last executing test programs: 9m38.877143838s ago: executing program 1 (id=427): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r3, 0x4b72, &(0x7f00000001c0)={0x0, 0x20000, 0x8, 0x2, 0x200, &(0x7f0000003c40)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309001f000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x7}, @hci_rp_read_enc_key_size={{0x3}, {0xff, 0xc8, 0x9d}}}}, 0xa) 9m35.351630236s ago: executing program 1 (id=444): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000000)=0x28, 0x4) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000017c0)=@newtaction={0xe68, 0x30, 0x25, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{}, [{}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x20000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x80003}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4000000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xffffffff}], [{}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r4, @ANYBLOB="0108000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x109040, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e04015b0c"], 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0, 0xccd21cca, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='h'], 0x68}, 0x9}, 0x0) setns(r1, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r8 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_DRAIN(r8, 0x4144, 0x0) futex(0x0, 0x6, 0x0, 0x0, 0x0, 0x0) 9m34.168960519s ago: executing program 1 (id=453): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='select \n', 0x10) write(r0, &(0x7f0000000100)='file read /etc/passwd task.uid=0 exec.argv[0]=\"\\a\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) 9m34.105027406s ago: executing program 1 (id=454): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x800, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000440)="97"}) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/../file0/file0\x00', 0x0, 0x2a530d1, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x5) 9m34.020848482s ago: executing program 1 (id=455): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x20040084) socket(0x400000000010, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000002cc0)={0x0, [{0x0, 0x4d88, 0x8, &(0x7f0000000640)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0x0, 0x1ff, 0x0}, {0x3, 0x0, 0x100d5b6, 0x0}, {0x2, 0x0, 0xfffffff8, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0xa2d, 0x0}, {0x0, 0x0, 0x1, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x4, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x1545, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x40007, 0x0}]}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRES16, @ANYBLOB, @ANYRES32=r11], 0x24}}, 0x18) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r4) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002440)={&(0x7f0000000280)={0x24, r12, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x178e}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}}, 0x60048005) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) add_key$user(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='5', 0x1, 0xfffffffffffffffd) 9m33.372671066s ago: executing program 1 (id=456): syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080002"], 0x0) syz_emit_ethernet(0x24e, &(0x7f00000007c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000002182c00fe8000000000000000000000000000bbfe8000000000000004000000000000aa8902000100000000"], 0x0) 9m33.027622389s ago: executing program 32 (id=456): syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080002"], 0x0) syz_emit_ethernet(0x24e, &(0x7f00000007c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000002182c00fe8000000000000000000000000000bbfe8000000000000004000000000000aa8902000100000000"], 0x0) 3m54.352572844s ago: executing program 2 (id=1793): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x5, 0x0, 0x6}}}}}}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000003c0)={@local, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x38, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xffffa888}]}}}}}}}, 0x0) 3m54.104669296s ago: executing program 2 (id=1795): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x3c, r1, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x16c}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x3c}, 0x1, 0xff7f0000}, 0x20000000) 3m53.432692795s ago: executing program 2 (id=1796): r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) preadv(r3, &(0x7f0000000380)=[{&(0x7f0000000040)=""/133, 0x85}], 0x1, 0xf2a4, 0x7f) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000140)=@req={0x1, 0xffff, 0x3, 0x1}, 0x10) (async) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400030500008000ffdbdf25020000fd", @ANYRES32=r5, @ANYBLOB="080002007f"], 0x20}, 0x1, 0x0, 0x0, 0x8090}, 0x48006) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e22, @broadcast}}) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000680)={&(0x7f00000003c0)={0x2c0, r7, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_OURS={0x268, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x1e, 0x4, "8f1013f97971c5bd7f040cb9c8d2c956e92fb1b69d6831d07e59"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x5e0f}, @ETHTOOL_A_BITSET_VALUE={0xaf, 0x4, "eb4c19b14b0428067001c770e5a9c0d6e19c53b4f8a4ffe1dd90b52284497d7c4b191f8648f366a6cf3b1c9b5a5692c083a5d2747535eaffba8c22952a2432cc5ae3fbb3cff6a8f4ed3d864ee21eb2516ddd4249c7ef7ea85246530d7eb61e07b970d4f6bb7404ea0fc2a5f7369e2533cd3cebd92fa9d3813caf1e281c22a5f49176248a0c1b71f24faf285beae78b9e42d1b3c7e947ee05dd07993f31b0b9902e0e37b7359f4ca5c4415d"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}, @ETHTOOL_A_BITSET_VALUE={0xe2, 0x4, "b0c45063fe26fb97b7af54c0531cf315257b6c9f906f8027a57c985dce6621ae42f8636efcbbac2464f60e71256a9473c4a0b52e5f326af96579bc65d2fa319283b55727b5dc59efd04cdf000eba042e69294b7bf7d2a2fe2b653e78ef3d7521a5d656adc3638e1c665b7eecde2e98c819a8849502fe6cbdbe5e02dd9e421d5031c231338f40df7b6fd0f3bcb1a055418a354735860b1dd404ae2e56eb0eec7b3c80226c597daaa934668de4ba33a6e4c3345015891ad8da65703c086b0a85bebc607a9988a88b67f1ff9d92b0874368ce89b4e405d9008799bb49681a3c"}, @ETHTOOL_A_BITSET_VALUE={0x98, 0x4, "e205b746e5c3c784cabc3863a99703de058eb87f87d665c3ddcbc4cf6e0cd13ec5f5cb08e9121898b2654df83249251ec30e000f44b129b558f8793c03c820b9257f6e096618a2f3f679dfdf69bd967d3a2d584ac2fcedecb9cafe492877e278961796def18ae1ce792545bbfde299b9b5adeef3f3109b4ecf5158b2d0156ccdad94eaf2acc290d6dfd1246e9f52d5c0c0893557"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd}]}, @ETHTOOL_A_LINKMODES_OURS={0x44, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x3c, 0x3, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, 'lo\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, 'lo\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x10, 0x2, '.^+:$($H:@$\x00'}]}]}]}]}, 0x2c0}, 0x1, 0x0, 0x0, 0x8010}, 0x20000884) 3m53.317122187s ago: executing program 2 (id=1797): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d2) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x700, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 3m53.173511999s ago: executing program 2 (id=1799): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) close(0x3) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) writev(r1, &(0x7f0000001640)=[{&(0x7f0000000000)='i', 0x1}], 0x1) mmap(&(0x7f0000b2c000/0x1000)=nil, 0x1000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) tkill(r2, 0x2f) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace$peekuser(0x3, r2, 0xa) ptrace(0x10, r2) ptrace$peeksig(0x4209, r2, &(0x7f0000000140)={0x1, 0x0, 0x7b}, &(0x7f0000000fc0)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x200002, 0x0) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001540), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r4, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001600)={0x28, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4008004) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 3m52.016217164s ago: executing program 2 (id=1806): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='oom_adj\x00') mount$overlay(0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$igmp6(0xa, 0x3, 0x2) fspick(0xffffffffffffffff, &(0x7f0000000400)='./file0/file1\x00', 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x3, 0x2, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x3b, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) exit(0xffff) pread64(r0, 0x0, 0x0, 0xffffffffffffffff) 3m36.437483792s ago: executing program 33 (id=1806): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='oom_adj\x00') mount$overlay(0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$igmp6(0xa, 0x3, 0x2) fspick(0xffffffffffffffff, &(0x7f0000000400)='./file0/file1\x00', 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x3, 0x2, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x3b, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) exit(0xffff) pread64(r0, 0x0, 0x0, 0xffffffffffffffff) 2m53.728504314s ago: executing program 0 (id=2028): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000280)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406301, {0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m53.453873855s ago: executing program 0 (id=2030): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) (async) r1 = eventfd(0x0) (async) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) (async) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) (async) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x1, 0x0, &(0x7f00000008c0)=""/58, 0x0}) (async) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) (async) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b40)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0bf0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a404724f8a4f1cda7997b65954f74097560b91da309b887af2485c2d9ab09b523000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb7818000000009dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbef88811dc8c1b27ac7d9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d856177a2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009d81003f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e750339643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2dfae60ab958e9f3ef9b4aaa4e8d6166f636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978a2df2f2a29a387c6f0576b36038f819286eca99a6a434811cf2a117d775fe986a49fb82cf5f15972d5ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e6735305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a54b49e1ae6c5aa620d27e91aa0aa0ed6fcacfc91fbb4c256409e54daefbb107c381fa729ff5f3907d93430da178d685d7730f5e129438a5214f722096d2986334c2576bef69145d3fbd78a9059e454474f92e65828b018174a9f4738b8c71fbdeac26ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a378ed4c6267965af78b861bd025312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68f78215d65f96eb55db8cbcb060008000d988374f85451a694ffe38a1d03916ff10dc82b31c98d42e1a1bda1290de1a499a5a385b31112a48ba3e6d6849914c1788a7aca37177cc341fff44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553e4ece78d4c1501c70f5d81e0725d5b273755c0000000000000000aa4234ff82182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a11993d54f97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a923655800a2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574e6e6aefb7a68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24a8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa753ba528f7ba77e825051ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8e220bb4d83de1e4dc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a409315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f0000000086e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e801015642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f845d1cc9ec4eee79c298fb0ba939b13707044e2e9cc0d350438c1c8c6bb9a38c6ac5ca0d9cf1f3d6915f25cb26edfc28b3079b97df32601240e454db103fb0c4a143673a3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4054605558ab31f339f6a4caf2ee2fd01f34dca3300000000000000000000000000000000f59f8e6e00000000c44130098d833a24000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c595426ae40d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd603fd7f8898c70b5c65f2e28f22e1a79a6af3a54861b07f124642e98389557affbdede09b5566a4a1ee73b20846810030a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae3a9052be8eec1e95f6ad8d41dd34829503ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b0b0770c6a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd25091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a674bd16b8f7e6aed12a305366599f5f029a7b24558c027518c669760500002f1c19d16a6f391906000000cc0bbbfb8c698ecc137d96711100e0108d3bd2afed0b279ebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc784c9f940d9fb0464a6cce635e14b80dc5c1c64e75e6bd5355d84f8df272f18f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f9f8ad16eeb8342278f311cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706b584d8408c9652b3fe68500747f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2ccb600ae7a4b128cae19df160e7c207b89132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af911dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2befd1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bc5348229fa84ae78af8421a22c4b4c17a3d24a4a0104000000000000d77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2c2b5c976dacf3dda7191c757f208000000000000005f7ed983f65723fbb36b9b51abb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a58275dbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193a05008cdef7a98a1671a1918df310dc4bfd61c3db4819ab1c57b348a8ff1ed36364a20fe846f1cd086058d139ce528425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb2514a6ae50dbdd422de0f0f8c670000000000390be79688f80c47314cb1b14afcaa5d23f9032e0ec51f45f447d6a7c798fcf7e60e2180e289410801e4f03a0e140f388f25b92da1025d8409e171a2336ed71cca86eb4658fe06df286e0e20276b0618eeffd05774f15686cd9d3182ca2fec863875f305fed6baf48a594db12582a38cfdffffffffffffff0cf8d920517835fe7d09cfcb624f6931f1cc6f6b71f58de9ddc38e0c43992f6bc57a718d0cfd197b5324b4e05ef1caa96db3ae1f2f2e5791faba2ebbe1a6faf21f2748fb1fb6743c3ca8af4e6b02518c9b7fdc1b5721eb1c3ed98db25536f74ac7861afc94544e52dcb5c60460a05802e3b437ac977bfa26b887a2443e8d559c58187f004eb82b07937df6e96f77ed551926bec4e0188fae10a35d1c5f1768ac6be829bea46f1babc3d74adc31ca71bdab9079e4288881b434484eadde9da6b81802842abd462d546c59d87acc014f81d3414759bda12d2a2c6bc1bfa807bd3101eb227184a61107b6d0618e2a3b842671e084ac3f0ff94dc48b51601247318ab4d1c5106458000000000008000000000000cfee0107e6c2fe8639d926829fdbbd86bf591a8c3c235d8939af9d923f648165881a6c29997234406400b3b1c321cc158dbe17123eace30000000000009ea77cb4d3ca892600000000796de6ae4ae40bdf9a6e8c5dc29562262af9cd54e8e3ecc7e3c8cba0ecc791683496c4e5c1a5729714d9f9031f49b400cd2667b4ea6df54809615a4f973f93e6ccec72f16ff998e29ed99df733680a9d5cea57f99cc139b6ea9014f3000000000000000000000000000000000000feeab45a4046a622b0dceb413e4e39b7317e92cbed46b41ab5115bfb542c933783d750852dfdc6656aaf15e10615a88821f2f1bc53969b52d6852755e7681ad5beda80b38ccd34116b99f50b4fdd967b3f20f260455412b67563e40e323bde9d673fceda0ad6981565c8a183d928903b4f4472dde41b6dcd75314c31e704dfcb222c8359fe88944f852242270c932abfaeece0843d708f5cd25b2a63ae1e79723c1c3c013836b47da0a35d0f34c070000000000000422ae2c148d444dd437a7d2f5e575009bc2d17a199802409329dae8baa58d3de63ad45328a9d4dc1ace543dfe11913c6c6413f8f7a15657d012fea460bb4656a20df1ba26932b0ef49f8ea88d7b4c1289314ba789661640f1b5d7cbae103fa95b0035f1e8e866307d4796eab0992704f9e00be4b1af8dfa9e94ad74e607ea9d7d7a95ed5a15429426abbed8d2c657018305c6f9e5159a5453f958991a908ff4cb2e8cbccb1d3c8daf754e4b01b2edd023e5bfdf293bd28fc1f8885f6edd5a715df4d180247feb08e9e2e5126c48be6098e711f0d86de5d76fdccae34eef9197c32ab4e6fcb52eb9ce18fdb621a75913a97254d783778203ec0bd1a8859683e1d01da4e81fb73bb3b358340a0310bf5ae17b917208da607fd7b125cf99fd3e9056f5184df7570ede94b736ae354b5b8ae2cc473b455f2f86d47c69027676bf1141f316b0f278f1692406572ee82766f8e5ff1cfec2a7a6cab7d0f2582a877c9bd4ca81089373f738d02e6bb4d3df30ac0f041e51ad36e1ff140812baf54b80635cc80963c8f69fa4506f7a30c99d3e538cc0aeafcad86ead38ed949aa3c204aea50e5e0039f01b82595b7dc921a8acc1f76340f060cc9a3acad3451c17dc9b5ca5d10a0cb1708592d1900a046f33761d50895febd9fd58cb132989766cf7c252daac259576ec218e3857e6fa97fe445d1fab51d87302a4bb28a4cfe462ee4849cc6832650188ca187d85509d8beccf9d9cf752368985804195b9fd2faf1aff8248f3981bd55cbbf514cd8365fee72cc7af053e5388ceadadb967ef735181df6a90cab13f58f6d563c9ab4ad37297aecffd8446cb2b14ec36a99af8393e3760d5970ba1debdcbccd54012c559ee2797ff962328aa6a252c0756e396ce4d52937546675203bdf1d6b120acac576523f8b1daa922188bf61536312f90dba92fb380c3c6fb5f9883a2c4dd99a1bac9b7cb25ff2ef9bd58ff97ddfdd2d4bcc371ee82245b57cd91a7fa3479cd339f54a5c422b753cd42d441ea881d46e419312db1f0cccce"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xff9d}, 0x48) 2m53.052990239s ago: executing program 0 (id=2032): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r3, 0xc008551a, &(0x7f00000003c0)={0x6, 0xc, [0xa1, 0xa4f2, 0x6]}) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000440)={0x25b, 0x10000, {0xffffffffffffffff}, {0xee01}, 0x0, 0x8}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@mcast1, 0x4e20, 0x9, 0x4e24, 0x2, 0x2, 0x0, 0xa0, 0x4, 0x0, r6}, {0x3d46, 0x4, 0xfffffffffffffff7, 0x6, 0x80, 0x1, 0x98e, 0x5}, {0x8, 0xfffffffffffffff9, 0x0, 0x3}, 0x2, 0x0, 0x1}, {{@in6=@remote, 0x4d6, 0x32}, 0xa, @in6=@private2, 0x3503, 0x0, 0x2, 0x5, 0xfae, 0x101, 0xc}}, 0xe4) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) 2m51.257778103s ago: executing program 0 (id=2035): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r3, 0xc008551a, &(0x7f00000003c0)={0x6, 0xc, [0xa1, 0xa4f2, 0x6]}) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000440)={0x25b, 0x10000, {0xffffffffffffffff}, {0xee01}, 0x0, 0x8}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@mcast1, 0x4e20, 0x9, 0x4e24, 0x2, 0x2, 0x0, 0xa0, 0x4, 0x0, r6}, {0x3d46, 0x4, 0xfffffffffffffff7, 0x6, 0x80, 0x1, 0x98e, 0x5}, {0x8, 0xfffffffffffffff9, 0x0, 0x3}, 0x2, 0x0, 0x1}, {{@in6=@remote, 0x4d6, 0x32}, 0xa, @in6=@private2, 0x3503, 0x0, 0x2, 0x5, 0xfae, 0x101, 0xc}}, 0xe4) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) 2m49.406776292s ago: executing program 0 (id=2038): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0x7, &(0x7f0000000140)={0x8, 0x2}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x5) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, 0x0, &(0x7f0000000680)=0xaf00) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/kernel/mm/transparent_hugepage/shmem_enabled\x00', 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendfile(r3, r3, 0x0, 0x6) sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_dev$usbmon(&(0x7f00000000c0), 0x5, 0xc000) read$msr(r5, &(0x7f0000032680)=""/102364, 0x18fdc) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x105680, 0x0) setrlimit(0x40000000000008, &(0x7f0000000000)={0x4848, 0xfffffffffffff006}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000001640), 0x0, 0x0) io_setup(0x2, &(0x7f00000001c0)=0x0) io_submit(r7, 0x1, &(0x7f00000012c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2004, r6, 0x0, 0xfffffe60, 0x800, 0x0, 0x6}]) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) 2m47.491317418s ago: executing program 0 (id=2045): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x57da, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x17}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f00000001c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r3, 0xc008551a, &(0x7f00000003c0)={0x6, 0xc, [0xa1, 0xa4f2, 0x6]}) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000440)={0x25b, 0x10000, {0xffffffffffffffff}, {0xee01}, 0x0, 0x8}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@mcast1, 0x4e20, 0x9, 0x4e24, 0x2, 0x2, 0x0, 0xa0, 0x4, 0x0, r6}, {0x3d46, 0x4, 0xfffffffffffffff7, 0x6, 0x80, 0x1, 0x98e, 0x5}, {0x8, 0xfffffffffffffff9, 0x0, 0x3}, 0x2, 0x0, 0x1}, {{@in6=@remote, 0x4d6, 0x32}, 0xa, @in6=@private2, 0x3503, 0x0, 0x2, 0x5, 0xfae, 0x101, 0xc}}, 0xe4) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) 2m33.386373261s ago: executing program 3 (id=2086): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000e500010000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000180)='binfmt_misc\x00', 0x28e4020, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)="303132333a616263643a63ed7b188db386fd353596a17062fe01637654c85ba3a1dfc61bf255cc6e5bbfa4b6dbccec74416c116f", 0x34) mbind(&(0x7f0000008000/0x7000)=nil, 0x7000, 0x1, 0x0, 0x2, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='projid_map\x00') writev(r4, &(0x7f00000002c0)=[{&(0x7f0000000280)='2', 0x1}], 0x1) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000300)={0x0, 0xff2, "a1713ae7d921350861dbf1fb8b3dbe01da300f1e726d2ca43d73488b48c9b3b8c8b389720b8642963ca1e31a6775a0d0723837696d03272b901053499275d7c6fa2ea2d6fec40092b319ac7bddaa63a2a8e55aea1aa765acad41097ea93f62ea3fc540c3084350874dee45800f5c6da032695038387c42139bfcafd0484a704d1ae3bc256803bf3cfd80beb28d080b9fe0430aa258b3aa785c33a0b480ee85f2edc8d18aed7a1571f08ddf78f2e077d94259bee7cce89ae0a155b4c159ab33db51d0842ac9d02437183e1f0b5413661d6261fe941b7198eea572a02610b7940d4c559fd90b3bac244bfa6a128338aae6589e74c9698d89ec2a3d372e4c6aefccc33cafc39b5d51ee82ac883b04c2799bd9fd3d137502ded8b1c05edf567ab66435c93e89f148a41b9328ab2589809595d61c52472586a017ff90c0b165033e85f3c1a88b1a8e385280c58c3ddfaba2fc2f6341c73280194ac6abcff273c590e0f4f8e2e4bad78c0bc3a8462a9714e4ba019e4af35196bd92ef89f02ce75e9ec8183b2320e52278a7562c9c4b69e85dc0cd71a4da7b413a897085f7e08fe903f6f54e1b8d8bb1e5b9ec333bbe0fddce8deb07984208f766847f43e4bcd62259e2f1d7c592ff63a722da7d926dfe20802967769d4e5043f55912e3d8d39293189e07559c91de24248984128ec8275d145f0eae4ad1962120bf100ed479542a8b354b22cea95254b1fbe8b59ebe3330c4110310763e22a1d4448b65b427f55a596fc5f56e337034b8a95c6c6fb0d5c0d399f2df5f89ad50d0d2bd3daab1e7cb1dbb6a43dc20b8c205ab4304ec265ee6c24cd437badb0d21122c1f7bce82e232bf436d694a1ae868897a26b7a75a2f31c76b1004175452e67cca7e0c348ff44bccad6d8b115579942cf934d3a457a1872f110150a590240d4e08b7a9752ec141ae58ef6f48a29f7bd4eea31c00d48af28babdc4f393534f05e93faf6b2e4fd72c70e522bcaa085587fb473c4c4f41843c38c4c420ffe0e4177421e894ddbb86e6d9a0c239b06520f80f3d9d19566db9d33f8e212f7f445899d81bc24c70fb6ac4f0227df39384bac93114def87c759cb03cd8e09099b91ec3452509c76f86a660b15e1873a3f0f47d8ed83ab71093a5c77bbd1c48a8aa409225e1bfd92806869ce20ee91b86bc559751ccd284f2eea92b2755adf0c46ae41af2fe97b3338914eb3858884fa56385f0f95d9a7b6d2455ccd9841ab7dbf1cc7403a3b8497fdd5e696fd344f8d089df7010ff22a31bd1089e0a3c9c0d236dc1aab2c89f4850a5be00d23d2a9dbc01f5c5fcecd43e755da643ddebb30377a22b9c69a99720e749a1bd380a4be34f30dc1fc213b41214af9e22cc9ad9d1f1c3643eb6e3e63f1ab53b70bdbc86f63f52087e9cd6fbbd5b6c4162f3b0cb1fe17488c99f078d0b1254fde932847fda083a62b4289b5f7e2d7ec853a3b09c022422fb131125532ac5deab3aef5a4549b08ff380e0ecfe30a7519ea90738c7fd68b8205a0ebd05c7f039d53fb7f106d5668afc893a670aac5b9dd7cc8dcce39634f8ce619862aa2a2a35875c8fd9728885f9a5f3d97e5873a67695560b696fec21df70da39bfa8dcfac2c9ecc928eb0deeef3d5709da6ab346cbea88089dd94d83b596ecabf4d9ddc19892d444be7a6e08bf9e2c6ef31761ae3f01d2de25a8d84e9e131897f499cc6ca8799a8aa48064a20e3ab34ec5241cd3ea66186e384bb1287da898b7b2e6fd01595c68f9954bef399b0633c1f42e2ba923382c80d2b6d0087026e90a077e4ea97f7726e1eab54539e931d7b3c0c79a53b17db8a6f778033d57404be3d8068dce049b4938d67d460a89aaf66a4d61926c4a0ad3ffa37b452a94a767b2d981dbfc2e486859d972886289a02f87abc66c25ba1d04cde9208629cf14c4a4fcb37b97c662d7ff0bc0871aefb1ff76676b169fb6e5b435606a1c41a4bcfb28e345b80a5ce756b413ed13dd265d0fa26466c970a09a4599d57193a82f816338c9a392b9cd68cc86f1a95ff9e94cf8a97e89ccbc6ab3ca39e2af4ec8fcca812af6b64afab32a3a3b56655e3bd48f1c66227ff6e0b265532e956c6c667e824e66f71ea3ea2253d5fba3312c4b07edc997ea55f2de09f7669595a27f5d0b45b90c613c7ed157341a59bb6072d1fe4623d5ee45e3ac4fb34512a4fe2cf76575ab815af1bee3f56eb5b2f2eab7440977126fa7ea1b2d5c3757d402b86f097eb851ea407c8c57a7cac88076a9aa972313343eae86dd383d814c2924e9640cfb533f3714b6d8b123935f893dc328c08c734d5ff47ae0ea601a16889b0de4aa1602c314c99220f53af1d51e7aba2aac3535ade82713ed1998f5ee8f7c1145cc0d705bbcb82c66f345d05246a0bad81e94b8bbca4375ff308199e6997a87ee58b84ad56b43a8a40233b73393bc7b35387ef0a40f737a5cc1800925a39b42972dbcaeb8cc1f0f6ac9aaaf2e8c19a34b4b93d58c18d1aa556fd4ba5c63c4e0c4d1e1e499ce61b8278b70de3c251003bb2eeb27a4bc13c2eabde33a02400293bf00e516ee186faab29c25ea3df99319a03b3228b470a567c5a94a1dccfe0ea40324fca23ec546a4eb7489b520fd2ff1e20a1fb27a56086c25bf9fc45b9b4746b22abe1c1d3bacfd304cbf647336de7a235d3ec3070ffeaf0a8a3edc4a570130f08000d86715667238e585b942ecf5d1186e550c6d00865c0e7b000ef17889bfd4bf439cf87779f3101b62015fc8020483df6c3cf80773245211004aae3b6736e49733595db88dbf1db5936998f25a0192ce0aa7b14cc66a386af7f7eca40dc8cce9f57a1987453b84a9a8d6bd4980af2fbd7acc512d32d8700b53f03903fdad4b7adcf70e55bc645422d891415e1d24eaae1eea8e18483e74824f3b082ed45ecca7f97c52ab626ebdadd82d6568b550df839ff17d0088668b64f17908d355ff702ebd709fbb8f5941f7fd2009702f2aff0b12b63a192b4982e56bf05ac69f9f4efd4fd8bedb92774d8ce3aa2e070bca28a060d1e1fb8190a97000047728250b6198c2da445201bd930ff8e49f3d31b88509f713481f0f719f951cdd8d55a564ea9716b6e6ad8d02a3a635d89f68222456f7d287dba70e573b5dacae2a84a166017f22ab641cbe5bd585a45fd3dbfe9ff7710a70b952236ea97ddfb9e223f03eabb8d0ddcc7adee76f735ccd06675e2874f21f935230ab22451daf8756395ad67b3d2dd679195999cbc5eba636e9cec5cbe03388c141cbbb94e5ccbf3abbd5fb7d92e8f445d1b0fc30a84982ceb4aa09874b989d7bc625cf203db6fdc0f0bb4c7e8c3248cd9c0fe32036142ff52276a14b03f439896155d4b916a25983de60e3fcd0efbc74abd142d4f3c3a8156aca4abe3a14e484c2ae8d2520b6f5fa20aacadb0db74eea4196342ccf5a3dfe1a31d536a3b1874af9c9c756dd1db5d29de134ed71ac25e89eb3eae6294a4ddabd47876efa49810cef19a2b2336a9173e6bed44f0513efc388943ea3eab21fd508fec4b3403239ab62cbb8d61451fea6d51cff1ff84971961fc46c542f271296e805189d00b54dee42d6dd626f725e45902722e7b88f181acc33bb4da71f0f4f584ddea5e76a25edfc3dabaadc1089e19e10a35cff3991315f00d971384f55a184cd78c9884a9a410c4be95738a03626dc8d66e37cb5b214c0f1aa68c914744751afdb09f9588375f0648ffe84265d33e2cfc22c180b029f45c5ba0781b7e3a790f34b921bcb7dc4ccda45c5142ecbc6e9b996f2a7a6679ff7316c2afd4e1c5eaf817a4e6b0f345f72b811a92e4863115419a1f3e4145142da430bcf43fd273601c8e0400037e64f03d836d05219a5146a4c9674bec3086c9f66572f95ed98a87fb0e784bfe6f5db45194daea3ef39480a14606d862a869bad105ec8cf08f13be89d91f9171b9180959163f1710cb4784c5cffbfa3b7abeb6b458a83983811b667b47e2aba406abf19136f08ea554983f0ce5f4dd882de429c4803315f3be455e02e0814677ff2e364bdba5740e23189a1c379319a5607152ff3ab6cb3f5b6ad8504f269031007f2bff346c818507abd92281b0837dfc19ccf9a3045da3a5d36f2b88ba25fa0dc445b016aafc440f2af8d8c60ee7b10014f75b91afe1ea6fd8070f340d28b45223db5b65199e1fb1f1d09ec000670b3ccc06f65e857bd5e3d85980554b5e82d9db2a8af0c2271ad80f596f5c5c13fbcbc821046bd3a93fa3f0fdeb50ac099a357db1b2c8b87e69bd7c9433a8be53bfed1476179460d08e1ed5389df4b041f1d75705574673bd684eb8f2d1d8b13a53cf4204480878d4bbed771cfc3bbe9f934b48b051e07bdee39abf8753bf3833e9a03e35357b759cb0a3a5272c5719f80123e310e552e27935de2c972df4e006de91612a7c101d98e6389298eca5079e6d84459ec0d561aef123b46d4a7ecbaf82b3ad4267b30edd727afc2fb70ddf2725dbdcdda7b351c56541bfb4796158aebe0d23b55248292ff29f2776d0645f92915510d9b6f10439e44cdda0dd7e6cd983d59e32f501f2aae563260bce4f5f95f0429bd34ef546c8e0a8220455a217cc0eabce38852b69dea554511e8d287d18cbd71796c661bd1696fb128c975a7b26701334f0c774788c5f2ea774abd88f6e4705e43ff831274457bf3416d3bc33f1870504fc36143bb290dbaed480d6d9b5b8b7bf7f87b50e9a6e0d341be56487abd01a153e16c4dadab86d22bb95cb0a37a347558fc91066b3904423466e32307ba06adeb515d1dfd208499cb6714d8551bff69bbb40bb272d642ebc5767e7a042182c3afaf6680fe42f0c8a2fb52d2a6fb52da43f795741b4320aba0914acea68540a05a15ddac94484aa9fc295fba8cfaeec436e90f8bd37520a3a44ad637e05f303a710136cbd44954f242df0040f9ed902019d66618378b1913d498d7fd2dd920a0f95765352e96db3174d8d10c811dad3f17e4e3028adeed04d2ae59b102f18e0cf73287543a7856f0321c1a4832f7894ee8f56e013983d50ff4634ab3f9aab140bda9e7eacfc282f18b46c1f1bb5cb622f8fedf93b568ba0341e30ddead48081d9c4ea5b5f4d3d5f0b1f6b916e21e14dcbc707cf42439734025663541fca24b7be6c242ae0f4d1657dc13a1e742152f87036fc888f4820c03b6e8e2287d92101fbe3c4b98fe31bdb4ab9922687338e61dd8cda7246f27fef94deefed611410f362d9bbeef4f157d732e6612ea5ec8c381aeaf34053fe23b042ccb6750186610f17c07fae90a36fe4a226e9b402eb8938a167e5741aae6849bc6facbbb3915187456851753ff5f3aec0f5566da6f8b96ee7b649c719b72b2d6891aee5be861ffd8843c6775f1a4d16461d8f442ea28429b986652daf28f46210e0a02d7d070517c6e491498bf8fc645cce95944030dd46e75ad0e5468da44a346e5783eb29619a9ab5ba56d8e1aaddbfc247aef5b5ac9817a026a771f6494feca27ae7b7df34153e923c7f5ba1723fa8ad2ef2c367d009f7b79e4b6f37b3067c507e6e10fb2656f5a64b383b1f23ce95bc4468d74090e0818299d253fef14ff62f1d19d2574da3a0f450b44dff60a1aa2aaafa24045b65832ce921a184367a1da01991aa45566aed2fbbd3125b48bf67b31a3cc7c17dfcca587ba7dcf4d22b3c0a0e8af71b18c33398cff4594abbf379719dd62b68bef6c6bebf92297200adb8d5a141d5fb02be104591120c9d62caeffd8c56b56d73636c193c83afb225875af4800d4a"}, &(0x7f0000001340)=0xffa) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x101002, 0x0) write(r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f0000000140)='GPL\x00', 0x1}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8=r2, @ANYRES64=r0], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[], 0x10) sendto$inet6(r6, 0x0, 0x0, 0x24004090, 0x0, 0x0) landlock_restrict_self(r5, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) 2m31.779464622s ago: executing program 34 (id=2045): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x57da, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x17}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f00000001c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r3, 0xc008551a, &(0x7f00000003c0)={0x6, 0xc, [0xa1, 0xa4f2, 0x6]}) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000440)={0x25b, 0x10000, {0xffffffffffffffff}, {0xee01}, 0x0, 0x8}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@mcast1, 0x4e20, 0x9, 0x4e24, 0x2, 0x2, 0x0, 0xa0, 0x4, 0x0, r6}, {0x3d46, 0x4, 0xfffffffffffffff7, 0x6, 0x80, 0x1, 0x98e, 0x5}, {0x8, 0xfffffffffffffff9, 0x0, 0x3}, 0x2, 0x0, 0x1}, {{@in6=@remote, 0x4d6, 0x32}, 0xa, @in6=@private2, 0x3503, 0x0, 0x2, 0x5, 0xfae, 0x101, 0xc}}, 0xe4) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) 2m31.725909214s ago: executing program 3 (id=2089): ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, 0x0) r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x2000802, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000feffffff00000000000000008500000041000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010400000850000007200000095303b31bc47ecc245f97a8ab5270f177953e8b3e49db23c40383b48711474ec4ec82abd037396ab831e60cc7b3e8e5abf1546ba83a9b8556df64b49"], &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x94) socket(0xa, 0x3, 0xff) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') preadv(r1, &(0x7f0000003380)=[{&(0x7f00000020c0)=""/168, 0xa8}], 0x1, 0x7, 0x10002) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x4c, 0x0, &(0x7f0000000440)="e2cdde7bb77ffec185b37684b6b565988a4b613c313add90f5103e15764698cc9fd86b72441d37620612a818c8f15935502e5258bd4524e383598a78056420d7883b5c36e623aa62fdfad39e", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) mlock(&(0x7f0000ffe000/0x1000)=nil, 0xffffffffdf001fff) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x40800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000400)={0x1, 0x0, [{0x2, 0x4, 0x0, 0x0, @sint={0x6, 0x12}}]}) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0x7ffffffffffffffc, &(0x7f0000000100)=0x2) capset(&(0x7f0000019180)={0x19980330, 0xffffffffffffffff}, &(0x7f00000191c0)={0x5, 0x200003, 0x200bc2, 0x4, 0x3, 0xfffffffa}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) modify_ldt$read(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f00000001c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r5 = syz_open_dev$cec(&(0x7f00000000c0), 0xffffffffffffffff, 0xa2243) ioctl$CEC_TRANSMIT(r5, 0xc0386105, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f0000000140)={'\x00', 0x800b, 0x15, 0x0, 0x3, 0x3000006, "550000001000", "1575a859", '\x00', '}]6O', ["aabe8459c62224475793e8a7", "000400000000000000000040", "d400", '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ']}) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 2m28.524222842s ago: executing program 3 (id=2097): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x801, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r2, 0xc008ae09, &(0x7f0000000000)={0x3, 0x0, [{0x0, 0x5, 0x0, 0xd, 0x6, 0x0, 0x9}, {0x80000000, 0xffffffff, 0x4, 0x2d, 0x3, 0x40007, 0x1000}, {0x40000001, 0x0, 0x4, 0x10101, 0x6, 0x3, 0x8}]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x80000001}]}}}]}]}], {0x14}}, 0x78}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) sendto$inet(r4, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @random="3747e76de379", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x60}}}}}}, 0x0) 2m27.685079304s ago: executing program 3 (id=2101): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_open_dev$midi(&(0x7f0000000080), 0x3, 0x8ac02) syz_usb_disconnect(r0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x100}, 0x0) select(0x46, 0x0, 0x0, &(0x7f0000000400)={0xfefdffffffffffff, 0x1, 0x2, 0x2, 0x0, 0x0, 0x64000000}, &(0x7f0000000440)={0x0, 0x2710}) 2m25.215220746s ago: executing program 3 (id=2106): openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) clock_gettime(0x4, &(0x7f0000000000)) clock_gettime(0x1, &(0x7f0000000100)) r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000180)=[{0x5, 0x4000, 0x1, &(0x7f0000000100)="9a"}], 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) connect$bt_rfcomm(r2, &(0x7f0000000080)={0x1f, @none, 0x6}, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904000002ffffff00070581020002000705020200"], 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d4ee0620cf10618012b70102030109022d00010000100009040600024f1ce800090502020002020000090582020002"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r2, 0x29, 0x37, &(0x7f00000000c0)=ANY=[@ANYBLOB="00060000000000000720000000030663080013000000000000000300000000000000220b0000000000af7a06eb20600aa7000000000000000000000104010400"], 0x40) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 2m19.513556137s ago: executing program 3 (id=2128): r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4024587b, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4600}, 0x24044800) sync() bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x3, '\x00', 0x0, 0x0}, 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f0000000400000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfbfffffd, 0x0, 0x0, 0x0, 0x7fc}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0xc, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r3, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) sync() listen(0xffffffffffffffff, 0x0) 2m4.005221299s ago: executing program 35 (id=2128): r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4024587b, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4600}, 0x24044800) sync() bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x3, '\x00', 0x0, 0x0}, 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f0000000400000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfbfffffd, 0x0, 0x0, 0x0, 0x7fc}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0xc, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r3, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) sync() listen(0xffffffffffffffff, 0x0) 1m56.814542534s ago: executing program 5 (id=2188): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1fe) syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) (async) syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000002c0), 0x1040, 0x0) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40043d0d, 0x0) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f0000000000)={0xfff, 0x0, 0x3, 0x5, 0x4}) r5 = io_uring_setup(0x1789, &(0x7f00000001c0)={0x0, 0x400052c1, 0x100, 0xfffffffa, 0xc}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0xfffffffffffffff9, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x800000000004, 0x0, 0x1, 0xfffffffffffffffd, 0xffffffffffffffff}, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090509a9143c27c70ce6125797e7a869c6d70443c03e53b5abd92c5080e1b2d865abd506"], 0x0) close_range(r5, 0xffffffffffffffff, 0x0) (async) close_range(r5, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xf8d, 0x1, 0x7, 0x98c, 0x9, 0x7, 0x3, 0xe99}, &(0x7f00000001c0)={0x0, 0x5, 0x80, 0x7, 0x2, 0x4, 0xc4c, 0xffffffffffffffff}, &(0x7f0000000280)={0x4, 0x161f, 0x401, 0xfff, 0x8001, 0xe5b, 0x401, 0x6}, &(0x7f00000002c0)={0x0, 0x3938700}, &(0x7f0000002380)={&(0x7f0000002340)={[0x6]}, 0x8}) (async) pselect6(0x40, &(0x7f00000000c0)={0xf8d, 0x1, 0x7, 0x98c, 0x9, 0x7, 0x3, 0xe99}, &(0x7f00000001c0)={0x0, 0x5, 0x80, 0x7, 0x2, 0x4, 0xc4c, 0xffffffffffffffff}, &(0x7f0000000280)={0x4, 0x161f, 0x401, 0xfff, 0x8001, 0xe5b, 0x401, 0x6}, &(0x7f00000002c0)={0x0, 0x3938700}, &(0x7f0000002380)={&(0x7f0000002340)={[0x6]}, 0x8}) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) (async) r8 = fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000300)='5\xfd\x04\xc6\xc9]\v\xd6S9q\x0f#\x93\x9d\xeb\x00\xcf\xb2~9*\xa9\x1d:\x06u46N\xd93\xe1\xa2\x05\x83Z\xbc\xbeT\x16\xab\xfb=4\xa6\x10,\"\xee\xf8o+\x02\xd8\xaft_\r\x1d\"\xc8\\k\xcc4\x96\xdb\xb0\xadA\x02[\x16\xb4\xca\xa5n\x87\xdb\xb3\x1f\xbb\xc0\x9f\xc2\x9e\t[\xba\x9e\xfd\xc76#\x8f\xc6\xe7\x11\x8fL\xd970x0}, 0x0) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r6, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r7, r5, 0x0, r5}, 0x5) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) ioctl$sock_bt_hci(r8, 0x400448e4, &(0x7f0000001540)="ce69c2e0228d40bb0ffdafa7fadc59763c8e2427575d284de216290a3f8ac4b88b4bd87d10214a77dc5363e34c348efab1feff2eeb696b130a29a9dfb6230915531a1e77293775ccfa24eb8313d4d1b5318089d3394ec24bdd4fa16d0f81060fc1616515b6024603a7a44f640605a08702fa536e781d37eb00b6839bb4184f1e21000aafb45f30a4203ce7466cf71c99900f008806dcdc982c48767e23317304064474feff8c06d053bb911e8459cdbcbb3ccb85d281fba6be34c581209415e6ca6f0ba589de2d8ea5264072a8647df8a1ac1dd6a4d35a995fb2eac3e8322f80cb3b91c9001227d7ec3f0c") ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000340)=0xd) 1m54.436068629s ago: executing program 5 (id=2194): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024001000000080001400000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x50}, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000240)={@hyper}) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000240)={@hyper}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c0017"], 0x38}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c0017"], 0x38}}, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0xc, 0x0, 0x5e, 0xfffffffffffffff9}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r1, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0x26, 0x3, 0x69c9, 0x4, 0xf3d, 0x385a2d2f, 0x4, 0x100000000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)='au', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x4044044) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x4044044) openat(0xffffffffffffff9c, 0x0, 0x40040, 0x0) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prlimit64(0x0, 0x4, &(0x7f0000000140)={0x9, 0x88}, 0x0) (async) prlimit64(0x0, 0x4, &(0x7f0000000140)={0x9, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() (async) r5 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r6 = syz_io_uring_setup(0x760a, &(0x7f0000000040)={0x0, 0x74d3, 0x400, 0x0, 0x24a}, &(0x7f00000000c0), &(0x7f0000000000), &(0x7f0000000100)) io_uring_register$IORING_REGISTER_BUFFERS2(r6, 0xf, &(0x7f0000001580)={0xf2, 0x1, 0x0, 0x0, &(0x7f0000000200)}, 0x20) (async) io_uring_register$IORING_REGISTER_BUFFERS2(r6, 0xf, &(0x7f0000001580)={0xf2, 0x1, 0x0, 0x0, &(0x7f0000000200)}, 0x20) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)) sched_setscheduler(r5, 0x2, &(0x7f0000000480)=0x7) 1m51.56148236s ago: executing program 5 (id=2203): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f00000002c0)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @void}}}]}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) socket$inet(0x2, 0x2, 0x1) (async) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) (async) r2 = dup(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) (async) mount$fuse(0x0, &(0x7f0000000040)='./cgroup.cpu/memory.force_empty\x00', &(0x7f00000000c0), 0x80000, 0x0) (async) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r1, @ANYBLOB="5d580000000000001c001a8018000a8014000700fc0100000080000000000000000000001400030073697430000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x80a0}, 0x0) (async) r5 = openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/fail_io_timeout/times\x00', 0x1, 0x0) writev(r5, 0x0, 0x0) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) (async) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) (async) r6 = dup(0xffffffffffffffff) ioctl$PTP_EXTTS_REQUEST2(r6, 0x40603d07, &(0x7f0000000000)={0xfffffffe, 0xc}) 1m51.178153965s ago: executing program 5 (id=2208): syz_open_dev$video4linux(&(0x7f00000000c0), 0x3, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0xfffffffd, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4007, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x1, {0x0, 0x0, 0x0, '\x00', 0x0}}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x8, 0x4, 0x2, 0x8}]}) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r5 = fcntl$dupfd(r3, 0x406, r4) lseek(r4, 0x4, 0x1) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f00000001c0)=@urb_type_iso={0x0, {0x8, 0x1}, 0x4, 0x0, &(0x7f0000000100), 0x0, 0x40, 0x0, 0xf, 0x6, 0x80, 0x0, [{0x4, 0x4, 0x2}, {0x7f, 0xd, 0x8}, {0x8, 0x9, 0x2}, {0xc, 0x1, 0x4}, {0x8, 0x101, 0x3}, {0xb, 0x7ff, 0xabf}, {0x1, 0x5, 0x4}, {0x7, 0x13d, 0x3}, {0x5, 0x1, 0x6}, {0x5, 0x8735, 0x5}, {0x2, 0x8, 0x7}, {0x5, 0x1, 0x9c9}, {0xffffffff, 0x8, 0x8001}, {0x1, 0x8001, 0x5}, {0x3, 0xefe, 0x4}]}) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, 0x0) r6 = syz_open_procfs$namespace(0x0, 0x0) ioctl$NS_GET_PARENT(r6, 0x8004b708, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0xffffffff, 0x6361, 0x7, 0xfffffffd, 0x40000004}}}}]}, 0x4c}}, 0x20000804) close(r8) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r14) r15 = socket$unix(0x1, 0x1, 0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r16, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r17, {}, {0x2, 0xb}, {0xb, 0xb}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x0, 0x2, {0x4, 0x1, 0xfffffffa}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) 1m36.098941311s ago: executing program 36 (id=2208): syz_open_dev$video4linux(&(0x7f00000000c0), 0x3, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0xfffffffd, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4007, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x1, {0x0, 0x0, 0x0, '\x00', 0x0}}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x8, 0x4, 0x2, 0x8}]}) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r5 = fcntl$dupfd(r3, 0x406, r4) lseek(r4, 0x4, 0x1) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f00000001c0)=@urb_type_iso={0x0, {0x8, 0x1}, 0x4, 0x0, &(0x7f0000000100), 0x0, 0x40, 0x0, 0xf, 0x6, 0x80, 0x0, [{0x4, 0x4, 0x2}, {0x7f, 0xd, 0x8}, {0x8, 0x9, 0x2}, {0xc, 0x1, 0x4}, {0x8, 0x101, 0x3}, {0xb, 0x7ff, 0xabf}, {0x1, 0x5, 0x4}, {0x7, 0x13d, 0x3}, {0x5, 0x1, 0x6}, {0x5, 0x8735, 0x5}, {0x2, 0x8, 0x7}, {0x5, 0x1, 0x9c9}, {0xffffffff, 0x8, 0x8001}, {0x1, 0x8001, 0x5}, {0x3, 0xefe, 0x4}]}) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, 0x0) r6 = syz_open_procfs$namespace(0x0, 0x0) ioctl$NS_GET_PARENT(r6, 0x8004b708, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0xffffffff, 0x6361, 0x7, 0xfffffffd, 0x40000004}}}}]}, 0x4c}}, 0x20000804) close(r8) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r14) r15 = socket$unix(0x1, 0x1, 0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r16, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r17, {}, {0x2, 0xb}, {0xb, 0xb}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x0, 0x2, {0x4, 0x1, 0xfffffffa}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) 4.852004234s ago: executing program 9 (id=2621): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ec00", @ANYRES16=0x0, @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x810}, 0x0) 4.666908089s ago: executing program 4 (id=2624): syz_open_procfs(0x0, &(0x7f0000000140)='maps\x00') write(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, 0x0) timer_create(0x7, 0xffffffffffffffff, &(0x7f0000000100)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c9, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000000004007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002200)={r3, 0x0, 0xe, 0x0, &(0x7f0000000000)="0011223344550011223344560800", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x800, 0x122) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="f31fbd0d660f2a630066b8000000000f23d80f21f86635000000000f23f8b80d008ed82e667c75f364b646660fc735b800008ee866b9ff03000066ba000000000f3066b9bb0800000f32", 0x4a}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000005700)=@vmx={0x100, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xfffffffffffffffe}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0xffffffffffffffc3) ioctl$KVM_RUN(r7, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 4.623573451s ago: executing program 9 (id=2625): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000300000000000200000000000006000000000c00090008"], 0x38}}, 0x0) 4.374590111s ago: executing program 9 (id=2627): syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x100) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000480)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000007000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r2, 0x18000000000002a0, 0x48, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e09900", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x0, 0x300) r6 = inotify_init1(0x0) inotify_add_watch(r6, 0x0, 0x40001a2) r7 = open(&(0x7f0000000580)='./file1\x00', 0x200ac3, 0x1df2a23c5997fa5f) sendfile(r5, r7, &(0x7f0000000100)=0x6, 0x8113) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000040)) readv(r9, &(0x7f0000000100)=[{&(0x7f0000000000)=""/31, 0x1f}], 0x1) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000240)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r8}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.916974637s ago: executing program 4 (id=2629): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000040)={0xbc, "70122a314ecdc0dbc988f5c8799ba14f4867cc02e61c1c00a01c18a03c5bd004"}) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x400000) read$snddsp(r1, &(0x7f00000000c0)=""/125, 0x7d) ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f0000000140)) ioctl$SNDRV_PCM_IOCTL_PAUSE(r1, 0x40044145, &(0x7f0000000180)=0x5) r2 = syz_open_dev$dvb_frontend(&(0x7f00000001c0), 0x7, 0x4000) ioctl$FE_SET_VOLTAGE(r2, 0x6f43, &(0x7f0000000200)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000240)) ioctl$SNDRV_PCM_IOCTL_DROP(r1, 0x4143, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r3 = syz_open_dev$dvb_dvr(&(0x7f00000002c0), 0xe60a, 0x80) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(r3, 0xc00c6f3e, &(0x7f0000000340)={0x1ff, 0x80000, r4}) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000380)=0x1) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r1, 0x8010671f, &(0x7f0000000480)={&(0x7f00000003c0)=""/149, 0x95}) r6 = socket$rds(0x15, 0x5, 0x0) syz_clone(0xd000800, &(0x7f00000004c0)="74c995eb5299e4e54d4139b04af99fb7fb8a2b50d2e7143dd2ba6484d5f978ee60736735756be8c2f87d8400014cf67fe2038e00b88de6e31b55412a3e76ca4c586952c4e0bc5cf63cf7b11d02934c634f9abc08a8aa5736441408dc5cc8fe1da1a0c9a28e491ddba6bc861b4ee3458178daed6302700e2908ab7317a039043bf231384d8bf54f73f8523308f3763a8e7489fefe2a82c69708bdb7d7f5291db9067287631a7ba0adf616f5828ebf19787d6ee9d147d6a54189610c34b57cef611381214536a8809c9a7cbcfd679e3349", 0xd0, &(0x7f00000005c0), &(0x7f0000000600), &(0x7f0000000640)="7b473a58cc371017edcb8e705356bbfe1137c6b9a1e994f1440a004461505998e2621407c45139cf91b5e5fca224dba69ddbc8e04ddc444354e21312d539e9e1bb068e932af6c0ca4aa43c75a0f9d0cac4e2f0e147608c4ceead6cf8b028453f4ae4ced05dbb1a654a39ceb45bca74a8945c8d9d20f0529fb3e7900ccf42eb6cb0a0c067a4414eb214ff3d4f1efac1b8db8f953fe2c0") r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000740), r5) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r5, 0xc018937a, &(0x7f0000000780)={{0x1, 0x1, 0x18, r6, {0x8000}}, './file0\x00'}) sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x54, r7, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010101}, @GTPA_PEER_ADDR6={0x14, 0xb, @mcast1}, @GTPA_PEER_ADDR6={0x14, 0xb, @private1}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x40) r9 = openat$panthor(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) ioctl$DRM_IOCTL_GET_CAP(r9, 0xc010640c, &(0x7f0000000900)={0x9}) sendmsg$AUDIT_LIST_RULES(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x60010000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x10, 0x3f5, 0x400, 0x70bd27, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a40), r5) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x7ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a80)='./cgroup.net/syz1\x00', 0x200002, 0x0) ioctl$XFS_IOC_FSGETXATTRA(r10, 0x801c582d, &(0x7f0000000ac0)) io_uring_enter(r5, 0x2b5b, 0x538c, 0xa, &(0x7f0000000b00)={[0xd]}, 0x8) syz_usb_disconnect(0xffffffffffffffff) 3.217716519s ago: executing program 9 (id=2630): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000280)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406301, {0x3, 0x0, 0x0, 0x0, 0xf000, 0x0, 0x0, 0xf0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 3.098198216s ago: executing program 9 (id=2632): r0 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000080)={0x0, 0x4, 0x7}) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f00000000c0)={0x2, 0x0, @pic={0x0, 0x7, 0x1, 0xf, 0x3, 0x5, 0x5, 0x31, 0x6, 0x1, 0x1, 0x9, 0x1, 0xa0, 0xa, 0x1}}) 3.006915751s ago: executing program 9 (id=2633): ptrace(0x10, 0x0) (async) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x20c03, 0x0) r1 = syz_usb_connect(0x3, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xc38, &(0x7f00000020c0)=ANY=[@ANYBLOB="7c2f0aec9d222ea5ee20e6b25cf191669d6293d87d67cbc22a8dca55b40c545d1439d9ab278a279afd807e25e3c9aacca664836fec718e063c9b06cd66442b6407fec5c3e5cd9d0f1001c90a801c4fadce8e13a5e0209edf5c5693acccefa24d4f5a2ef062e701d054d19e9e6340a1651e05fd87b70942c679234426f9b19c0723563d0e38ec970aec02a6154ab61081aae03050d00192bd9d59977bb2f1297a7cd0571a0dfc5688a8e3d5f4a226b7e397b43c186967c74821bc70005059ab5606c70045a6a9915285c8215b9abd839f50530dde8ad500d70d8f7c1a0093293e6d632f8e8939f3199ab4ec92caed14c26975b57578c8ea666a2e4253ca9516f3c07bdc5ad27c2ff29e1569795f9dfbd1b92919432e423ff4f9a35b77419d6a8540fc9431ca78e05e278bef5a21b1423a3c9f7c1e2bd16a1ecdfde51cfa4aef38e6afb92770bcefb5fcb277ccede1ddc8647db538661b3d10effa1b6f705ef1b74e5bea20b4f98421b7b4be4c5c6be101f5503a4ecaffae335ef565920d678ed5b41031122b21f9d9b7f270b95f94624a7ddc657c83d3722a8d01f321fd7f685fc74d61a4e1914dda6df4be639c4910c56a84c24a41b9ef07eee4083dd9a30a53a58b50186c12180da4186fe5845b6b325fd112378a82d53bee449bc9d4c2d4331a1323c69c99c778560fc2142d138b23000c5403156cd8223f07a73811ab5b81e287bd6ad95c2fefce002ac77a1ac74d5e868870f29277da69987652b0055b3072efab2fe56fe0fe287f7d51aa772b2e3ae77954a938be2792442e1ab2e6fc078d821c70222142568b6db9609f1db23e8a4a460b9fbbeb48469e6bf0acffd85af86e69535a95c02c30d5ad776002c48e19e134688780bbafaf81097358b0c8f63bcefb61d8f29aacb3dc1a485bb7343539387f1e83b9283674bdc0d7fe8bf86948439f4b4a20e2832c560c743e4c2d37eddbf341c47f71a93101a08a533e96601f98752531428944d88c836c7d7a082859a3120721afd99130e83f689720638e889ddf4a23228dc23e955ae67fe5447e134b63f4c72e5664d2ed8a7406568e08f3582661006cf5800615fc4a5ec88ef3361ea027d2a1a550ac3e017a212570cd145fcc2e1984e4fca28bf4110f33a5ac847fcd3605e546ee8ea49a7de5d4b599926a76028e9d5259db7fd6f908c7a8657d42f895380c88ac85cdc183f6b61172b966a41888ceae895eaf18cb8da8d1918411b297959a8abacf8c4cee15ca87048aae13ffe068dee23a9edc2b259aeb0595b7ed2633431067a999f915934aef1be5f360f0db726f24e8eb89adb8db535de6fd7c06678831d17e47c67cd22f047b92d8fba83a49a1285def4dfdf634408cb05ae73f24df76e7393d1e90d40c50bd388bb53e281b889084a1a19efdfa6be16aed1a621d964c1ac332b65765e7440ccc75ef44851409c458905127bd161bf98cb6a3681af073e3650f52d5ee691c347e86360c3aebae4a691b2485d68c57d09e269656b1efbfd3413d54c8d3e467c0bfa84669d0cc5e9cfd50b9c79171f8b6a5e66e8c6f66c0916083b8e8a464498aed3badd2f267fb56adb0953b9ebd0370f941d796abffa81722d502c8d1e9d844802f4197067598b2394dddf76641f9c2ec0403bd379e8f712668b98e1121a27888b227104875999cd562fa9833458879652bfeffabc6bbb5c354dc36ad91354ccb5050d69b28b562a72bbf277f96bd1d5dc6408329f6f850a96762a6aebf2a7b5bacbbc032be8b29c453867a47094289f6b8aa38f85051fc4d4478a02af664b3250a396583001a7971cfa6f5a4931e32e7bfb7b4c3f7be3bc5f91ba46554773b9102dbd4aba4344c6fe87bd050f79175d7918d57bc137cde33a884bba63a1adf6e7e71ba783eb1fe689b23d3ad18627b0b229c0d982631308a88c4bf1e2079eb0fcc486ef864e7c6a75cce17b133577fa88d62807398b8a795ae2bb7610f8b17cfc56ff11b8ffc4aa316e612fc76955dc44e66467c4d632657d4cac3cc1bda8c2c6207915a89f76bf1fd61c156ba8720bb8048601cd1221f6996e6f04e44b842e00a4487cd59501a65db1f6ade7f22ba5d7ee8e67125e284eef41ad5f2069a48cc71c621eb08d832ef8592874199c5c03249d3ee03422535c2be6919c43724277d56a885ab67753ae8d7f1317b7e534bb1a111a0edb5d298c1374c7824a80fb00ae268f2fd641f1b2a12f712d9a5e027957941ffb4218c6d8a8e7950dca0b4c9018dcfb67244a30080d54781b5111c85cd89e08f51c55975301ff389baf2242ef0fb662122a2eb89c1dcaf82d6391906a1b235635e6c484cd5fa32bc80ce68d505df9a9c6b21e222c3b9330243b8e02a3e661c20e0da633d88f7debaf6643654050ab73613dbea6176109b5c35c4d280739aee77f81a1b58efa9e606259f45745b69523bc81828cfcfffd185ad51b4b183b7a1ef86757172ef67a4f153b7c3a3e99f15ef5b09d81cd1ccec8016ecc9864ccf2efdbf7a79ff9ba814a4a9e3124d735a591c649cdefa98bd569c5f4db18a537c55544c671d398ec50d9fc2b1ca1f9b0278acc9a21779c3815fcb0ee1c66c774b6591e8f6b5c9828db8a5d104213cd4513974be404a50c11009c15a1e2aaa81abc6c706c341f145f975717819c4429007ee648f6c3fca45d714981cd9240beea8b02a19e0ddb083dc8115d64d75ab087c87e00792b8b83551ca82b311444067923656b0e70015ca4775da3d5e984ea8af20955f92d9cbd9acca8cd258df4276a118505d440b74e93bd0b97caeb0e24dbb09e7dbdfe0c3b4bdc0983a7d1eee02bee9c5d381bfbd7dfbb6329539698477f3a8bc7f82c01588d679a167e91487f150e5923cbf3030f09c8fb89cf178f5e953618887b7e56afdfd6a6b5e3003cecdbcba76ed86bc48907fada5e0178f9194970323ae9c818215ae2feb1ee56b289d83e8e9d2ab27056ede5651d2a92a93dd3d6c519ac128a44f1414f93e96c55485a73f3cb7e4750d0f2a2acef87e46a7012a30712f7cfe2ac9372af0efcb6475e3a1a8db1961040002915038412b892eee569aae8f38fb07c27aef5bbab7750a244a7c3b0193004246afa1a72368db45cd3649a89b54e880ea12c92beb59e366d7893f725bb8080aebcd35857ff686d03eddc33af248cecc5198bda6f395b55294821f6853232cb5bde67a4166a35224cd9c5b54e6b5a38376b1fdfaeb7563a8ea93148997e2bf490c67916f059e3e1992a986f96d2720a6418cf8c57d6e72eb90d7ca59a3a20fd414e404900aa4a45f381ff7828e15558b4862055bf795c9134836878999200e71e9ba9f83a2e28955c7b37244f3abc8f9d15a5e6c3d9b2f76620b3b2bcb13c0c44c63b9bddd51e339aedfc3a4d995df0eca66c6891ca9099923577e7cd84cb58cf0d6d6eda2baeb00775c4e717e31dbc881615d5f1a0898017954e882a444017e947b1fc05fdcf4495c5dbe3b7b4ce4c1535070fbc64d135df094fe4f6cdd452e7a5f844145af9b746dc5eecede9a834de1ff65525ea3017478ee08dc1bcff852a9d2ad94f46840bdcf1b6226fb0cdb620787692e52aae3b9b703f30b3ce6ca6dcaeb8b3a5884c30c570b29741c70ad99f5d7f463c7e5e1b4bbaafae33e789c0ae1114674732d50c0a799bfa6388365c392d47c3e0d2992a61d21e4ca034ed3d386fe959a94601a4007f1f2060b59359747635b076db7697ba5ad45af0423dbb9966113fa5eb59118cac394c2e2b17ebec1b7ce18ede120b1f56956b12a95de708e780ba7a1ac3a9e31267a2c195acfcb3b20c2f5d20de288846045211da53649a6d8b23008449b763fe6a58243cde95093a9755e5725307af09c997520f159f4ec7d1e687a0cf5148721062ecc6b080f65a550730da9257f1515a10830e29b85de3138a77ee8d2f0cb129c971417d7bbcd982d684b697364084c5764bafb4e2211a82e8c962eefb1f000ac8f5f2567b580931676943cea9b95977d842c247a98672b5c73594eb51f927ee5ec2b0c45eda29fb83a092880e542c60113ca653923aa0c16e2e1604e5f437876cb7fa7d1498584f8800ff80804d41c7b89e9cba341fed8d260a6abd0fc242ba6b3d624c91c468e269069d0a121f0951c3765f18693a2c547d9bc924058d0ecece5c7802126d293d3033d6bbf83d4b8b0144d27cbb985dba465d75b62a93bf7a438cce59f", @ANYRES64=r0]) bind$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @loopback}}, 0x1e) 2.889088728s ago: executing program 7 (id=2634): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x37, 0x107, 0xfffffff3, 0x25d7dbfe, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) (fail_nth: 8) 2.882750832s ago: executing program 7 (id=2635): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ec00", @ANYRES16=0x0, @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x810}, 0x0) 2.815335844s ago: executing program 7 (id=2636): ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0xfb6c805f00ddce0, 0xffffffffffffffff, 0x1}) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f0000000080)=@attr_riscv64=@attr_ctrl={0x0, 0x1, 0x1, &(0x7f0000000040)=0xb05c}) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000000)) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r1, 0xf501, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf7, 0x14b080) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r2, 0xc01064c7, &(0x7f00000002c0)={0x3, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0]}) 2.724585599s ago: executing program 7 (id=2637): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0xa8000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x5420, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) syz_usb_connect$uac1(0x5, 0x82, &(0x7f0000000400)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x582, 0x7d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x3, 0x1, 0x0, 0x48, 0xf3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x9, 0x4, 0x4, 0x3}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x6, 0x7}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x0, 0x3, 0x7f, {0x7, 0x25, 0x1, 0xc, 0x0, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x9, 0x6, 0x3, {0x7, 0x25, 0x1, 0x4, 0x9, 0xa4b8}}}}}}}}]}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r3, &(0x7f0000000180)=[{0x1, 0x4, 0xb, 0xfe, @tick=0xffff, {0x2, 0x8}, {0x4, 0xff}, @raw32={[0x0, 0x3, 0x100]}}, {0x3, 0x81, 0xb, 0x18, @time={0xd1d4, 0xa2}, {0xd5, 0x3}, {0xff, 0x7}, @control={0x6, 0x2, 0x4}}, {0x9, 0xba, 0xfc, 0xe, @time={0x9, 0x1de4}, {0x4, 0x6}, {0x9, 0x3}, @ext={0x8e, &(0x7f0000000240)="ef0ec4002d716344898494a105bb8a1a2ccd295396c68a4a954df7e8accac06436164265ed8f7202ef35a54cba9646d219b59be5a9feecf336876b85da6e9c11feb4d1758bab0dc67fef0b5f7f649dd661940717b1617ee1784808be7c0fe6d14159f2494f75e5deaf8c39f93b88107791be0ffff6cba5f59722fc5bf922e67e2d4034f7c476c7ce3e5fa8131e26"}}, {0x7, 0xda, 0xa, 0x3, @time={0x8, 0xfffffffa}, {0x5, 0x40}, {0x9, 0x8}, @raw32={[0x401, 0x2, 0x800]}}, {0x4, 0x81, 0x92, 0x19, @time={0x5, 0xf}, {0x5, 0x2}, {0x4, 0x9}, @addr={0x0, 0x7}}], 0x8c) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xe) r5 = dup(r4) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$pokeuser(0x6, r6, 0x380, 0x3) fcntl$setown(r5, 0x8, r6) read$FUSE(r5, 0x0, 0x600) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0x40084146, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904000006ff000000070581024000000705010240"], 0x0) mkdir(&(0x7f00000000c0)='mnt\x00', 0x10d) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) munmap$IORING_OFF_CQ_RING(r0, 0xea08) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000080)='team0\x00', 0x10) ioctl$TCSETSF2(r7, 0x402c542d, 0x0) unshare(0x2000000) file_setattr(r5, &(0x7f0000000100)='mnt\x00', &(0x7f0000000140)={0x8080, 0x9, 0x24000, 0x4, 0x8}, 0x18, 0x100) 2.281265711s ago: executing program 4 (id=2643): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYRES8=r0, @ANYRESDEC=r0, @ANYRES32=0x0], 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x2000c000) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f0000000540)={{0xfffff586, 0x7}, 0x8c, './file0\x00'}) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='uid_map\x00') r2 = socket(0x1, 0x80805, 0x0) (async) r3 = socket$inet_sctp(0x2, 0xe994567d22b3e3ef, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x40003, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @dev={0xac, 0x14, 0x14, 0x2c}, 0x4e22, 0x3, 'lc\x00', 0x4, 0x8, 0x76}, {@rand_addr=0x64010100, 0x4e20, 0x2, 0xcd, 0x9}}, 0x44) (async) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) (async) r4 = socket(0x2, 0x80805, 0x0) (async) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @local, 0x0, 0x3, 'lc\x00', 0x1, 0x6, 0x1b}, 0x2c) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x62, @remote, 0x4e21, 0x4, 'lc\x00', 0x5, 0x0, 0x800077}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) r6 = socket$unix(0x1, 0x5, 0x0) bind$unix(r6, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e21}, 0x6e) (async) listen(r6, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYRES16=r7], 0x4c}, 0x1, 0x0, 0x0, 0x40480cc}, 0x40000) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) unshare(0x64020b00) (async) syz_usb_connect$uac2(0x0, 0x8e, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000081e0400304000010203010902"], 0x0) r8 = dup(0xffffffffffffffff) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in={{0x2, 0x5e22, @private=0xa010102}}, 0x1000004, 0xfffe, 0xf06, 0x8, 0xe6, 0x7d, 0x5}, 0x9c) (async) write$9p(r8, &(0x7f0000000500)="c6", 0x1) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f00000002c0)=0xa6) (async) socket$inet_smc(0x2b, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x11010d0, &(0x7f0000000100)={[{@index_off, 0x3a}], [], 0x2f}) 2.270530342s ago: executing program 6 (id=2644): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x5, 0x0, 0x6}}}}}}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000003c0)={@local, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0xf5, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xffffa888}]}}}}}}}, 0x0) 2.208915307s ago: executing program 4 (id=2646): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ec0000", @ANYRES16=0x0, @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x810}, 0x0) 2.185633965s ago: executing program 6 (id=2647): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x900, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xb4}}, 0x0) 2.128559458s ago: executing program 4 (id=2649): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f0000000000)="5a6f839106e06634abb8ad8b01367b6626b8a38477333e033025ce3b0ab30d38df1541827b0817b675bf", 0x2a) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0xc8df, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7}, 0x1c) (async) r2 = syz_open_dev$usbmon(&(0x7f0000000080), 0x2, 0x101000) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x100}) (async) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84880) write$P9_RSYMLINK(r3, &(0x7f0000000180)={0x14, 0x11, 0x1, {0x4, 0x4, 0x7}}, 0x14) r4 = pidfd_getfd(0xffffffffffffffff, r2, 0x0) (async, rerun: 64) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) (rerun: 64) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000280)={r4, r5}, 0xc) r6 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$AUTOFS_IOC_CATATONIC(r6, 0x9362, 0x0) (async) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r5) (async) sendmsg$nl_netfilter(r4, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)={0x1f8, 0x1, 0x2, 0x3, 0x70bd2b, 0x25dfdbfd, {0x1, 0x0, 0x9}, [@typed={0x5, 0x149, 0x0, 0x0, @str='\x00'}, @generic="60c01a65e5b47d834e4c98830b6561b07bf18e07b1d354bb7eb41c34d36c319dcc29cebcaab993a520cfcdb4c85963c22823a4aef0d1f418ad2a8b578695adafbe4219e7745e31fd60861057433713db547f9648e58917913d0fa63d84065ed9cf59b00cf73261f2236bdab8f1f9747d91da7d", @nested={0x148, 0x6a, 0x0, 0x1, [@generic="37c51baab3ab21702af55c582d8d833c073fa62708c6e0a521985f2ecbf50c7bddc30c0c108955364aeb0a305c7a01aea40d9eaf78e28d8f2b2924592f71cae79d75d678f9cf42cda50fdded381add549dac36bb9c65d9bcdb97ef446c25a9cba376e1a431fc927d2ffa354601871c50958a6963a7e43ab67f88cc9711257ebe682fb6d2f7c6346cb6661bdf8cc6d88ac6159c291466281cc1c3dd7be8f3b75b58c3b26a80dfbdb42f835a8c0fb614ff68d1ecd087ceafd4dd0693dd9be63e313b5b23afa43a6c791a6c24f6d4334ce1ec4990c0aab6f23c700927dea436c56099", @typed={0x8, 0x9f, 0x0, 0x0, @ipv4=@local}, @generic="98f26ebd284bfddce19b7730efce5a64f9edca07bcc7289f74621c5ccdb524eac71914187b03e45be389f899ae95e53865a3df9f3ebafc19c4edca2074c7f1e2515b5c67a5a8e6b8ae029807d10049f8c3c28163ca957f", @nested={0x4, 0xc8}]}, @nested={0x11, 0x166, 0x0, 0x1, [@generic="46f1d9a7fa73b5ce153653acde"]}, @typed={0xc, 0xf3, 0x0, 0x0, @u64=0x6}]}, 0x1f8}}, 0x40) (async) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f00000005c0)={0x5, &(0x7f0000000580)=[0x2, 0x2, 0x3, 0x7ff, 0x5]}) (async, rerun: 64) r7 = gettid() (rerun: 64) sched_setscheduler(r7, 0x6, &(0x7f0000000600)=0x8) ioctl$EVIOCSKEYCODE(r4, 0x40084504, &(0x7f0000000640)=[0x3, 0x2fa]) (async, rerun: 64) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, &(0x7f0000000840)={{r5, &(0x7f0000000680)='\xff\xff', 0x4c040, &(0x7f00000006c0)={@align=0x10001, {0x0, 0x960, 0xffffc27f, 0x6}}, 0x101, &(0x7f0000000700), &(0x7f0000000740)=0x6}, {[0x1, 0x400, 0x9, 0x7]}, 0x38c, 0xaa, &(0x7f0000000780)=""/170}) (rerun: 64) fstat(r8, &(0x7f00000008c0)) (async, rerun: 32) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000940)={0x0, 0x40, "5baa4931a67ecfed889a21dc9ca56cffb6081ab890fbdb8e4fd4b6ce38010042d09083dee55141bd8f765f4a095210ceabd4b1fa341fa59f769f8864e75890cc"}, &(0x7f00000009c0)=0x48) (rerun: 32) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x1f, &(0x7f0000000a00)={r9, @in6={{0xa, 0x4e23, 0x7, @local}}, 0x3b}, 0x90) (async, rerun: 32) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) (async, rerun: 32) ioctl$DRM_IOCTL_SET_MASTER(r4, 0x641e) (async, rerun: 64) r10 = fsmount(r8, 0x0, 0x2) (async, rerun: 64) pipe2(&(0x7f0000000ac0), 0x4000) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r10, 0xa, 0x1, 0x10001, &(0x7f0000000b00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000b40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000b80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000bc0)=[0x0]}, 0x40) writev(r10, &(0x7f0000001200)=[{&(0x7f0000000c40)="98f2f422eb3ad4e725ce12e1921403476ca237e9a312c14654e5c90d1e60be5d58d4eb9e70391f6dca9470134ebb1c0fd175660bf41b9f39ea25fbde6fd57b8cc09733309e61f79dcacfbef93b30454475815cfeefb9186fc1fc9243f52fe53f24dc83a69d66eeddbff9848fbc353f0c3822a6af10060abf", 0x78}, {&(0x7f0000000cc0)="a2f706f68bdadb25661982be62749755639bdf2c80a09ca67a6e8de05341353eabb95f67daf1d5abf206f4e7966129e951772f87b292f127b9188d19c5276dae6b432456fc0f3e49c4025d2f3b9debb195708b020a9457557d15fd8c64f478a41a292d854548ff3a0076048d997211fc6bcc969187d1cba8037587eacdbcafae7854818e5110259d15b33833ecd54e54e34eea84b3dde50b3900b6fc521b427df7da1333260e051c5cbd8b267493d4b8486ef713e1dc83b63b843aa593e1383f2bceebe9be7132ef673698e23c16db0390b75e75", 0xd4}, {&(0x7f0000000dc0)="9d359fe2a72671f165b93895d2c60897328c6ed9b1969326343a5350efb258c203c40247af1f833ec9721856571ca9de8ea6651921c34f850a63f2cbbdc4c3dcdb6837a9069c48c5d813f2123e", 0x4d}, {&(0x7f0000000e40)="ac7525433eda8761dbdd2158e8ccc2496678281fc3a159927056e4598d25f600d08d05165c3ab1896eebccb0da857c52fd0340e55941af090075e40c835986dad3d69430b29a3224c7c11ea3e31bba8f54c3d62f702694b97465675f3a63b26e9d38f31681c4f42da1fb2d972697a76ee12946e092269cdfff6477d0f0bbe00692be387737da08b44b81f66029dd400baf86d82a66a9e508a189a4b16b3d354c7cf3f064f1dc10126e1185fdea33bda0488e532955bcf26fd0c68174d70ec5c56f886f74c9ccf483d2f7ce3cdd3e694081d69e2f1f057c5d34539b11ae4886446073fd21b57ab4f451182d346628910fea83", 0xf2}, {&(0x7f0000000f40)="0be84a6479386d577d5bf70d7ac92f47d06c07bf14433757b4f8e6f09b2f3eb200d61aa5d00d07970da946f003de17fd829bdd212d8c2465c6479db0e19410d5e568852b65f2c23bb561a1b91686ff48ced9", 0x52}, {&(0x7f0000000fc0)="54118d23f62d5442637584f3d070cf8020857ed4f165825ab8bdc6d1507d0aec95ef11cc54da27b5c50ddca832a299e41f849436d6f033e387751b30124d756ff07ada85133684a8bbc5dc2b52adce75af7ba572dc7b0b258a66c3d8bbe1746d2036383d08de50f17ada32ae8cbe8bc392134ffa585bb5fbc787162a0a46521fb00527b4f3d1ff6f3e6bc6e50f717bad0b0163eb43859c3f61c5a4b3", 0x9c}, {&(0x7f0000001080)="a34aaff38bcb3d7fe5aea3b596b3f31f200316f3d75b8177201ba44169e7ecdb1bd8ae4028caf82cac5c7056b9c1d1c1f7aa15fe5f4c2b725f75e1d546270b55f821fdbaf0d0ac0af24b8e3780c0644f3a84e3410ea4d64316fab5d3256a73e81d30af87ff923c0af1c08c9c9094b21860af93881715a3a27a85a24f0c55ab4df1d90952411e57deaa7a7b5f1f63c1d4ef45221508cd25682dcc21478d31a08e6594fa0a1188", 0xa6}, {&(0x7f0000001140)="c8e1b7cb3912c3597c73d4605fe70c19d96d5f0e501a6eec1893975f01303fe154fb8c57912f47dccc5a99ebaba5164408fb9e26dc2db9b85ab9abf6693984fcdc5aadb20a0aabcaefa0c108bb868f37e77645cf995bf3710e34dfa3f6f30b7569c86f8abb7cbf4b54b6ec29d748306f4aa080c5", 0x74}, {&(0x7f00000011c0)="a51dee4ab0", 0x5}], 0x9) (async) ioctl$FIBMAP(r11, 0x1, &(0x7f00000012c0)=0x4) 2.036441257s ago: executing program 6 (id=2650): socket$nl_netfilter(0x10, 0x3, 0xc) get_robust_list(0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="70000500ffffffffffffaaaaaaaaaabb08004500452c00000000002f9078ac1e0001e0000001000065580018907804000000000000006a7d82c1efca3c83c34d97bd0186ddffff00000000"], 0xfdef) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x400203, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@gettaction={0x28, 0x32, 0x1, 0x72bd29, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='cdg', 0x3) write$binfmt_script(r2, &(0x7f0000000200), 0xfffffd9d) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a580000000c0a010100000000000000000a0000060900020073797a310000f5ba50a0a1b55dd0cc9d00000900010073797a31000000002c000380280000800400018020000b801c0001800b0001006f626a72656600000c000280080003400000000014000000110001000000"], 0x80}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) r4 = syz_io_uring_setup(0x80f00, &(0x7f0000000080)={0x0, 0x5078, 0x40000, 0x2, 0x0, 0x0, 0x0}, &(0x7f00000001c0), &(0x7f0000000340), &(0x7f0000000100)) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f0000000400)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}]}, 0x1}, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) io_uring_enter(r4, 0x1, 0x1, 0x5, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) write(r5, &(0x7f0000000040)='0', 0x1) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r6, &(0x7f0000000280)=ANY=[@ANYRESHEX], 0x10) write$9p(r6, &(0x7f0000000640)="d5428de519101516", 0x8) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r6, 0x0) 2.035910498s ago: executing program 4 (id=2651): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x64, 0x30, 0x30, 0x6c, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x39, 0x66, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x11}, 0x48, r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="020000000400000006000000450000000010"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000300000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x2000321, 0xe, 0x0, &(0x7f00000007c0)="63eced8e460100000001acf12a04", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x65, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233444d66778899aabbccddefff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011223344556677889c69bbccddeeff", 0x40}, 0x48, r1) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r1) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000780), 0xffffffffffffffff) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000900)={0x0, @empty, @remote}, &(0x7f0000000940)=0xc) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x68, r4, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @loopback}, @FOU_ATTR_IFINDEX={0x8, 0xb, r5}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}, @FOU_ATTR_PEER_V6={0x14, 0x9, @mcast2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @broadcast}]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x20000080) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x58425c31ab49816a, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x39, 0x56, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff001122334455667788990000ccddeeff0011223344556677a899aabbccddeeff00112233445566778899aabbccddeeff", 0x3c}, 0x48, r1) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, 0x0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x38, 0x31, 0x30, 0x64, 0x0, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3f}, 0x48, r1) keyctl$unlink(0x9, r0, r1) 1.781724558s ago: executing program 6 (id=2652): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000040780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}}, 0x0) 1.760788046s ago: executing program 6 (id=2653): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000040}, 0x4008811) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) userfaultfd(0x80000) writev(0xffffffffffffffff, 0x0, 0x0) r2 = openat$dsp1(0xffffffffffffff9c, 0x0, 0x18c81, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0xa6f81, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x24000085) r3 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r3, r3}, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f0000000340)='ntfs\x00', 0x3100040, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='proc/kallsyms\x00', 0x82002, 0x0) write(r4, &(0x7f0000000180), 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES32, @ANYRES16=r7, @ANYRES8=r2], 0x38}, 0x1, 0x0, 0x0, 0x20044090}, 0x1) sendmsg$TIPC_CMD_SHOW_PORTS(r5, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r7, 0x8, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40005) mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) lseek(r8, 0x186a0, 0x0) 797.11725ms ago: executing program 6 (id=2654): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000000)={0x7c, 0x3000, 0x0, r3}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f20c506200010102030109022000010100803209040000020806500007058102000200070502020002"], 0x0) syz_usb_ep_read(r4, 0x2, 0x1f, &(0x7f0000000200)=""/31) syz_usb_ep_write(r4, 0x81, 0x1, &(0x7f0000000300)="02") ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000003c0)={0x5, 0x3000, 0x0, r3, 0x4}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x70, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_tunnel_key={0x58, 0x1, 0x0, 0x0, {{0xf}, {0x28, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) 729.584737ms ago: executing program 8 (id=2655): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc, 0x1], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0xd}, {0x5, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40005}, 0x0) r3 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x48, 0x2, 0x6, 0x405, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}]}]}, 0x44}}, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000140)={'macvtap0\x00', &(0x7f0000000040)=@ethtool_drvinfo={0x3, "dc9b14135872301e6dce2615e41d4cf223fe3e5ea53cf85c58625758a1bb32db", "7633ce98abb90d70d5ff41d91f8323afb1dbb9db2c72238f4a585f6df17bf33b", "2a8bc33aaf8dd858614264a95b0f1199a0551237c78bc7a84de26dfbf575d0fd", "f621f1ae07ac12c0590359c110a80092ed45792422ba95ab0de1785a0f98601d", "6177acf87205fd647454b88389e9ff5db7eb51de28e5efae75edc5f28c461694", "35a098240d01f4127858f7ed", 0xfad6, 0x0, 0x9e57, 0xfff, 0x2}}) add_key(&(0x7f0000000080)='rxrpc_s\x00', 0x0, &(0x7f0000000140)="c9790aef67c6e492", 0x8, r3) 677.577367ms ago: executing program 8 (id=2656): socket(0xa, 0x3, 0xff) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001680)=ANY=[@ANYBLOB="580100001000030400feffffff00000000000000", @ANYRES32=0x0, @ANYBLOB="15020000000000003001128009000100766c616e000000002001028006000100000000001c0004800c00010032d10000ffff00000c000100ae021d009e000000700004800c00010009000000010000e29b5d2a0008000000010100000c000100f8ffffff080000000c00010006000000040000000c00010007000000010000800c00010005000000060000000c00010001000000000000000c000100910a00000d0000000c0001000e00000032000000880003800c002100060000000c0000000c00010003000000400000000c00010004000000ffffffff0c00010002000000110000000c00010001000000020000000c0001000b000000270000000c000100ffff00005f0200000c000100ffffffff030000000c00010001000000030000000c000108000000001a8000000c0001000900000008ffffe208000500", @ANYRES8=r0], 0x158}, 0x1, 0xba01, 0x0, 0x10}, 0x2400e0c0) 548.457607ms ago: executing program 8 (id=2657): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x1c, r1, 0xffffffffffffffff, 0x170bd2c, 0x8008000, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x1c}, 0x1, 0x0, 0xffff0000}, 0x20000000) 521.241135ms ago: executing program 7 (id=2658): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f00000000c0)={0x4, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg(r1, &(0x7f0000009040)=[{{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000180)="f1747ef3ec32e0d3c22322e77a6b0227a6c32a326f626090fc1859dd4405a8a5b02e464e7dfd4cda24dcd05c258a1c0e1931ae6dda8fc9354bcaa7db4506a3618af4777ab172f74284e80a94e12fe90062c8ab3a9359d4eb9270d4e090f2f0a4861aa29bf0c71a0a8705e9a6c1e385051d42685b3e29", 0x76}, {&(0x7f0000000200)="2b54f087fa18ab631e0b06bb092d4a76b4cb6f918e9452daffee00d059bf2a9d04b9bb680f377aa7b16add66feefe755468add6e0fca79599bc5ad913bf0417464625d11dcbd50a285f32f0c5b1917ddd03137fea211da173601734e33bf4b6981f58f43a5f63c779d31c11f0d6e4c708528c4e9baca4c71025f0458a546ce496eb59178822eefd94e078d179fd0cce4b5b82fc949819dfe5194157d3e51d2543f6660e7b9901776b039134ada2bb52a88b1f16602babc8a2d8c7250613b1d9a51591fc5561e571a690a82ecb0f96f6a53aad1b32bd306f675c59e36da763d1326f15e48", 0xe4}, {&(0x7f0000000300)="8f581a0bdb2f4e7b7ad0969d805d74475ab415d289a8cf0f2b4980df48d1a429b8a22e010ff4fae0953e4761848a6a16026ebc87faeeeb66692d187f64b892d0811d1e4bfc15b3d176ac6706b9e80eb1ee95ccc04cec94b4e4974ae44ac4b3d0416b95b2f7cd35a0322ea13daeb6b6459fcadc8d1c59e57efadab1bf169e8ea766d21818a9aa97498a06a211f2d6a937c2961dd58bd521552d5cbdbf751941d4d91963b89becfc89586fa0a59a3c615e4c91ea66b93d49dd5b01fc720ef1af3c60d6f0c56809c167af4055eef9b4283a97dd7a2d989127a6236b0d8bd604fa63b6077c990217e95d84611996f1e057f8e061f06a5968", 0xf6}, {&(0x7f0000000700)="48a9b5d2a1c57a7569b1d017ad3960350d6bc94a8a33bbba8b8a6e3bc04b94d4addba229022576a00392d0d683f4ecfba6a56a65e0be5a66100891d82a45aa3c1a8d6728ebf40b79e86dfaf1306f4e74c1", 0x51}], 0x4}}], 0x1, 0x8000) close(0xffffffffffffffff) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) (async) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f00000000c0)={0x4, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) (async) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) (async) sendmmsg(r1, &(0x7f0000009040)=[{{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000180)="f1747ef3ec32e0d3c22322e77a6b0227a6c32a326f626090fc1859dd4405a8a5b02e464e7dfd4cda24dcd05c258a1c0e1931ae6dda8fc9354bcaa7db4506a3618af4777ab172f74284e80a94e12fe90062c8ab3a9359d4eb9270d4e090f2f0a4861aa29bf0c71a0a8705e9a6c1e385051d42685b3e29", 0x76}, {&(0x7f0000000200)="2b54f087fa18ab631e0b06bb092d4a76b4cb6f918e9452daffee00d059bf2a9d04b9bb680f377aa7b16add66feefe755468add6e0fca79599bc5ad913bf0417464625d11dcbd50a285f32f0c5b1917ddd03137fea211da173601734e33bf4b6981f58f43a5f63c779d31c11f0d6e4c708528c4e9baca4c71025f0458a546ce496eb59178822eefd94e078d179fd0cce4b5b82fc949819dfe5194157d3e51d2543f6660e7b9901776b039134ada2bb52a88b1f16602babc8a2d8c7250613b1d9a51591fc5561e571a690a82ecb0f96f6a53aad1b32bd306f675c59e36da763d1326f15e48", 0xe4}, {&(0x7f0000000300)="8f581a0bdb2f4e7b7ad0969d805d74475ab415d289a8cf0f2b4980df48d1a429b8a22e010ff4fae0953e4761848a6a16026ebc87faeeeb66692d187f64b892d0811d1e4bfc15b3d176ac6706b9e80eb1ee95ccc04cec94b4e4974ae44ac4b3d0416b95b2f7cd35a0322ea13daeb6b6459fcadc8d1c59e57efadab1bf169e8ea766d21818a9aa97498a06a211f2d6a937c2961dd58bd521552d5cbdbf751941d4d91963b89becfc89586fa0a59a3c615e4c91ea66b93d49dd5b01fc720ef1af3c60d6f0c56809c167af4055eef9b4283a97dd7a2d989127a6236b0d8bd604fa63b6077c990217e95d84611996f1e057f8e061f06a5968", 0xf6}, {&(0x7f0000000700)="48a9b5d2a1c57a7569b1d017ad3960350d6bc94a8a33bbba8b8a6e3bc04b94d4addba229022576a00392d0d683f4ecfba6a56a65e0be5a66100891d82a45aa3c1a8d6728ebf40b79e86dfaf1306f4e74c1", 0x51}], 0x4}}], 0x1, 0x8000) (async) close(0xffffffffffffffff) (async) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) (async) 497.870586ms ago: executing program 8 (id=2659): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ec0000", @ANYRES16=0x0, @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x810}, 0x0) 405.593515ms ago: executing program 8 (id=2660): pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) (async) umount2(&(0x7f0000000040)='./file0\x00', 0x1) syz_open_dev$loop(0x0, 0xffff, 0x14f600) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) readv(r2, &(0x7f00000024c0)=[{&(0x7f0000002600)=""/46, 0x2e}], 0x1) (async) close_range(r2, r2, 0x0) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0xe) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r5, 0x4188aec6, &(0x7f0000000040)) (async) ioctl$KVM_SET_CLOCK(r5, 0x4188aec6, &(0x7f0000000040)={0x0, 0x6, 0x0, 0x125, 0x9}) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01) write$char_usb(r6, &(0x7f0000000040), 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f00000005c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x7ff, @local, 0x60000000}}}, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[], [], 0x2f}) (async) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r8, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0x1, 0x0, 0x0, 0x2}]) 313.107332ms ago: executing program 8 (id=2661): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000000)=[{0x30, 0x0, 0xfd, 0x5ae9}, {0x28, 0x7f, 0x6, 0xfffff00c}, {0x6, 0x4, 0x3, 0x1000}]}, 0x10) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20024080}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x40) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0xa4ffffff) 0s ago: executing program 7 (id=2662): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6(0xa, 0x3, 0x1) (async, rerun: 32) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) (rerun: 32) io_setup(0x7, &(0x7f0000004200)=0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000000400)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x100000b, 0x32, r0, 0x91c6e000) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) (async, rerun: 32) getpgrp(0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) (async) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000a40)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x4, 0x0, 0x4, 0x0, 0x4a, 0x9, 'syz1\x00', 0x0}) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc4c85513, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5c8e, 0x0, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xfffffffffffffffb, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x40000000000, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x6, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) (async, rerun: 32) syz_io_uring_setup(0xefd, &(0x7f00000002c0)={0x0, 0xfffffffe, 0x2d1528cfe5a31ee9, 0x3, 0x255}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000280)) (rerun: 32) kernel console output (not intermixed with test programs): ject_r:dri_device_t tclass=chr_file permissive=1 [ 596.715704][ T5791] infiniband syz2: ib_query_port failed (-19) [ 596.752594][T12569] Bluetooth: hci0: command tx timeout [ 596.885452][ T2347] pvrusb2: Invalid write control endpoint [ 596.945925][ T2347] pvrusb2: Invalid write control endpoint [ 596.951665][ T2347] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 596.960937][ T2347] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 597.013953][ T2347] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 597.056657][ T2347] pvrusb2: Device being rendered inoperable [ 597.125864][T13439] pvrusb2: Attempted to execute control transfer when device not ok [ 597.163866][T13439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.174492][ T2347] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 597.181558][ T2347] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 597.203204][T13439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.250546][ T2347] pvrusb2: Attached sub-driver cx25840 [ 597.256033][ T2347] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 597.266087][ T2347] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 597.279616][T13439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.335136][T13439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.579425][T13490] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2118'. [ 597.579472][T10715] block nbd3: Possible stuck request ffff888028b10000: control (read@0,1024B). Runtime 90 seconds [ 597.599002][T10715] block nbd3: Possible stuck request ffff888028b101c0: control (read@1024,1024B). Runtime 90 seconds [ 597.609904][T10715] block nbd3: Possible stuck request ffff888028b10380: control (read@2048,1024B). Runtime 90 seconds [ 597.620766][T10715] block nbd3: Possible stuck request ffff888028b10540: control (read@3072,1024B). Runtime 90 seconds [ 597.695316][ T30] audit: type=1400 audit(1787183733.854:1187): avc: denied { write } for pid=13502 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 597.762432][ T30] audit: type=1400 audit(1787183733.914:1188): avc: denied { write } for pid=13525 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 597.886741][T13514] lo: entered allmulticast mode [ 597.891842][T13514] lo: left allmulticast mode [ 597.901724][ T5258] 8021q: adding VLAN 0 to HW filter on device eth3 [ 597.942177][ T10] usb 4-1: USB disconnect, device number 38 [ 598.002685][T13373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 598.455856][T13547] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 598.557806][T13373] veth0_vlan: entered promiscuous mode [ 598.575066][T13373] veth1_vlan: entered promiscuous mode [ 598.979070][T12569] Bluetooth: hci0: command tx timeout [ 599.131838][ T29] libceph: connect (1)[c::]:6789 error -101 [ 599.139379][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 599.152916][ T29] libceph: connect (1)[c::]:6789 error -101 [ 599.159465][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 599.204599][T13553] ceph: No mds server is up or the cluster is laggy [ 599.341747][T13373] veth0_macvtap: entered promiscuous mode [ 599.370371][T13373] veth1_macvtap: entered promiscuous mode [ 599.402427][T11648] IPVS: stop unused estimator thread 0... [ 599.403003][ T30] audit: type=1400 audit(1787183735.554:1189): avc: denied { setopt } for pid=13552 comm="syz.6.2125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 599.439733][T13373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 599.466626][T13373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 599.550020][T13439] Process accounting resumed [ 599.656245][T11627] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.667889][T11627] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.854937][T11665] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.911221][T11665] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.952048][ T30] audit: type=1400 audit(1787183736.104:1190): avc: denied { write } for pid=13536 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 600.016381][T11665] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.024207][T11665] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.039215][T13579] input: syz1 as /devices/virtual/input/input77 [ 600.140377][T13584] loop5: detected capacity change from 0 to 7 [ 600.173809][T11634] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.184942][T13584] buffer_io_error: 138 callbacks suppressed [ 600.184958][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.185137][T11634] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.190888][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.190920][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.190946][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.190985][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191020][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191045][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191060][T13584] ldm_validate_partition_table(): Disk read failed. [ 600.191083][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191108][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191134][T13584] Buffer I/O error on dev loop5, logical block 0, async page read [ 600.191162][T13584] Dev loop5: unable to read RDB block 0 [ 600.191214][T13584] loop5: unable to read partition table [ 600.191390][T13584] loop5: partition table beyond EOD, [ 600.314117][ T30] audit: type=1400 audit(1787183736.464:1191): avc: denied { write } for pid=13585 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 600.319745][T13584] truncated [ 600.319775][T13584] loop_reread_partitions: partition scan of loop5 (þ被xüŸÑø éÚ¬§½dƤ´à–ƒÝ¡¯¨â·û [ 600.319775][T13584] ) failed (rc=-5) [ 600.558373][ T5258] 8021q: adding VLAN 0 to HW filter on device eth4 [ 600.861563][T13602] bond2 (unregistering): Released all slaves [ 600.947315][ T5692] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 601.005877][ T5706] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 601.018486][ T10] hsr0: entered promiscuous mode [ 601.164637][ T5706] usb 6-1: Using ep0 maxpacket: 16 [ 601.320331][ T5706] usb 6-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 601.320414][T12569] Bluetooth: hci3: unexpected event for opcode 0x0c2d [ 601.423583][ T5706] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 601.435665][ T5706] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 601.449997][ T5706] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.475487][ T5706] usb 6-1: config 0 descriptor?? [ 602.092940][ T5692] usb 8-1: not running at top speed; connect to a high speed hub [ 602.100802][ T5692] usb 8-1: New USB device found, idVendor=2040, idProduct=9301, bcdDevice=30.eb [ 602.357626][ T5706] hid (null): invalid report_size 29797 [ 602.363558][ T5706] hid (null): invalid report_size 29289 [ 602.372665][ T5706] hid_parser_main: 31 callbacks suppressed [ 602.372700][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.386458][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.393629][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.400987][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.408480][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.415778][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.423271][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.432208][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.439800][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.515759][ T5706] apple 0003:05AC:026C.001A: unknown main item tag 0x0 [ 602.527480][ T5706] apple 0003:05AC:026C.001A: invalid report_size 29797 [ 602.538279][ T5706] apple 0003:05AC:026C.001A: item 0 2 1 7 parsing failed [ 602.547102][ T5706] apple 0003:05AC:026C.001A: parse failed [ 602.553552][ T5706] apple 0003:05AC:026C.001A: probe with driver apple failed with error -22 [ 603.480396][ T5692] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.488513][ T5692] usb 8-1: Product: syz [ 603.492735][ T5692] usb 8-1: Manufacturer: syz [ 603.639925][ T5692] usb 8-1: SerialNumber: syz [ 605.907931][ T5692] usb 8-1: can't set config #45, error -71 [ 605.915228][ T5692] usb 8-1: USB disconnect, device number 2 [ 605.989841][ T10] usb 6-1: USB disconnect, device number 34 [ 606.833599][T13634] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 606.843432][T13634] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 606.851891][T13634] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 606.861171][T13634] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 606.870467][T13634] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 606.881643][T13634] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 606.902644][T13653] xt_hashlimit: size too large, truncated to 1048576 [ 607.101533][T13654] xt_hashlimit: size too large, truncated to 1048576 [ 607.153375][ T8931] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 608.064903][ T8931] usb 6-1: Using ep0 maxpacket: 16 [ 608.096889][ T8931] usb 6-1: unable to get BOS descriptor or descriptor too short [ 608.177438][ T8931] usb 6-1: New USB device found, idVendor=1608, idProduct=0302, bcdDevice=ff.4c [ 608.219676][T12569] Bluetooth: hci1: command 0x0406 tx timeout [ 608.318958][ T8957] IPVS: starting estimator thread 0... [ 608.443748][ T8931] usb 6-1: config 1 has an invalid interface number: 169 but max is 0 [ 608.609822][T13674] IPVS: using max 43 ests per chain, 103200 per kthread [ 608.768062][ T8931] usb 6-1: config 1 has no interface number 0 [ 608.894573][T12569] Bluetooth: hci5: command 0x0c1a tx timeout [ 608.921412][ T5611] Bluetooth: hci3: command 0x0c1a tx timeout [ 608.927475][ T5611] Bluetooth: hci0: command 0x0c1a tx timeout [ 608.990139][ T8931] usb 6-1: config 1 interface 169 has no altsetting 0 [ 609.043937][ T8931] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.072125][ T8931] usb 6-1: Product: syz [ 609.076842][T13677] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1547 sclass=netlink_route_socket pid=13677 comm=syz.4.2153 [ 609.114759][ T8931] usb 6-1: Manufacturer: syz [ 609.121678][ T8931] usb 6-1: SerialNumber: syz [ 609.236139][ T8931] usb 6-1: can't set config #1, error -71 [ 609.254352][ T8931] usb 6-1: USB disconnect, device number 35 [ 609.340508][T13680] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2154'. [ 609.481934][T13680] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2154'. [ 609.905386][T13684] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(9) [ 609.911922][T13684] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 609.921362][T13684] vhci_hcd vhci_hcd.0: Device attached [ 610.189158][T13686] vhci_hcd: connection closed [ 610.290075][T11654] vhci_hcd vhci_hcd.5: stop threads [ 610.564641][ T8957] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 610.705099][T11654] vhci_hcd vhci_hcd.5: release socket [ 610.728595][T11654] vhci_hcd vhci_hcd.5: disconnect device [ 610.776203][ T8957] usb 43-1: new full-speed USB device number 2 using vhci_hcd [ 610.821694][ T30] audit: type=1400 audit(1787183746.974:1192): avc: denied { getopt } for pid=13691 comm="syz.5.2158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 610.845621][ T8957] usb 43-1: enqueue for inactive port 0 [ 610.934587][ T8957] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 610.968336][T13697] FAULT_INJECTION: forcing a failure. [ 610.968336][T13697] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 611.003441][T12569] Bluetooth: hci0: command 0x0c1a tx timeout [ 611.024640][T13697] CPU: 0 UID: 0 PID: 13697 Comm: syz.4.2160 Tainted: G L syzkaller #0 PREEMPT(full) [ 611.024673][T13697] Tainted: [L]=SOFTLOCKUP [ 611.024679][T13697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 611.024690][T13697] Call Trace: [ 611.024695][T13697] [ 611.024703][T13697] dump_stack_lvl+0x100/0x190 [ 611.024730][T13697] should_fail_ex.cold+0x5/0xa [ 611.024754][T13697] _copy_to_user+0x32/0xd0 [ 611.024774][T13697] simple_read_from_buffer+0xcb/0x170 [ 611.024800][T13697] proc_fail_nth_read+0x1af/0x230 [ 611.024825][T13697] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 611.024849][T13697] ? rw_verify_area+0xce/0x6d0 [ 611.024875][T13697] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 611.024897][T13697] vfs_read+0x1e4/0xb40 [ 611.024919][T13697] ? __pfx_vfs_read+0x10/0x10 [ 611.024935][T13697] ? find_held_lock+0x2b/0x80 [ 611.024955][T13697] ? __fget_files+0x215/0x3d0 [ 611.024982][T13697] ? __fget_files+0x21f/0x3d0 [ 611.025011][T13697] ksys_read+0x12a/0x250 [ 611.025029][T13697] ? __pfx_ksys_read+0x10/0x10 [ 611.025054][T13697] do_syscall_64+0x123/0x790 [ 611.025074][T13697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.025093][T13697] RIP: 0033:0x7fb061b5e90e [ 611.025123][T13697] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 611.025140][T13697] RSP: 002b:00007fb062a1cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 611.025158][T13697] RAX: ffffffffffffffda RBX: 00007fb062a1d6c0 RCX: 00007fb061b5e90e [ 611.025169][T13697] RDX: 000000000000000f RSI: 00007fb062a1d0a0 RDI: 0000000000000004 [ 611.025180][T13697] RBP: 00007fb062a1d090 R08: 0000000000000000 R09: 0000000000000000 [ 611.025191][T13697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 611.025200][T13697] R13: 00007fb061e26038 R14: 00007fb061e25fa0 R15: 00007ffc0ae1cf48 [ 611.025223][T13697] [ 612.183857][ T5692] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 612.234569][T13698] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 612.361631][T13698] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 612.617560][ T5692] usb 6-1: device descriptor read/64, error -71 [ 612.655730][T13698] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 612.679346][T13698] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 612.990763][ T30] audit: type=1400 audit(1787183749.134:1193): avc: denied { write } for pid=13700 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 613.087564][ T30] audit: type=1400 audit(1787183749.174:1194): avc: denied { write } for pid=13716 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 613.113118][T13719] ip_tables: iptables: counters copy to user failed while replacing table [ 613.209577][ T5692] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 613.359561][ T30] audit: type=1400 audit(1787183749.504:1195): avc: denied { mounton } for pid=13725 comm="syz.6.2165" path="/proc/172/task" dev="proc" ino=43332 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 613.439054][T12569] Bluetooth: hci1: command 0x0406 tx timeout [ 613.744494][ T5692] usb 6-1: device descriptor read/64, error -71 [ 613.786689][ T5692] usb usb6-port1: attempt power cycle [ 613.846358][ T30] audit: type=1400 audit(1787183749.934:1196): avc: denied { write } for pid=13724 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 614.044987][T13746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 614.054430][T13746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 614.133053][T11467] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 614.250300][ T5692] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 614.445856][ T30] audit: type=1400 audit(1787183750.604:1197): avc: denied { write } for pid=13747 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 614.494674][T12569] Bluetooth: hci3: command 0x0c1a tx timeout [ 614.717336][ T5692] usb 6-1: device descriptor read/8, error -71 [ 614.835593][T11467] usb 8-1: Using ep0 maxpacket: 8 [ 614.863362][ T5606] Bluetooth: hci5: command 0x0c1a tx timeout [ 614.877840][T12569] Bluetooth: hci0: command 0x0c1a tx timeout [ 615.056750][T11467] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 615.181163][ T5692] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 615.321589][ T5606] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 615.334320][ T5606] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 615.343018][ T5606] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 615.350855][ T5606] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 615.358798][ T5606] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 615.527689][T11467] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 615.536011][T11467] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 615.545737][T11467] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 615.555456][T11467] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 615.577095][T11467] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 615.590094][T11467] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.763003][ T5692] usb 6-1: device descriptor read/8, error -71 [ 615.795516][ T30] audit: type=1400 audit(1787183751.944:1198): avc: denied { write } for pid=13752 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 615.828215][T13763] lo speed is unknown, defaulting to 1000 [ 615.990917][ T5692] usb usb6-port1: unable to enumerate USB device [ 616.030587][ T30] audit: type=1400 audit(1787183752.184:1199): avc: denied { write } for pid=13786 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 616.107670][T11467] usb 8-1: GET_CAPABILITIES returned 0 [ 616.113194][T11467] usbtmc 8-1:16.0: can't read capabilities [ 616.137647][ T30] audit: type=1326 audit(1787183752.274:1200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13783 comm="syz.5.2171" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4a4619e0d9 code=0x0 [ 616.279837][T13795] loop5: detected capacity change from 0 to 7 [ 616.288095][T13795] Dev loop5: unable to read RDB block 7 [ 616.293687][T13795] loop5: unable to read partition table [ 616.299530][T13795] loop5: partition table beyond EOD, truncated [ 616.305722][T13795] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 616.370876][T13763] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.384879][T13763] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.392688][ T30] audit: type=1400 audit(1787183752.534:1201): avc: denied { remount } for pid=13737 comm="syz.7.2167" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 616.423873][T13763] bridge_slave_0: entered allmulticast mode [ 616.456123][T13763] bridge_slave_0: entered promiscuous mode [ 616.470089][T13799] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 616.482213][T13738] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 616.496275][T13763] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.514975][ T30] audit: type=1400 audit(1787183752.664:1202): avc: denied { write } for pid=13737 comm="syz.7.2167" name="file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 616.546827][T13763] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.567336][T13763] bridge_slave_1: entered allmulticast mode [ 616.584981][T13763] bridge_slave_1: entered promiscuous mode [ 616.640126][T13763] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 616.651957][T13763] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 616.716907][ T5706] usb 8-1: USB disconnect, device number 3 [ 616.754673][T13763] team0: Port device team_slave_0 added [ 616.763579][T13763] team0: Port device team_slave_1 added [ 616.797795][T13813] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2172'. [ 616.822130][ T30] audit: type=1400 audit(1787183752.954:1203): avc: denied { write } for pid=13797 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 616.830056][T13763] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 616.852179][T13763] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 616.878034][T13763] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 616.890346][T13763] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 616.897317][T13763] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 617.009764][T13763] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 617.078312][ T30] audit: type=1400 audit(1787183753.164:1204): avc: denied { write } for pid=13816 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 617.126614][T13763] hsr_slave_0: entered promiscuous mode [ 617.132953][T13763] hsr_slave_1: entered promiscuous mode [ 617.503859][ T5606] Bluetooth: hci2: command tx timeout [ 617.616882][T13750] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 617.668786][T13763] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 617.699144][T13831] 9p: Bad value for 'wfdno' [ 617.699730][T13763] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 617.728617][T13763] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 617.762105][T13763] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 617.777058][T13763] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 617.787134][T13763] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 617.804036][T13763] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 617.844620][T13763] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 617.983275][T13818] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 618.022789][T13818] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 618.047306][T13818] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 618.137225][T13818] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 618.148479][T13847] netlink: 92 bytes leftover after parsing attributes in process `syz.6.2180'. [ 618.171994][T13818] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 618.336435][ T30] audit: type=1400 audit(1787183754.494:1205): avc: denied { ioctl } for pid=13835 comm="syz.7.2178" path="mnt:[4026534664]" dev="nsfs" ino=4026534664 ioctlcmd=0x550b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 618.520138][ T30] audit: type=1400 audit(1787183754.534:1206): avc: denied { getattr } for pid=13835 comm="syz.7.2178" path="mnt:[4026534664]" dev="nsfs" ino=4026534664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 618.634285][T13818] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 618.658033][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 618.952934][T13818] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 619.298331][T13763] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.391007][ T5606] Bluetooth: hci1: command 0x0406 tx timeout [ 619.630215][T13763] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.760246][T11654] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.767363][T11654] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.780349][T13856] IPVS: set_ctl: invalid protocol: 135 255.255.255.255:20 [ 619.789736][T11654] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.796859][T11654] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.865577][T13856] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2181'. [ 621.386709][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 621.409739][T12569] Bluetooth: hci0: command 0x0c1a tx timeout [ 621.417420][T12569] Bluetooth: hci5: command 0x0c1a tx timeout [ 621.423748][ T5606] Bluetooth: hci3: command 0x0c1a tx timeout [ 621.599513][T13859] i2c i2c-0: delete_device: Can't find device in list [ 621.674375][ T30] audit: type=1400 audit(1787183757.824:1207): avc: denied { map } for pid=13858 comm="syz.7.2182" path="socket:[43846]" dev="sockfs" ino=43846 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 622.398743][T13763] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 623.484524][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 623.647952][T13898] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 623.656857][T13898] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 624.581822][T13763] veth0_vlan: entered promiscuous mode [ 624.613709][T13763] veth1_vlan: entered promiscuous mode [ 624.705524][T13763] veth0_macvtap: entered promiscuous mode [ 624.749207][T13763] veth1_macvtap: entered promiscuous mode [ 624.819769][T13929] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2195'. [ 624.832505][T13763] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 624.855402][T11467] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 624.878648][T13928] WARNING! power/level is deprecated; use power/control instead [ 624.901905][T13763] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 624.979230][T11663] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.987959][T11663] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.996707][T11663] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.234994][T13939] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2197'. [ 625.243953][T13939] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2197'. [ 625.252860][T13939] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 625.452410][T11654] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.486772][T11654] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.578073][T11654] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.629964][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 625.854128][T11467] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 626.065909][ T9316] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 626.074991][ T9316] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 626.260458][ T30] audit: type=1326 audit(1787183762.364:1208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13943 comm="syz.4.2200" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb061b9e0d9 code=0x0 [ 626.268272][T13942] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2199'. [ 626.319119][T11467] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 626.329239][T11467] usb 8-1: config 0 has no interfaces? [ 626.334712][T11467] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.345129][T11467] usb 8-1: config 0 descriptor?? [ 626.394567][T13942] hsr_slave_1 (unregistering): left promiscuous mode [ 626.977756][T13954] netlink: 64 bytes leftover after parsing attributes in process `syz.8.2201'. [ 626.988797][T13954] netlink: 64 bytes leftover after parsing attributes in process `syz.8.2201'. [ 626.998797][T13954] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 627.155586][ T5706] usb 8-1: USB disconnect, device number 4 [ 627.673002][T13965] tmpfs: Bad value for 'mpol' [ 627.714817][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 627.722070][T10715] block nbd3: Possible stuck request ffff888028b10000: control (read@0,1024B). Runtime 120 seconds [ 627.732815][T10715] block nbd3: Possible stuck request ffff888028b101c0: control (read@1024,1024B). Runtime 120 seconds [ 627.743773][T10715] block nbd3: Possible stuck request ffff888028b10380: control (read@2048,1024B). Runtime 120 seconds [ 627.754724][T10715] block nbd3: Possible stuck request ffff888028b10540: control (read@3072,1024B). Runtime 120 seconds [ 628.696960][T13991] tipc: Enabled bearer , priority 0 [ 628.714665][T13983] syzkaller0: entered promiscuous mode [ 628.728466][T13983] syzkaller0: entered allmulticast mode [ 629.055033][T13978] tipc: Resetting bearer [ 629.128457][T13978] tipc: Disabling bearer [ 629.143005][T13999] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2213'. [ 629.187525][ T8957] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 629.231113][ T5791] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 629.350626][ T8957] usb 8-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 1.00 [ 629.363395][ T8957] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 629.372419][ T8957] usb 8-1: Product: syz [ 629.377355][ T8957] usb 8-1: Manufacturer: syz [ 629.430815][ T8957] msi2500 8-1:1.0: Registered as swradio24 [ 629.439748][ T8957] msi2500 8-1:1.0: SDR API is still slightly experimental and functionality changes may follow [ 629.803484][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 629.919556][ T5791] usb 9-1: Using ep0 maxpacket: 8 [ 630.152435][ T5791] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 630.351488][T14013] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2212'. [ 630.578095][T14019] netlink: 'syz.4.2217': attribute type 10 has an invalid length. [ 630.585945][T14019] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2217'. [ 630.615475][ T5791] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.866063][ T5791] pvrusb2: Hardware description: Terratec Grabster AV400 [ 630.874065][ T5791] pvrusb2: ********** [ 630.885287][ T5791] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 630.895453][ T5791] pvrusb2: Important functionality might not be entirely working. [ 630.903253][ T5791] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 630.914526][ T5791] pvrusb2: ********** [ 631.201031][ T2347] pvrusb2: Invalid write control endpoint [ 631.266945][T14024] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2219'. [ 631.268092][ T2347] pvrusb2: Invalid write control endpoint [ 631.286126][ T2347] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 631.304611][ T2347] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 631.321388][ T2347] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 631.332823][ T2347] pvrusb2: Device being rendered inoperable [ 631.339934][ T2347] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 631.348840][ T2347] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 631.368988][ T2347] pvrusb2: Attached sub-driver cx25840 [ 631.374500][ T2347] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 631.384572][ T2347] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 631.481238][T13994] pvrusb2: Attempted to execute control transfer when device not ok [ 631.495020][ T8957] usb 9-1: USB disconnect, device number 2 [ 631.615759][T14028] bond1: (slave vlan2): making interface the new active one [ 631.633095][T14028] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 632.104578][ T30] audit: type=1400 audit(1787183768.164:1209): avc: denied { write } for pid=14034 comm="syz.4.2222" name="functions" dev="configfs" ino=9318 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 632.225074][ T5791] usb 8-1: USB disconnect, device number 5 [ 632.328619][ T30] audit: type=1400 audit(1787183768.264:1210): avc: denied { write } for pid=14034 comm="syz.4.2222" name="header" dev="configfs" ino=45333 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 632.847745][T14041] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2224'. [ 632.847818][T14038] FAULT_INJECTION: forcing a failure. [ 632.847818][T14038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.901495][T14038] CPU: 1 UID: 0 PID: 14038 Comm: syz.7.2223 Tainted: G L syzkaller #0 PREEMPT(full) [ 632.901523][T14038] Tainted: [L]=SOFTLOCKUP [ 632.901529][T14038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 632.901538][T14038] Call Trace: [ 632.901544][T14038] [ 632.901552][T14038] dump_stack_lvl+0x100/0x190 [ 632.901580][T14038] should_fail_ex.cold+0x5/0xa [ 632.901603][T14038] _copy_from_iter+0x1f4/0x1690 [ 632.901627][T14038] ? __pfx__copy_from_iter+0x10/0x10 [ 632.901643][T14038] ? kasan_save_track+0x14/0x30 [ 632.901667][T14038] ? __kasan_kmalloc+0xaa/0xb0 [ 632.901690][T14038] ? __kmalloc_cache_noprof+0x2e7/0x6b0 [ 632.901710][T14038] ? configfs_write_iter+0x388/0x4e0 [ 632.901743][T14038] configfs_write_iter+0xb3/0x4e0 [ 632.901774][T14038] vfs_write+0x6af/0x1050 [ 632.901793][T14038] ? __pfx_configfs_write_iter+0x10/0x10 [ 632.901829][T14038] ? __pfx_vfs_write+0x10/0x10 [ 632.901844][T14038] ? find_held_lock+0x2b/0x80 [ 632.901878][T14038] ksys_write+0x12a/0x250 [ 632.901896][T14038] ? __pfx_ksys_write+0x10/0x10 [ 632.901921][T14038] do_syscall_64+0x123/0x790 [ 632.901941][T14038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.901960][T14038] RIP: 0033:0x7fd9a439e0d9 [ 632.901976][T14038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.901991][T14038] RSP: 002b:00007fd9a524d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 632.902007][T14038] RAX: ffffffffffffffda RBX: 00007fd9a4625fa0 RCX: 00007fd9a439e0d9 [ 632.902016][T14038] RDX: 0000000000000019 RSI: 0000200000000440 RDI: 0000000000000007 [ 632.902026][T14038] RBP: 00007fd9a524d090 R08: 0000000000000000 R09: 0000000000000000 [ 632.902035][T14038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.902045][T14038] R13: 00007fd9a4626038 R14: 00007fd9a4625fa0 R15: 00007ffd0e6b7008 [ 632.902068][T14038] [ 633.418275][T14053] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2229'. [ 633.605019][T14058] netlink: 3 bytes leftover after parsing attributes in process `syz.8.2229'. [ 634.485945][ T30] audit: type=1400 audit(1787183770.564:1211): avc: denied { execute } for pid=14068 comm="syz.4.2234" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=44762 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 634.621736][T14072] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 634.688271][T14072] can0: slcan on ttyS3. [ 635.061122][T14074] netlink: 'syz.6.2233': attribute type 1 has an invalid length. [ 635.227559][T14074] 8021q: adding VLAN 0 to HW filter on device bond2 [ 635.432457][T14079] tipc: Started in network mode [ 635.460733][T14079] tipc: Node identity , cluster identity 4711 [ 635.478652][T14079] tipc: Failed to obtain node identity [ 635.496177][T14079] tipc: Enabling of bearer rejected, failed to enable media [ 635.512826][ T30] audit: type=1400 audit(1787183771.664:1212): avc: denied { ioctl } for pid=14081 comm="syz.6.2236" path="socket:[44785]" dev="sockfs" ino=44785 ioctlcmd=0x6e83 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 635.576463][T14065] can0 (unregistered): slcan off ttyS3. [ 636.001712][ T30] audit: type=1400 audit(1787183772.154:1213): avc: denied { write } for pid=14080 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 636.093562][ T30] audit: type=1400 audit(1787183773.246:1214): avc: denied { write } for pid=14112 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 636.236491][T14118] input: syz1 as /devices/virtual/input/input78 [ 636.385107][ T5692] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 636.450354][T14127] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2244'. [ 636.689083][ T30] audit: type=1400 audit(1787183773.846:1215): avc: denied { write } for pid=14114 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 636.792388][ T30] audit: type=1400 audit(1787183773.886:1216): avc: denied { write } for pid=14144 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 637.002014][T14149] netlink: 'syz.6.2250': attribute type 5 has an invalid length. [ 637.081233][ T5692] usb 5-1: Using ep0 maxpacket: 16 [ 637.443492][ T5692] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 637.690129][T14160] netlink: 'syz.7.2254': attribute type 10 has an invalid length. [ 637.700197][T14160] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2254'. [ 637.889365][ T5692] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 637.900262][ T5692] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 637.913041][ T5692] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.933299][ T5692] usb 5-1: config 0 descriptor?? [ 638.233389][T11467] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 639.582333][ T5692] microsoft 0003:045E:07DA.001B: ignoring exceeding usage max [ 640.542412][T11467] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 640.553534][ T5692] hid_parser_main: 16 callbacks suppressed [ 640.553555][ T5692] microsoft 0003:045E:07DA.001B: unknown main item tag 0x0 [ 640.567468][ T5692] hid_map_usage: 11766 callbacks suppressed [ 640.567481][ T5692] HID 045e:07da: Invalid code 65791 type 1 [ 640.579465][ T5692] HID 045e:07da: Invalid code 768 type 1 [ 640.585108][ T5692] HID 045e:07da: Invalid code 769 type 1 [ 640.590748][ T5692] HID 045e:07da: Invalid code 770 type 1 [ 640.596375][ T5692] HID 045e:07da: Invalid code 771 type 1 [ 640.602030][ T5692] HID 045e:07da: Invalid code 772 type 1 [ 640.607668][ T5692] HID 045e:07da: Invalid code 773 type 1 [ 640.613307][ T5692] HID 045e:07da: Invalid code 774 type 1 [ 640.618938][ T5692] HID 045e:07da: Invalid code 775 type 1 [ 640.624569][ T5692] HID 045e:07da: Invalid code 776 type 1 [ 640.821483][ T5692] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.001B/input/input79 [ 640.899806][ T5692] microsoft 0003:045E:07DA.001B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 641.039284][ T8958] usb 5-1: USB disconnect, device number 53 [ 641.129672][T11467] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 641.137262][T11467] usb 8-1: can't read configurations, error -71 [ 641.320352][T14178] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2257'. [ 641.836491][T14191] Attempt to restore checkpoint with obsolete wellknown handles [ 641.959007][T14198] IPv6: NLM_F_CREATE should be specified when creating new route [ 642.501069][T14205] syzkaller0: entered promiscuous mode [ 642.507005][T14205] syzkaller0: entered allmulticast mode [ 642.540142][ T10] dummy0: entered promiscuous mode [ 642.688687][T14198] usb usb9: usbfs: process 14198 (syz.6.2264) did not claim interface 0 before use [ 642.964436][ T24] dummy0: left promiscuous mode [ 644.018563][ T5611] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 644.031748][ T5611] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 644.052522][ T5611] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 644.067588][ T5611] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 644.124024][ T5611] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 644.195945][T14220] fuse: Unknown parameter 'ft' [ 644.254659][T12569] Bluetooth: hci3: SCO packet for unknown connection handle 2357 [ 644.635223][T14216] lo speed is unknown, defaulting to 1000 [ 644.830659][T14248] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2276'. [ 644.893452][T14216] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.900575][T14216] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.907917][T14216] bridge_slave_0: entered allmulticast mode [ 644.915223][T14216] bridge_slave_0: entered promiscuous mode [ 644.949211][T14216] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.956425][T14216] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.965916][T14216] bridge_slave_1: entered allmulticast mode [ 644.973619][T14216] bridge_slave_1: entered promiscuous mode [ 644.993472][T14216] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 645.003804][T14254] bridge0: port 3(syz_tun) entered disabled state [ 645.010459][T14254] bridge0: port 2(bridge_slave_1) entered disabled state [ 645.017561][T14254] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.058905][T14216] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 645.079609][T14216] team0: Port device team_slave_0 added [ 645.086528][T14216] team0: Port device team_slave_1 added [ 645.102818][T14216] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 645.109754][T14216] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.159311][T14216] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 645.171684][T14216] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 645.192276][T14216] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.218346][T14216] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 645.291168][T14216] hsr_slave_0: entered promiscuous mode [ 645.297610][T14216] hsr_slave_1: entered promiscuous mode [ 645.303798][T14216] debugfs: 'hsr0' already exists in 'hsr' [ 645.309528][T14216] Cannot create hsr debugfs directory [ 646.095091][T12569] Bluetooth: hci6: command tx timeout [ 646.804735][T14265] loop2: detected capacity change from 0 to 2640 [ 647.239067][ T24] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 648.182314][T12569] Bluetooth: hci6: command tx timeout [ 648.777162][ T30] audit: type=1400 audit(1787183785.936:1217): avc: denied { write } for pid=14284 comm="syz.7.2284" name="cluster" dev="configfs" ino=1164 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 648.778044][T14285] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2284'. [ 648.980582][ T24] usb 9-1: unable to get BOS descriptor or descriptor too short [ 648.988325][ T24] usb 9-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 649.005266][T14285] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2284'. [ 649.255227][T14285] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2284'. [ 649.322178][ T24] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 649.329769][ T24] usb 9-1: can't read configurations, error -71 [ 650.148259][T13342] cxacru 7-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 650.362819][T12569] Bluetooth: hci6: command tx timeout [ 650.691947][T14299] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2285'. [ 650.703536][T14216] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 650.728608][T14216] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 650.737395][T14216] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 650.748224][T14216] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 650.756094][T14216] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 650.765612][T14216] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 650.773394][T14216] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 651.814781][ T24] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 651.907891][T14216] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 652.768231][T12569] Bluetooth: hci6: command tx timeout [ 652.817104][ T30] audit: type=1400 audit(1787183789.926:1218): avc: denied { execute } for pid=14303 comm="syz.7.2289" path="/sys/kernel/debug/bluetooth/6lowpan_control" dev="debugfs" ino=1731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=file permissive=1 [ 653.124493][ T30] audit: type=1400 audit(1787183790.276:1219): avc: denied { ioctl } for pid=14303 comm="syz.7.2289" path="socket:[47289]" dev="sockfs" ino=47289 ioctlcmd=0x5820 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 653.149505][ T30] audit: type=1400 audit(1787183790.276:1220): avc: denied { map } for pid=14303 comm="syz.7.2289" path="/dev/btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 653.494430][T14216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 653.509837][T14216] 8021q: adding VLAN 0 to HW filter on device team0 [ 653.541202][T14216] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 653.551573][T14216] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 653.586413][T11643] bridge0: port 1(bridge_slave_0) entered blocking state [ 653.593530][T11643] bridge0: port 1(bridge_slave_0) entered forwarding state [ 653.602460][T11643] bridge0: port 2(bridge_slave_1) entered blocking state [ 653.609563][T11643] bridge0: port 2(bridge_slave_1) entered forwarding state [ 653.716478][ T30] audit: type=1400 audit(1787183790.856:1221): avc: denied { setattr } for pid=14318 comm="syz.6.2290" path="/dev/uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 654.191421][T14328] trusted_key: encrypted_key: insufficient parameters specified [ 654.244514][ T30] audit: type=1400 audit(1787183791.316:1222): avc: denied { getopt } for pid=14327 comm="syz.6.2293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 654.807198][T14325] netlink: 76 bytes leftover after parsing attributes in process `syz.7.2292'. [ 655.025436][ T5692] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 655.233482][T14216] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 655.744975][T14361] netlink: 64 bytes leftover after parsing attributes in process `syz.8.2299'. [ 655.753974][T14361] netlink: 64 bytes leftover after parsing attributes in process `syz.8.2299'. [ 655.762913][T14361] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 655.929054][ T5692] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 656.417625][ T5692] usb 7-1: config 1 has an invalid interface number: 128 but max is 1 [ 656.425812][ T5692] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 656.446411][ T5692] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 656.455305][ T5692] usb 7-1: config 1 has no interface number 0 [ 656.461400][ T5692] usb 7-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 656.607454][T11666] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.681252][T14216] veth0_vlan: entered promiscuous mode [ 656.692704][T14216] veth1_vlan: entered promiscuous mode [ 656.727122][T14216] veth0_macvtap: entered promiscuous mode [ 656.736752][T14216] veth1_macvtap: entered promiscuous mode [ 656.753837][T14216] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 656.818679][T14216] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 656.994610][T11627] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 657.002438][T11627] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 657.042884][T11627] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 657.050720][T11627] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 657.076659][ T9316] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.140019][ T9316] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.148745][ T9316] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.157435][ T9316] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.759090][T11666] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.775150][ T5692] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.783158][ T5692] usb 7-1: Product: syz [ 657.787321][ T5692] usb 7-1: Manufacturer: syz [ 657.900539][ T5692] usb 7-1: can't set config #1, error -71 [ 657.907822][ T5692] usb 7-1: USB disconnect, device number 5 [ 657.959316][T14395] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input80 [ 658.059313][ T30] audit: type=1400 audit(1787183795.206:1223): avc: denied { append } for pid=14394 comm="syz.7.2311" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 658.134119][ T30] audit: type=1400 audit(1787183795.206:1224): avc: denied { ioctl } for pid=14394 comm="syz.7.2311" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 658.770916][T10715] block nbd3: Possible stuck request ffff888028b10000: control (read@0,1024B). Runtime 150 seconds [ 658.781901][T10715] block nbd3: Possible stuck request ffff888028b101c0: control (read@1024,1024B). Runtime 150 seconds [ 658.792877][T10715] block nbd3: Possible stuck request ffff888028b10380: control (read@2048,1024B). Runtime 150 seconds [ 658.837659][T10715] block nbd3: Possible stuck request ffff888028b10540: control (read@3072,1024B). Runtime 150 seconds [ 659.005580][T11666] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.196247][T14423] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2320'. [ 660.218994][ T5713] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 660.263228][T14442] snd_dummy snd_dummy.0: control -1:9:195::53367 is already present [ 660.337424][ T30] audit: type=1400 audit(1787183797.486:1225): avc: denied { append } for pid=14437 comm="syz.9.2322" name="ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 660.510494][T11666] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 660.677450][ T5713] usb 8-1: device descriptor read/64, error -71 [ 660.719296][T14448] syz.9.2325 (14448): drop_caches: 2 [ 661.027203][ T5713] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 661.334433][ T30] audit: type=1400 audit(1787183798.426:1226): avc: denied { setopt } for pid=14450 comm="syz.8.2326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 661.474854][T11666] netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.508771][ T30] audit: type=1326 audit(1787183798.546:1227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.551731][ T30] audit: type=1326 audit(1787183798.546:1228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.561071][T14456] netlink: 'syz.9.2327': attribute type 1 has an invalid length. [ 661.578258][ T30] audit: type=1326 audit(1787183798.546:1229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.628229][ T5713] usb 8-1: device descriptor read/64, error -71 [ 661.689594][ T30] audit: type=1326 audit(1787183798.546:1230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.723061][ T30] audit: type=1326 audit(1787183798.546:1231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.829300][ T30] audit: type=1326 audit(1787183798.546:1232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=322 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.833020][ T5713] usb usb8-port1: attempt power cycle [ 661.858538][ T30] audit: type=1326 audit(1787183798.786:1233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 661.917631][ T30] audit: type=1326 audit(1787183798.786:1234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14450 comm="syz.8.2326" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 662.145772][T11666] bridge_slave_1: left allmulticast mode [ 662.151538][T11666] bridge_slave_1: left promiscuous mode [ 662.157276][T11666] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.169679][T14469] netlink: 36 bytes leftover after parsing attributes in process `syz.9.2330'. [ 662.737865][T11666] bridge_slave_0: left allmulticast mode [ 662.804429][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 662.813434][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 662.838778][T11666] bridge_slave_0: left promiscuous mode [ 662.844805][T11666] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.926684][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 662.935666][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 663.319294][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 663.328273][T14483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2334'. [ 664.315183][T11666] bond1 (unregistering): (slave vlan2): Releasing active interface [ 664.388867][T11666] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 665.502489][T11666] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 665.514976][T11666] bond0 (unregistering): Released all slaves [ 665.528713][T11666] bond1 (unregistering): Released all slaves [ 665.537868][T14517] netlink: 'syz.4.2342': attribute type 2 has an invalid length. [ 665.545609][T14517] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2342'. [ 665.554525][T14517] netlink: 'syz.4.2342': attribute type 2 has an invalid length. [ 665.562229][T14517] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2342'. [ 665.579953][T14517] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 665.658148][ T5258] 8021q: adding VLAN 0 to HW filter on device eth5 [ 665.839903][T14527] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2344'. [ 665.862508][T14528] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x0007 instead [ 665.872839][T14528] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0247 instead [ 665.883143][T14528] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0xb0b1 instead [ 665.893767][T14528] jffs2: notice: (14528) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 665.941567][T14532] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 665.997481][T14532] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 666.490586][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 666.490602][ T30] audit: type=1400 audit(1787183803.626:1238): avc: denied { setattr } for pid=14526 comm="syz.7.2346" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 666.534576][T14537] bridge_slave_1: left allmulticast mode [ 666.540264][T14537] bridge_slave_1: left promiscuous mode [ 666.547454][T14537] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.612861][T14537] bridge_slave_0: left allmulticast mode [ 666.618530][T14537] bridge_slave_0: left promiscuous mode [ 666.625591][T14537] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.744851][ T30] audit: type=1400 audit(1787183803.856:1239): avc: denied { write } for pid=14541 comm="syz.4.2348" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 666.767840][ T30] audit: type=1400 audit(1787183803.856:1240): avc: denied { open } for pid=14541 comm="syz.4.2348" path="/489/proc/mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 666.824339][T11666] tipc: Left network mode [ 666.887779][T14547] MTRR 1 not used [ 666.995618][ T30] audit: type=1400 audit(1787183803.966:1241): avc: denied { ioctl } for pid=14541 comm="syz.4.2348" path="/489/proc/mtrr" dev="proc" ino=4026531995 ioctlcmd=0x4d09 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 667.616109][ T30] audit: type=1400 audit(1787183804.746:1242): avc: denied { write } for pid=14524 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 667.729926][T12569] Bluetooth: hci5: ACL packet for unknown connection handle 200 [ 667.771790][ T30] audit: type=1400 audit(1787183804.876:1243): avc: denied { write } for pid=14558 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 667.911604][ T5258] 8021q: adding VLAN 0 to HW filter on device eth6 [ 667.956777][T14564] 9p: Bad value for 'wfdno' [ 667.957936][ T30] audit: type=1400 audit(1787183805.106:1244): avc: denied { bind } for pid=14562 comm="syz.7.2353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 668.248676][T14576] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 668.277702][T14576] CIFS: Attempting to mount //127.0.0.1/share [ 668.288511][T14576] CIFS: VFS: Error connecting to socket. Aborting operation. [ 668.295924][T14576] CIFS: VFS: cifs_mount failed w/return code = -111 [ 668.296630][ T10] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 669.217195][ T10] usb 5-1: New USB device found, idVendor=0b43, idProduct=0003, bcdDevice= 0.00 [ 669.388488][ T30] audit: type=1400 audit(1787183806.496:1245): avc: denied { write } for pid=14575 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.462072][ T30] audit: type=1400 audit(1787183806.606:1246): avc: denied { write } for pid=14595 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.524980][ T5258] 8021q: adding VLAN 0 to HW filter on device eth8 [ 669.665388][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.674083][ T8957] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 669.682315][ T10] usb 5-1: config 0 descriptor?? [ 669.719988][ T30] audit: type=1400 audit(1787183806.826:1247): avc: denied { write } for pid=14598 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.901151][T11666] hsr_slave_0: left promiscuous mode [ 669.907063][T11666] hsr_slave_1: left promiscuous mode [ 669.916842][T11666] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 669.924249][T11666] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 669.931835][T11666] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 669.939191][T11666] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 669.999378][T11666] veth1_macvtap: left promiscuous mode [ 670.005272][T11666] veth0_macvtap: left promiscuous mode [ 670.010802][T11666] veth1_vlan: left promiscuous mode [ 670.260374][ T8957] usb 8-1: Using ep0 maxpacket: 8 [ 670.266765][ T8957] usb 8-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 670.782314][T14566] netlink: 'syz.4.2351': attribute type 13 has an invalid length. [ 670.790197][T14566] netlink: 'syz.4.2351': attribute type 17 has an invalid length. [ 670.938664][ T10] smartjoyplus 0003:0B43:0003.001C: ignoring exceeding usage max [ 670.962751][ T8957] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 670.975983][ T8957] usb 8-1: config 0 has no interface number 0 [ 670.976087][T11666] team0 (unregistering): Port device team_slave_1 removed [ 670.984967][ T8957] usb 8-1: config 0 interface 1 has no altsetting 0 [ 671.001357][ T8957] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.010153][ T8957] usb 8-1: Product: syz [ 671.014310][ T8957] usb 8-1: Manufacturer: syz [ 671.018896][ T8957] usb 8-1: SerialNumber: syz [ 671.025209][ T10] smartjoyplus 0003:0B43:0003.001C: hidraw0: USB HID v0.81 Device [HID 0b43:0003] on usb-dummy_hcd.4-1/input0 [ 671.027209][T14622] __nla_validate_parse: 1 callbacks suppressed [ 671.027222][T14622] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.036877][ T10] smartjoyplus 0003:0B43:0003.001C: no output reports found [ 671.043065][T14622] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.070575][ T8957] usb 8-1: config 0 descriptor?? [ 671.078416][T11666] team0 (unregistering): Port device team_slave_0 removed [ 671.141454][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.150458][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.173758][T14622] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.182758][T14622] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.213857][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.250094][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.310587][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.319595][T14624] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2359'. [ 671.396299][T14633] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 671.414842][T11662] smbdirect: ib_dev[syz_device_name_32_chars_1234567] removed [ 671.454816][ T5258] 8021q: adding VLAN 0 to HW filter on device eth7 [ 671.491796][T11467] lo speed is unknown, defaulting to 1000 [ 671.497551][T11467] infiniband syz_device_name_32_chars_1234567: ib_query_port failed (-19) [ 671.554795][ T8957] i2c-cp2615 8-1:0.1: probe with driver i2c-cp2615 failed with error -71 [ 671.565692][ T8957] usb 8-1: USB disconnect, device number 11 [ 671.594175][T14566] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 671.765716][T11467] usb 5-1: USB disconnect, device number 54 [ 672.230711][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 672.230726][ T30] audit: type=1400 audit(1787183809.376:1255): avc: denied { write } for pid=14639 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 672.311019][ T30] audit: type=1400 audit(1787183809.376:1256): avc: denied { write } for pid=14656 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 672.377394][ T5258] 8021q: adding VLAN 0 to HW filter on device eth9 [ 672.599265][ T30] audit: type=1400 audit(1787183809.746:1257): avc: denied { write } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 672.674640][ T30] audit: type=1400 audit(1787183809.756:1258): avc: denied { remove_name } for pid=13763 comm="syz-executor" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 672.745168][ T30] audit: type=1400 audit(1787183809.756:1259): avc: denied { unlink } for pid=13763 comm="syz-executor" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 672.790016][ T30] audit: type=1400 audit(1787183809.756:1260): avc: denied { write } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 672.816090][ T30] audit: type=1400 audit(1787183809.756:1261): avc: denied { write } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 672.897531][ T30] audit: type=1400 audit(1787183809.756:1262): avc: denied { write } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 672.948970][ T30] audit: type=1400 audit(1787183809.756:1263): avc: denied { write } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 673.014792][T14675] bridge1: entered promiscuous mode [ 673.037918][ T30] audit: type=1400 audit(1787183809.756:1264): avc: denied { rmdir } for pid=13763 comm="syz-executor" name="27" dev="tmpfs" ino=157 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 673.100408][ T5713] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 673.523584][ T8931] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 673.747301][ T8957] usb 9-1: new full-speed USB device number 5 using dummy_hcd [ 673.793043][ T5713] usb 5-1: Using ep0 maxpacket: 16 [ 674.023211][ T5713] usb 5-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice=5c.a8 [ 674.115690][ T8957] usb 9-1: not running at top speed; connect to a high speed hub [ 674.281061][ T8931] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 674.296893][ T8957] usb 9-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 674.431859][T11666] IPVS: stop unused estimator thread 0... [ 674.478098][ T5713] usb 5-1: config 3 has an invalid interface number: 88 but max is 0 [ 674.486203][ T5713] usb 5-1: config 3 has no interface number 0 [ 674.492488][ T5713] usb 5-1: config 3 interface 88 has no altsetting 0 [ 674.523622][ T8931] usb 8-1: config index 0 descriptor too short (expected 71, got 53) [ 674.532496][ T8957] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 674.548089][ T8957] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.558326][ T8931] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.567281][ T8931] usb 8-1: Product: syz [ 674.573017][ T8931] usb 8-1: Manufacturer: syz [ 674.579111][ T8931] usb 8-1: SerialNumber: syz [ 674.733073][T14700] loop5: detected capacity change from 0 to 7 [ 674.741386][T14700] Dev loop5: unable to read RDB block 7 [ 674.747033][T14700] loop5: unable to read partition table [ 674.753129][T14700] loop5: partition table beyond EOD, truncated [ 674.759323][T14700] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 675.148007][ T8957] uvcvideo 9-1:1.0: Found UVC 1.00 device (046d:0825) [ 675.309459][ T8931] mos7720 8-1:1.0: Moschip 2 port adapter converter detected [ 675.316680][T14703] futex_wake_op: syz.6.2376 tries to shift op by 144; fix this program [ 675.376735][ T8957] uvcvideo 9-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 675.522261][ T5713] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.530299][ T5713] usb 5-1: Product: syz [ 675.534453][ T5713] usb 5-1: Manufacturer: syz [ 675.539039][ T5713] usb 5-1: SerialNumber: syz [ 675.785561][ T8957] usb 9-1: USB disconnect, device number 5 [ 675.979255][T11467] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 675.987330][ T5713] usb 5-1: can't set config #3, error -71 [ 675.999741][ T5713] usb 5-1: USB disconnect, device number 55 [ 676.125448][T14712] __nla_validate_parse: 3 callbacks suppressed [ 676.125466][T14712] netlink: 92 bytes leftover after parsing attributes in process `syz.4.2378'. [ 677.354829][ T8931] usb 8-1: mos7720: usb_control_msg() failed: -71 [ 677.399787][ T8931] usb 8-1: Moschip 2 port adapter converter now attached to ttyUSB0 [ 677.538138][ T8931] usb 8-1: Moschip 2 port adapter converter now attached to ttyUSB1 [ 677.555872][ T8931] usb 8-1: USB disconnect, device number 12 [ 677.579677][ C0] usb 8-1: mos7720_interrupt_callback - Error -19 submitting control urb [ 677.609278][T11467] usb 7-1: unable to get BOS descriptor or descriptor too short [ 677.616971][T11467] usb 7-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 677.629468][ T8931] moschip7720 ttyUSB0: Moschip 2 port adapter converter now disconnected from ttyUSB0 [ 677.665113][ T8931] moschip7720 ttyUSB1: Moschip 2 port adapter converter now disconnected from ttyUSB1 [ 677.700225][ T8931] mos7720 8-1:1.0: device disconnected [ 678.011795][T14749] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 678.098817][T11467] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 678.109178][T11467] usb 7-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 678.170320][ T30] audit: type=1400 audit(1787183815.226:1265): avc: denied { associate } for pid=14754 comm="syz.7.2396" name=2205082075702E636F6E74726F6C6C657273 scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 678.198695][T14761] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2395'. [ 678.252712][T14761] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2395'. [ 678.278103][ T30] audit: type=1400 audit(1787183815.406:1266): avc: denied { ioctl } for pid=14760 comm="syz.4.2395" path="socket:[48584]" dev="sockfs" ino=48584 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 678.567924][T14774] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=29972 sclass=netlink_tcpdiag_socket pid=14774 comm=syz.9.2399 [ 678.939998][T14768] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2399'. [ 679.231969][T11467] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.265622][T14796] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2407'. [ 679.301286][T14796] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2407'. [ 679.346876][T11467] usb 7-1: can't set config #1, error -71 [ 679.354979][T11467] usb 7-1: USB disconnect, device number 6 [ 679.395349][T14800] Attempt to restore checkpoint with obsolete wellknown handles [ 679.440709][T14802] Cannot find del_set index 0 as target [ 680.103232][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.159454][T11467] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 680.624945][ T24] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 680.793764][T14825] FAULT_INJECTION: forcing a failure. [ 680.793764][T14825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 680.806816][T14825] CPU: 1 UID: 0 PID: 14825 Comm: syz.7.2417 Tainted: G L syzkaller #0 PREEMPT(full) [ 680.806846][T14825] Tainted: [L]=SOFTLOCKUP [ 680.806853][T14825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 680.806864][T14825] Call Trace: [ 680.806870][T14825] [ 680.806879][T14825] dump_stack_lvl+0x100/0x190 [ 680.806908][T14825] should_fail_ex.cold+0x5/0xa [ 680.806932][T14825] _copy_from_user+0x2e/0xd0 [ 680.806953][T14825] kstrtouint_from_user+0xd6/0x1d0 [ 680.806977][T14825] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 680.806999][T14825] ? __lock_acquire+0x4c5/0x1ec0 [ 680.807029][T14825] ? lock_acquire+0x1b9/0x370 [ 680.807057][T14825] proc_fail_nth_write+0x83/0x220 [ 680.807081][T14825] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 680.807111][T14825] vfs_write+0x2aa/0x1050 [ 680.807131][T14825] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 680.807157][T14825] ? __pfx_vfs_write+0x10/0x10 [ 680.807173][T14825] ? find_held_lock+0x2b/0x80 [ 680.807193][T14825] ? __fget_files+0x215/0x3d0 [ 680.807221][T14825] ? __fget_files+0x21f/0x3d0 [ 680.807251][T14825] ksys_write+0x12a/0x250 [ 680.807270][T14825] ? __pfx_ksys_write+0x10/0x10 [ 680.807296][T14825] do_syscall_64+0x123/0x790 [ 680.807318][T14825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.807336][T14825] RIP: 0033:0x7fd9a435e90e [ 680.807352][T14825] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 680.807369][T14825] RSP: 002b:00007fd9a524cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 680.807387][T14825] RAX: ffffffffffffffda RBX: 00007fd9a524d6c0 RCX: 00007fd9a435e90e [ 680.807399][T14825] RDX: 0000000000000001 RSI: 00007fd9a524d0a0 RDI: 0000000000000005 [ 680.807411][T14825] RBP: 00007fd9a524d090 R08: 0000000000000000 R09: 0000000000000000 [ 680.807421][T14825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 680.807432][T14825] R13: 00007fd9a4626038 R14: 00007fd9a4625fa0 R15: 00007ffd0e6b7008 [ 680.807457][T14825] [ 681.090798][T11467] usb 7-1: Using ep0 maxpacket: 16 [ 681.105047][T14828] netdevsim netdevsim8 netdevsim0: entered allmulticast mode [ 681.313927][T11467] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 681.546598][ T24] usb 10-1: Using ep0 maxpacket: 16 [ 681.778711][T11467] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.789603][T11467] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 681.802390][T11467] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.813197][T11467] usb 7-1: config 0 descriptor?? [ 681.819143][ T30] audit: type=1400 audit(1787183818.976:1267): avc: denied { read } for pid=14826 comm="syz.8.2422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 682.049686][T14842] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2422'. [ 682.479714][ T24] usb 10-1: unable to get BOS descriptor or descriptor too short [ 682.487489][ T24] usb 10-1: New USB device found, idVendor=1410, idProduct=7004, bcdDevice= 6.a2 [ 682.785648][ T30] audit: type=1400 audit(1787183819.946:1268): avc: denied { write } for pid=14853 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 682.837714][T11467] usbhid 7-1:0.0: can't add hid device: -71 [ 682.843709][T11467] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 682.855345][T11467] usb 7-1: USB disconnect, device number 7 [ 682.905934][ T30] audit: type=1400 audit(1787183820.066:1269): avc: denied { write } for pid=14873 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 682.953715][ T24] usb 10-1: config 1 has an invalid interface number: 232 but max is 0 [ 682.961989][ T24] usb 10-1: config 1 has no interface number 0 [ 682.968719][ T24] usb 10-1: config 1 interface 232 has no altsetting 0 [ 683.061319][ T5713] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 683.431905][T14886] netlink: 32 bytes leftover after parsing attributes in process `syz.9.2434'. [ 683.676330][ T30] audit: type=1400 audit(1787183820.796:1270): avc: denied { write } for pid=14878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 683.787719][T14899] ovs-system: entered promiscuous mode [ 683.899844][T14899] netlink: 14 bytes leftover after parsing attributes in process `syz.6.2435'. [ 683.908857][ T30] audit: type=1400 audit(1787183821.056:1271): avc: denied { write } for pid=14907 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 683.952347][T14899] netlink: 9 bytes leftover after parsing attributes in process `syz.6.2435'. [ 683.995964][ T24] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 684.005341][ T5791] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 684.022731][T14899] netlink: 9 bytes leftover after parsing attributes in process `syz.6.2435'. [ 684.082364][T14912] netlink: 140 bytes leftover after parsing attributes in process `syz.6.2439'. [ 684.110323][ T24] usb 10-1: can't set config #1, error -71 [ 684.117496][ T24] usb 10-1: USB disconnect, device number 2 [ 684.458942][ T5791] usb 8-1: device descriptor read/64, error -71 [ 684.692809][ T5713] usb 9-1: unable to get BOS descriptor or descriptor too short [ 684.700505][ T5713] usb 9-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.40 [ 686.197354][ T5791] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 686.326580][ T10] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 686.393718][ T30] audit: type=1400 audit(1787183823.546:1272): avc: denied { write } for pid=14914 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 686.472305][ T30] audit: type=1400 audit(1787183823.626:1273): avc: denied { ioctl } for pid=14935 comm="syz.8.2444" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 ioctlcmd=0x89f0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 686.474538][ T10] usb 10-1: device descriptor read/64, error -71 [ 686.555712][ T5713] usb 9-1: unable to read config index 0 descriptor/all [ 686.562704][ T5713] usb 9-1: can't read configurations, error -71 [ 686.583184][ T30] audit: type=1400 audit(1787183823.736:1274): avc: denied { write } for pid=14939 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 686.676657][T14941] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 686.686292][ T5791] usb 8-1: device descriptor read/64, error -71 [ 686.771882][T14941] overlayfs: missing 'lowerdir' [ 686.909624][ T5791] usb usb8-port1: attempt power cycle [ 687.001662][ T10] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 687.112498][ T30] audit: type=1400 audit(1787183824.156:1275): avc: denied { write } for pid=14948 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 687.187291][ T30] audit: type=1400 audit(1787183824.256:1276): avc: denied { write } for pid=14968 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 687.314655][ T30] audit: type=1326 audit(1787183824.376:1277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14970 comm="syz.8.2450" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 687.370123][ T5791] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 687.426795][ T30] audit: type=1326 audit(1787183824.376:1278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14970 comm="syz.8.2450" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 687.466310][ T10] usb 10-1: device descriptor read/64, error -71 [ 687.530769][ T30] audit: type=1326 audit(1787183824.506:1279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14970 comm="syz.8.2450" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47739e0d9 code=0x7ffc0000 [ 687.583729][ T10] usb usb10-port1: attempt power cycle [ 688.096001][ T5791] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 688.105088][ T5791] usb 8-1: too many configurations: 78, using maximum allowed: 8 [ 688.295657][T14991] FAULT_INJECTION: forcing a failure. [ 688.295657][T14991] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 688.308709][T14991] CPU: 1 UID: 0 PID: 14991 Comm: syz.8.2451 Tainted: G L syzkaller #0 PREEMPT(full) [ 688.308727][T14991] Tainted: [L]=SOFTLOCKUP [ 688.308731][T14991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 688.308737][T14991] Call Trace: [ 688.308742][T14991] [ 688.308746][T14991] dump_stack_lvl+0x100/0x190 [ 688.308764][T14991] should_fail_ex.cold+0x5/0xa [ 688.308779][T14991] _copy_to_user+0x32/0xd0 [ 688.308792][T14991] simple_read_from_buffer+0xcb/0x170 [ 688.308808][T14991] proc_fail_nth_read+0x1af/0x230 [ 688.308823][T14991] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 688.308838][T14991] ? rw_verify_area+0xce/0x6d0 [ 688.308854][T14991] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 688.308868][T14991] vfs_read+0x1e4/0xb40 [ 688.308881][T14991] ? __pfx_vfs_read+0x10/0x10 [ 688.308891][T14991] ? find_held_lock+0x2b/0x80 [ 688.308903][T14991] ? __fget_files+0x215/0x3d0 [ 688.308919][T14991] ? __fget_files+0x21f/0x3d0 [ 688.308936][T14991] ksys_read+0x12a/0x250 [ 688.308947][T14991] ? __pfx_ksys_read+0x10/0x10 [ 688.308963][T14991] do_syscall_64+0x123/0x790 [ 688.308976][T14991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.308987][T14991] RIP: 0033:0x7fc47735e90e [ 688.308998][T14991] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 688.309009][T14991] RSP: 002b:00007fc4781c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 688.309020][T14991] RAX: ffffffffffffffda RBX: 00007fc4781c86c0 RCX: 00007fc47735e90e [ 688.309033][T14991] RDX: 000000000000000f RSI: 00007fc4781c80a0 RDI: 0000000000000008 [ 688.309039][T14991] RBP: 00007fc4781c8090 R08: 0000000000000000 R09: 0000000000000000 [ 688.309046][T14991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 688.309052][T14991] R13: 00007fc477626038 R14: 00007fc477625fa0 R15: 00007ffe358a9cf8 [ 688.309066][T14991] [ 689.266337][ T10] usb usb10-port1: Cannot enable. Maybe the USB cable is bad? [ 689.297408][T10715] block nbd3: Possible stuck request ffff888028b10000: control (read@0,1024B). Runtime 180 seconds [ 689.308148][T10715] block nbd3: Possible stuck request ffff888028b101c0: control (read@1024,1024B). Runtime 180 seconds [ 689.319109][T10715] block nbd3: Possible stuck request ffff888028b10380: control (read@2048,1024B). Runtime 180 seconds [ 689.330091][T10715] block nbd3: Possible stuck request ffff888028b10540: control (read@3072,1024B). Runtime 180 seconds [ 689.494689][ T10] usb 10-1: new low-speed USB device number 6 using dummy_hcd [ 689.532933][ T10] usb 10-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 689.556853][ T10] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 689.584326][ T10] usb 10-1: too many endpoints for config 1 interface 0 altsetting 0: 194, using maximum allowed: 30 [ 689.615027][ T10] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 194 [ 689.661255][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.835029][ T10] mdc800 10-1:1.0: probe fails -> wrong Interface [ 690.172250][ T5791] usb 8-1: unable to read config index 1 descriptor/all [ 690.179461][ T5791] usb 8-1: can't read configurations, error -71 [ 690.193526][ T24] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 690.606816][T15001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 690.645872][T15001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 690.695618][ T10] usb 9-1: new low-speed USB device number 8 using dummy_hcd [ 690.695771][ T29] usb 10-1: USB disconnect, device number 6 [ 690.838832][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 690.838847][ T30] audit: type=1400 audit(1787183827.936:1289): avc: denied { write } for pid=15014 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 690.863760][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 690.955694][ T10] usb 9-1: device descriptor read/64, error -71 [ 691.037358][ T30] audit: type=1400 audit(1787183828.186:1290): avc: denied { write } for pid=15044 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 691.095967][ T24] usb 5-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 691.205529][ T10] usb 9-1: new low-speed USB device number 9 using dummy_hcd [ 691.570934][T15065] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2465'. [ 691.668127][ T10] usb 9-1: device descriptor read/64, error -71 [ 691.764460][ T10] usb usb9-port1: attempt power cycle [ 692.190829][ T10] usb 9-1: new low-speed USB device number 10 using dummy_hcd [ 692.274774][ T30] audit: type=1400 audit(1787183829.346:1291): avc: denied { write } for pid=15050 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.411752][ T10] usb 9-1: device descriptor read/8, error -71 [ 692.470728][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.478758][ T24] usb 5-1: Product: syz [ 692.480550][ T30] audit: type=1400 audit(1787183829.606:1292): avc: denied { write } for pid=15071 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.482908][ T24] usb 5-1: Manufacturer: syz [ 692.482927][ T24] usb 5-1: SerialNumber: syz [ 692.490671][ T24] usb 5-1: config 0 descriptor?? [ 692.664693][ T10] usb 9-1: new low-speed USB device number 11 using dummy_hcd [ 692.851314][ T10] usb 9-1: device descriptor read/8, error -71 [ 693.528466][ T24] gspca_main: sq930x-2.14.0 probing 2770:930c [ 693.625059][ T10] usb usb9-port1: unable to enumerate USB device [ 694.597440][ T24] gspca_sq930x: ucbus_write failed -71 [ 694.603331][ T24] sq930x 5-1:0.0: probe with driver sq930x failed with error -71 [ 694.614624][ T24] usb 5-1: USB disconnect, device number 56 [ 694.670139][T11467] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 695.147562][T15119] netlink: 'syz.7.2476': attribute type 6 has an invalid length. [ 695.252262][ T29] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 696.512985][T12569] Bluetooth: hci5: unexpected event for opcode 0x2011 [ 696.876709][T11467] usb 10-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 696.886166][ T29] usb 9-1: Using ep0 maxpacket: 16 [ 697.226889][ T29] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 697.272065][T15128] FAULT_INJECTION: forcing a failure. [ 697.272065][T15128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 697.285114][T15128] CPU: 1 UID: 0 PID: 15128 Comm: syz.7.2480 Tainted: G L syzkaller #0 PREEMPT(full) [ 697.285139][T15128] Tainted: [L]=SOFTLOCKUP [ 697.285144][T15128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 697.285152][T15128] Call Trace: [ 697.285159][T15128] [ 697.285164][T15128] dump_stack_lvl+0x100/0x190 [ 697.285190][T15128] should_fail_ex.cold+0x5/0xa [ 697.285210][T15128] _copy_from_user+0x2e/0xd0 [ 697.285226][T15128] __sys_bpf+0x2f5/0x4e80 [ 697.285249][T15128] ? __pfx___sys_bpf+0x10/0x10 [ 697.285265][T15128] ? find_held_lock+0x2b/0x80 [ 697.285280][T15128] ? get_pid_task+0xfc/0x250 [ 697.285294][T15128] ? get_pid_task+0xfc/0x250 [ 697.285315][T15128] ? find_held_lock+0x2b/0x80 [ 697.285334][T15128] ? rcu_read_lock_any_held+0x6a/0x90 [ 697.285350][T15128] ? find_held_lock+0x2b/0x80 [ 697.285364][T15128] ? ksys_write+0x190/0x250 [ 697.285379][T15128] ? ksys_write+0x190/0x250 [ 697.285409][T15128] ? fput+0x7c/0x100 [ 697.285429][T15128] ? ksys_write+0x1ac/0x250 [ 697.285447][T15128] ? __x64_sys_bpf+0xce/0x140 [ 697.285462][T15128] __x64_sys_bpf+0xce/0x140 [ 697.285480][T15128] ? do_syscall_64+0xae/0x790 [ 697.285495][T15128] do_syscall_64+0x123/0x790 [ 697.285511][T15128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.285527][T15128] RIP: 0033:0x7fd9a439e0d9 [ 697.285541][T15128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 697.285555][T15128] RSP: 002b:00007fd9a524d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 697.285571][T15128] RAX: ffffffffffffffda RBX: 00007fd9a4625fa0 RCX: 00007fd9a439e0d9 [ 697.285580][T15128] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 697.285590][T15128] RBP: 00007fd9a524d090 R08: 0000000000000000 R09: 0000000000000000 [ 697.285599][T15128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 697.285609][T15128] R13: 00007fd9a4626038 R14: 00007fd9a4625fa0 R15: 00007ffd0e6b7008 [ 697.285630][T15128] [ 697.671435][T11467] usb 10-1: unable to read config index 0 descriptor/all [ 697.678512][T11467] usb 10-1: can't read configurations, error -71 [ 698.393488][ T29] usb 9-1: unable to read config index 0 descriptor/all [ 698.400962][ T29] usb 9-1: can't read configurations, error -71 [ 699.534763][T15156] CIFS: Attempting to mount //127.0.0.1/share [ 699.635024][T15163] CIFS: VFS: \\127.0.0.1 SMB response too short (0 bytes) [ 699.642998][T15156] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 699.652218][T15156] CIFS: VFS: cifs_mount failed w/return code = -11 [ 699.832135][T15168] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 699.841965][T15168] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 700.677117][ T30] audit: type=1400 audit(1787183837.836:1293): avc: denied { nosuid_transition } for pid=15173 comm="syz.8.2491" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process2 permissive=1 [ 700.726608][ T30] audit: type=1400 audit(1787183837.856:1294): avc: denied { transition } for pid=15173 comm="syz.8.2491" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 700.841967][ T30] audit: type=1400 audit(1787183837.856:1295): avc: denied { entrypoint } for pid=15173 comm="syz.8.2491" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1371 scontext=system_u:object_r:hugetlbfs_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 700.871708][ T30] audit: type=1400 audit(1787183837.856:1296): avc: denied { noatsecure } for pid=15173 comm="syz.8.2491" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 701.084633][T15174] syzkaller1: entered promiscuous mode [ 701.090152][T15174] syzkaller1: entered allmulticast mode [ 701.265300][T11467] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 701.773830][T15193] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input82 [ 701.955851][T11467] usb 5-1: Using ep0 maxpacket: 8 [ 702.200978][T11467] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 702.418834][T11467] usb 5-1: config 0 has no interfaces? [ 702.424342][T11467] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.436058][T11467] usb 5-1: config 0 descriptor?? [ 703.048149][ T30] audit: type=1326 audit(1787183839.916:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15196 comm="syz.7.2498" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd9a439e0d9 code=0x0 [ 703.084842][T15206] netlink: 'syz.9.2499': attribute type 1 has an invalid length. [ 703.505752][T15206] 8021q: adding VLAN 0 to HW filter on device bond1 [ 703.641963][T15211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2492'. [ 703.664916][T15211] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 704.903300][T15222] input: syz1 as /devices/virtual/input/input83 [ 704.909577][T15222] input: failed to attach handler leds to device input83, error: -6 [ 705.070122][ T24] usb 5-1: USB disconnect, device number 57 [ 705.444538][T11467] usb 8-1: new low-speed USB device number 17 using dummy_hcd [ 705.474226][T15237] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2507'. [ 705.687354][ T30] audit: type=1400 audit(1787183842.836:1298): avc: denied { getopt } for pid=15228 comm="syz.4.2505" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 705.907267][T11467] usb 8-1: device descriptor read/64, error -71 [ 706.210681][T15249] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2511'. [ 706.258575][T11467] usb 8-1: new low-speed USB device number 18 using dummy_hcd [ 706.323168][T15249] SET target dimension over the limit! [ 708.605297][T15278] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2516'. [ 709.213810][ T30] audit: type=1400 audit(1787183846.366:1299): avc: denied { write } for pid=15235 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 709.568818][T15278] batadv0: entered promiscuous mode [ 709.658103][T15278] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 709.679302][T15278] batadv0: left promiscuous mode [ 709.695188][ T30] audit: type=1400 audit(1787183846.856:1300): avc: denied { write } for pid=15296 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 709.923241][T15302] netlink: 'syz.6.2523': attribute type 2 has an invalid length. [ 709.932827][T15302] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 709.971687][ T5791] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 710.227361][T15321] netlink: 3 bytes leftover after parsing attributes in process `syz.9.2528'. [ 710.252123][T15316] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2527'. [ 710.411952][ T30] audit: type=1400 audit(1787183847.566:1301): avc: denied { write } for pid=15305 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 710.501879][T15333] ieee802154 phy1 wpan1: encryption failed: -22 [ 710.526248][ T30] audit: type=1400 audit(1787183847.686:1302): avc: denied { write } for pid=15332 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 710.689661][ T5791] usb 8-1: Using ep0 maxpacket: 8 [ 710.849192][ T8957] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 710.856964][ T30] audit: type=1400 audit(1787183847.896:1303): avc: denied { getopt } for pid=15342 comm="syz.4.2532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 710.905938][ T5791] usb 8-1: New USB device found, idVendor=056a, idProduct=0047, bcdDevice= 0.00 [ 711.125059][T15347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 711.343929][ T5791] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.354816][ T5791] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 711.365849][ T5791] usb 8-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 711.378690][ T5791] usb 8-1: config 0 interface 0 has no altsetting 0 [ 711.385524][ T5791] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.399005][ T5791] usb 8-1: config 0 descriptor?? [ 711.460001][T15292] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 711.709583][ T8957] usb 7-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 711.745763][ T8957] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.948173][T15352] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2533'. [ 711.958622][T15352] netlink: 17 bytes leftover after parsing attributes in process `syz.9.2533'. [ 711.969177][T15352] tipc: Invalid UDP bearer configuration [ 711.969376][T15352] tipc: Enabling of bearer rejected, failed to enable media [ 712.027334][ T8958] IPVS: starting estimator thread 0... [ 712.104590][T15354] IPVS: sh: FWM 3 0x00000003 - no destination available [ 712.111629][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 712.262483][T15352] netlink: 48 bytes leftover after parsing attributes in process `syz.9.2533'. [ 712.310054][T15353] IPVS: using max 38 ests per chain, 91200 per kthread [ 712.582823][ T8957] wacom 0003:056A:033B.001D: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 712.597115][ T8957] wacom 0003:056A:033B.001D: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.6-1/input0 [ 712.706704][ T8957] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/0003:056A:033B.001D/input/input84 [ 712.708697][ T5791] wacom 0003:056A:0047.001E: Unknown device_type for 'HID 056a:0047'. Assuming pen. [ 712.901516][T15358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 713.026311][T15358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 713.154001][ T5791] wacom 0003:056A:0047.001E: hidraw1: USB HID v0.00 Joystick [HID 056a:0047] on usb-dummy_hcd.7-1/input0 [ 713.167230][ T5791] input: Wacom Intuos2 6x8 Pen as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:056A:0047.001E/input/input87 [ 713.884571][ T10] usb 8-1: USB disconnect, device number 19 [ 714.351222][T15363] comedi: No check for data length of config insn id 2147483647 is implemented [ 714.360215][T15363] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 714.369443][T15363] comedi: Assuming n=23250 is correct [ 714.424029][ T30] audit: type=1400 audit(1787183851.406:1304): avc: denied { write } for pid=15360 comm="syz.9.2534" name="functions" dev="configfs" ino=9318 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 714.447141][ T30] audit: type=1400 audit(1787183851.406:1305): avc: denied { write } for pid=15360 comm="syz.9.2534" name="c.1" dev="configfs" ino=42076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 714.503748][ T30] audit: type=1400 audit(1787183851.406:1306): avc: denied { write } for pid=15360 comm="syz.9.2534" name="c.1" dev="configfs" ino=42076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 714.630754][T15367] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2536'. [ 714.653564][T15367] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2536'. [ 714.662572][T15367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2536'. [ 714.903083][ T10] usb 7-1: USB disconnect, device number 8 [ 715.314615][ T5791] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 715.593115][T15369] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 715.599195][T15369] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 715.605214][T15369] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 715.611226][T15369] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 715.618109][T15369] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 715.624123][T15369] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 715.630050][T15369] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 715.699440][T15369] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 716.728372][ T5791] usb 10-1: Using ep0 maxpacket: 16 [ 716.956932][ T5791] usb 10-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 717.375834][ T5611] Bluetooth: hci1: command 0x0406 tx timeout [ 717.423137][ T5791] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 717.430829][ T5791] usb 10-1: can't read configurations, error -71 [ 717.700748][ T5611] Bluetooth: hci3: command 0x0c1a tx timeout [ 717.706774][ T5611] Bluetooth: hci6: command 0x0c1a tx timeout [ 717.707982][T12569] Bluetooth: hci5: command 0x0c1a tx timeout [ 717.726978][T15403] bridge0: port 3(veth0) entered blocking state [ 717.742544][T15403] bridge0: port 3(veth0) entered disabled state [ 717.769835][T12569] Bluetooth: hci2: command 0x040f tx timeout [ 717.771528][ T5611] Bluetooth: hci0: command 0x0c1a tx timeout [ 718.299516][T15407] netlink: 'syz.4.2544': attribute type 1 has an invalid length. [ 718.364166][T15408] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2544'. [ 718.483578][T15403] veth0: entered allmulticast mode [ 718.490623][T15403] veth0: entered promiscuous mode [ 718.496158][T15403] bridge0: port 3(veth0) entered blocking state [ 718.502493][T15403] bridge0: port 3(veth0) entered forwarding state [ 718.559006][T15407] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 719.110006][T15433] bridge0: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 719.199232][T15433] trusted_key: encrypted_key: hex blob is missing [ 719.512951][T15415] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 719.555886][T15415] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 719.583959][T15415] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 719.591050][T15415] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 719.600712][T15415] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 719.607690][T15415] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 719.848935][T10715] block nbd3: Possible stuck request ffff888028b10000: control (read@0,1024B). Runtime 210 seconds [ 719.859690][T10715] block nbd3: Possible stuck request ffff888028b101c0: control (read@1024,1024B). Runtime 210 seconds [ 719.870646][T10715] block nbd3: Possible stuck request ffff888028b10380: control (read@2048,1024B). Runtime 210 seconds [ 719.881624][T10715] block nbd3: Possible stuck request ffff888028b10540: control (read@3072,1024B). Runtime 210 seconds [ 720.075089][T11467] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 720.536236][T11467] usb 7-1: device descriptor read/64, error -71 [ 721.264357][T12569] Bluetooth: hci1: command 0x0406 tx timeout [ 721.349806][T11467] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 721.582077][T12569] Bluetooth: hci3: command 0x0c1a tx timeout [ 721.773497][ T5611] Bluetooth: hci6: command 0x0c1a tx timeout [ 721.774580][ T50] Bluetooth: hci2: command 0x040f tx timeout [ 721.779533][ T5611] Bluetooth: hci0: command 0x0c1a tx timeout [ 721.779561][ T5611] Bluetooth: hci5: command 0x0c1a tx timeout [ 722.462728][T11467] usb 7-1: device descriptor read/64, error -71 [ 722.498961][T15453] fuse: Unknown parameter '00000000000000000000' [ 722.746585][T11467] usb usb7-port1: attempt power cycle [ 723.145859][T15465] input: syz1 as /devices/virtual/input/input90 [ 723.155265][ T30] audit: type=1400 audit(1787183860.316:1307): avc: denied { append } for pid=15464 comm="syz.7.2567" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 723.234598][ T30] audit: type=1400 audit(1787183860.316:1308): avc: denied { ioctl } for pid=15464 comm="syz.7.2567" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 723.889263][ T50] Bluetooth: hci6: command 0x0c1a tx timeout [ 724.304278][T15468] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 724.335200][T15468] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 724.342156][T15468] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 724.349592][T15468] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 724.357587][T15468] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 724.364732][T15468] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 724.510212][T15488] Cannot find del_set index 0 as target [ 724.517015][T15488] netlink: 84 bytes leftover after parsing attributes in process `syz.9.2574'. [ 724.641144][T15493] loop4: detected capacity change from 0 to 7 [ 724.723668][T15493] loop4: [ 724.726650][T15493] loop4: partition table partially beyond EOD, truncated [ 724.849825][ T4963] loop4: [ 724.852815][ T4963] loop4: partition table partially beyond EOD, truncated [ 724.864255][ T30] audit: type=1326 audit(1787183862.016:1309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15499 comm="syz.4.2579" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb061b9e0d9 code=0x0 [ 724.936182][ T5791] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 725.374682][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 725.412750][T15511] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2581'. [ 725.595490][T15511] xt_l2tp: v2 tid > 0xffff: 134217728 [ 725.826870][T15520] syzkaller0: entered promiscuous mode [ 725.832369][T15520] syzkaller0: entered allmulticast mode [ 725.840228][T15520] tipc: Started in network mode [ 725.845153][T15520] tipc: Node identity a212f514e87b, cluster identity 4711 [ 725.893467][T15520] tipc: Enabled bearer , priority 0 [ 725.986541][T11467] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 726.100137][ T5791] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 726.330189][ T5791] usb 9-1: config 0 has no interfaces? [ 726.335688][ T5791] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.346082][ T5791] usb 9-1: config 0 descriptor?? [ 726.414815][ T50] Bluetooth: hci6: command 0x0c1a tx timeout [ 726.414922][ T5606] Bluetooth: hci2: command 0x040f tx timeout [ 726.421617][T12569] Bluetooth: hci0: command 0x0c1a tx timeout [ 726.428000][ T5606] Bluetooth: hci5: command 0x0c1a tx timeout [ 726.440588][ T5606] Bluetooth: hci3: command 0x0c1a tx timeout [ 726.582009][ T24] usb 9-1: USB disconnect, device number 14 [ 726.633285][T15527] openvswitch: ovs-system: Dropping previously announced user features [ 726.646269][T15527] netlink: 14 bytes leftover after parsing attributes in process `syz.8.2587'. [ 726.657287][T15527] netlink: 9 bytes leftover after parsing attributes in process `syz.8.2587'. [ 726.684104][T11467] usb 8-1: Using ep0 maxpacket: 8 [ 726.690891][T15527] netlink: 9 bytes leftover after parsing attributes in process `syz.8.2587'. [ 726.737534][T15529] overlayfs: workdir and upperdir must be separate subtrees [ 726.748289][ T30] audit: type=1400 audit(1787183863.906:1310): avc: denied { listen } for pid=15528 comm="syz.8.2588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 726.772899][ T30] audit: type=1400 audit(1787183863.926:1311): avc: denied { accept } for pid=15528 comm="syz.8.2588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 726.817093][T15523] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 726.823160][T15523] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 726.829176][T15523] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 726.835179][T15523] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 726.841171][T15523] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 726.847171][T15523] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 726.931332][T11467] usb 8-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 727.051299][ T24] tipc: Node number set to 1248458004 [ 727.388017][T11467] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 727.398299][T11467] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 727.407625][T11467] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 728.763802][T12569] Bluetooth: hci1: command 0x0406 tx timeout [ 728.795008][T15549] loop9: detected capacity change from 0 to 2640 [ 728.801913][T15549] buffer_io_error: 24 callbacks suppressed [ 728.801928][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.815538][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.823352][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.831161][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.838971][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.846805][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.854624][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.862427][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 728.870222][T15549] ldm_validate_partition_table(): Disk read failed. [ 728.994218][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 729.002071][T15549] Buffer I/O error on dev loop9, logical block 0, async page read [ 729.009902][T15549] Dev loop9: unable to read RDB block 0 [ 729.015595][T15549] loop9: unable to read partition table [ 729.021384][T15549] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 729.041920][T12569] Bluetooth: hci6: command 0x0c1a tx timeout [ 729.041948][ T50] Bluetooth: hci2: command 0x040f tx timeout [ 729.047927][T12569] Bluetooth: hci0: command 0x0c1a tx timeout [ 729.053883][ T50] Bluetooth: hci5: command 0x0c1a tx timeout [ 729.059829][T12569] Bluetooth: hci3: command 0x0c1a tx timeout [ 729.474132][T11467] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.482149][T11467] usb 8-1: Product: syz [ 729.486285][T11467] usb 8-1: Manufacturer: syz [ 729.512124][T15559] FAULT_INJECTION: forcing a failure. [ 729.512124][T15559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 729.546286][T15559] CPU: 0 UID: 0 PID: 15559 Comm: syz.8.2597 Tainted: G L syzkaller #0 PREEMPT(full) [ 729.546315][T15559] Tainted: [L]=SOFTLOCKUP [ 729.546321][T15559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 729.546330][T15559] Call Trace: [ 729.546336][T15559] [ 729.546343][T15559] dump_stack_lvl+0x100/0x190 [ 729.546369][T15559] should_fail_ex.cold+0x5/0xa [ 729.546392][T15559] _copy_from_iter+0x1f4/0x1690 [ 729.546413][T15559] ? __asan_memset+0x23/0x50 [ 729.546433][T15559] ? __pfx__copy_from_iter+0x10/0x10 [ 729.546451][T15559] ? __pfx___alloc_skb+0x10/0x10 [ 729.546479][T15559] netlink_sendmsg+0x808/0xda0 [ 729.546510][T15559] ? __pfx_netlink_sendmsg+0x10/0x10 [ 729.546539][T15559] ? selinux_socket_sendmsg+0x198/0x2f0 [ 729.546569][T15559] ____sys_sendmsg+0xa4d/0xbe0 [ 729.546592][T15559] ? __pfx_netlink_sendmsg+0x10/0x10 [ 729.546627][T15559] ? __pfx_____sys_sendmsg+0x10/0x10 [ 729.546662][T15559] ___sys_sendmsg+0x190/0x1e0 [ 729.546688][T15559] ? __pfx____sys_sendmsg+0x10/0x10 [ 729.546711][T15559] ? get_pid_task+0x106/0x250 [ 729.546738][T15559] ? find_held_lock+0x2b/0x80 [ 729.546772][T15559] __sys_sendmsg+0x160/0x210 [ 729.546791][T15559] ? __pfx___sys_sendmsg+0x10/0x10 [ 729.546822][T15559] do_syscall_64+0x123/0x790 [ 729.546842][T15559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.546860][T15559] RIP: 0033:0x7fc47739e0d9 [ 729.546875][T15559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.546892][T15559] RSP: 002b:00007fc4781c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 729.546910][T15559] RAX: ffffffffffffffda RBX: 00007fc477625fa0 RCX: 00007fc47739e0d9 [ 729.546921][T15559] RDX: 00000000200000d4 RSI: 0000200000000100 RDI: 0000000000000003 [ 729.546932][T15559] RBP: 00007fc4781c8090 R08: 0000000000000000 R09: 0000000000000000 [ 729.546942][T15559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 729.546952][T15559] R13: 00007fc477626038 R14: 00007fc477625fa0 R15: 00007ffe358a9cf8 [ 729.546975][T15559] [ 729.572839][T15561] openvswitch: ovs-system: Dropping previously announced user features [ 729.589445][T11467] usb 8-1: can't set config #1, error -71 [ 729.828349][T11467] usb 8-1: USB disconnect, device number 20 [ 729.848117][T15561] netlink: 14 bytes leftover after parsing attributes in process `syz.7.2598'. [ 730.029332][T15567] netlink: 9 bytes leftover after parsing attributes in process `syz.7.2598'. [ 730.052825][T15567] netlink: 9 bytes leftover after parsing attributes in process `syz.7.2598'. [ 731.432844][ T30] audit: type=1400 audit(1787183868.436:1312): avc: denied { getopt } for pid=15570 comm="syz.8.2602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 732.789180][T15566] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 732.795230][T15566] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 732.801235][T15566] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 732.807237][T15566] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 732.813229][T15566] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 732.819230][T15566] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 732.934039][T15587] tipc: Enabling of bearer rejected, already enabled [ 732.988071][T15590] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 732.999923][ T30] audit: type=1400 audit(1787183870.116:1313): avc: denied { getopt } for pid=15589 comm="syz.4.2609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 733.043131][ T30] audit: type=1400 audit(1787183870.176:1314): avc: denied { accept } for pid=15588 comm="syz.7.2607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 733.173398][ T8957] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 733.389797][T15609] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2615'. [ 733.473858][ T5791] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 734.065271][ T8957] usb 9-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 1.00 [ 734.084777][ T8957] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 734.162570][ T5791] usb 7-1: Using ep0 maxpacket: 32 [ 734.166423][ T8957] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 734.176628][ T8957] usb 9-1: Product: syz [ 734.181248][ T8957] usb 9-1: Manufacturer: syz [ 734.392460][ T5791] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 734.402718][ T8957] msi2500 9-1:1.0: Registered as swradio24 [ 734.408572][ T8957] msi2500 9-1:1.0: SDR API is still slightly experimental and functionality changes may follow [ 734.643224][ T5692] usb 9-1: USB disconnect, device number 15 [ 734.652397][T15639] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2625'. [ 734.681194][T15641] netlink: 92 bytes leftover after parsing attributes in process `syz.7.2626'. [ 734.836068][T15525] Bluetooth: hci2: command 0x040f tx timeout [ 734.842690][T15525] Bluetooth: hci0: command 0x0c1a tx timeout [ 734.849466][T15525] Bluetooth: hci5: command 0x0c1a tx timeout [ 734.849584][ T5791] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 734.855962][T15525] Bluetooth: hci3: command 0x0c1a tx timeout [ 734.863511][ T5791] usb 7-1: config 0 has no interface number 0 [ 734.863565][ T5791] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 734.863592][ T5791] usb 7-1: config 0 interface 85 has no altsetting 0 [ 734.863729][T12569] Bluetooth: hci6: command 0x0c1a tx timeout [ 734.863780][T12569] Bluetooth: hci1: command 0x0406 tx timeout [ 735.895130][ T5791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.903158][ T5791] usb 7-1: Product: syz [ 735.907324][ T5791] usb 7-1: Manufacturer: syz [ 735.911922][ T5791] usb 7-1: SerialNumber: syz [ 735.928625][ T5791] usb 7-1: config 0 descriptor?? [ 736.262436][T15655] nbd4: detected capacity change from 0 to 63 [ 736.355826][ T5791] appletouch 7-1:0.85: Failed to read mode from device. [ 736.362971][ T5791] appletouch 7-1:0.85: probe with driver appletouch failed with error -5 [ 736.374764][T15525] block nbd4: Receive control failed (result -104) [ 736.473753][T11467] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 736.507847][ T24] libceph: connect (1)[c::]:6789 error -101 [ 736.513919][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 736.593808][ T5791] usb 7-1: USB disconnect, device number 12 [ 736.594784][ T8958] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 736.666802][T15671] ceph: No mds server is up or the cluster is laggy [ 736.978401][T15697] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 737.050706][ T8958] usb 8-1: Using ep0 maxpacket: 32 [ 737.088506][T15701] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2650'. [ 737.171966][T11467] usb 10-1: Using ep0 maxpacket: 16 [ 737.178264][T15697] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 737.264691][ T8958] usb 8-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 737.288085][T15707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 737.387441][T11467] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 737.396812][ T5791] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 737.477213][ T8958] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 737.514561][ T8958] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.534453][ T8958] usb 8-1: Product: syz [ 737.538839][ T8958] usb 8-1: Manufacturer: syz [ 737.543590][ T8958] usb 8-1: SerialNumber: syz [ 737.578372][ T8958] snd-ua101 8-1:1.1: sample format descriptor not found [ 737.586489][ T8958] snd-ua101 8-1:1.0: invalid num_altsetting [ 737.807643][T15667] ALSA: seq fatal error: cannot create timer (-22) [ 737.848948][T11467] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 737.859166][T11467] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 737.870139][T11467] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 737.879862][T11467] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 737.883874][T15667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.889590][T11467] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 737.926472][T15667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.311154][T11467] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 738.320871][T11467] usb 10-1: Manufacturer: syz [ 738.327735][ T5791] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 738.337930][T11467] usb 10-1: config 0 descriptor?? [ 738.452293][T15720] netlink: 96 bytes leftover after parsing attributes in process `syz.8.2656'. [ 738.467684][T15720] vlan2: entered allmulticast mode [ 738.472837][T15720] gretap0: entered allmulticast mode [ 738.595782][ T8958] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 738.613580][T15724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.624433][T15724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.776878][ T5791] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.788115][ T5791] usb 5-1: config 0 descriptor?? [ 738.834409][ T8958] usb 7-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 1.00 [ 738.992966][ T8958] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.032434][ T8958] usb 7-1: Product: syz [ 739.051194][ T8958] usb 7-1: Manufacturer: syz [ 739.122676][ T8958] usb 7-1: SerialNumber: syz [ 739.343013][T11467] rc_core: IR keymap rc-hauppauge not found [ 739.348964][T11467] Registered IR keymap rc-empty [ 739.354283][T11467] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 739.443862][ T8958] ums_eneub6250 7-1:1.0: USB Mass Storage device detected [ 739.478357][T11467] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 739.599847][ T8958] scsi host1: usb-storage 7-1:1.0 [ 739.637776][ T8958] list_add double add: new=ffff88804047fc18, prev=ffff88804047fc18, next=ffff8880564ea078. [ 739.648795][ T8958] ------------[ cut here ]------------ [ 739.654270][ T8958] kernel BUG at lib/list_debug.c:35! [ 739.659559][ T8958] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 739.665973][ T8958] CPU: 0 UID: 0 PID: 8958 Comm: kworker/0:11 Tainted: G L syzkaller #0 PREEMPT(full) [ 739.676989][ T8958] Tainted: [L]=SOFTLOCKUP [ 739.681285][ T8958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 739.691312][ T8958] Workqueue: usb_hub_wq hub_event [ 739.696319][ T8958] RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 [ 739.703060][ T8958] Code: eb ff 90 0f 0b 48 c7 c7 00 24 60 8c e8 ba e6 eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 26 60 8c e8 a2 e6 eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 27 60 8c e8 90 e6 eb ff 90 0f 0b 48 89 [ 739.722641][ T8958] RSP: 0018:ffffc900064d6c20 EFLAGS: 00010082 [ 739.728683][ T8958] RAX: 0000000000000058 RBX: ffff8880564ea078 RCX: 0000000000000000 [ 739.736627][ T8958] RDX: 0000000000000058 RSI: ffffffff81e8c2e9 RDI: fffff52000c9ad75 [ 739.744569][ T8958] RBP: ffff88804047fc18 R08: 0000000000000007 R09: 0000000000000000 [ 739.752522][ T8958] R10: 8000000000000002 R11: fffffffffffcd3f8 R12: ffff8880564ea080 [ 739.760470][ T8958] R13: ffff88804047fc18 R14: 0000000000000000 R15: ffff88804047fc18 [ 739.768424][ T8958] FS: 0000000000000000(0000) GS:ffff888123bd4000(0000) knlGS:0000000000000000 [ 739.777327][ T8958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 739.783896][ T8958] CR2: 00007f3b5b1eb7c0 CR3: 000000007e4c4000 CR4: 00000000003526f0 [ 739.791844][ T8958] Call Trace: [ 739.795097][ T8958] [ 739.798015][ T8958] usb_hcd_link_urb_to_ep+0x220/0x3a0 [ 739.803369][ T8958] dummy_urb_enqueue+0x2b5/0x880 [ 739.808296][ T8958] ? usb_hcd_map_urb_for_dma+0x1c0/0x1190 [ 739.813999][ T8958] ? _raw_spin_unlock_irq_enable+0x56/0x90 [ 739.819784][ T8958] usb_hcd_submit_urb+0x268/0x2150 [ 739.824885][ T8958] usb_submit_urb+0x827/0x19b0 [ 739.829638][ T8958] ? __init_swait_queue_head+0xca/0x150 [ 739.835161][ T8958] usb_stor_msg_common+0x241/0x560 [ 739.840250][ T8958] ? __pfx_usb_stor_msg_common+0x10/0x10 [ 739.845874][ T8958] usb_stor_bulk_transfer_buf+0x17c/0x420 [ 739.851583][ T8958] ene_send_scsi_cmd+0x12b/0x610 [ 739.856506][ T8958] ? __pfx_ene_send_scsi_cmd+0x10/0x10 [ 739.861967][ T8958] ? __asan_memset+0x23/0x50 [ 739.866552][ T8958] ene_ub6250_probe+0x2c0/0x430 [ 739.871398][ T8958] ? lockdep_hardirqs_on+0x7d/0x110 [ 739.876583][ T8958] ? __pfx_ene_ub6250_probe+0x10/0x10 [ 739.881932][ T8958] ? __pm_runtime_set_status+0x13c/0x970 [ 739.887548][ T8958] usb_probe_interface+0x303/0x8f0 [ 739.892636][ T8958] ? __pfx_usb_probe_interface+0x10/0x10 [ 739.898246][ T8958] really_probe+0x241/0xa60 [ 739.902724][ T8958] __driver_probe_device+0x20e/0x450 [ 739.907996][ T8958] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 739.913865][ T8958] driver_probe_device+0x4a/0x140 [ 739.918876][ T8958] __device_attach_driver+0x1df/0x320 [ 739.924236][ T8958] ? __pfx___device_attach_driver+0x10/0x10 [ 739.930104][ T8958] bus_for_each_drv+0x159/0x1e0 [ 739.934930][ T8958] ? __pfx_bus_for_each_drv+0x10/0x10 [ 739.940281][ T8958] ? lockdep_hardirqs_on+0x7d/0x110 [ 739.945464][ T8958] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 739.951253][ T8958] __device_attach+0x1e4/0x4d0 [ 739.955991][ T8958] ? __pfx___device_attach+0x10/0x10 [ 739.961251][ T8958] ? do_raw_spin_unlock+0x145/0x1e0 [ 739.966441][ T8958] device_initial_probe+0xaf/0xd0 [ 739.971441][ T8958] bus_probe_device+0x64/0x160 [ 739.976185][ T8958] device_add+0x121d/0x1970 [ 739.980678][ T8958] ? __pfx_device_add+0x10/0x10 [ 739.985519][ T8958] usb_set_configuration+0xd97/0x1c60 [ 739.990869][ T8958] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 739.996913][ T8958] usb_generic_driver_probe+0xa1/0xe0 [ 740.002264][ T8958] usb_probe_device+0xef/0x400 [ 740.007016][ T8958] ? __pfx_usb_probe_device+0x10/0x10 [ 740.012373][ T8958] really_probe+0x241/0xa60 [ 740.016863][ T8958] __driver_probe_device+0x20e/0x450 [ 740.022121][ T8958] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 740.028002][ T8958] driver_probe_device+0x4a/0x140 [ 740.033010][ T8958] __device_attach_driver+0x1df/0x320 [ 740.038357][ T8958] ? __pfx___device_attach_driver+0x10/0x10 [ 740.044220][ T8958] bus_for_each_drv+0x159/0x1e0 [ 740.049049][ T8958] ? __pfx_bus_for_each_drv+0x10/0x10 [ 740.054413][ T8958] ? lockdep_hardirqs_on+0x7d/0x110 [ 740.059602][ T8958] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 740.065401][ T8958] __device_attach+0x1e4/0x4d0 [ 740.070136][ T8958] ? __pfx___device_attach+0x10/0x10 [ 740.075397][ T8958] device_initial_probe+0xaf/0xd0 [ 740.080404][ T8958] bus_probe_device+0x64/0x160 [ 740.085147][ T8958] device_add+0x121d/0x1970 [ 740.089634][ T8958] ? __pfx_device_add+0x10/0x10 [ 740.094465][ T8958] ? add_device_randomness+0xc9/0x110 [ 740.099815][ T8958] usb_new_device.part.0+0xcc2/0x1686 [ 740.105163][ T8958] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 740.110954][ T8958] ? preempt_schedule_thunk+0x16/0x40 [ 740.116298][ T8958] hub_event.cold+0x1e3/0xe90 [ 740.120961][ T8958] ? __pfx_hub_event+0x10/0x10 [ 740.125707][ T8958] ? debug_object_deactivate+0x2e4/0x3b0 [ 740.131325][ T8958] ? rcu_is_watching+0x13/0xc0 [ 740.136063][ T8958] process_one_work+0xa23/0x1940 [ 740.140987][ T8958] ? __pfx_process_one_work+0x10/0x10 [ 740.146345][ T8958] ? __pfx_hub_event+0x10/0x10 [ 740.151089][ T8958] worker_thread+0x5ef/0xe50 [ 740.155658][ T8958] ? kthread+0x13a/0x450 [ 740.159896][ T8958] ? __pfx_worker_thread+0x10/0x10 [ 740.164980][ T8958] kthread+0x373/0x450 [ 740.169020][ T8958] ? __pfx_kthread+0x10/0x10 [ 740.173593][ T8958] ret_from_fork+0x730/0xd60 [ 740.178160][ T8958] ? __pfx_ret_from_fork+0x10/0x10 [ 740.183252][ T8958] ? rcu_is_watching+0x13/0xc0 [ 740.187990][ T8958] ? __switch_to+0x800/0x10f0 [ 740.192648][ T8958] ? __pfx_kthread+0x10/0x10 [ 740.197211][ T8958] ret_from_fork_asm+0x1a/0x30 [ 740.201969][ T8958] [ 740.204981][ T8958] Modules linked in: [ 740.208887][ T8958] ---[ end trace 0000000000000000 ]--- [ 740.214327][ T8958] RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 [ 740.221105][ T8958] Code: eb ff 90 0f 0b 48 c7 c7 00 24 60 8c e8 ba e6 eb ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 26 60 8c e8 a2 e6 eb ff 90 <0f> 0b 48 89 de 48 c7 c7 00 27 60 8c e8 90 e6 eb ff 90 0f 0b 48 89 [ 740.240700][ T8958] RSP: 0018:ffffc900064d6c20 EFLAGS: 00010082 [ 740.246749][ T8958] RAX: 0000000000000058 RBX: ffff8880564ea078 RCX: 0000000000000000 [ 740.254693][ T8958] RDX: 0000000000000058 RSI: ffffffff81e8c2e9 RDI: fffff52000c9ad75 [ 740.262653][ T8958] RBP: ffff88804047fc18 R08: 0000000000000007 R09: 0000000000000000 [ 740.270600][ T8958] R10: 8000000000000002 R11: fffffffffffcd3f8 R12: ffff8880564ea080 [ 740.278564][ T8958] R13: ffff88804047fc18 R14: 0000000000000000 R15: ffff88804047fc18 [ 740.286513][ T8958] FS: 0000000000000000(0000) GS:ffff888123bd4000(0000) knlGS:0000000000000000 [ 740.295431][ T8958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 740.301993][ T8958] CR2: 00007f3b5b1eb7c0 CR3: 000000007e4c4000 CR4: 00000000003526f0 [ 740.309944][ T8958] Kernel panic - not syncing: Fatal exception [ 741.385399][ T8958] Shutting down cpus with NMI [ 741.390315][ T8958] Kernel Offset: disabled [ 741.394618][ T8958] Rebooting in 86400 seconds..