last executing test programs: 10.022619287s ago: executing program 2 (id=49): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002214c6a0009050702000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="40012e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000080000000c"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYRES64=r1, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000954bbe20d9107255f2df0b060dbe713d045d08133cf2b87dfe381f9bf69deed2004d7c9196997ca560b395abfdc3d59b822caa95597e670ab4464c4cd75902ba272b40b2e1ac660aaeb5e1332ea13e7c16a752fb90ef096a1d48f97d0b6eb47985b711ad9341361c3d183a7100af5f084f9d75a8e4f5696d669c8ed28f0f5c14013046cc8d287dbbecf711b2dc22dc7cef0ef3d91ed550e4bf18d992b1"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000002c0)='rxrpc_peer\x00', r2}, 0x18) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@isdn={0x22, 0x5, 0x8f, 0xfc}, 0x80, 0x0, 0x0, &(0x7f0000000140)=[{0x18, 0x110, 0x1, 'p'}], 0x18}, 0x0) 9.668775319s ago: executing program 4 (id=50): bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1f00000004000000060000000700000080130000", @ANYRES32, @ANYBLOB="0000000000000000008000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000001"], 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f0006", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[], 0xfe33) syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) socket$l2tp(0x2, 0x2, 0x73) pipe2$watch_queue(&(0x7f0000000280), 0x80) keyctl$clear(0x3, 0xffffffffffffffff) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$MRT_DEL_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd3, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x10) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x44}}, 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) writev(r10, &(0x7f0000001500)=[{&(0x7f0000001540)="f9", 0x1}], 0x1) 9.234512352s ago: executing program 1 (id=53): syz_emit_ethernet(0x106, &(0x7f0000000100)=ANY=[], 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1) r0 = accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) sched_setattr(0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = dup(r1) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0000000206030000000000fffff000000000000900020073797a32000100000500040000000000050005000200000010000300686173683a69702c6d616300050001000700000014000780080013400000000008001240"], 0x5c}}, 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r3, 0x0, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x40) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) 8.692128332s ago: executing program 3 (id=55): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000b00)=ANY=[], 0x58}, 0x1, 0x7}, 0x0) ioctl(r0, 0x0, &(0x7f0000000080)="2ff0b8baea8ea349d8c13bc3c906e6ae830f93518e94da80951a27a49a5e66389d76a052160eec115e0baddc7313a305264d46c947a2471a6edffdfaed70fe3b560d2995a1be45c6d07e997ac5aa7972b2580983182106") 8.630260648s ago: executing program 3 (id=56): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket(0xa, 0x5, 0x0) socketpair(0x22, 0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) r3 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r4, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000240)={r0}) syz_usb_disconnect(r3) sendfile(r2, r2, 0x0, 0xb1d) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_FLAGS={0x8}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_DYNSET_OP={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x90}}, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ed5696c5820fcbd28dc42aff610e8002009943e53ece1959", 0x18) openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 8.26889432s ago: executing program 0 (id=57): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x2}}}}]}, 0x40}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) socket$nl_rdma(0x10, 0x3, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000180)}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYRESHEX=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10001, @loopback, 0xe}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000004440)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, 0x0, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000380)}], 0x1) sendto$inet6(r4, &(0x7f0000000700)='\x00', 0x1, 0x4090, 0x0, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x80c0) 7.410395646s ago: executing program 0 (id=58): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) socketpair(0x18, 0x0, 0x2, &(0x7f0000000000)) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f000000b000/0x4000)=nil, 0x4000, 0x1, 0x12, r3, 0x1000) readlinkat(r3, 0x0, &(0x7f00000001c0)=""/5, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000026000000080000000b"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a80)={0xffffffffffffffff, &(0x7f0000000700), 0x0}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@bridge_getvlan={0x20, 0x72, 0x301, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0xf00, 0x0, 0x20000010}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r4}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB, @ANYBLOB], 0x1c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200001032abd7000ffdbdf250a000000000100080000"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r8, 0x89f1, &(0x7f00000003c0)={'wg0\x00', &(0x7f0000000300)=@ethtool_channels={0x3c, 0x8001, 0x1, 0x4, 0x7, 0x80000001, 0x106, 0x80004, 0x7}}) 7.409985949s ago: executing program 1 (id=59): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) epoll_create1(0x80000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141101) dup(r0) userfaultfd(0x80001) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x11000) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000001780), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x40, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0xc7) mount$nfs(&(0x7f0000000040)='@\a', &(0x7f0000000340)='./file1\x00', 0x0, 0x20887b, 0x0) mount$nfs(&(0x7f0000000080)='@\a', &(0x7f00000000c0)='./file1\x00', &(0x7f0000000500), 0x20040c1, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x2, 0xd, &(0x7f0000000180)=@raw=[@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x76e}}, @generic={0xf7, 0x8, 0x5, 0xf7a, 0x7eae}, @map_idx={0x18, 0x8, 0x5, 0x0, 0xc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x11d}], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040)) 6.005565639s ago: executing program 0 (id=60): syz_usb_connect(0x0, 0x276, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x62, 0x5a, 0xb9, 0x10, 0x403, 0xa54b, 0x4073, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x264, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x7e, 0x0, 0xd, 0xe5, 0xdb, 0x6, 0x0, [], [{{0x9, 0x5, 0x84, 0x2, 0x3ff, 0xe, 0x81, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x2, 0x6}]}}, {{0x9, 0x5, 0x0, 0x2, 0x3ff, 0x6, 0x4, 0x83, [@generic={0xd9, 0x22, "a631469cadd41e75a5c1decc89f957dce2bfa78012d62e3b2b0db605824ba17935a86dc4c9a4678fa8fff242214410ecc82da8505886b3f25a821e53f63b21b31ecdaaf0e53406317956a0e03ba3bd6c4c9d7b73078575549de820df85b14ca66d8ec59c1802924f0994949be1b804ffeb1d3622fd5dacebb07f870da37636a12aa8c739cf0198aac7421591df1d5c373cdebbdd272cc87af527d739b6dcb9961dcaef64a86b760f4b7a57d620a4f8f0bc957dd1954f4f4209de354b9f7109b04d5d0d97d7c3e494fa51f9956ee6e530d1582c73fa04a2"}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x7f}]}}, {{0x9, 0x5, 0x9, 0x0, 0x20, 0x8, 0xfb, 0x66}}, {{0x9, 0x5, 0x4, 0xc69a350591d7ba4b, 0x40, 0x1c, 0x6, 0x22}}, {{0x9, 0x5, 0xa, 0x10, 0x8, 0x3, 0x1, 0xf8, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0xff, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x0, 0x800}]}}, {{0x9, 0x5, 0x80, 0x10, 0x400, 0x5, 0x1}}, {{0x9, 0x5, 0x5, 0x0, 0x200, 0x8f, 0x4, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x0, 0x6}]}}, {{0x9, 0x5, 0xe, 0x8, 0x20, 0x2, 0x4, 0xba}}, {{0x9, 0x5, 0x1, 0x0, 0x8, 0x9, 0x3, 0xc, [@generic={0xda, 0xa, "4cbfab08c9079dc1a5e017bfb319cce31123e1f92167167aaa9eaa79a4794b314cfd7ae7dad8003f88e17851fc3f1b1203ce00c5a137e2f8544e31e7d5353e110909c4ba1fb1f2d5bb1a749b8bda397125ccd35b5564a7d3d61e9c69385db3af9f7638b91046842f2fecc46f1a7408ff96f3e99bce2f1367888f4050b971fb6857350cc4056b4264818274117fad6fbcc07acc3fa3d7c1cc6e2dbb034ad57e3d60de70a8b0c3b3d4f3a087e2e7ca3f211fd3599547384962ee45f057122729664edc6b45773a8e17e43793c657acd9848af33c08cfcb136e"}]}}, {{0x9, 0x5, 0x2, 0x3, 0x8, 0x1, 0x40, 0xeb}}, {{0x9, 0x5, 0x6, 0x10, 0x3ff, 0x5, 0x9, 0x40}}, {{0x9, 0x5, 0xb, 0x4, 0x200, 0x7, 0x0, 0x5c}}, {{0x9, 0x5, 0xa, 0x2e5adbb81b45a417, 0x40, 0x2, 0x2, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0x1ff}]}}]}}]}}]}}, 0x0) 5.960971429s ago: executing program 2 (id=61): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000200)={0x200000, 0x0, 0x2b}, 0x17) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 5.818460493s ago: executing program 2 (id=62): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x242580, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_PTRACER(0x59616d61, 0x0) r3 = socket(0x2, 0x80805, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendmmsg$inet(r3, &(0x7f0000000900)=[{{&(0x7f0000000080)={0x2, 0x4, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000001040)='l', 0x1}], 0x1}}], 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)={0x14, 0x34, 0x701, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4004840}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) 5.794525155s ago: executing program 4 (id=63): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) connect$can_j1939(r3, &(0x7f0000000440)={0x1d, r4, 0x1, {0x0, 0xff, 0x4}, 0xfd}, 0x18) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r7, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000280)={r7, r7, 0x1, 0x0, 0x0, 0x48, 0x1, 0x15c2, 0x8, 0x8, 0xecf5ee2b324e3e2d, 0x42, 'syz0\x00'}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x10, 0x0, &(0x7f0000000180)=[@request_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @fd={0x66642a85, 0x0, r5}, @flat=@binder={0x73622a85, 0x100}}, &(0x7f0000000200)={0xfffffca4, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0x0, 0x0, 0x0}) r8 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) r9 = syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_S_TUNER(r9, 0x4054561e, &(0x7f0000000b40)={0xfffffffc, "b992447f1252bbde728df2362be6d0f5c49cd29346b53475cf76c2e939a305f2", 0x5, 0x10, 0x4, 0x97, 0x10, 0x0, 0x1, 0x4}) ioctl$EVIOCGMASK(r8, 0x80104592, &(0x7f0000000300)={0x0, 0x0, 0x0}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x38b802, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f0000000280)={0xe, 0x1, {0x57, 0x3, 0x200, {0x9, 0x7}, {0x2, 0x7ff}, @const={0x7de, {0x1, 0x1, 0x5, 0x7}}}, {0x55, 0x6, 0x98c, {0x1, 0x5dd}, {0x4, 0x4}, @cond=[{0x6, 0x7c, 0x17, 0x4, 0x3, 0x9}, {0x2, 0x4, 0x8, 0x2, 0x7, 0x1}]}}) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r10, &(0x7f0000000540)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa3e8100220086dd6d0000000008110000000000000000000000000000000000ff0200000000000000000000000000014f1c195900089078944d3eb92a682223156a04257794005c0e6a9774caa88dc1e1ccf57b757fb832549dfec40d2646e85b24bd79b4477effa4b5f184795d2053f0eece4516fa186429ba3e5d25ca2b415816652b87a6706a741b2454dc7bf4ad75ed94a4b4cd0072ceedb93d7cace7391d1ce27c5a96e8262d90ef49d4166e06ce242f55c9cb73ad85cd3edae68b988d8556d904640c9e244c8fd78a97016757b58324aaf3067aa5076b71170e5f39874065aa70"], 0x42) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_GET_VERSION(r12, 0x8004552d, &(0x7f0000000080)) 5.728076528s ago: executing program 3 (id=64): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) io_setup(0x6, &(0x7f00000000c0)=0x0) io_submit(r2, 0x3, &(0x7f0000000780)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000340)="e1594d39785eef9c34bfb57a88b327831c5cc76769a37bc5209abfed582efe14c83bd14bad48b6c14117b5c7b364d0bb3c3f963c89afc7da82bd24dfa589515aabfeeb4515970278b55c9bacbf4dcaa5ccd7b4e7", 0x54, 0x844}, 0x0, 0x0]) 5.162428818s ago: executing program 3 (id=65): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() r0 = socket(0x21, 0x807, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, 0x0) syz_open_dev$usbfs(0x0, 0xcc61, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000080, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000200000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36b26fb0b71d0e6adfefcf1d8f7faf75e0f226bd99eea7960717142fa9ea4318123741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ce99fbfbf9b0a4def23d410f6296b32a334388107200759cda9036b4e369a9e152ddcc7f05a5f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967deabe802f5ab3e89bd6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837074e098ee207d2f73902fbcfcf49822775985bf32d715f5888b24efa000000000000ffffffdf000000000000000000000089a7b9b00000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f91a31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5dff5adbdee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf1128744bab6677fcb78e313841ec309baed0495f06d058a75fa4c81e5c9f42d9383e41d277b10392a912ffaf6f658f3fadd16286744f839c3f128f8f92d0992239eafce5c1b3f97a297c9e49a0c3510ef74080e6d1e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda154910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b61799257ab55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bc6cf8809c3a0d46ff7f008000000000ad1e1f493354b2822b98371d000000167d78e65b90eba0768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cd1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e3344b155cc20f49e298727340e97cdefb40e56e9cfad973347d0de7ba4754ff231a1b033d8f931ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef79b8d4c2ff030000000000000007b82e6044f643068cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c99220002af8c5e53d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf99000000000000000000bfb32c826563c518d0ad23bc83ba3f3757210a057eff7615c868bd7d74233da1a3b56d4e04a7ec4792b1c4cffddbbdcfdd23ab5268f1b3d08ebb8ce498cbaaf5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fc02b70be8629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa44966945d93c33b038ce0d890f851811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f20a95b817ea3df3d6c0002a41783058e56c70afe8016b3dd9dc7785b36e609f173cc6b893ecd138289709839747837d6a6283b3452c57a5d44cacd363589845637071320921d22c1663964eddec902fc7cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c898b7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dca9c42c4d719347f39ef006c2df747ee6adb7cd04faf05c36de72354c64ebaf28a3de18607ebc4b70f50f71dae565749568a23319232dc213342fb472e98c9a412199ce7976bee5eaf40e60cb3fbe8b92dae5008e92d17d05ce74ffffe74ae71d5b8bd43a4e0bf0390335aa489689f5e3a4ac5adca96caab658b43cd499d95d3876c220d147ad1d0e626621d88f1370982f663793cac52ea0d14e595ff1f56427a0a813bb3b84d31d021eeea8faeff25bb66f5940d08a5509a66fc43962bcb2f7415bc38e355e80ec935aa6fe2d74bd475d89449fb46320fee40faff2fd005549fe6a042bd95decfde5e166971935f4cfd9c9e5bfd2d803644f4e5b7e6dc1a7a35df7134e2fad79269bf24bea4eb0213068e3054d9e4a8d1a9eb032cb390e2016d0ce10549728cb4732dc5adab16fa19ac70780b29e079be27c95d3dd2bd91a584c46d84d430fc6ea31ce0ba62fa27be9f6bc435203da7c3a5d68bf4dd4f81cbfaa1c87a15b9272853c9837db930952dca667194b71815a9eb49b495360dcdf31e0e560857d0541a916d6b5469ac1b36babc5a91e1d58925f20d9d5f8a0da3c30711b0d101cabceffbe072be69613ea0003c6e9bb5cd2413c8ddc17cfa319cf7aaeed0ffb07a08f8fb439f709dfe0732fe42192819870bdd87d5f612ade03540a28be446095269d9ea5a60bba1f2462f9921f2a731dbcf1d03964ea1e4f79514914d37877f57617b60fa2b58aa694fcb023024653c4b73efb12a57ffc6f8943262b77be933051e12bd4d768a422ea652d45b04a9c43b5c97fc3edea7002d51a0a74889334ee"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000000)={0xfffffffc, 0x0, 0x3, 0xfffffffc}, 0x10}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06000000a843089100fe800c00080008001100080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) rt_sigqueueinfo(r4, 0x2002b, &(0x7f0000000240)={0x31, 0x131, 0x17b}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0xf2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="1800ddff0000000000000000000000009500000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_GETFLAGS(r7, 0x80086601, &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f00000000c0)=0xf) 5.046570121s ago: executing program 4 (id=66): clock_adjtime(0x3, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x0, 0x81}, &(0x7f0000000100)=0x0, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r2, 0x0, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x4004, @fd=r0, 0x823, &(0x7f00000001c0)=[{0x0}], 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000000000000000100000009000034000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000140000000e0a0102000000000000000001000000140000001000010000000000000000000000000a94d99f4a88af8f7c"], 0x90}}, 0x0) io_uring_enter(r1, 0x27e2, 0x0, 0x0, 0x0, 0x0) 4.901410484s ago: executing program 4 (id=67): prctl$PR_SET_IO_FLUSHER(0x43, 0x1) userfaultfd(0x801) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0xfd, 0x7fff0000}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1404200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x20000253) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r5, 0xc048aec8, &(0x7f0000000080)={0x1, 0x0, @pic={0x0, 0x81, 0x9, 0x5, 0x3c, 0xfd, 0x5, 0x9, 0x4, 0xfc, 0xff, 0xf9, 0x55, 0x9, 0xf7, 0x7}}) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) syz_open_dev$sg(&(0x7f0000000280), 0x10, 0x88000) close_range(r0, 0xffffffffffffffff, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r3) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x40, r6, 0x100, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x4, 0x75}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x4080) 4.42295109s ago: executing program 1 (id=68): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x2}}}}]}, 0x40}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) socket$nl_rdma(0x10, 0x3, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000180)}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYRESHEX=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10001, @loopback, 0xe}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000004440)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, 0x0, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025", 0x1d}], 0x1) sendto$inet6(r4, &(0x7f0000000700)='\x00', 0x1, 0x4090, 0x0, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x80c0) 4.362428402s ago: executing program 3 (id=69): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000a80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) close(r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x30, r3, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_SEQ={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x818}, 0x4000) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x880) syz_emit_ethernet(0xa2, &(0x7f0000000140)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0xc}}}, {}, {0x8, 0x6558, 0x0, "169da219669739516eb57d61255dd5d06edb06d528e00b33fa4b91b5725aec5595da7df873ac55bed7ede055909b09648f30957aab09ae308372a2cf"}}}}}}, 0x0) 4.027556335s ago: executing program 2 (id=70): bind$can_raw(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000580)='smaps_rollup\x00') rseq(&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) lseek(r0, 0x2004, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x2004000, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_kthread_work_queue_work\x00', r3}, 0x10) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001500)=@newqdisc={0x4c, 0x24, 0xe0b, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x1ff, 0x4, 0x0, 0x5, 0xfffffffd, 0x8}}}}]}, 0x4c}}, 0x0) unshare(0x22020600) r6 = mq_open(&(0x7f0000000480)='!selinuxwk1\x1f\xd0m\xc3\x7f9\xc9\x9e*\rT\x93\xfd\xe2\x91\xef\xaa\x16#j\x97\x8f\xbc\xdeY\x0f\xcc\xc5mV\xcb\x15vm(p\xc9-QZ#\xd2{\x84\xbf\x06\x00\x00\xd9', 0x840, 0x104, 0x0) finit_module(r6, 0x0, 0x0) 3.449729051s ago: executing program 4 (id=71): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000004880)='lo\x00', 0x10) setsockopt$inet_mreqn(r1, 0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x2) io_uring_setup(0x40f8, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x40010, 0xffffffffffffffff, 0x80000000) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x191a00, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, &(0x7f000001b700)={0x2020}, 0x2020) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x20, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @rand_addr=0x64010100}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0xc, 0x1, {0x3, 0x8, 0x1, 0x8, 0x2}}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x44}, 0x1, 0x0, 0x300}, 0x0) 3.324060419s ago: executing program 2 (id=72): socket$nl_audit(0x10, 0x3, 0x9) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000380)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000200)='nv', 0x2) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f0000000180)={&(0x7f00000000c0)="0618fd34bd81d4165d57d3d93bae2e3e9675456d6371398659f95c3143b6a7fc50d052d4ea6a4672486b905ae236a80f35673d3412fa6b28811a30ba613e2a", 0x3f}, 0x1, 0x0, 0x0, 0x4008040}, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000000000), 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) write(r4, &(0x7f00000000c0), 0x0) 2.926207663s ago: executing program 4 (id=73): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {0x2}}) r0 = syz_io_uring_setup(0x17dc, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cd}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r3 = socket(0x10, 0x803, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000001900)=ANY=[@ANYBLOB="1201000202cd77100304d8b8bb3001794c010902120001de0000080904"], 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) connect$rxrpc(r4, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, 0x24) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='cachefiles_prep_read\x00', r5, 0x0, 0x2}, 0x18) sendmsg$inet(r4, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) connect$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0x64010100}}, 0x24) getsockname$packet(r3, 0x0, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0x4, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(r0, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 2.925166264s ago: executing program 1 (id=74): memfd_create(&(0x7f0000000080)='security.selinux\x00\xabl\x8d+\x8d\x17\xd3\x17t-\xd1]\xa1\xe4i$\xa0t\x1e.\x90+\x04\xfa\xfc\x80L+\x18\xe2\xcc\x81l\xe7\x91\x12A\x14FU \x89\xbb\x97\x05\x92z\x90;\xd3\xc5\x93.\xa4`d\x86\xbfd5\x8d;T\xea\xe79\xee\xe8\x10\xf89$N;+}\xe2C\xd3\"\xdc\n\xe2^F0O\fD\xe5d+=\x9b#L}r\x85B\xa5J\xa5\xb0\xf4\xae\xadd\xff3`\x13V\xb9\x99C\xe0\xb3\xde\x83H.]\xa3\xe2\x05\xa8,qW;\x93\\\xc4\v\x0exA\x00Iw}\x9c\xdax,\xa3\x1d\xb6\x85\x83\xca\x1c3\xb0\xcb\x95\xac\x84-W\xc2\xf4\xc2d\"\xea\x9f\xfcr\\!\xcd@\xa0$\xef\xbd\x85\x00@E\xe2\xfa1\x86\x81\xd0b\xc9\x9d\xf4\xb5\xed\xa9\xc6\x06\x9eV\xa0u\xd8\n=\xee\xea\x95\xdd\x86)\xe8iKZ\x16\xf7F)\x87\xa7\xbf\\\\>\xdcL\xebN\xedE\xf1J\xea\xb0Y\xb8SD\xc4\x17\xe2aI\xda\xaa\x98&\x8fyvR\xcd\xc1\xe8\xa3I\x9e&*\n\r\x8f.\xd9O=\a\xfa[\xf2\xf1\xd0\f\x95n\x1d\x91\"\xa7\x92e\x88\x19\xe3;\xff\xb8\x19*^\x8bM\x87\xf1\x8a\xa7`o\x81\xa1\xb2Q&\x04\xfeC\x9a\xeb', 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$SEG6_CMD_SET_TUNSRC(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004801}, 0x24004880) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8800, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1900000004000000040000000200010000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000040000000000000000000000000000000600000000000000"], 0x48) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000040)='!,\x00') mremap(&(0x7f0000ff1000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r4, @ANYBLOB="050000000000e8ffffff0e00000008000300", @ANYRES32=r5], 0x90}, 0x1, 0x0, 0x0, 0x4800}, 0x0) bind$inet6(r2, &(0x7f00000001c0)={0xa, 0x4, 0x0, @mcast2}, 0xfffffffffffffff8) syz_emit_ethernet(0x392, &(0x7f0000000400)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x8, 0x6, "423ae8", 0x35c, 0x2f, 0x1, @remote, @remote, {[@srh={0x1, 0x4, 0x4, 0x2, 0x3, 0x48, 0xb998, [@private2, @mcast2]}, @fragment={0x2c, 0x0, 0x2, 0x1, 0x0, 0xb, 0x64}, @dstopts={0x3c, 0x5, '\x00', [@padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x8}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x2}, @pad1, @enc_lim={0x4, 0x1, 0x7f}, @ra={0x5, 0x2, 0x6}, @pad1, @enc_lim={0x4, 0x1, 0x1}]}, @srh={0x2c, 0x8, 0x4, 0x4, 0xfd, 0x0, 0x1, [@ipv4={'\x00', '\xff\xff', @empty}, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}]}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0xfd, 0x2, [], "a96b52f212ee9c1cf74008e9b70a4fcc864999cbd04b3294e90d7732dafa56c2ddc98e5357d4372d389cea920eb6e27429bf2d48ffac42d25b7b10df0ee422b15c0111586ed1be4b5b8fd36ed62554172674946202e2ca93eda4b67f4cb6435d5d4e1d707ee16305d1498aff607d64ff4ad172635e4398769b2a7a172d4bac1b4056fd6b5112ded77b90aad2dabb2e4b670c4a60f99080672cedeca3dcee22ffc7d96e95759b7d41b09303d2004af5aab6f330c68f02066edb755efc4d7fd8cce838f78376e421376080e6f278f54492641da0a08c2e57943f08863cdd048c5ef071cb4fe8dddc84ec3c8e2a400a78ea816263195e4fa22ae203148ced"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x401, 0x6], "00ab1b0e4cb6218b7261388311ee53a02031fd6700533de23f748cff586563b8d51db7740ded7c45774d79fcb8aa63154a9f90153d530511c891b70b5f5221e31758c7323333c2edf6da083e4a9021cc44b84fc20e12cc75963b9dca2a0924f659541bdd491560db54f32755d3e43fae58dfc2c703a18d4af2820f53cdb2172eaf669f587fb85de6741b6a954f84498f0f2e2bd4d7b306a40b65d2221a39f244c09ef87a41d686990e9210d0071fe73b3cfa2c781cab4da98a316027e58dc738dcf9a91ae07238873c4722639abca6e51491f75822f9211d48fb1881d060fa1a8efccaabd53b"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "39a86a2e52a0785bddced9544479"}, {0x8, 0x88be, 0x4, {{0x2, 0x1, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x2, {{0x0, 0x2, 0x5, 0x1, 0x0, 0x2, 0x1, 0x6}, 0x2, {0x1, 0x1, 0x2, 0x8, 0x1, 0x1, 0x2, 0x1}}}, {0x8, 0x6558, 0x0, "c755deb1fe9b8ffef851671322fdd2e153236a4a0168b3ef93991a564991e88379a154ea985963823365637fb1d724a6904af7fac4ca875d93369fa50f578954edba2d67d2a3536cc4934d274d407fe4fbffe7431c0fd5861746fb775c3e8fce7ed5851f65f4c858e5fe207ab24183ebb4545d"}}}}}}}, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0xe) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) 2.86658916s ago: executing program 0 (id=75): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f0000000100)=@ringbuf={{}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x8}, {0x4, 0x1, 0xb, 0x9, 0x0, 0x8}}, {{0x6, 0x0, 0xb, 0xa}, {0xf}}, [@printk={@lu, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000080)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) fchown(0xffffffffffffffff, 0x0, 0x0) wait4(r0, 0x0, 0x40000000, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc040ff0b, &(0x7f0000000200)) 2.831897899s ago: executing program 3 (id=76): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ff9}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x1}) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000020ee9740ab0701fc06640000000109021200017f000000090420d30006d94b00d499c8a2494d3c148828b1187e920076c6064ff16b6b8186ed7f1b03f19d76c916b630b21faa6bef000000000000000000"], 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x4c, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000840)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$inet(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008001500b70400000000000085000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000b00)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="796100000000000000007e000000330003", @ANYRES32=0x0, @ANYBLOB="de0a103a36cc128cfa9d579c50e995e947f5bceb3d6f7524a2caaab0d80b311e8d5c1e558bd19a7a30dbbbce4417abe2ba2f659f7efce912c9f044e4adb36c4146849b9c14b4b1d3b2beda63202fb48f046ef9ff9c26d7c0cb6970e68987af6efc7494446743f38009a8abe03e609a1733b45a5b5bcdfa30d4702a9ec8845d1ce1b44d"], 0x1c}}, 0x4000054) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000100)={'vcan0\x00', 0x400}) kexec_load(0x5, 0x0, 0x0, 0x0) syz_usb_ep_read(r0, 0x8, 0x48, &(0x7f0000000100)=""/72) 2.487636425s ago: executing program 1 (id=77): clock_adjtime(0x3, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x0, 0x81}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, 0x0, 0x1) syz_io_uring_submit(r2, r3, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x20, 0x4004, @fd=r0, 0x823, &(0x7f00000001c0)=[{0x0}], 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000000000000000100000009000034000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000140000000e0a0102000000000000000001000000140000001000010000000000000000000000000a94d99f4a88af8f7c"], 0x90}}, 0x0) io_uring_enter(r1, 0x27e2, 0x0, 0x0, 0x0, 0x0) 2.39332217s ago: executing program 1 (id=78): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000140)={0x0, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000d042abd70000100000000000000", @ANYRES32=0x0, @ANYBLOB="c0700400400012800c0001006d6163766c61ee001400028008000900fdffffff0800070009000000140035006d6163766c616e30"], 0x58}, 0x1, 0x0, 0x0, 0x24060080}, 0x8000) msgctl$IPC_STAT(0x0, 0x2, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[], 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000000)={0x0, 0x0, 0x16, "04b1215a3c964f01277520dcfe14c639a500ba1772d5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x20, 0x46e2ce1dfc86f44b, 0x1, "b0"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_read(r2, 0x2, 0xa6, &(0x7f0000000180)=""/166) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$EVIOCGMASK(r4, 0x5b14, 0x0) syz_usb_connect(0x5, 0xfffffffffffffe49, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x59, 0xd, 0xe, 0x20, 0x2001, 0x3c19, 0x3bd8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x213, 0x1, 0x0, 0x40, 0x0, 0x0, [{{0x9, 0x4, 0xb0, 0x0, 0x6, 0xed, 0xed, 0xee, 0x6, [], [{{0x9, 0x5, 0xe, 0x10, 0x20, 0x7f, 0x9, 0x5}}, {{0x9, 0x5, 0xc, 0x3, 0x400, 0x8, 0xa, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x3, 0x7}]}}, {{0x9, 0x5, 0xd, 0xc, 0x200, 0xb, 0x9, 0x5}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0x9, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x57, 0x4}, @generic={0xe3, 0xb, "0f621093b679b53812aaf5053d7e19e984e063bd8300b438ccd2a3224ecfdf7706a49b6ca3710603fceba434706b9261587490b2aec125b950a2ee77e0635bc73f68a8a46722886bee0ea2554a1e902a6912e5cad65ab7b60714a84ced4fda24a794d69e644bd70f80f5648abf5dbf9ca10e91cdb6d4f429c8b7b8e0392b0929bee4e28279d95687246b8bb48e6cae2171358c37c6f7a9e0ccb5c63ff7834b5b9fd9e1c62902a35b4ed6ed81ae50f49d39ed37bfc57256cc3d70946fd3d77475d3531d5f855ca82c7a782c5ff57ba4dd909a5d9f180b4b851076202576cb2571c1"}]}}, {{0x9, 0x5, 0x0, 0xc, 0x0, 0x2, 0x9, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xe, 0x8000}]}}, {{0x9, 0x5, 0x8c, 0x0, 0x20, 0xfa, 0x9, 0x2, [@generic={0xd3, 0x7, "0da517c49c16cdb59adc9ed517932372a33cb16a222b6863142b8b7e50efc55ead55887dc4023e98c77538c0ab27e2031840aeeecda4f9a8616454a1290291ad674895b9e8e4b4189dee87a5b0d70d952fd3f71eb4f72d326d3d041582f70ad26a222029f1d43e0be6decd4bb3a5e46370b4fbc979cdd7ab95b65f8d005605e4eeadb54ae82fef9056c84acfa9e82aadbdf4db16e3b1a93fea7eed36ebb68bfeafa6f48fc83307ebe44365796f0311476518f9669c002ebca0ac28bd5ebb68cc564f0157f011b848af29c3643847d16fc1"}]}}]}}]}}]}}, 0x0) 2.150899522s ago: executing program 0 (id=79): mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x250}}, 0x4c000) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) unshare(0x2040600) r1 = semget$private(0x0, 0x5, 0x0) semop(r1, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1) semop(r1, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1) semctl$SETVAL(r1, 0x1, 0x10, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000003d40)={0x1, 0x0, [{0x0, 0x1000, &(0x7f0000002c40)=""/4096}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 1.895920416s ago: executing program 2 (id=80): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, &(0x7f0000000040)) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x3, 0x0) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000140)={0xffff0000, 0x6, 0x9, 0x2, 0x7, "d171a6100600000009e49200", 0x802046, 0x200068e}) ioctl$TIOCVHANGUP(r2, 0x5437, 0x2) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) listen(r1, 0xf) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="12000000070000000400", @ANYBLOB="5a9ce97ca6bb6fb4caaa087df785f5233879ffb86468fe6a7be85a9594369e3e1e0b090556290186a14590d6405481b7ce4844d81a03230212bf86bb6d2348ed0da06ada63bfed6c551d9ebe5cdca44afbff5473eca0f2ab5754dc75044b9faefe2ca9d7975c", @ANYBLOB="9ad0290800003ff002e1f524d155606570a868c38cf08066257cd907ad32113680129db2daf12f0e318e56eacc9f3b1c9f164e1828d2cfcb3ce038456831ea2a37d363a95e9856dcba7e49a65f8849a42e5ec6889d2cbecb6e71aaa0e7929ecd52fbc4b1b85b49446fc16c702a1e5eb8d50ca484f6cbec529a15c5844037fdf1536afdc6caf3df4e88f8957d9949883f4ea074faef3f896a57cb9a37f161b60a444a90ef423fc38006576c2c19fdb4ea91d26351d68f29f7241ce1346b646a2c682e9dcf139143973099921561c83a2bf645cf49b30d95dd3bcd64f78c39b4f59feeac1ff85aa402", @ANYRES32=0x0, @ANYRES64=r2, @ANYRESHEX=r1], 0x50) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmmsg(r1, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)=""/52, 0x34}], 0x1}, 0xe}], 0x2, 0x0, 0x0) unshare(0x18010100) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r5, 0xe) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES8=r3, @ANYRES16, @ANYRES8=r6, @ANYRESOCT=r1], 0xf0}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0xad1, 0x0, 0xc}) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2080}, {r5, 0x60}], 0x2, 0x0, 0x0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000008080), 0x2d2583, 0x0) shutdown(r1, 0x1) 0s ago: executing program 0 (id=81): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setaffinity(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x207a98, 0x0, 0x0, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x2, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket(0x10, 0x3, 0xa) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendfile(r1, r2, 0x0, 0x7fffffffffffffff) accept4$unix(r1, &(0x7f00000000c0)=@abs, &(0x7f00000001c0)=0x6e, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x7fffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x18, 0x2d, 0x1, 0x70bd2d, 0x25dfdbfc, {0x4}, [@nested={0x4, 0x12}]}, 0x18}, 0x1, 0x700}, 0x8004) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.54' (ED25519) to the list of known hosts. [ 62.111461][ T30] audit: type=1400 audit(1759595361.974:62): avc: denied { mounton } for pid=5812 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 62.135044][ T30] audit: type=1400 audit(1759595361.994:63): avc: denied { mount } for pid=5812 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.138228][ T5812] cgroup: Unknown subsys name 'net' [ 62.163885][ T30] audit: type=1400 audit(1759595362.034:64): avc: denied { unmount } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.288583][ T5812] cgroup: Unknown subsys name 'cpuset' [ 62.296834][ T5812] cgroup: Unknown subsys name 'rlimit' [ 62.441764][ T30] audit: type=1400 audit(1759595362.304:65): avc: denied { setattr } for pid=5812 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 62.474473][ T30] audit: type=1400 audit(1759595362.304:66): avc: denied { create } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.497622][ T30] audit: type=1400 audit(1759595362.304:67): avc: denied { write } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.520567][ T30] audit: type=1400 audit(1759595362.304:68): avc: denied { read } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 62.541050][ T30] audit: type=1400 audit(1759595362.304:69): avc: denied { mounton } for pid=5812 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 62.554594][ T5814] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 62.566130][ T30] audit: type=1400 audit(1759595362.304:70): avc: denied { mount } for pid=5812 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 62.598130][ T30] audit: type=1400 audit(1759595362.364:71): avc: denied { read } for pid=5491 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 63.573136][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 65.774078][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.782529][ T5839] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.788009][ T5840] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.790489][ T5839] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.816689][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.824476][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.826236][ T5844] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.832669][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.845449][ T5843] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.853983][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.854057][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.861530][ T5843] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.868705][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.876541][ T5843] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.882382][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.890694][ T5843] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.897681][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.903558][ T5843] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.910741][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.917897][ T5843] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.924688][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.931372][ T5843] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.945183][ T5147] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.952634][ T5147] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.965042][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 66.341702][ T5824] chnl_net:caif_netlink_parms(): no params data found [ 66.457696][ T5823] chnl_net:caif_netlink_parms(): no params data found [ 66.542749][ T5822] chnl_net:caif_netlink_parms(): no params data found [ 66.552290][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 66.615357][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.622621][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.630002][ T5824] bridge_slave_0: entered allmulticast mode [ 66.636747][ T5824] bridge_slave_0: entered promiscuous mode [ 66.651575][ T5830] chnl_net:caif_netlink_parms(): no params data found [ 66.679477][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.686665][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.693762][ T5824] bridge_slave_1: entered allmulticast mode [ 66.700747][ T5824] bridge_slave_1: entered promiscuous mode [ 66.717461][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.724541][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.732233][ T5823] bridge_slave_0: entered allmulticast mode [ 66.738966][ T5823] bridge_slave_0: entered promiscuous mode [ 66.746393][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.753511][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.760693][ T5823] bridge_slave_1: entered allmulticast mode [ 66.767460][ T5823] bridge_slave_1: entered promiscuous mode [ 66.817251][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.828481][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.890664][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.904052][ T5824] team0: Port device team_slave_0 added [ 66.910093][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.917827][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.924946][ T5826] bridge_slave_0: entered allmulticast mode [ 66.931791][ T5826] bridge_slave_0: entered promiscuous mode [ 66.946842][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.960287][ T5824] team0: Port device team_slave_1 added [ 66.966410][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.973505][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.980954][ T5826] bridge_slave_1: entered allmulticast mode [ 66.987633][ T5826] bridge_slave_1: entered promiscuous mode [ 66.994285][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.001565][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.008774][ T5822] bridge_slave_0: entered allmulticast mode [ 67.015363][ T5822] bridge_slave_0: entered promiscuous mode [ 67.022530][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.029650][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.036857][ T5822] bridge_slave_1: entered allmulticast mode [ 67.043738][ T5822] bridge_slave_1: entered promiscuous mode [ 67.111378][ T5823] team0: Port device team_slave_0 added [ 67.124831][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.133029][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.140423][ T5830] bridge_slave_0: entered allmulticast mode [ 67.147203][ T5830] bridge_slave_0: entered promiscuous mode [ 67.154970][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.162050][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.188307][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.201460][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.219731][ T5823] team0: Port device team_slave_1 added [ 67.227213][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.236612][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.243730][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.250982][ T5830] bridge_slave_1: entered allmulticast mode [ 67.257979][ T5830] bridge_slave_1: entered promiscuous mode [ 67.264719][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.271762][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.297692][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.314084][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.331217][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.375442][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.382450][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.408369][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.442219][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.449305][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.475500][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.487711][ T5822] team0: Port device team_slave_0 added [ 67.498853][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.510174][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.521045][ T5826] team0: Port device team_slave_0 added [ 67.528118][ T5822] team0: Port device team_slave_1 added [ 67.534949][ T5826] team0: Port device team_slave_1 added [ 67.594394][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.601967][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.628220][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.640358][ T5830] team0: Port device team_slave_0 added [ 67.660160][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.667362][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.693277][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.704782][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.711853][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.737898][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.750145][ T5830] team0: Port device team_slave_1 added [ 67.759630][ T5824] hsr_slave_0: entered promiscuous mode [ 67.765732][ T5824] hsr_slave_1: entered promiscuous mode [ 67.779538][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.786579][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.813127][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.846828][ T5823] hsr_slave_0: entered promiscuous mode [ 67.853170][ T5823] hsr_slave_1: entered promiscuous mode [ 67.859375][ T5823] debugfs: 'hsr0' already exists in 'hsr' [ 67.865124][ T5823] Cannot create hsr debugfs directory [ 67.886567][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.893501][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.919488][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.931317][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.938452][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.964355][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.996620][ T5837] Bluetooth: hci3: command tx timeout [ 68.002309][ T5837] Bluetooth: hci1: command tx timeout [ 68.002818][ T5838] Bluetooth: hci0: command tx timeout [ 68.008151][ T5829] Bluetooth: hci4: command tx timeout [ 68.013239][ T5147] Bluetooth: hci2: command tx timeout [ 68.047772][ T5826] hsr_slave_0: entered promiscuous mode [ 68.054098][ T5826] hsr_slave_1: entered promiscuous mode [ 68.060649][ T5826] debugfs: 'hsr0' already exists in 'hsr' [ 68.066414][ T5826] Cannot create hsr debugfs directory [ 68.099833][ T5822] hsr_slave_0: entered promiscuous mode [ 68.106346][ T5822] hsr_slave_1: entered promiscuous mode [ 68.112166][ T5822] debugfs: 'hsr0' already exists in 'hsr' [ 68.117910][ T5822] Cannot create hsr debugfs directory [ 68.167974][ T5830] hsr_slave_0: entered promiscuous mode [ 68.174119][ T5830] hsr_slave_1: entered promiscuous mode [ 68.180396][ T5830] debugfs: 'hsr0' already exists in 'hsr' [ 68.186230][ T5830] Cannot create hsr debugfs directory [ 68.478570][ T5824] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 68.489088][ T5824] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 68.503081][ T5824] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 68.518901][ T5824] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.564477][ T5823] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.578578][ T5823] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.594966][ T5823] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.617242][ T5823] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.649800][ T5826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.665044][ T5826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.684355][ T5826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.695313][ T5826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.781607][ T5822] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 68.804871][ T5822] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 68.815112][ T5822] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 68.824177][ T5822] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 68.848755][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.904171][ T5830] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 68.921835][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.936721][ T5830] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 68.946999][ T5830] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 68.958161][ T5830] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 68.976583][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.996845][ T5824] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.009043][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.020625][ T217] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.027851][ T217] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.048174][ T217] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.055264][ T217] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.071824][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.078941][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.100581][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.107766][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.122604][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.163252][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.170360][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.220133][ T5823] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.238044][ T3495] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.245113][ T3495] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.264854][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.317949][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 69.317972][ T30] audit: type=1400 audit(1759595369.184:86): avc: denied { sys_module } for pid=5823 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 69.322748][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.373532][ T5826] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 69.384748][ T5826] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.440702][ T217] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.447869][ T217] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.470002][ T217] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.477159][ T217] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.514865][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.575538][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.589904][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.619012][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.630197][ T3495] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.637298][ T3495] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.661922][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.669037][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.783141][ T5824] veth0_vlan: entered promiscuous mode [ 69.813965][ T5824] veth1_vlan: entered promiscuous mode [ 69.850134][ T5830] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.897076][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.969405][ T5824] veth0_macvtap: entered promiscuous mode [ 70.007215][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.021840][ T5824] veth1_macvtap: entered promiscuous mode [ 70.053856][ T5826] veth0_vlan: entered promiscuous mode [ 70.076733][ T5147] Bluetooth: hci2: command tx timeout [ 70.077339][ T5843] Bluetooth: hci0: command tx timeout [ 70.082152][ T5147] Bluetooth: hci1: command tx timeout [ 70.087594][ T5838] Bluetooth: hci4: command tx timeout [ 70.093500][ T5147] Bluetooth: hci3: command tx timeout [ 70.111538][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.132309][ T5826] veth1_vlan: entered promiscuous mode [ 70.142726][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.167946][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.190148][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.199060][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.212222][ T5823] veth0_vlan: entered promiscuous mode [ 70.222951][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.231823][ T5822] veth0_vlan: entered promiscuous mode [ 70.252000][ T5823] veth1_vlan: entered promiscuous mode [ 70.263058][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.301875][ T5822] veth1_vlan: entered promiscuous mode [ 70.323576][ T5826] veth0_macvtap: entered promiscuous mode [ 70.332876][ T5826] veth1_macvtap: entered promiscuous mode [ 70.352898][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.365495][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.393164][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.404927][ T5823] veth0_macvtap: entered promiscuous mode [ 70.430996][ T5823] veth1_macvtap: entered promiscuous mode [ 70.441108][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.468920][ T5822] veth0_macvtap: entered promiscuous mode [ 70.482333][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.492159][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.503417][ T5830] veth0_vlan: entered promiscuous mode [ 70.515114][ T5822] veth1_macvtap: entered promiscuous mode [ 70.524055][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.525928][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.533629][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.541403][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.562488][ T5830] veth1_vlan: entered promiscuous mode [ 70.573971][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.594255][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.604725][ T30] audit: type=1400 audit(1759595370.474:87): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.LC2tFA/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 70.618284][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.643564][ T30] audit: type=1400 audit(1759595370.474:88): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 70.665724][ T30] audit: type=1400 audit(1759595370.474:89): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.LC2tFA/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 70.699252][ T30] audit: type=1400 audit(1759595370.474:90): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 70.722370][ T30] audit: type=1400 audit(1759595370.504:91): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.LC2tFA/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 70.751474][ T30] audit: type=1400 audit(1759595370.504:92): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.LC2tFA/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=6916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 70.809510][ T30] audit: type=1400 audit(1759595370.504:93): avc: denied { unmount } for pid=5824 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 70.810137][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 70.845255][ T30] audit: type=1400 audit(1759595370.554:94): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2782 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 70.878977][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.887981][ T30] audit: type=1400 audit(1759595370.554:95): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="gadgetfs" ino=7654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 70.889292][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.928745][ T3495] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.938634][ T3495] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.939238][ T5830] veth0_macvtap: entered promiscuous mode [ 70.960373][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.973770][ T3462] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.983566][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.990889][ T3462] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.043757][ T5938] block device autoloading is deprecated and will be removed. [ 71.045064][ T5830] veth1_macvtap: entered promiscuous mode [ 71.063567][ T3462] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.076589][ T3462] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.121224][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.149058][ T3462] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.159769][ T3462] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.177525][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.178210][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.192937][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.204480][ T3462] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.242486][ T3462] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.251759][ T3462] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.300194][ T3462] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.310468][ T3462] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.338756][ T3641] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.378289][ T3641] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.479597][ T3641] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.493476][ T3641] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.502572][ T217] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.514486][ T217] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.590113][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.634405][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.693046][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.703001][ T5835] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 71.713777][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.792002][ T3641] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.815404][ T3641] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.869994][ T5835] usb 1-1: config 6 has an invalid interface number: 2 but max is 0 [ 71.886435][ T5835] usb 1-1: config 6 has an invalid descriptor of length 255, skipping remainder of the config [ 71.903076][ T5835] usb 1-1: config 6 has no interface number 0 [ 71.925839][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 71.934449][ T5835] usb 1-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 71.982873][ T5835] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 72.006743][ T5835] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 72.025007][ T5835] usb 1-1: Product: syz [ 72.041954][ T5835] usb 1-1: Manufacturer: syz [ 72.048563][ T5835] usb 1-1: SerialNumber: syz [ 72.098458][ T5835] hso 1-1:6.2: Failed to find INT IN ep [ 72.117337][ T24] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 72.133470][ T24] usb 5-1: config 0 has no interface number 0 [ 72.158518][ T5147] Bluetooth: hci4: command tx timeout [ 72.164001][ T5837] Bluetooth: hci3: command tx timeout [ 72.166196][ T5843] Bluetooth: hci1: command tx timeout [ 72.169895][ T5837] Bluetooth: hci0: command tx timeout [ 72.174825][ T5838] Bluetooth: hci2: command tx timeout [ 72.189709][ T24] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 72.225702][ T24] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 72.247459][ T5967] FAULT_INJECTION: forcing a failure. [ 72.247459][ T5967] name failslab, interval 1, probability 0, space 0, times 1 [ 72.266742][ T24] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 72.277230][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.285418][ T5967] CPU: 1 UID: 0 PID: 5967 Comm: syz.1.12 Not tainted syzkaller #0 PREEMPT(full) [ 72.285442][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 72.285452][ T5967] Call Trace: [ 72.285457][ T5967] [ 72.285463][ T5967] dump_stack_lvl+0x16c/0x1f0 [ 72.285486][ T5967] should_fail_ex+0x512/0x640 [ 72.285505][ T5967] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 72.285525][ T5967] should_failslab+0xc2/0x120 [ 72.285546][ T5967] kmem_cache_alloc_node_noprof+0x78/0x770 [ 72.285562][ T5967] ? __alloc_skb+0x2b2/0x380 [ 72.285585][ T5967] ? __alloc_skb+0x2b2/0x380 [ 72.285600][ T5967] __alloc_skb+0x2b2/0x380 [ 72.285620][ T5967] ? __pfx___alloc_skb+0x10/0x10 [ 72.285642][ T5967] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 72.285669][ T5967] netlink_alloc_large_skb+0x69/0x140 [ 72.285692][ T5967] netlink_sendmsg+0x698/0xdd0 [ 72.285719][ T5967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.285751][ T5967] ____sys_sendmsg+0xa98/0xc70 [ 72.285780][ T5967] ? copy_msghdr_from_user+0x10a/0x160 [ 72.285799][ T5967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 72.285833][ T5967] ___sys_sendmsg+0x134/0x1d0 [ 72.285853][ T5967] ? __pfx____sys_sendmsg+0x10/0x10 [ 72.285902][ T5967] __sys_sendmsg+0x16d/0x220 [ 72.285955][ T5967] ? __pfx___sys_sendmsg+0x10/0x10 [ 72.285991][ T5967] do_syscall_64+0xcd/0x4e0 [ 72.286014][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.286032][ T5967] RIP: 0033:0x7f724cd8eec9 [ 72.286046][ T5967] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.286061][ T5967] RSP: 002b:00007f724db4e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.286077][ T5967] RAX: ffffffffffffffda RBX: 00007f724cfe5fa0 RCX: 00007f724cd8eec9 [ 72.286088][ T5967] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 72.286098][ T5967] RBP: 00007f724db4e090 R08: 0000000000000000 R09: 0000000000000000 [ 72.286107][ T5967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 72.286117][ T5967] R13: 00007f724cfe6038 R14: 00007f724cfe5fa0 R15: 00007ffe34fa2588 [ 72.286138][ T5967] [ 72.498788][ T24] usb 5-1: Product: syz [ 72.504023][ T24] usb 5-1: Manufacturer: syz [ 72.508711][ T24] usb 5-1: SerialNumber: syz [ 72.528125][ T5943] gfs2: error -5 reading superblock [ 72.537617][ T24] usb 5-1: config 0 descriptor?? [ 72.538360][ T5909] usb 1-1: USB disconnect, device number 2 [ 72.543720][ T5948] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 72.586254][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 72.595515][ T24] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 72.610536][ T24] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 72.674173][ T5969] block nbd0: not configured, cannot reconfigure [ 72.772727][ T5948] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 73.076111][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 73.180172][ T5970] Zero length message leads to an empty skb [ 73.280252][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 73.355868][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 73.365839][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 73.397649][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 73.406981][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 73.415283][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 73.486594][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.495409][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 73.586929][ T5976] mmap: syz.3.15 (5976): VmData 37654528 exceed data ulimit 1. Update limits or use boot option ignore_rlimit_data. [ 73.743916][ T5936] usb 5-1: USB disconnect, device number 2 [ 73.964450][ T5983] netlink: 10 bytes leftover after parsing attributes in process `syz.0.16'. [ 73.978323][ T5936] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 74.014983][ T5936] cyberjack 5-1:0.69: device disconnected [ 74.033556][ T5843] Bluetooth: hci1: unexpected event 0x03 length: 1 < 11 [ 74.056993][ T5990] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 74.083280][ T5990] qnx6: wrong signature (magic) in superblock #1. [ 74.092487][ T5991] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 74.102614][ T5990] qnx6: unable to read the first superblock [ 74.147339][ T5991] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 74.239938][ T5829] Bluetooth: hci1: command tx timeout [ 74.248658][ T5838] Bluetooth: hci4: command tx timeout [ 74.248659][ T5837] Bluetooth: hci2: command tx timeout [ 74.248696][ T5837] Bluetooth: hci3: command tx timeout [ 74.254104][ T5843] Bluetooth: hci0: command tx timeout [ 74.735874][ T5835] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 74.999041][ T5835] usb 5-1: Using ep0 maxpacket: 8 [ 75.090173][ T5835] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 75.099986][ T5835] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 75.109814][ T5835] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 75.121021][ T5835] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 75.135104][ T5835] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 75.144417][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.359505][ T30] kauditd_printk_skb: 52 callbacks suppressed [ 75.359521][ T30] audit: type=1400 audit(1759595375.224:148): avc: denied { setopt } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.425490][ T6010] vlan2: entered promiscuous mode [ 75.433044][ T6010] bridge0: entered promiscuous mode [ 75.519820][ T30] audit: type=1400 audit(1759595375.224:149): avc: denied { bind } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.540457][ T30] audit: type=1400 audit(1759595375.224:150): avc: denied { name_bind } for pid=6004 comm="syz.1.21" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 75.565116][ T5835] usb 5-1: GET_CAPABILITIES returned 0 [ 75.566096][ T30] audit: type=1400 audit(1759595375.224:151): avc: denied { node_bind } for pid=6004 comm="syz.1.21" saddr=::1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 75.592545][ T5835] usbtmc 5-1:16.0: can't read capabilities [ 75.715098][ T6012] syz.0.23 uses obsolete (PF_INET,SOCK_PACKET) [ 75.999666][ T30] audit: type=1400 audit(1759595375.254:152): avc: denied { prog_run } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 76.030646][ T6015] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 76.066651][ T5936] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.081220][ T5998] process 'syz.4.20' launched './file1' with NULL argv: empty string added [ 76.110873][ T30] audit: type=1400 audit(1759595375.514:153): avc: denied { create } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 76.152675][ T30] audit: type=1400 audit(1759595375.514:154): avc: denied { write } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 76.172322][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.257174][ T5936] usb 4-1: config 0 has an invalid interface number: 10 but max is 0 [ 76.322999][ T30] audit: type=1400 audit(1759595375.524:155): avc: denied { create } for pid=6004 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 76.353959][ T30] audit: type=1400 audit(1759595375.524:156): avc: denied { write } for pid=6004 comm="syz.1.21" laddr=::1 lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 76.375029][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.435897][ T5936] usb 4-1: config 0 has no interface number 0 [ 76.459511][ T5936] usb 4-1: New USB device found, idVendor=050d, idProduct=0122, bcdDevice=69.f6 [ 76.491471][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.647770][ T5998] ======================================================= [ 76.647770][ T5998] WARNING: The mand mount option has been deprecated and [ 76.647770][ T5998] and is ignored by this kernel. Remove the mand [ 76.647770][ T5998] option from the mount to silence this warning. [ 76.647770][ T5998] ======================================================= [ 76.682580][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.707110][ T5936] usb 4-1: config 0 descriptor?? [ 76.723380][ T30] audit: type=1400 audit(1759595375.524:157): avc: denied { connect } for pid=6004 comm="syz.1.21" laddr=::1 lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 77.093565][ T6028] netlink: 'syz.0.28': attribute type 2 has an invalid length. [ 77.161840][ T6006] mmap: syz.3.22 (6006) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 77.527791][ T5835] usb 5-1: USB disconnect, device number 3 [ 78.007276][ T5936] pegasus 4-1:0.10: probe with driver pegasus failed with error -32 [ 78.267754][ T6045] FAULT_INJECTION: forcing a failure. [ 78.267754][ T6045] name failslab, interval 1, probability 0, space 0, times 0 [ 78.296352][ T6045] CPU: 0 UID: 0 PID: 6045 Comm: syz.1.32 Not tainted syzkaller #0 PREEMPT(full) [ 78.296377][ T6045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 78.296387][ T6045] Call Trace: [ 78.296393][ T6045] [ 78.296399][ T6045] dump_stack_lvl+0x16c/0x1f0 [ 78.296426][ T6045] should_fail_ex+0x512/0x640 [ 78.296447][ T6045] ? fs_reclaim_acquire+0xae/0x150 [ 78.296470][ T6045] should_failslab+0xc2/0x120 [ 78.296493][ T6045] __kmalloc_noprof+0xdd/0x880 [ 78.296519][ T6045] ? tomoyo_encode2+0x100/0x3e0 [ 78.296545][ T6045] ? tomoyo_encode2+0x100/0x3e0 [ 78.296564][ T6045] tomoyo_encode2+0x100/0x3e0 [ 78.296588][ T6045] tomoyo_encode+0x29/0x50 [ 78.296608][ T6045] tomoyo_realpath_from_path+0x18f/0x6e0 [ 78.296636][ T6045] ? tomoyo_profile+0x47/0x60 [ 78.296662][ T6045] tomoyo_path_number_perm+0x245/0x580 [ 78.296679][ T6045] ? tomoyo_path_number_perm+0x237/0x580 [ 78.296699][ T6045] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 78.296718][ T6045] ? find_held_lock+0x2b/0x80 [ 78.296765][ T6045] ? find_held_lock+0x2b/0x80 [ 78.296788][ T6045] ? hook_file_ioctl_common+0x145/0x410 [ 78.296818][ T6045] ? __fget_files+0x20e/0x3c0 [ 78.296842][ T6045] security_file_ioctl+0x9b/0x240 [ 78.296864][ T6045] __x64_sys_ioctl+0xb7/0x210 [ 78.296893][ T6045] do_syscall_64+0xcd/0x4e0 [ 78.296916][ T6045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.296933][ T6045] RIP: 0033:0x7f724cd8eec9 [ 78.296947][ T6045] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 78.296963][ T6045] RSP: 002b:00007f724db4e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.296979][ T6045] RAX: ffffffffffffffda RBX: 00007f724cfe5fa0 RCX: 00007f724cd8eec9 [ 78.296990][ T6045] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 78.297000][ T6045] RBP: 00007f724db4e090 R08: 0000000000000000 R09: 0000000000000000 [ 78.297010][ T6045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.297020][ T6045] R13: 00007f724cfe6038 R14: 00007f724cfe5fa0 R15: 00007ffe34fa2588 [ 78.297043][ T6045] [ 78.297076][ T6045] ERROR: Out of memory at tomoyo_realpath_from_path. [ 78.529622][ T6050] overlayfs: failed to resolve './file1': -2 [ 78.576993][ T6050] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.34'. [ 78.587992][ T6050] netlink: zone id is out of range [ 78.615441][ T6050] netlink: zone id is out of range [ 78.621254][ T6050] netlink: zone id is out of range [ 78.627189][ T6050] netlink: get zone limit has 8 unknown bytes [ 78.665584][ T6054] netlink: 124 bytes leftover after parsing attributes in process `syz.4.35'. [ 79.226476][ T5908] usb 4-1: USB disconnect, device number 2 [ 80.555273][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 80.555290][ T30] audit: type=1400 audit(1759595380.414:185): avc: denied { ioctl } for pid=6079 comm="syz.2.43" path="socket:[9604]" dev="sockfs" ino=9604 ioctlcmd=0x52c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 80.725142][ T6088] siw: device registration error -23 [ 81.351677][ T9] cfg80211: failed to load regulatory.db [ 81.505866][ T5882] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 81.615865][ T5936] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 81.667905][ T5882] usb 1-1: config 6 has an invalid interface number: 2 but max is 0 [ 81.676269][ T5882] usb 1-1: config 6 has an invalid descriptor of length 255, skipping remainder of the config [ 81.696909][ T6099] netlink: 'syz.4.50': attribute type 2 has an invalid length. [ 81.697980][ T5882] usb 1-1: config 6 has no interface number 0 [ 81.725028][ T6099] netlink: 132 bytes leftover after parsing attributes in process `syz.4.50'. [ 81.725487][ T5882] usb 1-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 81.762903][ T5882] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 81.772052][ T5882] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 81.782893][ T5882] usb 1-1: Product: syz [ 81.788353][ T5882] usb 1-1: Manufacturer: syz [ 81.793054][ T5882] usb 1-1: SerialNumber: syz [ 81.799199][ T5936] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.803818][ T5882] hso 1-1:6.2: Failed to find INT IN ep [ 81.825342][ T5936] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 81.835378][ T5936] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 81.847779][ T5936] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.862211][ T5936] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 81.872867][ T5936] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.887579][ T5936] usb 3-1: config 0 descriptor?? [ 81.895375][ T5936] hdpvr 3-1:0.0: Could not find bulk-in endpoint [ 81.901849][ T5936] hdpvr 3-1:0.0: probe with driver hdpvr failed with error -12 [ 81.972440][ T30] audit: type=1400 audit(1759595381.834:186): avc: denied { ioctl } for pid=6102 comm="syz.3.52" path="socket:[8789]" dev="sockfs" ino=8789 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 81.987314][ T5908] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 82.258702][ T5908] usb 5-1: Using ep0 maxpacket: 8 [ 82.325965][ T30] audit: type=1400 audit(1759595382.124:187): avc: denied { ioctl } for pid=6104 comm="syz.3.54" path="socket:[9693]" dev="sockfs" ino=9693 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 82.376106][ T5908] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 82.405894][ T5908] usb 5-1: config 0 has no interface number 0 [ 82.412130][ T5908] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 82.413514][ T5882] usb 1-1: USB disconnect, device number 3 [ 82.423809][ T30] audit: type=1400 audit(1759595382.244:188): avc: denied { ioctl } for pid=6104 comm="syz.3.54" path="socket:[9696]" dev="sockfs" ino=9696 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 82.460709][ T5908] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 82.473056][ T5908] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 82.492596][ T5908] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 82.508323][ T5908] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 82.517871][ T5908] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.535562][ T5908] usb 5-1: config 0 descriptor?? [ 82.544913][ T5908] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 82.588456][ T30] audit: type=1400 audit(1759595382.454:189): avc: denied { ioctl } for pid=6112 comm="syz.3.55" path="socket:[9701]" dev="sockfs" ino=9701 ioctlcmd=0x0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 82.685991][ T5835] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 82.837422][ T5835] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 82.841772][ T6099] netlink: 'syz.4.50': attribute type 10 has an invalid length. [ 82.848727][ T5835] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 82.866073][ T5835] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 82.871808][ T6099] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 82.875918][ T5835] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 82.893635][ T5835] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.902399][ T5909] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 82.907673][ T6099] 8021q: adding VLAN 0 to HW filter on device bond1 [ 82.926750][ T5835] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 82.930533][ T6099] bond_slave_0: entered promiscuous mode [ 82.939621][ T6099] bond_slave_1: entered promiscuous mode [ 82.945330][ T6099] syz_tun: entered promiscuous mode [ 82.951675][ T6099] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 82.964664][ T6099] bond1: (slave macvlan2): unknown ethtool speed (30000) for port 1 (set it to 0) [ 82.987853][ T6099] bond1: (slave macvlan2): speed changed to 0 on port 1 [ 83.007125][ T6099] bond1: (slave macvlan2): Enslaving as an active interface with an up link [ 83.085294][ T5909] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 83.108971][ T5825] udevd[5825]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 83.138752][ T5909] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 83.143511][ T30] audit: type=1400 audit(1759595383.004:190): avc: denied { create } for pid=6095 comm="syz.2.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 83.155102][ T5909] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 83.170189][ T30] audit: type=1400 audit(1759595383.004:191): avc: denied { write } for pid=6095 comm="syz.2.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 83.202253][ T5909] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 83.220224][ T5835] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 83.246609][ T5835] usb 2-1: USB disconnect, device number 2 [ 83.266423][ T5909] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 83.279801][ T5909] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 83.289122][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 83.301151][ T5909] usb 4-1: Product: syz [ 83.305526][ T5909] usb 4-1: Manufacturer: syz [ 83.415174][ T5909] cdc_wdm 4-1:1.0: skipping garbage [ 83.424173][ T5909] cdc_wdm 4-1:1.0: skipping garbage [ 83.685254][ T5909] cdc_wdm 4-1:1.0: cdc-wdm1: USB WDM device [ 83.691395][ T5909] cdc_wdm 4-1:1.0: Unknown control protocol [ 84.000754][ T5909] usb 4-1: USB disconnect, device number 3 [ 84.073221][ T30] audit: type=1400 audit(1759595383.934:192): avc: denied { create } for pid=6124 comm="syz.0.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 84.131078][ T6130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.58'. [ 84.295918][ T5908] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 84.988655][ T24] usb 5-1: USB disconnect, device number 4 [ 85.003862][ T30] audit: type=1400 audit(1759595384.824:193): avc: denied { read } for pid=6114 comm="syz.3.56" path="socket:[9708]" dev="sockfs" ino=9708 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 85.027552][ T24] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 85.037365][ T30] audit: type=1400 audit(1759595384.824:194): avc: denied { write } for pid=6114 comm="syz.3.56" path="socket:[9708]" dev="sockfs" ino=9708 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 85.135833][ T5908] usb 2-1: Using ep0 maxpacket: 8 [ 85.264727][ T1909] usb 3-1: USB disconnect, device number 2 [ 85.274806][ T5908] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 85.312250][ T5908] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 85.333385][ T5908] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 85.375651][ T5908] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.392317][ T5908] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 85.402499][ T5908] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.505189][ T6140] binder: 6139:6140 ioctl 8933 2000000003c0 returned -22 [ 85.603609][ T5936] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 85.904509][ T5908] usb 2-1: GET_CAPABILITIES returned 0 [ 85.911710][ T5908] usbtmc 2-1:16.0: can't read capabilities [ 85.919128][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 85.919141][ T30] audit: type=1400 audit(1759595385.764:202): avc: denied { map } for pid=6139 comm="syz.4.63" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 85.996300][ T30] audit: type=1400 audit(1759595385.764:203): avc: denied { read } for pid=6139 comm="syz.4.63" name="event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 86.076256][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 86.139709][ T5936] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 86.153270][ T5936] usb 1-1: config 0 has no interface number 0 [ 86.172025][ T5936] usb 1-1: config 0 interface 126 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1023 [ 86.197803][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 86.207910][ T30] audit: type=1400 audit(1759595385.764:204): avc: denied { open } for pid=6139 comm="syz.4.63" path="/dev/input/event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 86.238534][ T5908] usb 2-1: USB disconnect, device number 3 [ 86.295590][ T5936] usb 1-1: config 0 interface 126 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 86.326017][ T5936] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x4 has an invalid bInterval 28, changing to 8 [ 86.456022][ T5936] usb 1-1: config 0 interface 126 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 86.457028][ T30] audit: type=1400 audit(1759595385.764:205): avc: denied { ioctl } for pid=6139 comm="syz.4.63" path="/dev/input/event2" dev="devtmpfs" ino=921 ioctlcmd=0x4592 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 86.467712][ T5936] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 86.537862][ T5936] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 86.559082][ T5936] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 86.580622][ T30] audit: type=1400 audit(1759595385.764:206): avc: denied { ioctl } for pid=6139 comm="syz.4.63" path="socket:[9745]" dev="sockfs" ino=9745 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 86.624679][ T30] audit: type=1400 audit(1759595385.824:207): avc: denied { create } for pid=6137 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 86.657170][ T5936] usb 1-1: config 0 interface 126 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 86.688240][ T5936] usb 1-1: New USB device found, idVendor=0403, idProduct=a54b, bcdDevice=40.73 [ 86.699400][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.769831][ T5936] usb 1-1: Product: syz [ 86.774150][ T5936] usb 1-1: Manufacturer: syz [ 86.774223][ T30] audit: type=1400 audit(1759595385.904:208): avc: denied { sys_module } for pid=6139 comm="syz.4.63" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 86.876016][ T30] audit: type=1400 audit(1759595386.044:209): avc: denied { write } for pid=6126 comm="syz.1.59" name="usbtmc0" dev="devtmpfs" ino=2836 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 86.919614][ T5936] usb 1-1: SerialNumber: syz [ 86.993696][ T30] audit: type=1400 audit(1759595386.054:210): avc: denied { execute } for pid=6126 comm="syz.1.59" name="file1" dev="tmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 87.016490][ T30] audit: type=1400 audit(1759595386.054:211): avc: denied { execute_no_trans } for pid=6126 comm="syz.1.59" path="/19/file1" dev="tmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 87.025734][ T5936] usb 1-1: config 0 descriptor?? [ 87.127268][ T6132] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 87.147796][ T6132] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 87.165858][ T5882] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 87.212411][ T5936] ftdi_sio 1-1:0.126: FTDI USB Serial Device converter detected [ 87.234943][ T5936] ftdi_sio ttyUSB0: unknown device type: 0x4073 [ 87.336253][ T5882] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 87.347492][ T5882] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 87.363528][ T5882] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 87.393196][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.415057][ T6160] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 87.432328][ T6164] netlink: 12 bytes leftover after parsing attributes in process `syz.2.70'. [ 87.432556][ T5882] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 87.473234][ T5936] usb 1-1: USB disconnect, device number 4 [ 87.520447][ T5936] ftdi_sio 1-1:0.126: device disconnected [ 87.784247][ T6164] kernel read not supported for file /!selinuxwk1m9ɞ*T#jYmVvm(p-QZ#{ (pid: 6164 comm: syz.2.70) [ 87.851534][ T24] usb 4-1: USB disconnect, device number 4 [ 88.564264][ T6186] netlink: 116 bytes leftover after parsing attributes in process `syz.1.74'. [ 88.706106][ T5882] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 88.765860][ T5908] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 88.875992][ T5882] usb 5-1: Using ep0 maxpacket: 16 [ 88.894682][ T5882] usb 5-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 88.920137][ T6201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.78'. [ 88.924522][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=121, SerialNumber=76 [ 88.929488][ T5908] usb 4-1: Using ep0 maxpacket: 32 [ 88.951305][ T5882] usb 5-1: Product: syz [ 88.954467][ T5908] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 88.955712][ T5882] usb 5-1: Manufacturer: syz [ 88.975826][ T5882] usb 5-1: SerialNumber: syz [ 88.978859][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.989620][ T5908] usb 4-1: Product: syz [ 88.993842][ T5908] usb 4-1: Manufacturer: syz [ 89.004552][ T5908] usb 4-1: SerialNumber: syz [ 89.016330][ T5908] usb 4-1: config 0 descriptor?? [ 89.205857][ T24] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 89.231398][ T5882] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 89.244308][ T6185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.259013][ T6185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.343737][ T5882] snd-usb-audio 5-1:222.0: probe with driver snd-usb-audio failed with error -71 [ 89.380001][ T5882] usb 5-1: USB disconnect, device number 5 [ 89.465837][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 89.471578][ T6172] udevd[6172]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 89.472400][ T24] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 89.601269][ T6220] netlink: 8 bytes leftover after parsing attributes in process `syz.3.76'. [ 90.474407][ T24] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 90.498440][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 91.152943][ T5908] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: failure sending bit rate [ 91.163823][ T6222] sp0: Synchronizing with TNC [ 91.180403][ T5908] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -110 [ 91.195437][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 91.209460][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 91.209477][ T30] audit: type=1400 audit(1759595391.074:291): avc: denied { bind } for pid=6217 comm="syz.2.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.241066][ T5843] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 91.253460][ T5843] CPU: 1 UID: 0 PID: 5843 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 91.253488][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 91.253500][ T5843] Workqueue: hci4 hci_rx_work [ 91.253526][ T5843] Call Trace: [ 91.253533][ T5843] [ 91.253541][ T5843] dump_stack_lvl+0x16c/0x1f0 [ 91.253568][ T5843] sysfs_warn_dup+0x7f/0xa0 [ 91.253595][ T5843] sysfs_create_dir_ns+0x24b/0x2b0 [ 91.253620][ T5843] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 91.253644][ T5843] ? find_held_lock+0x2b/0x80 [ 91.253675][ T5843] ? do_raw_spin_unlock+0x172/0x230 [ 91.253700][ T5843] kobject_add_internal+0x2c4/0x9b0 [ 91.253729][ T5843] kobject_add+0x16e/0x240 [ 91.253753][ T5843] ? __pfx_kobject_add+0x10/0x10 [ 91.253778][ T5843] ? do_raw_spin_unlock+0x172/0x230 [ 91.253801][ T5843] ? kobject_put+0xab/0x5a0 [ 91.253831][ T5843] device_add+0x288/0x1aa0 [ 91.253850][ T5843] ? __pfx_dev_set_name+0x10/0x10 [ 91.253870][ T5843] ? __pfx_device_add+0x10/0x10 [ 91.253886][ T5843] ? mgmt_send_event_skb+0x2fb/0x460 [ 91.253915][ T5843] hci_conn_add_sysfs+0x17e/0x230 [ 91.253939][ T5843] le_conn_complete_evt+0x1260/0x2150 [ 91.253967][ T5843] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 91.253987][ T5843] ? hci_event_packet+0x459/0x11c0 [ 91.254016][ T5843] hci_le_conn_complete_evt+0x23c/0x370 [ 91.254041][ T5843] hci_le_meta_evt+0x354/0x5e0 [ 91.254061][ T5843] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 91.254084][ T5843] hci_event_packet+0x682/0x11c0 [ 91.254104][ T5843] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 91.254134][ T5843] ? __pfx_hci_event_packet+0x10/0x10 [ 91.254160][ T5843] ? kcov_remote_start+0x3c9/0x6d0 [ 91.254185][ T5843] ? lockdep_hardirqs_on+0x7c/0x110 [ 91.254214][ T5843] hci_rx_work+0x2c5/0x16b0 [ 91.254236][ T5843] ? rcu_is_watching+0x12/0xc0 [ 91.254266][ T5843] process_one_work+0x9cf/0x1b70 [ 91.254301][ T5843] ? __pfx_process_one_work+0x10/0x10 [ 91.254332][ T5843] ? assign_work+0x1a0/0x250 [ 91.254355][ T5843] worker_thread+0x6c8/0xf10 [ 91.254387][ T5843] ? __pfx_worker_thread+0x10/0x10 [ 91.254410][ T5843] kthread+0x3c2/0x780 [ 91.254432][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.254456][ T5843] ? rcu_is_watching+0x12/0xc0 [ 91.254481][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.254502][ T5843] ret_from_fork+0x56a/0x730 [ 91.254519][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.254536][ T5843] ret_from_fork_asm+0x1a/0x30 [ 91.254568][ T5843] [ 91.254842][ T5843] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 91.508830][ T5843] Bluetooth: hci4: failed to register connection device [ 91.519329][ T5843] ================================================================== [ 91.527420][ T5843] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0xdb9/0xf80 [ 91.535311][ T5843] Read of size 8 at addr ffff88807b055480 by task kworker/u9:8/5843 [ 91.543280][ T5843] [ 91.545585][ T5843] CPU: 1 UID: 0 PID: 5843 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 91.545600][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 91.545608][ T5843] Workqueue: hci4 hci_rx_work [ 91.545626][ T5843] Call Trace: [ 91.545631][ T5843] [ 91.545636][ T5843] dump_stack_lvl+0x116/0x1f0 [ 91.545652][ T5843] print_report+0xcd/0x630 [ 91.545667][ T5843] ? __virt_addr_valid+0x81/0x610 [ 91.545677][ T5843] ? __phys_addr+0xe8/0x180 [ 91.545687][ T5843] ? l2cap_connect_cfm+0xdb9/0xf80 [ 91.545699][ T5843] kasan_report+0xe0/0x110 [ 91.545712][ T5843] ? l2cap_connect_cfm+0xdb9/0xf80 [ 91.545725][ T5843] l2cap_connect_cfm+0xdb9/0xf80 [ 91.545739][ T5843] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 91.545752][ T5843] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 91.545769][ T5843] le_conn_complete_evt+0x1ba6/0x2150 [ 91.545790][ T5843] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 91.545807][ T5843] ? hci_event_packet+0x459/0x11c0 [ 91.545827][ T5843] hci_le_conn_complete_evt+0x23c/0x370 [ 91.545849][ T5843] hci_le_meta_evt+0x354/0x5e0 [ 91.545870][ T5843] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 91.545888][ T5843] hci_event_packet+0x682/0x11c0 [ 91.545905][ T5843] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 91.545918][ T5843] ? __pfx_hci_event_packet+0x10/0x10 [ 91.545931][ T5843] ? kcov_remote_start+0x3c9/0x6d0 [ 91.545946][ T5843] ? lockdep_hardirqs_on+0x7c/0x110 [ 91.545960][ T5843] hci_rx_work+0x2c5/0x16b0 [ 91.545974][ T5843] ? rcu_is_watching+0x12/0xc0 [ 91.545992][ T5843] process_one_work+0x9cf/0x1b70 [ 91.546009][ T5843] ? __pfx_process_one_work+0x10/0x10 [ 91.546024][ T5843] ? assign_work+0x1a0/0x250 [ 91.546036][ T5843] worker_thread+0x6c8/0xf10 [ 91.546052][ T5843] ? __pfx_worker_thread+0x10/0x10 [ 91.546065][ T5843] kthread+0x3c2/0x780 [ 91.546077][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.546090][ T5843] ? rcu_is_watching+0x12/0xc0 [ 91.546105][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.546117][ T5843] ret_from_fork+0x56a/0x730 [ 91.546129][ T5843] ? __pfx_kthread+0x10/0x10 [ 91.546141][ T5843] ret_from_fork_asm+0x1a/0x30 [ 91.546160][ T5843] [ 91.546164][ T5843] [ 91.754050][ T5843] Allocated by task 5843: [ 91.758353][ T5843] kasan_save_stack+0x33/0x60 [ 91.763009][ T5843] kasan_save_track+0x14/0x30 [ 91.767660][ T5843] __kasan_kmalloc+0xaa/0xb0 [ 91.772224][ T5843] l2cap_chan_create+0x44/0x920 [ 91.777065][ T5843] l2cap_sock_alloc.constprop.0+0xf5/0x1d0 [ 91.782860][ T5843] l2cap_sock_new_connection_cb+0x101/0x240 [ 91.788740][ T5843] l2cap_connect_cfm+0x4c4/0xf80 [ 91.793652][ T5843] le_conn_complete_evt+0x1ba6/0x2150 [ 91.799013][ T5843] hci_le_conn_complete_evt+0x23c/0x370 [ 91.804532][ T5843] hci_le_meta_evt+0x354/0x5e0 [ 91.809274][ T5843] hci_event_packet+0x682/0x11c0 [ 91.814189][ T5843] hci_rx_work+0x2c5/0x16b0 [ 91.818680][ T5843] process_one_work+0x9cf/0x1b70 [ 91.823608][ T5843] worker_thread+0x6c8/0xf10 [ 91.828195][ T5843] kthread+0x3c2/0x780 [ 91.832252][ T5843] ret_from_fork+0x56a/0x730 [ 91.836817][ T5843] ret_from_fork_asm+0x1a/0x30 [ 91.841558][ T5843] [ 91.843853][ T5843] Freed by task 6219: [ 91.847800][ T5843] kasan_save_stack+0x33/0x60 [ 91.852450][ T5843] kasan_save_track+0x14/0x30 [ 91.857101][ T5843] __kasan_save_free_info+0x3b/0x60 [ 91.862275][ T5843] __kasan_slab_free+0x5f/0x80 [ 91.867015][ T5843] kfree+0x2b8/0x6d0 [ 91.870906][ T5843] l2cap_chan_put+0x216/0x2c0 [ 91.875559][ T5843] l2cap_sock_cleanup_listen+0x4d/0x2a0 [ 91.881081][ T5843] l2cap_sock_release+0x69/0x250 [ 91.885996][ T5843] __sock_release+0xb0/0x270 [ 91.890563][ T5843] sock_close+0x1c/0x30 [ 91.894692][ T5843] __fput+0x3ff/0xb70 [ 91.898671][ T5843] task_work_run+0x150/0x240 [ 91.903238][ T5843] exit_to_user_mode_loop+0xec/0x130 [ 91.908499][ T5843] do_syscall_64+0x419/0x4e0 [ 91.913068][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.918938][ T5843] [ 91.921240][ T5843] The buggy address belongs to the object at ffff88807b055000 [ 91.921240][ T5843] which belongs to the cache kmalloc-2k of size 2048 [ 91.935264][ T5843] The buggy address is located 1152 bytes inside of [ 91.935264][ T5843] freed 2048-byte region [ffff88807b055000, ffff88807b055800) [ 91.949205][ T5843] [ 91.951510][ T5843] The buggy address belongs to the physical page: [ 91.957909][ T5843] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b050 [ 91.966663][ T5843] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 91.975141][ T5843] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 91.982666][ T5843] page_type: f5(slab) [ 91.986636][ T5843] raw: 00fff00000000040 ffff88801b027000 ffffea0000a19800 dead000000000002 [ 91.995194][ T5843] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 92.003762][ T5843] head: 00fff00000000040 ffff88801b027000 ffffea0000a19800 dead000000000002 [ 92.012431][ T5843] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 92.021082][ T5843] head: 00fff00000000003 ffffea0001ec1401 00000000ffffffff 00000000ffffffff [ 92.029742][ T5843] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 92.038394][ T5843] page dumped because: kasan: bad access detected [ 92.044781][ T5843] page_owner tracks the page as allocated [ 92.050468][ T5843] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5826, tgid 5826 (syz-executor), ts 68674101017, free_ts 68672857264 [ 92.071810][ T5843] post_alloc_hook+0x1c0/0x230 [ 92.076580][ T5843] get_page_from_freelist+0x10a3/0x3a30 [ 92.082117][ T5843] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 92.087989][ T5843] alloc_pages_mpol+0x1fb/0x550 [ 92.092819][ T5843] new_slab+0x24a/0x360 [ 92.096955][ T5843] ___slab_alloc+0xdc4/0x1ae0 [ 92.101613][ T5843] __slab_alloc.constprop.0+0x63/0x110 [ 92.107065][ T5843] __kmalloc_node_noprof+0x4dd/0x8a0 [ 92.112329][ T5843] qdisc_alloc+0xbb/0xc50 [ 92.116663][ T5843] qdisc_create_dflt+0x94/0x490 [ 92.121500][ T5843] dev_activate+0x63f/0x12d0 [ 92.126081][ T5843] __dev_open+0x432/0x7c0 [ 92.130398][ T5843] __dev_change_flags+0x55d/0x720 [ 92.135484][ T5843] netif_change_flags+0x8d/0x160 [ 92.140404][ T5843] do_setlink.constprop.0+0xb53/0x4380 [ 92.145872][ T5843] rtnl_newlink+0x1446/0x2000 [ 92.150537][ T5843] page last free pid 5826 tgid 5826 stack trace: [ 92.156850][ T5843] __free_frozen_pages+0x7df/0x1160 [ 92.162038][ T5843] __put_partials+0x130/0x170 [ 92.166711][ T5843] qlist_free_all+0x4d/0x120 [ 92.171280][ T5843] kasan_quarantine_reduce+0x195/0x1e0 [ 92.176712][ T5843] __kasan_slab_alloc+0x69/0x90 [ 92.181537][ T5843] __kmalloc_node_track_caller_noprof+0x2fd/0x8a0 [ 92.187937][ T5843] kstrdup+0x53/0x100 [ 92.191893][ T5843] device_rename+0x88/0x230 [ 92.196374][ T5843] netif_change_name+0x27c/0x920 [ 92.201287][ T5843] do_setlink.constprop.0+0x3362/0x4380 [ 92.206818][ T5843] rtnl_newlink+0x1446/0x2000 [ 92.211470][ T5843] rtnetlink_rcv_msg+0x95e/0xe90 [ 92.216382][ T5843] netlink_rcv_skb+0x158/0x420 [ 92.221122][ T5843] netlink_unicast+0x5a7/0x870 [ 92.225866][ T5843] netlink_sendmsg+0x8c8/0xdd0 [ 92.230636][ T5843] __sys_sendto+0x4a3/0x520 [ 92.235117][ T5843] [ 92.237416][ T5843] Memory state around the buggy address: [ 92.243024][ T5843] ffff88807b055380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.251117][ T5843] ffff88807b055400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.259170][ T5843] >ffff88807b055480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.267208][ T5843] ^ [ 92.271248][ T5843] ffff88807b055500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.279294][ T5843] ffff88807b055580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.287325][ T5843] ================================================================== [ 92.297042][ T24] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.310668][ T6220] syz.3.76 (6220) used greatest stack depth: 16536 bytes left [ 92.325825][ T5843] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 92.333051][ T5843] CPU: 1 UID: 0 PID: 5843 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 92.342509][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 92.352565][ T5843] Workqueue: hci4 hci_rx_work [ 92.357241][ T5843] Call Trace: [ 92.360500][ T5843] [ 92.363443][ T5843] dump_stack_lvl+0x3d/0x1f0 [ 92.368026][ T5843] vpanic+0x640/0x6f0 [ 92.372004][ T5843] panic+0xca/0xd0 [ 92.375707][ T5843] ? __pfx_panic+0x10/0x10 [ 92.380104][ T5843] ? l2cap_connect_cfm+0xdb9/0xf80 [ 92.385197][ T5843] ? preempt_schedule_common+0x44/0xc0 [ 92.390638][ T5843] ? preempt_schedule_thunk+0x16/0x30 [ 92.396013][ T5843] check_panic_on_warn+0xab/0xb0 [ 92.400933][ T5843] end_report+0x107/0x170 [ 92.405247][ T5843] kasan_report+0xee/0x110 [ 92.409649][ T5843] ? l2cap_connect_cfm+0xdb9/0xf80 [ 92.414746][ T5843] l2cap_connect_cfm+0xdb9/0xf80 [ 92.419671][ T5843] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 92.425115][ T5843] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 92.430558][ T5843] le_conn_complete_evt+0x1ba6/0x2150 [ 92.435920][ T5843] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 92.441620][ T5843] ? hci_event_packet+0x459/0x11c0 [ 92.446716][ T5843] hci_le_conn_complete_evt+0x23c/0x370 [ 92.452251][ T5843] hci_le_meta_evt+0x354/0x5e0 [ 92.456997][ T5843] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 92.463051][ T5843] hci_event_packet+0x682/0x11c0 [ 92.467982][ T5843] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 92.473269][ T5843] ? __pfx_hci_event_packet+0x10/0x10 [ 92.478625][ T5843] ? kcov_remote_start+0x3c9/0x6d0 [ 92.483723][ T5843] ? lockdep_hardirqs_on+0x7c/0x110 [ 92.488908][ T5843] hci_rx_work+0x2c5/0x16b0 [ 92.493414][ T5843] ? rcu_is_watching+0x12/0xc0 [ 92.498167][ T5843] process_one_work+0x9cf/0x1b70 [ 92.503092][ T5843] ? __pfx_process_one_work+0x10/0x10 [ 92.508449][ T5843] ? assign_work+0x1a0/0x250 [ 92.513020][ T5843] worker_thread+0x6c8/0xf10 [ 92.517599][ T5843] ? __pfx_worker_thread+0x10/0x10 [ 92.522702][ T5843] kthread+0x3c2/0x780 [ 92.526770][ T5843] ? __pfx_kthread+0x10/0x10 [ 92.531351][ T5843] ? rcu_is_watching+0x12/0xc0 [ 92.536113][ T5843] ? __pfx_kthread+0x10/0x10 [ 92.540692][ T5843] ret_from_fork+0x56a/0x730 [ 92.545269][ T5843] ? __pfx_kthread+0x10/0x10 [ 92.549843][ T5843] ret_from_fork_asm+0x1a/0x30 [ 92.554599][ T5843] [ 92.557791][ T5843] Kernel Offset: disabled [ 92.562090][ T5843] Rebooting in 86400 seconds..