last executing test programs: 2m39.407382939s ago: executing program 4 (id=1139): socket$isdn_base(0x22, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xcb}, 0x0) (async) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) (async) r4 = accept$alg(r3, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002940)=""/102392, 0x18ff8) (async) sendmsg$sock(r4, &(0x7f00000004c0)={&(0x7f0000000300)=@llc={0x1a, 0x301, 0x2, 0x4, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000380)="af1cee9cf4ba56440a48849bec549a7a02b057920178222c6adf50d2d4950d567d15346237e968b1d0e0fe6caa00e367ee8129101fd4f775e4bc59b31f8c45268fdb318212f86a7c0d22a86d84a9f9ef1b4a11c1701d2c38640b46a2e479e5add0131d94d49a0f20225530cb16537ca1aa3726a05e4a7331ed25cadbd26c91a004b485079734e4b827369ba80db7c325f99602bda8825bab3fde6481e30ea570d4fefbe8cfc8ce1eabf1e4e19808449daf7b4e3b10f766b56c2050be", 0xbc}, {&(0x7f0000000440)="0a68d14c4be3cc65bbbb17b90992754ae6ab7676a0244d3ec10d73d0a159b2fe5a1ddea35359ca94c3216ae9337e90aba39ce7ba75959931f57da2b335f2bf6160f37a5deae3400d7af05a72fd956cb086ff5ea180d6e735fdc10fee450565ec0b272b6847451b124ac4e8eec951f37c7a4f49", 0x73}], 0x2, &(0x7f0000000240)=[@mark={{0x14}}, @mark={{0x14, 0x1, 0x24, 0xffff}}], 0x30}, 0x4000000) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b19, &(0x7f0000000080)={'veth1_virt_wifi\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0xb2, @loopback, 0xc}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "7c80690ea8c8123e", "f92dafad9e3b473a1eaac151fe41ea97", "ee367a98", "74aff2072572aca8"}, 0x28) (async) writev(r6, &(0x7f0000001780)=[{&(0x7f00000006c0)="ba74d6a717d19f0797fde80e383d0f06834ec2455c762dcbb20c6e615768ae1ef2855bd90b1506abb8c58a7bcd64d753141e4710c3b58be77add5f8439c1afe4f5dfe3838f453e6ac1fbb2ef1c7e4322f66500cf993a948fd4580f12f47228eb0cf1fee169e666c555c49b99b5183c90797dff8b211a06cd041864fa82d2aa6a8bcc52c1316575a9ec287a5d23ddee28c25ef09fc40ef3801342b95b929ab1f622109d7adcff323dce8d88db9d01350e8d92273fbbc7186663b52c61048cc1dd663877a6ca365e1055d25f6f88f7bc480d820130636c1e99d7966cac5743f503baa549aa32be1c3c5da052b025cfc82c23bdffd7baf10b8da9099ce5c60009124cd0076b59b1dd3e7f267a83a2557ce64f074a6b0dd0d2a1a0908a04dd139764dd4b9aa55fea5e73ec674784613a2b045a8a9fb02aec4bb0fab3840cfef0d65e53d6dfc412b78ff0611b6fe39360427ab2cdb4ac00cfe931f7f539f929ad1fecebdf9b32b62fc460a1f89b87b422e41c945887e4e87936651f316e764b7b83d7add0a0c7d2555250afcefe83d889929d59bb6400ae3c5fbbe569b7855910cc28ead46a98dfe55b15bbb7d45e87126c39e16195fd9e815766d86755bc51dc89fcda44838fae895bef3452fcb44362754708436baa516c609baec2fdfa21601296240b7db905ecdb18bd720a283677f38472aa8edd5f86e5df59f29cf11e373e47176219231694d5f41a3ad0fa0e7f368164242230ffeb9c96b4683bb369dd3ab9d744e1296ae24da9b7bae7c548d34b4d40a3ec3241572923935b10bee949550808d977958e734a306f1d4154fe313815ffdfed2f709ea2150c73f9eecf6eddfcef8975cc7d9fd6812fdf03723638b4a33aae25f8a8e4fb766d0f5af2ef6340d7a1f03193faee24ee2aa9ad3cdb22cf97f5f5e1637c5e3dcc2e0e533845876d877c3d3ef445eca621b69858d4049d32c28eeaa304d274752f6ecbcac9d0b0fd792ae043fee30546ac2b73000ad48e6d037adad0a5aab5566008994d7e87eecc01135b049c10c7154cc3291f21d71089d5f515ab42c7f96dee5b76ce9dc2e86d159410256add91c3b36de1cd3af25345ccda3fa1d4ea2efa39aa479cd586d05c9cbadbcbec665dfcf16913d7c4aa2526483bd8754595887b244024673f093ed606f38a4d1ef05d9487c4e50c368db27679c507b032869901f43a0c030855074485e6064b47e04ddc213b87f69b444b552d033af4839c50417611b9e4e085ce9c91efd55484e20757e8deb494bb2d1a679b6140a15b80469f1fa2afb6ab2cb281226ed5b9f31b0c4f9ee79df1e6988802205531e93fc32f1e9d16f091818223891ea22a1d5a3397d4162809527febb5cc92d1b2c42b78196a65de99ea4b8558651ad31aa1a3fafd05052e071d2508198c25bc785bb3d96f82fbb67bae7931a33873a95fad8a28220f29a62fd456af2f214f772a0dc3ec35f89c1ac29e1f167b5020105dcf505d461e2f8ba6fbdf37fc1865df25861d59c7f9aab4670df824bcbb4a54b8927b3270a039974a4c9db6fcc249b18268ada4d63ded7961d72a6dcbf98edbdf2bc6c65c8e1b2e0b0712878b88a8a909374a327ce3918a773a5f787f042c71e5645f66eaf9f931f97f2cb3d11cdd35db0795dc0c2beb43ef727e0582236f74d9d62fcfca760e3de403b4dd65c781025b042991be215b11e08cc0557685f2a9cbfd66df9ab14d7d1962c8ba36c7c4ccc722c63e2f0e422582fc42e22b8c6d830346be1a9d08950f8bd6c66e54f05b0fb47e1e0137c93313823f63ad76a00862fb6ca19f7f9039940e4fb2176366c65e4c6380ff9d527df470f8a506ada84c2fba29f0c832e124101acd72ae837ecafae1027905b4a627c8d82582cd04fd2bc0e4c296e46f14bcd4d488e509ad92b15ffffb5975a05ffbb065e70e852412575ad7ed463f6889aace479bc97eb398d4cd7cb415f5c1953862cbe08ee2e428428475f69ea82e6e4da4613be4849ec73f05e72bf9e7e20e3a1d9938886b8ad80f6883f9f8f37094efd1502600307bfbe977250b5dc9d0bfb11b40ec58bb21ebae884da3e4776ee05de3077cd00caaa3892c9e4e9ab62011c20761fae89656c8b699214c05cd9617edf6ba3d295d49c7eeae245ec604b9bdaa44c5370278f0775e30c8a7992b50d6b1d10568d8ebaf96f63a4c3b30d1be1da72a2690d1d6a08209f07ba79718d4b37a8647efe45bd33f7afff4e6a10a3398c0befb6653cb139e52e59c84fd760bb9d52ee6fe2d9c592abaa41c979b06676bca37834eba8941213b100c8a237c84c9052b84bc973ea7738982679bd97b3805a36d6c67b145ced3a8329dcd115c13f120de5eaa188afa4a08680a924f65a1d922b4b25a60a140e91cf897635d6a881ba6856936ee852dd48992d0309ece305e0e50a87a93cc2a0ad6c8a2ebd2b958eceebc225274e344ca95b8bf98d5615bff6ad41e66f45010d7156e91fdb584b01942bc868eaeb9b234fd91a1b62812f8815bdc693842ab81b93bc885542e917bc8fa8f477a1568407179ba34f239584cace7925dc6bd4e70a140c137b21aca820b9ac18cee4a089e644ed01341e5c72616d9fd838ad110e841c27d45b3003f12c8a84b94c1d4a7bb6fae0763bb8635403fcd576e49aba43d628db611be371b97a0ffd88736651eef087f88748d89c0cf02be76242ac244e6f4a344ab58630c5d5c15bd3adf1535c498ce893416d2c6033bb9f904e1781d88260bec2ba176bf795daef73d97630e33f1481bf3f1d8fdc984cb0c6d78bc1297852f607f166f0658da2c55ec71f84664fed8537cb8e1934e904fb99db035590c874e0aae5d4004cfa8a4cb1002eb931850dcfc9a8ae59893eb36dbf40ef93991c29c808b9aaa99a6e852ab026a68bea76a3060d4e21efe502de33a7ca0363654eff9c75d1969a838aa90ee0e2ed268f1f9cedf10d1693bdb4512fcbb7484a1d054fe6f1c180e7cde130d933aace81bd7d7efe7db0bb8bafcbd0c6e839739c51f199f77aefde6d70bf110d2c046345a3a339cd9f1418ff6393eca2569580c05a0f8f9fb2f0ca55d744a8905660986968461f3982a4d6297a41d1a11248daa29d4167d6b0e328dde7fd969a0f7327ed24842ca2884c6a7dd2a43953145f720a52f6f0255a5166e5dc7cfb050c804b66486200796fb5892a70bfb4899bd9eb6c71a0d3075218e14f4846f6fad63b63b2fa414f0599cfdc2e1def25d562670a42b7d3448745ff7f56db33970a012e294270e1a546cb12969daf7b439fa26963692c97d33d24ca69b76ea3ee9068df0847b00e9a7b95f337ac5a7a27eae55037ee23f07685fddc5561a541e01998a6a2e36d5cee5a026452a07fd3af076cb7d5769d4129f753b0a9c3482f64c54e898ff7a3698d4d469e8553384f3846d987e94a5fc7bf5d48c0c0c1101d3ff5713b361aa6aeec90c3c15d3cc734e470c9038196fd746de384c2b8c755f4d68aed2f9356698821de1269467cd1d4d31d7e9a2d6bb35d5f8dbe6bce23f7e291c1c67aa1510adaff776e22fd73d5f8546d47b8b499d582965b3ef5f64ef0321b98279d3d37b5fe897658cf455182f3e69748fdcd3c355b0011bfa13bc3c3f8ce99aee8a7ed81cc54f3b6538f5bef27f46dd19cff52bad3d7bd383202fc1b5240a256c1edd9a90a1d1b08a2d3aea0639f786b6c24a90034ff355169f384a6d4b6e8fb1409796331c0302eac25ee9058bfaf5a784a3bff9724f703bd1ded0ef4fe5f3e0343bfed4047273575908ed616631c8f41fcf5469305f31edd3908ddd14e1929b6be6869ecb5a05a6f647e85614d0bacc985532ff695ee5244b91b1e080e281b87853f046c62dba4404e688326bbbec450cbe548038faccdf0d6b73bf2d20f11e1efd10efd2afea1d75b31b7d494f857574b0b509a7aa2782888c4b87e98bacdd0221cdff4bc28f0051f6090c1d32dd0f24fca891dd53a59719d2d4f199de60a60daf1c0620d886e2a2f1e77fd4bd2f910f2fae481f1af552d495bc8ea2d00ee1d0337b4cb4d4772c15c83bbdfdbdc7c323e6f7a7c117f23f9f22bf5a76e75b3df1f1eea4f3a89053d980163dcba294ff566c14ca7b9063f9df301123752c0cd83cabb1da4dde0099a4acd685284a0b8917c6047c08d7be1af3d0f32b4b6cbfb9789acf3d10eabf64689838305cc237961a4e258d062b37cbfd109c0657ad5b25face2b00e40a852a4f528eebd0f7aeff10e22802e63c69c4e139697f7fbfa4844586f5ed540c63b53440f066449bb86fb2c3f98ce4a63cf62a87b5ef7ca06239d61f1ba4d2b3e73c55550099cef61be5f771f814dd840ebb8cc6565675cc05d6458a952bafbf7a3afee7ef222271c8037cc8e4f1fffcbe43c4e16f109cf125d9a620dd5d3f95fd252911f542d4774c9a2b6e8ca5b167c3d69104cc5c7680379a979e45e03f26a3e694b852fec3ea763710b5479ea60fa2a31015c0a32665911f7e2e89da1ab7f69cef9e22916a5245dccd6758ee55216220c96562fa8f4db62a66b257a64eb961ec54ded72d22d2238103089d1f3166005e9cb306849eeb74782db08142910915fa29e61527004c55dfc8b9c79d50554557092042ded1c4d8e23b0fb62c755a93c3cdce9acfb048b4c45399f0264d85f93746c21e0448d73724563961c5e6ea4d323d12ddc9bf376dfa8e081e8403b8d832ce0735817b50ae9339e7b8bf4198c812a115f9c11261111295990acd257b9e87a671a71d42148fe6008db7b6a1e91934f6e05eb85f2166998a5c298408671886b27599dfcd81554ebbf86dd767416815cd9b11ea8f54905b973f2f2334e4bdbdb869a9ebdc249084e72cbc67772cf14494f795946155f6a14e2c76a8f4100aca32ab2dc4627834160f49b40dc2cc4d78e9042260b85710d9105e5a18bd40f8010e14384d147e0f1573f2ad91c7c1b9d9dfb3f0d12733ebcae4427bfdd2f503f52a3b0a8b540d24928b7a94157c50eee903dfa56a28dd4ef0a8408bbf0334748694c0fae63c6f012c5e23d601100cea62d07ef27bc77f6d51727bc668f01eb54a42d91834771b5c67c9b909028f88e327845df30679294fbf7561e99efbab5ca94c0a947881b7e556998a865ed98931d3c896d8ecb8fb8442a9fa199c5ddde043bbabcfdb59c25b3db8a500fc38efa36edbb20f68d5e8664cc0b30c4b5c75fdf4dc23f186b6942bd5e62d6adee3ae1fbca5a88bcc5da5280d4ccb1ebb64366fb62604083186862f9dc12c8ab63ef23534dc28ed013bae135f849cee657586a3df7db56199e0eff1a877563e993e61278db96012fc388b", 0xeb8}], 0x1) (async) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "53000c51bf8400", "7a76e2498f89a0d4def76cdbe200", "e9be1e07", "bb10000000000001"}, 0x28) 2m39.031964606s ago: executing program 4 (id=1142): r0 = socket$inet6(0xa, 0x5, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000500)=""/110, &(0x7f0000000640)=0x6e) r1 = syz_open_dev$vbi(&(0x7f0000000080), 0x0, 0x2) r2 = syz_io_uring_setup(0x6399, &(0x7f0000000f80)={0x0, 0x79af, 0x0, 0x8000, 0x32}, &(0x7f0000000880)=0x0, &(0x7f0000000080)=0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r5, 0x0) ioctl$KVM_X86_SETUP_MCE(r5, 0x4008ae9c, &(0x7f0000000000)={0x4, 0xa13ca8e5839881a8, 0x4}) read$msr(r5, &(0x7f0000000140)=""/79, 0x4f) r6 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x308, 0xe8, 0x1f8, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xff000000}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000380)={{{@in=@dev, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) mount$9p_fd(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f00000000c0), 0x1001, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r6, @ANYBLOB="2c616363655f733d6f636c6958e696c8230a423c74696d652c686173682c6575696449dd258f380eccc2273c7366ca96dab91fca603bdf", @ANYRESDEC=r8, @ANYBLOB=',\x00']) socket(0x10, 0x2, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x52, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100036ffa680863070120ff2c0102030109024000021109400c0904080601ff8bbd020a240107000d02010205240503", @ANYRES8], &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000100)=@IORING_OP_SPLICE={0x1e, 0x18, 0x0, @fd_index=0x6, 0x4, {}, 0x7, 0xd}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r9, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r9, &(0x7f0000000100)={0x50, 0x0, r10, {0x7, 0x1f, 0x5, 0x5069e481, 0xfffe, 0x7fff, 0x0, 0x0, 0xf8, 0x0, 0x4e28e1d62807e4f7}}, 0x50) io_uring_enter(r2, 0x627, 0x4c1, 0x43, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000200)={0x7, @sliced={0x7, [0x1, 0x200, 0x1, 0xc6, 0xff, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, 0x5, 0x6, 0x2, 0xfffa, 0x8, 0x7, 0x548b, 0x40, 0x3, 0x10, 0x7, 0x7, 0x7, 0x7, 0xff, 0xfffa, 0x8, 0x0, 0x6, 0xffff, 0x208, 0x8000, 0xfff, 0x1, 0x9, 0x2, 0x6, 0x7, 0x3, 0x6, 0xe, 0x1, 0x6, 0xb, 0x1000, 0xf, 0x4], 0xb}}) 2m35.889900478s ago: executing program 4 (id=1150): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x14) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0xfffff000, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000080)='./file0\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0x2) 2m35.788254796s ago: executing program 4 (id=1151): r0 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x200) ioctl$CEC_S_MODE(r0, 0x40046109, &(0x7f0000000040)=0x12) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xb0}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x5, 0x8}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r1, 0x8008f511, &(0x7f0000000080)) close_range(r1, 0xffffffffffffffff, 0x0) 2m35.736605725s ago: executing program 4 (id=1152): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000100)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x21400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) ppoll(&(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0xf) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) syz_open_dev$media(&(0x7f00000006c0), 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$FUSE_OPEN(r3, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x1b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0x1f, 0x0, &(0x7f0000000640)="b9ff03076844260002000aac14140ce000"/31, 0x0, 0x15, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x50) tee(r4, r3, 0x0, 0x2) 2m34.747136384s ago: executing program 4 (id=1156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000280)='io_uring_task_add\x00', r4, 0x0, 0x9}, 0x18) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000c000000000000000000000085000000270010001801000020646c2500000000002040000000000000000000e12e02dc0000000007010000f8ffffffb702000008000000b7030000ffffffff85000000730000109500000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000001900)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0x46, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x5, 0x4, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0xf801, @broadcast, @rand_addr=0x640100ff}, "96af4914a8f2dab5"}}}}}, 0x0) r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r9, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r10, 0xffffffffffffffff}) close(0x3) ioctl$SYNC_IOC_MERGE(r11, 0xc0303e03, &(0x7f00000001c0)={"193757f50eb2f3e2af0fd12b3037cb09c5cc8316613705a9f615cf170cf1e213", r9}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x200000}, 0x1f00) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="300000000d0a010800000000000000000a00000108000440000000010900010073797a3100000000080003800400008070b5e3a3c98a2de64531dcbc6a5578fccf8ff756eef4523b1d4d0c256eb1e38421dc0d906157fa2ec1e85333034efd99dfb36cf351a97b1945ed964273139dd7ab9cfa1070003c2a0781192e47f9617bde781cb6e28e68c9aa3f1e80"], 0x30}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) preadv(r13, &(0x7f0000000a80)=[{&(0x7f0000000540)=""/226, 0xe2}, {&(0x7f0000000640)=""/175, 0xaf}, {&(0x7f0000000700)=""/219, 0xdb}, {&(0x7f0000000880)=""/66, 0x42}, {&(0x7f0000000900)=""/249, 0xf9}, {&(0x7f0000000a00)=""/104, 0x68}], 0x6, 0x4, 0xfd) 2m18.981251602s ago: executing program 32 (id=1156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000280)='io_uring_task_add\x00', r4, 0x0, 0x9}, 0x18) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000c000000000000000000000085000000270010001801000020646c2500000000002040000000000000000000e12e02dc0000000007010000f8ffffffb702000008000000b7030000ffffffff85000000730000109500000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000001900)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0x46, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x5, 0x4, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0xf801, @broadcast, @rand_addr=0x640100ff}, "96af4914a8f2dab5"}}}}}, 0x0) r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r9, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r10, 0xffffffffffffffff}) close(0x3) ioctl$SYNC_IOC_MERGE(r11, 0xc0303e03, &(0x7f00000001c0)={"193757f50eb2f3e2af0fd12b3037cb09c5cc8316613705a9f615cf170cf1e213", r9}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x200000}, 0x1f00) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="300000000d0a010800000000000000000a00000108000440000000010900010073797a3100000000080003800400008070b5e3a3c98a2de64531dcbc6a5578fccf8ff756eef4523b1d4d0c256eb1e38421dc0d906157fa2ec1e85333034efd99dfb36cf351a97b1945ed964273139dd7ab9cfa1070003c2a0781192e47f9617bde781cb6e28e68c9aa3f1e80"], 0x30}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) preadv(r13, &(0x7f0000000a80)=[{&(0x7f0000000540)=""/226, 0xe2}, {&(0x7f0000000640)=""/175, 0xaf}, {&(0x7f0000000700)=""/219, 0xdb}, {&(0x7f0000000880)=""/66, 0x42}, {&(0x7f0000000900)=""/249, 0xf9}, {&(0x7f0000000a00)=""/104, 0x68}], 0x6, 0x4, 0xfd) 1m29.046907085s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 1m15.629663268s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 58.808248532s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 44.267258298s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 26.536045547s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 10.964451531s ago: executing program 5 (id=1216): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty=0xa00}}}], 0x20}}], 0x27, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103301) 4.827374412s ago: executing program 1 (id=1678): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10022, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4f, '\x00', 0x0, 0x2}, 0x94) mkdir(&(0x7f0000000140)='./control\x00', 0x5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000100)='sched_switch\x00', r0}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xb635773f07ebbeee, 0x110, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r4 = syz_open_dev$vim2m(0x0, 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000006800010003001000fdffff7f00000000000000000c000200010000001500000014000c8006000100f6b7000008000300cf000000060007000200000021036fdd0819bad073f944bd6feec4bf2f9179c0f5490f8795d0b9fdbacf25ddadd1a7136d13d7dc2f1fcd30c7d0fc7fa28a5573762cb3c421deca4070cc234742198793d6ba7c6f6dbf6ba66b7c09072da0e6a25a0ff4043b6a20ba768df1fc5a10888579ddc86b6f48e42f092529dd3cc982e3221bbf852588b9307c614f6def"], 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x40008c0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4080) socket$rds(0x15, 0x5, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="01002dbd7000fedbdf2531000000180001"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c090}, 0x2000c800) sendmsg$netlink(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="1401000020000101000000000000000003"], 0x114}], 0x1}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000014500000000c0a050000000000000000000a0000060900020073797a31000000000900010073797a31000000002400038020000080040001800c000440f7"], 0xbc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) recvmmsg(r2, &(0x7f0000000c40), 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) recvfrom$rxrpc(r8, &(0x7f00000006c0)=""/148, 0x94, 0x10040, &(0x7f0000000dc0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, '\x00', 0x30}, 0x28}}, 0x24) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_SNDMTU(r9, 0x112, 0xc, 0x0, &(0x7f0000000ec0)) 4.686258771s ago: executing program 3 (id=1679): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x841, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x8, 0x20132, 0xffffffffffffffff, 0xb2993000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002080)=@newtaction={0x14, 0x30, 0x25}, 0x14}}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x34652c59dd22359f}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) 4.575255767s ago: executing program 1 (id=1680): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000880}, 0x20040040) 4.475367191s ago: executing program 1 (id=1681): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x15, 0x5, 0x8) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000480)={'\x00', 0x2e9, 0x3, 0x0, 0x3, 0x80000001, 0xffffffffffffffff}) fcntl$lock(r1, 0x6, &(0x7f0000000140)={0x1, 0x1, 0x8, 0x4, r4}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xffffffff, 0x0, 0xb49, 0x9, 0x8000000000000001, 0x0, 0x3}, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4, 0x5}}, 0xe8) r7 = syz_open_dev$dri(0x0, 0x7, 0x220042) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000280)=[0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r7, 0xc01064ab, &(0x7f0000000380)={0x1d52}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r7, 0xc01064ab, &(0x7f0000000440)={0x5}) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x28}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x10}}, 0x0) 4.416016736s ago: executing program 2 (id=1682): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) (async) syz_open_dev$dri(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x800, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) (async) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x60, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}, @IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5, 0x9, 0x1}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x60, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}, @IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5, 0x9, 0x1}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4.397327056s ago: executing program 3 (id=1683): ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(0xffffffffffffffff, 0xc0884123, &(0x7f0000000300)={0x1, "c4aaccd94696ecbf345d02bb2514af88d609d88f8aaffc86b6aec4f10946c9d80edb30af80a826c82a71c7ce780b51d7ee4075fe788e4327cfa84263342f538d", {0x7ff, 0x7}}) r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x7e, 0x20203843, 0x3, [0x2], [0x800], [0x101, 0x0, 0x0, 0xb1e5]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000040)=ANY=[@ANYBLOB="180800000000000000000000000000008510000029000000180000000000000000060000000000009500000000000000bf200100040000002f8a0800100000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41000}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r1) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, r2, 0x511, 0x0, 0xfffffffe, {0x5}}, 0x21}, 0x1, 0x0, 0x0, 0xfffffffe}, 0xa000000) 4.295627935s ago: executing program 3 (id=1684): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@generic={&(0x7f0000000140)='./file0\x00', r2}, 0x18) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x18) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = openat$comedi(0xffffff9c, &(0x7f0000000440)='/dev/comedi0\x00', 0x101001, 0x0) fadvise64(r3, 0x8, 0x6, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) readv(r3, &(0x7f0000000800)=[{&(0x7f0000000340)=""/48, 0x30}, {0x0, 0x30}], 0x2) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40440) ioctl$VIDIOC_S_PARM(r6, 0xc0cc5616, &(0x7f0000000200)={0x1, @capture={0x1000, 0x1, {0xc}, 0xfffffffe, 0x7e}}) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000140)=0x7fffffff, 0x4) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x0, 0x6}, 0x76e0}) fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r0, 0x1, 0x0) (async) fchdir(r1) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) (async) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)=@generic={&(0x7f0000000140)='./file0\x00', r2}, 0x18) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x18) (async) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) openat$comedi(0xffffff9c, &(0x7f0000000440)='/dev/comedi0\x00', 0x101001, 0x0) (async) fadvise64(r3, 0x8, 0x6, 0x0) (async) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) (async) readv(r3, &(0x7f0000000800)=[{&(0x7f0000000340)=""/48, 0x30}, {0x0, 0x30}], 0x2) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40440) (async) ioctl$VIDIOC_S_PARM(r6, 0xc0cc5616, &(0x7f0000000200)={0x1, @capture={0x1000, 0x1, {0xc}, 0xfffffffe, 0x7e}}) (async) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000140)=0x7fffffff, 0x4) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x0, 0x6}, 0x76e0}) (async) 4.191848331s ago: executing program 2 (id=1685): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x300000000000000}, 0x800) 3.897048068s ago: executing program 3 (id=1686): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xc1103000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './cgroup/file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) fsconfig$FSCONFIG_SET_PATH(r5, 0x3, 0x0, &(0x7f0000000200)='./file0/file0\x00', r5) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x40049366, &(0x7f0000000180)) ioctl$AUTOFS_IOC_EXPIRE(r5, 0x810c9365, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000000400)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x12) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000580)={0xac, r6, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xbd}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x41}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xd}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x200080c4) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='exfat\x00', 0x0, &(0x7f00000001c0)='discard') syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) pipe2$watch_queue(&(0x7f0000000300), 0x80) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000003000/0x3000)=nil, 0x3000, &(0x7f0000000000)='pids.current\x00') ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000740)=ANY=[@ANYRES64, @ANYRES64]) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x82801, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r8, 0x40043311, 0x0) 2.991747449s ago: executing program 3 (id=1688): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() r2 = socket$kcm(0x1e, 0x5, 0x0) recvmsg(r2, 0x0, 0x40000010) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10, 0xffffffffffffffff, 0xdd1f000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x3, 0x7fff0000}]}) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = fanotify_init(0x4000, 0x0) fanotify_mark(r5, 0x80, 0x40000012, 0xffffffffffffffff, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r6, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000500)}}], 0x1, 0x34000811) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000340)={0x0}, &(0x7f0000000180)=0x8) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000300)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f0000000380)={0xfbff, 0x0, 0x8000003, 0x3, r9}, 0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000000c0)={r9, 0x3}, 0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f0000000580)={r7}, &(0x7f00000001c0)=0x8) io_uring_setup(0x4c9e, &(0x7f0000000040)={0x0, 0x10f4, 0x200, 0x0, 0xbe}) 2.903903332s ago: executing program 0 (id=1689): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f0000000680)=ANY=[@ANYRES8=0x0, @ANYRES16=0x0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f0000000680)=ANY=[@ANYRES8=0x0, @ANYRES16=0x0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0, 0x0, 0x4}, 0x18) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000100)={{0x0, 0x0, 0x3, 0x1, 0x80}, 0x0, 0x2, 'id0\x00', 'timer1\x00', 0x0, 0x0, 0x65, 0x5, 0x7}) fcntl$setstatus(r0, 0x4, 0x40000) openat$zero(0xffffffffffffff9c, &(0x7f0000000380), 0x271483, 0x0) (async) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380), 0x271483, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000200)=0x1, 0x4) (async) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000200)=0x1, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01000000040000000400000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRESHEX=r0, @ANYRES8=r4, @ANYRESHEX=r1], 0x0, 0xfffffffc, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRESHEX=r0, @ANYRES8=r4, @ANYRESHEX=r1], 0x0, 0xfffffffc, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x40000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) (async) r8 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x4008, 0x40000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}}]}}}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x4008, 0x40000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}}]}}}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000b000000050010000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r11, @ANYRES32=r1, @ANYRESHEX=r5], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000b000000050010000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r11, @ANYRES32=r1, @ANYRESHEX=r5], 0x48) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a320000410073697700140033006c6f3b4ac85ba1001d5fa7071e0a103d60e0bb87598d11ba8bf3f4565327ed6fede308cdac005751d4fa08ff73ae01f40141a29adad998348b62f1e630a693b84bf0f29a6cb3a4e541453f83834b4416e103a4088ef4973a4e149da0b13b3072c609d0ce2274037c638f6fb30efe06441f2f95f6722d2e32a9592e684abe8df03f6eebd3062d510608318fae13052ece6fdcd764e80798574c0b77f9c86694069732e0f036c46785a2b802d2e6116f56619f164fcd9914cd3cdc652a68ea1869276992f1f8c45753f0e0a09af8169467c1b3edc58199e8859a3add6fcb93b104bf07585fc458e61a55fa2bea316fdb", @ANYRESHEX=r2], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08d1ca4eb6b8b4889cdd4e786eb807e04eb88b935d785f3d3201c58033c88e160d"], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) sendfile(r1, r1, 0x0, 0x40000f63c) sendto$inet(0xffffffffffffffff, &(0x7f0000000380)="8a80dff7b81e93", 0x7, 0x0, 0x0, 0x0) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r13, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r13, 0xae60) ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) (async) ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r13, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) 2.597224389s ago: executing program 1 (id=1690): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x109000, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$RTC_PIE_ON(r5, 0x7005) ioctl$RTC_IRQP_SET(r5, 0x4008700c, 0x80000000000725) 2.497886374s ago: executing program 0 (id=1691): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000880}, 0x20040040) 2.108094086s ago: executing program 0 (id=1692): syz_emit_ethernet(0x92, &(0x7f0000000200)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x1c, 0x4, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@cipso={0x86, 0x5a, 0x3, [{0x2, 0x10, "ceb4a1de2d9ab46b87084078782c"}, {0x1, 0x9, "af15365ee049b7"}, {0x2, 0x10, "ab00"/14}, {0x6, 0x7, "3bf3cca349"}, {0x5, 0xe, "d9d84f74c9d226cca31c68ab"}, {0x3, 0xc, "9e7f387475300150a861"}, {0x2, 0xa, "6e76cf4beaf11ccc"}]}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x7fff, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0x80000039f8, 0x4) timer_create(0x3, &(0x7f0000000100)={0x0, 0xe}, &(0x7f0000000140)=0x0) timer_settime(r1, 0x0, &(0x7f0000000300)={{}, {0x0, 0x3938700}}, &(0x7f0000000340)) sendto$inet6(r0, &(0x7f0000000000)="8d", 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0x8, &(0x7f00000002c0)={0x6, 0x6}, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0xfffffffe, 0x0, 0x3a5f, 0x8}) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x1000000, 0x1000}, 0x20) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000380)) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, [@call={0x85, 0x0, 0x0, 0x28}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3ff}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmmsg(r0, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}, 0x96f4}], 0x1, 0x60, 0x0) syz_open_dev$video(&(0x7f0000000740), 0x3, 0x400) 1.932097789s ago: executing program 3 (id=1693): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000997aa910c6250290ba41010203010902120001000000000904"], 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0xa000, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, @private=0xa010101, @rand_addr=0x3, {[@rr={0x7, 0x3, 0xf4}]}}}}}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r2, &(0x7f0000000340)={0x2, 0xffff, 0x0, @remote}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') getdents64(r3, &(0x7f0000000000)=""/181, 0xb5) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r5, &(0x7f0000000280)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @remote, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000300)="e2", 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e20, 0x1dc5ad4a, @private1={0xfc, 0x1, '\x00', 0x1}, 0x10}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000040)='^', 0x1}], 0x1}}], 0x2, 0x14) shutdown(r5, 0x1) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000080)={0x28, 0x1, 0x0, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f0000000380)=[r8], &(0x7f00000003c0)=[0x7], &(0x7f00000000c0)=[r9], &(0x7f0000000180)=[0x31], 0x0, 0xff}) syz_usb_control_io$hid(r0, 0x0, 0x0) 1.696451155s ago: executing program 0 (id=1694): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$KVM_SET_GUEST_DEBUG_x86(r0, 0x4048ae9b, &(0x7f00000002c0)={0x80000, 0x0, {[0xf, 0xa58, 0x1ff, 0x6, 0x9489, 0xe800000000000000, 0xda1, 0x7]}}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r3}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f0000000380)=[r3], &(0x7f00000003c0)=[0x7], &(0x7f00000000c0)=[r4], &(0x7f0000000180)=[0x31], 0x0, 0xff}) ioctl$DRM_IOCTL_MODE_CURSOR2(r0, 0xc02464bb, &(0x7f00000000c0)={0x2, r3, 0x0, 0x7, 0x8, 0x5946, 0x5, 0x80000000, 0x8}) move_mount(r0, 0x0, r0, &(0x7f0000000000)='./file1\x00', 0x115) 1.619993453s ago: executing program 2 (id=1695): socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b40)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xb0ffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) ustat(0x9, &(0x7f0000000480)) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10) ppoll(&(0x7f0000000500)=[{r6}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendto$inet6(r5, &(0x7f0000847fff), 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.578811878s ago: executing program 1 (id=1696): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socket(0x2b, 0x80801, 0x1) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x20, 0x40, 0x0, 0x0, 0x0, 0x7}}, 0x1c}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106}}, 0x20) ioctl$VIDIOC_S_HW_FREQ_SEEK(0xffffffffffffffff, 0x40305652, &(0x7f00000002c0)={0x0, 0x1, 0x0, 0x0, 0x80, 0xfa000, 0x8}) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4000, 0xffffffff, @mcast2}, {0xa, 0x0, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x86}}}, 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) ioctl$BLKDISCARDZEROES(0xffffffffffffffff, 0x127c, &(0x7f0000000000)) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}, 0x1, 0x0, 0x100000000000000}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="6002000043000701fefffffffcdbdf25037c00"], 0x260}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) 1.364042046s ago: executing program 0 (id=1697): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x7d, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x400000a0, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 588.179408ms ago: executing program 2 (id=1698): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x142) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x40086602, &(0x7f0000000080)={@desc={0xffff8000, 0x0, @desc2}}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r2, 0x26, &(0x7f0000000280)={0x1, 0x1, 0xb8, 0x403}) fcntl$lock(r2, 0x24, &(0x7f0000000180)={0x2, 0x1, 0x400000200, 0x2}) r3 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x10780, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2, 0x2}, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$selinux_user(0xffffffffffffff9c, 0x0, 0x2, 0x0) getsockname$unix(r3, &(0x7f00000002c0)=@abs, &(0x7f0000000000)=0x6e) r5 = inotify_init1(0x0) r6 = dup(r5) inotify_rm_watch(r6, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) 432.012722ms ago: executing program 0 (id=1699): unshare(0x66000080) r0 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'vlan0\x00', 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100000000000000000200000000", @ANYRES32=r1, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r2], 0x28}}, 0x0) 156.135758ms ago: executing program 2 (id=1700): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x0, 0x4, 0x0, 0x7}) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x0, 0x0, 0x9}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r1, 0x4b45, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f046}) 113.893821ms ago: executing program 1 (id=1701): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r3 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000031401000000001f000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) write$rfkill(0xffffffffffffffff, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) syz_open_procfs(0x0, 0x0) r4 = syz_io_uring_setup(0x49b, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x7, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x4, 0x0, 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x24004030) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, 0x0, 0x0) io_uring_enter(r4, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000080)="e7a47f1510a3f0d0f58b1404747bfa7b51530d0bf50bcc642f72284c9e8e2d0e1cdc1eb5e63643feea6a12730652a5215c59d8e06a53e154e27ef57b27093707bbb997da7cdb2dc0b1cb7162cbfa41737cfa7e04a668b00a85a117bc1c1bd8bb026a6ab54080f403ca25760f6e2d90afe4d1545942735eaf1ac94f0e68019367415d0ba2d4102d25be7a391df28b6e950245a81bece1ad19ee317f4e6ac76edf329f8161f887a15e06e03762ce33d7591740d83b3aebf58b383adb9ebf54e7f247e26a6ff1c3bfbbee6eb7be1d3dc4ee9049b73151f19484c9f3f5f4c7c6bc9b70e80900cd043a3d5ae66d3b74453a0b897ff897ac09bd205959ca487102d1ac54abc0bb63300537d2b6db5c3a54bdc45feefbd0f0b39631306890993782a0dd58aee59d317a82c2356ffe1e4da5d21fc11abe7f7bebd9d8b1ffb356732f1990c3fe7ff34c4a598d65ed0133cf8f910f9e4d9699d4ab2f211a671dbaad9e6bc7eb67396d2389ed81cbf234c0dd50008e854bf81737050e063bd5d3aad092ba4fd4", 0x181, 0x200c80d1, 0x0, 0x0) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r8, &(0x7f0000000080)={&(0x7f0000000040)={0x24, @none={0x0, 0x1}}, 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x4}, 0x8000) pipe2$9p(&(0x7f0000000400), 0x84080) fstat(r8, &(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) r9 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r9, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="480000000e14200025bd7000ffdbdf298fd8fce5afe8f4d1baf9db7928ff250800030000000000080003ea87963aacaa30b7ecc8900cc00000000000080001000200000008000100020000000800030000000000080003957b6ca2cdd9747fa199b7d5dd891308239b5c1f3580fab96d8d021c5b13b387fd120b3ad68da6fa426fafde347a69a3051f4f9ae01a8ae6cfd395c2e1a8d343d8d4b51fc204dedb4c58f986cb6cf0541dd8b4ed4b055df135566afb7161aba9eda91979b038498d69cdf2b6f5f802aad9c26749e55dcc75a2c7ba2808bfb2365f9d86b89e948e31477a86a823fe8cab98c8bb2dce6dbfd9b42127833ea7d838b656a1d872abba4565976a4860dab52077819aeb53a822ce435e53153120a57496b9447e7df31fed12648be470325175f397f310069a5741c0b186574de65e695d80efdc4940c396fa9b88307cc58a0a"], 0x48}, 0x1, 0x0, 0x0, 0x20004000}, 0x8045) 0s ago: executing program 2 (id=1702): r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x16, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="0000000000000000b70100000000000000a5e7561538b3030000b131000001e1007c0c000000b7090000000000005509011000a99598a86f7a00000095000000000000701e78999000bf91000000000000b7020000000000008500000000000000b70000fffe"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) syz_usb_connect(0x0, 0x92, &(0x7f0000000200)={{0x12, 0x1, 0x310, 0xdd, 0x16, 0x5b, 0x20, 0xe8d, 0x3, 0x3a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x80, 0x1, 0x4, 0xbe, 0x20, 0x2, [{{0x9, 0x4, 0x6b, 0x79, 0x1, 0x76, 0x4b, 0x9c, 0x6, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "96"}, {0x5, 0x24, 0x0, 0x400}, {0xd, 0x24, 0xf, 0x1, 0x9, 0xcba6, 0x8, 0x3}, {0x6, 0x24, 0x1a, 0x200, 0x20}, [@country_functional={0x6, 0x24, 0x7, 0xff, 0xf0}, @country_functional={0x10, 0x24, 0x7, 0x2, 0x200, [0xa5, 0x9, 0x2, 0x9, 0x2]}, @network_terminal={0x7, 0x24, 0xa, 0x0, 0x9, 0x5, 0x7}, @country_functional={0xe, 0x24, 0x7, 0xe6, 0x3, [0x2, 0x9408, 0x6, 0x3]}, @dmm={0x7, 0x24, 0x14, 0x7, 0x7}, @dmm={0x7, 0x24, 0x14, 0x6, 0xdfc}]}], [{{0x9, 0x5, 0x4, 0x3, 0x20, 0x40, 0x10, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x1, 0x480}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x7, 0x5}]}}]}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x310, 0x9, 0x6, 0x2, 0xff, 0x9}, 0x2c, &(0x7f0000000080)={0x5, 0xf, 0x2c, 0x2, [@ssp_cap={0x24, 0x10, 0xa, 0x2d, 0x6, 0x8, 0x0, 0xff, [0xc0, 0xffff0f, 0xc000, 0xffc000, 0x8080c0, 0x3fc0]}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x42b}}]}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) shutdown(r2, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(r2, &(0x7f0000000c40)="d68f46cb91980e861416b2e3333f1d53c80a05beea6807003a0050a074e3", 0x1e, 0x80, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x80000000fea8, 0x7) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x88, 0x88, 0x3, [@restrict={0x8, 0x0, 0x0, 0xb, 0x3}, @fwd={0xb}, @float={0x1, 0x0, 0x0, 0x10, 0x2}, @struct={0x6, 0x5, 0x0, 0x4, 0x1, 0x9, [{0x8, 0x0, 0x2}, {0xc, 0x2, 0x800}, {0xe, 0x0, 0x8}, {0x5, 0x1, 0x9}, {0x8, 0x4, 0x8}]}, @const={0x7, 0x0, 0x0, 0xa, 0x4}, @int={0x10, 0x0, 0x0, 0x1, 0x0, 0x64, 0x0, 0x19, 0x6}]}, {0x0, [0x61]}}, &(0x7f0000000680)=""/188, 0xa3, 0xbc, 0x0, 0xffffffff}, 0x28) r3 = open(&(0x7f00000000c0)='.\x00', 0xd5b203, 0x8) lseek(r3, 0xfffffffffffffffb, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x4}, 0x50) syz_open_procfs(0x0, &(0x7f0000000480)='net/ip_vs_stats\x00') bpf$OBJ_GET_MAP(0x7, &(0x7f0000000880)=@generic={&(0x7f0000000840)='./file0\x00'}, 0x18) r4 = socket$packet(0x11, 0x3, 0x300) io_submit(0x0, 0x2, &(0x7f0000000340)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2, 0x4, r4, &(0x7f0000000080)="458dbf4c", 0x4, 0x5a, 0x0, 0x2}]) pipe(&(0x7f00000008c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) kernel console output (not intermixed with test programs): } for pid=10158 comm="syz.4.1156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 354.775319][T10159] smc: removing ib device syz! [ 355.210256][ T24] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 355.372426][ T24] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 355.445895][ T24] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 355.466856][T10170] 9pnet_fd: Insufficient options for proto=fd [ 355.525857][T10170] netlink: 'syz.1.1157': attribute type 10 has an invalid length. [ 355.537095][T10170] team0: left promiscuous mode [ 355.542258][T10170] team_slave_0: left promiscuous mode [ 355.549105][T10170] team_slave_1: left promiscuous mode [ 355.555337][T10170] team0: left allmulticast mode [ 355.560697][T10170] team_slave_0: left allmulticast mode [ 355.566221][T10170] team_slave_1: left allmulticast mode [ 355.650285][ T24] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 355.767078][ T24] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 355.849202][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.956131][T10157] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 355.994333][ T30] audit: type=1400 audit(1761269589.231:786): avc: denied { create } for pid=10173 comm="syz.0.1159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 356.770477][ T24] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 356.779582][ T24] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input24 [ 356.814942][ T24] usb 3-1: USB disconnect, device number 37 [ 356.821241][ C1] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 356.990747][T10194] Failed to initialize the IGMP autojoin socket (err -2) [ 357.260426][ T5881] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 357.547751][T10204] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 357.581576][ T5881] usb 1-1: config 0 has no interfaces? [ 357.589266][ T5881] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 357.671203][ T5881] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.697892][ T5881] usb 1-1: Product: syz [ 357.702453][ T5881] usb 1-1: Manufacturer: syz [ 357.707070][ T5881] usb 1-1: SerialNumber: syz [ 358.235775][ T5881] usb 1-1: config 0 descriptor?? [ 358.348751][T10212] [U] ×_LÏŸ]M [ 358.444235][ T30] audit: type=1400 audit(1761269591.781:787): avc: denied { bind } for pid=10211 comm="syz.2.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 358.463508][ T5881] usb 1-1: USB disconnect, device number 28 [ 358.483886][T10212] [U] vÔ3¸Âfù¾"SçÁ/Éê4:ÃXTz“W¡t‘’lWµ«= [ 358.509745][T10212] [U] J"—e:ÀÆ" [ 358.553812][ T30] audit: type=1400 audit(1761269591.891:788): avc: denied { connect } for pid=10215 comm="syz.2.1171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 358.804395][T10216] Failed to initialize the IGMP autojoin socket (err -2) [ 358.826386][ T30] audit: type=1400 audit(1761269592.161:789): avc: denied { write } for pid=10213 comm="syz.1.1170" path="socket:[27940]" dev="sockfs" ino=27940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 358.963050][T10225] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1172'. [ 360.521904][ T5866] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 360.800056][ T5866] usb 1-1: Using ep0 maxpacket: 32 [ 360.806769][ T5866] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 360.929173][T10239] netlink: 'syz.2.1175': attribute type 1 has an invalid length. [ 360.947781][ T5866] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 361.010240][T10240] netlink: 34 bytes leftover after parsing attributes in process `syz.3.1174'. [ 361.088127][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 361.137055][T10239] 8021q: adding VLAN 0 to HW filter on device bond1 [ 361.144398][ T5866] usb 1-1: Product: syz [ 361.149429][ T5866] usb 1-1: Manufacturer: syz [ 361.155934][ T5866] usb 1-1: SerialNumber: syz [ 361.170575][ T5866] usb 1-1: config 0 descriptor?? [ 361.176710][T10234] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 361.185041][ T5866] hub 1-1:0.0: bad descriptor, ignoring hub [ 361.191143][ T5866] hub 1-1:0.0: probe with driver hub failed with error -5 [ 361.390179][ T5881] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 361.500232][ T11] usb 1-1: USB disconnect, device number 29 [ 361.552332][ T5881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 361.563556][ T5881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 361.573800][ T5881] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 361.587128][ T5881] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 361.596693][ T5881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.606179][ T5881] usb 3-1: config 0 descriptor?? [ 362.206284][ T5881] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 362.916009][T10262] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1180'. [ 362.925454][T10262] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1180'. [ 362.935084][T10262] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1180'. [ 362.944169][T10262] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1180'. [ 362.953560][T10262] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1180'. [ 363.054188][T10265] random: crng reseeded on system resumption [ 363.275406][T10270] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.1183'. [ 363.285176][T10270] openvswitch: netlink: Missing key (keys=40, expected=100) [ 363.936029][T10280] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1187'. [ 363.940332][ T30] audit: type=1400 audit(1761269597.271:790): avc: denied { bind } for pid=10277 comm="syz.3.1186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 364.003729][ T11] usb 3-1: USB disconnect, device number 38 [ 364.502261][T10286] tmpfs: Bad value for 'mpol' [ 365.039267][T10302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=15529 sclass=netlink_route_socket pid=10302 comm=syz.3.1192 [ 365.555078][T10307] netlink: 666 bytes leftover after parsing attributes in process `syz.1.1195'. [ 366.033253][T10311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 366.040844][T10311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 366.107355][T10311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 366.107735][ T30] audit: type=1400 audit(1761269599.441:791): avc: denied { open } for pid=10310 comm="syz.1.1197" path="/dev/ptyq7" dev="devtmpfs" ino=126 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 366.115089][T10311] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 366.790908][T10319] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1198'. [ 367.421448][ T30] audit: type=1400 audit(1761269600.741:792): avc: denied { setopt } for pid=10325 comm="syz.2.1200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 367.572354][ T5866] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 367.824872][ T5866] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 367.835418][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.847380][ T5866] usb 4-1: Product: syz [ 367.884313][ T5866] usb 4-1: Manufacturer: syz [ 367.903710][ T5866] usb 4-1: SerialNumber: syz [ 367.960237][ T5866] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 367.972114][ T30] audit: type=1400 audit(1761269601.311:793): avc: denied { firmware_load } for pid=24 comm="kworker/1:0" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 367.997998][ C0] vkms_vblank_simulate: vblank timer overrun [ 368.024139][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 368.221106][T10353] binder: 10352:10353 ioctl c0306201 200000001a80 returned -14 [ 368.537529][ T5880] usb 4-1: USB disconnect, device number 19 [ 368.660086][ T5866] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 369.090205][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 369.097678][ T5866] usb 3-1: Using ep0 maxpacket: 16 [ 369.103320][ T24] ath9k_htc: Failed to initialize the device [ 369.110479][ T5880] usb 4-1: ath9k_htc: USB layer deinitialized [ 369.112472][ T5866] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 369.127666][ T5866] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 369.136978][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.146583][ T5866] usb 3-1: config 0 descriptor?? [ 369.659394][ T5866] mcp2221 0003:04D8:00DD.0009: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 370.068092][T10373] netlink: 666 bytes leftover after parsing attributes in process `syz.1.1214'. [ 370.586035][ T11] usb 3-1: USB disconnect, device number 39 [ 370.942633][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 370.957456][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 370.969886][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 370.980605][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 370.988335][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 371.018445][ T30] audit: type=1400 audit(1761269604.351:794): avc: denied { mounton } for pid=10384 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 371.070437][T10384] Failed to initialize the IGMP autojoin socket (err -2) [ 371.121185][ T5880] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 371.301911][ T5880] usb 2-1: Using ep0 maxpacket: 8 [ 371.355468][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 371.378706][T10384] chnl_net:caif_netlink_parms(): no params data found [ 371.394172][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 371.427193][ T5880] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 371.447471][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 371.484779][ T5880] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 371.523354][ T5880] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 371.566166][ T5880] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.598185][ T5880] usb 2-1: config 0 descriptor?? [ 371.626024][ T5816] Bluetooth: hci6: urb ffff888053ac4300 submission failed (90) [ 371.725738][ T30] audit: type=1326 audit(1761269605.051:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 371.841736][ T30] audit: type=1326 audit(1761269605.061:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 371.862101][ T5880] usb 2-1: USB disconnect, device number 30 [ 371.870573][ T30] audit: type=1326 audit(1761269605.061:797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 371.912766][T10384] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.939466][T10384] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.946884][ T30] audit: type=1326 audit(1761269605.061:798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 371.946928][ T30] audit: type=1326 audit(1761269605.091:799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 371.970264][ C0] vkms_vblank_simulate: vblank timer overrun [ 372.006660][T10384] bridge_slave_0: entered allmulticast mode [ 372.026173][T10384] bridge_slave_0: entered promiscuous mode [ 372.073797][T10384] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.091160][T10384] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.124210][T10384] bridge_slave_1: entered allmulticast mode [ 372.150173][ T30] audit: type=1326 audit(1761269605.091:800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 372.153860][T10384] bridge_slave_1: entered promiscuous mode [ 372.188760][ T30] audit: type=1326 audit(1761269605.091:801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 372.263759][ T30] audit: type=1326 audit(1761269605.091:802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 372.287346][ C0] vkms_vblank_simulate: vblank timer overrun [ 372.401163][ T30] audit: type=1326 audit(1761269605.091:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10414 comm="syz.2.1226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7ffbd278efc9 code=0x7ffc0000 [ 372.751850][T10443] netlink: 1363 bytes leftover after parsing attributes in process `syz.3.1232'. [ 373.492088][ T5816] Bluetooth: hci5: command tx timeout [ 373.513706][T10384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 373.556561][T10384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 373.734712][T10453] mmap: syz.1.1234 (10453): VmData 25825280 exceed data ulimit 3. Update limits or use boot option ignore_rlimit_data. [ 373.945078][T10465] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 373.951633][T10465] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 373.959448][T10465] vhci_hcd vhci_hcd.0: Device attached [ 374.050608][ T5880] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 374.105976][T10465] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(9) [ 374.112530][T10465] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 374.120481][T10465] vhci_hcd vhci_hcd.0: Device attached [ 374.158825][T10465] fuse: Unknown parameter 'user00000000000000000000' [ 374.243203][T10469] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(12) [ 374.249846][T10469] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 374.257624][T10469] vhci_hcd vhci_hcd.0: Device attached [ 374.320664][ T11] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 374.375619][ T5880] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 374.557407][T10473] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(15) [ 374.564305][T10473] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 374.572579][T10473] vhci_hcd vhci_hcd.0: Device attached [ 374.868216][T10475] vhci_hcd: connection closed [ 374.870587][T10468] vhci_hcd: connection closed [ 374.875344][T10472] vhci_hcd: connection closed [ 375.057933][T10466] vhci_hcd: connection closed [ 375.343685][T10467] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 375.414303][ T50] vhci_hcd: stop threads [ 375.418592][ T50] vhci_hcd: release socket [ 375.423379][ T50] vhci_hcd: disconnect device [ 375.464927][ T50] vhci_hcd: stop threads [ 375.469217][ T50] vhci_hcd: release socket [ 375.490394][ T50] vhci_hcd: disconnect device [ 375.492102][ T5880] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 375.505302][ T50] vhci_hcd: stop threads [ 375.509579][ T50] vhci_hcd: release socket [ 375.528249][T10384] team0: Port device team_slave_0 added [ 375.568161][ T50] vhci_hcd: disconnect device [ 375.572538][ T5816] Bluetooth: hci5: command tx timeout [ 375.574328][ T50] vhci_hcd: stop threads [ 375.578961][ T5880] usb 3-1: config 1 interface 0 has no altsetting 0 [ 375.600268][ T50] vhci_hcd: release socket [ 375.605029][ T50] vhci_hcd: disconnect device [ 375.614060][ T5880] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 375.626769][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.636023][ T5880] usb 3-1: Product: syz [ 375.636828][T10384] team0: Port device team_slave_1 added [ 375.640718][ T5880] usb 3-1: Manufacturer: syz [ 375.654492][ T5880] usb 3-1: SerialNumber: syz [ 375.670822][T10458] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 375.687079][T10458] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 375.747940][T10384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 375.764814][T10384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.905488][T10384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 375.955808][T10384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 375.980151][T10384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.170768][T10384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 377.173151][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 377.173168][ T30] audit: type=1400 audit(1761269609.731:844): avc: denied { mount } for pid=10494 comm="syz.3.1246" name="/" dev="rpc_pipefs" ino=28876 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 377.566118][ T30] audit: type=1400 audit(1761269609.751:845): avc: denied { mounton } for pid=10494 comm="syz.3.1246" path="/290/file0" dev="rpc_pipefs" ino=28876 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=dir permissive=1 [ 377.650732][ T5816] Bluetooth: hci5: command tx timeout [ 377.794967][T10384] hsr_slave_0: entered promiscuous mode [ 377.826864][T10384] hsr_slave_1: entered promiscuous mode [ 377.848616][T10384] debugfs: 'hsr0' already exists in 'hsr' [ 377.869122][T10384] Cannot create hsr debugfs directory [ 378.216404][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 378.226005][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.232984][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.259119][T10527] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1251'. [ 378.268947][T10527] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1251'. [ 378.605531][T10384] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 378.650463][T10384] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 378.759117][ T5880] rtl8150 3-1:1.0: couldn't reset the device [ 378.774999][ T5880] rtl8150 3-1:1.0: probe with driver rtl8150 failed with error -5 [ 378.775985][T10384] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 378.799325][T10527] nvme_fabrics: missing parameter 'transport=%s' [ 378.806345][T10527] nvme_fabrics: missing parameter 'nqn=%s' [ 378.846697][ T5880] usb 3-1: USB disconnect, device number 40 [ 378.859054][T10384] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 379.134057][ T30] audit: type=1400 audit(1761269612.401:846): avc: denied { unmount } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 379.343537][T10546] FAULT_INJECTION: forcing a failure. [ 379.343537][T10546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.407005][T10546] CPU: 1 UID: 0 PID: 10546 Comm: syz.3.1254 Not tainted syzkaller #0 PREEMPT(full) [ 379.407029][T10546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 379.407040][T10546] Call Trace: [ 379.407045][T10546] [ 379.407052][T10546] dump_stack_lvl+0x16c/0x1f0 [ 379.407083][T10546] should_fail_ex+0x512/0x640 [ 379.407107][T10546] _copy_to_user+0x32/0xd0 [ 379.407131][T10546] simple_read_from_buffer+0xcb/0x170 [ 379.407161][T10546] proc_fail_nth_read+0x197/0x240 [ 379.407182][T10546] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 379.407203][T10546] ? rw_verify_area+0xcf/0x6c0 [ 379.407226][T10546] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 379.407246][T10546] vfs_read+0x1e4/0xcf0 [ 379.407264][T10546] ? __pfx___mutex_lock+0x10/0x10 [ 379.407280][T10546] ? __pfx_vfs_read+0x10/0x10 [ 379.407300][T10546] ? __fget_files+0x20e/0x3c0 [ 379.407324][T10546] ksys_read+0x12a/0x250 [ 379.407337][T10546] ? __pfx_ksys_read+0x10/0x10 [ 379.407350][T10546] ? fput+0x9b/0xd0 [ 379.407372][T10546] do_syscall_64+0xcd/0xfa0 [ 379.407398][T10546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.407416][T10546] RIP: 0033:0x7f4b5e38d9dc [ 379.407430][T10546] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 379.407445][T10546] RSP: 002b:00007f4b5f1bb030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 379.407462][T10546] RAX: ffffffffffffffda RBX: 00007f4b5e5e5fa0 RCX: 00007f4b5e38d9dc [ 379.407472][T10546] RDX: 000000000000000f RSI: 00007f4b5f1bb0a0 RDI: 0000000000000004 [ 379.407497][T10546] RBP: 00007f4b5f1bb090 R08: 0000000000000000 R09: 0000000000000000 [ 379.407507][T10546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.407516][T10546] R13: 00007f4b5e5e6038 R14: 00007f4b5e5e5fa0 R15: 00007ffd3754e7a8 [ 379.407540][T10546] [ 379.733964][ T30] audit: type=1400 audit(1761269613.041:847): avc: denied { mount } for pid=10556 comm="syz.1.1259" name="/" dev="configfs" ino=1122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 379.740206][ T5816] Bluetooth: hci5: command tx timeout [ 379.928849][T10560] hpfs: hpfs_map_sector(): read error [ 380.002147][ T30] audit: type=1400 audit(1761269613.051:848): avc: denied { search } for pid=10556 comm="syz.1.1259" name="/" dev="configfs" ino=1122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 380.149974][T10554] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1257'. [ 380.177811][ T30] audit: type=1400 audit(1761269613.051:849): avc: denied { search } for pid=10556 comm="syz.1.1259" name="/" dev="configfs" ino=1122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 380.222061][ T30] audit: type=1400 audit(1761269613.051:850): avc: denied { search } for pid=10556 comm="syz.1.1259" name="/" dev="configfs" ino=1122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 380.320712][ T30] audit: type=1400 audit(1761269613.051:851): avc: denied { search } for pid=10556 comm="syz.1.1259" name="/" dev="configfs" ino=1122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 380.327152][T10384] 8021q: adding VLAN 0 to HW filter on device team0 [ 380.446771][T10571] loop2: detected capacity change from 0 to 7 [ 380.454904][T10571] Dev loop2: unable to read RDB block 7 [ 380.461320][T10571] loop2: unable to read partition table [ 380.467152][T10571] loop2: partition table beyond EOD, truncated [ 380.470783][ T11] vhci_hcd: vhci_device speed not set [ 380.479794][T10571] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 380.706049][ T1023] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.713258][ T1023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 380.789700][ T1023] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.796910][ T1023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 382.600459][ T3093] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 382.664685][T10384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 382.702112][T10602] netlink: 'syz.0.1270': attribute type 1 has an invalid length. [ 382.792714][ T3093] usb 4-1: config 0 has an invalid interface number: 7 but max is 0 [ 382.823443][ T3093] usb 4-1: config 0 has no interface number 0 [ 382.909258][ T3093] usb 4-1: config 0 interface 7 has no altsetting 0 [ 382.949555][ T3093] usb 4-1: New USB device found, idVendor=0499, idProduct=1021, bcdDevice=6b.96 [ 382.960308][ T3093] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.023756][T10600] bridge0: port 2(bridge_slave_1) entered disabled state [ 383.031648][T10600] bridge0: port 1(bridge_slave_0) entered disabled state [ 383.046256][ T3093] usb 4-1: Product: syz [ 383.055836][ T3093] usb 4-1: Manufacturer: syz [ 383.090637][ T3093] usb 4-1: SerialNumber: syz [ 383.132404][ T3093] usb 4-1: config 0 descriptor?? [ 383.142740][ T3093] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 383.333042][ T3093] snd-usb-audio 4-1:0.7: probe with driver snd-usb-audio failed with error -2 [ 383.515661][ T5810] udevd[5810]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.7/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 383.943446][T10613] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1272'. [ 384.818880][ T50] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.856924][ T50] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.900321][T10611] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 384.915078][ T24] usb 4-1: USB disconnect, device number 20 [ 384.973998][ T50] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.975443][T10635] loop7: detected capacity change from 0 to 7 [ 384.995062][T10639] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 385.003019][T10639] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 385.014657][T10639] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 385.016726][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 385.022726][T10639] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 385.035474][ T50] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.060755][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 385.121647][T10611] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 385.172556][T10611] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 385.300547][T10611] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 385.310226][T10611] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14129, setting to 64 [ 385.323209][T10611] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 385.332798][T10611] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 385.341058][T10611] usb 2-1: Product: syz [ 385.404699][T10646] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1277'. [ 385.758100][T10611] usb 2-1: Manufacturer: syz [ 385.782509][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 385.815019][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 385.819440][T10611] cdc_wdm 2-1:1.0: skipping garbage [ 385.855357][T10611] cdc_wdm 2-1:1.0: skipping garbage [ 385.871241][T10611] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 385.932314][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 385.973981][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 386.089040][T10624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.117528][T10648] Failed to initialize the IGMP autojoin socket (err -2) [ 386.125761][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 386.150655][T10624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.183973][T10650] ipvlan2: entered promiscuous mode [ 386.215405][T10635] ldm_validate_partition_table(): Disk read failed. [ 386.222750][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 386.258491][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 386.274043][T10635] Buffer I/O error on dev loop7, logical block 0, async page read [ 386.284212][T10635] Dev loop7: unable to read RDB block 0 [ 386.307010][T10635] loop7: unable to read partition table [ 386.313232][T10635] loop7: partition table beyond EOD, truncated [ 386.324816][T10384] veth0_vlan: entered promiscuous mode [ 386.336995][T10635] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 386.463915][T10384] veth1_vlan: entered promiscuous mode [ 386.652736][T10654] openvswitch: netlink: IP tunnel dst address not specified [ 386.729639][T10384] veth0_macvtap: entered promiscuous mode [ 386.788118][T10384] veth1_macvtap: entered promiscuous mode [ 387.024700][T10666] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1283'. [ 387.342576][T10384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 387.373240][T10384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 387.398674][T10384] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 387.455907][T10384] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 387.513210][T10384] wireguard: wg0: Could not create IPv4 socket [ 387.541342][T10384] wireguard: wg1: Could not create IPv4 socket [ 387.565472][T10384] wireguard: wg2: Could not create IPv4 socket [ 387.713275][T10611] usb 2-1: USB disconnect, device number 31 [ 389.941305][ T30] audit: type=1400 audit(1761269623.261:852): avc: denied { bind } for pid=10704 comm="syz.3.1295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 390.260194][ T30] audit: type=1400 audit(1761269623.271:853): avc: denied { write } for pid=10704 comm="syz.3.1295" path="socket:[29681]" dev="sockfs" ino=29681 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 390.892016][T10713] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1298'. [ 390.989933][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 391.002863][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 391.011797][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 391.028271][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 391.036909][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 391.064550][T10717] Failed to initialize the IGMP autojoin socket (err -2) [ 391.969271][T10731] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1300'. [ 391.981208][T10731] binder: 10721:10731 ioctl c0306201 0 returned -14 [ 392.055803][T10731] syz.1.1300 (10731): drop_caches: 2 [ 392.710108][ T24] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 392.817725][T10742] 9pnet_fd: Insufficient options for proto=fd [ 392.832507][ T30] audit: type=1400 audit(1761269626.151:854): avc: denied { write } for pid=10737 comm="syz.0.1303" name="usbmon9" dev="devtmpfs" ino=743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 392.917541][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 393.085600][ T24] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 393.095359][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.100389][ T5816] Bluetooth: hci5: command tx timeout [ 393.141450][ T24] usb 3-1: config 0 descriptor?? [ 393.226448][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 393.513751][T10753] tmpfs: Bad value for 'mpol' [ 393.774048][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 393.802940][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 393.810476][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 394.017621][T10717] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 394.025059][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 394.563047][T10717] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 394.594281][T10717] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 394.693133][T10717] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 395.170374][ T5816] Bluetooth: hci5: command tx timeout [ 395.498036][ T24] pwc: recv_control_msg error -71 req 04 val 1400 [ 395.518149][ T24] pwc: recv_control_msg error -71 req 02 val 2000 [ 395.536533][ T24] pwc: recv_control_msg error -71 req 02 val 2100 [ 395.551977][ T24] pwc: recv_control_msg error -71 req 04 val 1500 [ 395.575081][ T24] pwc: recv_control_msg error -71 req 02 val 2500 [ 395.616211][ T24] pwc: recv_control_msg error -71 req 02 val 2400 [ 395.779317][ T24] pwc: recv_control_msg error -71 req 02 val 2600 [ 395.786998][ T24] pwc: recv_control_msg error -71 req 02 val 2900 [ 395.795266][ T24] pwc: recv_control_msg error -71 req 02 val 2800 [ 395.807815][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 395.815749][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 395.893709][T10803] SELinux: Context u:object_r:app_data_file:s0:c512,c768 is not valid (left unmapped). [ 395.980099][ T30] audit: type=1400 audit(1761269629.231:855): avc: denied { relabelfrom } for pid=10798 comm="syz.2.1309" name="UNIX" dev="sockfs" ino=30929 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 396.244642][ T24] pwc: Registered as video103. [ 396.255204][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input25 [ 396.284390][ T30] audit: type=1400 audit(1761269629.241:856): avc: denied { relabelto } for pid=10798 comm="syz.2.1309" name="UNIX" dev="sockfs" ino=30929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=unix_dgram_socket permissive=1 trawcon="u:object_r:app_data_file:s0:c512,c768" [ 396.293479][ T24] usb 3-1: USB disconnect, device number 41 [ 396.312561][ C0] vkms_vblank_simulate: vblank timer overrun [ 396.983464][T10717] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 397.069622][T10717] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 397.232173][T10717] wireguard: wg0: Could not create IPv4 socket [ 397.261083][ T5816] Bluetooth: hci5: command tx timeout [ 397.271084][T10717] wireguard: wg1: Could not create IPv4 socket [ 397.745879][T10717] wireguard: wg2: Could not create IPv4 socket [ 398.290317][ T30] audit: type=1400 audit(1761269631.391:857): avc: denied { getopt } for pid=10848 comm="syz.0.1318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 401.043118][ T30] audit: type=1400 audit(1761269634.151:858): avc: denied { audit_read } for pid=10906 comm="syz.1.1326" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 401.064224][ C0] vkms_vblank_simulate: vblank timer overrun [ 401.072332][ T30] audit: type=1400 audit(1761269634.151:859): avc: denied { create } for pid=10906 comm="syz.1.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 401.072866][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 401.114603][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 401.157705][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 401.172924][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 401.211260][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 401.427722][T10916] binder: 10890:10916 ioctl c0306201 200000000640 returned -22 [ 401.450312][ T30] audit: type=1400 audit(1761269634.151:860): avc: denied { bind } for pid=10906 comm="syz.1.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 401.455425][T10911] Failed to initialize the IGMP autojoin socket (err -2) [ 401.479813][ T30] audit: type=1400 audit(1761269634.151:861): avc: denied { bind } for pid=10906 comm="syz.1.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 401.563615][ T30] audit: type=1400 audit(1761269634.161:862): avc: denied { bind } for pid=10906 comm="syz.1.1326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 401.814969][T10928] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1330'. [ 402.010982][ T30] audit: type=1400 audit(1761269635.321:863): avc: denied { ioctl } for pid=10929 comm="syz.2.1331" path="socket:[32203]" dev="sockfs" ino=32203 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 402.150134][ T30] audit: type=1400 audit(1761269635.321:864): avc: denied { read } for pid=10929 comm="syz.2.1331" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 402.220153][ T30] audit: type=1400 audit(1761269635.331:865): avc: denied { write } for pid=10929 comm="syz.2.1331" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 402.693841][T10948] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 402.716594][ T30] audit: type=1400 audit(1761269636.031:866): avc: denied { mount } for pid=10939 comm="syz.1.1334" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 402.822915][ T30] audit: type=1400 audit(1761269636.031:867): avc: denied { mounton } for pid=10939 comm="syz.1.1334" path="/265/file0" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 403.492777][ T52] Bluetooth: hci5: command tx timeout [ 405.322630][T10911] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 405.389022][T10911] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 405.459554][T10911] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 405.543170][T10911] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 405.574678][ T52] Bluetooth: hci5: command tx timeout [ 406.313823][T11022] fuse: Unknown parameter 'uy©Í‰™@Ñ00000000000000000000' [ 406.480126][ T5866] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 406.500305][ T1057] usb 1-1: new low-speed USB device number 30 using dummy_hcd [ 406.660128][ T1057] usb 1-1: device descriptor read/64, error -71 [ 406.690085][ T5866] usb 4-1: Using ep0 maxpacket: 16 [ 406.704585][ T5866] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.724936][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 406.863007][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 407.091149][ T5866] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 407.110050][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 407.150272][ T1057] usb 1-1: new low-speed USB device number 31 using dummy_hcd [ 407.184776][ T5866] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 407.240333][ T5866] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 407.248360][ T5866] usb 4-1: Manufacturer: syz [ 407.301028][ T5866] usb 4-1: config 0 descriptor?? [ 407.320129][ T1057] usb 1-1: device descriptor read/64, error -71 [ 407.663814][ T52] Bluetooth: hci5: command tx timeout [ 407.738820][ T1057] usb usb1-port1: attempt power cycle [ 407.823410][ T5866] rc_core: IR keymap rc-hauppauge not found [ 407.853976][ T5866] Registered IR keymap rc-empty [ 407.863051][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 407.870990][T11018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.885760][T11018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.896515][T10911] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 407.925700][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 407.958567][T10911] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 407.988572][ T5866] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 408.038303][ T5866] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input26 [ 408.061206][T10911] wireguard: wg0: Could not create IPv4 socket [ 408.087940][T10911] wireguard: wg1: Could not create IPv4 socket [ 408.102863][T10911] wireguard: wg2: Could not create IPv4 socket [ 408.109405][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.129583][ T1057] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 408.178425][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.200622][ T1057] usb 1-1: device descriptor read/8, error -71 [ 408.237738][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.280153][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.306650][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.344448][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.390333][T10611] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 408.410246][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.457650][ T1057] usb 1-1: new low-speed USB device number 33 using dummy_hcd [ 408.465665][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.501952][ T1057] usb 1-1: device descriptor read/8, error -71 [ 408.510147][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.537148][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.570828][ T5866] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.581750][T10611] usb 3-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 408.601662][ T5866] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 408.610147][T10611] usb 3-1: config 1 interface 0 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 408.630493][ T1057] usb usb1-port1: unable to enumerate USB device [ 408.647407][ T5866] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 408.648831][T10611] usb 3-1: config 1 interface 0 has no altsetting 0 [ 408.677970][ T5866] usb 4-1: USB disconnect, device number 21 [ 408.706284][T10611] usb 3-1: New USB device found, idVendor=056e, idProduct=00fb, bcdDevice= 0.40 [ 408.737880][T10611] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.758643][T10611] usb 3-1: Product: 킾ԫﻗï¾çš¯ï’ˆâ®ŸíꞀ겟ﲚ踪௶ä¶áœ­â¶ºí”²Ó‘஄䷳膜哈㙬鈹гä¤Ö°ï­Ÿç¬ƒïŒ¼ã•°å¹‡ï¤Ÿã‡”ത穖ë ï£˜à£€î˜ê˜¡ç’¦ë’¾ã·žï¿çž»ë‰¸ë¨¢ë‹Ö§ä„¨ß¸é¥“æ žë¡å‰ æ¸æ°‡ê´Š [ 408.791888][T10611] usb 3-1: Manufacturer: І [ 408.796555][T10611] usb 3-1: SerialNumber: 몪唙æ¹á ê£¯ã³Žï¦’㮡ï¦ã¬·â”šå¢œë•áŸ‰èˆ½åˆ ï—‡æ‹¤æ é‰¹ë¢† [ 408.816301][T11068] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 408.881728][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 408.881744][ T30] audit: type=1400 audit(1761269642.221:871): avc: denied { ioctl } for pid=11078 comm="syz.1.1357" path="socket:[31701]" dev="sockfs" ino=31701 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 409.284672][T10611] usbhid 3-1:1.0: can't add hid device: -71 [ 409.309880][T10611] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 409.339892][T10611] usb 3-1: USB disconnect, device number 42 [ 409.350092][ T5866] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 409.531641][ T5866] usb 2-1: Using ep0 maxpacket: 16 [ 409.550740][ T5866] usb 2-1: New USB device found, idVendor=25c6, idProduct=9002, bcdDevice=41.ba [ 409.562600][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.583036][ T5866] usb 2-1: Product: syz [ 409.590179][ T5866] usb 2-1: Manufacturer: syz [ 409.594789][ T5866] usb 2-1: SerialNumber: syz [ 409.614638][ T5866] usb 2-1: config 0 descriptor?? [ 409.866391][T11088] lo speed is unknown, defaulting to 1000 [ 409.876713][T11088] lo speed is unknown, defaulting to 1000 [ 409.887194][T11088] lo speed is unknown, defaulting to 1000 [ 409.915888][T11134] netlink: 1363 bytes leftover after parsing attributes in process `syz.2.1369'. [ 409.918048][T11088] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -2 [ 409.995224][T11088] lo speed is unknown, defaulting to 1000 [ 410.027845][T11088] lo speed is unknown, defaulting to 1000 [ 410.045691][T11088] lo speed is unknown, defaulting to 1000 [ 410.068806][T11088] lo speed is unknown, defaulting to 1000 [ 410.098563][T11088] lo speed is unknown, defaulting to 1000 [ 410.186676][ T5866] usb 2-1: can't set first interface for hiFace device. [ 410.212551][ T5866] snd-usb-hiface 2-1:0.0: probe with driver snd-usb-hiface failed with error -5 [ 410.245170][ T5866] usb 2-1: USB disconnect, device number 32 [ 411.678857][ T5816] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 411.694761][ T5816] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 411.708327][ T5816] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 411.761275][ T5816] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 411.769182][ T5816] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 411.784415][T11171] Failed to initialize the IGMP autojoin socket (err -2) [ 412.275300][ T5880] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 412.441823][ T5880] usb 1-1: Using ep0 maxpacket: 16 [ 412.455723][ T5880] usb 1-1: config 0 has no interfaces? [ 412.493524][T11191] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1379'. [ 412.500110][ T5880] usb 1-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 412.530340][ T5880] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.551459][ T5880] usb 1-1: Product: syz [ 412.564194][ T5880] usb 1-1: Manufacturer: syz [ 412.596749][ T5880] usb 1-1: SerialNumber: syz [ 412.618500][ T5880] usb 1-1: config 0 descriptor?? [ 412.740060][ T24] usb 2-1: new low-speed USB device number 33 using dummy_hcd [ 412.870496][ T24] usb 2-1: device descriptor read/64, error -71 [ 413.120605][ T24] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 413.280696][ T24] usb 2-1: device descriptor read/64, error -71 [ 413.311159][T11171] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 413.352749][T11171] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 413.415099][ T24] usb usb2-port1: attempt power cycle [ 413.437425][T11171] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 413.491410][T11171] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 413.543050][T11219] FAULT_INJECTION: forcing a failure. [ 413.543050][T11219] name failslab, interval 1, probability 0, space 0, times 0 [ 413.555933][T11219] CPU: 0 UID: 0 PID: 11219 Comm: syz.2.1384 Not tainted syzkaller #0 PREEMPT(full) [ 413.555955][T11219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 413.555963][T11219] Call Trace: [ 413.555969][T11219] [ 413.555974][T11219] dump_stack_lvl+0x16c/0x1f0 [ 413.556004][T11219] should_fail_ex+0x512/0x640 [ 413.556022][T11219] ? fs_reclaim_acquire+0xae/0x150 [ 413.556043][T11219] should_failslab+0xc2/0x120 [ 413.556061][T11219] __kmalloc_noprof+0xdd/0x880 [ 413.556083][T11219] ? tomoyo_encode2+0x100/0x3e0 [ 413.556104][T11219] ? tomoyo_encode2+0x100/0x3e0 [ 413.556121][T11219] tomoyo_encode2+0x100/0x3e0 [ 413.556140][T11219] tomoyo_encode+0x29/0x50 [ 413.556158][T11219] tomoyo_realpath_from_path+0x18f/0x6e0 [ 413.556179][T11219] ? tomoyo_profile+0x47/0x60 [ 413.556199][T11219] tomoyo_path_number_perm+0x245/0x580 [ 413.556221][T11219] ? tomoyo_path_number_perm+0x237/0x580 [ 413.556247][T11219] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 413.556295][T11219] ? rcu_is_watching+0x12/0xc0 [ 413.556314][T11219] ? irqentry_exit+0x3b/0x90 [ 413.556336][T11219] ? hook_file_ioctl_common+0x145/0x410 [ 413.556356][T11219] ? lockdep_hardirqs_on+0x7c/0x110 [ 413.556389][T11219] security_file_ioctl+0x9b/0x240 [ 413.556408][T11219] __x64_sys_ioctl+0xb7/0x210 [ 413.556434][T11219] do_syscall_64+0xcd/0xfa0 [ 413.556460][T11219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.556474][T11219] RIP: 0033:0x7ffbd278efc9 [ 413.556487][T11219] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 413.556502][T11219] RSP: 002b:00007ffbd3555038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 413.556519][T11219] RAX: ffffffffffffffda RBX: 00007ffbd29e6090 RCX: 00007ffbd278efc9 [ 413.556530][T11219] RDX: 0000200000000080 RSI: 00000000000089eb RDI: 0000000000000007 [ 413.556540][T11219] RBP: 00007ffbd3555090 R08: 0000000000000000 R09: 0000000000000000 [ 413.556549][T11219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 413.556558][T11219] R13: 00007ffbd29e6128 R14: 00007ffbd29e6090 R15: 00007ffe25421ea8 [ 413.556583][T11219] [ 413.556870][T11219] ERROR: Out of memory at tomoyo_realpath_from_path. [ 413.869872][ T24] usb 2-1: new low-speed USB device number 35 using dummy_hcd [ 413.973792][ T52] Bluetooth: hci5: command tx timeout [ 414.031678][ T24] usb 2-1: device descriptor read/8, error -71 [ 414.531545][ T24] usb 2-1: new low-speed USB device number 36 using dummy_hcd [ 414.562032][ T24] usb 2-1: device descriptor read/8, error -71 [ 414.680478][ T24] usb usb2-port1: unable to enumerate USB device [ 414.780548][ T24] usb 1-1: USB disconnect, device number 34 [ 416.050328][ T52] Bluetooth: hci5: command tx timeout [ 416.096559][T11266] tipc: Started in network mode [ 416.120202][T11270] ALSA: mixer_oss: invalid OSS volume 'PHONEXÛ0ØIN' [ 416.122454][T11266] tipc: Node identity 4, cluster identity 4711 [ 416.174336][T11266] tipc: Node number set to 4 [ 416.668251][T11287] binder: 11264:11287 ioctl c0306201 0 returned -14 [ 417.330172][T10611] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 417.421721][T11171] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 417.709337][T10611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 52, changing to 4 [ 417.753053][T10611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 13368, setting to 1023 [ 418.042361][T11171] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 418.072304][T10611] usb 3-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 418.096930][T11287] syz.1.1390 (11287): drop_caches: 2 [ 418.121924][T11171] wireguard: wg0: Could not create IPv4 socket [ 418.132477][ T52] Bluetooth: hci5: command tx timeout [ 418.134510][T10611] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.158760][T11171] wireguard: wg1: Could not create IPv4 socket [ 418.186451][T11171] wireguard: wg2: Could not create IPv4 socket [ 418.195456][T10611] usb 3-1: Product: syz [ 418.209556][T10611] usb 3-1: Manufacturer: syz [ 418.270081][T10611] usb 3-1: SerialNumber: syz [ 418.308907][T10611] usb 3-1: config 0 descriptor?? [ 418.572512][T10611] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input27 [ 418.989275][T11324] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1399'. [ 418.998625][T11324] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1399'. [ 419.851631][ T5924] usb 3-1: USB disconnect, device number 43 [ 419.975576][T11342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1403'. [ 420.033632][T11342] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 420.420302][ T5924] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 420.590560][ T5924] usb 3-1: Using ep0 maxpacket: 16 [ 420.607307][ T5924] usb 3-1: config 0 has no interfaces? [ 420.631879][ T5924] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 420.643350][ T5924] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 420.660861][ T5924] usb 3-1: Manufacturer: syz [ 420.670713][ T5924] usb 3-1: config 0 descriptor?? [ 420.922492][ T5924] usb 3-1: USB disconnect, device number 44 [ 422.307183][ T5816] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 422.318047][ T5816] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 422.326366][ T5816] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 422.336552][ T5816] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 422.348008][ T5816] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 422.689526][T11389] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 422.714607][T11392] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1412'. [ 422.738977][T11389] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 422.784651][T11387] Failed to initialize the IGMP autojoin socket (err -2) [ 423.010444][T10630] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 423.210076][T10630] usb 4-1: Using ep0 maxpacket: 32 [ 423.264538][T10630] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.325910][T10630] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.376543][T10630] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 423.430052][T10630] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.476331][T10630] usb 4-1: config 0 descriptor?? [ 423.518833][T10630] hub 4-1:0.0: USB hub found [ 423.732808][T10630] hub 4-1:0.0: 1 port detected [ 423.813742][T11422] input: syz1 as /devices/virtual/input/input28 [ 423.842670][T11424] FAULT_INJECTION: forcing a failure. [ 423.842670][T11424] name failslab, interval 1, probability 0, space 0, times 0 [ 423.858583][T11424] CPU: 0 UID: 0 PID: 11424 Comm: syz.0.1416 Not tainted syzkaller #0 PREEMPT(full) [ 423.858605][T11424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 423.858615][T11424] Call Trace: [ 423.858620][T11424] [ 423.858626][T11424] dump_stack_lvl+0x16c/0x1f0 [ 423.858655][T11424] should_fail_ex+0x512/0x640 [ 423.858679][T11424] ? fs_reclaim_acquire+0xae/0x150 [ 423.858698][T11424] should_failslab+0xc2/0x120 [ 423.858727][T11424] __kmalloc_noprof+0xdd/0x880 [ 423.858752][T11424] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 423.858779][T11424] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 423.858797][T11424] tomoyo_realpath_from_path+0xc2/0x6e0 [ 423.858819][T11424] ? tomoyo_profile+0x47/0x60 [ 423.858843][T11424] tomoyo_path_number_perm+0x245/0x580 [ 423.858868][T11424] ? tomoyo_path_number_perm+0x237/0x580 [ 423.858897][T11424] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 423.858926][T11424] ? find_held_lock+0x2b/0x80 [ 423.858972][T11424] ? find_held_lock+0x2b/0x80 [ 423.858992][T11424] ? hook_file_ioctl_common+0x145/0x410 [ 423.859020][T11424] ? __fget_files+0x20e/0x3c0 [ 423.859043][T11424] security_file_ioctl+0x9b/0x240 [ 423.859065][T11424] __x64_sys_ioctl+0xb7/0x210 [ 423.859091][T11424] do_syscall_64+0xcd/0xfa0 [ 423.859119][T11424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.859136][T11424] RIP: 0033:0x7facfb78efc9 [ 423.859151][T11424] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 423.859167][T11424] RSP: 002b:00007facfc5a8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 423.859184][T11424] RAX: ffffffffffffffda RBX: 00007facfb9e6180 RCX: 00007facfb78efc9 [ 423.859196][T11424] RDX: 0000000000000000 RSI: 0000000000008915 RDI: 0000000000000007 [ 423.859205][T11424] RBP: 00007facfc5a8090 R08: 0000000000000000 R09: 0000000000000000 [ 423.859215][T11424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 423.859225][T11424] R13: 00007facfb9e6218 R14: 00007facfb9e6180 R15: 00007ffc06c1cd18 [ 423.859250][T11424] [ 424.061562][ C0] vkms_vblank_simulate: vblank timer overrun [ 424.074896][T11424] ERROR: Out of memory at tomoyo_realpath_from_path. [ 424.090686][T10630] hub 4-1:0.0: hub_hub_status failed (err = -71) [ 424.097044][T10630] hub 4-1:0.0: config failed, can't get hub status (err -71) [ 424.130866][T10630] usbhid 4-1:0.0: can't add hid device: -71 [ 424.136922][T10630] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 424.170946][T10630] usb 4-1: USB disconnect, device number 22 [ 424.609910][T11435] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1419'. [ 424.701170][ T5816] Bluetooth: hci5: command tx timeout [ 424.799413][T11435] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1419'. [ 426.076956][T11387] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 426.151500][T11387] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 426.213534][T11387] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 426.223154][T11464] netlink: 'syz.3.1425': attribute type 15 has an invalid length. [ 426.263705][T11387] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 426.537850][T11474] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 426.546998][T11474] overlayfs: missing 'lowerdir' [ 426.770439][ T5816] Bluetooth: hci5: command tx timeout [ 428.143577][T11495] sg_write: data in/out 16056444/1 bytes for SCSI command 0x1c-- guessing data in; [ 428.143577][T11495] program syz.0.1431 not setting count and/or reply_len properly [ 428.860124][ T5816] Bluetooth: hci5: command tx timeout [ 428.995889][T11507] ALSA: mixer_oss: invalid OSS volume '®Kj41ñ⯶\Kjgß¡(ƒ[:›$-ì²»×.' [ 429.130370][T11507] ALSA: mixer_oss: invalid OSS volume 'Ž(°Âìz—S~tÕa\ÿe"Æ4ª`ó²¯%' [ 429.145573][T11507] ALSA: mixer_oss: invalid OSS volume 'Ÿóô•£cœ˜IH¯Œ²î4¡#­ Ža²mª' [ 429.254985][T11387] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 429.271256][T11507] ALSA: mixer_oss: invalid OSS volume 'Øèr˜ÕdÁ' [ 429.384584][T11387] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 429.804988][T11524] serio: Serial port ptm0 [ 429.806435][T11387] wireguard: wg0: Could not create IPv4 socket [ 429.893489][T11387] wireguard: wg1: Could not create IPv4 socket [ 429.929168][T11387] wireguard: wg2: Could not create IPv4 socket [ 430.656791][T11533] ip6gre1: entered allmulticast mode [ 430.994899][T10630] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 431.160132][T10630] usb 3-1: Using ep0 maxpacket: 16 [ 431.551444][ T30] audit: type=1400 audit(1761269664.891:872): avc: denied { ioctl } for pid=11538 comm="syz.2.1438" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 431.552241][T10630] usb 3-1: config 0 has an invalid interface number: 206 but max is 0 [ 431.576358][ C1] vkms_vblank_simulate: vblank timer overrun [ 431.619271][T10630] usb 3-1: config 0 has no interface number 0 [ 431.628314][T10630] usb 3-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 431.638446][T10630] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.694977][T10630] usb 3-1: Product: syz [ 431.762564][T10630] usb 3-1: Manufacturer: syz [ 431.778826][T11558] tipc: Enabling of bearer rejected, failed to enable media [ 431.796537][T10630] usb 3-1: SerialNumber: syz [ 431.819211][T10630] usb 3-1: config 0 descriptor?? [ 431.861842][T10630] radioshark2 3-1:0.206: Invalid radioSHARK2 device [ 431.878673][ T30] audit: type=1400 audit(1761269665.031:873): avc: denied { read write } for pid=5817 comm="syz-executor" name="loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 431.886426][T10630] radioshark2 3-1:0.206: probe with driver radioshark2 failed with error -22 [ 432.031486][T10630] usbhid 3-1:0.206: couldn't find an input interrupt endpoint [ 432.052119][ T30] audit: type=1400 audit(1761269665.031:874): avc: denied { open } for pid=5817 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 432.554533][T11541] 9pnet_fd: Insufficient options for proto=fd [ 432.579488][T10630] usb 3-1: USB disconnect, device number 45 [ 432.603246][ T30] audit: type=1400 audit(1761269665.031:875): avc: denied { ioctl } for pid=5817 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=650 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 432.628771][ C1] vkms_vblank_simulate: vblank timer overrun [ 432.650124][ T30] audit: type=1400 audit(1761269665.091:876): avc: denied { create } for pid=11557 comm="syz.3.1442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 432.790685][ T30] audit: type=1400 audit(1761269665.101:877): avc: denied { write } for pid=11557 comm="syz.3.1442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 432.935669][T11576] tmpfs: Bad value for 'mpol' [ 433.120525][ T30] audit: type=1400 audit(1761269665.101:878): avc: denied { read } for pid=11557 comm="syz.3.1442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 433.140791][ C1] vkms_vblank_simulate: vblank timer overrun [ 433.147556][ T30] audit: type=1400 audit(1761269665.101:879): avc: denied { search } for pid=11552 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 433.190250][ T30] audit: type=1400 audit(1761269665.141:880): avc: denied { read } for pid=5479 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 433.211205][ C1] vkms_vblank_simulate: vblank timer overrun [ 433.313194][ T30] audit: type=1400 audit(1761269665.221:881): avc: denied { prog_load } for pid=11561 comm="syz.3.1443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 433.636688][T11600] overlayfs: missing 'lowerdir' [ 436.179265][T11641] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1458'. [ 436.260760][T11642] binder: 11637:11642 ioctl c0306201 0 returned -14 [ 436.366927][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 436.377176][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 436.385630][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 436.393669][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 436.401220][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 436.735686][T11642] syz.3.1458 (11642): drop_caches: 2 [ 437.188932][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 437.188947][ T30] audit: type=1400 audit(1761269670.521:943): avc: denied { module_request } for pid=11661 comm="syz.1.1459" kmod="netdev-syzkaller0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 437.288495][ T30] audit: type=1400 audit(1761269670.621:944): avc: denied { sys_module } for pid=11661 comm="syz.1.1459" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 437.292275][T11668] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=5141 sclass=netlink_xfrm_socket pid=11668 comm=syz.1.1459 [ 438.216914][T11631] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 438.253559][T11643] Failed to initialize the IGMP autojoin socket (err -2) [ 438.424491][ T30] audit: type=1400 audit(1761269671.681:945): avc: denied { create } for pid=11692 comm="syz.1.1460" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 438.465990][ T5816] Bluetooth: hci5: command tx timeout [ 438.668635][ T30] audit: type=1400 audit(1761269671.731:946): avc: denied { ioctl } for pid=11695 comm="syz.0.1462" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 438.703086][ T30] audit: type=1400 audit(1761269671.751:947): avc: denied { create } for pid=11692 comm="syz.1.1460" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 438.830740][ T30] audit: type=1400 audit(1761269672.001:948): avc: denied { read } for pid=11695 comm="syz.0.1462" path="socket:[34907]" dev="sockfs" ino=34907 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 439.061310][ T30] audit: type=1400 audit(1761269672.391:949): avc: denied { create } for pid=11705 comm="syz.1.1463" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 439.141635][ T30] audit: type=1400 audit(1761269672.391:950): avc: denied { getopt } for pid=11705 comm="syz.1.1463" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 439.236005][ T30] audit: type=1400 audit(1761269672.421:951): avc: denied { read write } for pid=11705 comm="syz.1.1463" name="video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 439.323371][ T30] audit: type=1400 audit(1761269672.421:952): avc: denied { open } for pid=11705 comm="syz.1.1463" path="/dev/video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 439.714311][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.720702][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.132814][T11743] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1467'. [ 441.164223][T11761] tmpfs: Bad value for 'mpol' [ 441.211559][ T5816] Bluetooth: hci5: command tx timeout [ 441.587829][T11771] tmpfs: Bad value for 'mpol' [ 441.815292][T11774] netlink: 'syz.2.1475': attribute type 4 has an invalid length. [ 441.827560][T11770] overlayfs: missing 'lowerdir' [ 441.850241][T11774] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1475'. [ 441.920506][T11774] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 442.097624][T11786] netlink: 'syz.3.1476': attribute type 1 has an invalid length. [ 442.108250][T11786] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 442.140436][ T24] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 442.199215][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 442.199229][ T30] audit: type=1400 audit(1761269675.531:967): avc: denied { read write } for pid=11788 comm="syz.2.1477" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 442.284203][T11791] exFAT-fs (nullb0): mounting with "discard" option, but the device does not support discard [ 442.294925][T11791] exFAT-fs (nullb0): invalid boot record signature [ 442.301481][T11791] exFAT-fs (nullb0): failed to read boot sector [ 442.307723][T11791] exFAT-fs (nullb0): failed to recognize exfat type [ 442.324441][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 442.347702][ T24] usb 2-1: config 1 has an invalid interface number: 178 but max is 0 [ 442.359321][ T30] audit: type=1400 audit(1761269675.531:968): avc: denied { open } for pid=11788 comm="syz.2.1477" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 442.373937][ T24] usb 2-1: config 1 has no interface number 0 [ 442.412089][ T30] audit: type=1400 audit(1761269675.621:969): avc: denied { mounton } for pid=11788 comm="syz.2.1477" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 442.436011][ C0] vkms_vblank_simulate: vblank timer overrun [ 442.448512][T11643] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 442.489738][T11643] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 442.513570][ T24] usb 2-1: config 1 interface 178 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 442.546076][T11643] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 442.553414][ T24] usb 2-1: config 1 interface 178 altsetting 5 endpoint 0xE has an invalid bInterval 209, changing to 11 [ 442.569903][ T24] usb 2-1: config 1 interface 178 altsetting 5 bulk endpoint 0xD has invalid maxpacket 16 [ 442.623776][T11643] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 442.726328][ T24] usb 2-1: config 1 interface 178 altsetting 5 endpoint 0x5 has invalid wMaxPacketSize 0 [ 442.736411][ T24] usb 2-1: config 1 interface 178 altsetting 5 bulk endpoint 0x5 has invalid maxpacket 0 [ 442.746427][ T24] usb 2-1: config 1 interface 178 has no altsetting 0 [ 442.754376][ T24] usb 2-1: language id specifier not provided by device, defaulting to English [ 442.765221][ T24] usb 2-1: New USB device found, idVendor=0c45, idProduct=602c, bcdDevice=c5.df [ 442.774595][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.289262][ T24] usb 2-1: Product: syz [ 443.302236][ T24] usb 2-1: Manufacturer: І [ 443.318638][ T24] usb 2-1: SerialNumber: syz [ 443.330183][ T5816] Bluetooth: hci5: command tx timeout [ 443.346394][T11767] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 443.564431][T11812] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1482'. [ 443.591602][ T24] gspca_main: sonixb-2.14.0 probing 0c45:602c [ 443.870309][ T30] audit: type=1400 audit(1761269677.201:970): avc: denied { append } for pid=11814 comm="syz.2.1483" name="comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 443.893696][ T24] sonixb 2-1:1.178: Error reading register 00: -71 [ 443.922806][ T24] usb 2-1: USB disconnect, device number 37 [ 444.012222][ T30] audit: type=1400 audit(1761269677.341:971): avc: denied { setopt } for pid=11821 comm="syz.3.1484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 444.072496][ T30] audit: type=1400 audit(1761269677.351:972): avc: denied { write } for pid=11821 comm="syz.3.1484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 444.479409][T11836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1487'. [ 444.760641][ T30] audit: type=1400 audit(1761269678.091:973): avc: denied { create } for pid=11849 comm="syz.0.1490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 444.811895][T11851] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11851 comm=syz.1.1489 [ 445.105636][ T30] audit: type=1400 audit(1761269678.431:974): avc: denied { create } for pid=11845 comm="syz.1.1489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 445.246857][ T30] audit: type=1400 audit(1761269678.441:975): avc: denied { setopt } for pid=11845 comm="syz.1.1489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 445.342425][ T30] audit: type=1400 audit(1761269678.621:976): avc: denied { read write } for pid=11858 comm="syz.0.1491" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 445.440430][ T5816] Bluetooth: hci5: command tx timeout [ 446.035917][T11643] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 446.234600][T11643] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 446.334072][T11643] wireguard: wg0: Could not create IPv4 socket [ 446.352772][T11643] wireguard: wg1: Could not create IPv4 socket [ 446.449586][T11643] wireguard: wg2: Could not create IPv4 socket [ 446.456053][T10628] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 447.121399][T10628] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 447.150128][T10628] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 447.240101][T10628] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 447.279261][T10628] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 447.306232][T10628] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 447.325721][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 447.325735][ T30] audit: type=1400 audit(1761269680.661:982): avc: denied { write } for pid=11898 comm="syz.3.1499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 447.335175][T10628] usb 1-1: Product: syz [ 447.356852][T10628] usb 1-1: Manufacturer: syz [ 447.361685][T10628] usb 1-1: SerialNumber: syz [ 447.460654][ T30] audit: type=1400 audit(1761269680.661:983): avc: denied { setopt } for pid=11898 comm="syz.3.1499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 447.633517][T11909] tmpfs: Bad value for 'mpol' [ 447.863416][T10628] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 35 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 447.991299][T11916] trusted_key: encrypted_key: insufficient parameters specified [ 448.026962][ T30] audit: type=1400 audit(1761269681.331:984): avc: denied { create } for pid=11915 comm="syz.3.1503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 448.203887][ T30] audit: type=1400 audit(1761269681.441:985): avc: denied { write } for pid=11918 comm="syz.3.1504" name="001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 448.356881][ T5866] usb 1-1: USB disconnect, device number 35 [ 448.446756][ T30] audit: type=1400 audit(1761269681.741:986): avc: denied { read } for pid=11918 comm="syz.3.1504" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 448.469620][ C0] vkms_vblank_simulate: vblank timer overrun [ 448.514385][ T5866] usblp0: removed [ 448.570772][ T30] audit: type=1400 audit(1761269681.741:987): avc: denied { open } for pid=11918 comm="syz.3.1504" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 448.598365][ T30] audit: type=1400 audit(1761269681.741:988): avc: denied { ioctl } for pid=11918 comm="syz.3.1504" path="/dev/dri/card0" dev="devtmpfs" ino=627 ioctlcmd=0x6407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 448.754267][T11932] tmpfs: Bad value for 'mpol' [ 449.121566][T11942] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1506'. [ 449.230360][T11944] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1506'. [ 449.332461][ T30] audit: type=1400 audit(1761269682.451:989): avc: denied { create } for pid=11936 comm="syz.1.1506" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 450.033357][ T30] audit: type=1400 audit(1761269683.341:990): avc: denied { create } for pid=11946 comm="syz.0.1509" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 450.331457][T11955] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1511'. [ 450.354848][ T30] audit: type=1400 audit(1761269683.341:991): avc: denied { setopt } for pid=11946 comm="syz.0.1509" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 450.561380][T10611] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 450.569782][T11961] comedi comedi0: Minor 47 could not be opened [ 450.746749][T10611] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 450.756304][T10611] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.770518][T10611] usb 4-1: Product: syz [ 450.774705][T10611] usb 4-1: Manufacturer: syz [ 450.779426][T10611] usb 4-1: SerialNumber: syz [ 450.812297][T10611] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 450.837076][ T5880] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 450.982591][T11974] 9pnet_fd: Insufficient options for proto=fd [ 451.577379][T11983] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1514'. [ 451.588750][T10611] usb 4-1: USB disconnect, device number 23 [ 451.882622][T10628] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 451.912644][ T5880] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 452.060288][T11991] tmpfs: Bad value for 'mpol' [ 452.090791][ T5880] ath9k_htc: Failed to initialize the device [ 452.257199][T10611] usb 4-1: ath9k_htc: USB layer deinitialized [ 452.285607][T10628] usb 2-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 452.320284][T10628] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.328305][T10628] usb 2-1: Product: syz [ 452.366821][T10628] usb 2-1: Manufacturer: syz [ 452.383678][T10628] usb 2-1: SerialNumber: syz [ 452.412198][T10628] usb 2-1: config 0 descriptor?? [ 452.426082][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 452.426096][ T30] audit: type=1400 audit(1761269685.761:997): avc: denied { create } for pid=11994 comm="syz.3.1518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 452.535872][T12002] sp0: Synchronizing with TNC [ 452.543382][ T30] audit: type=1400 audit(1761269685.821:998): avc: denied { append } for pid=11999 comm="syz.2.1519" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 452.573316][T12002] sp0: Found TNC [ 452.658610][T10628] usb_8dev 2-1:0.0 can0: sending command message failed [ 452.687766][T10628] usb_8dev 2-1:0.0 can0: can't get firmware version [ 452.769457][T10628] usb_8dev 2-1:0.0: probe with driver usb_8dev failed with error -22 [ 452.865888][T10628] usb 2-1: USB disconnect, device number 38 [ 453.054020][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 453.066973][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 453.075818][ T30] audit: type=1400 audit(1761269686.411:999): avc: denied { bind } for pid=12001 comm="syz.0.1520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 453.075995][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 453.107139][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 453.114672][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 453.142270][T12009] loop6: detected capacity change from 0 to 524288000 [ 453.240103][ T30] audit: type=1400 audit(1761269686.431:1000): avc: denied { setopt } for pid=12001 comm="syz.0.1520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 453.354485][ T30] audit: type=1400 audit(1761269686.431:1001): avc: denied { write } for pid=12001 comm="syz.0.1520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 453.458082][T12020] tmpfs: Bad value for 'mpol' [ 453.823634][T12012] Failed to initialize the IGMP autojoin socket (err -2) [ 453.889157][ T30] audit: type=1400 audit(1761269687.221:1002): avc: denied { create } for pid=12022 comm="syz.1.1522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 453.901090][T12023] binder: 12022:12023 ioctl 4008f510 200000000280 returned -22 [ 453.955146][T12026] binder: BINDER_SET_CONTEXT_MGR already set [ 453.999805][T12026] binder: 12022:12026 ioctl 4018620d 200000000040 returned -16 [ 454.000545][ T30] audit: type=1400 audit(1761269687.241:1003): avc: denied { set_context_mgr } for pid=12022 comm="syz.1.1522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 454.260106][ T5866] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 454.276663][ T30] audit: type=1400 audit(1761269687.291:1004): avc: denied { map } for pid=12022 comm="syz.1.1522" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 454.300604][ C0] vkms_vblank_simulate: vblank timer overrun [ 454.364391][ T30] audit: type=1400 audit(1761269687.591:1006): avc: denied { ioctl } for pid=12024 comm="syz.3.1523" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 454.391716][ T30] audit: type=1400 audit(1761269687.591:1005): avc: denied { ioctl } for pid=12024 comm="syz.3.1523" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 454.417429][ C0] vkms_vblank_simulate: vblank timer overrun [ 454.443006][ T5866] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 454.471005][ T5866] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.554190][ T5866] usb 2-1: config 0 descriptor?? [ 455.145289][T12055] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1528'. [ 455.170128][ T5816] Bluetooth: hci5: command tx timeout [ 457.140321][T10628] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 457.266985][ T5816] Bluetooth: hci5: command tx timeout [ 457.383648][T10628] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 457.430128][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 457.430145][ T30] audit: type=1400 audit(1761269690.751:1012): avc: denied { write } for pid=12081 comm="syz.2.1535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 457.496316][T10628] usb 1-1: config 0 has no interface number 0 [ 457.603300][T12012] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 457.726002][T10628] usb 1-1: config 0 interface 41 has no altsetting 0 [ 457.772231][T10628] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 457.785884][T10628] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.798746][T12012] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 457.862415][T12012] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 457.869158][T10628] usb 1-1: Product: syz [ 457.886655][T10628] usb 1-1: Manufacturer: syz [ 457.930560][T10628] usb 1-1: SerialNumber: syz [ 457.961302][T12012] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 457.987937][T10628] usb 1-1: config 0 descriptor?? [ 458.313889][ T30] audit: type=1400 audit(1761269691.651:1013): avc: denied { append } for pid=12075 comm="syz.0.1533" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 458.581170][ T30] audit: type=1400 audit(1761269691.921:1014): avc: denied { connect } for pid=12093 comm="syz.3.1536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 458.601098][ C0] vkms_vblank_simulate: vblank timer overrun [ 458.710042][ T30] audit: type=1400 audit(1761269691.981:1015): avc: denied { write } for pid=12093 comm="syz.3.1536" path="socket:[37100]" dev="sockfs" ino=37100 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 458.733689][ C0] vkms_vblank_simulate: vblank timer overrun [ 458.823917][T10628] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -22 [ 459.300026][T10628] usb 1-1: USB disconnect, device number 36 [ 459.336350][ T5816] Bluetooth: hci5: command tx timeout [ 459.525822][ T30] audit: type=1400 audit(1761269692.861:1016): avc: denied { create } for pid=12113 comm="syz.1.1539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 459.815632][ T30] audit: type=1400 audit(1761269693.001:1017): avc: denied { mounton } for pid=12110 comm="syz.3.1538" path="/362/file0" dev="tmpfs" ino=1946 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 459.838426][ C0] vkms_vblank_simulate: vblank timer overrun [ 460.173517][ T30] audit: type=1400 audit(1761269693.021:1018): avc: denied { mount } for pid=12110 comm="syz.3.1538" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 460.206432][ T30] audit: type=1400 audit(1761269693.151:1019): avc: denied { getopt } for pid=12113 comm="syz.1.1539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 460.665132][ T30] audit: type=1400 audit(1761269693.181:1020): avc: denied { map } for pid=12113 comm="syz.1.1539" path="socket:[36753]" dev="sockfs" ino=36753 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 460.688773][ C0] vkms_vblank_simulate: vblank timer overrun [ 460.750373][ T30] audit: type=1400 audit(1761269693.181:1021): avc: denied { read accept } for pid=12113 comm="syz.1.1539" path="socket:[36753]" dev="sockfs" ino=36753 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 461.323850][T12141] fuse: Bad value for 'fd' [ 461.420314][ T5816] Bluetooth: hci5: command tx timeout [ 461.631742][T12012] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 461.688051][T12149] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1546'. [ 462.165182][T12012] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 462.352624][T12012] wireguard: wg0: Could not create IPv4 socket [ 462.392332][T12012] wireguard: wg1: Could not create IPv4 socket [ 463.362014][T12012] wireguard: wg2: Could not create IPv4 socket [ 463.873433][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 463.873447][ T30] audit: type=1400 audit(1761269697.211:1030): avc: denied { bind } for pid=12153 comm="syz.0.1549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 464.970382][T10628] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 465.034118][T12175] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 465.200039][T10628] usb 3-1: Using ep0 maxpacket: 32 [ 465.213707][T10628] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 465.257112][T10628] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.314017][T10628] usb 3-1: Product: syz [ 465.318243][T10628] usb 3-1: Manufacturer: syz [ 465.365504][T10628] usb 3-1: SerialNumber: syz [ 465.393751][T10628] usb 3-1: config 0 descriptor?? [ 465.403917][T12192] sg_write: data in/out 16056444/1 bytes for SCSI command 0x1c-- guessing data in; [ 465.403917][T12192] program syz.1.1555 not setting count and/or reply_len properly [ 465.662292][T10628] snd-usb-6fire 3-1:0.0: unknown device firmware state received from device: [ 465.713911][T10628] 00 00 00 00 00 00 00 00 [ 465.746545][T10628] snd-usb-6fire 3-1:0.0: probe with driver snd-usb-6fire failed with error -5 [ 465.878274][T10628] usb 3-1: USB disconnect, device number 46 [ 466.034329][T12196] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 466.041400][ T30] audit: type=1400 audit(1761269699.371:1031): avc: denied { create } for pid=12188 comm="syz.3.1556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 466.122462][ T30] audit: type=1400 audit(1761269699.371:1032): avc: denied { write } for pid=12188 comm="syz.3.1556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 466.229018][ T30] audit: type=1400 audit(1761269699.531:1033): avc: denied { create } for pid=12188 comm="syz.3.1556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 466.946686][ T30] audit: type=1400 audit(1761269700.281:1034): avc: denied { getopt } for pid=12215 comm="syz.3.1559" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 467.026631][T12221] vxfs: WRONG superblock magic 00000000 at 1 [ 467.033890][T12221] vxfs: WRONG superblock magic 00000000 at 8 [ 467.039857][T12221] vxfs: can't find superblock. [ 467.312642][ T30] audit: type=1400 audit(1761269700.361:1035): avc: denied { bind } for pid=12215 comm="syz.3.1559" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 467.347988][ T1057] libceph: mon0 (1)[c::]:6789 connect error [ 467.414772][T12225] Device name not specified. [ 467.414772][T12225] [ 467.614795][ T1057] libceph: mon0 (1)[c::]:6789 connect error [ 467.642095][T12216] ceph: No mds server is up or the cluster is laggy [ 468.288555][ T30] audit: type=1400 audit(1761269701.613:1036): avc: denied { read write } for pid=12232 comm="syz.0.1561" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 468.733790][ T30] audit: type=1400 audit(1761269701.613:1037): avc: denied { open } for pid=12232 comm="syz.0.1561" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 469.549262][T12258] netlink: 666 bytes leftover after parsing attributes in process `syz.3.1567'. [ 469.963938][T12281] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1571'. [ 470.015525][T12281] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 470.477233][ T30] audit: type=1400 audit(1761269703.803:1038): avc: denied { setopt } for pid=12286 comm="syz.1.1573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 470.513623][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 470.524577][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 470.535096][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 470.550984][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 470.560956][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 470.593649][T12269] Failed to initialize the IGMP autojoin socket (err -2) [ 471.152831][ T30] audit: type=1400 audit(1761269960.482:1039): avc: denied { connect } for pid=12304 comm="syz.1.1577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 471.941589][T12320] exFAT-fs (nullb0): mounting with "discard" option, but the device does not support discard [ 471.955473][T12320] exFAT-fs (nullb0): invalid boot record signature [ 471.962071][T12320] exFAT-fs (nullb0): failed to read boot sector [ 471.968333][T12320] exFAT-fs (nullb0): failed to recognize exfat type [ 472.610092][ T52] Bluetooth: hci5: command tx timeout [ 472.612173][T12324] FAULT_INJECTION: forcing a failure. [ 472.612173][T12324] name failslab, interval 1, probability 0, space 0, times 0 [ 472.654360][ T30] audit: type=1400 audit(1761269961.952:1040): avc: denied { create } for pid=12321 comm="syz.1.1581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 472.733103][T12324] CPU: 1 UID: 0 PID: 12324 Comm: syz.3.1582 Not tainted syzkaller #0 PREEMPT(full) [ 472.733131][T12324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 472.733141][T12324] Call Trace: [ 472.733146][T12324] [ 472.733153][T12324] dump_stack_lvl+0x16c/0x1f0 [ 472.733184][T12324] should_fail_ex+0x512/0x640 [ 472.733205][T12324] ? __kmalloc_node_track_caller_noprof+0xcb/0x8a0 [ 472.733228][T12324] should_failslab+0xc2/0x120 [ 472.733249][T12324] __kmalloc_node_track_caller_noprof+0xde/0x8a0 [ 472.733273][T12324] ? p9_client_create+0x4ca/0x11d0 [ 472.733294][T12324] ? kstrdup+0x53/0x100 [ 472.733308][T12324] kstrdup+0x53/0x100 [ 472.733324][T12324] p9_client_create+0x4ca/0x11d0 [ 472.733347][T12324] ? __pfx_p9_client_create+0x10/0x10 [ 472.733369][T12324] ? rcu_is_watching+0x12/0xc0 [ 472.733392][T12324] ? trace_kmalloc+0x2b/0xd0 [ 472.733409][T12324] ? __kmalloc_node_track_caller_noprof+0x362/0x8a0 [ 472.733430][T12324] ? lockdep_init_map_type+0x5c/0x280 [ 472.733447][T12324] ? __raw_spin_lock_init+0x3a/0x110 [ 472.733470][T12324] v9fs_session_init+0x1f7/0x1a80 [ 472.733502][T12324] ? __pfx_v9fs_session_init+0x10/0x10 [ 472.733538][T12324] v9fs_mount+0xc5/0xa90 [ 472.733562][T12324] ? __pfx_v9fs_mount+0x10/0x10 [ 472.733587][T12324] ? cap_capable+0xb3/0x250 [ 472.733615][T12324] ? __pfx_v9fs_mount+0x10/0x10 [ 472.733638][T12324] legacy_get_tree+0x10c/0x220 [ 472.733660][T12324] vfs_get_tree+0x8e/0x340 [ 472.733683][T12324] path_mount+0x7b9/0x23a0 [ 472.733705][T12324] ? __pfx_path_mount+0x10/0x10 [ 472.733726][T12324] ? putname+0x154/0x1a0 [ 472.733750][T12324] ? putname+0x154/0x1a0 [ 472.733767][T12324] ? putname+0x154/0x1a0 [ 472.733790][T12324] ? __x64_sys_mount+0x293/0x310 [ 472.733808][T12324] __x64_sys_mount+0x293/0x310 [ 472.733828][T12324] ? __pfx___x64_sys_mount+0x10/0x10 [ 472.733855][T12324] do_syscall_64+0xcd/0xfa0 [ 472.733881][T12324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.733898][T12324] RIP: 0033:0x7f4b5e38efc9 [ 472.733912][T12324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 472.733928][T12324] RSP: 002b:00007f4b5f1bb038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 472.733944][T12324] RAX: ffffffffffffffda RBX: 00007f4b5e5e5fa0 RCX: 00007f4b5e38efc9 [ 472.733955][T12324] RDX: 0000200000001440 RSI: 0000200000001400 RDI: 00002000000013c0 [ 472.733965][T12324] RBP: 00007f4b5f1bb090 R08: 00002000000002c0 R09: 0000000000000000 [ 472.733975][T12324] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 472.733985][T12324] R13: 00007f4b5e5e6038 R14: 00007f4b5e5e5fa0 R15: 00007ffd3754e7a8 [ 472.734008][T12324] [ 473.151997][ T5866] ath6kl: Failed to submit usb control message: -71 [ 473.158649][ T5866] ath6kl: unable to send the bmi data to the device: -71 [ 473.165710][ T5866] ath6kl: Unable to send get target info: -71 [ 473.210260][ T5866] ath6kl: Failed to init ath6kl core: -71 [ 473.217520][ T5866] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 473.250473][ T30] audit: type=1400 audit(1761269962.572:1041): avc: denied { read write } for pid=12327 comm="syz.0.1583" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 473.251090][ T5866] usb 2-1: USB disconnect, device number 39 [ 473.650436][ T30] audit: type=1400 audit(1761269962.572:1042): avc: denied { open } for pid=12327 comm="syz.0.1583" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 473.734731][ T5924] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 473.810947][ T30] audit: type=1400 audit(1761269962.612:1043): avc: denied { ioctl } for pid=12327 comm="syz.0.1583" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 473.930144][ T5924] usb 4-1: Using ep0 maxpacket: 16 [ 473.943378][ T5924] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 473.976307][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 474.012003][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 474.047000][ T5924] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 474.151879][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 474.360051][ T5924] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 474.474303][ T5924] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 474.563069][ T5924] usb 4-1: Manufacturer: syz [ 474.607589][ T5924] usb 4-1: config 0 descriptor?? [ 474.691241][ T52] Bluetooth: hci5: command tx timeout [ 474.922964][ T5924] rc_core: IR keymap rc-hauppauge not found [ 474.942203][ T30] audit: type=1400 audit(1761269964.262:1044): avc: denied { append } for pid=12364 comm="syz.1.1591" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 474.970092][ T5924] Registered IR keymap rc-empty [ 475.001347][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.039837][T12332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.054085][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.061286][ T24] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 475.085973][T12332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.155340][ T5924] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 475.202626][T12269] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 475.219527][ T5924] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input29 [ 475.237865][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 475.254441][T12269] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 475.261454][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.269442][ T24] usb 3-1: Product: syz [ 475.277023][ T24] usb 3-1: Manufacturer: syz [ 475.278015][ T30] audit: type=1400 audit(1761269964.602:1045): avc: denied { read } for pid=5169 comm="acpid" name="event4" dev="devtmpfs" ino=3260 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 475.282709][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.315075][ T24] usb 3-1: SerialNumber: syz [ 475.324338][T12373] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 475.347661][T12269] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 475.394455][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.402031][ T30] audit: type=1400 audit(1761269964.602:1046): avc: denied { open } for pid=5169 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3260 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 475.428042][T12269] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 475.434994][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.510416][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.551015][ T30] audit: type=1400 audit(1761269964.602:1047): avc: denied { ioctl } for pid=5169 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3260 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 475.584058][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.636901][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 475.649931][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.675832][ T30] audit: type=1400 audit(1761269964.812:1048): avc: denied { create } for pid=12375 comm="syz.1.1594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=iucv_socket permissive=1 [ 475.706802][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.760263][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 475.771357][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 475.790123][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.852403][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.877824][ T24] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -32 [ 475.911092][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 475.931814][ T24] usb 3-1: USB disconnect, device number 47 [ 475.960141][ T5924] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 476.017252][ T5924] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 476.062935][ T5924] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 476.116168][ T5924] usb 4-1: USB disconnect, device number 24 [ 476.781855][ T52] Bluetooth: hci5: command tx timeout [ 477.910245][ T24] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 478.081645][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 478.106248][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 478.130601][ T24] usb 3-1: config 1 has an invalid interface number: 2 but max is 0 [ 478.159267][ T24] usb 3-1: config 1 has no interface number 0 [ 478.172797][ T24] usb 3-1: config 1 interface 2 has no altsetting 0 [ 478.187957][ T24] usb 3-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=a2.4b [ 478.199449][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.226582][ T24] usb 3-1: Product: syz [ 478.238236][ T24] usb 3-1: Manufacturer: syz [ 478.243244][ T24] usb 3-1: SerialNumber: syz [ 478.468099][ T24] etas_es58x 3-1:1.2: Starting syz syz (Serial Number syz) [ 478.492428][T12455] tmpfs: Unknown parameter '0000000000000000000000318446744073709551615' [ 478.512848][ T24] usb 3-1: USB disconnect, device number 48 [ 478.540554][T12455] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=28181 sclass=netlink_xfrm_socket pid=12455 comm=syz.0.1603 [ 478.854500][ T52] Bluetooth: hci5: command tx timeout [ 479.358954][T12480] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1606'. [ 479.906236][T12425] netlink: 755 bytes leftover after parsing attributes in process `syz.3.1599'. [ 480.270163][ T30] audit: type=1400 audit(1761269969.572:1049): avc: denied { read write } for pid=12500 comm="syz.3.1607" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 480.300382][T12269] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 480.847475][ T30] audit: type=1400 audit(1761269969.572:1050): avc: denied { open } for pid=12500 comm="syz.3.1607" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 480.871708][T12269] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 480.890280][ T30] audit: type=1400 audit(1761269969.572:1051): avc: denied { ioctl } for pid=12500 comm="syz.3.1607" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 480.917669][T12269] wireguard: wg0: Could not create IPv4 socket [ 480.972647][T12269] wireguard: wg1: Could not create IPv4 socket [ 480.994361][T12269] wireguard: wg2: Could not create IPv4 socket [ 481.280215][ T5880] usb 2-1: new low-speed USB device number 40 using dummy_hcd [ 481.481471][T12533] exFAT-fs (nullb0): mounting with "discard" option, but the device does not support discard [ 481.494647][T12533] exFAT-fs (nullb0): invalid boot record signature [ 481.501294][T12533] exFAT-fs (nullb0): failed to read boot sector [ 481.507553][T12533] exFAT-fs (nullb0): failed to recognize exfat type [ 481.579839][T12533] random: crng reseeded on system resumption [ 481.772076][ T30] audit: type=1400 audit(1761269970.902:1052): avc: denied { write } for pid=12528 comm="syz.3.1614" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 481.825384][ T30] audit: type=1400 audit(1761269970.902:1053): avc: denied { open } for pid=12528 comm="syz.3.1614" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 481.863165][ T5880] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 481.882913][ T5880] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.896362][ T30] audit: type=1400 audit(1761269971.212:1054): avc: denied { read } for pid=12525 comm="syz.0.1613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 481.924162][ T5880] usb 2-1: config 0 descriptor?? [ 484.442881][T12592] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1617'. [ 484.452019][T12592] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1617'. [ 484.658835][T12594] ubi: mtd0 is already attached to ubi31 [ 484.676987][ T30] audit: type=1400 audit(1761269973.972:1055): avc: denied { connect } for pid=12581 comm="syz.0.1617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 484.978885][T12583] comedi comedi1: comedi_config --init_data is deprecated [ 485.003185][T12593] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1617'. [ 485.136478][ T30] audit: type=1400 audit(1761269973.982:1056): avc: denied { ioctl } for pid=12581 comm="syz.0.1617" path="socket:[39188]" dev="sockfs" ino=39188 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 485.229820][ T5816] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 485.242663][ T5816] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 485.251731][ T5816] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 485.259872][ T5816] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 485.267378][ T5816] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 485.289601][ T30] audit: type=1400 audit(1761269974.142:1057): avc: denied { mount } for pid=12579 comm="syz.2.1618" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 485.391144][T12597] Failed to initialize the IGMP autojoin socket (err -2) [ 485.515157][ T5880] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 485.537655][ T5880] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 485.558966][ T5880] asix 2-1:0.0: probe with driver asix failed with error -71 [ 485.705751][ T5880] usb 2-1: USB disconnect, device number 40 [ 486.269232][ T30] audit: type=1400 audit(1761269975.562:1058): avc: denied { ioctl } for pid=12615 comm="syz.3.1624" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x125f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 487.330050][ T5816] Bluetooth: hci5: command tx timeout [ 488.137577][T12649] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1630'. [ 488.206764][T12651] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12651 comm=syz.0.1631 [ 488.236070][T12639] syzkaller0: entered promiscuous mode [ 488.321424][T12639] syzkaller0: entered allmulticast mode [ 488.387519][T12647] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1630'. [ 488.514535][T12656] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 488.643922][ T30] audit: type=1400 audit(1761269977.972:1059): avc: denied { create } for pid=12655 comm="syz.0.1632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 489.221156][ T60] Bluetooth: (null): Invalid header checksum [ 489.248043][ T60] Bluetooth: (null): Invalid header checksum [ 489.259721][ T60] Bluetooth: (null): Invalid header checksum [ 489.285231][ T60] Bluetooth: (null): Invalid header checksum [ 489.310612][ T60] Bluetooth: (null): Invalid header checksum [ 489.410893][ T5816] Bluetooth: hci5: command tx timeout [ 491.530432][ T5816] Bluetooth: hci5: command tx timeout [ 491.691185][T12735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1633'. [ 491.725182][T12735] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1633'. [ 492.010886][ T5880] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 492.238911][ T30] audit: type=1400 audit(1761269981.552:1060): avc: denied { map } for pid=12742 comm="syz.2.1638" path="socket:[40041]" dev="sockfs" ino=40041 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 492.446298][T12735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1633'. [ 492.590890][ T5880] usb 1-1: Using ep0 maxpacket: 16 [ 492.623913][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 492.674261][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 492.693361][T12597] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 492.760187][ T5880] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 492.769786][ T5880] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.782942][ T5880] usb 1-1: config 0 descriptor?? [ 492.799683][T12597] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 492.851762][T12597] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 492.917097][T12597] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 493.233812][ T30] audit: type=1400 audit(1761269982.532:1061): avc: denied { create } for pid=12738 comm="syz.0.1636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 493.438202][ T5880] usbhid 1-1:0.0: can't add hid device: -71 [ 493.468696][ T30] audit: type=1400 audit(1761269982.532:1062): avc: denied { ioctl } for pid=12738 comm="syz.0.1636" path="socket:[40060]" dev="sockfs" ino=40060 ioctlcmd=0x89e6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 493.469814][ T5880] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 493.612922][ T5816] Bluetooth: hci5: command tx timeout [ 493.726556][ T5880] usb 1-1: USB disconnect, device number 37 [ 493.831712][T12785] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1643'. [ 495.683920][ T30] audit: type=1400 audit(1761269985.012:1063): avc: denied { remount } for pid=12832 comm="syz.1.1652" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 495.711813][T12597] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 495.814651][T12597] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 495.893784][ T30] audit: type=1400 audit(1761269985.212:1064): avc: denied { read write } for pid=12841 comm="syz.1.1655" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 495.941729][T12597] wireguard: wg0: Could not create IPv4 socket [ 495.976505][ T30] audit: type=1400 audit(1761269985.212:1065): avc: denied { open } for pid=12841 comm="syz.1.1655" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 496.000192][ C0] vkms_vblank_simulate: vblank timer overrun [ 496.012715][T12597] wireguard: wg1: Could not create IPv4 socket [ 496.023182][T12597] wireguard: wg2: Could not create IPv4 socket [ 496.253433][T12849] trusted_key: encrypted_key: insufficient parameters specified [ 496.710995][T12854] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1657'. [ 497.014946][ T30] audit: type=1400 audit(1761269986.332:1066): avc: denied { ioctl } for pid=12841 comm="syz.1.1655" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 497.858478][T12879] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1658'. [ 498.400533][ C0] vkms_vblank_simulate: vblank timer overrun [ 500.580090][ T5880] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 500.779260][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 500.825568][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 500.834062][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 500.842173][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 500.849893][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 500.870086][ T5880] usb 1-1: Using ep0 maxpacket: 8 [ 500.886943][ T5880] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 500.909740][T12967] Failed to initialize the IGMP autojoin socket (err -2) [ 500.956351][ T5880] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.972247][T12966] binder: 12957:12966 ioctl c0306201 0 returned -14 [ 501.078339][ T5880] usb 1-1: Product: syz [ 501.091657][ T30] audit: type=1400 audit(1761269990.422:1067): avc: denied { read write } for pid=12948 comm="syz.3.1664" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 501.116062][ C0] vkms_vblank_simulate: vblank timer overrun [ 501.126502][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.133000][ T5880] usb 1-1: Manufacturer: syz [ 501.137701][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.163126][ T5880] usb 1-1: SerialNumber: syz [ 501.192489][ T5880] usb 1-1: config 0 descriptor?? [ 501.228329][ T5880] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 501.241558][ T30] audit: type=1400 audit(1761269990.422:1068): avc: denied { open } for pid=12948 comm="syz.3.1664" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 501.266779][ C0] vkms_vblank_simulate: vblank timer overrun [ 501.289524][ T5880] dvb-usb: bulk message failed: -22 (2/0) [ 501.378447][ T5880] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 501.460193][T12952] dvb-usb: bulk message failed: -22 (4/0) [ 501.467641][ T5880] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 501.487117][ T5880] usb 1-1: media controller created [ 501.511608][ T5880] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 501.531151][ T30] audit: type=1400 audit(1761269990.862:1069): avc: denied { bind } for pid=12976 comm="syz.1.1666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 501.603845][T12952] cxusb: i2c read failed [ 501.609855][T12978] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 501.681052][ T5880] cxusb: set interface failed [ 501.723766][ T5880] dvb-usb: bulk message failed: -22 (1/0) [ 501.842747][ T5880] DVB: Unable to find symbol mt352_attach() [ 501.851424][ T5880] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 502.097670][T12966] syz.2.1665 (12966): drop_caches: 2 [ 502.140044][ T5880] rc_core: IR keymap rc-dvico-portable not found [ 502.146526][ T5880] Registered IR keymap rc-empty [ 502.159095][ T5880] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 502.220941][ T5880] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input31 [ 502.485429][ T5880] dvb-usb: schedule remote query interval to 100 msecs. [ 502.498449][ T5880] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 502.607670][ T5880] usb 1-1: USB disconnect, device number 38 [ 502.917947][ T5880] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 502.931673][ T5816] Bluetooth: hci5: command tx timeout [ 503.063242][ T30] audit: type=1400 audit(1761269992.392:1070): avc: denied { create } for pid=13008 comm="syz.0.1674" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 503.366572][ T30] audit: type=1400 audit(1761269992.692:1071): avc: denied { create } for pid=13018 comm="syz.1.1675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 504.389774][T12967] netdevsim netdevsim5 netdevsim0: renamed from eth1 [ 504.433141][T12967] netdevsim netdevsim5 netdevsim1: renamed from eth2 [ 504.448060][T13029] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1677'. [ 504.457661][T13029] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1677'. [ 504.462397][T12967] netdevsim netdevsim5 netdevsim2: renamed from eth3 [ 504.473620][T13029] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1677'. [ 504.513808][T12967] netdevsim netdevsim5 netdevsim3: renamed from eth4 [ 504.537533][T13031] netlink: 'syz.1.1678': attribute type 1 has an invalid length. [ 504.547684][T13031] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1678'. [ 504.565122][T13031] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1678'. [ 504.574660][T13031] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1678'. [ 504.604609][ T30] audit: type=1400 audit(1761269993.922:1072): avc: denied { getopt } for pid=13030 comm="syz.1.1678" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 504.702666][T13033] random: crng reseeded on system resumption [ 504.880222][ T30] audit: type=1400 audit(1761269994.202:1073): avc: denied { ioctl } for pid=13032 comm="syz.3.1679" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x330b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 504.966993][T13043] netlink: 'syz.2.1682': attribute type 1 has an invalid length. [ 504.967810][T13045] netlink: 'syz.2.1682': attribute type 1 has an invalid length. [ 505.011126][ T5816] Bluetooth: hci5: command tx timeout [ 505.012090][T13043] 8021q: adding VLAN 0 to HW filter on device bond2 [ 505.264172][ T30] audit: type=1400 audit(1761269994.592:1074): avc: denied { mount } for pid=13052 comm="syz.3.1684" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 505.285894][ C1] vkms_vblank_simulate: vblank timer overrun [ 505.350232][ T30] audit: type=1400 audit(1761269994.672:1075): avc: denied { append } for pid=13052 comm="syz.3.1684" name="video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 505.373482][ C1] vkms_vblank_simulate: vblank timer overrun [ 505.730242][T13070] exFAT-fs (nullb0): mounting with "discard" option, but the device does not support discard [ 505.743947][T13070] exFAT-fs (nullb0): invalid boot record signature [ 505.750592][T13070] exFAT-fs (nullb0): failed to read boot sector [ 505.756933][T13070] exFAT-fs (nullb0): failed to recognize exfat type [ 505.786530][T13070] random: crng reseeded on system resumption [ 506.504065][T13080] netlink: 'syz.0.1689': attribute type 1 has an invalid length. [ 506.594320][T13080] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.988676][T12967] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 507.091648][ T5816] Bluetooth: hci5: command tx timeout [ 507.459491][T12967] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 507.525219][T12967] wireguard: wg0: Could not create IPv4 socket [ 507.534314][T12967] wireguard: wg1: Could not create IPv4 socket [ 507.544509][T12967] wireguard: wg2: Could not create IPv4 socket [ 507.562015][ T30] audit: type=1400 audit(1761269996.892:1076): avc: denied { setopt } for pid=13098 comm="syz.0.1692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 507.808191][ T30] audit: type=1400 audit(1761269997.132:1077): avc: denied { mount } for pid=13100 comm="syz.0.1694" name="/" dev="autofs" ino=41761 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 507.838083][ T30] audit: type=1400 audit(1761269997.172:1078): avc: denied { mounton } for pid=13100 comm="syz.0.1694" path="/file1" dev="autofs" ino=41761 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 507.939119][ T30] audit: type=1400 audit(1761269997.262:1079): avc: denied { unmount } for pid=5809 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 507.966388][ T1057] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 508.509024][T13107] netlink: 320 bytes leftover after parsing attributes in process `syz.1.1696'. [ 508.536372][ T1057] usb 4-1: Using ep0 maxpacket: 16 [ 508.574453][ T1057] usb 4-1: New USB device found, idVendor=25c6, idProduct=9002, bcdDevice=41.ba [ 508.630037][ T1057] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.712245][ T1057] usb 4-1: Product: syz [ 508.735073][ T1057] usb 4-1: Manufacturer: syz [ 508.765792][ T1057] usb 4-1: SerialNumber: syz [ 508.814281][ T1057] usb 4-1: config 0 descriptor?? [ 508.927420][T13119] Failed to initialize the IGMP autojoin socket (err -2) [ 509.082101][ T30] audit: type=1400 audit(1761269998.412:1080): avc: denied { execute_no_trans } for pid=13096 comm="syz.3.1693" path="/401/file0" dev="tmpfs" ino=2172 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 509.105652][ C1] vkms_vblank_simulate: vblank timer overrun [ 509.191119][ T1057] snd-usb-hiface 4-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 509.220047][T10611] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 509.394363][T10611] usb 1-1: config 0 has no interfaces? [ 509.409545][T10628] usb 4-1: USB disconnect, device number 25 [ 509.419163][T10611] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 509.420171][ T31] INFO: task syz.4.1156:10159 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 509.441224][T10611] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.450214][ T30] audit: type=1400 audit(1761269998.772:1081): avc: denied { write } for pid=5797 comm="syz-executor" path="pipe:[4009]" dev="pipefs" ino=4009 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 509.473745][ C1] vkms_vblank_simulate: vblank timer overrun [ 509.490833][T10611] usb 1-1: Product: syz [ 509.500097][T10611] usb 1-1: Manufacturer: syz [ 509.504762][T10611] usb 1-1: SerialNumber: syz [ 509.511033][ T31] Not tainted syzkaller #0 [ 509.532221][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 509.552547][ T31] task:syz.4.1156 state:D stack:24568 pid:10159 tgid:10158 ppid:5808 task_flags:0x400140 flags:0x00080003 [ 509.573141][T10611] usb 1-1: config 0 descriptor?? [ 509.596794][ T31] Call Trace: [ 509.638033][ T31] [ 509.662721][ T31] __schedule+0x1190/0x5de0 [ 509.670155][T10626] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 509.696681][ T31] ? __pfx___schedule+0x10/0x10 [ 509.716456][ T31] ? find_held_lock+0x2b/0x80 [ 509.791851][ T31] ? schedule+0x2d7/0x3a0 [ 509.796255][ T31] schedule+0xe7/0x3a0 [ 509.830510][ T31] schedule_timeout+0x257/0x290 [ 509.857816][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 509.869991][ T31] ? mark_held_locks+0x49/0x80 [ 509.874907][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 509.900343][T10626] usb 3-1: Using ep0 maxpacket: 16 [ 509.900684][ T31] __wait_for_common+0x2fc/0x4e0 [ 509.920358][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 509.925799][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 509.950532][ T31] ? ib_cq_pool_cleanup+0x220/0x360 [ 509.956280][ T31] disable_device+0x16f/0x280 [ 509.971803][ T31] ? __pfx_disable_device+0x10/0x10 [ 509.977057][ T31] __ib_unregister_device+0x2b4/0x480 [ 510.002760][ T31] ? __pfx_ib_device_get_by_index+0x10/0x10 [ 510.009119][ T31] ib_unregister_device_and_put+0x5a/0x80 [ 510.020604][ T31] nldev_dellink+0x21f/0x320 [ 510.025242][ T31] ? __pfx_nldev_dellink+0x10/0x10 [ 510.031337][ T31] ? cap_capable+0xb3/0x250 [ 510.043928][ T31] ? bpf_lsm_capable+0x9/0x10 [ 510.048947][ T31] ? security_capable+0x7e/0x260 [ 510.055420][ T31] ? ns_capable+0xd7/0x110 [ 510.061520][ T31] ? __pfx_nldev_dellink+0x10/0x10 [ 510.070538][ T31] rdma_nl_rcv_msg+0x38a/0x6e0 [ 510.075331][ T31] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 510.080704][ T31] ? __lock_acquire+0x622/0x1c90 [ 510.086220][ T31] rdma_nl_rcv_skb.constprop.0.isra.0+0x2d0/0x430 [ 510.094100][ T31] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 510.103649][ T31] ? netlink_deliver_tap+0x1ae/0xd30 [ 510.109503][ T31] netlink_unicast+0x5aa/0x870 [ 510.115794][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 510.141775][ T31] netlink_sendmsg+0x8c8/0xdd0 [ 510.146611][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.170015][ T31] ____sys_sendmsg+0xa98/0xc70 [ 510.176608][ T31] ? copy_msghdr_from_user+0x10a/0x160 [ 510.190519][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 510.195869][ T31] ___sys_sendmsg+0x134/0x1d0 [ 510.210249][ T31] ? futex_private_hash_put+0x176/0x300 [ 510.216195][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 510.223748][ T31] ? __lock_acquire+0x622/0x1c90 [ 510.229304][ T31] __sys_sendmsg+0x16d/0x220 [ 510.234155][ T31] ? __pfx___sys_sendmsg+0x10/0x10 [ 510.239293][ T31] ? __x64_sys_futex+0x1e0/0x4c0 [ 510.244354][ T31] do_syscall_64+0xcd/0xfa0 [ 510.249008][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.255530][ T31] RIP: 0033:0x7fc93df8efc9 [ 510.263138][ T31] RSP: 002b:00007fc93edcc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 510.271768][ T31] RAX: ffffffffffffffda RBX: 00007fc93e1e5fa0 RCX: 00007fc93df8efc9 [ 510.279853][ T31] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000000c [ 510.287942][ T31] RBP: 00007fc93e011f91 R08: 0000000000000000 R09: 0000000000000000 [ 510.297520][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 510.305725][ T31] R13: 00007fc93e1e6038 R14: 00007fc93e1e5fa0 R15: 00007ffc1ba507b8 [ 510.314143][ T31] [ 510.317284][ T31] [ 510.317284][ T31] Showing all locks held in the system: [ 510.325096][ T31] 1 lock held by khungtaskd/31: [ 510.330213][ T31] #0: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 510.360285][ T31] 2 locks held by getty/5576: [ 510.365003][ T31] #0: ffff88814d4d00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 510.380220][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 510.430223][ T31] 3 locks held by kworker/0:4/5880: [ 510.450000][ T31] #0: ffff88813ff11948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 510.490016][ T31] #1: ffffc90003427d00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 510.530026][ T31] #2: ffffffff8e3cf9f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 510.593322][ T31] 2 locks held by syz.4.1156/10159: [ 510.598557][ T31] #0: ffffffff9ae624d8 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg+0x169/0x6e0 [ 510.640098][ T31] #1: ffff888079330700 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x23b/0x480 [ 510.700306][ T31] 3 locks held by kworker/0:10/10611: [ 510.720702][ T31] 5 locks held by kworker/0:15/10626: [ 510.726268][ T31] #0: ffff88801be9b948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 510.800262][ T31] #1: ffffc9000c787d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 510.860257][ T31] #2: ffff888144b3a198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 510.869224][ T31] #3: ffff888144b3d518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2981/0x4fe0 [ 510.900019][ T31] #4: ffff8880293d5f68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x29aa/0x4fe0 [ 510.909841][ T31] 1 lock held by syz-executor/12967: [ 510.930880][ T31] #0: ffffffff8e3cf8c0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6e0 [ 510.980188][ T31] 3 locks held by syz.3.1693/13097: [ 510.985447][ T31] #0: ffff88802371cdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 511.010206][ T31] #1: ffff88802371c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 511.033703][ T31] #2: ffffffff9035a2c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 511.070295][ T31] 3 locks held by syz.0.1699/13118: [ 511.075594][ T31] #0: ffff8880768bcdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 511.110183][ T31] #1: ffff8880768bc0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 511.119929][ T31] #2: ffffffff9035a2c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 511.170189][ T31] 1 lock held by syz.1.1701/13126: [ 511.175363][ T31] 5 locks held by syz.2.1702/13124: [ 511.200473][ T31] #0: ffff8880792a0dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 [ 511.230252][ T31] #1: ffff8880792a00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 [ 511.253709][ T31] #2: ffffffff9035a2c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 [ 511.263883][ T31] #3: ffff888035d2f338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 [ 511.290026][ T31] #4: ffffffff8e3cf9f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 511.331131][ T31] 4 locks held by dhcpcd-run-hook/13143: [ 511.344051][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 511.361336][ T31] #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 511.410156][ T31] #2: ffffffff9acfb530 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 [ 511.423579][ T31] #3: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: sig_get_ucounts+0x74/0x5b0 [ 511.436011][ T31] [ 511.438394][ T31] ============================================= [ 511.438394][ T31] [ 511.449185][ T31] NMI backtrace for cpu 1 [ 511.449200][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 511.449218][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 511.449238][ T31] Call Trace: [ 511.449244][ T31] [ 511.449250][ T31] dump_stack_lvl+0x116/0x1f0 [ 511.449280][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 511.449299][ T31] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 511.449323][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 511.449349][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 511.449372][ T31] watchdog+0xf3f/0x1170 [ 511.449397][ T31] ? rcu_is_watching+0x12/0xc0 [ 511.449419][ T31] ? __pfx_watchdog+0x10/0x10 [ 511.449438][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 511.449464][ T31] ? __kthread_parkme+0x19e/0x250 [ 511.449489][ T31] ? __pfx_watchdog+0x10/0x10 [ 511.449509][ T31] kthread+0x3c5/0x780 [ 511.449526][ T31] ? __pfx_kthread+0x10/0x10 [ 511.449543][ T31] ? rcu_is_watching+0x12/0xc0 [ 511.449563][ T31] ? __pfx_kthread+0x10/0x10 [ 511.449581][ T31] ret_from_fork+0x675/0x7d0 [ 511.449595][ T31] ? __pfx_kthread+0x10/0x10 [ 511.449611][ T31] ret_from_fork_asm+0x1a/0x30 [ 511.449646][ T31] [ 511.449652][ T31] Sending NMI from CPU 1 to CPUs 0: [ 511.577624][ C0] NMI backtrace for cpu 0 [ 511.577637][ C0] CPU: 0 UID: 0 PID: 13150 Comm: sed Not tainted syzkaller #0 PREEMPT(full) [ 511.577653][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 511.577661][ C0] RIP: 0010:__lock_acquire+0x682/0x1c90 [ 511.577686][ C0] Code: 06 41 31 d6 44 89 f2 44 29 f1 41 01 c6 c1 c2 08 31 d1 89 ca 29 c8 44 01 f1 c1 c2 10 89 cf 31 d0 89 c6 41 29 c6 01 c8 c1 ce 0d <44> 31 f6 89 f2 29 f7 01 f0 c1 c2 04 89 c0 31 fa 48 c1 e2 20 48 09 [ 511.577699][ C0] RSP: 0018:ffffc90003727660 EFLAGS: 00000082 [ 511.577710][ C0] RAX: 0000000095481a34 RBX: 0000000000000000 RCX: 00000000ef9d33e4 [ 511.577719][ C0] RDX: 00000000b5f8efad RSI: 0000000032852d57 RDI: 00000000ef9d33e4 [ 511.577727][ C0] RBP: ffff888027e8a480 R08: 0000000000000000 R09: 0000000000000000 [ 511.577738][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888027e8afb0 [ 511.577747][ C0] R13: ffff888027e8afb0 R14: 000000005a44979c R15: 0000000000000001 [ 511.577755][ C0] FS: 0000000000000000(0000) GS:ffff888124a0b000(0000) knlGS:0000000000000000 [ 511.577769][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 511.577777][ C0] CR2: 00007f5455d08b4c CR3: 0000000033a9a000 CR4: 00000000003526f0 [ 511.577785][ C0] Call Trace: [ 511.577790][ C0] [ 511.577799][ C0] lock_acquire+0x179/0x350 [ 511.577811][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 511.577827][ C0] ? unwind_next_frame+0x3f4/0x20a0 [ 511.577841][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 511.577859][ C0] unwind_next_frame+0xd1/0x20a0 [ 511.577872][ C0] ? unwind_next_frame+0xbd/0x20a0 [ 511.577885][ C0] ? __x64_sys_execve+0x8e/0xb0 [ 511.577900][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 511.577917][ C0] arch_stack_walk+0x94/0x100 [ 511.577933][ C0] ? __x64_sys_execve+0x8e/0xb0 [ 511.577946][ C0] stack_trace_save+0x8e/0xc0 [ 511.577962][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 511.577979][ C0] ? __lock_acquire+0xb8a/0x1c90 [ 511.577998][ C0] kasan_save_stack+0x33/0x60 [ 511.578010][ C0] ? kasan_save_stack+0x33/0x60 [ 511.578021][ C0] ? kasan_save_track+0x14/0x30 [ 511.578033][ C0] ? __kasan_save_free_info+0x3b/0x60 [ 511.578056][ C0] ? __kasan_slab_free+0x5f/0x80 [ 511.578068][ C0] ? kfree+0x2b8/0x6d0 [ 511.578085][ C0] ? load_elf_binary+0x1e1e/0x4fe0 [ 511.578099][ C0] ? bprm_execve+0x8be/0x1640 [ 511.578116][ C0] ? do_execveat_common.isra.0+0x4a5/0x610 [ 511.578129][ C0] ? __x64_sys_execve+0x8e/0xb0 [ 511.578152][ C0] kasan_save_track+0x14/0x30 [ 511.578163][ C0] __kasan_save_free_info+0x3b/0x60 [ 511.578180][ C0] __kasan_slab_free+0x5f/0x80 [ 511.578194][ C0] kfree+0x2b8/0x6d0 [ 511.578208][ C0] ? load_elf_binary+0x1e1e/0x4fe0 [ 511.578224][ C0] ? load_elf_binary+0x1e1e/0x4fe0 [ 511.578238][ C0] load_elf_binary+0x1e1e/0x4fe0 [ 511.578258][ C0] ? __pfx_load_elf_binary+0x10/0x10 [ 511.578272][ C0] ? find_held_lock+0x2b/0x80 [ 511.578286][ C0] ? bprm_execve+0x89d/0x1640 [ 511.578305][ C0] bprm_execve+0x8be/0x1640 [ 511.578325][ C0] ? __pfx_bprm_execve+0x10/0x10 [ 511.578342][ C0] ? copy_strings.isra.0+0x4a7/0x990 [ 511.578363][ C0] do_execveat_common.isra.0+0x4a5/0x610 [ 511.578382][ C0] __x64_sys_execve+0x8e/0xb0 [ 511.578394][ C0] do_syscall_64+0xcd/0xfa0 [ 511.578413][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.578426][ C0] RIP: 0033:0x7fb39c603107 [ 511.578441][ C0] Code: Unable to access opcode bytes at 0x7fb39c6030dd. [ 511.578447][ C0] RSP: 002b:00007fff8c88d578 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 511.578459][ C0] RAX: ffffffffffffffda RBX: 0000560a82f50e40 RCX: 00007fb39c603107 [ 511.578467][ C0] RDX: 0000560a82f50e68 RSI: 0000560a82f50e40 RDI: 0000560a82f50ef8 [ 511.578475][ C0] RBP: 0000560a82f50ef8 R08: 00007fff8c892c25 R09: 0000000000000000 [ 511.578483][ C0] R10: 0000000000000008 R11: 0000000000000246 R12: 0000560a82f50e68 [ 511.578491][ C0] R13: 00007fb39c7c8e8b R14: 0000560a82f50e68 R15: 0000000000000000 [ 511.578503][ C0] [ 511.964277][ C1] vkms_vblank_simulate: vblank timer overrun [ 512.219574][T10626] usb 3-1: device descriptor read/all, error -71 [ 512.333527][T10611] usb 1-1: USB disconnect, device number 39 [ 512.686672][ T60] bridge_slave_1: left allmulticast mode [ 512.694859][ T60] bridge_slave_1: left promiscuous mode [ 512.702338][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.712450][ T60] bridge_slave_0: left allmulticast mode [ 512.718160][ T60] bridge_slave_0: left promiscuous mode [ 512.724228][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 513.342840][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 513.352966][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 513.364094][ T60] bond0 (unregistering): Released all slaves [ 513.492279][ T60] bond1 (unregistering): Released all slaves [ 513.616339][ T60] bond2 (unregistering): Released all slaves [ 513.706939][ T60] tipc: Left network mode