/0x10 [ 958.317723][T17421] ? __fget_files+0x20e/0x3c0 [ 958.317752][T17421] ksys_read+0x12a/0x250 [ 958.317769][T17421] ? __pfx_ksys_read+0x10/0x10 [ 958.317795][T17421] do_syscall_64+0xcd/0x4c0 [ 958.317817][T17421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.317835][T17421] RIP: 0033:0x7fa4cb18d5fc [ 958.317851][T17421] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 958.317868][T17421] RSP: 002b:00007fa4cc07c030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 958.317886][T17421] RAX: ffffffffffffffda RBX: 00007fa4cb3b5fa0 RCX: 00007fa4cb18d5fc [ 958.317898][T17421] RDX: 000000000000000f RSI: 00007fa4cc07c0a0 RDI: 0000000000000003 [ 958.317909][T17421] RBP: 00007fa4cc07c090 R08: 0000000000000000 R09: 0000000000000000 [ 958.317919][T17421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 958.317928][T17421] R13: 00007fa4cb3b6038 R14: 00007fa4cb3b5fa0 R15: 00007ffc07953458 [ 958.317954][T17421] [ 958.574257][ T9] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 958.688407][T17364] chnl_net:caif_netlink_parms(): no params data found [ 958.804189][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 958.826897][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 958.858327][ T9] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 958.867810][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.876104][ T9] usb 4-1: Product: syz [ 958.880282][ T9] usb 4-1: Manufacturer: syz [ 958.885150][ T9] usb 4-1: SerialNumber: syz [ 958.896106][ T9] usb 4-1: config 0 descriptor?? [ 958.905111][T17415] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 958.915912][ T9] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input63 [ 958.948389][T17364] bridge0: port 1(bridge_slave_0) entered blocking state [ 958.961106][T17364] bridge0: port 1(bridge_slave_0) entered disabled state [ 958.973974][T17364] bridge_slave_0: entered allmulticast mode [ 958.983290][T12723] Bluetooth: hci4: command tx timeout [ 958.992304][T17364] bridge_slave_0: entered promiscuous mode [ 959.014328][ T1674] usb 8-1: new low-speed USB device number 7 using dummy_hcd [ 959.047202][T17364] bridge0: port 2(bridge_slave_1) entered blocking state [ 959.055058][T17364] bridge0: port 2(bridge_slave_1) entered disabled state [ 959.062372][T17364] bridge_slave_1: entered allmulticast mode [ 959.071015][T17364] bridge_slave_1: entered promiscuous mode [ 959.195830][ T1674] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 959.206145][ T1674] usb 8-1: config 0 has no interface number 0 [ 959.219267][T17364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 959.230047][ T1674] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 959.241959][ T1674] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 959.253953][ T1674] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 959.265849][T17415] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 959.272358][T17415] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 959.283673][T17415] vhci_hcd vhci_hcd.0: Device attached [ 959.289403][ T1674] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 959.306672][ T1674] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 959.311741][T17364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 959.325469][ T24] usb 4-1: USB disconnect, device number 57 [ 959.326811][ C0] usbtouchscreen 4-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 959.332657][T17435] vhci_hcd: connection closed [ 959.355423][ T1674] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 959.383350][T14322] vhci_hcd: stop threads [ 959.383471][ T1674] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 959.400948][ T1674] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.404635][T14322] vhci_hcd: release socket [ 959.413330][ T1674] usb 8-1: config 0 descriptor?? [ 959.421551][T17431] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 959.429974][T17431] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 959.440499][ T1674] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 959.456938][T14322] vhci_hcd: disconnect device [ 959.469342][ T5987] vhci_hcd: vhci_device speed not set [ 959.521720][T17364] team0: Port device team_slave_0 added [ 959.528999][T17364] team0: Port device team_slave_1 added [ 959.550843][T17364] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 959.559197][T17364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 959.586577][T17364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 959.610505][T17364] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 959.617802][T17364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 959.674306][T17364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 959.689400][T17431] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(10) [ 959.696030][T17431] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 959.865202][T17431] vhci_hcd vhci_hcd.0: Device attached [ 959.879122][T17364] hsr_slave_0: entered promiscuous mode [ 959.886385][T17444] vhci_hcd vhci_hcd.0: pdev(7) rhport(1) sockfd(13) [ 959.892986][T17444] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 959.901366][T17364] hsr_slave_1: entered promiscuous mode [ 959.910093][T17443] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 959.910560][T17364] debugfs: 'hsr0' already exists in 'hsr' [ 959.932301][T17431] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 959.955064][T17364] Cannot create hsr debugfs directory [ 959.960733][T17444] vhci_hcd vhci_hcd.0: Device attached [ 960.013121][ T9] usb 7-1: USB disconnect, device number 17 [ 960.034392][T17431] vhci_hcd vhci_hcd.0: pdev(7) rhport(3) sockfd(17) [ 960.041003][T17431] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 960.068103][ T1674] vhci_hcd: vhci_device speed not set [ 960.131644][T17444] vhci_hcd vhci_hcd.0: pdev(7) rhport(4) sockfd(20) [ 960.138276][T17444] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 960.165909][T17444] vhci_hcd vhci_hcd.0: Device attached [ 960.194180][ T1674] usb 47-1: new full-speed USB device number 2 using vhci_hcd [ 960.201988][T17431] vhci_hcd vhci_hcd.0: Device attached [ 960.234227][T17444] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 960.250712][T17444] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 960.514836][T17455] vhci_hcd vhci_hcd.0: pdev(7) rhport(5) sockfd(23) [ 960.521499][T17455] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 960.617380][T17455] vhci_hcd vhci_hcd.0: Device attached [ 960.806264][T17452] vhci_hcd: connection closed [ 960.806432][T17457] vhci_hcd: connection closed [ 960.811251][T17445] vhci_hcd: connection closed [ 960.816110][T17447] vhci_hcd: connection closed [ 960.825895][T14322] vhci_hcd: stop threads [ 960.836923][T14322] vhci_hcd: release socket [ 960.844030][ T9] usb 8-1: USB disconnect, device number 7 [ 960.852705][ T9] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 960.863798][T14322] vhci_hcd: disconnect device [ 960.871837][T17441] vhci_hcd: connection reset by peer [ 960.879439][T14322] vhci_hcd: stop threads [ 960.932414][T15921] hsr_slave_0: left promiscuous mode [ 960.976116][T14322] vhci_hcd: release socket [ 960.987474][T15921] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 960.998575][T14322] vhci_hcd: disconnect device [ 961.009631][T14322] vhci_hcd: stop threads [ 961.013907][T14322] vhci_hcd: release socket [ 961.033935][T14322] vhci_hcd: disconnect device [ 961.043069][T14322] vhci_hcd: stop threads [ 961.058871][T14322] vhci_hcd: release socket [ 961.101645][T12723] Bluetooth: hci4: command tx timeout [ 961.101994][T14322] vhci_hcd: disconnect device [ 961.130114][T14322] vhci_hcd: stop threads [ 961.157302][T14322] vhci_hcd: release socket [ 961.162176][T14322] vhci_hcd: disconnect device [ 962.113080][T17465] netlink: 168 bytes leftover after parsing attributes in process `syz.6.2974'. [ 962.264449][T17483] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 962.793607][T17496] bpq0: left allmulticast mode [ 963.155534][T12723] Bluetooth: hci4: command tx timeout [ 964.789133][T17519] bridge_slave_0: left allmulticast mode [ 964.794936][T17519] bridge_slave_0: left promiscuous mode [ 964.800585][T17519] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.826744][T17519] bridge_slave_1: left allmulticast mode [ 964.890328][T17519] bridge_slave_1: left promiscuous mode [ 964.901589][T17526] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 964.904350][T17519] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.997648][T17519] bond0: (slave bond_slave_0): Releasing backup interface [ 965.032522][T17519] bond0: (slave bond_slave_1): Releasing backup interface [ 965.076431][T17530] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 965.083583][T17519] team0: Port device team_slave_0 removed [ 965.100381][T17519] team0: Port device team_slave_1 removed [ 965.136449][T17519] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 965.147178][T17519] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 965.273011][T17519] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 965.298426][T17519] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 965.748182][ T1674] vhci_hcd: vhci_device speed not set [ 965.895625][T17364] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 966.168241][T17364] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 966.202484][T17364] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 966.272689][T17364] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 966.524377][T17554] FAULT_INJECTION: forcing a failure. [ 966.524377][T17554] name failslab, interval 1, probability 0, space 0, times 0 [ 966.537293][T17554] CPU: 1 UID: 0 PID: 17554 Comm: syz.5.2995 Not tainted syzkaller #0 PREEMPT(full) [ 966.537317][T17554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 966.537328][T17554] Call Trace: [ 966.537335][T17554] [ 966.537342][T17554] dump_stack_lvl+0x16c/0x1f0 [ 966.537368][T17554] should_fail_ex+0x512/0x640 [ 966.537388][T17554] ? __kmalloc_noprof+0xbf/0x510 [ 966.537410][T17554] ? alloc_pipe_info+0x1ec/0x590 [ 966.537431][T17554] should_failslab+0xc2/0x120 [ 966.537451][T17554] __kmalloc_noprof+0xd2/0x510 [ 966.537475][T17554] alloc_pipe_info+0x1ec/0x590 [ 966.537499][T17554] splice_direct_to_actor+0x77d/0xa30 [ 966.537520][T17554] ? __lock_acquire+0x62e/0x1ce0 [ 966.537548][T17554] ? __pfx_direct_splice_actor+0x10/0x10 [ 966.537569][T17554] ? find_held_lock+0x2b/0x80 [ 966.537591][T17554] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 966.537608][T17554] ? get_pid_task+0xfc/0x250 [ 966.537632][T17554] do_splice_direct+0x174/0x240 [ 966.537652][T17554] ? __pfx_do_splice_direct+0x10/0x10 [ 966.537671][T17554] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 966.537693][T17554] ? rw_verify_area+0xcf/0x6c0 [ 966.537723][T17554] do_sendfile+0xb06/0xe50 [ 966.537745][T17554] ? __pfx_do_sendfile+0x10/0x10 [ 966.537763][T17554] ? __fget_files+0x20e/0x3c0 [ 966.537789][T17554] __x64_sys_sendfile64+0x1d8/0x220 [ 966.537810][T17554] ? ksys_write+0x1ac/0x250 [ 966.537833][T17554] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 966.537864][T17554] do_syscall_64+0xcd/0x4c0 [ 966.537887][T17554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.537906][T17554] RIP: 0033:0x7fb4f998ebe9 [ 966.537921][T17554] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 966.537938][T17554] RSP: 002b:00007fb4fa76d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 966.537956][T17554] RAX: ffffffffffffffda RBX: 00007fb4f9bb6180 RCX: 00007fb4f998ebe9 [ 966.537968][T17554] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000009 [ 966.537979][T17554] RBP: 00007fb4fa76d090 R08: 0000000000000000 R09: 0000000000000000 [ 966.537990][T17554] R10: 0000000008000002 R11: 0000000000000246 R12: 0000000000000001 [ 966.538001][T17554] R13: 00007fb4f9bb6218 R14: 00007fb4f9bb6180 R15: 00007ffda136cae8 [ 966.538025][T17554] [ 966.848401][T17364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 966.860616][T17364] 8021q: adding VLAN 0 to HW filter on device team0 [ 966.881771][T17364] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 966.892263][T17364] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 966.913683][T15925] bridge0: port 1(bridge_slave_0) entered blocking state [ 966.920792][T15925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 966.930006][T15925] bridge0: port 2(bridge_slave_1) entered blocking state [ 966.937074][T15925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 967.524999][T17569] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2997'. [ 968.132058][T17364] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 968.308523][ T30] audit: type=1400 audit(1755910365.374:1093): avc: denied { create } for pid=17570 comm="syz.5.2998" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 968.313289][T17579] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 968.419198][T17364] veth0_vlan: entered promiscuous mode [ 968.468363][T17364] veth1_vlan: entered promiscuous mode [ 968.557667][T17364] veth0_macvtap: entered promiscuous mode [ 968.572822][T17364] veth1_macvtap: entered promiscuous mode [ 968.706070][ T9] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 969.165436][T17364] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 969.195001][T17364] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 969.202489][ T9] usb 6-1: config 0 has an invalid descriptor of length 33, skipping remainder of the config [ 969.215819][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 969.240410][T15925] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.295680][T15925] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.328557][T17594] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 969.339192][T17594] SELinux: failed to load policy [ 969.607259][T15925] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.636472][ T9] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 969.679377][T15925] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.685176][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.714936][ T9] usb 6-1: config 0 descriptor?? [ 970.211882][ T9] usb 6-1: string descriptor 0 read error: -71 [ 970.378972][ T9] usb 6-1: USB disconnect, device number 20 [ 970.420178][T15924] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 970.476886][T15924] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 970.504932][ T30] audit: type=1400 audit(1755910367.554:1094): avc: denied { setopt } for pid=17601 comm="syz.6.3005" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 970.617678][T15925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 970.733324][T15925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 971.353870][T17610] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 971.364229][T17610] SELinux: failed to load policy [ 972.001028][T17620] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3008'. [ 974.962350][ T1674] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 975.237712][ T1674] usb 6-1: config 1 interface 0 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 64 [ 975.311491][ T1674] usb 6-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 975.326495][T17656] bpq0: entered allmulticast mode [ 975.542986][ T1674] usb 6-1: config 1 interface 0 has no altsetting 0 [ 975.559347][ T1674] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 975.575818][ T1674] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.588229][ T1674] usb 6-1: Product: syz [ 975.595978][ T1674] usb 6-1: Manufacturer: syz [ 975.603855][ T1674] usb 6-1: SerialNumber: syz [ 975.691106][T17651] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 976.034491][T17666] tipc: Started in network mode [ 976.039389][T17666] tipc: Node identity ce66f8c4b022, cluster identity 4711 [ 976.046713][T17666] tipc: Enabled bearer , priority 0 [ 976.054223][T17666] syzkaller0: entered promiscuous mode [ 976.059700][T17666] syzkaller0: entered allmulticast mode [ 976.070952][T17665] tipc: Resetting bearer [ 976.085583][T17665] tipc: Disabling bearer [ 976.360120][T17678] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3022'. [ 977.208007][T17687] CIFS mount error: No usable UNC path provided in device string! [ 977.208007][T17687] [ 977.221005][T17687] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 977.973002][ T1674] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 21 if 0 alt 2 proto 1 vid 0x0525 pid 0xA4A8 [ 977.986311][ T1674] usb 6-1: USB disconnect, device number 21 [ 977.995389][ T1674] usblp0: removed [ 978.090047][ T30] audit: type=1400 audit(1755910375.154:1095): avc: denied { append } for pid=17693 comm="syz.2.3029" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 979.243286][T17714] FAULT_INJECTION: forcing a failure. [ 979.243286][T17714] name failslab, interval 1, probability 0, space 0, times 0 [ 979.393214][T17714] CPU: 1 UID: 0 PID: 17714 Comm: syz.3.3033 Not tainted syzkaller #0 PREEMPT(full) [ 979.393242][T17714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 979.393253][T17714] Call Trace: [ 979.393260][T17714] [ 979.393268][T17714] dump_stack_lvl+0x16c/0x1f0 [ 979.393293][T17714] should_fail_ex+0x512/0x640 [ 979.393314][T17714] ? kmem_cache_alloc_lru_noprof+0x5f/0x3b0 [ 979.393342][T17714] should_failslab+0xc2/0x120 [ 979.393363][T17714] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 979.393383][T17714] ? __d_alloc+0x32/0xae0 [ 979.393409][T17714] __d_alloc+0x32/0xae0 [ 979.393435][T17714] d_alloc_parallel+0x111/0x1480 [ 979.393474][T17714] ? __pfx_d_alloc_parallel+0x10/0x10 [ 979.393505][T17714] ? lockdep_init_map_type+0x5c/0x280 [ 979.393529][T17714] ? lockdep_init_map_type+0x5c/0x280 [ 979.393550][T17714] __lookup_slow+0x193/0x460 [ 979.393579][T17714] ? __pfx___lookup_slow+0x10/0x10 [ 979.393609][T17714] ? pcpu_block_update+0xc0/0x660 [ 979.393641][T17714] ? pcpu_block_update+0xc0/0x660 [ 979.393666][T17714] ? d_lookup+0xe7/0x190 [ 979.393697][T17714] lookup_noperm+0xe1/0x110 [ 979.393724][T17714] simple_start_creating+0xd1/0x1b0 [ 979.393747][T17714] start_creating.part.0+0x82/0x190 [ 979.393770][T17714] __debugfs_create_file+0xa7/0x6b0 [ 979.393798][T17714] debugfs_create_file_full+0x41/0x60 [ 979.393823][T17714] ? __pfx_br_dev_setup+0x10/0x10 [ 979.393847][T17714] ref_tracker_dir_debugfs+0x19d/0x290 [ 979.393874][T17714] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 979.393917][T17714] ? __kvmalloc_node_noprof+0x298/0x620 [ 979.393937][T17714] ? lockdep_init_map_type+0x5c/0x280 [ 979.393959][T17714] alloc_netdev_mqs+0x30f/0x1530 [ 979.393992][T17714] rtnl_create_link+0xc08/0xf90 [ 979.394017][T17714] rtnl_newlink+0xb69/0x2000 [ 979.394046][T17714] ? __pfx_rtnl_newlink+0x10/0x10 [ 979.394064][T17714] ? find_held_lock+0x2b/0x80 [ 979.394085][T17714] ? avc_has_perm_noaudit+0x117/0x3b0 [ 979.394113][T17714] ? avc_has_perm_noaudit+0x149/0x3b0 [ 979.394157][T17714] ? find_held_lock+0x2b/0x80 [ 979.394177][T17714] ? __pfx_rtnl_newlink+0x10/0x10 [ 979.394195][T17714] ? __pfx_rtnl_newlink+0x10/0x10 [ 979.394214][T17714] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 979.394235][T17714] ? __pfx_rtnl_newlink+0x10/0x10 [ 979.394255][T17714] rtnetlink_rcv_msg+0x95e/0xe90 [ 979.394282][T17714] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 979.394310][T17714] ? ref_tracker_free+0x37c/0x830 [ 979.394335][T17714] netlink_rcv_skb+0x158/0x420 [ 979.394357][T17714] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 979.394379][T17714] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 979.394410][T17714] ? netlink_deliver_tap+0x1ae/0xd30 [ 979.394436][T17714] netlink_unicast+0x5a7/0x870 [ 979.394460][T17714] ? __pfx_netlink_unicast+0x10/0x10 [ 979.394482][T17714] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 979.394510][T17714] netlink_sendmsg+0x8d1/0xdd0 [ 979.394536][T17714] ? __pfx_netlink_sendmsg+0x10/0x10 [ 979.394572][T17714] ____sys_sendmsg+0xa95/0xc70 [ 979.394598][T17714] ? copy_msghdr_from_user+0x10a/0x160 [ 979.394617][T17714] ? __pfx_____sys_sendmsg+0x10/0x10 [ 979.394654][T17714] ___sys_sendmsg+0x134/0x1d0 [ 979.394676][T17714] ? __pfx____sys_sendmsg+0x10/0x10 [ 979.394729][T17714] __sys_sendmsg+0x16d/0x220 [ 979.394749][T17714] ? __pfx___sys_sendmsg+0x10/0x10 [ 979.394786][T17714] do_syscall_64+0xcd/0x4c0 [ 979.394809][T17714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 979.394828][T17714] RIP: 0033:0x7efea438ebe9 [ 979.394844][T17714] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 979.394861][T17714] RSP: 002b:00007efea51e2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 979.394880][T17714] RAX: ffffffffffffffda RBX: 00007efea45b5fa0 RCX: 00007efea438ebe9 [ 979.394892][T17714] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 979.394902][T17714] RBP: 00007efea51e2090 R08: 0000000000000000 R09: 0000000000000000 [ 979.394913][T17714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 979.394924][T17714] R13: 00007efea45b6038 R14: 00007efea45b5fa0 R15: 00007ffe4db0eb28 [ 979.394949][T17714] [ 980.622765][T17732] netlink: 132 bytes leftover after parsing attributes in process `syz.6.3036'. [ 981.318854][T17736] netlink: 'syz.3.3037': attribute type 10 has an invalid length. [ 981.411690][T17736] team0: Port device dummy0 added [ 982.251897][T17752] netlink: 212316 bytes leftover after parsing attributes in process `syz.2.3042'. [ 982.275574][T17753] SELinux: policydb string does not match my string SE Linux [ 982.289214][T17753] SELinux: failed to load policy [ 982.741008][T17761] FAULT_INJECTION: forcing a failure. [ 982.741008][T17761] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 982.754288][T17761] CPU: 1 UID: 0 PID: 17761 Comm: syz.6.3044 Not tainted syzkaller #0 PREEMPT(full) [ 982.754313][T17761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 982.754325][T17761] Call Trace: [ 982.754331][T17761] [ 982.754338][T17761] dump_stack_lvl+0x16c/0x1f0 [ 982.754362][T17761] should_fail_ex+0x512/0x640 [ 982.754386][T17761] _copy_from_user+0x2e/0xd0 [ 982.754410][T17761] memdup_user+0x6b/0xe0 [ 982.754432][T17761] ucma_set_option+0x11f/0x530 [ 982.754454][T17761] ? __might_fault+0xe3/0x190 [ 982.754472][T17761] ? __pfx_ucma_set_option+0x10/0x10 [ 982.754501][T17761] ? __pfx_ucma_set_option+0x10/0x10 [ 982.754524][T17761] ucma_write+0x1f8/0x330 [ 982.754544][T17761] ? __pfx_ucma_write+0x10/0x10 [ 982.754564][T17761] ? vfs_writev+0x6f3/0xde0 [ 982.754581][T17761] ? vfs_writev+0x5b0/0xde0 [ 982.754600][T17761] ? __pfx_ucma_write+0x10/0x10 [ 982.754617][T17761] vfs_writev+0x5df/0xde0 [ 982.754641][T17761] ? __pfx_vfs_writev+0x10/0x10 [ 982.754657][T17761] ? rcu_is_watching+0x12/0xc0 [ 982.754679][T17761] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 982.754712][T17761] ? lockdep_hardirqs_on+0x7c/0x110 [ 982.754733][T17761] ? rcu_preempt_deferred_qs_irqrestore+0x500/0xbc0 [ 982.754763][T17761] ? __fget_files+0x20e/0x3c0 [ 982.754781][T17761] ? __fget_files+0x140/0x3c0 [ 982.754806][T17761] ? do_writev+0x28c/0x340 [ 982.754821][T17761] do_writev+0x28c/0x340 [ 982.754838][T17761] ? __pfx_do_writev+0x10/0x10 [ 982.754862][T17761] do_syscall_64+0xcd/0x4c0 [ 982.754884][T17761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.754902][T17761] RIP: 0033:0x7fa38758ebe9 [ 982.754916][T17761] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 982.754933][T17761] RSP: 002b:00007fa3883f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 982.754951][T17761] RAX: ffffffffffffffda RBX: 00007fa3877b6180 RCX: 00007fa38758ebe9 [ 982.754962][T17761] RDX: 0000000000000003 RSI: 0000200000000000 RDI: 0000000000000006 [ 982.754972][T17761] RBP: 00007fa3883f7090 R08: 0000000000000000 R09: 0000000000000000 [ 982.754983][T17761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 982.754994][T17761] R13: 00007fa3877b6218 R14: 00007fa3877b6180 R15: 00007ffda90f5158 [ 982.755018][T17761] [ 983.304166][ T5968] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 983.458156][ T5968] usb 3-1: config 0 has no interfaces? [ 983.463713][ T5968] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 983.473718][ T5968] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.484030][ T5968] usb 3-1: config 0 descriptor?? [ 985.516770][T17796] netlink: 146872 bytes leftover after parsing attributes in process `syz.6.3053'. [ 986.083937][ T5967] usb 3-1: USB disconnect, device number 74 [ 986.678467][ T5967] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 987.221827][ T5967] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 987.232367][ T5967] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 987.475749][T17835] FAULT_INJECTION: forcing a failure. [ 987.475749][T17835] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 987.488983][T17835] CPU: 1 UID: 0 PID: 17835 Comm: syz.5.3063 Not tainted syzkaller #0 PREEMPT(full) [ 987.489010][T17835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 987.489020][T17835] Call Trace: [ 987.489029][T17835] [ 987.489037][T17835] dump_stack_lvl+0x16c/0x1f0 [ 987.489060][T17835] should_fail_ex+0x512/0x640 [ 987.489077][T17835] _copy_to_user+0x32/0xd0 [ 987.489093][T17835] simple_read_from_buffer+0xcb/0x170 [ 987.489106][T17835] proc_fail_nth_read+0x197/0x240 [ 987.489119][T17835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 987.489139][T17835] ? rw_verify_area+0xcf/0x6c0 [ 987.489170][T17835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 987.489189][T17835] vfs_read+0x1e1/0xcf0 [ 987.489209][T17835] ? __pfx___mutex_lock+0x10/0x10 [ 987.489224][T17835] ? __pfx_vfs_read+0x10/0x10 [ 987.489238][T17835] ? __fget_files+0x20e/0x3c0 [ 987.489255][T17835] ksys_read+0x12a/0x250 [ 987.489266][T17835] ? __pfx_ksys_read+0x10/0x10 [ 987.489287][T17835] do_syscall_64+0xcd/0x4c0 [ 987.489309][T17835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 987.489327][T17835] RIP: 0033:0x7fb4f998d5fc [ 987.489341][T17835] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 987.489357][T17835] RSP: 002b:00007fb4fa7af030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 987.489369][T17835] RAX: ffffffffffffffda RBX: 00007fb4f9bb5fa0 RCX: 00007fb4f998d5fc [ 987.489376][T17835] RDX: 000000000000000f RSI: 00007fb4fa7af0a0 RDI: 0000000000000005 [ 987.489382][T17835] RBP: 00007fb4fa7af090 R08: 0000000000000000 R09: 0000000000000000 [ 987.489389][T17835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 987.489396][T17835] R13: 00007fb4f9bb6038 R14: 00007fb4f9bb5fa0 R15: 00007ffda136cae8 [ 987.489409][T17835] [ 987.513376][T17833] netlink: 146872 bytes leftover after parsing attributes in process `syz.2.3064'. [ 987.714888][ T5967] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 987.727607][ T5967] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.752497][ T5967] usb 4-1: Product: syz [ 987.764712][ T5967] usb 4-1: Manufacturer: syz [ 987.769592][ T5967] usb 4-1: SerialNumber: syz [ 987.789018][ T5967] rtl8150 4-1:1.0: couldn't find required endpoints [ 987.796344][ T5967] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 988.194207][ T30] audit: type=1400 audit(1755910385.254:1096): avc: denied { connect } for pid=17843 comm="syz.6.3066" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 989.309367][ T30] audit: type=1400 audit(1755910385.324:1097): avc: denied { write } for pid=17843 comm="syz.6.3066" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 989.443985][T17851] CIFS mount error: No usable UNC path provided in device string! [ 989.443985][T17851] [ 989.454340][T17851] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 990.013381][T17855] bpq0: left allmulticast mode [ 990.482820][ T24] usb 4-1: USB disconnect, device number 58 [ 991.149423][T17875] netlink: 124 bytes leftover after parsing attributes in process `syz.3.3073'. [ 991.762804][T17887] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3074'. [ 992.360551][T17890] netlink: 146872 bytes leftover after parsing attributes in process `syz.3.3077'. [ 992.584714][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.691813][T17899] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3079'. [ 993.114416][T17899] netlink: 'syz.2.3079': attribute type 2 has an invalid length. [ 993.156540][ T30] audit: type=1400 audit(1755910390.224:1098): avc: denied { ioctl } for pid=17895 comm="syz.2.3079" path="socket:[69822]" dev="sockfs" ino=69822 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 993.225386][ T5863] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 993.240485][ T5863] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 993.263029][ T5863] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 993.278854][ T5863] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 993.288490][ T5863] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 993.367929][T15922] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 993.802629][T17903] wg2 speed is unknown, defaulting to 1000 [ 993.993591][T15922] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 995.238547][T15922] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 995.376314][T12723] Bluetooth: hci5: command tx timeout [ 995.479602][T15922] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 995.502580][T17940] bpq0: entered promiscuous mode [ 996.967830][T17903] chnl_net:caif_netlink_parms(): no params data found [ 997.456766][T12723] Bluetooth: hci5: command tx timeout [ 997.687084][T17961] netlink: 830 bytes leftover after parsing attributes in process `syz.5.3094'. [ 997.757825][T17962] Bluetooth: MGMT ver 1.23 [ 997.814726][T17963] netlink: 192 bytes leftover after parsing attributes in process `syz.2.3093'. [ 998.009854][T15922] bridge_slave_1: left allmulticast mode [ 998.019416][T17970] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 998.022885][T15922] bridge_slave_1: left promiscuous mode [ 998.040237][T15922] bridge0: port 2(bridge_slave_1) entered disabled state [ 998.110977][T17971] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3096'. [ 998.635725][T15922] bridge_slave_0: left allmulticast mode [ 998.651752][T15922] bridge_slave_0: left promiscuous mode [ 998.660320][T15922] bridge0: port 1(bridge_slave_0) entered disabled state [ 999.544457][T12723] Bluetooth: hci5: command tx timeout [ 999.858335][ T30] audit: type=1400 audit(1755910396.924:1099): avc: denied { ioctl } for pid=17991 comm="syz.6.3102" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0xf503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1000.871657][T15922] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1000.918566][T15922] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1000.938474][ T30] audit: type=1400 audit(1755910397.974:1100): avc: denied { read } for pid=17991 comm="syz.6.3102" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1001.015464][T15922] bond0 (unregistering): Released all slaves [ 1001.041770][ T30] audit: type=1400 audit(1755910397.974:1101): avc: denied { open } for pid=17991 comm="syz.6.3102" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1001.525444][T18011] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18011 comm=syz.6.3103 [ 1001.615899][T12723] Bluetooth: hci5: command tx timeout [ 1001.636250][T15922] : left promiscuous mode [ 1001.683189][T17903] bridge0: port 1(bridge_slave_0) entered blocking state [ 1001.696187][T18015] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1001.723978][T17903] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.844347][T17903] bridge_slave_0: entered allmulticast mode [ 1001.863535][T17903] bridge_slave_0: entered promiscuous mode [ 1001.918232][T17903] bridge0: port 2(bridge_slave_1) entered blocking state [ 1001.928696][T17903] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.936191][T17903] bridge_slave_1: entered allmulticast mode [ 1001.943350][T17903] bridge_slave_1: entered promiscuous mode [ 1002.114221][ T30] audit: type=1326 audit(1755910399.174:1102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.146588][ T30] audit: type=1326 audit(1755910399.174:1103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.181832][ T30] audit: type=1326 audit(1755910399.174:1104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.208255][ T30] audit: type=1326 audit(1755910399.174:1105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.234011][ T30] audit: type=1326 audit(1755910399.174:1106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.263787][ T30] audit: type=1326 audit(1755910399.174:1107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.291113][ T30] audit: type=1326 audit(1755910399.174:1108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18005 comm="syz.6.3103" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa38758ebe9 code=0x7fc00000 [ 1002.318650][T17903] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1002.338336][T17903] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1002.347520][ T5968] usb 3-1: new full-speed USB device number 75 using dummy_hcd [ 1002.539603][T17903] team0: Port device team_slave_0 added [ 1002.550739][T17903] team0: Port device team_slave_1 added [ 1002.562034][ T5968] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1002.576134][ T5968] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1002.611068][ T5968] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1002.636668][ T5968] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.658434][ T5968] usb 3-1: config 0 descriptor?? [ 1002.672834][ T5968] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1002.679863][ T5968] dvb-usb: bulk message failed: -22 (3/0) [ 1002.700865][ T5968] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1002.717447][ T5968] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1002.725634][ T5968] usb 3-1: media controller created [ 1002.732664][ T5968] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1002.759898][T17903] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1002.776073][T17903] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1002.806868][ T5968] dvb-usb: bulk message failed: -22 (6/0) [ 1002.809373][T17903] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1002.832574][ T5968] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1003.032831][T18022] dibusb: i2c wr: len=61 is too big! [ 1003.032831][T18022] [ 1003.050061][ T5968] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input64 [ 1003.679679][T15922] hsr_slave_0: left promiscuous mode [ 1003.692185][ T5968] dvb-usb: schedule remote query interval to 150 msecs. [ 1003.711495][ T5968] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1003.722416][T15922] hsr_slave_1: left promiscuous mode [ 1003.737119][T15922] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1003.768769][ T5968] usb 3-1: USB disconnect, device number 75 [ 1003.833831][T15922] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1003.963870][T15922] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1003.963894][T15922] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1004.240644][ T5968] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1004.251372][T15922] veth1_macvtap: left promiscuous mode [ 1004.269646][T15922] veth0_macvtap: left promiscuous mode [ 1004.293498][T15922] veth1_vlan: left promiscuous mode [ 1004.300253][T15922] veth0_vlan: left promiscuous mode [ 1004.398237][T18049] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1005.405180][ T24] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 1005.596200][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.606584][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1005.625175][ T24] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1005.637593][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1005.658301][ T24] usb 4-1: config 0 descriptor?? [ 1005.666916][ T24] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1005.673657][ T24] dvb-usb: bulk message failed: -22 (3/0) [ 1005.687895][ T24] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1005.700113][ T24] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1005.708220][ T24] usb 4-1: media controller created [ 1005.718663][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1005.757413][ T24] dvb-usb: bulk message failed: -22 (6/0) [ 1005.763414][ T24] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1005.773884][ T24] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input65 [ 1005.791193][ T24] dvb-usb: schedule remote query interval to 150 msecs. [ 1005.798461][ T24] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1005.906577][T18069] dibusb: i2c wr: len=61 is too big! [ 1005.906577][T18069] [ 1005.937817][ T1674] usb 4-1: USB disconnect, device number 59 [ 1005.968886][ T1674] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1006.023256][T15922] team0 (unregistering): Port device team_slave_1 removed [ 1006.083094][T15922] team0 (unregistering): Port device team_slave_0 removed [ 1006.969142][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 1006.969194][ T30] audit: type=1326 audit(1755910404.034:1170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.078093][ T30] audit: type=1326 audit(1755910404.034:1171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.105601][ T30] audit: type=1326 audit(1755910404.034:1172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.134515][ T30] audit: type=1326 audit(1755910404.034:1173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.164961][ T30] audit: type=1326 audit(1755910404.034:1174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.193570][ T30] audit: type=1326 audit(1755910404.034:1175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.220188][ T30] audit: type=1326 audit(1755910404.034:1176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.249169][ T30] audit: type=1326 audit(1755910404.034:1177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.281053][ T30] audit: type=1326 audit(1755910404.034:1178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.311550][ T30] audit: type=1326 audit(1755910404.034:1179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18078 comm="syz.3.3123" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7efea438ebe9 code=0x7ffc0000 [ 1007.476751][T17903] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1007.483722][T17903] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1007.511466][T17903] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1007.532962][T18073] bpq0: left promiscuous mode [ 1008.049006][T17903] hsr_slave_0: entered promiscuous mode [ 1008.070411][T17903] hsr_slave_1: entered promiscuous mode [ 1008.077555][T17903] debugfs: 'hsr0' already exists in 'hsr' [ 1008.083492][T17903] Cannot create hsr debugfs directory [ 1008.466083][T18091] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1008.474040][T18091] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 1008.486211][T18091] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1008.493961][T18091] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 1008.524908][T18099] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3125'. [ 1008.594328][ T5968] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1008.714190][ T5967] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 1008.814455][ T5968] usb 7-1: Using ep0 maxpacket: 16 [ 1008.825504][ T5968] usb 7-1: config 0 has no interfaces? [ 1008.833280][ T5968] usb 7-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1008.844628][ T5968] usb 7-1: New USB device strings: Mfr=1, Product=10, SerialNumber=3 [ 1008.852851][ T5968] usb 7-1: Product: syz [ 1008.857257][ T5967] usb 4-1: device descriptor read/64, error -71 [ 1008.865725][ T5968] usb 7-1: Manufacturer: syz [ 1008.871255][ T5968] usb 7-1: SerialNumber: syz [ 1008.901752][T17903] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1008.911011][ T5968] usb 7-1: config 0 descriptor?? [ 1008.934909][T17903] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1009.005217][T17903] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1009.047893][T17903] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1009.094239][ T5967] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 1009.232068][ T5987] usb 7-1: USB disconnect, device number 18 [ 1009.283765][ T5967] usb 4-1: device descriptor read/64, error -71 [ 1009.336998][T17903] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1009.371134][T17903] 8021q: adding VLAN 0 to HW filter on device team0 [ 1009.432021][ T5967] usb usb4-port1: attempt power cycle [ 1009.479375][T17903] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1009.497288][T17903] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1009.525971][T15922] bridge0: port 1(bridge_slave_0) entered blocking state [ 1009.533234][T15922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1009.543270][T15922] bridge0: port 2(bridge_slave_1) entered blocking state [ 1009.550374][T15922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1009.784163][ T5967] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 1009.807083][ T5967] usb 4-1: device descriptor read/8, error -71 [ 1010.025046][T17903] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1010.161381][ T5967] usb 4-1: new full-speed USB device number 63 using dummy_hcd [ 1010.206484][ T5967] usb 4-1: device descriptor read/8, error -71 [ 1010.314858][ T5967] usb usb4-port1: unable to enumerate USB device [ 1010.454285][ T5987] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1010.626528][ T5987] usb 3-1: Using ep0 maxpacket: 8 [ 1010.637372][ T5987] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1010.647752][ T5987] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1010.670854][ T5987] usb 3-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 1010.837544][ T5987] usb 3-1: config 8 interface 0 has no altsetting 0 [ 1010.918782][ T5987] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 1010.935756][ T5987] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1011.078609][ T5987] usb 3-1: Product: syz [ 1011.084663][ T5987] usb 3-1: Manufacturer: syz [ 1011.090584][ T5987] usb 3-1: SerialNumber: syz [ 1011.122467][T17903] veth0_vlan: entered promiscuous mode [ 1011.841251][T18145] SELinux: policydb magic number 0x78756e8c does not match expected magic number 0xf97cff8c [ 1011.851776][T18145] SELinux: failed to load policy [ 1012.120814][T17903] veth1_vlan: entered promiscuous mode [ 1012.295940][T17903] veth0_macvtap: entered promiscuous mode [ 1012.327565][T17903] veth1_macvtap: entered promiscuous mode [ 1012.348959][T17903] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1012.386190][T17903] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1012.757981][T15921] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.774561][T15922] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.785859][T15922] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.826142][T15922] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.948355][T15922] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1012.984586][T15922] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1013.139296][T15925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1013.149117][T15925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1013.193644][ T5987] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1013.248720][ T5987] usb 3-1: selecting invalid altsetting 0 [ 1013.639878][ T5987] snd-usb-audio 3-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 1013.707743][T18167] netlink: 'syz.8.3076': attribute type 4 has an invalid length. [ 1013.731082][ T5987] usb 3-1: USB disconnect, device number 76 [ 1013.779652][T18170] netlink: 'syz.8.3076': attribute type 4 has an invalid length. [ 1014.329200][T18173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3142'. [ 1014.452846][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 1014.452865][ T30] audit: type=1400 audit(1755910411.514:1191): avc: denied { setopt } for pid=18172 comm="syz.2.3142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1015.614573][T18195] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3147'. [ 1018.263827][T18213] fuse: Bad value for 'fd' [ 1018.484114][T18203] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1018.505547][T18203] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1018.649184][T18203] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1018.804152][T18203] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1019.013655][T18203] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1019.021003][T18203] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1020.624276][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3160'. [ 1020.863916][T18252] hub 9-0:1.0: USB hub found [ 1020.871806][T18252] hub 9-0:1.0: 1 port detected [ 1021.449370][T18255] FAULT_INJECTION: forcing a failure. [ 1021.449370][T18255] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1021.454133][ T30] audit: type=1400 audit(1755910417.864:1192): avc: denied { map } for pid=18244 comm="syz.8.3162" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1021.477511][T18248] input: syz1 as /devices/virtual/input/input66 [ 1021.495903][T18255] CPU: 1 UID: 0 PID: 18255 Comm: syz.2.3164 Not tainted syzkaller #0 PREEMPT(full) [ 1021.495929][T18255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1021.495940][T18255] Call Trace: [ 1021.495947][T18255] [ 1021.495954][T18255] dump_stack_lvl+0x16c/0x1f0 [ 1021.495980][T18255] should_fail_ex+0x512/0x640 [ 1021.496005][T18255] _copy_to_user+0x32/0xd0 [ 1021.496030][T18255] simple_read_from_buffer+0xcb/0x170 [ 1021.496052][T18255] proc_fail_nth_read+0x197/0x240 [ 1021.496074][T18255] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1021.496096][T18255] ? rw_verify_area+0xcf/0x6c0 [ 1021.496123][T18255] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1021.496143][T18255] vfs_read+0x1e1/0xcf0 [ 1021.496165][T18255] ? __pfx___mutex_lock+0x10/0x10 [ 1021.496186][T18255] ? __pfx_vfs_read+0x10/0x10 [ 1021.496211][T18255] ? __fget_files+0x20e/0x3c0 [ 1021.496238][T18255] ksys_read+0x12a/0x250 [ 1021.496255][T18255] ? __pfx_ksys_read+0x10/0x10 [ 1021.496280][T18255] do_syscall_64+0xcd/0x4c0 [ 1021.496302][T18255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1021.496320][T18255] RIP: 0033:0x7f6063d8d5fc [ 1021.496336][T18255] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1021.496353][T18255] RSP: 002b:00007f6064cd1030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1021.496370][T18255] RAX: ffffffffffffffda RBX: 00007f6063fb5fa0 RCX: 00007f6063d8d5fc [ 1021.496381][T18255] RDX: 000000000000000f RSI: 00007f6064cd10a0 RDI: 0000000000000004 [ 1021.496392][T18255] RBP: 00007f6064cd1090 R08: 0000000000000000 R09: 00000000fffff000 [ 1021.496403][T18255] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 [ 1021.496413][T18255] R13: 00007f6063fb6038 R14: 00007f6063fb5fa0 R15: 00007ffd637a0938 [ 1021.496438][T18255] [ 1021.747976][ T30] audit: type=1400 audit(1755910417.864:1193): avc: denied { execute } for pid=18244 comm="syz.8.3162" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1021.883741][T18266] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3167'. [ 1022.534848][T18279] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1023.384396][ T31] INFO: task syz-executor:5842 blocked for more than 143 seconds. [ 1023.392245][ T31] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1023.446287][ T30] audit: type=1400 audit(1755910420.514:1194): avc: denied { write } for pid=5831 comm="syz-executor" path="pipe:[4821]" dev="pipefs" ino=4821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 1023.470010][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1023.506698][ T31] task:syz-executor state:D stack:23840 pid:5842 tgid:5842 ppid:1 task_flags:0x400140 flags:0x00004004 [ 1023.580552][ T31] Call Trace: [ 1023.583872][ T31] [ 1023.604393][T18284] netlink: 'syz.3.3167': attribute type 1 has an invalid length. [ 1023.612273][T18284] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3167'. [ 1023.621437][T18284] netlink: 'syz.3.3167': attribute type 2 has an invalid length. [ 1023.647283][T18284] netlink: 'syz.3.3167': attribute type 1 has an invalid length. [ 1023.654405][ T31] __schedule+0x1190/0x5de0 [ 1023.659535][ T31] ? __lock_acquire+0x62e/0x1ce0 [ 1023.711882][ T31] ? __pfx___schedule+0x10/0x10 [ 1023.754129][ T31] ? find_held_lock+0x2b/0x80 [ 1023.758859][ T31] ? schedule+0x2d7/0x3a0 [ 1023.763200][ T31] schedule+0xe7/0x3a0 [ 1023.827951][ T31] v9fs_evict_inode+0x26f/0x300 [ 1023.832850][ T31] ? __pfx_v9fs_evict_inode+0x10/0x10 [ 1023.871516][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 1023.884117][ T31] ? evict+0x3a2/0x920 [ 1023.888227][ T31] ? __pfx_v9fs_evict_inode+0x10/0x10 [ 1023.893601][ T31] evict+0x3e3/0x920 [ 1023.916429][ T31] ? __pfx_evict+0x10/0x10 [ 1023.920861][ T31] ? iput+0x519/0x880 [ 1023.977341][ T31] iput+0x521/0x880 [ 1023.981191][ T31] ? __pfx_v9fs_drop_inode+0x10/0x10 [ 1023.986958][ T31] dentry_unlink_inode+0x29c/0x480 [ 1023.992079][ T31] __dentry_kill+0x1d0/0x600 [ 1024.024925][ T31] dput.part.0+0x4b1/0x9b0 [ 1024.038668][ T31] shrink_dcache_for_umount+0x159/0x3e0 [ 1024.054119][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1024.059347][ T31] generic_shutdown_super+0x6c/0x390 [ 1024.074137][ T31] kill_anon_super+0x3a/0x60 [ 1024.078766][ T31] v9fs_kill_super+0x3d/0xa0 [ 1024.083355][ T31] deactivate_locked_super+0xc1/0x1a0 [ 1024.117156][ T31] deactivate_super+0xde/0x100 [ 1024.122053][ T31] cleanup_mnt+0x225/0x450 [ 1024.138664][ T31] task_work_run+0x14d/0x240 [ 1024.143302][ T31] ? __pfx_task_work_run+0x10/0x10 [ 1024.156906][ T31] ? __pfx___x64_sys_umount+0x10/0x10 [ 1024.174129][ T31] exit_to_user_mode_loop+0xeb/0x110 [ 1024.179461][ T31] do_syscall_64+0x3f6/0x4c0 [ 1024.187444][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1024.193355][ T31] RIP: 0033:0x7fb04358ff17 [ 1024.198186][ T31] RSP: 002b:00007ffdce6684b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1024.209979][ T31] RAX: 0000000000000000 RBX: 00007fb043611c05 RCX: 00007fb04358ff17 [ 1024.217999][ T31] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdce668570 [ 1024.226224][ T31] RBP: 00007ffdce668570 R08: 0000000000000000 R09: 0000000000000000 [ 1024.234243][ T31] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffdce669600 [ 1024.242212][ T31] R13: 00007fb043611c05 R14: 00000000000d5c15 R15: 00007ffdce669640 [ 1024.250310][ T31] [ 1024.253477][ T31] [ 1024.253477][ T31] Showing all locks held in the system: [ 1024.262027][ T31] 1 lock held by khungtaskd/31: [ 1024.304470][ T31] #0: ffffffff8e5c1220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1024.364206][ T31] 2 locks held by getty/5600: [ 1024.368920][ T31] #0: ffff8880324630a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1024.444181][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1024.514181][ T31] 1 lock held by syz-executor/5842: [ 1024.547030][ T31] #0: ffff88801b9ac0e0 (&type->s_umount_key#85){+.+.}-{4:4}, at: deactivate_super+0xd6/0x100 [ 1024.584314][ T31] 2 locks held by syz-executor/14167: [ 1024.589721][ T31] #0: ffffffff90382ac8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 1024.624176][ T31] #1: ffffffff8e5cc7b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1024.644140][ T31] 3 locks held by kworker/1:1/14225: [ 1024.649453][ T31] #0: ffff88801b878d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1024.675490][ T31] #1: ffffc9000427fd10 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1024.704878][ T31] #2: ffffffff8e5cc7b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1024.717169][ T31] 1 lock held by syz-executor/14462: [ 1024.722474][ T31] #0: ffffffff90382ac8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 1024.739321][ T31] 2 locks held by kworker/u8:13/15919: [ 1024.745088][ T31] #0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1024.755214][ T31] #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1024.763942][ T31] 1 lock held by syz.8.3165/18263: [ 1024.770057][ T31] #0: ffffffff90382ac8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 1024.779110][ T31] 1 lock held by syz.3.3167/18284: [ 1024.784305][ T31] #0: ffffffff90382ac8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 1024.793282][ T31] 1 lock held by syz.2.3166/18269: [ 1024.798411][ T31] #0: ffffffff90382ac8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 [ 1024.807441][ T31] [ 1024.809775][ T31] ============================================= [ 1024.809775][ T31] [ 1024.820929][ T31] NMI backtrace for cpu 0 [ 1024.820947][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1024.820968][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1024.820979][ T31] Call Trace: [ 1024.820985][ T31] [ 1024.820993][ T31] dump_stack_lvl+0x116/0x1f0 [ 1024.821017][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1024.821042][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1024.821071][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1024.821099][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1024.821126][ T31] watchdog+0xf0e/0x1260 [ 1024.821151][ T31] ? __pfx_watchdog+0x10/0x10 [ 1024.821169][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1024.821189][ T31] ? __kthread_parkme+0x19e/0x250 [ 1024.821216][ T31] ? __pfx_watchdog+0x10/0x10 [ 1024.821235][ T31] kthread+0x3c2/0x780 [ 1024.821253][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.821271][ T31] ? rcu_is_watching+0x12/0xc0 [ 1024.821292][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.821310][ T31] ret_from_fork+0x5d7/0x6f0 [ 1024.821325][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.821342][ T31] ret_from_fork_asm+0x1a/0x30 [ 1024.821375][ T31] [ 1024.821381][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1024.943274][ C1] NMI backtrace for cpu 1 [ 1024.943289][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 1024.943305][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1024.943314][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1024.943332][ C1] Code: 4c 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 52 16 00 fb f4 4c 09 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1024.943346][ C1] RSP: 0018:ffffc90000197df8 EFLAGS: 000002c2 [ 1024.943358][ C1] RAX: 00000000047ee831 RBX: 0000000000000001 RCX: ffffffff8b93bc29 [ 1024.943367][ C1] RDX: 0000000000000000 RSI: ffffffff8de4fd28 RDI: ffffffff8c162900 [ 1024.943376][ C1] RBP: ffffed1003c56488 R08: 0000000000000001 R09: ffffed10170a6655 [ 1024.943385][ C1] R10: ffff8880b85332ab R11: 0000000000000000 R12: 0000000000000001 [ 1024.943394][ C1] R13: ffff88801e2b2440 R14: ffffffff90ab4390 R15: 0000000000000000 [ 1024.943403][ C1] FS: 0000000000000000(0000) GS:ffff8881247bb000(0000) knlGS:0000000000000000 [ 1024.943417][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1024.943427][ C1] CR2: 0000200000404030 CR3: 000000000e380000 CR4: 00000000003526f0 [ 1024.943436][ C1] Call Trace: [ 1024.943441][ C1] [ 1024.943446][ C1] default_idle+0x13/0x20 [ 1024.943462][ C1] default_idle_call+0x6d/0xb0 [ 1024.943478][ C1] do_idle+0x391/0x510 [ 1024.943496][ C1] ? __pfx_do_idle+0x10/0x10 [ 1024.943511][ C1] ? trace_sched_exit_tp+0x2f/0x120 [ 1024.943528][ C1] cpu_startup_entry+0x4f/0x60 [ 1024.943543][ C1] start_secondary+0x21d/0x2b0 [ 1024.943563][ C1] ? __pfx_start_secondary+0x10/0x10 [ 1024.943583][ C1] common_startup_64+0x13e/0x148 [ 1024.943604][ C1] [ 1024.950201][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1024.950216][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1024.950235][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1024.950245][ T31] Call Trace: [ 1024.950251][ T31] [ 1024.950258][ T31] dump_stack_lvl+0x3d/0x1f0 [ 1024.950278][ T31] vpanic+0x6e8/0x7a0 [ 1024.950303][ T31] ? __pfx_vpanic+0x10/0x10 [ 1024.950328][ T31] ? __pfx___irq_work_queue_local+0x10/0x10 [ 1024.950349][ T31] panic+0xca/0xd0 [ 1024.950372][ T31] ? __pfx_panic+0x10/0x10 [ 1024.950395][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1024.950419][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 1024.950443][ T31] ? watchdog+0xd78/0x1260 [ 1024.950464][ T31] ? watchdog+0xd6b/0x1260 [ 1024.950482][ T31] watchdog+0xd89/0x1260 [ 1024.950509][ T31] ? __pfx_watchdog+0x10/0x10 [ 1024.950525][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1024.950543][ T31] ? __kthread_parkme+0x19e/0x250 [ 1024.950566][ T31] ? __pfx_watchdog+0x10/0x10 [ 1024.950583][ T31] kthread+0x3c2/0x780 [ 1024.950599][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.950616][ T31] ? rcu_is_watching+0x12/0xc0 [ 1024.950637][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.950654][ T31] ret_from_fork+0x5d7/0x6f0 [ 1024.950668][ T31] ? __pfx_kthread+0x10/0x10 [ 1024.950684][ T31] ret_from_fork_asm+0x1a/0x30 [ 1024.950713][ T31] [ 1025.250784][ T31] Kernel Offset: disabled [ 1025.255082][ T31] Rebooting in 86400 seconds..