last executing test programs: 6m52.551237132s ago: executing program 2 (id=1465): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) syz_io_uring_submit(0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5393, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r2 = dup(0xffffffffffffffff) read$FUSE(r2, &(0x7f0000003c40)={0x2020}, 0xffffff0a) r3 = syz_clone(0x840080, &(0x7f0000000580)="3a59421c146cad0f26b88eb1e6d05ad53518c300d6106310230811f78f147e5560f0a330e9634d6ab39281aa889e7eace32f2d757e7e333d2b22b127f3226d2c4093e42593234c9d50148572efe7f7ab452a61cc32cec27dcfe9722c4fe381f7ed927af21b9fb63eac4a42f9bc28010f503f3d35d4729aca64e7de259149625505519a28e070d78f77e002285f7f499871617d31678f150fef7f830306e4376ef16b5ec0d808fca786fd4d4d676ec9e6a1505dc3b20c2dbabbc57d66c7cc5db209baf2869e754361aea7c0f41bf098f32ede7d828897552df4c64ba8a3204883a2806883babb5c9cf4a5235453246c19342b52c586424011be911bcd18cd94edd6b5cab8e377d2d68f3ef970487025847ca6e98939fd45de9921d3bd6e6cf7697dc3ac4674d5bed46ff24d8e4710306bfe9fff057621a1002504706b5a502101ae750a7bc255d5a1e4333402e5094c7758068e01443871cec01331bf73a0546f2e0c0b733108fcb31abd0868ee4f2437fe8d6598715c7cdff79edd7912da523012bde4554192d54c7f427e452c29f8d4b3ee945dd7e5301ef2f0b1b7e0fd548c1e3b29808110a46eece29d61856dff01acf6df3d8b88450c8cddec5cfdbeda2b3c210b9dafe677b314d055e10a4bcf921e993c36d03de6c01c4cfdf7a74010e3fd6264970e2d78a973490e82c500f88a", 0x1f0, &(0x7f0000000040), &(0x7f0000000380), &(0x7f00000003c0)="ad0d08584547edd6aeec639fa19ee18935870e6fa50ef23b130bbaa7bac10755f0312b5b41aebca77d842249cb52fb89b1123937c940359e4801ee") ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f0000000440)={{0x1, 0x0, 0x5, 0x1, 'syz0\x00', 0xff}, 0x3, 0x400, 0x80, r3, 0x1, 0x3, 'syz1\x00', &(0x7f0000000400)=['/dev/vbi#\x00'], 0xa}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x4000851) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x1, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0x98f909, 0x8000, '\x00', @string=&(0x7f0000000240)=0x7d}}) r6 = eventfd2(0xff, 0x80801) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r6}) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r7, 0x400454cd, 0x339) epoll_create1(0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x8, r6, 0xc}) 6m51.16734578s ago: executing program 2 (id=1470): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x40c0}, 0x20004000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = shmget$private(0x0, 0x3000, 0x80, &(0x7f0000ffb000/0x3000)=nil) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) shmctl$SHM_UNLOCK(r2, 0xc) r3 = dup3(r1, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x6, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x5, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x8, 0x4c75, 0x80000000, 0x2, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x6, 0x4, 0x8008, 0x400, 0xe, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0x40c8, 0xf9, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0xea4, 0x0, 0xb94, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x1, 0x9, 0x5, 0x1000005, 0x5f31, 0x2d, 0x4e4, 0x5, 0x4, 0xb, 0x2000004, 0x809, 0x80000000, 0x9, 0x6, 0x47, 0x81fd, 0x1, 0xfe000000, 0x8, 0xffffffff, 0x4, 0x4, 0x3, 0x50, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x407, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0x8000, 0x0, 0x5, 0xb, 0x5, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x1000, 0x20000008, 0x4, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x6, 0x2, 0x1ff, 0x3, 0x7ff, 0x8, 0x7, 0x7, 0xe, 0x0, 0x5, 0x1c, 0x8, 0x4, 0x8, 0xde, 0x4, 0x82a], [0x9, 0xbb33, 0x6, 0xb, 0x5, 0x2, 0x5, 0x3, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x9, 0x1, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x2, 0x6, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0x40007, 0xaf, 0x5, 0x6, 0x227, 0x2, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x20000001, 0x6c1b, 0x0, 0x4, 0x1, 0xb1e, 0x2000d7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x100000000000000, &(0x7f0000000580)="b3"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x13, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x1a, &(0x7f00000007c0)=0x40000401, 0x4) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000080)={0xa, 0x14e22, 0x6, @ipv4={'\x00', '\xff\xff', @multicast2}, 0xfffffffe}, 0x1c) 6m49.467478657s ago: executing program 2 (id=1474): socket(0x10, 0x803, 0x0) socket(0x11, 0xa, 0x38) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', &(0x7f0000002880), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='dyn']) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0xf1) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0xfffffffffffffffc}) chdir(&(0x7f00000000c0)='./bus\x00') mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) mount$tmpfs(0xf0, &(0x7f00000000c0)='./file0\x00', 0x0, 0xe4428, 0x0) 6m48.53546247s ago: executing program 2 (id=1477): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x700, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000351930404516080036cf000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000026c0)={0x2c, &(0x7f0000002500)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd26, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_BETA={0x8, 0x5, 0x1f}, @TCA_PIE_TUPDATE={0x8, 0x3, 0x5}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) 6m45.579130955s ago: executing program 2 (id=1486): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x0, 0x31, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x8, 0x10, 0x80000000, 0x5}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000002100)={0x0}, &(0x7f0000002180)=0xc) ptrace$ARCH_SHSTK_ENABLE(0x1e, r4, 0x3, 0x5001) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x140070, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000002140)='net/psched\x00') read$FUSE(r5, &(0x7f00000000c0)={0x2020}, 0x2020) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000000), 0xfffffecc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000140)=r2}, 0x20) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000004c0)={0x7, r1, 'id1\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000880)=@bpf_lsm={0x1d, 0x32, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@jmp={0x5, 0x1, 0x0, 0x1, 0x3, 0x10}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2d53}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7fffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='syzkaller\x00', 0x2, 0xc8, &(0x7f0000000780)=""/200, 0x41100, 0x4a, '\x00', r8, 0x1b, r9, 0x8, &(0x7f0000000540)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000600)={0x3, 0xf, 0x3, 0x7}, 0x10, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000640)=[{0x3, 0x5, 0xe, 0x6}, {0x2, 0x3, 0xa, 0x4}, {0x0, 0x3, 0x6, 0x6}], 0x10, 0xf}, 0x94) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)=@getlink={0x28, 0x12, 0x1, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x3080, 0x808}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0) r11 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0xfee6, 0x14, 0x51b, 0x70bd26, 0x25dfdbff, {0x2}, [@INET_DIAG_REQ_BYTECODE={0xd, 0x1, "3de07dcbbfa42772feaa33384d12890b0bf850af897c4d8de593fc5f25ddf0fd85d2ca5e5223c1c414154060f92f7a01e84e"}]}, 0xfffffffffffffe7a}, 0x1, 0x0, 0x0, 0x4000}, 0x44000) 6m43.123318319s ago: executing program 2 (id=1494): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e05, 0x1, @mcast1, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="80006466d3805699", 0x8, 0x20004840, 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x101400) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000200)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@empty}}, &(0x7f0000000100)=0xe8) quotactl$Q_GETINFO(0xffffffff80000500, &(0x7f00000000c0)=@sg0, r2, &(0x7f0000000140)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x14, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000005000000000000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000851000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7020000000062b3231022bd1e870000a791000000000000b7020001020000008500000084000000b700000000000000950000080000000a"], &(0x7f00000003c0)='GPL\x00', 0xd, 0x7d, &(0x7f0000000400)=""/125, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x7, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x5, 0x1, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000500)=[0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f0000000540)=[{0x3, 0x3, 0x7, 0x5}, {0x3, 0x1, 0xc, 0x7}, {0x4, 0x4, 0x4}, {0x1, 0x2, 0x2, 0xc}, {0x5, 0x3, 0x1, 0xc}, {0x2, 0x2, 0x6}, {0x5, 0x1, 0xc, 0x1}, {0x0, 0x5, 0x3, 0xc}]}, 0x94) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000a00)={{0xd000, 0x26e000, 0xb, 0xb, 0x56, 0xc, 0xe, 0xf, 0xc, 0x5, 0x2, 0x7}, {0xeeef0000, 0x2000, 0xa, 0x7, 0x7, 0xc, 0xf7, 0x81, 0x81, 0xc, 0xec, 0xee}, {0x8000000, 0x58000, 0x3, 0x25, 0x6, 0x1, 0x0, 0xa8, 0x81, 0x6, 0x2, 0xfc}, {0x5000, 0xd5d57004, 0xd, 0xd, 0x3, 0x5, 0xa7, 0x7f, 0x9, 0x2, 0xc0, 0x3}, {0x4000, 0x54000, 0xb, 0x1, 0x80, 0x1, 0x1, 0x98, 0x34, 0x9, 0xff, 0x9}, {0xfec00000, 0xdddd1000, 0x8, 0xae, 0x68, 0x6, 0x6, 0x0, 0x7, 0xfd, 0x6c, 0xf9}, {0xe000, 0x40000, 0x10, 0x9, 0x65, 0x1, 0x40, 0x6, 0xe2, 0xe, 0xf}, {0x8080000, 0x30000, 0x4, 0x97, 0x7, 0x2, 0x0, 0x2, 0x3, 0x7, 0x8, 0x3}, {0x25000, 0x791}, {0x11000, 0x80}, 0x40012, 0x0, 0x10000, 0x0, 0xc, 0x2000, 0x26000, [0x5, 0xffff, 0xffffffffffffffff, 0x64]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0xc) socket(0x18, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) socket(0x10, 0x3, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000040)=0x100000001) 6m27.940476327s ago: executing program 32 (id=1494): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e05, 0x1, @mcast1, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="80006466d3805699", 0x8, 0x20004840, 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x101400) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000200)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@empty}}, &(0x7f0000000100)=0xe8) quotactl$Q_GETINFO(0xffffffff80000500, &(0x7f00000000c0)=@sg0, r2, &(0x7f0000000140)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x14, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000005000000000000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000851000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7020000000062b3231022bd1e870000a791000000000000b7020001020000008500000084000000b700000000000000950000080000000a"], &(0x7f00000003c0)='GPL\x00', 0xd, 0x7d, &(0x7f0000000400)=""/125, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x7, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x5, 0x1, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000500)=[0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f0000000540)=[{0x3, 0x3, 0x7, 0x5}, {0x3, 0x1, 0xc, 0x7}, {0x4, 0x4, 0x4}, {0x1, 0x2, 0x2, 0xc}, {0x5, 0x3, 0x1, 0xc}, {0x2, 0x2, 0x6}, {0x5, 0x1, 0xc, 0x1}, {0x0, 0x5, 0x3, 0xc}]}, 0x94) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000a00)={{0xd000, 0x26e000, 0xb, 0xb, 0x56, 0xc, 0xe, 0xf, 0xc, 0x5, 0x2, 0x7}, {0xeeef0000, 0x2000, 0xa, 0x7, 0x7, 0xc, 0xf7, 0x81, 0x81, 0xc, 0xec, 0xee}, {0x8000000, 0x58000, 0x3, 0x25, 0x6, 0x1, 0x0, 0xa8, 0x81, 0x6, 0x2, 0xfc}, {0x5000, 0xd5d57004, 0xd, 0xd, 0x3, 0x5, 0xa7, 0x7f, 0x9, 0x2, 0xc0, 0x3}, {0x4000, 0x54000, 0xb, 0x1, 0x80, 0x1, 0x1, 0x98, 0x34, 0x9, 0xff, 0x9}, {0xfec00000, 0xdddd1000, 0x8, 0xae, 0x68, 0x6, 0x6, 0x0, 0x7, 0xfd, 0x6c, 0xf9}, {0xe000, 0x40000, 0x10, 0x9, 0x65, 0x1, 0x40, 0x6, 0xe2, 0xe, 0xf}, {0x8080000, 0x30000, 0x4, 0x97, 0x7, 0x2, 0x0, 0x2, 0x3, 0x7, 0x8, 0x3}, {0x25000, 0x791}, {0x11000, 0x80}, 0x40012, 0x0, 0x10000, 0x0, 0xc, 0x2000, 0x26000, [0x5, 0xffff, 0xffffffffffffffff, 0x64]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0xc) socket(0x18, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) socket(0x10, 0x3, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000040)=0x100000001) 3m54.104262184s ago: executing program 1 (id=2057): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002800600010000000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240088c1}, 0x0) write(r0, &(0x7f0000000080)="b6", 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) syz_open_dev$ndb(&(0x7f00000001c0), 0x0, 0x440) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x100000000000000) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e21, @broadcast}}, 0x0, 0x0, 0x3a, 0x0, "a30b3b28af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000000000033035551502f07b4001a00"}, 0xd8) 3m54.008426302s ago: executing program 1 (id=2059): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000100)={&(0x7f0000000080)={0xa, 0x4e24, 0x8000000b, @loopback, 0x1}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000000c0)='\x00', 0x1}, {&(0x7f00000005c0)="827a34d10ca3dfd13b5c468b69ab8fd2cc5abfc0f2db1d71bfcffcd6e306d77820f6519741d0da262290e81e5449e4314de8049b15d5d4ccab02faec7f197e503e8c3396ae28e19ca7b9d7cfe6f55e6e61d4edb9f701d2a590ceb3ec102489e11b189be4fcb405a2de0bea896722f555940b7c41906897abe44601c80f47c442493bee2d41b725c8ca9fa92d30bafe2e48790b8d44fb2c07c50343af2691a60273fdb4586a81945a13585929309302d16ce79512cfc6d794cabe9350167f7b5a5f9507e59c35b8e0f59fc57e57c0f1d11e1ae34867758d8abb3ad41cf058b5ff74643867edfde8d3e740e53aaf3fb733777db87dbe5075045b3d3c6939a1959a6cee71fb2e5eaa2e520f1bfbd18609264e548dba6174e36dea47b2682f102cc69a53400d9ecf56eede1893b188ef971271eb2b427c1f3a1842782f734e092039da82b306d599498d162a4735d57020917e09a30e7abc79f2af330ea5579de8b96dfa1a2ac6754ea1b26a1e9d2d0200000078164b81937fec88d0d1621ac4e27895a01bac515c2f6981a201aaeb58b8036f37b8a67975551616496f3c1cef7c11172fd9734952a7ceccfd3246caa111acbacc64fe672bf40b5eac0c32254863465a"}], 0x1000000000000309}, 0x40043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 3m53.573074574s ago: executing program 1 (id=2062): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$pptp(0x18, 0x1, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x100, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, 0x0, {0xb, 0xe}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES8=r1, @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRESOCT=r1, @ANYBLOB="20081875b13d845a71060000000000000001015e24036a56eafe2fbfc66a6225e3aa34b72d2ed7e704307d25cd321773f0e59f5c03671a823fa81cf4ff4571e1513934cd0a8096e431c9bc7199552760421b350bf4d1a7ca10328b8934dd3cd70d331c2d4994833effdedd60e6afd7a1f78c94511d15dfcb91b710fe6d09aa63c0ee306038b1633dfde38646b7fa687e0a6d0d7b8e9388023ddc483ebc2a42509b77ca87a462a5d7dcbf40f4c6f76adf139fc52b"], 0x48}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="380100001000130628bd700000000000fe80cf00000000000000000000000029ac1e000100000000000000000000008a6c2709823d2f77000a00000039000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="64010102000000000000000000000000000004d232000000ac1e0101000000000000000000000000fcffffffffffffff00000000000000000b000000000000000500000000000000fcffffffffffffff00003a010000000001000000000000000c000000000000000000000000000000ff7f0000000000000000000000000000b8ad000000000000050000000000000001000000000000000000000002000400b00000000000000048000200636861636861323000"/240], 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x0) capget(&(0x7f0000000180), 0x0) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) copy_file_range(r3, 0x0, r3, 0x0, 0xb, 0x0) write$binfmt_elf64(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460e05030b0700000000000000030003000600000019010000000000080000000000000000bd010000000000002f9000000800380003000100040044fe05000070da6500000600000000000000090000000000000008000000000000000002000000000000687c000000000000001000000000000005000000ff0100000000000000000080060000000000000002000000000000000600000000000000ff7f000000000000080000000000000056e574642c0000000500000000000000ffffffffffffff7fdb00000000000000ffffff7f000000000a0000000000000008000000000000009e73e7b0d0c5b7322ccb8c4d7d633147a7505f0f7fc217430b622ff66ca6e0a75843396563286e9e7bf08792721c4d10faf61efb8cc3db1fbd8976128084288802df5149a0220ce2a7f4a205c560f84f1c4759ebdc732e73ab8b5fd4cf33f6d9dcd1751d08b7703d4122886120ec849efb08fc5de80aa4433f6af022ada4dba7f073188d98691303830d24dff86bcd75afa0668f23cd4f62c5e7e64a36ff8397be44ce9414940d7d39dde4f92eb66ba2b787021999a857013522ef658ab5a05a640cfc9fd9fd29de685fa62f357ab8ed46fc9d5473c87900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800"/1721], 0x6bf) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r4, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x0, "d32984bd1ca44c066af5160e961701a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000001200000000001900", 0x3c}, 0x60) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r5, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) r6 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xffffffffffffff8d, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000014c0)=@delchain={0x1404, 0x65, 0x100, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {0x0, 0xffe0}, {0x3, 0xa}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x9}}, @filter_kind_options=@f_bpf={{0x8}, {0x24, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x4}, @TCA_BPF_CLASSID={0x8, 0x3, {0x5, 0x4}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff1, 0xfff3}}]}}, @TCA_RATE={0x6, 0x5, {0x40, 0xd5}}, @filter_kind_options=@f_matchall={{0xd}, {0x150, 0x2, [@TCA_MATCHALL_ACT={0x10c, 0x2, [@m_tunnel_key={0x108, 0x1e, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @multicast1}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x0, 0x4, @private=0xa010102}]}, {0xa8, 0x6, "1655c7d8663b78ae4de3d2e9064661ca84630b75fe0e1cd892d78a376a316b6a3f952ba768a685fe07409ea051cf38e6358cdc7b258d744807d218a91356297b3fb0bfe26ced957f87a7e54079cbada3781d7ea966972c8556b4225f6e1137a384c54f5f4815a94490aaed33c88d755dfae90da0e0901fcdbe9f5a178203d6d582a9009c0e8b010374480f323ee7260d9fda69fc9b5790ad0e21f2656a0555b92ea6c1f2"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x5}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x8}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x8}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0xfff1}}]}}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_cgroup={{0xb}, {0x1228, 0x2, [@TCA_CGROUP_EMATCHES={0xe0, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0xc4, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{}, {0x8, 0x8, 0x3, 0x2, 0xc}}}, @TCF_EM_CONTAINER={0x84, 0x2, 0x0, 0x0, {{0x2, 0x0, 0x2}, "ff07d5b9050ebc033d3f7ca0f0cbeb41d83cc4e01846537d2c518a92ac1ef2f097b30c6929b6d34820ad137a2cbd8664bdc9fee80103fee2621c466f1a08063359244dc55151a815de759a0197e29a7de2461d417d3b7eef874a33162ae05955a36aeb812b51239e25d0a0612018cf55a4b1ff7e10"}}, @TCF_EM_META={0x24, 0x3, 0x0, 0x0, {{0x77c4, 0x4, 0x6}, [@TCA_EM_META_RVALUE={0x14, 0x3, [@TCF_META_TYPE_VAR="964bdb5434a633e49ca6", @TCF_META_TYPE_INT, @TCF_META_TYPE_VAR="8d51"]}, @TCA_EM_META_RVALUE={0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2e1}}]}, @TCA_CGROUP_ACT={0x124, 0x1, [@m_vlan={0x90, 0x7, 0x0, 0x0, {{0x9}, {0x5c, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xb4}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x1}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x8, 0x8, 0x1, 0x10, 0x8}, 0x1}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x67b}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0xffffffe1, 0x1, 0x7, 0x80000000}, 0x2}}]}, {0xa, 0x6, "4fae5e9edb2d"}, {0xc}, {0xc, 0x8, {0x4}}}}, @m_xt={0x90, 0x9, 0x0, 0x0, {{0x7}, {0x40, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}]}, {0x29, 0x6, "76dfe7e7f5d085e33bb7547f9d4f298da6bda05574e516d83ac22bb84fab7ae1d118504d17"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}, @TCA_CGROUP_POLICE={0x490, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0xfb}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xffffff50}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x7, 0x12c, 0x80000, 0x9, {0xa7, 0x0, 0x8001, 0x218d, 0x5, 0x6}, {0x5, 0x0, 0x9, 0x10, 0x49, 0x8}, 0x2, 0xfffffffe, 0x8}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0xb, 0x0, 0x8, 0xfffffffe, 0x1, 0x2f, 0x2f0, 0x400, 0x5, 0x1, 0x5, 0x4, 0x2, 0x1, 0x7f, 0x9, 0xa, 0x1a, 0x13a4, 0x9, 0x0, 0x64, 0x7, 0x1, 0xe76, 0x81, 0x8, 0x1ffc, 0xa4b, 0x5, 0x2d79e486, 0x3b43, 0x7f, 0x3956, 0x2, 0x800, 0x3, 0x10000, 0x7, 0x4000000, 0x1, 0x80000000, 0xffff, 0xe6be, 0x2, 0xfffff800, 0x8, 0xdc37c9b, 0x196, 0x6b9ca05f, 0x0, 0xcf, 0x7, 0xffffffff, 0x10001, 0x8001, 0xffffffff, 0x0, 0x1ff, 0x7385a8a3, 0x1, 0xa923, 0x0, 0x8, 0x50, 0x5, 0x7fff, 0x1, 0x67, 0x7, 0x7, 0x101, 0x1, 0xd, 0x400, 0x4, 0xb, 0x8, 0x2, 0x8001, 0xffffff7f, 0xffff, 0x80000, 0x6, 0x0, 0x5, 0x101, 0x5, 0x10, 0x6, 0x2, 0x1, 0x3, 0xd79e, 0x80, 0x1, 0x7, 0xe, 0x0, 0x5, 0x2, 0xe497, 0x2, 0x7, 0x7, 0x53, 0x8, 0x9, 0x3ff, 0xe, 0x6, 0xebc2, 0xfffff84a, 0x9, 0xc, 0x3, 0x3, 0x4, 0x3, 0x6, 0x5, 0x8001, 0x5, 0x0, 0x6, 0x3a, 0x7f, 0x7, 0x1, 0x1bc87f2d, 0x100, 0x80000a, 0x80000000, 0x5, 0x2, 0x1e, 0x0, 0x8006, 0xffffc239, 0x1, 0x0, 0x9, 0x5, 0x4, 0x2, 0x2, 0x7, 0xb4, 0x9, 0xfffffff8, 0x0, 0x7, 0x6, 0x5, 0x6, 0x827e, 0x1000, 0x2dba, 0x240000, 0x7fe, 0x1000, 0x80000000, 0x1, 0x3, 0x6, 0x4, 0x5, 0x9, 0x5, 0x3, 0x1510, 0x628d, 0x6, 0x8, 0x432, 0xf803, 0x7, 0x7, 0xc5, 0x386, 0x6, 0xffffffff, 0x0, 0x0, 0x8c1, 0xd, 0x25, 0x8000, 0x7, 0x0, 0x7, 0x3, 0x0, 0x8000, 0x5, 0x3, 0x2, 0x80000001, 0x609, 0x8d, 0x2, 0x200, 0x8, 0xc, 0x980000, 0x1d28, 0x6, 0x0, 0x1, 0x4, 0xb, 0x28e8, 0x100, 0xde0, 0x0, 0xba, 0x9, 0x8, 0x3, 0x0, 0x1, 0xffffffff, 0x1, 0x4, 0x8, 0x3, 0x9, 0x5, 0x5c5, 0x7e9143a8, 0x6, 0x4, 0x8001, 0xc750, 0x9, 0x0, 0x10001, 0x4, 0xcb, 0xa, 0x4, 0x0, 0x3, 0x86, 0x204, 0x5, 0xfff, 0x2, 0x5, 0x8, 0x800b, 0x1, 0xfffffff2, 0x7, 0xb3c3]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffffc, 0x2, 0xd71, 0x6, 0x0, {0x9, 0x1, 0x9, 0x7, 0x6, 0x1000}, {0x9, 0x0, 0xec0, 0x904, 0xfff, 0x6}, 0x5d3, 0xffff, 0x1}}]}, @TCA_CGROUP_EMATCHES={0x11c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x7c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x8000, 0x1, 0xff}, {0x495bb4a, 0x388, 0x45, 0x1, 0x4, 0x0, 0x2}}}, @TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0x1, 0x2, 0x9}, {0xf789, 0x1, 0x2, "d9"}}}, @TCF_EM_META={0x3c, 0x2, 0x0, 0x0, {{0x100, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x3, 0x5, 0x2}, {0x7, 0x2}}}, @TCA_EM_META_HDR={0xc, 0x1, {{0x9, 0xb0}, {0x100, 0x5}}}, @TCA_EM_META_HDR={0xc, 0x1, {{0x2, 0x81, 0x2}, {0x9, 0x8, 0x1}}}, @TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x0, 0x2}, {0xc, 0x4}}}]}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x2, 0x8, 0x1ff}, {0x3, 0x6, 0x4}}}]}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x4d12, 0x7, 0x2}, {{0x4}, {0x1, 0x1, 0x1}}}}]}, @TCA_EMATCH_TREE_HDR={0x0, 0x1, {0xc}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0xfff9, 0x3, 0x2}, {0xfffffffa, 0x10001, 0x470a, 0x5}}}, @TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x67b, 0x2, 0x10}, {0x3}}}]}, @TCA_EMATCH_TREE_LIST={0x4}]}, @TCA_CGROUP_ACT={0x86c, 0x1, [@m_skbmod={0x110, 0xf, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0xfffffffd, 0x7, 0x101, 0x38e}}}]}, {0xc0, 0x6, "7ecba17ec9f25e9f30caf6b92c1e147e28bffed510fd8c0b23d8e706f2fae5981ebcbc86a2a242a7bb54438eeed20e57639a1dfab7292835d2a829842be693d69255dec16128d229507203bb79ffc29e3c0ea5291abc372cf7babfe7b6d700d34f7e0ca34306c8157f03471a4daa555a638480f411a96c9e68ef53e7b157280720a1cfff9b814ee16eef098b84360040d1c8f88f0bb277e7d4570703910ee23b50c0c456d0d65d1cd711ee4a82d9074494da941d5db74c0000000000"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x4}}}}, @m_skbedit={0xd8, 0xb, 0x0, 0x0, {{0xc}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x4dd}]}, {0xa4, 0x6, "2119a8a9a89876191b612bbbf5d9413d087b0fcdd96f3bcdce9c151d97b305c343028319e9215f0ad41d25d94851abd1d8e12dd751b9ab029bd99fe3ef014afc3d20f4f330c141d722d64c2a68368afa4a7bb457a8302fde9af6114068a2f9383cc7ca17bc53ab37db49e560610aea15c08d0db876150e2612fece4fe881a46f26886e5fdcd9f7809b87933269e9f5dda6df2df5b4c365813197669dad907e36"}, {0xc}, {0x50, 0x8, {0x1, 0x3}}}}, @m_connmark={0x118, 0x2, 0x0, 0x0, {{0xd}, {0x90, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xa76d, 0x3, 0x20000000, 0xea5, 0x6180000}, 0x7}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0xffffffff, 0xffffffffffffffff, 0x4023, 0x6}, 0xfe13}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x1, 0x7fff, 0x8}, 0x1ff}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x9, 0x3, 0x2, 0x3}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0xffff8be7, 0x10000000, 0xff, 0x1}, 0x50}}]}, {0x5c, 0x6, "4f7bdfc6ce78a9430db5f877c229a4595ebe4007055e22662f5d91f407250483cffaea2ce1bb2040194d3e9d81dffc43c3072a45090f72c54a496d328f0ae1001f5a7586892fdb4b4ca76481cf213d6ff4094358cbb2029e"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_vlan={0xe4, 0x19, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0xfffffffa, 0x9, 0x10000000, 0x6}, 0x3ff}}]}, {0x94, 0x6, "7759f86dbdf7d065e283d69452820ae7f01f6350be5bd8a9101d0c2b6cefc47c4ce10cfe5a6ea45c9518ca456fd000d18243a6f4278af38d9fc2d13609d4a35ca3e75c5f46851a3b34d94ddb9f208626cd9972d11383e3f1a5f9c1bf66c44d52ef0149dc80f8b35ac5c77f0170803827a21b5bbf55175159b5e097b91cc40edac47ef041ebbbaaaaab771ca4cb6f0ed8"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_simple={0x110, 0x5, 0x0, 0x0, {{0xb}, {0x88, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0xffffffff, 0x7, 0x5, 0x2, 0x8}}, @TCA_DEF_DATA={0x9, 0x3, '&\\#}\x00'}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0xfffffe4e, 0x2, {0xcc6, 0x6, 0x10000000, 0x10001, 0x101}}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x10001, 0xffffffffeffffffe, 0x800, 0x5}}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_DATA={0xc, 0x3, 'skbedit\x00'}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0x0, 0x2, {0x2, 0xfb, 0x5, 0x2, 0xfffffffc}}]}, {0x5f, 0x6, "50aff2d40debf37a9d315fb5f78b91469663c93d5477b26910b57d145c125d1a0eefdab7cd3495805d568f0ed2a404bb6b7b4d8f41368043fb402826a29fd62da1f0c1f42e82dd5260ceb9e614dcfad530e3c514ceb2f435aae5ce"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_connmark={0x1a0, 0x11, 0x0, 0x0, {{0xd}, {0x74, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x1, 0x10000000, 0xfffff348}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xe, 0x7, 0xffffffffffffffff, 0x3, 0x8}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0xfffffffa, 0x0, 0x9, 0x6}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x6, 0x5, 0x8b, 0x7}, 0x7fff}}]}, {0x100, 0x6, "6b64d8ac8a0b369a650b5cfec9d51cf69740a2365673b9eaacbcd5d7555c8212a8a8573301b4d858359d2a870a205ca82d387636fe0b039097a8ab664e4a11e1cb03cca04e7fd3fd58c8589e982534f15fe95f14edbcb14e15ff48ea2dbde5e9f503f062d2df26a63055d844d5d7cb3a7caf02e5a39a4687093934f544afd24bbf4c1a93a74872e4ab0b26f14d548d5e09011ed1863e46118af8b924cd16243a7fd6f314b09bd941abaac92e2107ec80d2cc8b78ebfbb21a5a7e94fc15f5c2acd536ca28404ba76f3175194eaf3c03af411239f9a52c3a0976214bbc1a5d294d651fdabff5d700c33162b65ba20bb22518313f43662ccdd5f01abbd2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}, @m_vlan={0x188, 0x1c, 0x0, 0x0, {{0x9}, {0xb8, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0x6, 0x1, 0x8, 0xff}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x67a}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x3}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x6f1, 0x1, 0xffffffffffffffff, 0x40, 0x2}, 0x1}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x92bc, 0x1, 0xffffffffffffffff, 0x9, 0x4}, 0x1}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x0, 0x4, 0x4d4}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0xa, 0x1, 0xd2}, 0x3}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}]}, {0xa5, 0x6, "edc7c2fff38e67adf7d619fcbf179c3462688d55831d5438672885dbf4480d73c4c0c0ad1a0e064d4be0687b9308e82be83e7a1d8c59b5d813da9925212639f2555e9c8366832f8ee7ab1ac72928385f51640a11cab18fb23fa8172f3c63dc16b6aecea6501c1e002c10ad67518becb08e3c6eb8db53236ee1844ee358228a5ac5f4ad7c03ba8af1b879ccb8bca84cd3e537ea3d9840486b5511ad01e028dfb2ee"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_tunnel_key={0x4c, 0x1a, 0x0, 0x0, {{0xf}, {0x18, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}]}, {0x7, 0x6, "144c67"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_CGROUP_EMATCHES={0x208, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1ec, 0x2, 0x0, 0x1, [@TCF_EM_META={0xc, 0x2, 0x0, 0x0, {{0x5, 0x4, 0x9}}}, @TCF_EM_NBYTE={0x1c, 0x2, 0x0, 0x0, {{0x8}, {0x2, 0xa, 0x2, "38e62e7ff3d90a433320"}}}, @TCF_EM_NBYTE={0x14, 0x1, 0x0, 0x0, {{0x8001}, {0x6, 0x1, 0x2, ','}}}, @TCF_EM_IPSET={0x10, 0x1, 0x0, 0x0, {{0x4, 0x8, 0x1}, {0x1, 0x0, 0x1}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xffff, 0x1, 0x6}, {0x3ff, 0x8, 0x7f, 0x2, 0x0, 0x2, 0x1}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xfff, 0x1, 0xd26c}, {0xfffffffb, 0x6, 0x800, 0x0, 0x2, 0x2}}}, @TCF_EM_IPT={0x154, 0x3, 0x0, 0x0, {{0x401, 0x9, 0x8}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_DATA={0xfd, 0x5, "52284ecb4b44e6ee6c677e1aa4bf189b0bf8e8ee4566508363e25b665fc750759131a70058bc18f866c8663761a570f7c9f8ac59ed596db0cd4fce13ecd99ee1d4f3c7301504c51408c2727f5630cde3ad693c5e4a60b750cfc00ab16d674100fff6c37dbef43418d73ec99550a14655899b3ffff7b527c0ef2a7aa3104fdce8f731d6523c83fea77e23fdff549d7701125b8ad1b763baaacaa61ee929bf558d8041f0e05d92f04adc5322b3aa9cedfd37e7f955fb929208a9807f82045f0692248faa8af5d95e505529ede7fad2bf2f980c72f12dd0926d4a455050aa1bc1eeb2b3b63cd543a2b7128af9ca6aaae6643ea654e030de3e6632"}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}, @TCA_EM_IPT_NFPROTO={0x5}, @TCA_EM_IPT_HOOK={0xffffffffffffffba, 0x1, 0x2}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x2}]}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x2, 0x1, 0x7}, {0x3, 0x4, 0x5, 0x6, 0xf, 0x1, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}, @TCA_CHAIN={0x8, 0xb, 0x10001}]}, 0x1404}}, 0x8900) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) connect$pptp(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400010bce) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 3m51.624687209s ago: executing program 1 (id=2070): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000040)={'bridge0\x00', @random="1c00000000ff"}) 3m51.055368171s ago: executing program 1 (id=2075): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) r7 = socket$alg(0x26, 0x5, 0x0) r8 = openat$zero(0xffffffffffffff9c, 0x0, 0x4200, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r8) sendto(r7, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100", @ANYRES16=r3], 0x7c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000040) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x108, 0x9, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0x67}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x2}, @IPSET_ATTR_ADT={0x8c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x1}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x9}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x4}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private2}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x4}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x6}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}}]}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2d}, @IPSET_ATTR_LINENO={0x8}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x108}, 0x1, 0x0, 0x0, 0x8844}, 0x4004000) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000010400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300002c0000000e0a010200000000000000000a0000000900010073797a31000000000900020073797a31"], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x118, 0x2e, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x105, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0xa, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) 3m48.685849139s ago: executing program 1 (id=2079): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x3032}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000000abc0)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xac9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x24041050) socket$nl_generic(0x10, 0x3, 0x10) fchown(0xffffffffffffffff, 0x0, 0xee01) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000380)) read$FUSE(0xffffffffffffffff, &(0x7f0000001fc0)={0x2020}, 0x2020) 3m33.270251256s ago: executing program 33 (id=2079): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x3032}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000000abc0)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xac9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x24041050) socket$nl_generic(0x10, 0x3, 0x10) fchown(0xffffffffffffffff, 0x0, 0xee01) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000380)) read$FUSE(0xffffffffffffffff, &(0x7f0000001fc0)={0x2020}, 0x2020) 8.015129795s ago: executing program 5 (id=2736): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000300)=0x49) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000005c0)=0x7e) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a1000"/196], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) ioctl$HIDIOCGRDESCSIZE(r2, 0x4004480d, &(0x7f0000000100)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="da114ca9345a4494ecd2181082060b6ceeccb4ed315b52ddc31ae5d66cfbd6696350e8ccc260583dc7120da0ad83734e591dcc90b88ecf1707a4d65fe89603d24ecbb06d064af8803d20fa2e7c7df78cc2aa4adea47555e5743acee5644eb81d2470784aca495c14545ef91cd8134ce61eb8d33414635fd61987118a8489b953fed5f2889db6e6f702a6ec77daece77f8614d89b3d6cb15d4f0809fd518587", @ANYRES16=r0, @ANYRESOCT=0x0, @ANYRESDEC=r0, @ANYRES8=r2, @ANYRES16=r1, @ANYRESOCT=r3, @ANYRES16=r0], 0x48) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x5, @loopback, 0xfffff6bd}}, 0x0, 0x0, 0x22, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e23602a3c364ca41d6e5615445244740bd4c0b42a21d7214bf92594925208a0e2f964e654dc534a6324d4993fcf19b2df3ee818a118a7c49462189316d556d2ccd"}, 0xd8) sendto$inet6(r5, &(0x7f00000000c0)="e9", 0x1, 0x20008045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @remote}, 0x1c) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="020000000400000008000000010000008000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000600000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r8 = socket(0x1d, 0x2, 0x6) getsockopt$nfc_llcp(r8, 0x6a, 0x2, 0x0, 0xffffffffffffff33) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="0000000000140000181100", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe00000000b609000000000000dbaaf0ff50000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff570000000800000018220000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000004d9800000000000056080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='contention_end\x00'}, 0x10) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) dup(r9) 7.43749169s ago: executing program 6 (id=2740): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000000ac0)) syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303}, "3f69f5593d99b5b9", "ad19b9f81b7051508702a27013f65558c8a01f2ae65a25a4c4580daf90219442", "d78279e4", "ba02af61de6197b6"}, 0x38) r1 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0x356b, 0x800, 0x1, 0x40000334}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000500)={0x9, [[0x3, 0x101, 0x8, 0x5, 0x4c, 0x3, 0x4, 0x4], [0xa, 0x81, 0xffffffff, 0x2, 0x6, 0xffffff80, 0x5, 0x1], [0x1, 0x5, 0x8517, 0x7, 0x7, 0x10001, 0xb, 0xb]], '\x00', [{0x3, 0xc, 0x1, 0x1, 0x1}, {0x5776d45a, 0x40, 0x1, 0x1, 0x1}, {0x10001, 0x0, 0x1, 0x1}, {0xfffffff7, 0x6, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x8, 0x0, 0x0, 0x0, 0x1}, {0xa, 0x7, 0x0, 0x1, 0x0, 0x1}, {0x5, 0x4, 0x1, 0x0, 0x1, 0x1}, {0x2, 0x3, 0x0, 0x1, 0x1}, {0x5, 0x5, 0x1, 0x0, 0x1, 0x1}, {0x7ff, 0x3, 0x0, 0x0, 0x1, 0x1}, {0x7, 0x9, 0x0, 0x1, 0x1, 0x1}, {0xc, 0xfffffff8, 0x0, 0x0, 0x1, 0x1}], '\x00', 0x80000001}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="010000000600000008000000080000004047fd1f", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000004000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f000001b700)=""/102392, 0x18ff8) 6.707396876s ago: executing program 3 (id=2741): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c2", 0x17) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) 6.586600607s ago: executing program 6 (id=2742): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240088c1}, 0x0) 6.561991612s ago: executing program 3 (id=2743): pipe2(&(0x7f0000001cc0), 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f00000001c0)='GPL\x00'}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r1, 0x24, 0x0, 0xffff69b9, &(0x7f0000000740)=[0x0, 0x0, 0x0], 0x3, 0x0, 0x0, 0x0, 0x0}, 0x40) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x20) mkdir(&(0x7f0000000000)='./bus\x00', 0x1) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x21) fanotify_init(0x200, 0x0) r2 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) 6.246025284s ago: executing program 6 (id=2744): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x7fffffffffffffff) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000009180)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000000c0)="64ee711f1bee8e4599dad8399180", 0xe}, {&(0x7f0000000100)="68e8f799b8a2eb6aafe5e8c510162323a4fce7c97365f48c36046d89607ea0efa491d9033cd438299b41ae0832882dbf6803", 0x32}, {&(0x7f0000000500)="eb7caaa89fd4ea76b2096e8df899a95d079196a9665fc2ff801cf1d5fa4b1558dba2baccf606971ddd816ab6d92bda312611e73ba340fafdc700ca1ed897b80fb8aac77505f4abf524e4867550ced756a2bba168694da50d0e8875814f490d0f5f9e292d91dc2fa94b9b42d2fc8d19f4cbfa44b66042b7be60cd8afbebca1eabf86fbe0372391a2eecb1c8c9937f157a70758d2c79041a1a5b98a81eba0046f15246277f0c53931a1cfd9e706d53e85990cf1d301b83c86d5e80ff1b41dd5efcd0eddadfaf21ad99d7edfc94f760693da1", 0xd1}, {&(0x7f0000000280)="b2a84c1b6da4b0b6e24e75e29cf7437a6e05583825f78147a6f9bc26f279d28f2bb209651c2d93dfebbe00e8b8b08fa55c4d6c7099c35fcf", 0x38}, {&(0x7f0000000300)="dbdc8fd7bdba43e8ea09fdcb0d2e1085ec3d08d9e83bbe9c47c1a9", 0x1b}, {&(0x7f0000000600)="83f4acf36812db88b27e578c3718438e916fc8f95f08ef6d6de6a098ee2f1617139b81b8c042384320f33d0cb77b05d57d43f9363e919f55648b1a199a57c870a3a4564e24db80db2ca5958ef99b0801cb76edcd8e73513f750832ef6eeeedcce0c80aabd34db0478e1b5dcfba829bc33b89bf7a48161e962bc799a0a594c03daabaee9be91f6806a7d98c4e2a67f62bd6254b00b5121c9cfb0df4cee8fa6fd5b20071037e339426ed7ee2fd4b206d92d972833381c7cbb3cab180155d9dbda0e6a263566a6582614da7a02dd39f0103429097dc5e29e42c9b048ed7f8878ae77b5a520960645d9546ab567efeb1d1eee68ca920", 0xf4}, {&(0x7f0000000400)="f64cc4930d3b65b405c8c927d8a8b8bfd100cfb36be54e18bfbdf65aa07f9f16481212fcf87cdba91d92de440123fa4a9d76a06fcd5756320b36e586fe6368e20c2e97a5477b44749e7fdb4b8bcde7f7fe18640c370b70511486fb80f909f0d28672498316f9b07534dc923972d033ba8cc68584ef80b4734853a5f2744042552fd26a9b912c7b1cb1806b3b38d6211526e4094aba1a8cc416b0453650242790fc638445caf045446b", 0xa9}, {&(0x7f0000000700)="b96dc259e4e53af45df8e0c181a6cd411b6a93c514b3eca753e2f9c1ad40cfcee40c18bd7b57bde6d7f5a97dea71d5f567c39ecc440d55eb9c2066fa8f4467f509630fd613c86746772b40e340147e42e083437b", 0x54}, {&(0x7f0000000380)="57242d7b95ae1d5842683138bef248027aaa651e1b2227c52a38f4aaed2cf5117be4e9d3730fcac951772f2a8b5bc7671d", 0x31}], 0x9, &(0x7f00000019c0)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r3, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32=r0, @ANYBLOB="180080770e410e691e6dbfffffffff00", @ANYRES32=r0, @ANYRES32=r3], 0x98, 0x20040014}}, {{&(0x7f0000002000)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000006680)=[{&(0x7f00000021c0)="f48a92e3b85d2bd728adf9cb20000f7918986f3cdfbd057d33486db370abafc47898aa9956493333fbd2143646d070194d9eacf8a3159f744bfed3ea6a0bc0957b402bd14b751ca9eb780784a1b4334fc8522ffac86d58439c072e7ef0a8a5870df73592ef5b644de6251686a9316e9b48db0fdb3856761a8b3073b7afc5ddfb420e208fac200f7b65f3fca65ad89756", 0x90}, {&(0x7f0000006380)="5885d3e44948125ef1c98f78eeb7d1ba0406c0ce86caf7cb688a3064d547da5a75ce4a2c1c55286fd2e32664ebc67999dc47c1c8d55fc6ecc4045b1599ab82be112bdd605f23941715a0d6ac3ab81161e7f7339bb79107c44702838c0003c0413b3687ea503861836397c14a6290f544a6d2cab290b7411f968a99cd35d1fcffd7464d0e86ef517b6f8e52d82f2bb1cbcd5ba250fce038710e85254fa734e87188083605c82a61df084220a4f92aaa5146d305b34fe94add819aa95892581baa7d38cc9951d941c97f140b9a0a892f2ea7e28dbf7989573a13a1992a3618ecd0395da9863c9c44bf9506d825c4797bf6d0eebb71a6ed3a02cc4d5b", 0xfb}, {&(0x7f0000006480)="a7321e9f55d1c8cf52fe4e6a1e3b4dad81a68fb1f9febd45992e7780749c44340e874ab83fb226b6e0b9d5859e277603ec063fecb09b1cc34740fcd7e7faa01d2d39ce94940cfac9ac774234a08f0e49efca83bd861f273c0783f8730e8ee4c4c5a78836b9666cf9e73aa50ee9b8f4253279e5ee817319fa55f22ab1c9b6f9f921b3433d72aecf39c0cc58bfe478426bb1b8efd2e3223547fcdf1689e9a8ad64f85337", 0xa3}, {&(0x7f0000006540)}, {&(0x7f0000006580)="cb6d8e62095d427f893a", 0xa}, {&(0x7f00000065c0)="131c24a4445d7ceb4a908b36d75486dad5c114a30508e6394d1ceaff62db63a3c1ffd20dea7f2484b2a3f96c0d65e70af2c1f70babbf505ea3cfc285278391dc810fb17b066676f1736326749ae68d2fbca5c1256cd70ef16aabcf787e93bbfebc40d6d6a0029e6e049fdd7b6ffd093c9ac574171f2025fcaa3b69a076a61d8c984ccd676207f3396f5113c83f9563", 0x8f}], 0x6, &(0x7f0000006740)=ANY=[@ANYBLOB='\x00'/16, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0xc0}}, {{&(0x7f0000006800)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000006a00)=[{&(0x7f0000006880)="0dd8fe0a55ebac9da8f734ce855efcbd82c5f2ff87b9b84b5b14960ca3fe1f2c5a29dd0c626d3a2db8b3eb48", 0x2c}, {&(0x7f00000068c0)="0709b8614f024c4bb02087e5e15c5c3bc06cdfc3ec14bef15619a4d2b5d4f849555f1500681279c1243031533dc982ecfb2cf5111c9ad463fce9c2ecd5bf94f7ca38610f826600be4cb6d3abac62928f120011ba0d67b97244e3c7138fad806aed5a7f4d4d57848e7c1ae826664e1604d0197794f4ec61b6a80f883f9768a94135f2f11d67ca3805bda1d89df3196f7b50d55052e3386a12181987bc030c9429d31f318ff191cc85e505b8a8b8a5d88ecc6967f5f69f94f3da6c3a11157b3934ed9b772b8734173a125500a7548cc1ce79709e2eaa884ba64f7ebd3386b82914eeee0caa0bf4d50f31504cf0a0dcea4507af43bdfeab460917ef2a", 0xfb}, {&(0x7f00000069c0)="268ffcae6ada5812c8e42ca01bd95fe2ca442bc4af7986bcda5a3c1acc575e60f0173a7dadb59a8d175c5f5ab8824e25d20286", 0x33}], 0x3, &(0x7f0000006a40)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000020050000000100000001000004000000", @ANYRES32=r4, @ANYRES32, @ANYRES32=r3, @ANYRES32], 0x38, 0x20000010}}, {{&(0x7f0000006a80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000006d80)=[{&(0x7f0000006b00)="94194699de708bc1d166f013971b43007d3be4b9c1d475a8de09e7df98c4e0fe345b453e1b4eba3a146c9ced1e75c35e6b75d7b4ed3f913ddeb17fe7dac76c19e991a1717f02a945c47e880310860c7924ae48c3", 0x54}, {&(0x7f0000006b80)="e78bbdccd43d122bb51016b3c33abf198e95d5d95d2ec7e50b877ed9d82821c15ac8d9f5cc6813ff800087eda7312d62e1b4bab6688ca02af2da76c28f7c5501a97b6c23aa91afea03915994163ad35349bed046a78164", 0x57}, {&(0x7f0000006c00)="32bc46d10bfb85a122a40faa1d25127cb70b8539b404578e8707ac218f844ce32411d1407efad264783ef2d39bfaa2728426e7b9ce80505783b96b0f5d007a52d49b5bbed7d52a6f476dc4ce12a37e47dbeccbd2d89e0e68a6e054285a824f55fd2cbf5b03a0bd150e3073009347391299d6b91cbebe3895b3c97bd763fc420eb7c146fd67058de5c1ce2f7c3075d51879dd9126312258506d5eff51c722eb6637e826fffb1d926c2bcc9e07e0a0840e189ba97a38bfdf272326761673041cd378e0ebc9f860f22b89ee", 0xca}, {&(0x7f0000006d00)="9d355d6bb744eb413b4916cce68af53b333110f218b92d16331b8a6d608ff6590a91e8d115568357c23cbb90e75cde7f4b612f198dab504d2954f0135c0775fbd4bf7275bb07ec218ab8b927dacd24990b31bd87abe1946a0550472f63f2f2293fc709e1d058db576e25aa81ac6482cf49647dca97eecbe66f9c29b76683", 0x7e}], 0x4, 0x0, 0x0, 0x20000840}}, {{0x0, 0x0, &(0x7f0000009140)=[{&(0x7f0000008ec0)="5034e168032731325790b6cbb356af4aa7d86e855f5e19d10c5809c29f137a27bffc8b187881b92afa0d4ac81f739a5481da1d29e9fb9ff16a9e4e541f661cb464ad2659601690c71465ac4c63228b1cb705add1c7968bbceef85c3f63ba4be11dbff2d25d7ef0e19ee80f02bf3bf671397819b7fc3a8432755ec8770dbd9ddd09ab3520a5847c7e19fa95b3c0526155", 0x90}, {&(0x7f0000008f80)="6397bcd65cf8991370701503d22e403195a506da3f4dfa8865246f09345c78e2dcc86b6adbbf29ca708bcf5a075c3e4c4ee329ae7b5392aff343e1231a0bb8aa2fdd0ff74bba0bfe97f0931c1c193dcb714daddd01e991cd2b3e136dd3dbbe12e1d1c21f2f2d6d705ee8e8d07fece2b1206282b18093c425dc527a011b0c073f67a2b82c88c1de9863ed42dafb2eccea3fc5de58ec368596fb953b0e1c99432272d2460209827dc7b5d87c7414a7567579", 0xb1}, {&(0x7f0000009040)="ca60b10c132332099bfb3f9af12b38b59e2fbb460075bea4da71b4326c2cca3748d1fd29d040f60184f3b696abee1b3c287651b28bda22373880f0395fb5633f1218372cf7f33e3373f68289c747d7a6d5cf8659950487744dbb54abd76392d968c82366b27851b587e047dbda10dec6ba677021fe7b97732607d458cea6c0cb5c074818134a0a6d9065c7f5903a2564f8921f7839e87f14552afed1645cf34212d6276c8d8d499dad05eb5322f4a57019bd79782a0abd5fce02f44bbe321eec732041ca77d3e4bd90f2629db90d830c6a", 0xd1}], 0x3, 0x0, 0x0, 0x20000800}}], 0x5, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r7, 0x0, 0x0}, 0x10) ioctl$TIOCSETD(r5, 0x5423, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r8, &(0x7f0000000040), 0xc) r9 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r9, &(0x7f00000001c0)=ANY=[@ANYBLOB="03010000b5"], 0xc8) writev(r8, &(0x7f0000000180)=[{&(0x7f0000002680)="1e", 0xfdef}], 0x1) ioctl$TIOCSTI(r5, 0x5412, &(0x7f00000004c0)=0xff) ioctl$SNDRV_PCM_IOCTL_LINK(0xffffffffffffffff, 0x40044160, 0x0) socket$kcm(0x29, 0x7, 0x0) r10 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r10, 0x40000000af01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r10, 0x4008af30, &(0x7f00000003c0)={0x1}) ioctl$BTRFS_IOC_START_SYNC(r10, 0x80089418, &(0x7f0000000340)) 5.715451973s ago: executing program 6 (id=2746): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xfd01000000000000, 0x31, 0xffffffffffffffff, 0x0) 5.574873997s ago: executing program 4 (id=2747): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20000000) bind$netlink(0xffffffffffffffff, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04070620"], 0x7) syz_usb_connect(0x5, 0x2d, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x5b0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1000) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x8, &(0x7f0000000080)=[{0xd8a8, 0x8, 0xfa, 0x5}, {0x7, 0x2, 0xff, 0x8}, {0x0, 0x9, 0x4, 0x5577}, {0x400, 0xff, 0x10, 0x31}, {0x6, 0x1, 0xf, 0x3}, {0x7f, 0x9, 0x2, 0x9}, {0x3, 0x28, 0x3, 0x2}, {0x8000, 0x0, 0xb0, 0x9}]}) tkill(0x0, 0x4) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x4000000009, &(0x7f0000000380)=0x102) 5.518324096s ago: executing program 3 (id=2748): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000080)={0x50, 0x1, 0x0, "d02067046edd9a2ad5b4f84e565c6f0f30807278f8983c3c0a31965ebd9ca8ac"}) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e25, 0xb, @empty, 0x2}, 0x1c) socket$rxrpc(0x21, 0x2, 0xa) r2 = socket$rxrpc(0x21, 0x2, 0xa) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x0, 0x218, 0x70bd2a, 0x25dfdbfd}, 0x14}}, 0x4004) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() process_vm_writev(r4, &(0x7f0000000800)=[{&(0x7f0000000380)=""/162, 0xa2}, {&(0x7f0000000440)=""/234, 0xea}, {&(0x7f0000001b80)=""/4096, 0x1000}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f0000000600)=""/94, 0x5e}, {&(0x7f0000000680)=""/93, 0x5d}, {&(0x7f0000002b80)=""/4096, 0x1000}, {0x0}], 0x8, &(0x7f0000000ac0)=[{&(0x7f00000008c0)=""/165, 0xa5}, {&(0x7f0000000700)=""/102, 0x66}, {0x0}, {&(0x7f0000003b80)=""/4096, 0x1000}], 0x4, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0xffffffff, 0x0, 0x0, 0x4, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x0, 0x3}}) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000040)=0x1, 0x4) socket$xdp(0x2c, 0x3, 0x0) syz_io_uring_setup(0x1e7f, &(0x7f0000000540)={0x0, 0xac24, 0x10000, 0x1, 0xc}, &(0x7f0000000080), &(0x7f0000000000)) 5.394211119s ago: executing program 0 (id=2749): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x101) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x81) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000340)="d88b9593204eeb7d", 0x8}], 0x1) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0xfffffff2, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x6], 0x0, 0x0, 0x1}}, 0x40) 5.271259141s ago: executing program 5 (id=2750): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f0000000280)=0x5, 0x4) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, 0x0, &(0x7f00000014c0)) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16, @ANYBLOB="010027bd7000fc06df25140000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000200000008000b00400000000600110006000000080015000c000000"], 0x54}, 0x1, 0x0, 0x0, 0xc0}, 0x8000004) setuid(0xee01) 5.265078246s ago: executing program 0 (id=2751): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x12, 0x1, 0x41b}}}, 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r3 = add_key$keyring(&(0x7f0000000240), 0x0, 0x0, 0x0, 0xffffffffffffffff) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) close_range(r1, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x4, 0x5}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="97e92b6a00000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r5, {0xffffffffffffffff}}, './file0\x00'}) keyctl$get_persistent(0x16, r8, r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x18, 0x10, &(0x7f0000000400)=ANY=[@ANYRESHEX=0x0], &(0x7f0000000980)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffe6a) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f00000000c0)=r11, 0x4) sendmsg$unix(r10, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) r12 = socket$netlink(0x10, 0x3, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xc8, 0x1170, 0x1170, 0x0, 0x1170, 0x200, 0x1398, 0x1398, 0x200, 0x1398, 0x3, 0x0, {[{{@ipv6={@mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffffff, 0xff000000], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_vlan\x00', 'veth0_vlan\x00', {}, {}, 0x2e}, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xd0, 0x138, 0x0, {}, [@common=@eui64={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x2, 0x9, 0xf, 0xd18, 'syz0\x00', 'syz1\x00', {0x9}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r13, @ANYRES32=r14, @ANYBLOB="0c0000060005000100"/21], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) 4.630802461s ago: executing program 6 (id=2752): getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) prlimit64(0x0, 0xe, &(0x7f0000000300)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r5) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r7, 0x421, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x1f, 0x0, 0xc35d4f6d52288271}, 0x200048c4) 4.503398224s ago: executing program 0 (id=2753): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, 0x0, 0x0, 0x40800) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) 4.422552552s ago: executing program 5 (id=2754): syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x3c, 0xa1, 0x2a, 0x10, 0x102c, 0x6151, 0x44e6, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x70, 0xcc, 0x4e}}]}}]}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000100000000000000e3ffffff"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x10000008, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7fe}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f0000000400000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x4, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xfffffff7}, 0x20000000) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000dfff75390000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='io_uring_register\x00', r5}, 0x10) r6 = io_uring_setup(0x2edd, &(0x7f0000000100)={0x0, 0xdbcb, 0x800, 0x0, 0x64}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) io_uring_register$IORING_REGISTER_PBUF_RING(r6, 0x16, &(0x7f00000000c0)={0x0, 0x0, 0x1}, 0x1) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002800)=ANY=[@ANYBLOB="202700002c0007012bbd7000ffdbdf25047c0000280301802103dd802001e98008004600", @ANYRES32, @ANYBLOB="1401ba80040079800400c180d15806e759d3c3f646a8da9670688629e2bb6399b4987b58df9f74930c23deafc677fe2aa5a6b67e2adacde02ec5b5e461115f3288ae4ac28cca1c9b2996f76f1025c2a5d1a26a1ad57dfcd4650286dbf5cf7b1105042b41f72d0391157514cc9b360f3395a70ee8ed5ed190270e6c43fbc6e61fd0f65211d97c51d9496ee0d36d8ee881dd0b7c0a8319efa114f4085cd077236b3c8b1a9a5c8cb8b81a2984840f741c8816af01ea4ad03cef18e000876b332532067bca3d3c35e47b1c1b5e1c94a8731be24dbe10f3bf3cfa49b3bf76968c4cb32cc6e7af47607f9a6157e020011d9b4fd8eca028c3cb7f4d19ec78496ca01c46768c7619f9dd5d9f0c006f000400000000000000ae014180d06869f78652a94a6f6ffdbb17a5dd1b1557160bd4f80a77e454fcebc11ec2bb2b24b0a040795a213fd5528fe94f25b0714ce43829fec955021fde36b00ca70cbeb1fcbf8ebebfe9c862bbc070fe60e5aa4444ea00e5aee6c4167c7d0ce9bf2d0f8291e2875b7950372bab9c393b6ebf929dbe58b9fa8827e1113a228f7d71fb2cc418cf57f63ff3e7c97e981a7d1df5f9c232ac4848e9b9e63446b12f8b7b18c3d4f3fd2d3160e2f13b49f430fc32ea670196532a8f3e67d9899631ce431d9ef051c706ec1d66b8bfb2e9d04ec18308b4cc9c9d901935b3397b8612a6d9888e83baf346998bd00e5ce3234d5ae3ed182c4f696d4e1aa29863737f50042f5041e45ecc4b59d6043380fb234434c50036c390590f0c67e1c129eac0898d489de7995faee3d2c5ebf3290e7b98dcac4e5eead30d9dcee3189b1e13e43d1b694949b6912fe52329c61625de8aa3177545dbdf7af158748143ba9a60e4926c0888f40a61ff0f548c7a94a658dacaedf2c466f3f4e68e02fe81ee376755d69756890cce7d7ca059c94b2b10a08b52d6feb29f0e9ed20845f7120a75c51e0e336a0d8fcee20800b000", @ANYRES32, @ANYBLOB="0000227082d57c5848d403e212111b7355941a4abee53192f9ad0ca4033342783801144c6ba1ea7845071729e825b33f1a20fe09b8762b86d910fab7e0264c14550e4b91c89f69764109add4c2854f000000e42303800c00018008"], 0x2720}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r7 = socket$tipc(0x1e, 0x2, 0x0) pwritev(r7, &(0x7f0000000480)=[{&(0x7f0000000080)="2ae2c0497f966f2f564e16c14f726997d862dbce0cf76e35908a0406ee8446ffaa0e2a5a0091efd11afee165b5a052bfb610000c6773c3fdcf8b5ac4501a045481a9cacd43c15f9c79b8c0007f6322b9a3d64d0675cdd24e21369aee9568aa40335e4de887c946258cd9e732c5c686a745541746b1f38e1190bfe39d1caf7fa32b857797404ae81bb0e249431a902a3e83042098ecc1128e31f8030157e06c554eae8f83de39348d59c59503797d397b235be70f5b37ee3d5b5a0bf8515dd977f99cf89c71ed9866a21e83423c187406fb598fb760028ce61705b8f29c16daa9e85bf0e2ad09be5a26cae0039ef6d9", 0xef}, {&(0x7f0000000180)="4be54a14722acf5b6a38c8fb3e4eaecdaa1bbbed2b1c16383f4adc631ec7648617f4d3e645f854f135cae0e27514d497e1d6bfe003b8c3a8d127193d2d2535a0e886dd1c", 0x44}, {&(0x7f0000000200)="e16045590b96e3cb3aa8edab5b63cdd3a1fd2cff0100002743863cc1c3eace3bdc541dc5eb076cd022d9ea7ebb329b9619f0438a0b8fceccae20215901040000000000006890044e1798683609ce3909f218b9fe102cac493a88ddd74e9b8cd7f731ccb2a57008bc61b976c1ef7d808cb84d17dd0800bd7d125aa93b7df18fe1", 0x80}, {&(0x7f00000002c0)="19b041e848e886d2df15031f8eb2f0ef7a3a912fe793698ce9910a650bacae297b37512e4ebe331c61ed2b9a2e45757ec9ce4bdec4f433c9924d995408def3c44b1203db3d042553e01ee647bc7f89b8b235e3b2806ce06b45c08409e755f91c0ccb591de02c5432709128d3e326de7abe63db98da94901b8f3c412b4d5c61eccab045eb54577d73c3b99d3842e5735ea8e529", 0x93}, {&(0x7f0000000580)="0637dd0e6b9edc00782700400aa4042df1531e5817863c023eab266067853bec91898bf46821f31f59f04a40188fb0a2a8d042463a4dcf446360b4b5fdc24b7c8fd4e02221a83cf472fb2787673afafc218795cd6dffd4fe686ff88a14af23533e32923e4da95bc202d17207c5d4677587569d772cbd5603794129a2054a1edf748b635ffbac9df3c28c074a8f8d4ed2e2df09c20f0a936b60ed1a19028934f418f88af5c5e77c4d79a5b36121327211d185f34ead054bad69911089ef6f9cf99d6646411b68c6caa99a06fd68786185df84ecf5e8b1eab58b96da80", 0xdc}, {&(0x7f0000000680)="8bc2a829b9993e029adfa702e0da5e2aa84bb2767d73b4ca1cfd332f82efffc1903c4b445e3b18da39138bb31b7b4db5c11e3b5e0a659924ef6009cb77136b12fdb988d3b9fa5cebd9ac524376b6ccf067ec130c4a76564e07aa63d238be54215926166ead827ecc789adea72c7c8f2e2ba6759d4eed6c7708bd1777a7a0c7c6a6d0582200ca9034913b77d059deb7454ff5e5680527310aed17aee180a543f8e7b6d54dd3dbc9a7dcf16035b6e801196e4b731a5dc8fb1f6870844b58e65439447cb16eb33d1fe1553a78b69198bde88dfdb3293a31e04cba9fc44eefb22cc50d344687cd24bb84", 0xe8}], 0x6, 0x4, 0xffffffff) 4.407348033s ago: executing program 4 (id=2755): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x448803, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000100), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000080)={0x2, 0x6}, 0x2) 3.939077763s ago: executing program 0 (id=2756): syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000000ac0)) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') name_to_handle_at(r0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="1c000000811e0000050000000000000000100000000000000c0000000000009457969fcf"], &(0x7f0000001500), 0x200) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r2 = fcntl$dupfd(r1, 0x0, r1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4000080}, 0x24004080) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303}, "3f69f5593d99b5b9", "ad19b9f81b7051508702a27013f65558c8a01f2ae65a25a4c4580daf90219442", "d78279e4", "ba02af61de6197b6"}, 0x38) r3 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0x356b, 0x800, 0x1, 0x40000334}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000500)={0x9, [[0x3, 0x101, 0x8, 0x5, 0x4c, 0x3, 0x4, 0x4], [0xa, 0x81, 0xffffffff, 0x2, 0x6, 0xffffff80, 0x5, 0x1], [0x1, 0x5, 0x8517, 0x7, 0x7, 0x10001, 0xb, 0xb]], '\x00', [{0x3, 0xc, 0x1, 0x1, 0x1}, {0x5776d45a, 0x40, 0x1, 0x1, 0x1}, {0x10001, 0x0, 0x1, 0x1}, {0xfffffff7, 0x6, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x8, 0x0, 0x0, 0x0, 0x1}, {0xa, 0x7, 0x0, 0x1, 0x0, 0x1}, {0x5, 0x4, 0x1, 0x0, 0x1, 0x1}, {0x2, 0x3, 0x0, 0x1, 0x1}, {0x5, 0x5, 0x1, 0x0, 0x1, 0x1}, {0x7ff, 0x3, 0x0, 0x0, 0x1, 0x1}, {0x7, 0x9, 0x0, 0x1, 0x1, 0x1}, {0xc, 0xfffffff8, 0x0, 0x0, 0x1, 0x1}], '\x00', 0x80000001}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="010000000600000008000000080000004047fd1f", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000004000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r7, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="58eced8e46dc3f0ab98607000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f000001b700)=""/102392, 0x18ff8) 3.876335907s ago: executing program 4 (id=2757): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$nl_route_sched(r1, 0x0, 0xc050) socket$kcm(0x10, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) 3.675362767s ago: executing program 6 (id=2758): syz_emit_ethernet(0x7a, &(0x7f0000000200)={@empty, @random="ad5b2fa107c4", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00\x00k', 0x44, 0x2f, 0x0, @dev={0xfe, 0x80, '\x00', 0x27}, @private2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}, {}, {}, {0x8, 0x88be, 0x1}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10}, 0x2, {0x8, 0x1}}}}}}}}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000000ac0)) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') name_to_handle_at(r0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="1c000000811e0000050000000000000000100000000000000c0000000000009457969fcf"], &(0x7f0000001500), 0x200) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303}, "3f69f5593d99b5b9", "ad19b9f81b7051508702a27013f65558c8a01f2ae65a25a4c4580daf90219442", "d78279e4", "ba02af61de6197b6"}, 0x38) r2 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0x356b, 0x800, 0x1, 0x40000334}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000500)={0x9, [[0x3, 0x101, 0x8, 0x5, 0x4c, 0x3, 0x4, 0x4], [0xa, 0x81, 0xffffffff, 0x2, 0x6, 0xffffff80, 0x5, 0x1], [0x1, 0x5, 0x8517, 0x7, 0x7, 0x10001, 0xb, 0xb]], '\x00', [{0x3, 0xc, 0x1, 0x1, 0x1}, {0x5776d45a, 0x40, 0x1, 0x1, 0x1}, {0x10001, 0x0, 0x1, 0x1}, {0xfffffff7, 0x6, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x8, 0x0, 0x0, 0x0, 0x1}, {0xa, 0x7, 0x0, 0x1, 0x0, 0x1}, {0x5, 0x4, 0x1, 0x0, 0x1, 0x1}, {0x2, 0x3, 0x0, 0x1, 0x1}, {0x5, 0x5, 0x1, 0x0, 0x1, 0x1}, {0x7ff, 0x3, 0x0, 0x0, 0x1, 0x1}, {0x7, 0x9, 0x0, 0x1, 0x1, 0x1}, {0xc, 0xfffffff8, 0x0, 0x0, 0x1, 0x1}], '\x00', 0x80000001}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="010000000600000008000000080000004047fd1f", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f000001b700)=""/102392, 0x18ff8) 3.011412957s ago: executing program 4 (id=2759): syz_emit_ethernet(0x7a, &(0x7f0000000200)={@empty, @random="ad5b2fa107c4", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00\x00k', 0x44, 0x2f, 0x0, @dev={0xfe, 0x80, '\x00', 0x27}, @private2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}, {}, {}, {0x8, 0x88be, 0x1}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10}, 0x2, {0x8, 0x1}}}}}}}}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000000ac0)) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') name_to_handle_at(r0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="1c000000811e0000050000000000000000100000000000000c0000000000009457969fcf"], &(0x7f0000001500), 0x200) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) fcntl$dupfd(r1, 0x0, r1) r2 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0x356b, 0x800, 0x1, 0x40000334}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="010000000600000008000000080000004047fd1f", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f000001b700)=""/102392, 0x18ff8) 1.934711015s ago: executing program 3 (id=2760): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000080)=r2, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() r6 = socket$xdp(0x2c, 0x3, 0x0) r7 = socket(0x1a, 0x5, 0x8) bind$xdp(r6, &(0x7f0000000180)={0x2c, 0x2, r1, 0x3a, r7}, 0x10) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4dc1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r10}, @IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_VERSION={0x5, 0x6, 0x1}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.765661536s ago: executing program 0 (id=2761): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000180)={0x1f, 0x0, @any, 0x4, 0x2}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001100)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28}, {0x4}, {0xc}, {0xc}}}, @m_bpf={0x0, 0x10, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0x0, 0x6, './file2\x00'}, @TCA_ACT_BPF_FD, @TCA_ACT_BPF_NAME={0x0, 0x6, './file1\x00'}, @TCA_ACT_BPF_FD]}, {0x0, 0x6, "8c39993268f7589916ccbe2dc74b7502b0f8cb9cf1b61a376303ac5bae5b4f74df3eb839bfe053313bb307020397087f8aefe2f72e9fdcfbec72bc7ae20f1c557d5250f8bf1e359f7a3a960bf061c00e61d0ceb87dc7940fac9da50c7f90541d997f9c6f7daea1c8c994c3318b201e47625fe4edd57d166c75343d530c9f33d9494246ad3dc2e689a536532029ca6d4416cbd04460dba534e2a45edf1d844bcba29ec5f223efa822be09fdcdd07dde651534dec94966f7e0fcb26d06fc07f6293563d1a39ead599536efdbbd3342ac0c21840ca531a9c908de591bb1f7185e63a486182a4a4ce4e40a70f77673fb0a112156b5d4b9"}, {}, {0x0, 0x8, {0x2, 0x2}}}}, @m_gact={0x0, 0x20, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x0, 0x2, {0x9, 0x0, 0x4, 0x200, 0x9}}, @TCA_GACT_PARMS={0x0, 0x2, {0xfffffffb, 0x4, 0x2, 0xff, 0x5}}, @TCA_GACT_PARMS={0x0, 0x2, {0x3, 0x9, 0x7, 0x401}}]}, {0x0, 0x6, "312630d25a776491414de676b241975705f39094bc0fdcd999bb48f78bb896892ec5908d0dfbef212cdd4878730f4c2e6c64ff2695244571284fa064e3ccdb54b3b7176b92cc8cd70fe74e06fdf5720946664fb65bb7b368d8247dd899756edd68c2aca4e4f809ef79647168557b53b4ce710085e0b5f52a2709d9427de92f09614e464de802eb32f2a2c728bc90a3c8c1fdb14af38f591d7e4befb1036841b136562b5814fb0187a076ee2bb8147151877b5a8ef481693c51c2b62c45303910cef3c9dbaa2bed3ae8395bc311962fcafd67dcd2976c67d033c0dcffcb0bc8546b3d23732a3b61283f6fdba5cd28a6ab8f04322f1f6ea3f649d4cf83f966bb5608bdf37f45b19b5bec2bf33826f65287ae1e98ec4d3c8780e7bf9f366f715fcdf67f2d279fad719ce8fb8c17b0087f2b99da63359a8c8c443ec65de5e8f1bdedf636f9c257214564b98aae8551b949f2c029ec54bf9f6bc0b0592a94b43bb75892ec9ca2d7858120adeef04e1df95014114b660b83027d54ba1c03365a796bfbd68d7bfd53b132d48f3c3db80cc64f26ea5d00b353e509e25c280599cb5b3dfd5ef7ec8c0727d105299fcffb5735120bba15af46090b135feb45fc06550261563692eb5105677d744e72186c01fe9cfaba63adee4ac39ec9da664884f2641e9c7345bb664deec9da3f75fdd2b74ac5a2cf3dab3b1b6e0ed69bac31998ac36b07da4917e068643ddbc645efcd9d927f6c0341121486f45338f245dce5453aaf2163e675bac7ff7abb234c5742076b438625ab7da13e53e9307ec32bc3064161205b1c9e237d406181d5098504c1ebc83f2d6e79a7c7aa8fe5680fb97638fd6c7b18f1fb46cc2330ac0d96cfddd54c92bd4b238059b2b35f1adcf5e67b06b3837fd9a1d873077323a93203957645a7a7d860d5b3102299235a2430a02184e81a03de01c9937fe0bc19c9aa2f038f3d658464adae4844ba8faa2aa7786971c5127bcd66b9943f12fa8dc45cad5282a8b630c73617cb06fa92a47d28b595553008fe4801b196f035f6916ba28f0514962ddf99248faff6a70b48252f26013bf9fcfcf9fb95bf371df5af4d8ad7eaaefc15f38234d80b62d2a18e9d7c7235fed6a24d5fcd1cbd40732e3c724e08ed7b7404ad8840b90d272ecfae7cff4c224ed0bfafc3481ea8dd9f7c29a05a69f9ecadecf0258e4bbe922036ab56a48d7f6b7c41d1fd20eebf5963057b115c48df6d8b851b99b1de498253a4176cadcd3f4e351a893d784b200624504815680c978485df1d593dd6730093b8616f8fe97d6803959d0e59980a3267fddce5d2b5f2dacedadb2ccb568832eba06c73f43fe33f4796f770005086cdc5db3d981af69563c2da24c634723d96bd67b5a9c79308cbeea48dbd42346b7c38ce22e0bbe1c25ca557f35b48b4047bfa1753b9713c5a6052948bd785b196d6c7ac35e8f52b7e364d04b611a9429fcb4a7de1f44a902dec10524b856d86dd73df46ef01b6e874349bd05db10cbb6681de3c09a2bad2fb519a1078f244a607fbf1080f2379d1046d14728fed6e843a16ec7618d5d2f3f4bc58b4c73a3c6fb422cffcfcf146712a11ebe945120f3574b4ac9cf8c1ed418d1a1cace9010e6ba548fd0fc764c3f0d5aa92bb3f34ba1a8973f055cf0b412c13d8e5a63a3af86154b362158d6af594aa693042c20c880060b5c14c66ec9f49eef04649f3cc281122ab6298ae0343d11430d104e11bf159023a2ce0b8327e96fc48e741b3c69fa879b0b96799b93f3ed8b073c6046370535604a093f25381dc66aa76a836f425dc34e53714e1fee874cb98c6d7f83886cdf5516671d6dd605e9d4449c8d21dcb3d82b2c5d7413da19c12d5a3401a819d398cd80684c318b74b3ea43d99195e62a3ac9c7870a8ac31c0e7917e79aa9d81f39cae06392d3f4a7b0cfd69106c8a832ebb580c9bc4a2adbca2f0d24b36fb1348d187c35e9979637b7001b43848122fcc75e7e2e80e46cadabd021eca3529ba1b93d318ac8bc6b0e63fa56a427e875363f729ef19f529753a19c0c5d6cbc886b7f374e90d6b31f8740027ab0240e3fa4759c3bb3d5ec2347eb67a7561e3a4aa7194754f79045cd1821f494a5b425a671160278a74f6203f151b8228049bf09d12a80d691ad728a3bda6db4510d55dfc7b86bd027c79c50973b6348551d5014bad0e2086a487d53dccb3122ebe47f9880c9abb2da30af1d3f5c15f1e6d8f069008d43f197b8109d1aa67007a30fd5db608b6c5a629647ff979a8e3fc30f56213671ea6b4cb2919e88c21392609512f4e18ca645a3c21236ac8b15a02202115cd23f906d5ed8f0e32daa8b2431dd1a482f0bcb1cdb3604f62d8b00bd211ea55ce964e5424ec8bc819c52c571396bd79cfc11784db28d00598b4545318f930ed0c8e79e3a007efc71d69f771748c1107373adac370e6feb1a32385eb10f0144f196efc065fb3ff4b03c299d3265e63f1104fba928417ddc84ca62db2048990fc74f085507c5980374d52ee0028623e9352f1c50a22f685ccbd4d26d71e081c5d5e5c31470a6868180ff763fd7e781efd126d5971b834a8caa652fc85160fd939538b46c79be5d68988d03ea8a1d2332eae09b98da6b234c147a95adac77e946eb00c0d5659997ce65b5f231e8c32251a3e484d56ba95ca128db324e7101e42d7fd446930d631198181070dfa23d43ded534fd6bfde162b31aa44b04cf35e9f6ede0fc8c23591cb179ba07ceea5eb704df87a32c6c4cc98bd880057aad0bd333e6c6c6f1ebd09671b80a5b2bd638484b31cc7e6857e64a99d84bf59cabdab88245009c29e220a60622d142439245903441c8e56deee6dfac926c0c5b79e5c881d0da323d33e10de8eaf8b4b97f58311e4606c1a756a7282f5726612b4d7f32bc54b4565af178d287e41bd75d1d95eec17a5b720ec85682b9d97c671d95f611dc96fa7e3a9eabc917a4cc69b46e0586a414bb3b2d03c9106159ea35366ad3dc3d040571722a87ddbd77eee859feb9cdc90ea36ca10d3d25f855a1294a970623370c84d68d3fb416b08de41c553a55818cbe3980096d4e022ed7743672b68b2dbcdf5278eef3a5f1ffcdb12452a7df0bb557695d56fec9a10c5904384791f9a4e83b41620e692eee58049aa3a7db422ed825736d0ca5adf2cd1e43200b5de859a51d715cdbb730e72dc772c729de78e4f0a140cbb8f51825ac23add20f64b0eaed1da6be27bcb7936148e5217d84e5bd558df2428fffb0f16764303df639025711d72d94fbb7d593aa05e6ad88740e8fb63ff2509d696163ecca1c6a985c2eeae0586a1bd7fa084b32e60309a9838c2532d192a3968c0c885dd217978a0cf7155de31d0042f2abcc953688da47bc9ecd115c106613a182e4a9925a5c6a4a808fa3aec1b7ed4793ceb6e7dbd0f12218f6046de21be2107a40c115adbc7dc637e926b56295f9b7cab69aabeb6ec09fd9be089d7aeb535a26f2167a636ed0ca9115f6b6284eb2e0968806c24b46211ab44b58dcb016ddb7c5c0073336e914b9cf7f9ebc7c167a6fb7461aed9f12c23891b72eda0add5abd29e3f1d21287965fb87fc2d19ddcff0211d99f663b7ccc5e2bb5ba74b0c31a7476337bf15e6fce896829a42c44f42e608622a971cf5c142e815d98de4595fce1f27f6be5fb8349532c90c4b6cc2c32be1f6786ce1c500cddec533cb93dc80aced9b4dd9ef25e838f4c0df61d13cfd77799e5634696c106e23e155b64a4c466ea1adb13cba7b417b6ff4b11c5a27b579c741ac8b579a76a003941fa0f20c07043da4da8235ef976e743f58cfedc1caa9de981e58d7f621a835cdbfdd1e09fa9b2d82c0084d111d9946c06c20e1efd15db37e479f562bd6d8a985a149a22c94bf0169eeda7eb95dd373dfb57dda34d4681de765dfb4f9c136a4b4c2dc83c7583c871e61d9f1401c95d565e968152f9c0f0bf29b1a2f6652f656b6dd73c2ee4dbb8a32e32a3ae730eb60303e10be6cf3c3952de480694f63b10a8405f179941a9dc635340ec91caa9fc88266b0a3b215d2dc92036eead2551c2382d42158275115ae3bb8b34901bc4bdc8d960d3676584c2623afdc2c07fe3693ca18bf85fa3bf9868f159a3748d0a19394fec78f9a07c3c8db4d10a7920281646b57b14264fe4c90060e4d520020398eb299a542b08ca888f1d33ab2cf87cf30c86c71fa262a8b7263763fd25096f1198babf1ae22382458f7d52895f28de68518d52e274229ea8cfd176c441ccf7ee1a3bf8e6421010dfbecd76b988ecb7f62d325939f9955dc0c29f8c0ba7bd624b5361f1906e363d4e7f1c91f8fdd4a1930b5eec116ca643f7f2c5a41511c73fb08b5223ff7ae1d56230b9f07de9cf9dc2f16bd0a122b476f2096a017effa9b00a8046fccb2e03b161127e30dfff63f34ba3a6f075d785ee7711caf2496633750a320b0eeff2718733348311c6a16c79e073834e21a681d9faf5de3c4c229f095b92d0cdc0fc8e0435bb127328ff88bb8b66c22e221ee6927eabe99adc8db27354b71b7c4730590df420972ef1353cefffec27d2d82c25c7943d6cac25f9b077c8f10293eadf89ea32ac997e0ace3bebad26e41f63ef491d9d1093490a4d66dfcda36343056ddbcf02b38896f07bbbcd3120143b19b6c253eb1d56e0d5a2ffd40bebba313556a4333752b82d0b6dc230cf175143e22007f9156a8f91731ac7791da9dd6cfb0e82817bec6ccb06d27f51c80a9fec56c8b6e1ec011e61dc03c706dbbe594983fe794645686755511b0313fb56be1f2940a1cc3347300d54e1c8b1499a4a28436fa8869da0c37df8be95a8d07809373dd4de2a3a616726c049b0128cf4549f24e0e2cb3cd93de4d1426dafb19be1f85712965a6798fbff04e3a97533a1d1cc59536c146b9ee2d847f1df84bb71f920fecc51b3e1bfbbcbcf0d09faa8c94cfb4a3da0e839df2b2f7ca5dd19b46a8d0af39e9f125323f63cf287c85524fd036d19145b859b41f19db22a658d26832e8769455294df73986db6f27f44b85aca686612714ae2f841021dce2ff2d092b2d9e3a80f5b597ec6b54214ccd3d979d67c2615b25d7892cd08f09be92fca9afccfd12d9d2b415d63310cc3da6d7c0403862e66d99690b987d7fac8cbbd341e079333295c4a18e4f4630d1e8d5e676d584e7d6f7de04b4fe938fb29836bcca8865b94e9b3a0796344e88fcffe462432ac08a21faa406af451e5108fd77303e8d505b1e957d4c496dabcd47af2683ff888bd166ad3f77ce5c9cbfe78e6f528eaa24793df31d32626912c3e8b76e9c6b670e923605384e864d1727d2b76ea6e2c176ea1dc17abee081b77520bbf28bc85384df78192d4cd75971f3c8b4353bbe71b357c0fa6da2174ecce2b749dba3431ff75b7c24356b566a289a2f3d26f30d03d92948bea15884fa476fbce45f8e3e336adb96d9231f7e2ecc1737e006a0abd994a5b7f235f7e1bdbc756577bb6d33dedf22dacfcafeed9e453acc8910b9d804f2d3cf0cab4a3f7aa5d8aea9cd7a8ee4f4ce9e75c839cc1020fc0cf5f4c75c8a14a7e8558935acae15c43c2929105aa05816a276b2f8ce62e4bbaff21c650c41ef2c168f1964189563df8d796a3316d2259042b2fad4d3bfc3bd7e79efdceee07b1fdc837174eace31ebdc72a309f7312f5a74c55cf73f99499eac4245761cfedaebdf19a8df64f8b91cc3d3e03eec2bb4c5f849744752bececb9bfab60c49e7d9f608dec0a6dc974ac02d60077058da36488d8141279145d24b00af9493c3d62e"}, {0x0, 0x7, {0x1, 0x1}}, {0x0, 0x8, {0x2, 0x3}}}}]}]}, 0x6c}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000380)='sys_enter\x00', r4}, 0x10) wait4(0x0, 0x0, 0x0, 0x0) connect$netrom(r1, &(0x7f0000000000)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) writev(r1, &(0x7f0000002340)=[{&(0x7f0000001100)="6196", 0x2}], 0x1) r6 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000240), 0x101a00, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) statx(0xffffffffffffff9c, &(0x7f0000000300)='./file2\x00', 0x2000, 0x400, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r5, &(0x7f0000002380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$fuse(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000200), 0x2008802, &(0x7f0000000680)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x1400}}, {@allow_other}, {@blksize}], [{@flag='posixacl'}, {@uid_eq={'uid', 0x3d, r9}}, {@obj_type}]}}) 1.764729353s ago: executing program 5 (id=2762): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000140)=""/43, 0x1c000, 0x1800, 0x8, 0x2}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x6, 'bridge0\x00', {0x2}, 0x2}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000080)={0x0, 'bridge_slave_1\x00', {0x1}, 0x4}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f00000000c0)=0x100, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) bind$xdp(r0, &(0x7f00000001c0)={0x2c, 0x0, r2}, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x20, 0x0, 0x3}]}) r4 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r4, 0x80044940, &(0x7f0000000600)=0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) close(r4) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, 0x0) 962.657036ms ago: executing program 3 (id=2763): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000000000000e000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a30000000005c000000030a030000000000000000000300000009000b0073797a30000000000900010073797a300000000014000480080002400000000008000140000000001c0008800c00024000000000000000000c0001"], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) (fail_nth: 12) 960.644644ms ago: executing program 4 (id=2764): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, 0x0, &(0x7f00000014c0)) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16, @ANYBLOB="010027bd7000fc06df25140000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000200000008000b00400000000600110006000000080015000c000000"], 0x54}, 0x1, 0x0, 0x0, 0xc0}, 0x8000004) setuid(0xee01) 261.897602ms ago: executing program 4 (id=2765): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socket(0x1d, 0x2, 0x6) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='sched_switch\x00', r5}, 0x18) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020900000700000000000000000000000500", @ANYRES32], 0x38}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={0x0, r1}, 0x18) pipe(0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020603f7ff000000000100000700000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r7 = syz_open_dev$video(&(0x7f0000000040), 0x1, 0x240) ioctl$VIDIOC_S_FMT(r7, 0xc0d05640, &(0x7f0000000340)={0x7, @pix={0x9, 0x4, 0xb5315258, 0x9, 0x8, 0xe, 0x8, 0x726c4a97, 0x1, 0x7, 0x2, 0x6}}) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(0xffffffffffffffff, 0x3ba0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r8, &(0x7f0000000640)=ANY=[], 0x200002e6) 170.406854ms ago: executing program 5 (id=2766): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, 0x0, 0x0, 0x40800) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) 63.278995ms ago: executing program 3 (id=2767): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$nl_route_sched(r1, 0x0, 0xc050) socket$kcm(0x10, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x100000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) recvmsg$can_raw(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) 62.379827ms ago: executing program 0 (id=2768): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'c6xdigio\x00', [0xcf7, 0x5, 0x1, 0x0, 0x40000000, 0xcc7, 0x8, 0x7, 0x1, 0xff, 0x2, 0xffffffff, 0x28, 0x0, 0x6, 0x22, 0x101, 0x49, 0x43, 0x40000003, 0xf, 0xa, 0xf27, 0x7, 0x2, 0x8, 0x3, 0x6, 0x8, 0x10000, 0xfffffff4]}) 0s ago: executing program 5 (id=2769): getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) prlimit64(0x0, 0xe, &(0x7f0000000300)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r5) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r7, 0x421, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x4000, 0x0, 0xc35d4f6d52288271}, 0x200048c4) kernel console output (not intermixed with test programs): 731.209262][T14209] hsr_slave_0: entered promiscuous mode [ 731.245849][T14209] hsr_slave_1: entered promiscuous mode [ 732.028215][T12493] usb 4-1: USB disconnect, device number 73 [ 733.029043][ T30] audit: type=1400 audit(1764717416.944:1074): avc: denied { mount } for pid=14387 comm="syz.3.2153" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 733.612962][T14209] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 733.658557][T14209] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 733.712986][T14209] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 733.754095][T14209] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 733.969972][T14426] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2156'. [ 734.064012][T14209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 734.155265][T14209] 8021q: adding VLAN 0 to HW filter on device team0 [ 734.437727][ T4212] bridge0: port 1(bridge_slave_0) entered blocking state [ 734.444876][ T4212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 734.499204][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 734.506317][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 734.533465][T14430] netlink: 'syz.0.2157': attribute type 20 has an invalid length. [ 734.552531][T14430] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2157'. [ 734.597229][T14431] bridge2: entered promiscuous mode [ 734.622563][ T60] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 734.660286][T14430] bridge3: entered promiscuous mode [ 734.935072][ T60] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 734.989637][ T60] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.052621][ T60] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 735.823217][T14209] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 735.841527][ T931] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 736.044248][ T931] usb 6-1: Using ep0 maxpacket: 16 [ 736.067906][ T931] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 736.102870][ T931] usb 6-1: config 0 has no interface number 0 [ 736.108998][ T931] usb 6-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 736.203945][ T931] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 736.245634][ T931] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 736.261243][ T931] usb 6-1: Product: syz [ 736.269220][ T931] usb 6-1: SerialNumber: syz [ 736.320888][ T931] usb 6-1: config 0 descriptor?? [ 736.405391][T14476] QAT: failed to copy from user cfg_data. [ 736.451403][ T931] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 737.023898][T14209] veth0_vlan: entered promiscuous mode [ 737.044839][T14209] veth1_vlan: entered promiscuous mode [ 737.170819][T14209] veth0_macvtap: entered promiscuous mode [ 737.208055][T14209] veth1_macvtap: entered promiscuous mode [ 737.313948][T14209] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 737.359243][T14209] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 737.668013][ T60] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.704686][ T60] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.716273][ T60] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.734012][ T60] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.891910][T12025] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.906914][T12025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.977396][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.987683][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.997223][T14502] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2168'. [ 738.142922][ T5882] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 738.304314][ T5882] usb 5-1: config 0 interface 0 altsetting 251 has an invalid descriptor for endpoint zero, skipping [ 738.407125][ T24] usb 6-1: USB disconnect, device number 17 [ 738.429533][ T5882] usb 5-1: config 0 interface 0 has no altsetting 0 [ 738.449086][ T5882] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 738.482581][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 738.533593][T14507] FAULT_INJECTION: forcing a failure. [ 738.533593][T14507] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 738.580674][ T5882] usb 5-1: Product: syz [ 738.594827][ T5882] usb 5-1: Manufacturer: syz [ 738.606092][ T5882] usb 5-1: SerialNumber: syz [ 738.614847][T14507] CPU: 0 UID: 0 PID: 14507 Comm: syz.5.2171 Not tainted syzkaller #0 PREEMPT(full) [ 738.614870][T14507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 738.614880][T14507] Call Trace: [ 738.614885][T14507] [ 738.614892][T14507] dump_stack_lvl+0x16c/0x1f0 [ 738.614914][T14507] should_fail_ex+0x512/0x640 [ 738.614943][T14507] _copy_from_user+0x2e/0xd0 [ 738.614967][T14507] copy_msghdr_from_user+0x98/0x160 [ 738.614994][T14507] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 738.615018][T14507] ? __lock_acquire+0x433/0x22f0 [ 738.615051][T14507] ___sys_sendmsg+0xfe/0x1d0 [ 738.615076][T14507] ? __pfx____sys_sendmsg+0x10/0x10 [ 738.615100][T14507] ? __lock_acquire+0x433/0x22f0 [ 738.615151][T14507] __sys_sendmsg+0x16d/0x220 [ 738.615183][T14507] ? __pfx___sys_sendmsg+0x10/0x10 [ 738.615224][T14507] do_syscall_64+0xcd/0xf80 [ 738.615243][T14507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.615261][T14507] RIP: 0033:0x7fdc32d8f749 [ 738.615276][T14507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 738.615293][T14507] RSP: 002b:00007fdc30ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 738.615309][T14507] RAX: ffffffffffffffda RBX: 00007fdc32fe5fa0 RCX: 00007fdc32d8f749 [ 738.615321][T14507] RDX: 0000000024008000 RSI: 0000200000000280 RDI: 0000000000000003 [ 738.615332][T14507] RBP: 00007fdc30ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 738.615342][T14507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 738.615352][T14507] R13: 00007fdc32fe6038 R14: 00007fdc32fe5fa0 R15: 00007ffe8b333f58 [ 738.615377][T14507] [ 738.789829][ T5882] usb 5-1: config 0 descriptor?? [ 738.839903][ T5882] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 739.465231][T12493] usb 5-1: USB disconnect, device number 63 [ 739.566664][T14211] udevd[14211]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 739.986839][T14515] delete_channel: no stack [ 740.000244][T14525] netlink: 212916 bytes leftover after parsing attributes in process `syz.4.2174'. [ 740.012840][ T30] audit: type=1400 audit(1764717423.854:1075): avc: denied { unmount } for pid=14209 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 740.388893][ T30] audit: type=1400 audit(1764717424.274:1076): avc: denied { getopt } for pid=14528 comm="syz.6.2175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 740.596865][ T30] audit: type=1326 audit(1764717424.304:1077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 740.685480][T14535] FAULT_INJECTION: forcing a failure. [ 740.685480][T14535] name failslab, interval 1, probability 0, space 0, times 0 [ 740.698219][T14535] CPU: 1 UID: 0 PID: 14535 Comm: syz.3.2176 Not tainted syzkaller #0 PREEMPT(full) [ 740.698243][T14535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 740.698254][T14535] Call Trace: [ 740.698262][T14535] [ 740.698270][T14535] dump_stack_lvl+0x16c/0x1f0 [ 740.698294][T14535] should_fail_ex+0x512/0x640 [ 740.698319][T14535] ? __kmalloc_noprof+0xca/0x870 [ 740.698345][T14535] should_failslab+0xc2/0x120 [ 740.698365][T14535] __kmalloc_noprof+0xdd/0x870 [ 740.698387][T14535] ? mark_held_locks+0x49/0x80 [ 740.698409][T14535] ? constrain_params_by_rules+0x175/0xca0 [ 740.698439][T14535] ? constrain_params_by_rules+0x175/0xca0 [ 740.698459][T14535] constrain_params_by_rules+0x175/0xca0 [ 740.698482][T14535] ? trace_sched_exit_tp+0xd1/0x110 [ 740.698520][T14535] ? __pfx_constrain_params_by_rules+0x10/0x10 [ 740.698544][T14535] ? lockdep_hardirqs_on+0x7c/0x110 [ 740.698578][T14535] ? rcu_is_watching+0x12/0xc0 [ 740.698596][T14535] ? snd_interval_refine+0x2fa/0x580 [ 740.698617][T14535] snd_pcm_hw_refine+0x7de/0xad0 [ 740.698645][T14535] ? __pfx_snd_pcm_hw_refine+0x10/0x10 [ 740.698667][T14535] ? irqentry_exit+0x3b/0x90 [ 740.698693][T14535] ? snd_pcm_oss_change_params_locked+0x5d3/0x3a30 [ 740.698715][T14535] ? snd_pcm_oss_change_params_locked+0x5e1/0x3a30 [ 740.698740][T14535] snd_pcm_oss_change_params_locked+0x65e/0x3a30 [ 740.698769][T14535] ? __mutex_lock+0x27b/0x1b10 [ 740.698791][T14535] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 740.698813][T14535] ? irqentry_exit+0x3b/0x90 [ 740.698832][T14535] ? __pfx___mutex_lock+0x10/0x10 [ 740.698859][T14535] ? lockdep_hardirqs_on+0x7c/0x110 [ 740.698880][T14535] snd_pcm_oss_make_ready_locked+0xb7/0x130 [ 740.698910][T14535] snd_pcm_oss_sync+0x32e/0x840 [ 740.698931][T14535] ? snd_pcm_oss_release+0x283/0x310 [ 740.698954][T14535] ? __pfx_snd_pcm_oss_release+0x10/0x10 [ 740.698975][T14535] snd_pcm_oss_release+0x28b/0x310 [ 740.698997][T14535] ? __pfx_snd_pcm_oss_release+0x10/0x10 [ 740.699017][T14535] __fput+0x402/0xb70 [ 740.699049][T14535] fput_close_sync+0x118/0x210 [ 740.699075][T14535] ? __pfx_fput_close_sync+0x10/0x10 [ 740.699097][T14535] ? dnotify_flush+0x79/0x4c0 [ 740.699122][T14535] __x64_sys_close+0x8b/0x120 [ 740.699147][T14535] do_syscall_64+0xcd/0xf80 [ 740.699167][T14535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.699184][T14535] RIP: 0033:0x7f2a3eb8f749 [ 740.699199][T14535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 740.699215][T14535] RSP: 002b:00007f2a3f956038 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 740.699232][T14535] RAX: ffffffffffffffda RBX: 00007f2a3ede6180 RCX: 00007f2a3eb8f749 [ 740.699244][T14535] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 740.699254][T14535] RBP: 00007f2a3f956090 R08: 0000000000000000 R09: 0000000000000000 [ 740.699264][T14535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.699275][T14535] R13: 00007f2a3ede6218 R14: 00007f2a3ede6180 R15: 00007ffd16121018 [ 740.699303][T14535] [ 741.197237][ T30] audit: type=1326 audit(1764717424.304:1078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.253897][ T30] audit: type=1326 audit(1764717424.304:1079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.311158][ T24] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 741.471188][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 741.481349][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 741.492730][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 741.502893][ T24] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 741.512098][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.667395][ T30] audit: type=1326 audit(1764717424.304:1080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.775444][ T30] audit: type=1326 audit(1764717424.304:1081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.819514][ T24] usb 7-1: config 0 descriptor?? [ 741.856634][ T30] audit: type=1326 audit(1764717424.304:1082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=442 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.923514][ T24] hub 7-1:0.0: USB hub found [ 741.930667][ T30] audit: type=1326 audit(1764717424.304:1083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 741.980060][ T30] audit: type=1326 audit(1764717424.304:1084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14528 comm="syz.6.2175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=47 compat=0 ip=0x7f733278f749 code=0x7ffc0000 [ 742.202456][ T24] hub 7-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 742.481414][ T24] usbhid 7-1:0.0: can't add hid device: -71 [ 742.828841][ T24] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 742.996892][ T24] usb 7-1: USB disconnect, device number 2 [ 745.076410][T14588] ./file0: Can't lookup blockdev [ 745.090047][T14588] fuse: Bad value for 'fd' [ 745.104487][ T5882] usb 1-1: new full-speed USB device number 71 using dummy_hcd [ 745.433482][ T5882] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 745.447673][ T5882] usb 1-1: config 0 has no interface number 0 [ 745.470392][ T5882] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 745.496651][ T5882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.524161][ T5882] usb 1-1: config 0 descriptor?? [ 745.540946][ T5882] usb 1-1: selecting invalid altsetting 1 [ 745.548883][ T5882] dvb_ttusb_budget: ttusb_init_controller: error [ 745.562416][ T5882] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 745.571031][T14593] netlink: 'syz.5.2189': attribute type 21 has an invalid length. [ 745.591153][T14593] netlink: 156 bytes leftover after parsing attributes in process `syz.5.2189'. [ 745.621286][T14593] netlink: 'syz.5.2189': attribute type 21 has an invalid length. [ 745.690949][ T5882] DVB: Unable to find symbol cx22700_attach() [ 745.691190][T14593] netlink: 156 bytes leftover after parsing attributes in process `syz.5.2189'. [ 746.623460][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 746.623476][ T30] audit: type=1800 audit(1764717430.544:1095): pid=14597 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.2190" name="bus" dev="overlay" ino=58 res=0 errno=0 [ 746.774851][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.939444][T14601] netlink: 'syz.0.2186': attribute type 10 has an invalid length. [ 747.110506][T14601] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2186'. [ 747.456732][ T5882] DVB: Unable to find symbol tda10046_attach() [ 747.465934][ T5882] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 748.588085][T14633] workqueue: name exceeds WQ_NAME_LEN. Truncating to: ôÏ€ðFõïVl‘uc'f`å”Þ†’;œ1µ [ 748.839785][ T931] usb 1-1: USB disconnect, device number 71 [ 749.171162][ T24] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 749.461189][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 750.241451][T14663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2200'. [ 750.575294][ T24] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 750.695213][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 750.739636][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 750.839324][ T24] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 750.852884][ T24] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 750.868423][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.106595][T14678] net_ratelimit: 1247 callbacks suppressed [ 751.106613][T14678] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 751.154949][T14679] 9pnet_fd: Insufficient options for proto=fd [ 751.158985][ T24] usb 4-1: GET_CAPABILITIES returned 0 [ 751.188847][ T24] usbtmc 4-1:16.0: can't read capabilities [ 753.551400][ T5931] usb 5-1: new full-speed USB device number 64 using dummy_hcd [ 753.718910][ T5931] usb 5-1: config 0 has an invalid interface number: 17 but max is 0 [ 753.728252][ T5931] usb 5-1: config 0 has no interface number 0 [ 753.834734][ T5931] usb 5-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 753.908737][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.082484][ T5931] usb 5-1: Product: syz [ 754.100768][ T5931] usb 5-1: Manufacturer: syz [ 754.115654][T12493] usb 4-1: USB disconnect, device number 74 [ 754.702775][ T5931] usb 5-1: SerialNumber: syz [ 754.927305][ T5931] usb 5-1: config 0 descriptor?? [ 755.290210][ T30] audit: type=1800 audit(1764717439.204:1096): pid=14721 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.5.2213" name="bus" dev="overlay" ino=707 res=0 errno=0 [ 755.405363][T14721] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2213'. [ 755.438694][T14697] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2209'. [ 755.781642][ T5931] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 found [ 755.795247][ T24] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 755.871884][ T5931] usb 5-1: selecting invalid altsetting 5 [ 755.938077][ T5931] snd_usb_podhd 5-1:0.17: set_interface failed [ 756.088116][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 756.101269][ T5931] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 now disconnected [ 756.118100][ T5931] snd_usb_podhd 5-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 756.155138][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.216886][ T5931] usb 5-1: USB disconnect, device number 64 [ 756.288840][ T24] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 756.395188][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.469130][ T24] usb 4-1: config 0 descriptor?? [ 757.062649][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.086539][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.110658][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.565868][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.590835][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.636600][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.655228][ T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 757.668663][ T24] cp2112 0003:10C4:EA90.000F: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 758.034527][ T24] cp2112 0003:10C4:EA90.000F: Part Number: 0x82 Device Version: 0xFE [ 758.254403][T14723] cp2112 0003:10C4:EA90.000F: Error starting transaction: -38 [ 758.360425][ T30] audit: type=1400 audit(1764717442.274:1097): avc: denied { listen } for pid=14722 comm="syz.3.2217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 759.218740][ T30] audit: type=1400 audit(1764717442.274:1098): avc: denied { accept } for pid=14722 comm="syz.3.2217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 759.398775][T14728] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 759.519440][ T24] cp2112 0003:10C4:EA90.000F: error reading lock byte: -71 [ 759.620787][T14787] overlay: ./file0 is not a directory [ 760.351124][T14181] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 760.543985][ T24] usb 4-1: USB disconnect, device number 75 [ 760.548591][T14817] netlink: 'syz.5.2234': attribute type 22 has an invalid length. [ 760.551052][ T5827] Bluetooth: hci0: command 0x0405 tx timeout [ 761.294054][T14817] overlayfs: failed lookup in lower (newroot/133, name='bus', err=-40): overlapping layers [ 761.304521][T14817] overlayfs: failed to resolve './bus': -40 [ 761.314181][T14181] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 761.356435][T14181] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= e.b7 [ 761.386722][T14181] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.457387][T14181] usb 7-1: config 0 descriptor?? [ 761.528212][T14181] usbserial_generic 7-1:0.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 761.608212][T14181] usbserial_generic 7-1:0.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 762.026587][T14181] usbserial_generic 7-1:0.0: device has no bulk endpoints [ 762.396157][T14181] usb 7-1: USB disconnect, device number 3 [ 762.582614][T12493] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 762.665971][ T10] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 762.754217][T12493] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 762.775680][T12493] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 762.800472][T12493] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.820275][T12493] usb 6-1: config 0 descriptor?? [ 762.828204][ T10] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 762.839252][ T10] usb 1-1: config 0 has no interface number 0 [ 762.850684][ T10] usb 1-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 762.872971][ T10] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 762.885899][ T10] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 762.899996][ T10] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 762.912386][ T10] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 762.922536][ T10] usb 1-1: Product: syz [ 762.929066][ T10] usb 1-1: SerialNumber: syz [ 762.945192][ T10] usb 1-1: config 0 descriptor?? [ 762.959732][ T10] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 762.980589][ T10] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input33 [ 763.051194][ T24] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 763.171003][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 763.249361][T12493] keytouch 0003:0926:3333.0010: fixing up Keytouch IEC report descriptor [ 763.261342][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 763.269795][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 763.306350][T12493] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0010/input/input34 [ 763.333429][ T24] usb 7-1: config 57 has an invalid interface number: 229 but max is 0 [ 763.361957][ T24] usb 7-1: config 57 has no interface number 0 [ 763.383681][T14842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2239'. [ 763.420640][ T24] usb 7-1: config 57 interface 229 has no altsetting 0 [ 763.451296][ T24] usb 7-1: New USB device found, idVendor=0979, idProduct=0270, bcdDevice=dd.eb [ 763.451325][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.451343][ T24] usb 7-1: Product: syz [ 763.451357][ T24] usb 7-1: Manufacturer: syz [ 763.451371][ T24] usb 7-1: SerialNumber: syz [ 763.905408][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.912614][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.919742][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.926893][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.934086][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.941381][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.948505][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.955816][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.963229][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.971089][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 763.988780][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 763.998019][T14181] usb 1-1: USB disconnect, device number 72 [ 764.237531][ T24] gspca_main: jeilinj-2.14.0 probing 0979:0270 [ 764.240071][T12493] keytouch 0003:0926:3333.0010: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 764.264799][T14181] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 764.286027][ T24] usb 7-1: USB disconnect, device number 4 [ 764.321890][ T5931] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 764.511262][ T5931] usb 5-1: Using ep0 maxpacket: 16 [ 764.518093][ T5931] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 764.526620][ T5931] usb 5-1: config 0 has no interface number 0 [ 764.533046][ T5931] usb 5-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 764.544724][ T5931] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 240, changing to 11 [ 764.557397][ T5931] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 40993, setting to 1024 [ 764.570658][ T5931] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 764.580072][ T5931] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 764.589106][ T5931] usb 5-1: Product: syz [ 764.593329][ T5931] usb 5-1: SerialNumber: syz [ 764.599715][ T5931] usb 5-1: config 0 descriptor?? [ 764.608682][ T5931] cm109 5-1:0.8: invalid payload size 1024, expected 4 [ 764.617352][ T5931] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input35 [ 764.843500][ T30] audit: type=1400 audit(1764717448.754:1099): avc: denied { listen } for pid=14876 comm="syz.6.2245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 764.850360][ C1] cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71 [ 765.128639][ T5931] usb 5-1: USB disconnect, device number 65 [ 765.134717][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 765.339886][ T5931] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 765.400580][T12493] usb 6-1: USB disconnect, device number 18 [ 766.088002][T14894] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2249'. [ 767.729475][T14914] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2252'. [ 769.015801][T12493] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 769.223528][T12493] usb 1-1: Using ep0 maxpacket: 16 [ 769.463941][T12493] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 769.508814][T12493] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 769.528632][T12493] usb 1-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 769.549605][T12493] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 769.567114][T12493] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 769.583544][T12493] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 769.599820][T12493] usb 1-1: Manufacturer: syz [ 769.634611][T12493] usb 1-1: config 0 descriptor?? [ 772.431827][T14990] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2266'. [ 773.164990][ T10] usb 1-1: USB disconnect, device number 73 [ 773.336854][T14993] overlayfs: missing 'lowerdir' [ 773.375292][T14993] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=24 sclass=netlink_audit_socket pid=14993 comm=syz.6.2268 [ 773.388834][T14998] FAULT_INJECTION: forcing a failure. [ 773.388834][T14998] name failslab, interval 1, probability 0, space 0, times 0 [ 773.388876][T14998] CPU: 0 UID: 0 PID: 14998 Comm: syz.3.2269 Not tainted syzkaller #0 PREEMPT(full) [ 773.388897][T14998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 773.388907][T14998] Call Trace: [ 773.388913][T14998] [ 773.388921][T14998] dump_stack_lvl+0x16c/0x1f0 [ 773.388943][T14998] should_fail_ex+0x512/0x640 [ 773.388968][T14998] ? fs_reclaim_acquire+0xae/0x150 [ 773.388989][T14998] should_failslab+0xc2/0x120 [ 773.389010][T14998] __kmalloc_noprof+0xdd/0x870 [ 773.389034][T14998] ? tomoyo_encode2+0x100/0x3e0 [ 773.389064][T14998] ? tomoyo_encode2+0x100/0x3e0 [ 773.389087][T14998] tomoyo_encode2+0x100/0x3e0 [ 773.389115][T14998] tomoyo_encode+0x29/0x50 [ 773.389138][T14998] tomoyo_realpath_from_path+0x18f/0x6e0 [ 773.389165][T14998] ? tomoyo_profile+0x47/0x60 [ 773.389184][T14998] tomoyo_path_number_perm+0x245/0x580 [ 773.389204][T14998] ? tomoyo_path_number_perm+0x237/0x580 [ 773.389228][T14998] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 773.389251][T14998] ? find_held_lock+0x2b/0x80 [ 773.389291][T14998] ? find_held_lock+0x2b/0x80 [ 773.389306][T14998] ? hook_file_ioctl_common+0x145/0x410 [ 773.389329][T14998] ? __fget_files+0x20e/0x3c0 [ 773.389356][T14998] security_file_ioctl+0x9b/0x240 [ 773.389382][T14998] __x64_sys_ioctl+0xb7/0x210 [ 773.389402][T14998] do_syscall_64+0xcd/0xf80 [ 773.389421][T14998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.389439][T14998] RIP: 0033:0x7f2a3eb8f749 [ 773.389453][T14998] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 773.389475][T14998] RSP: 002b:00007f2a3f977038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 773.389492][T14998] RAX: ffffffffffffffda RBX: 00007f2a3ede6090 RCX: 00007f2a3eb8f749 [ 773.389503][T14998] RDX: 0000000000000000 RSI: 00000000c018aa06 RDI: 0000000000000003 [ 773.389514][T14998] RBP: 00007f2a3f977090 R08: 0000000000000000 R09: 0000000000000000 [ 773.389524][T14998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 773.389534][T14998] R13: 00007f2a3ede6128 R14: 00007f2a3ede6090 R15: 00007ffd16121018 [ 773.389560][T14998] [ 773.389576][T14998] ERROR: Out of memory at tomoyo_realpath_from_path. [ 773.745405][T15003] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20000 [ 774.153839][T15007] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 774.769776][T15018] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2267'. [ 776.313327][T12493] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 776.389480][T15033] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2277'. [ 776.565948][T12493] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 776.808553][T12493] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.837241][T12493] usb 7-1: Product: syz [ 777.390164][T12493] usb 7-1: Manufacturer: syz [ 777.396620][T12493] usb 7-1: SerialNumber: syz [ 777.440624][T12493] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 777.460858][ T10] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 777.743005][T10935] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 777.901168][T10935] usb 5-1: Using ep0 maxpacket: 16 [ 777.918203][T10935] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 777.936722][T10935] usb 5-1: config 0 has no interface number 0 [ 777.978246][T10935] usb 5-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 778.034975][T10935] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 778.067904][T10935] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 40993, setting to 1024 [ 778.189907][T12493] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 778.428830][T10935] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 778.523525][ T10] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 778.548110][ T10] ath9k_htc: Failed to initialize the device [ 778.585277][T10935] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 778.593526][T10935] usb 5-1: Product: syz [ 778.597687][T10935] usb 5-1: SerialNumber: syz [ 778.653718][T10935] usb 5-1: config 0 descriptor?? [ 778.679068][T12493] usb 6-1: Using ep0 maxpacket: 32 [ 778.690208][T12493] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 778.700192][T10935] cm109 5-1:0.8: invalid payload size 1024, expected 4 [ 778.717411][T12493] usb 6-1: config 0 has no interface number 0 [ 778.723753][T10935] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input36 [ 778.767124][ T10] usb 7-1: ath9k_htc: USB layer deinitialized [ 778.780356][T12493] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 778.805982][T12493] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 778.839619][T12493] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.853489][T12493] usb 6-1: Product: syz [ 778.857742][T12493] usb 6-1: Manufacturer: syz [ 778.867960][T12493] usb 6-1: SerialNumber: syz [ 778.906795][ C1] cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71 [ 778.920407][T12493] usb 6-1: config 0 descriptor?? [ 778.945527][T15048] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 778.957194][T15067] netlink: 'syz.6.2275': attribute type 4 has an invalid length. [ 779.066616][ T5902] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 779.107932][ C1] cm109_urb_ctl_callback: 64 callbacks suppressed [ 779.107959][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 779.123304][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 779.131232][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 779.138800][T10935] usb 5-1: USB disconnect, device number 66 [ 779.144800][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 779.144828][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 779.180469][T15048] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 779.192952][T10935] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 779.235413][ T5902] usb 1-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 779.277043][ T5902] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.337432][ T5902] usb 1-1: Product: syz [ 779.355928][ T5902] usb 1-1: Manufacturer: syz [ 779.367652][ T5902] usb 1-1: SerialNumber: syz [ 779.394462][ T5902] usb 1-1: config 0 descriptor?? [ 779.419484][ T5902] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 779.669312][T12493] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 779.699241][T12493] asix 6-1:0.188: probe with driver asix failed with error -61 [ 779.715904][ T5902] sonixb 1-1:0.0: Error reading register 00: -32 [ 780.341231][ T30] audit: type=1326 audit(1764717464.254:1100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15088 comm="syz.4.2291" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3570d8f749 code=0x0 [ 780.508053][T10935] usb 7-1: USB disconnect, device number 5 [ 780.924961][T10935] usb 6-1: USB disconnect, device number 19 [ 781.106113][T15098] FAULT_INJECTION: forcing a failure. [ 781.106113][T15098] name failslab, interval 1, probability 0, space 0, times 0 [ 781.120034][T15098] CPU: 0 UID: 0 PID: 15098 Comm: syz.6.2294 Not tainted syzkaller #0 PREEMPT(full) [ 781.120049][T15098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 781.120056][T15098] Call Trace: [ 781.120061][T15098] [ 781.120066][T15098] dump_stack_lvl+0x16c/0x1f0 [ 781.120081][T15098] should_fail_ex+0x512/0x640 [ 781.120097][T15098] ? fs_reclaim_acquire+0xae/0x150 [ 781.120111][T15098] should_failslab+0xc2/0x120 [ 781.120124][T15098] __kmalloc_noprof+0xdd/0x870 [ 781.120138][T15098] ? trace_kmalloc+0x2b/0xb0 [ 781.120149][T15098] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 781.120169][T15098] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 781.120184][T15098] tomoyo_realpath_from_path+0xc2/0x6e0 [ 781.120201][T15098] ? tomoyo_fill_path_info+0x233/0x420 [ 781.120214][T15098] tomoyo_mount_acl+0x1ae/0x850 [ 781.120229][T15098] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 781.120244][T15098] ? kernel_text_address+0x8d/0x100 [ 781.120260][T15098] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 781.120279][T15098] ? arch_stack_walk+0xa6/0x100 [ 781.120322][T15098] ? tomoyo_domain+0xbb/0x150 [ 781.120336][T15098] ? tomoyo_profile+0x47/0x60 [ 781.120349][T15098] tomoyo_mount_permission+0x16d/0x420 [ 781.120363][T15098] ? tomoyo_mount_permission+0x14f/0x420 [ 781.120378][T15098] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 781.120401][T15098] security_sb_mount+0x9b/0x260 [ 781.120416][T15098] path_mount+0x158/0x23a0 [ 781.120432][T15098] ? rcu_is_watching+0x12/0xc0 [ 781.120444][T15098] ? __pfx_path_mount+0x10/0x10 [ 781.120460][T15098] ? kmem_cache_free+0x328/0x7d0 [ 781.120475][T15098] ? putname+0xf5/0x1a0 [ 781.120492][T15098] ? putname+0xf5/0x1a0 [ 781.120504][T15098] ? putname+0xf5/0x1a0 [ 781.120519][T15098] ? __x64_sys_mount+0x293/0x310 [ 781.120534][T15098] __x64_sys_mount+0x293/0x310 [ 781.120549][T15098] ? __pfx___x64_sys_mount+0x10/0x10 [ 781.120574][T15098] do_syscall_64+0xcd/0xf80 [ 781.120586][T15098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.120597][T15098] RIP: 0033:0x7f733278f749 [ 781.120606][T15098] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 781.120616][T15098] RSP: 002b:00007f73309f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 781.120627][T15098] RAX: ffffffffffffffda RBX: 00007f73329e5fa0 RCX: 00007f733278f749 [ 781.120633][T15098] RDX: 0000200000000080 RSI: 0000200000000100 RDI: 00002000000000c0 [ 781.120640][T15098] RBP: 00007f73309f6090 R08: 0000000000000000 R09: 0000000000000000 [ 781.120646][T15098] R10: 0000000000800004 R11: 0000000000000246 R12: 0000000000000001 [ 781.120653][T15098] R13: 00007f73329e6038 R14: 00007f73329e5fa0 R15: 00007ffd1ca311a8 [ 781.120667][T15098] [ 781.120676][T15098] ERROR: Out of memory at tomoyo_realpath_from_path. [ 781.156959][T15099] fuse: Bad value for 'fd' [ 781.741912][T10935] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 781.783607][ T5931] usb 1-1: USB disconnect, device number 74 [ 781.853010][T15115] team0: Port device bond0 removed [ 782.022397][T10935] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 782.025092][T15115] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 782.035002][T10935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 782.035031][T10935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 782.035051][T10935] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 782.035090][T10935] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 782.035110][T10935] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.063051][T10935] usb 7-1: config 0 descriptor?? [ 783.618509][T15140] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input37 [ 783.663995][ T10] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 784.222690][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 784.236719][ T10] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 784.246672][ T10] usb 6-1: config 0 has no interface number 0 [ 784.289169][ T10] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 784.320406][ T10] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 784.472844][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 784.489760][ T10] usb 6-1: Product: syz [ 784.554198][T10935] usbhid 7-1:0.0: can't add hid device: -71 [ 784.560194][T10935] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 784.604020][T10935] usb 7-1: USB disconnect, device number 6 [ 784.632736][ T10] usb 6-1: Manufacturer: syz [ 784.653321][ T10] usb 6-1: SerialNumber: syz [ 784.722857][ T10] usb 6-1: config 0 descriptor?? [ 784.893637][T15128] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 785.883079][T15128] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 786.376577][ T10] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 786.570564][ T10] asix 6-1:0.188: probe with driver asix failed with error -61 [ 787.892315][T15179] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2315'. [ 787.938199][T15180] netlink: 'syz.0.2310': attribute type 10 has an invalid length. [ 787.946099][T15180] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2310'. [ 788.252382][ T30] audit: type=1400 audit(1764717471.824:1101): avc: denied { create } for pid=15172 comm="syz.4.2315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 788.610219][ T30] audit: type=1400 audit(1764717472.524:1102): avc: denied { ioctl } for pid=15183 comm="syz.4.2316" path="/dev/usbmon7" dev="devtmpfs" ino=737 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 788.669727][T14181] usb 6-1: USB disconnect, device number 20 [ 789.067036][T10935] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 789.623430][ T10] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 789.686942][T10935] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 789.750657][T10935] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 789.773399][T14181] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 789.912379][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 789.922639][T10935] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 789.923545][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 789.957828][T10935] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.976481][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 789.988066][T10935] usb 1-1: config 0 descriptor?? [ 790.039133][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 790.058967][ T10] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 790.079295][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.092835][T14181] usb 5-1: config 0 has an invalid interface number: 133 but max is 0 [ 790.109614][T14181] usb 5-1: config 0 has no interface number 0 [ 790.113036][ T10] usb 6-1: config 0 descriptor?? [ 790.379894][T15212] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 790.398577][T14181] usb 5-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 790.410665][T14181] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.419127][T14181] usb 5-1: Product: syz [ 790.423626][T14181] usb 5-1: Manufacturer: syz [ 790.428213][T14181] usb 5-1: SerialNumber: syz [ 790.435503][T14181] usb 5-1: config 0 descriptor?? [ 790.563394][ T30] audit: type=1400 audit(1764717474.434:1103): avc: denied { append } for pid=15209 comm="syz.6.2325" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 790.781668][T10935] arvo 0003:1E7D:30D4.0012: unknown main item tag 0x0 [ 790.789501][T15201] random: crng reseeded on system resumption [ 790.809033][T15201] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2322'. [ 790.833887][ T30] audit: type=1400 audit(1764717474.704:1104): avc: denied { read } for pid=15198 comm="syz.5.2322" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 790.884753][T15201] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 790.895360][T15201] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.203265][T15193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.244889][T15193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.247045][T14181] keyspan 5-1:0.133: Keyspan 1 port adapter converter detected [ 791.262612][T10935] arvo 0003:1E7D:30D4.0012: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.0-1/input0 [ 791.283617][ T30] audit: type=1400 audit(1764717474.824:1105): avc: denied { bind } for pid=15198 comm="syz.5.2322" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 791.306099][ T10] input: HID 0955:7214 Haptics as /devices/virtual/input/input38 [ 791.353255][T14181] keyspan 5-1:0.133: found no endpoint descriptor for endpoint 81 [ 791.364568][T14181] keyspan 5-1:0.133: found no endpoint descriptor for endpoint 1 [ 791.373832][T14181] keyspan 5-1:0.133: found no endpoint descriptor for endpoint 2 [ 791.383230][T14181] usb 5-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 791.431750][T15216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.456383][T15216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.466649][ T30] audit: type=1400 audit(1764717474.824:1106): avc: denied { node_bind } for pid=15198 comm="syz.5.2322" saddr=fec0:ffff::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 791.519170][T15193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.549217][ T10] shield 0003:0955:7214.0011: Registered Thunderstrike controller [ 791.569283][ T30] audit: type=1400 audit(1764717475.254:1107): avc: denied { mounton } for pid=15192 comm="syz.0.2320" path=2F3334362FE91F7189591E9233614B dev="tmpfs" ino=1884 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 791.596642][ T10] shield 0003:0955:7214.0011: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.5-1/input0 [ 791.640612][T15193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.687420][T10935] arvo 0003:1E7D:30D4.0012: couldn't init struct arvo_device [ 791.743780][T10935] arvo 0003:1E7D:30D4.0012: couldn't install keyboard [ 791.805590][T10935] arvo 0003:1E7D:30D4.0012: probe with driver arvo failed with error -71 [ 791.826332][T10935] usb 1-1: USB disconnect, device number 75 [ 791.913619][T12493] usb 5-1: USB disconnect, device number 67 [ 791.924753][T12493] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 791.936216][T12493] keyspan 5-1:0.133: device disconnected [ 791.969147][ T30] audit: type=1800 audit(1764717475.884:1108): pid=15225 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.2329" name="file1" dev="overlay" ino=2550 res=0 errno=0 [ 791.969953][T15225] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 792.285981][T15234] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2331'. [ 792.314060][ T5902] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 792.334109][T12493] usb 6-1: USB disconnect, device number 21 [ 792.353343][ T5902] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 792.370909][ T5902] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 792.484215][ T5902] shield 0003:0955:7214.0011: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 792.833474][T15239] netlink: 'syz.3.2330': attribute type 10 has an invalid length. [ 792.844312][T15239] netlink: 228 bytes leftover after parsing attributes in process `syz.3.2330'. [ 793.707433][T15251] veth0_to_bridge: entered promiscuous mode [ 794.819568][T15261] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 795.403757][T15247] veth0_to_bridge: left promiscuous mode [ 795.437316][T15267] bridge_slave_0: left allmulticast mode [ 795.445535][T15267] bridge_slave_0: left promiscuous mode [ 795.494242][T15267] bridge0: port 1(bridge_slave_0) entered disabled state [ 795.737693][T15267] bridge_slave_1: left allmulticast mode [ 795.793368][T15267] bridge_slave_1: left promiscuous mode [ 795.799280][T15267] bridge0: port 2(bridge_slave_1) entered disabled state [ 795.824131][T15267] bond0: (slave bond_slave_0): Releasing backup interface [ 795.977280][T15267] bond0: (slave bond_slave_1): Releasing backup interface [ 796.187214][T15267] team0: Port device team_slave_0 removed [ 796.295447][T15267] team0: Port device team_slave_1 removed [ 796.342946][T15267] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 796.373126][T15267] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 796.412237][T15267] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 796.431271][T15267] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 796.464624][T15267] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 796.525017][T15279] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2341'. [ 796.891751][T15292] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2346'. [ 797.179393][ T30] audit: type=1400 audit(1764717481.084:1109): avc: denied { map } for pid=15286 comm="syz.4.2347" path="socket:[50438]" dev="sockfs" ino=50438 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 797.265268][ T30] audit: type=1400 audit(1764717481.084:1110): avc: denied { accept } for pid=15286 comm="syz.4.2347" path="socket:[50438]" dev="sockfs" ino=50438 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 798.027958][T15303] bridge1: entered allmulticast mode [ 799.433287][ T5930] usb 1-1: new full-speed USB device number 76 using dummy_hcd [ 799.463367][ T5902] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 799.605318][ T5930] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 4 [ 799.620217][ T5930] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 13368, setting to 1023 [ 799.634255][ T5902] usb 7-1: Using ep0 maxpacket: 16 [ 799.664916][ T5902] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 799.678295][ T5930] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 799.699673][ T5902] usb 7-1: config 0 interface 0 has no altsetting 0 [ 799.708592][ T5930] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 799.726178][ T5902] usb 7-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 799.738848][ T5930] usb 1-1: config 0 descriptor?? [ 799.748268][ T5902] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 799.774702][ T5902] usb 7-1: config 0 descriptor?? [ 799.795107][T15336] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2305 sclass=netlink_route_socket pid=15336 comm=syz.3.2357 [ 799.976312][ T5930] ath6kl: Failed to submit usb control message: -71 [ 799.999544][ T5930] ath6kl: unable to send the bmi data to the device: -71 [ 800.020245][ T5930] ath6kl: Unable to send get target info: -71 [ 800.099627][ T5930] ath6kl: Failed to init ath6kl core: -71 [ 800.124748][ T5930] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 800.157731][ T5930] usb 1-1: USB disconnect, device number 76 [ 800.490643][ T5902] nzxt-smart2 0003:1E71:2009.0013: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.6-1/input0 [ 800.846041][T10935] usb 7-1: USB disconnect, device number 7 [ 801.947124][T15372] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2368'. [ 802.012664][ T30] audit: type=1400 audit(1764717485.914:1111): avc: denied { ioctl } for pid=15369 comm="syz.5.2369" path="socket:[50679]" dev="sockfs" ino=50679 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 802.037533][ C1] vkms_vblank_simulate: vblank timer overrun [ 802.072634][ T30] audit: type=1400 audit(1764717485.914:1112): avc: denied { read } for pid=15369 comm="syz.5.2369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 802.281289][T10935] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 802.367650][T15382] fuse: Bad value for 'fd' [ 802.382771][T15382] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2372'. [ 802.399290][T15382] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2372'. [ 802.411850][T10935] usb 6-1: device descriptor read/64, error -71 [ 802.451494][ T931] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 802.673837][ T931] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 802.684871][ T931] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 802.703464][ T931] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 802.712708][T10935] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 802.773005][T15387] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2373'. [ 803.202474][ T931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 803.258124][ T931] usb 4-1: config 0 descriptor?? [ 803.321289][T10935] usb 6-1: device descriptor read/64, error -71 [ 803.449040][T10935] usb usb6-port1: attempt power cycle [ 803.925921][ T931] arvo 0003:1E7D:30D4.0014: unknown main item tag 0x0 [ 804.042306][ T931] arvo 0003:1E7D:30D4.0014: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.3-1/input0 [ 804.091155][T10935] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 804.123413][T10935] usb 6-1: device descriptor read/8, error -71 [ 804.136234][ T931] arvo 0003:1E7D:30D4.0014: couldn't init struct arvo_device [ 804.161395][ T931] arvo 0003:1E7D:30D4.0014: couldn't install keyboard [ 804.218212][ T931] arvo 0003:1E7D:30D4.0014: probe with driver arvo failed with error -71 [ 804.501159][T10935] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 804.572128][ T931] usb 4-1: USB disconnect, device number 76 [ 804.593503][T10935] usb 6-1: device descriptor read/8, error -71 [ 804.711583][T10935] usb usb6-port1: unable to enumerate USB device [ 804.916241][ T30] audit: type=1400 audit(1764717488.834:1113): avc: denied { connect } for pid=15408 comm="syz.6.2380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 804.994482][T15410] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 805.101124][ T931] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 805.163607][ T5902] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 805.443628][ T5902] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 805.536557][ T5902] usb 5-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= e.b7 [ 805.764220][ T5902] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 805.884193][ T5902] usb 5-1: config 0 descriptor?? [ 805.920892][ T5902] usbserial_generic 5-1:0.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 805.953994][ T5902] usbserial_generic 5-1:0.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 805.979660][ T5902] usbserial_generic 5-1:0.0: device has no bulk endpoints [ 806.163944][ T931] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 806.192113][ T931] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 806.305553][T15420] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2382'. [ 806.590251][ T931] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 806.624931][ T931] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 806.650082][ T931] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 806.679685][ T24] usb 5-1: USB disconnect, device number 68 [ 806.689726][ T931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.932803][ T931] usb 4-1: config 0 descriptor?? [ 807.184010][T15427] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 807.226909][ T931] hdpvr 4-1:0.0: firmware version 0x0 dated [ 807.234417][ T931] hdpvr 4-1:0.0: untested firmware, the driver might not work. [ 807.628162][T15405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 807.668813][T15405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.900122][ T931] hdpvr 4-1:0.0: Could not setup controls [ 808.007471][ T931] hdpvr 4-1:0.0: registering videodev failed [ 808.224766][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.789196][ T931] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -71 [ 808.894561][ T931] usb 4-1: USB disconnect, device number 77 [ 809.567068][T15456] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 809.806365][T15463] FAULT_INJECTION: forcing a failure. [ 809.806365][T15463] name failslab, interval 1, probability 0, space 0, times 0 [ 809.827205][T15463] CPU: 1 UID: 0 PID: 15463 Comm: syz.0.2394 Not tainted syzkaller #0 PREEMPT(full) [ 809.827233][T15463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 809.827245][T15463] Call Trace: [ 809.827251][T15463] [ 809.827259][T15463] dump_stack_lvl+0x16c/0x1f0 [ 809.827281][T15463] should_fail_ex+0x512/0x640 [ 809.827307][T15463] ? find_held_lock+0x2b/0x80 [ 809.827327][T15463] should_failslab+0xc2/0x120 [ 809.827349][T15463] kmem_cache_alloc_node_noprof+0x78/0x760 [ 809.827376][T15463] ? __alloc_skb+0x2b2/0x380 [ 809.827405][T15463] ? __alloc_skb+0x2b2/0x380 [ 809.827426][T15463] __alloc_skb+0x2b2/0x380 [ 809.827449][T15463] ? __pfx___alloc_skb+0x10/0x10 [ 809.827478][T15463] ? kobject_put+0xab/0x590 [ 809.827500][T15463] create_monitor_ctrl_close+0xc2/0x500 [ 809.827528][T15463] ? hci_dev_open+0x1f1/0x330 [ 809.827547][T15463] hci_sock_bind+0x12d6/0x14e0 [ 809.827565][T15463] ? __pfx_hci_sock_bind+0x10/0x10 [ 809.827591][T15463] __sys_bind+0x1a7/0x260 [ 809.827615][T15463] ? __pfx___sys_bind+0x10/0x10 [ 809.827634][T15463] ? __fget_files+0x20e/0x3c0 [ 809.827666][T15463] ? __pfx_ksys_write+0x10/0x10 [ 809.827692][T15463] __x64_sys_bind+0x72/0xb0 [ 809.827712][T15463] ? lockdep_hardirqs_on+0x7c/0x110 [ 809.827730][T15463] do_syscall_64+0xcd/0xf80 [ 809.827749][T15463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.827766][T15463] RIP: 0033:0x7fb58b78f749 [ 809.827782][T15463] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 809.827798][T15463] RSP: 002b:00007fb58c65f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 809.827816][T15463] RAX: ffffffffffffffda RBX: 00007fb58b9e5fa0 RCX: 00007fb58b78f749 [ 809.827828][T15463] RDX: 0000000000000006 RSI: 0000200000000040 RDI: 0000000000000006 [ 809.827839][T15463] RBP: 00007fb58c65f090 R08: 0000000000000000 R09: 0000000000000000 [ 809.827849][T15463] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 809.827858][T15463] R13: 00007fb58b9e6038 R14: 00007fb58b9e5fa0 R15: 00007fff0f586c58 [ 809.827885][T15463] [ 810.428229][T15473] netlink: 'syz.4.2392': attribute type 10 has an invalid length. [ 810.436179][T15473] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2392'. [ 810.850713][T15474] autofs: Unknown parameter 'fd0x0000000000000000' [ 812.071304][ T5931] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 812.424440][T15490] input: syz1 as /devices/virtual/input/input39 [ 812.508438][ T5931] usb 6-1: device descriptor read/64, error -71 [ 813.321095][ T5931] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 813.581151][ T5931] usb 6-1: device descriptor read/64, error -71 [ 813.728377][ T5931] usb usb6-port1: attempt power cycle [ 813.819229][T15511] netlink: 'syz.0.2408': attribute type 10 has an invalid length. [ 813.872520][T15511] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2408'. [ 814.111312][ T5931] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 814.779343][ T5931] usb 6-1: device descriptor read/8, error -71 [ 815.561142][T14181] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 815.761154][T14181] usb 7-1: Using ep0 maxpacket: 32 [ 815.766305][T15537] program syz.5.2416 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 815.925063][ T5930] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 815.980960][T14181] usb 7-1: config 0 has an invalid interface number: 35 but max is 0 [ 815.991148][T14181] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 816.022241][T14181] usb 7-1: config 0 has no interface number 0 [ 816.028663][T14181] usb 7-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 816.086381][ T5930] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 816.102530][T14181] usb 7-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 816.107715][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.121152][T14181] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.134723][ T5930] usb 1-1: Product: syz [ 816.153626][ T5930] usb 1-1: Manufacturer: syz [ 816.159890][ T5930] usb 1-1: SerialNumber: syz [ 816.161068][T14181] usb 7-1: Product: syz [ 816.168647][T14181] usb 7-1: Manufacturer: syz [ 816.195171][ T5930] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 816.195809][T14181] usb 7-1: SerialNumber: syz [ 816.228306][T12493] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 816.231690][T14181] usb 7-1: config 0 descriptor?? [ 816.765642][T14181] radio-si470x 7-1:0.35: could not find interrupt in endpoint [ 816.798776][T14181] radio-si470x 7-1:0.35: probe with driver radio-si470x failed with error -5 [ 816.853717][T14181] radio-raremono 7-1:0.35: this is not Thanko's Raremono. [ 816.878947][T14181] usbhid 7-1:0.35: couldn't find an input interrupt endpoint [ 817.093530][T15525] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2412'. [ 817.436894][T12493] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 817.503840][T12493] ath9k_htc: Failed to initialize the device [ 817.534457][T12493] usb 1-1: ath9k_htc: USB layer deinitialized [ 818.599778][ T931] usb 1-1: USB disconnect, device number 77 [ 819.792443][T14181] usb 7-1: USB disconnect, device number 8 [ 819.868822][T15567] hub 1-0:1.0: USB hub found [ 819.877646][T15567] hub 1-0:1.0: 1 port detected [ 821.684497][T15589] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2430'. [ 821.748160][T15589] netlink: 'syz.6.2430': attribute type 1 has an invalid length. [ 821.770670][T15589] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2430'. [ 821.797731][T15592] tipc: Started in network mode [ 821.803970][T15592] tipc: Node identity ced2c8e931eb, cluster identity 4711 [ 821.813680][T15592] tipc: Enabled bearer , priority 0 [ 821.820957][T15592] syzkaller0: entered promiscuous mode [ 821.828058][T15592] syzkaller0: entered allmulticast mode [ 821.853433][T15592] tipc: Resetting bearer [ 821.897751][T15590] tipc: Resetting bearer [ 821.925443][T15590] tipc: Disabling bearer [ 822.202707][T12493] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 823.099028][ T30] audit: type=1400 audit(1764717507.014:1114): avc: denied { write } for pid=15604 comm="syz.5.2436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 823.265123][T12493] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 823.305494][T12493] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.314455][T15616] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 823.314498][T15616] overlayfs: missing 'lowerdir' [ 823.363140][T12493] usb 4-1: Product: syz [ 823.414520][T12493] usb 4-1: Manufacturer: syz [ 823.419150][T12493] usb 4-1: SerialNumber: syz [ 823.456532][T12493] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 823.506704][ T5930] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 824.189587][ T30] audit: type=1400 audit(1764717508.104:1115): avc: denied { write } for pid=15613 comm="syz.6.2438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 824.603676][ T5930] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 824.610838][ T5930] ath9k_htc: Failed to initialize the device [ 824.657415][ T5930] usb 4-1: ath9k_htc: USB layer deinitialized [ 825.584209][ T5931] usb 4-1: USB disconnect, device number 78 [ 825.695972][T15634] program syz.6.2444 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 825.842633][T15636] lo speed is unknown, defaulting to 1000 [ 825.848703][T15636] lo speed is unknown, defaulting to 1000 [ 825.859254][T15636] lo speed is unknown, defaulting to 1000 [ 825.892143][T15636] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 825.952677][T15637] fuse: Unknown parameter '' [ 825.972833][T15636] lo speed is unknown, defaulting to 1000 [ 825.982243][T15636] lo speed is unknown, defaulting to 1000 [ 825.992102][T15636] lo speed is unknown, defaulting to 1000 [ 826.002264][T15636] lo speed is unknown, defaulting to 1000 [ 826.012053][T15636] lo speed is unknown, defaulting to 1000 [ 826.920293][T15644] erspan0: entered promiscuous mode [ 826.944136][T15644] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2446'. [ 826.971807][T15644] erspan0: left promiscuous mode [ 827.242050][ T5931] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 827.401401][ T5931] usb 5-1: device descriptor read/64, error -71 [ 827.571103][ T931] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 828.257338][ T5931] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 828.337454][T15661] tipc: Enabling of bearer <õdp:syz1> rejected, media not registered [ 828.401242][ T5931] usb 5-1: device descriptor read/64, error -71 [ 828.422464][ T931] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 828.454153][ T931] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 828.481638][ T931] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.507264][ T931] usb 7-1: config 0 descriptor?? [ 828.509275][T15668] program syz.5.2455 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 828.513034][ T5931] usb usb5-port1: attempt power cycle [ 828.724025][ T931] usbhid 7-1:0.0: can't add hid device: -71 [ 828.730110][ T931] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 828.740481][ T931] usb 7-1: USB disconnect, device number 9 [ 829.161116][ T5931] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 829.201717][ T5931] usb 5-1: device descriptor read/8, error -71 [ 829.431420][T14181] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 829.481232][ T931] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 829.568715][ T5931] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 829.591678][ T5931] usb 5-1: device descriptor read/8, error -71 [ 829.654940][T14181] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 829.671126][T14181] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.679262][T14181] usb 4-1: Product: syz [ 829.689691][T14181] usb 4-1: Manufacturer: syz [ 829.699464][T14181] usb 4-1: SerialNumber: syz [ 829.724724][ T5931] usb usb5-port1: unable to enumerate USB device [ 829.760169][ T931] usb 7-1: Using ep0 maxpacket: 32 [ 829.774492][T14181] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 829.785508][ T931] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 829.810533][ T931] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 829.820651][ T931] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.856038][ T5931] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 829.867195][ T931] usb 7-1: config 0 descriptor?? [ 829.878316][ T931] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 829.929324][ T931] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 830.921135][ T5931] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 830.963153][ T5931] ath9k_htc: Failed to initialize the device [ 831.134979][T15679] netlink: 'syz.3.2457': attribute type 4 has an invalid length. [ 831.165763][T15706] EXT4-fs (nullb0): VFS: Can't find ext4 filesystem [ 831.478457][T15702] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 831.512895][T15705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 831.513385][ T5931] usb 4-1: ath9k_htc: USB layer deinitialized [ 831.560312][T15705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 831.655919][ T5930] usb 7-1: USB disconnect, device number 10 [ 831.675229][ T5930] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 831.806503][T15710] tipc: Started in network mode [ 831.894123][ T5902] usb 4-1: USB disconnect, device number 79 [ 831.919474][T15710] tipc: Node identity e0000001, cluster identity 4711 [ 831.968433][T15710] tipc: Enabling of bearer rejected, failed to enable media [ 832.048549][T15711] Sensor B: ================= START STATUS ================= [ 832.061222][T15711] Sensor B: Test Pattern: 75% Colorbar [ 832.067860][T15711] Sensor B: Show Information: All [ 832.084592][T15711] Sensor B: Vertical Flip: false [ 832.093470][T15711] Sensor B: Horizontal Flip: false [ 832.098733][T15711] Sensor B: Brightness: 128 [ 832.106810][T15711] Sensor B: Contrast: 128 [ 832.118777][T15711] Sensor B: Hue: 0 [ 832.132542][T15711] Sensor B: Saturation: 128 [ 832.137887][T15711] Sensor B: ================== END STATUS ================== [ 832.722544][T15709] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.429261][T15731] program syz.4.2470 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 834.167615][ T30] audit: type=1800 audit(1764717517.994:1116): pid=15741 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.2475" name="bus" dev="overlay" ino=2720 res=0 errno=0 [ 834.731105][ T5931] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 834.991259][ T5931] usb 1-1: Using ep0 maxpacket: 8 [ 835.258001][ T5931] usb 1-1: unable to get BOS descriptor or descriptor too short [ 835.277319][T15753] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2478'. [ 835.292683][T15753] netlink: 'syz.3.2478': attribute type 1 has an invalid length. [ 835.293017][ T5931] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 835.300527][T15753] netlink: 'syz.3.2478': attribute type 2 has an invalid length. [ 835.408137][ T5931] usb 1-1: can't read configurations, error -71 [ 835.524220][ T5930] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 835.724026][ T5930] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 835.790028][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.909206][ T5930] usb 6-1: Product: syz [ 835.944856][ T5930] usb 6-1: Manufacturer: syz [ 835.985839][T15761] trusted_key: encrypted_key: keyword 'mew' not recognized [ 836.008057][ T5930] usb 6-1: SerialNumber: syz [ 836.026712][T15762] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.2482'. [ 836.120601][ T5930] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 836.215483][T15759] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.2482'. [ 836.348233][ T5902] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 836.393487][T15761] xt_CT: You must specify a L4 protocol and not use inversions on it [ 836.671764][T15767] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 837.483999][ T5902] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 837.897979][ T5902] ath9k_htc: Failed to initialize the device [ 838.296245][ T5902] usb 6-1: ath9k_htc: USB layer deinitialized [ 838.657879][T15782] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2487'. [ 839.843538][ T931] usb 6-1: USB disconnect, device number 30 [ 840.111350][ T5931] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 840.213652][T15798] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2494'. [ 840.267977][T15796] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 840.313105][ T5931] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 840.327436][ T5931] usb 5-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= e.b7 [ 840.361493][ T5931] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 840.695390][ T5931] usb 5-1: config 0 descriptor?? [ 840.719559][ T5931] usbserial_generic 5-1:0.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 840.745865][ T5931] usbserial_generic 5-1:0.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 840.765288][ T5931] usbserial_generic 5-1:0.0: device has no bulk endpoints [ 840.966235][T15805] ptrace attach of "./syz-executor exec"[14209] was attempted by " [ 841.123177][ T5902] usb 5-1: USB disconnect, device number 73 [ 841.512205][ T5930] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 841.558192][ T30] audit: type=1400 audit(1764717525.474:1117): avc: denied { setattr } for pid=15810 comm="syz.0.2499" name="ptmx" dev="devtmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 841.675227][ T5930] usb 4-1: Using ep0 maxpacket: 32 [ 841.699292][ T5930] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 841.715841][ T5930] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 841.733629][ T5930] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 841.794994][ T5930] usb 4-1: config 1 has no interface number 0 [ 841.834417][ T5931] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 841.850884][ T5930] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 841.967497][ T5930] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 842.032482][ T5931] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 842.055867][ T5930] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 842.070047][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.098847][ T5931] usb 1-1: Product: syz [ 842.108925][ T5931] usb 1-1: Manufacturer: syz [ 842.116501][ T5930] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.119267][ T5931] usb 1-1: SerialNumber: syz [ 842.146719][ T5930] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 842.174372][ T5931] usb 1-1: config 0 descriptor?? [ 842.221131][T14181] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 842.346894][ T5930] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 842.405260][ T5931] usb-storage 1-1:0.0: USB Mass Storage device detected [ 842.422320][T14181] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 842.434134][T14181] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.445059][T14181] usb 5-1: Product: syz [ 842.452129][T14181] usb 5-1: Manufacturer: syz [ 842.582024][T14181] usb 5-1: SerialNumber: syz [ 842.856490][T14181] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 842.867613][ T5931] usb 1-1: USB disconnect, device number 80 [ 842.904983][ T931] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 842.979749][T15833] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2506'. [ 843.099982][T15807] ipip0: entered promiscuous mode [ 843.106946][T15807] ipip0: entered allmulticast mode [ 843.140757][T15807] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15807 comm=syz.3.2497 [ 843.194207][T15837] overlay: Unknown parameter 'uid>00000000000000000000' [ 843.207804][ T5930] usb 4-1: USB disconnect, device number 80 [ 843.323898][ T5930] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 843.744756][T15820] netlink: 'syz.4.2503': attribute type 4 has an invalid length. [ 843.785682][T14181] usb 5-1: USB disconnect, device number 74 [ 843.830679][T15849] netlink: 2 bytes leftover after parsing attributes in process `syz.5.2508'. [ 844.254761][T15858] 9pnet_fd: Insufficient options for proto=fd [ 844.469355][T15865] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 844.626859][ T931] usb 5-1: Service connection timeout for: 256 [ 844.932968][ T931] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 844.994474][ T931] ath9k_htc: Failed to initialize the device [ 845.011875][T14181] usb 5-1: ath9k_htc: USB layer deinitialized [ 845.298854][T15882] binder: 15871:15882 ioctl 8912 200000000100 returned -22 [ 846.134317][T15897] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 846.363429][ T5930] usb 5-1: new full-speed USB device number 75 using dummy_hcd [ 846.909416][ T5930] usb 5-1: config 0 has an invalid interface number: 17 but max is 0 [ 846.943365][ T5930] usb 5-1: config 0 has no interface number 0 [ 846.991641][T15907] input: syz1 as /devices/virtual/input/input40 [ 847.055998][ T5930] usb 5-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 847.117390][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.158532][ T5930] usb 5-1: Product: syz [ 847.164241][ T5930] usb 5-1: Manufacturer: syz [ 847.179008][ T5930] usb 5-1: SerialNumber: syz [ 847.207228][T15912] 9pnet_fd: Insufficient options for proto=fd [ 847.273759][ T5930] usb 5-1: config 0 descriptor?? [ 847.275854][T15915] overlayfs: overlapping lowerdir path [ 848.705402][T15892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2520'. [ 848.740403][T15930] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 848.778423][ T5930] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 found [ 848.985838][ T5930] usb 5-1: selecting invalid altsetting 5 [ 849.013600][ T5930] snd_usb_podhd 5-1:0.17: set_interface failed [ 849.030199][ T5930] snd_usb_podhd 5-1:0.17: Line 6 POD HD300 now disconnected [ 849.166726][ T5930] snd_usb_podhd 5-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 849.190299][ T5930] usb 5-1: USB disconnect, device number 75 [ 849.304738][T15945] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2531'. [ 849.541098][T14181] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 849.715358][T14181] usb 7-1: config 12 has an invalid interface number: 64 but max is 1 [ 849.748852][T14181] usb 7-1: config 12 has an invalid interface number: 91 but max is 1 [ 849.789863][T14181] usb 7-1: config 12 has no interface number 0 [ 849.824595][T14181] usb 7-1: config 12 has no interface number 1 [ 849.917890][T15955] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 850.287842][T14181] usb 7-1: config 12 interface 91 altsetting 7 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 850.300613][T14181] usb 7-1: config 12 interface 64 has no altsetting 0 [ 850.307562][T14181] usb 7-1: config 12 interface 91 has no altsetting 0 [ 850.349664][T14181] usb 7-1: New USB device found, idVendor=2040, idProduct=000f, bcdDevice= 0.00 [ 850.380020][T14181] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 850.409971][T14181] usb 7-1: Product: syz [ 850.423492][T14181] usb 7-1: Manufacturer: syz [ 850.437602][T14181] usb 7-1: SerialNumber: syz [ 850.481635][T14181] usb 7-1: Interface #91 referenced by multiple IADs [ 850.722531][T15944] netlink: 15110 bytes leftover after parsing attributes in process `syz.6.2532'. [ 851.741758][T14181] usb 7-1: USB disconnect, device number 11 [ 852.394075][ T30] audit: type=1400 audit(1764717536.294:1118): avc: denied { read open } for pid=15983 comm="syz.5.2541" path="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 852.672476][ T5902] usb 6-1: new low-speed USB device number 31 using dummy_hcd [ 852.825518][ T5902] usb 6-1: Invalid ep0 maxpacket: 32 [ 852.881200][T14181] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 852.920550][T15982] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 852.962783][ T5902] usb 6-1: new low-speed USB device number 32 using dummy_hcd [ 853.063908][T14181] usb 7-1: config 0 has an invalid interface number: 17 but max is 0 [ 853.083430][T14181] usb 7-1: config 0 has no interface number 0 [ 853.096295][T14181] usb 7-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 853.112849][T14181] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.123737][ T5902] usb 6-1: Invalid ep0 maxpacket: 32 [ 853.139652][ T5902] usb usb6-port1: attempt power cycle [ 853.141114][T14181] usb 7-1: Product: syz [ 853.159813][T14181] usb 7-1: Manufacturer: syz [ 853.171736][T14181] usb 7-1: SerialNumber: syz [ 853.187469][T14181] usb 7-1: config 0 descriptor?? [ 853.415471][T15995] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2543'. [ 853.471337][T16004] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2546'. [ 853.494925][ T5902] usb 6-1: new low-speed USB device number 33 using dummy_hcd [ 853.550010][ T5902] usb 6-1: Invalid ep0 maxpacket: 32 [ 853.704469][ T5902] usb 6-1: new low-speed USB device number 34 using dummy_hcd [ 853.743506][ T5902] usb 6-1: Invalid ep0 maxpacket: 32 [ 854.200467][ T5902] usb usb6-port1: unable to enumerate USB device [ 854.465717][ T30] audit: type=1400 audit(1764717538.384:1119): avc: denied { getopt } for pid=16014 comm="syz.4.2550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 855.552944][T16020] netlink: 196 bytes leftover after parsing attributes in process `syz.3.2552'. [ 856.892189][ T931] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 857.505268][ T931] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 857.772817][ T931] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.816790][ T931] usb 6-1: Product: syz [ 857.820987][ T931] usb 6-1: Manufacturer: syz [ 857.855762][ T931] usb 6-1: SerialNumber: syz [ 857.917819][ T931] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 857.947834][ T5931] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 858.305431][T14181] snd_usb_podhd 7-1:0.17: Line 6 POD HD300 found [ 858.369493][T14181] usb 7-1: selecting invalid altsetting 5 [ 858.447467][T14181] snd_usb_podhd 7-1:0.17: set_interface failed [ 858.961358][T14181] snd_usb_podhd 7-1:0.17: Line 6 POD HD300 now disconnected [ 858.968973][T14181] snd_usb_podhd 7-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 859.011200][ T5931] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 859.018318][ T5931] ath9k_htc: Failed to initialize the device [ 859.114309][ T5931] usb 6-1: ath9k_htc: USB layer deinitialized [ 859.173770][T14181] usb 7-1: USB disconnect, device number 12 [ 859.921829][ T931] usb 6-1: USB disconnect, device number 35 [ 860.152322][T14181] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 860.391258][ T30] audit: type=1400 audit(1764717544.304:1120): avc: denied { audit_read } for pid=16065 comm="syz.3.2568" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 860.393679][T16066] overlay: Unknown parameter 'euid' [ 860.623884][T14181] usb 7-1: Using ep0 maxpacket: 16 [ 860.630331][T16069] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2569'. [ 860.657401][T14181] usb 7-1: config 0 has an invalid interface number: 8 but max is 0 [ 860.688720][T16071] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 860.704961][T14181] usb 7-1: config 0 has an invalid descriptor of length 33, skipping remainder of the config [ 860.704986][T14181] usb 7-1: config 0 has no interface number 0 [ 860.705021][T14181] usb 7-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 860.706466][T14181] usb 7-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 860.706491][T14181] usb 7-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 860.706511][T14181] usb 7-1: Product: syz [ 860.706526][T14181] usb 7-1: SerialNumber: syz [ 860.708438][T14181] usb 7-1: config 0 descriptor?? [ 861.115991][T16081] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 861.153329][T14181] usbhid 7-1:0.8: couldn't find an input interrupt endpoint [ 861.235970][T16084] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 861.519798][T14181] usb 7-1: USB disconnect, device number 13 [ 864.771083][ T931] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 865.272570][ T931] usb 6-1: too many endpoints for config 0 interface 0 altsetting 1: 65, using maximum allowed: 30 [ 865.287165][T16130] binder: 16129:16130 ioctl c0306201 200000000040 returned -22 [ 865.296735][T16130] binder: 16129:16130 ioctl c0306201 200000000640 returned -22 [ 865.327736][ T931] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 865.358487][ T931] usb 6-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 865.387539][ T931] usb 6-1: config 0 interface 0 has no altsetting 0 [ 865.407695][ T931] usb 6-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 865.427583][ T931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.469390][ T931] usb 6-1: config 0 descriptor?? [ 865.742894][T12493] hid-generic FFFF:0008:0003.0015: item fetching failed at offset 0/2 [ 865.753992][T12493] hid-generic FFFF:0008:0003.0015: probe with driver hid-generic failed with error -22 [ 866.463443][ T931] hid-multitouch 0003:1FD2:6007.0016: item fetching failed at offset 0/3 [ 866.464041][ T931] hid-multitouch 0003:1FD2:6007.0016: probe with driver hid-multitouch failed with error -22 [ 866.566838][T16125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.577745][T16125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.471157][T16145] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=65535 sclass=netlink_xfrm_socket pid=16145 comm=syz.3.2587 [ 868.122342][ T931] usb 6-1: USB disconnect, device number 36 [ 868.897192][T16159] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2595'. [ 869.086943][T16162] netlink: 'syz.0.2596': attribute type 17 has an invalid length. [ 869.096448][T16162] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2596'. [ 869.168789][T16162] macvtap0: entered allmulticast mode [ 869.180306][T16162] veth0_macvtap: entered allmulticast mode [ 869.209621][T16162] A link change request failed with some changes committed already. Interface macvtap0 may have been left with an inconsistent configuration, please check. [ 869.645086][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.751266][ T931] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 870.780623][T16171] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2599'. [ 870.951065][ T931] usb 1-1: Using ep0 maxpacket: 16 [ 870.957913][ T931] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 870.981746][ T931] usb 1-1: config 0 has an invalid descriptor of length 33, skipping remainder of the config [ 871.032404][ T931] usb 1-1: config 0 has no interface number 0 [ 871.038555][ T931] usb 1-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 871.064504][ T931] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 871.111134][ T931] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 871.144974][T11943] Bluetooth: hci5: unexpected event for opcode 0x1004 [ 871.154380][ T931] usb 1-1: Product: syz [ 871.174518][ T931] usb 1-1: SerialNumber: syz [ 871.195209][ T931] usb 1-1: config 0 descriptor?? [ 871.385072][ T24] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 871.611383][ T24] usb 7-1: device descriptor read/64, error -71 [ 871.642679][ T931] usbhid 1-1:0.8: couldn't find an input interrupt endpoint [ 871.662146][ T931] usb 1-1: USB disconnect, device number 81 [ 871.815025][T16198] netlink: 112 bytes leftover after parsing attributes in process `syz.5.2608'. [ 871.881180][ T24] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 872.995238][ T24] usb 7-1: device descriptor read/64, error -71 [ 873.419501][ T24] usb usb7-port1: attempt power cycle [ 873.460954][T16201] program syz.3.2609 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 873.520001][T16214] input: syz1 as /devices/virtual/input/input41 [ 873.871306][ T5931] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 873.874761][T16220] serio: Serial port ptm0 [ 873.878992][ T24] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 874.023583][ T24] usb 7-1: device descriptor read/8, error -71 [ 874.101337][ T5931] usb 1-1: Using ep0 maxpacket: 32 [ 874.125655][ T5931] usb 1-1: config 0 has an invalid interface number: 163 but max is 0 [ 874.157114][T16226] batman_adv: batadv0: Adding interface: dummy0 [ 874.180338][ T5931] usb 1-1: config 0 has no interface number 0 [ 874.196760][T16226] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 874.231335][ T5931] usb 1-1: config 0 interface 163 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 874.271223][ T5931] usb 1-1: config 0 interface 163 altsetting 0 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 874.311378][ T5931] usb 1-1: config 0 interface 163 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 874.313967][T16226] batman_adv: batadv0: Interface activated: dummy0 [ 874.324514][ T5931] usb 1-1: New USB device found, idVendor=0b3b, idProduct=5630, bcdDevice=b6.31 [ 874.340951][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.350191][ T5931] usb 1-1: Product: syz [ 874.354924][ T5931] usb 1-1: Manufacturer: syz [ 874.359571][ T5931] usb 1-1: SerialNumber: syz [ 874.377824][ T5931] usb 1-1: config 0 descriptor?? [ 874.391568][T14181] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 874.443681][T16229] batadv0: mtu less than device minimum [ 874.450204][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.461759][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.473115][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.484009][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.494827][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.505644][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.516464][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.527274][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.538091][T16229] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 874.570498][T16231] tipc: New replicast peer: 255.255.255.255 [ 874.577719][T16231] tipc: Enabled bearer , priority 10 [ 874.591529][T16231] block nbd6: not configured, cannot reconfigure [ 874.628292][T16231] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2618'. [ 874.641122][T14181] usb 6-1: Using ep0 maxpacket: 8 [ 874.648840][T14181] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x2 has an invalid bInterval 255, changing to 11 [ 874.677042][T14181] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x2 has invalid maxpacket 59391, setting to 1024 [ 874.698480][T14181] usb 6-1: config 0 interface 0 has no altsetting 0 [ 874.710772][T14181] usb 6-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 874.728095][T14181] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.742133][T14181] usb 6-1: Product: syz [ 874.746380][T14181] usb 6-1: Manufacturer: syz [ 874.751543][T14181] usb 6-1: SerialNumber: syz [ 874.759234][T14181] usb 6-1: config 0 descriptor?? [ 874.766738][T16223] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 874.777388][T14181] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 found [ 874.912377][T16239] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2619'. [ 874.985818][T16223] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 874.996376][T14181] snd_usb_toneport 6-1:0.0: cannot get proper max packet size [ 875.021518][T14181] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 now disconnected [ 875.030532][T16239] bridge_slave_1: entered allmulticast mode [ 875.031971][T14181] snd_usb_toneport 6-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 875.071902][ T24] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 875.122127][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 875.134522][ T24] usb 7-1: config 9 has an invalid interface number: 64 but max is 0 [ 875.145527][ T24] usb 7-1: config 9 has no interface number 0 [ 875.155007][ T24] usb 7-1: config 9 interface 64 has no altsetting 0 [ 875.163086][T11943] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 875.165981][ T24] usb 7-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=1e.21 [ 875.175102][T11943] Bluetooth: hci5: Injecting HCI hardware error event [ 875.186882][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.226833][T16248] program syz.3.2620 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 875.249257][ T24] usb 7-1: Product: syz [ 875.364910][ T24] usb 7-1: Manufacturer: syz [ 875.369848][ T24] usb 7-1: SerialNumber: syz [ 875.693830][T14181] tipc: Node number set to 3758096385 [ 875.724005][ T24] cxacru 7-1:9.64: cxacru_bind: interface has incorrect endpoints [ 875.752060][ T24] cxacru 7-1:9.64: usbatm_usb_probe: bind failed: -19! [ 875.802333][ T24] usb 7-1: USB disconnect, device number 17 [ 876.085346][T14181] usb 1-1: USB disconnect, device number 82 [ 877.049833][T12493] usb 6-1: USB disconnect, device number 37 [ 877.482189][T16273] netlink: 'syz.6.2626': attribute type 2 has an invalid length. [ 878.587108][T12493] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 878.640153][T16293] program syz.6.2632 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 879.037167][T12493] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 879.079863][T12493] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 879.156076][T12493] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 879.180881][T12493] usb 1-1: Product: syz [ 879.201127][ T5931] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 879.212834][T12493] usb 1-1: Manufacturer: syz [ 879.224158][T12493] usb 1-1: SerialNumber: syz [ 879.375852][ T5931] usb 4-1: Using ep0 maxpacket: 8 [ 879.394776][ T5931] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 879.413209][ T5931] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 879.441382][ T5931] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 879.521037][ T5931] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 879.685989][T16312] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 880.057103][T12493] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 83 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 880.062238][ T5931] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 880.083917][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 880.347039][ C1] usblp0: nonzero write bulk status received: -71 [ 880.361330][T10935] usb 1-1: USB disconnect, device number 83 [ 880.367669][ T5931] usb 4-1: GET_CAPABILITIES returned 0 [ 880.547240][T10935] usblp0: removed [ 880.550973][ T5931] usbtmc 4-1:16.0: can't read capabilities [ 880.595387][ T5931] usb 4-1: USB disconnect, device number 81 [ 882.191354][ T5931] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 882.272792][T12493] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 882.371199][ T5931] usb 4-1: Using ep0 maxpacket: 32 [ 882.386049][ T5931] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 882.522647][T12493] usb 5-1: Using ep0 maxpacket: 16 [ 882.530123][T12493] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 882.540194][T12493] usb 5-1: can't read configurations, error -61 [ 882.553240][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.785282][ T5931] usb 4-1: config 0 descriptor?? [ 882.902789][T12493] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 883.037073][ T5931] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 883.062508][ T5931] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 883.073018][T12493] usb 5-1: Using ep0 maxpacket: 16 [ 883.095248][T12493] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 883.098863][ T5931] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 883.131185][ T5931] usb 4-1: media controller created [ 883.165396][ T5931] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 883.172929][T12493] usb 5-1: can't read configurations, error -61 [ 883.190339][T12493] usb usb5-port1: attempt power cycle [ 883.348553][ T30] audit: type=1400 audit(1764717567.264:1121): avc: denied { ioctl } for pid=16363 comm="syz.6.2653" path="socket:[56076]" dev="sockfs" ino=56076 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 883.672675][T16366] netlink: 21 bytes leftover after parsing attributes in process `syz.6.2653'. [ 883.721225][T12493] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 883.770053][ T5931] DVB: Unable to find symbol dib7000p_attach() [ 883.779604][T12493] usb 5-1: Using ep0 maxpacket: 16 [ 883.795291][T12493] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 883.808765][T12493] usb 5-1: can't read configurations, error -61 [ 883.874428][ T5931] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 884.251642][ T30] audit: type=1400 audit(1764717568.074:1122): avc: denied { map } for pid=16370 comm="syz.0.2655" path="socket:[54725]" dev="sockfs" ino=54725 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 884.275005][ T30] audit: type=1400 audit(1764717568.074:1123): avc: denied { read } for pid=16370 comm="syz.0.2655" path="socket:[54725]" dev="sockfs" ino=54725 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 884.384978][T12493] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 884.421384][ T5931] rc_core: IR keymap rc-dib0700-rc5 not found [ 884.434905][T12493] usb 5-1: Using ep0 maxpacket: 16 [ 884.447646][ T5931] Registered IR keymap rc-empty [ 884.453442][T12493] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 884.466994][ T5931] dvb-usb: could not initialize remote control. [ 884.480722][T12493] usb 5-1: can't read configurations, error -61 [ 884.506611][T12493] usb usb5-port1: unable to enumerate USB device [ 884.509501][ T5931] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 884.737595][ T24] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 884.951140][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 884.970007][T16391] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2661'. [ 884.978786][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 884.999966][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 885.039382][ T24] usb 7-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 885.064679][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.134548][ T24] usb 7-1: config 0 descriptor?? [ 885.696559][ T24] logitech 0003:046D:C29C.0017: hidraw0: USB HID vb4.30 Device [HID 046d:c29c] on usb-dummy_hcd.6-1/input0 [ 885.718279][T16410] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2666'. [ 886.218897][T16413] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2667'. [ 886.230974][T16413] netlink: 'syz.3.2667': attribute type 1 has an invalid length. [ 886.243317][T16413] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2667'. [ 886.302818][ T24] logitech 0003:046D:C29C.0017: no inputs found [ 886.342564][ T24] usb 7-1: USB disconnect, device number 18 [ 887.438531][T16419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.463487][ T30] audit: type=1800 audit(1764717571.384:1124): pid=16427 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.2673" name="bus" dev="overlay" ino=559 res=0 errno=0 [ 887.489389][T16427] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2673'. [ 887.556365][T16419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.593982][T16429] FAULT_INJECTION: forcing a failure. [ 887.593982][T16429] name failslab, interval 1, probability 0, space 0, times 0 [ 887.608414][T16429] CPU: 0 UID: 0 PID: 16429 Comm: syz.6.2673 Not tainted syzkaller #0 PREEMPT(full) [ 887.608439][T16429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 887.608449][T16429] Call Trace: [ 887.608456][T16429] [ 887.608463][T16429] dump_stack_lvl+0x16c/0x1f0 [ 887.608486][T16429] should_fail_ex+0x512/0x640 [ 887.608510][T16429] ? __kvmalloc_node_noprof+0x12e/0x9b0 [ 887.608538][T16429] should_failslab+0xc2/0x120 [ 887.608554][T16429] __kvmalloc_node_noprof+0x141/0x9b0 [ 887.608572][T16429] ? bpf_test_run_xdp_live+0x139/0x770 [ 887.608590][T16429] ? find_held_lock+0x2b/0x80 [ 887.608603][T16429] ? bpf_test_run_xdp_live+0x139/0x770 [ 887.608624][T16429] bpf_test_run_xdp_live+0x139/0x770 [ 887.608651][T16429] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 887.608677][T16429] ? find_held_lock+0x2b/0x80 [ 887.608693][T16429] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 887.608719][T16429] ? 0xffffffffa0205540 [ 887.608729][T16429] ? 0xffffffffa0205540 [ 887.608737][T16429] ? 0xffffffffa0205540 [ 887.608745][T16429] ? bpf_dispatcher_change_prog+0x54d/0xa80 [ 887.608766][T16429] bpf_prog_test_run_xdp+0xd38/0x1660 [ 887.608788][T16429] ? __fget_files+0x204/0x3c0 [ 887.608809][T16429] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 887.608826][T16429] ? __might_fault+0x10/0x190 [ 887.608845][T16429] ? fput+0x9b/0xd0 [ 887.608860][T16429] ? __bpf_prog_get+0x97/0x2a0 [ 887.608870][T16429] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 887.608881][T16429] __sys_bpf+0x1035/0x4980 [ 887.608897][T16429] ? __pfx___sys_bpf+0x10/0x10 [ 887.608918][T16429] ? find_held_lock+0x2b/0x80 [ 887.608938][T16429] ? find_held_lock+0x2b/0x80 [ 887.608958][T16429] ? __mutex_unlock_slowpath+0x161/0x790 [ 887.608984][T16429] ? fput+0x9b/0xd0 [ 887.608999][T16429] ? ksys_write+0x1ac/0x250 [ 887.609010][T16429] ? __pfx_ksys_write+0x10/0x10 [ 887.609023][T16429] __x64_sys_bpf+0x78/0xc0 [ 887.609037][T16429] ? lockdep_hardirqs_on+0x7c/0x110 [ 887.609052][T16429] do_syscall_64+0xcd/0xf80 [ 887.609070][T16429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.609086][T16429] RIP: 0033:0x7f733278f749 [ 887.609100][T16429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 887.609121][T16429] RSP: 002b:00007f73309d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 887.609134][T16429] RAX: ffffffffffffffda RBX: 00007f73329e6090 RCX: 00007f733278f749 [ 887.609141][T16429] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 887.609147][T16429] RBP: 00007f73309d5090 R08: 0000000000000000 R09: 0000000000000000 [ 887.609154][T16429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 887.609160][T16429] R13: 00007f73329e6128 R14: 00007f73329e6090 R15: 00007ffd1ca311a8 [ 887.609174][T16429] [ 887.883350][ C0] vkms_vblank_simulate: vblank timer overrun [ 888.183275][ T5882] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 888.343450][ T5882] usb 1-1: Using ep0 maxpacket: 32 [ 888.349973][ T5882] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 888.360075][ T5882] usb 1-1: config 0 has no interface number 0 [ 888.369226][ T5882] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 888.388768][ T5882] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 888.399666][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.409452][ T5882] usb 1-1: Product: syz [ 888.415476][ T5882] usb 1-1: Manufacturer: syz [ 888.420145][ T5882] usb 1-1: SerialNumber: syz [ 888.429941][ T5882] usb 1-1: config 0 descriptor?? [ 888.439497][T16434] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 888.575620][T16446] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2680'. [ 888.780969][T16434] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 889.128887][T16452] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 889.184617][T16452] bridge_slave_1: entered promiscuous mode [ 889.453339][ T10] usb 6-1: new full-speed USB device number 38 using dummy_hcd [ 889.607035][ T5882] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 889.620329][ T5882] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 889.634715][ T10] usb 6-1: config 0 has an invalid interface number: 237 but max is 0 [ 889.647037][ T10] usb 6-1: config 0 has no interface number 0 [ 889.666704][ T5882] asix 1-1:0.188: probe with driver asix failed with error -61 [ 889.918358][ T10] usb 6-1: config 0 interface 237 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 890.020716][ T10] usb 6-1: config 0 interface 237 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 890.073543][ T10] usb 6-1: config 0 interface 237 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 890.115603][ T10] usb 6-1: config 0 interface 237 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 890.144156][ T10] usb 6-1: New USB device found, idVendor=045e, idProduct=84bd, bcdDevice=89.b6 [ 890.337536][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.348671][ T10] usb 6-1: Product: syz [ 890.354804][ T10] usb 6-1: Manufacturer: syz [ 890.359419][ T10] usb 6-1: SerialNumber: syz [ 890.373856][ T10] usb 6-1: config 0 descriptor?? [ 890.386483][ T10] xpad 6-1:0.237: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 890.570416][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.237/input/input43 [ 890.833551][ T10] usb 6-1: USB disconnect, device number 38 [ 890.956636][T12493] usb 1-1: USB disconnect, device number 84 [ 891.850805][T16484] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2692'. [ 892.007638][T16487] netlink: 'syz.6.2693': attribute type 1 has an invalid length. [ 892.168494][T16487] bond1: entered promiscuous mode [ 892.175153][T16487] bond1: entered allmulticast mode [ 892.187054][T16487] 8021q: adding VLAN 0 to HW filter on device bond1 [ 892.192195][T16490] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2693'. [ 892.413579][T16489] erspan1: entered allmulticast mode [ 892.467427][T16489] bond1: (slave erspan1): making interface the new active one [ 892.483417][T16489] erspan1: entered promiscuous mode [ 892.628160][T16489] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 892.645896][T16500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2697'. [ 892.657079][T16496] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 892.725227][T12493] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 892.737143][T16499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2694'. [ 892.883591][T12493] usb 5-1: Using ep0 maxpacket: 32 [ 892.899580][T12493] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 893.205523][T12493] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 893.216661][T12493] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 893.227178][T12493] usb 5-1: Product: syz [ 893.253194][ T10] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 893.345075][T12493] usb 5-1: Manufacturer: syz [ 893.349894][T12493] usb 5-1: SerialNumber: syz [ 893.374143][T12493] usb 5-1: config 0 descriptor?? [ 893.379711][T16495] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 893.516061][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 893.533319][ T10] usb 1-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= e.b7 [ 893.555123][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.574936][ T10] usb 1-1: config 0 descriptor?? [ 893.614453][ T10] usbserial_generic 1-1:0.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 893.635533][ T10] usbserial_generic 1-1:0.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 893.649902][ T10] usbserial_generic 1-1:0.0: device has no bulk endpoints [ 893.962515][T16512] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2695'. [ 893.971513][T16512] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2695'. [ 894.420423][ T5931] usb 5-1: USB disconnect, device number 80 [ 894.430689][ T10] usb 1-1: USB disconnect, device number 85 [ 894.629696][T14181] usb 4-1: USB disconnect, device number 82 [ 895.159342][T16516] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2702'. [ 895.349751][T16519] bridge_slave_0: default FDB implementation only supports local addresses [ 895.372077][T14181] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 895.979634][T16524] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 896.728235][T16536] netlink: 212916 bytes leftover after parsing attributes in process `syz.6.2704'. [ 896.886360][T16543] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16543 comm=syz.3.2710 [ 896.921131][ T24] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 896.937544][T16543] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2710'. [ 897.311327][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 897.318064][ T24] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 897.326761][ T24] usb 6-1: config 0 has no interface number 0 [ 897.333598][ T24] usb 6-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 897.706123][T14181] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 897.732813][ T24] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 897.747570][ T24] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 897.758967][ T24] usb 6-1: Product: syz [ 897.772829][ T24] usb 6-1: SerialNumber: syz [ 897.786590][ T24] usb 6-1: config 0 descriptor?? [ 897.818048][ T24] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 897.868338][T16554] program syz.6.2713 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 897.902869][T14181] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 897.922109][T14181] usb 1-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 897.941111][T14181] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.992808][T14181] usb 1-1: config 0 descriptor?? [ 898.012123][T16556] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 898.616332][ T30] audit: type=1400 audit(1764717582.534:1125): avc: denied { setattr } for pid=16564 comm="syz.3.2717" name="RAWv6" dev="sockfs" ino=55108 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 898.670348][T16544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 898.690442][T16544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 898.708168][T16570] --map-set only usable from mangle table [ 898.719063][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.730960][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.738171][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.746999][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.765181][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.779091][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.786330][T14181] logitech 0003:046D:C50C.0018: unknown main item tag 0x0 [ 898.803227][T14181] logitech 0003:046D:C50C.0018: hidraw0: USB HID v0.00 Device [HID 046d:c50c] on usb-dummy_hcd.0-1/input0 [ 899.233447][T14181] usb 1-1: USB disconnect, device number 86 [ 899.682467][T14181] usb 6-1: USB disconnect, device number 39 [ 900.307129][T12493] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 901.800750][T12493] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 901.826552][T12493] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 901.978891][T16596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 902.024852][T12493] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 902.097129][T12493] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 902.122684][T12493] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.147778][T12493] usb 4-1: config 0 descriptor?? [ 902.154509][T16592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 902.204405][T16606] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2730'. [ 902.356026][ T10] usb 1-1: new full-speed USB device number 87 using dummy_hcd [ 902.948148][T12493] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 903.024970][ T10] usb 1-1: config 0 has an invalid interface number: 17 but max is 0 [ 903.037851][ T10] usb 1-1: config 0 has no interface number 0 [ 903.073184][ T10] usb 1-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=b4.dd [ 903.102899][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.112878][ T10] usb 1-1: Product: syz [ 903.137339][ T10] usb 1-1: Manufacturer: syz [ 903.165977][ T10] usb 1-1: SerialNumber: syz [ 903.185389][ T10] usb 1-1: config 0 descriptor?? [ 903.529120][T16599] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2728'. [ 903.569888][ T10] snd_usb_podhd 1-1:0.17: Line 6 POD HD300 found [ 903.580805][ T10] usb 1-1: selecting invalid altsetting 5 [ 903.596259][ T10] snd_usb_podhd 1-1:0.17: set_interface failed [ 903.607178][ T10] snd_usb_podhd 1-1:0.17: Line 6 POD HD300 now disconnected [ 903.619838][ T10] snd_usb_podhd 1-1:0.17: probe with driver snd_usb_podhd failed with error -22 [ 903.638075][ T10] usb 1-1: USB disconnect, device number 87 [ 904.165701][T16640] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2738'. [ 904.523685][ T10] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 904.732380][T12493] usb 4-1: reset high-speed USB device number 83 using dummy_hcd [ 904.802503][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 904.808878][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x2 has an invalid bInterval 255, changing to 11 [ 904.845800][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x2 has invalid maxpacket 59391, setting to 1024 [ 904.879621][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 904.912684][ T10] usb 1-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 904.929827][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.945681][ T10] usb 1-1: Product: syz [ 904.949946][ T10] usb 1-1: Manufacturer: syz [ 904.993747][ T10] usb 1-1: SerialNumber: syz [ 905.045808][ T10] usb 1-1: config 0 descriptor?? [ 905.059417][T16642] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 905.070038][ T10] snd_usb_toneport 1-1:0.0: Line 6 TonePort UX2 found [ 905.269936][T16642] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 905.286392][ T10] snd_usb_toneport 1-1:0.0: cannot get proper max packet size [ 905.320375][ T10] snd_usb_toneport 1-1:0.0: Line 6 TonePort UX2 now disconnected [ 905.348552][ T10] snd_usb_toneport 1-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 905.653833][ T5882] usb 4-1: USB disconnect, device number 83 [ 905.683544][ T5931] usb 1-1: USB disconnect, device number 88 [ 905.809786][T16653] [U] ÿ [ 907.951067][ T5931] usb 6-1: new full-speed USB device number 40 using dummy_hcd [ 908.239927][ T5931] usb 6-1: New USB device found, idVendor=102c, idProduct=6151, bcdDevice=44.e6 [ 908.433374][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.637285][ T5931] usb 6-1: config 0 descriptor?? [ 908.696185][ T5931] gspca_main: etoms-2.14.0 probing 102c:6151 [ 909.556660][ T5931] usb 6-1: USB disconnect, device number 40 [ 910.484320][ T30] audit: type=1326 audit(1764717594.404:1126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16709 comm="syz.5.2762" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdc32d8f749 code=0x0 [ 910.577320][T16713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2761'. [ 910.606295][T16713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2761'. [ 910.643975][T16713] netlink: 'syz.0.2761': attribute type 6 has an invalid length. [ 910.733977][T16717] netlink: 'syz.3.2763': attribute type 11 has an invalid length. [ 910.776962][T16717] FAULT_INJECTION: forcing a failure. [ 910.776962][T16717] name failslab, interval 1, probability 0, space 0, times 0 [ 910.797947][T16717] CPU: 0 UID: 0 PID: 16717 Comm: syz.3.2763 Not tainted syzkaller #0 PREEMPT(full) [ 910.797972][T16717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 910.797982][T16717] Call Trace: [ 910.797989][T16717] [ 910.797996][T16717] dump_stack_lvl+0x16c/0x1f0 [ 910.798018][T16717] should_fail_ex+0x512/0x640 [ 910.798043][T16717] ? __kmalloc_cache_noprof+0x5f/0x770 [ 910.798069][T16717] should_failslab+0xc2/0x120 [ 910.798090][T16717] __kmalloc_cache_noprof+0x72/0x770 [ 910.798114][T16717] ? nfnl_err_add+0x4e/0x350 [ 910.798141][T16717] ? nfnl_err_add+0x4e/0x350 [ 910.798162][T16717] nfnl_err_add+0x4e/0x350 [ 910.798185][T16717] nfnetlink_rcv_batch+0xb5f/0x2350 [ 910.798222][T16717] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 910.798264][T16717] ? avc_has_perm_noaudit+0x149/0x3b0 [ 910.798310][T16717] ? __nla_parse+0x40/0x60 [ 910.798332][T16717] nfnetlink_rcv+0x3c1/0x430 [ 910.798354][T16717] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 910.798385][T16717] netlink_unicast+0x5aa/0x870 [ 910.798408][T16717] ? __pfx_netlink_unicast+0x10/0x10 [ 910.798436][T16717] netlink_sendmsg+0x8c8/0xdd0 [ 910.798459][T16717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 910.798488][T16717] ____sys_sendmsg+0xa5d/0xc30 [ 910.798509][T16717] ? copy_msghdr_from_user+0x10a/0x160 [ 910.798534][T16717] ? __pfx_____sys_sendmsg+0x10/0x10 [ 910.798552][T16717] ? __lock_acquire+0x433/0x22f0 [ 910.798586][T16717] ___sys_sendmsg+0x134/0x1d0 [ 910.798613][T16717] ? __pfx____sys_sendmsg+0x10/0x10 [ 910.798638][T16717] ? __lock_acquire+0x433/0x22f0 [ 910.798690][T16717] __sys_sendmsg+0x16d/0x220 [ 910.798716][T16717] ? __pfx___sys_sendmsg+0x10/0x10 [ 910.798742][T16717] ? __pfx_bpf_trace_run2+0x10/0x10 [ 910.798769][T16717] ? syscall_trace_enter+0x1cb/0x220 [ 910.798798][T16717] ? rcu_is_watching+0x12/0xc0 [ 910.798820][T16717] do_syscall_64+0xcd/0xf80 [ 910.798845][T16717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.798862][T16717] RIP: 0033:0x7f2a3eb8f749 [ 910.798876][T16717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 910.798892][T16717] RSP: 002b:00007f2a3f998038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 910.798910][T16717] RAX: ffffffffffffffda RBX: 00007f2a3ede5fa0 RCX: 00007f2a3eb8f749 [ 910.798921][T16717] RDX: 0000000004000004 RSI: 0000200000000340 RDI: 0000000000000005 [ 910.798931][T16717] RBP: 00007f2a3f998090 R08: 0000000000000000 R09: 0000000000000000 [ 910.798945][T16717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 910.798956][T16717] R13: 00007f2a3ede6038 R14: 00007f2a3ede5fa0 R15: 00007ffd16121018 [ 910.798981][T16717] [ 911.478903][ T5827] Bluetooth: hci5: hardware error 0x00 [ 911.725522][T16727] comedi comedi3: c6xdigio: I/O port conflict (0xcf7,3) [ 911.732883][T16727] ================================================================== [ 911.740949][T16727] BUG: KASAN: slab-use-after-free in sysfs_remove_file_ns+0x63/0x70 [ 911.748932][T16727] Read of size 8 at addr ffff888079081630 by task syz.0.2768/16727 [ 911.756813][T16727] [ 911.759128][T16727] CPU: 1 UID: 0 PID: 16727 Comm: syz.0.2768 Not tainted syzkaller #0 PREEMPT(full) [ 911.759146][T16727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 911.759155][T16727] Call Trace: [ 911.759161][T16727] [ 911.759166][T16727] dump_stack_lvl+0x116/0x1f0 [ 911.759186][T16727] print_report+0xcd/0x630 [ 911.759203][T16727] ? __virt_addr_valid+0x81/0x610 [ 911.759218][T16727] ? __phys_addr+0xe8/0x180 [ 911.759232][T16727] ? sysfs_remove_file_ns+0x63/0x70 [ 911.759255][T16727] kasan_report+0xe0/0x110 [ 911.759271][T16727] ? sysfs_remove_file_ns+0x63/0x70 [ 911.759294][T16727] sysfs_remove_file_ns+0x63/0x70 [ 911.759315][T16727] driver_remove_file+0x4a/0x60 [ 911.759334][T16727] bus_remove_driver+0x224/0x2c0 [ 911.759350][T16727] driver_unregister+0x76/0xb0 [ 911.759367][T16727] comedi_device_detach_locked+0x12f/0xa50 [ 911.759391][T16727] comedi_device_detach+0x67/0xb0 [ 911.759410][T16727] comedi_device_attach+0x43d/0x900 [ 911.759431][T16727] do_devconfig_ioctl+0x1b1/0x710 [ 911.759446][T16727] ? comedi_unlocked_ioctl+0x167/0x2ee0 [ 911.759463][T16727] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 911.759483][T16727] ? find_held_lock+0x2b/0x80 [ 911.759498][T16727] comedi_unlocked_ioctl+0x165d/0x2ee0 [ 911.759518][T16727] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 911.759537][T16727] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 911.759553][T16727] ? do_vfs_ioctl+0x128/0x14f0 [ 911.759567][T16727] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 911.759580][T16727] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 911.759606][T16727] ? hook_file_ioctl_common+0x145/0x410 [ 911.759622][T16727] ? selinux_file_ioctl+0x180/0x270 [ 911.759640][T16727] ? selinux_file_ioctl+0xb4/0x270 [ 911.759659][T16727] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 911.759676][T16727] __x64_sys_ioctl+0x18e/0x210 [ 911.759691][T16727] do_syscall_64+0xcd/0xf80 [ 911.759705][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.759720][T16727] RIP: 0033:0x7fb58b78f749 [ 911.759732][T16727] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 911.759746][T16727] RSP: 002b:00007fb58c65f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 911.759761][T16727] RAX: ffffffffffffffda RBX: 00007fb58b9e5fa0 RCX: 00007fb58b78f749 [ 911.759770][T16727] RDX: 0000200000000180 RSI: 0000000040946400 RDI: 0000000000000003 [ 911.759789][T16727] RBP: 00007fb58b813f91 R08: 0000000000000000 R09: 0000000000000000 [ 911.759797][T16727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 911.759806][T16727] R13: 00007fb58b9e6038 R14: 00007fb58b9e5fa0 R15: 00007fff0f586c58 [ 911.759820][T16727] [ 911.759826][T16727] [ 912.022117][T16727] Allocated by task 14211: [ 912.026514][T16727] kasan_save_stack+0x33/0x60 [ 912.031175][T16727] kasan_save_track+0x14/0x30 [ 912.035838][T16727] __kasan_kmalloc+0xaa/0xb0 [ 912.040405][T16727] __kmalloc_noprof+0x32f/0x870 [ 912.045239][T16727] security_inode_init_security+0x13f/0x390 [ 912.051116][T16727] shmem_mknod+0x22e/0x450 [ 912.055516][T16727] lookup_open.isra.0+0x12dc/0x1780 [ 912.060691][T16727] path_openat+0xa95/0x3140 [ 912.065175][T16727] do_filp_open+0x20b/0x470 [ 912.069661][T16727] do_sys_openat2+0x11f/0x280 [ 912.074320][T16727] __x64_sys_openat+0x174/0x210 [ 912.079160][T16727] do_syscall_64+0xcd/0xf80 [ 912.083647][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.089529][T16727] [ 912.091839][T16727] Freed by task 14211: [ 912.095891][T16727] kasan_save_stack+0x33/0x60 [ 912.100558][T16727] kasan_save_track+0x14/0x30 [ 912.105217][T16727] __kasan_save_free_info+0x3b/0x60 [ 912.110408][T16727] __kasan_slab_free+0x5f/0x80 [ 912.115161][T16727] kfree+0x29e/0x710 [ 912.119042][T16727] security_inode_init_security+0x2eb/0x390 [ 912.124918][T16727] shmem_mknod+0x22e/0x450 [ 912.129318][T16727] lookup_open.isra.0+0x12dc/0x1780 [ 912.134496][T16727] path_openat+0xa95/0x3140 [ 912.138985][T16727] do_filp_open+0x20b/0x470 [ 912.143469][T16727] do_sys_openat2+0x11f/0x280 [ 912.148134][T16727] __x64_sys_openat+0x174/0x210 [ 912.152971][T16727] do_syscall_64+0xcd/0xf80 [ 912.157455][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.163328][T16727] [ 912.165630][T16727] The buggy address belongs to the object at ffff888079081600 [ 912.165630][T16727] which belongs to the cache kmalloc-256 of size 256 [ 912.179662][T16727] The buggy address is located 48 bytes inside of [ 912.179662][T16727] freed 256-byte region [ffff888079081600, ffff888079081700) [ 912.193360][T16727] [ 912.195693][T16727] The buggy address belongs to the physical page: [ 912.202082][T16727] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79080 [ 912.210838][T16727] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 912.219335][T16727] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 912.226875][T16727] page_type: f5(slab) [ 912.230845][T16727] raw: 00fff00000000040 ffff88813ff26b40 ffffea0001456b00 dead000000000002 [ 912.239413][T16727] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 912.247988][T16727] head: 00fff00000000040 ffff88813ff26b40 ffffea0001456b00 dead000000000002 [ 912.256649][T16727] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 912.265313][T16727] head: 00fff00000000001 ffffea0001e42001 00000000ffffffff 00000000ffffffff [ 912.273973][T16727] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 912.282628][T16727] page dumped because: kasan: bad access detected [ 912.289017][T16727] page_owner tracks the page as allocated [ 912.294706][T16727] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5829, tgid 5829 (syz-executor), ts 66931042222, free_ts 66884124486 [ 912.316050][T16727] post_alloc_hook+0x1af/0x220 [ 912.320809][T16727] get_page_from_freelist+0xd0b/0x31a0 [ 912.326255][T16727] __alloc_frozen_pages_noprof+0x25f/0x2440 [ 912.332147][T16727] alloc_pages_mpol+0x1fb/0x550 [ 912.336988][T16727] new_slab+0x24a/0x360 [ 912.341130][T16727] ___slab_alloc+0xee7/0x1cd0 [ 912.345798][T16727] __slab_alloc.constprop.0+0x63/0x110 [ 912.351250][T16727] __kmalloc_noprof+0x501/0x870 [ 912.356090][T16727] fib_create_info+0x53f/0x4680 [ 912.360933][T16727] fib_table_insert+0x177/0x1c40 [ 912.365850][T16727] fib_magic+0x4d4/0x5c0 [ 912.370077][T16727] fib_add_ifaddr+0x16d/0x580 [ 912.374735][T16727] fib_netdev_event+0x38a/0x710 [ 912.379577][T16727] notifier_call_chain+0xbc/0x3e0 [ 912.384583][T16727] call_netdevice_notifiers_info+0xbe/0x110 [ 912.390457][T16727] __dev_notify_flags+0x12c/0x2e0 [ 912.395465][T16727] page last free pid 5922 tgid 5922 stack trace: [ 912.401773][T16727] __free_frozen_pages+0x7df/0x1160 [ 912.406963][T16727] __put_partials+0x130/0x170 [ 912.411627][T16727] qlist_free_all+0x4d/0x120 [ 912.416203][T16727] kasan_quarantine_reduce+0x195/0x1e0 [ 912.421643][T16727] __kasan_slab_alloc+0x69/0x90 [ 912.426484][T16727] kmem_cache_alloc_noprof+0x250/0x720 [ 912.431934][T16727] vm_area_alloc+0x1f/0x160 [ 912.436427][T16727] __mmap_region+0xf85/0x2770 [ 912.441094][T16727] mmap_region+0x1ab/0x3f0 [ 912.445525][T16727] do_mmap+0xa3e/0x1210 [ 912.449669][T16727] vm_mmap_pgoff+0x29e/0x470 [ 912.454238][T16727] ksys_mmap_pgoff+0x32c/0x5c0 [ 912.458983][T16727] __x64_sys_mmap+0x125/0x190 [ 912.463641][T16727] do_syscall_64+0xcd/0xf80 [ 912.468123][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.473999][T16727] [ 912.476302][T16727] Memory state around the buggy address: [ 912.481906][T16727] ffff888079081500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 912.489952][T16727] ffff888079081580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 912.497991][T16727] >ffff888079081600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 912.506029][T16727] ^ [ 912.511642][T16727] ffff888079081680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 912.519693][T16727] ffff888079081700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 912.527757][T16727] ================================================================== [ 912.802969][T16727] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 912.810188][T16727] CPU: 1 UID: 0 PID: 16727 Comm: syz.0.2768 Not tainted syzkaller #0 PREEMPT(full) [ 912.819554][T16727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 912.829609][T16727] Call Trace: [ 912.832885][T16727] [ 912.835811][T16727] dump_stack_lvl+0x3d/0x1f0 [ 912.840396][T16727] vpanic+0x640/0x6f0 [ 912.844382][T16727] panic+0xca/0xd0 [ 912.848099][T16727] ? __pfx_panic+0x10/0x10 [ 912.852508][T16727] ? sysfs_remove_file_ns+0x63/0x70 [ 912.857705][T16727] ? preempt_schedule_common+0x44/0xc0 [ 912.863167][T16727] ? preempt_schedule_thunk+0x16/0x30 [ 912.868544][T16727] check_panic_on_warn+0xab/0xb0 [ 912.873481][T16727] end_report+0x107/0x160 [ 912.877809][T16727] kasan_report+0xee/0x110 [ 912.882216][T16727] ? sysfs_remove_file_ns+0x63/0x70 [ 912.887426][T16727] sysfs_remove_file_ns+0x63/0x70 [ 912.892451][T16727] driver_remove_file+0x4a/0x60 [ 912.897300][T16727] bus_remove_driver+0x224/0x2c0 [ 912.902230][T16727] driver_unregister+0x76/0xb0 [ 912.906991][T16727] comedi_device_detach_locked+0x12f/0xa50 [ 912.912800][T16727] comedi_device_detach+0x67/0xb0 [ 912.917824][T16727] comedi_device_attach+0x43d/0x900 [ 912.923022][T16727] do_devconfig_ioctl+0x1b1/0x710 [ 912.928039][T16727] ? comedi_unlocked_ioctl+0x167/0x2ee0 [ 912.933568][T16727] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 912.939098][T16727] ? find_held_lock+0x2b/0x80 [ 912.943759][T16727] comedi_unlocked_ioctl+0x165d/0x2ee0 [ 912.949210][T16727] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 912.955002][T16727] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 912.960879][T16727] ? do_vfs_ioctl+0x128/0x14f0 [ 912.965624][T16727] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 912.970628][T16727] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 912.977465][T16727] ? hook_file_ioctl_common+0x145/0x410 [ 912.982997][T16727] ? selinux_file_ioctl+0x180/0x270 [ 912.988181][T16727] ? selinux_file_ioctl+0xb4/0x270 [ 912.993278][T16727] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 912.999068][T16727] __x64_sys_ioctl+0x18e/0x210 [ 913.003816][T16727] do_syscall_64+0xcd/0xf80 [ 913.008302][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.014174][T16727] RIP: 0033:0x7fb58b78f749 [ 913.018568][T16727] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 913.038164][T16727] RSP: 002b:00007fb58c65f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 913.046573][T16727] RAX: ffffffffffffffda RBX: 00007fb58b9e5fa0 RCX: 00007fb58b78f749 [ 913.054538][T16727] RDX: 0000200000000180 RSI: 0000000040946400 RDI: 0000000000000003 [ 913.062501][T16727] RBP: 00007fb58b813f91 R08: 0000000000000000 R09: 0000000000000000 [ 913.070457][T16727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 913.078414][T16727] R13: 00007fb58b9e6038 R14: 00007fb58b9e5fa0 R15: 00007fff0f586c58 [ 913.086382][T16727] [ 913.089667][T16727] Kernel Offset: disabled [ 913.093964][T16727] Rebooting in 86400 seconds..