last executing test programs: 15m30.977362269s ago: executing program 4 (id=70): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000ac0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000ffdbdf252100000008000300", @ANYRES32=r3, @ANYBLOB="0c007d800400020b"], 0x28}, 0x1, 0x0, 0x0, 0x46b2d3ba8e12a610}, 0x4000) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0xc0844123, 0x0) r4 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r4, 0xc0984124, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24008800) r5 = socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0xa0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=@newsa={0x104, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x300, 0x3, 0x2, 0xfeffff7f00000000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x3500, 0xa, 0x1, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x104}}, 0x0) prlimit64(r6, 0x1, &(0x7f0000000100)={0x0, 0xb2}, &(0x7f0000000140)) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) r9 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x40050) read$FUSE(r8, &(0x7f0000000f40)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) getpgrp(r10) 15m30.215671709s ago: executing program 4 (id=72): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000800)={'tunl0\x00', 0x0, 0x700, 0x1, 0xffff, 0x7fffffff, {{0x2c, 0x4, 0x0, 0x3, 0xb0, 0x68, 0x0, 0x7, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}, @rand_addr=0x64010102, {[@lsrr={0x83, 0x23, 0x6c, [@multicast1, @empty, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, @private=0xa010101, @rand_addr=0x64010101, @remote, @loopback]}, @lsrr={0x83, 0x7, 0xfb, [@local]}, @generic={0x94, 0x9, "976de12ea7168d"}, @generic={0x86, 0x5, "28cdb7"}, @lsrr={0x83, 0x13, 0xa3, [@broadcast, @rand_addr=0x64010100, @rand_addr=0x64010102, @multicast1]}, @cipso={0x86, 0x26, 0x3, [{0x6, 0x2}, {0x1, 0x9, "2b9b8f4a3accca"}, {0x6, 0x2}, {0x5, 0x3, 'm'}, {0x1, 0x10, "52422399eb3efe653bafc142d835"}]}, @ssrr={0x89, 0xf, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @multicast2]}, @rr={0x7, 0x1b, 0x7c, [@loopback, @remote, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast2, @multicast2, @local]}]}}}}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], &(0x7f0000000380)=""/18, 0x57, 0x12, 0x0, 0x3, 0x10000}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002240)=""/102400, 0x19000) setreuid(0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) vmsplice(r1, &(0x7f0000001240)=[{&(0x7f0000000100)}], 0x1, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000780)={0xffffffffffffffff, 0x8, 0x8}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x4, &(0x7f0000000680)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8922, &(0x7f0000000280)={'dummy0\x00'}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r7, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/udp\x00') pread64(r8, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000081000000100826aa82cb00000e4ec66eecf", @ANYBLOB="d0e2565298b219875044bd50319e32db19f19586e2c6574c4a4be0dafe1b9187d1", @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES8=r7], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r9) 15m29.651405298s ago: executing program 4 (id=74): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000280)=0x0) sched_setscheduler(r2, 0x6, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="c80000000002010000000000000000000a0000003c0001802c00018014000300fe80000000000000000000000000002014000400ff0100000000000000000000000000010c00028005000100980000003c0003800c00028005000100890000002c00fb7f1400030000000000000000000000ffffac1e000114000400ff0100000000000800000000000000013c0002802c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1414aa0c000280050001"], 0xc8}, 0x1, 0x0, 0x0, 0x24000801}, 0x4) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000180)="6726660faeb2a13700003e262e6767660f1edf66b99e0000400f320f060f01c266b91406000066b87e00000066ba000000000f300f353e0f005a0166b8414b01df0f23d00f21f86635300000020f23f8b880068ec8", 0x55}], 0x1, 0x76, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000000)=0xc, 0x4) ioctl$KVM_RUN(r6, 0xae80, 0x0) 15m28.107750451s ago: executing program 4 (id=80): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x803, 0x72) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) mq_open(&(0x7f00000000c0)='\x00', 0x800, 0x8, &(0x7f0000000180)={0x7fffffff, 0x6, 0x10000, 0x3ff}) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000390400000000000000000032bfa5", @ANYRES32=r4, @ANYBLOB="01980600000000001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f0000000a00)='1', 0x1, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r4, 0x1, 0x4, 0x6, @random="b59a81d0b9ec"}, 0x14) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) 15m26.829232309s ago: executing program 4 (id=87): r0 = fsopen(&(0x7f0000000000)='smb3\x00', 0x1) fstat(r0, &(0x7f0000002300)) setsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f0000000040)=0x1, 0x4) userfaultfd(0x1) r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000140)=[{0x0, 0x1, {}, {}, 0x1}], 0x20) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$KVM_GET_MSRS_sys(r2, 0xc008ae88, &(0x7f0000000140)) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESOCT=r2], 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000002c0)={0x4c, r5, 0xd55319eec59dfa33, 0xfffffffd, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x0, 0x67}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}]]}, 0x4c}, 0x1, 0x0, 0x0, 0xc804}, 0xc2010) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40800850}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x7c, r5, 0x300, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x8, 0x28}}}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x787}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1db}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x185}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x338}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x33}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8001}]]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) 15m25.018268231s ago: executing program 4 (id=96): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r1, 0x4b46, &(0x7f0000000000)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2e41, 0x0) syz_open_procfs(0x0, 0x0) socket$tipc(0x1e, 0x5, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r2, &(0x7f0000000780)}, 0x20) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2c, &(0x7f0000000200)={0xfffffffe, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2b, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x2000, @remote}}}, 0x108) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30"], 0xec}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, &(0x7f0000000080)={0x0, 0xdf4, 0x80, 0x7, 0x2}) 15m24.276469194s ago: executing program 32 (id=96): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r1, 0x4b46, &(0x7f0000000000)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2e41, 0x0) syz_open_procfs(0x0, 0x0) socket$tipc(0x1e, 0x5, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r2, &(0x7f0000000780)}, 0x20) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2c, &(0x7f0000000200)={0xfffffffe, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2b, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x2000, @remote}}}, 0x108) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30"], 0xec}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_uring_setup(0xaae, &(0x7f0000000080)={0x0, 0xdf4, 0x80, 0x7, 0x2}) 15m20.151101611s ago: executing program 0 (id=115): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0xffffffffffffff7b, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000f80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x200000b9, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r6}, 0x10) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000300)) r7 = syz_open_dev$vbi(0x0, 0x0, 0x2) dup(r7) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000003c0)=@fd={0x10000, 0x3, 0x4, 0x10, 0x5a2, {0x77359400}, {0x6, 0x8dda032cb3f98ec1, 0xd9, 0x31, 0x5, 0x5, "57a33919"}, 0x9, 0x4, {}, 0x3}) 15m18.936898966s ago: executing program 0 (id=118): openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000400)='.\x00', 0xa40000d1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x1aa) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_io_uring_setup(0x19f2, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f00000002c0)=@framed={{}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0x25}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x14, 0x0, 0x0, 0x0, 0x2b, @empty, @empty}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$inet(0x2, 0x3, 0x33) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r9, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0xc) write$UHID_CREATE2(r8, &(0x7f0000000180)=ANY=[@ANYRES64=r7], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r8, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x0, 0x0, r8, 0x0}) io_uring_enter(r4, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 15m18.663799397s ago: executing program 0 (id=119): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="c4000000190001050000000000000000fc000000000000000000000000000000e000000200000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c00", @ANYRES32=r0, @ANYBLOB="04"], 0xc4}, 0x1, 0x0, 0x0, 0x20004015}, 0x48000) 15m18.327501828s ago: executing program 0 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) 15m18.189135595s ago: executing program 0 (id=121): r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980280000f8060001000a00000014000200fe8000000000030000000000000000aa05000300ff8000001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d4000980"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) 15m17.259902678s ago: executing program 0 (id=124): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000800)={'tunl0\x00', 0x0, 0x700, 0x1, 0xffff, 0x7fffffff, {{0x2c, 0x4, 0x0, 0x3, 0xb0, 0x68, 0x0, 0x7, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}, @rand_addr=0x64010102, {[@lsrr={0x83, 0x23, 0x6c, [@multicast1, @empty, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, @private=0xa010101, @rand_addr=0x64010101, @remote, @loopback]}, @lsrr={0x83, 0x7, 0xfb, [@local]}, @generic={0x94, 0x9, "976de12ea7168d"}, @generic={0x86, 0x5, "28cdb7"}, @lsrr={0x83, 0x13, 0xa3, [@broadcast, @rand_addr=0x64010100, @rand_addr=0x64010102, @multicast1]}, @cipso={0x86, 0x26, 0x3, [{0x6, 0x2}, {0x1, 0x9, "2b9b8f4a3accca"}, {0x6, 0x2}, {0x5, 0x3, 'm'}, {0x1, 0x10, "52422399eb3efe653bafc142d835"}]}, @ssrr={0x89, 0xf, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @multicast2]}, @rr={0x7, 0x1b, 0x7c, [@loopback, @remote, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast2, @multicast2, @local]}]}}}}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], &(0x7f0000000380)=""/18, 0x57, 0x12, 0x0, 0x3, 0x10000}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002240)=""/102400, 0x19000) setreuid(0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) vmsplice(r1, &(0x7f0000001240)=[{&(0x7f0000000100)='p', 0x1}], 0x1, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000780)={0xffffffffffffffff, 0x8, 0x8}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x4, &(0x7f0000000680)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8922, &(0x7f0000000280)={'dummy0\x00'}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r7, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/udp\x00') pread64(r8, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000081000000100826aa82cb00000e4ec66eecf", @ANYBLOB="d0e2565298b219875044bd50319e32db19f19586e2c6574c4a4be0dafe1b9187d1", @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES8=r7], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r9) 15m16.975130804s ago: executing program 33 (id=124): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000800)={'tunl0\x00', 0x0, 0x700, 0x1, 0xffff, 0x7fffffff, {{0x2c, 0x4, 0x0, 0x3, 0xb0, 0x68, 0x0, 0x7, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}, @rand_addr=0x64010102, {[@lsrr={0x83, 0x23, 0x6c, [@multicast1, @empty, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, @private=0xa010101, @rand_addr=0x64010101, @remote, @loopback]}, @lsrr={0x83, 0x7, 0xfb, [@local]}, @generic={0x94, 0x9, "976de12ea7168d"}, @generic={0x86, 0x5, "28cdb7"}, @lsrr={0x83, 0x13, 0xa3, [@broadcast, @rand_addr=0x64010100, @rand_addr=0x64010102, @multicast1]}, @cipso={0x86, 0x26, 0x3, [{0x6, 0x2}, {0x1, 0x9, "2b9b8f4a3accca"}, {0x6, 0x2}, {0x5, 0x3, 'm'}, {0x1, 0x10, "52422399eb3efe653bafc142d835"}]}, @ssrr={0x89, 0xf, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @multicast2]}, @rr={0x7, 0x1b, 0x7c, [@loopback, @remote, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast2, @multicast2, @local]}]}}}}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], &(0x7f0000000380)=""/18, 0x57, 0x12, 0x0, 0x3, 0x10000}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002240)=""/102400, 0x19000) setreuid(0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) vmsplice(r1, &(0x7f0000001240)=[{&(0x7f0000000100)='p', 0x1}], 0x1, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000780)={0xffffffffffffffff, 0x8, 0x8}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x4, &(0x7f0000000680)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x17}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8922, &(0x7f0000000280)={'dummy0\x00'}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r7, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/udp\x00') pread64(r8, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000081000000100826aa82cb00000e4ec66eecf", @ANYBLOB="d0e2565298b219875044bd50319e32db19f19586e2c6574c4a4be0dafe1b9187d1", @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES8=r7], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r9) 14m6.738186371s ago: executing program 1 (id=350): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$keyring(&(0x7f0000000100), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffec00000000000000000000000000010ff0200"/51], 0x340a) recvmmsg(r4, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) 14m5.38345896s ago: executing program 1 (id=352): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}}) 14m4.509089519s ago: executing program 1 (id=355): syz_usb_connect(0x5, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000980e5b4035120e00eef00000000109021200010000000009"], 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0xfe) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x200000000000005e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2042, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r5, 0x26, &(0x7f0000000280)={0x1, 0x1, 0xb8, 0x403}) fcntl$lock(r5, 0x24, &(0x7f0000000180)={0x2, 0x1, 0x400000200, 0x2}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12010020c2110822400001020301090224000101ff000309040001020301014009218000fe0122ee0309058103dc3f0107030000000034d8836e8042398ec860ae2c3709e26b0b0b7ba875253610183023ecd6b5df4dd26ba55d828426559c2cafb7686e0fe321122ac597870a6db06e9a04c04002f3edf3f695cec8179c73d6d9b45cb76117cf7334f5444f93123e5dca0012c7c549dc48370e3fbf0a9f7b"], &(0x7f00000003c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x6, 0x5, 0x0, 0x8, 0x2}, 0x31, &(0x7f00000001c0)=ANY=[@ANYBLOB="050f3100040a1003020400340601800710020ab78100071041620514100407a387ff4fb5143865ddf6f1d7a0678efa0000"], 0x2, [{0x38, &(0x7f0000000200)=ANY=[@ANYBLOB="38039674b53789ab83205f90b433ac9a0d023092ef50e14c663bd1279cd6e8941e4b4fadc278b75b2ced6fec17d28b3f1f0a030000000000"]}, {0xe2, &(0x7f00000002c0)=@string={0xe2, 0x3, "bdb06299ca4c835e8830b100bf9d015a6504902b96d935084c950604eaee9d0a2a36ca1daa3ef660b3bcd1a8d23b736dc70aee67fe736289fe7bd5ae8915002e9827a1034eef67ac379054a5cebef34742c783373c77bec94dd7a7f618d24cb4c8ea47e7b61807e3e0a0fc020eefa6973ca47d1f91228ef5c8d0a03061f6c33bc7c946a3ed5f349431790ae78d4bf7535ee152205a01d3374144843f856ffdb3ecd5cf84bd3f98a2fbce2f114fb0c46d92a6ccfeae4ffc5cb49f8fb78446f7ce602fea05432e0c84e23dc4f76c88091afcc59216d2976ee79b13e300aa364398"}}]}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 14m1.17108054s ago: executing program 1 (id=369): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x803, 0x72) mq_open(&(0x7f00000000c0)='\x00', 0x800, 0x8, &(0x7f0000000180)={0x7fffffff, 0x6, 0x10000, 0x3ff}) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000390400000000000000000032bfa5", @ANYRES32=r4, @ANYBLOB="01980600000000001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f0000000a00)='1', 0x1, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r4, 0x1, 0x4, 0x6, @random="b59a81d0b9ec"}, 0x14) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) 14m0.60184304s ago: executing program 1 (id=372): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102387, 0x18ff3) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0xc0844123, 0x0) r0 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r0, 0xc0984124, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24008800) socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0xa0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x20040050) 13m58.695634998s ago: executing program 1 (id=382): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x803, 0x72) mq_open(&(0x7f00000000c0)='\x00', 0x800, 0x8, &(0x7f0000000180)={0x7fffffff, 0x6, 0x10000, 0x3ff}) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000390400000000000000000032bfa5", @ANYRES32=r4, @ANYBLOB="01980600000000001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f0000000a00)='1', 0x1, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r4, 0x1, 0x4, 0x6, @random="b59a81d0b9ec"}, 0x14) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) 13m56.448080299s ago: executing program 34 (id=382): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x803, 0x72) mq_open(&(0x7f00000000c0)='\x00', 0x800, 0x8, &(0x7f0000000180)={0x7fffffff, 0x6, 0x10000, 0x3ff}) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000390400000000000000000032bfa5", @ANYRES32=r4, @ANYBLOB="01980600000000001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f0000000a00)='1', 0x1, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r4, 0x1, 0x4, 0x6, @random="b59a81d0b9ec"}, 0x14) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) 6m53.551192629s ago: executing program 3 (id=2232): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1], 0x15) 6m53.440254067s ago: executing program 3 (id=2235): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r4, 0x113, 0x2, &(0x7f00000001c0), &(0x7f0000002300)=0x4) 6m52.363219414s ago: executing program 3 (id=2245): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002980)={0x20, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x3, 0x7c}, [@nested={0x4, 0x145}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x1c}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0xc000) 6m52.271508496s ago: executing program 3 (id=2246): r0 = memfd_create(&(0x7f0000001cc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0sr\x95\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\x00\x01\x00\x00\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) write$binfmt_script(r0, &(0x7f0000000680)={'#! ', './file0'}, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c09c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, r1) setpgid(0x0, r1) lsetxattr$security_evm(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, 0x0, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 6m51.791023985s ago: executing program 3 (id=2248): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0xe) 6m51.323537898s ago: executing program 3 (id=2256): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(r2, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="380000001000050700bbc0000000010007000000", @ANYRES32=r3, @ANYBLOB="00000000000000001800120008000100736974000c0002000800020006"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="40000000100001002dbd7000fedbdf2500000000", @ANYRES32=r4, @ANYBLOB="00000000000000002000128008000100736974001400028008000300ac1e"], 0x40}}, 0x0) 6m51.258470975s ago: executing program 35 (id=2256): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(r2, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="380000001000050700bbc0000000010007000000", @ANYRES32=r3, @ANYBLOB="00000000000000001800120008000100736974000c0002000800020006"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="40000000100001002dbd7000fedbdf2500000000", @ANYRES32=r4, @ANYBLOB="00000000000000002000128008000100736974001400028008000300ac1e"], 0x40}}, 0x0) 2m43.903595632s ago: executing program 6 (id=3322): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02000000010000000000000004000000000000001000000000000000200000000000000078870470b900000100000000004ff5ca9063b74387d477a09023487413703326f48b84455172b0"], 0x24, 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2c, 0x2c, 0x107, 0x0, 0x25dfdbff, {0x2, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xe2}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@generic="a664f7feda247668"]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r3, &(0x7f0000000100)='./file1\x00', r3, &(0x7f0000000240)='./file0\x00', 0x0) unlink(&(0x7f00000002c0)='./file0\x00') 2m39.013561658s ago: executing program 6 (id=3338): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x65) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000d00000000000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) 2m38.650652193s ago: executing program 6 (id=3339): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f0000000200)=0x7fffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs={0x40046304, 0x7000000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2m36.287402778s ago: executing program 6 (id=3346): io_setup(0x5, &(0x7f00000003c0)=0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0/../file0/../file0/../file0\x00', 0x88901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000200)='./file0\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x36) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000240)={'wg1\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1e000000fcffffff040000000200000000000000", @ANYRES32=r3, @ANYBLOB="e6070000f10800008c1300"/20, @ANYRES32=r5, @ANYRES32=r3, @ANYBLOB="0500000002000000020000000c00"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="2dd6e80200e8cd1776696e6574"], 0xd) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0/../file0/../file0/../file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) readv(r8, &(0x7f00000001c0)=[{&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/212, 0xd4}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000480)=""/250, 0xfa}, {0x0}, {0x0}], 0x7) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(0x0, 0x122) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) 2m35.349725949s ago: executing program 6 (id=3348): syz_usb_connect(0x2, 0x36, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd7000fddbdf2506000000200001c008000300060000001400020076657468305f7669"], 0x34}, 0x1, 0x0, 0x0, 0x8094}, 0x90) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYBLOB="010000000000000000001000000018000180140002007665746830000000"], 0x34}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}, 0x1, 0x0, 0x0, 0x140}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2m35.04312836s ago: executing program 6 (id=3351): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000000), &(0x7f0000000100)=0x4) r2 = userfaultfd(0x80801) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x104) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip6_tables_targets\x00') preadv(r3, &(0x7f0000000100)=[{&(0x7f0000000200)=""/235, 0xeb}], 0x1, 0xfff, 0xfffffffe) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r4 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r4, 0x405c5503, 0x0) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@empty, 0x4e22, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffd, 0xfffffffffffffffd, 0x6, 0x0, 0x5, 0x80000000, 0x0, 0x7fffffdfffffffff}, {0x0, 0x0, 0xffffffffffffffff, 0x20000000000000}}, {{@in6=@empty, 0x4d5, 0x6c}, 0xa, @in=@private=0xa010102, 0x350a, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000040)={r5, @in6={{0xa, 0x4e24, 0xfffffff7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x74}}}, &(0x7f0000000280)=0x84) ioctl$UI_DEV_CREATE(r4, 0x5501) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x800) ioctl$SG_GET_VERSION_NUM(r6, 0x2284, &(0x7f0000000080)) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002040)) 2m34.503810119s ago: executing program 36 (id=3351): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000000), &(0x7f0000000100)=0x4) r2 = userfaultfd(0x80801) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x104) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip6_tables_targets\x00') preadv(r3, &(0x7f0000000100)=[{&(0x7f0000000200)=""/235, 0xeb}], 0x1, 0xfff, 0xfffffffe) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r4 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r4, 0x405c5503, 0x0) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@empty, 0x4e22, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffd, 0xfffffffffffffffd, 0x6, 0x0, 0x5, 0x80000000, 0x0, 0x7fffffdfffffffff}, {0x0, 0x0, 0xffffffffffffffff, 0x20000000000000}}, {{@in6=@empty, 0x4d5, 0x6c}, 0xa, @in=@private=0xa010102, 0x350a, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000040)={r5, @in6={{0xa, 0x4e24, 0xfffffff7, @private1={0xfc, 0x1, '\x00', 0x1}, 0x74}}}, &(0x7f0000000280)=0x84) ioctl$UI_DEV_CREATE(r4, 0x5501) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x800) ioctl$SG_GET_VERSION_NUM(r6, 0x2284, &(0x7f0000000080)) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002040)) 13.267139377s ago: executing program 5 (id=3814): syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = socket$phonet(0x23, 0x2, 0x1) sendmmsg$inet(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40800) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000440), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="84010000", @ANYRES16=r2, @ANYBLOB="0100d8000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000f1ffa7"], 0x184}}, 0x20000000) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, &(0x7f00000000c0)="f03b4e7b265e7d72b2a3ef7c7fdaff60c4ddb6ae61ff9df3854919069c7bb1a0c1819d45658e8336ebdc18137eb1cacbc4433f869546d7b6dde303eb51ba33968012665d8216b5a67ddd3dea1de2068abb", 0x51) 12.075135157s ago: executing program 8 (id=3818): socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x28, 0x1, 0x0, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket(0x10, 0x2, 0x0) write(r2, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r2, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) preadv2(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4080, 0xff0}], 0x1, 0x0, 0x0, 0x0) dup(r2) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_REAPURB(r6, 0x4004550c, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) socket$netlink(0x10, 0x3, 0x0) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001ac0)={r7, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r9, 0x0, 0x4000) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x4c}}, 0x0) 9.899121901s ago: executing program 5 (id=3826): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x1, 0x4, 0x1, 0x1}, 0x50) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) socket$kcm(0x29, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000001000010030000000ffdbdf2500000000", @ANYRES32=r4, @ANYBLOB="0000000000100000240012800b0001006d616373656300001400028005000f"], 0x44}}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@ipv6_newaddr={0x54, 0x14, 0x9535393fea6295b5, 0x40, 0xfffffffc, {0xa, 0x3f, 0x0, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @local}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffff001}}, @IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x3f}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x2, 0x0, 0x79, @mcast2, @mcast2, 0x80, 0x40, 0x7f, 0x9}}) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000540)={0xac, r1, 0x8, 0x70bd2d, 0x25dfdbfc, {}, [@HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4020845}, 0x24000090) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='mm_migrate_pages\x00', r8, 0x0, 0x5}, 0x18) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a907"], 0xfdef) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) 9.175627089s ago: executing program 9 (id=3831): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xfbc6, 0x10100, 0x8000003}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000000)={0x2b, 0x4, 0x0, {0x1, 0xfffffffffffffffe, 0x3, 0x0, [0x0, 0x0, 0x0]}}, 0x2b) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x0, 0x0, 0x0) poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x3388}], 0x1, 0x800) 8.596555613s ago: executing program 8 (id=3832): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = socket(0x2, 0x2, 0x1) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e1f, 0x7ff, @local, 0x4}, 0x1c) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(0x0, r4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000002000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(r4, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000002040)={0x1c, r5, 0x103, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000140)=0x0) io_submit(r9, 0x1, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r8, 0x0}]) write$uinput_user_dev(r7, &(0x7f0000000cc0)={'syz1\x00', {}, 0x3, [0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x4, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x8, 0x2, 0xffffffff, 0x0, 0x0, 0x3, 0xe, 0x721a2d63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x6], [0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x8, 0x7f, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0xb72, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x289, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xfffffff2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xfffffff9, 0x0, 0xfffffffe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xfffffffe], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000008, 0xc7, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x10000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400]}, 0x45c) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', 0x0, 0x0, 0x0) chdir(0x0) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000001200)='./file1\x00') readlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r7, 0x5501, 0x0) openat$cgroup_procs(r8, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) bind$ax25(r3, &(0x7f0000000540)={{0x3, @bcast, 0x1}, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092e1300833280102d52a0000000109022200010000000009040000000e010000082402030002100708240201000400"], 0x0) write$sndseq(r2, &(0x7f0000000180)=[{0x0, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x10, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @tick=0x46f, {}, {0x80, 0x1}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) read$snapshot(r2, 0x0, 0xffffffbf) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000140)) 8.567822287s ago: executing program 5 (id=3833): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="280000004000fb00feffffff00000000017c0000040042800c00018006000600800a0000040002"], 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) mq_timedreceive(0xffffffffffffffff, &(0x7f0000004600)=""/102381, 0xfffffceb, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mq_open(&(0x7f0000001600)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\aXg\xbb\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x8a=\x0f\n*\x8a\x99\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5\x00\x00\x00\x00\x00\x00\x00\x01\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbbV\x1a\x8a\x03#T\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8', 0x40, 0xb, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x8) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuseblk(&(0x7f00000001c0), &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), 0x204a05a, &(0x7f0000000340)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0xc000}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00', r1}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)={0x18, 0x3c, 0x301, 0x70bd25, 0xfffffffc, {0x7}, [@typed={0x4, 0x3, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x448d3}, 0x4000004) sendmsg$nl_generic(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="8c000000160001002cbd7000fedb5f25080000000c00320007000000000000000400ac6196a49ddc46e64d0603a0faccc3ec4192081beebe4d4bbd4b4f2b9d8c5fcdbf04b9905ecafe9855f8c3a302b3e3cbe1e55b1e810f12fe2cfd78f43a885aa8b69b814d9019481e5ee6c9eb2496864aa1cb5c06244e3e21c8b4631f429d75fc31415f5d628a8b0000008a2a020e0f3ceeaa1632b8effc94a143b8"], 0x8c}, 0x1, 0x0, 0x0, 0xc88d1}, 0x4004091) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000200), 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@enum64={0x6, 0x1, 0x0, 0x13, 0x0, 0x2, [{0x7, 0x3, 0x2000007}]}]}, {0x0, [0x30, 0x30, 0x2e, 0x2e, 0x61, 0x2e, 0x5f, 0x5f]}}, &(0x7f00000005c0)=""/194, 0x3a, 0xc2, 0x1, 0x8}, 0x28) write$cgroup_subtree(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="2b7069647320617c8e73f01778806aaf033f25edcdc2c912f65e573600ca64a64539978423e37dc4db9c23b01648bc104af842b6b7fc718fd31307e2d0ce7660bb0e3cc6a53a58dcefe9b9f29fe9f4337271d7ab2c44956ae831f3b3d64ac0efdabd37c6"], 0x6) 8.47666651s ago: executing program 7 (id=3834): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x10, r0, 'id1\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000080)={@initdev}, &(0x7f0000000140)=0x14) socket$netlink(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bond0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) listxattr(&(0x7f0000019300)='./file1\x00', &(0x7f0000019340)=""/199, 0xc7) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x17e) getdents64(r3, &(0x7f0000000200)=""/179, 0xb3) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180002000000000000000000000000009500000000060000"], &(0x7f0000000080)='GPL\x00', 0xa, 0x10, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r4, 0x8, 0x0, 0x0, 0x18, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0x1c}, 0x6d) 7.417852098s ago: executing program 7 (id=3838): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000300)={0x0, 0x17da, 0x0, 0x1, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000180)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0xffffffff, 0x8002) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x4, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1, 0x0, 0x7}, 0x18) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2002, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000300)={0x0, 0x3f00, &(0x7f0000001200)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) 6.675172236s ago: executing program 7 (id=3839): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}, 0x1, 0x1f00000000000000}, 0x0) 6.538959259s ago: executing program 7 (id=3840): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) close(0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1e, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000005580)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x80c42, 0x0) read(r1, &(0x7f0000000040)=""/148, 0xffffff96) 6.078168339s ago: executing program 2 (id=3841): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000180)={0x50, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}]}}) 5.955599323s ago: executing program 7 (id=3842): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) socket$nl_xfrm(0x10, 0x3, 0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xb, &(0x7f0000000380)="e7add1e9c2625c10032c3d89ff01ada0d70932b46a842ed277fac258083ca490d31f341236eccf4507576c4d033dfc3e4f695143a1", 0x35) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYRES8=r2], 0xa8}}, 0x8800) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x8000000000001, &(0x7f0000000340)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000240)=0x8, r5, 0x0, 0x0, 0x1}}, 0x20) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x6b) io_setup(0x20000002, &(0x7f00000016c0)) clock_getres(0xeaffffff, 0x0) r6 = syz_io_uring_setup(0x7b, &(0x7f0000000540)={0x0, 0x3bce, 0x10100, 0x3, 0x100}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000700)="f7", 0x1}], 0x1}, 0x8000) syz_io_uring_submit(r7, r8, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, r10, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x2}, 0x0, 0x40002002}) io_uring_enter(r6, 0x46f3, 0x0, 0x0, 0x0, 0x0) r11 = syz_open_dev$vbi(&(0x7f0000000180), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r11, 0xc0045627, &(0x7f00000001c0)=0x80000001) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) 5.904958105s ago: executing program 2 (id=3843): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x94) syz_emit_ethernet(0x12, &(0x7f0000000000)=ANY=[@ANYBLOB="910418166421b54fa0aaaa050004424203"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff62, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) poll(0x0, 0x0, 0x7) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff010000850000000e00000085000000500000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8e, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000001}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r2}, 0x10) getresgid(&(0x7f0000008b80), &(0x7f0000008bc0), &(0x7f0000008c00)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) fallocate(0xffffffffffffffff, 0x0, 0x9, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) setpriority(0x0, 0x0, 0x7) r3 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x8}) mq_timedreceive(r3, &(0x7f0000000180)=""/196, 0xc4, 0x0, 0x0) mq_timedreceive(r3, &(0x7f0000000440)=""/30, 0x1e, 0x80000000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000500)={&(0x7f00000003c0), 0xc, &(0x7f00000004c0)={&(0x7f00000008c0)={0x674, r6, 0x10, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TX_RATES={0x1a8, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x6c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x18, 0x9, 0x12, 0x61, 0x18, 0x0, 0x48, 0x16, 0x60, 0x6, 0x48, 0x12, 0x4, 0x6c, 0xc, 0xc, 0x36, 0x6, 0x12, 0x18, 0x48, 0x24, 0x1b, 0x60, 0x36, 0x6c]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x6, 0x36, 0xb768b6f86e364dbb, 0x6, 0x6c, 0x6, 0xb, 0x30, 0x60, 0x3]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0xc, 0x0, 0x80, 0x1000, 0x4, 0x4, 0x3b5e]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x2, 0xfffc, 0x3, 0x2, 0x9, 0x3ff, 0xf760]}}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x50, 0x2, [{0x3, 0x4}, {0x7, 0x4}, {0x0, 0x9}, {0x6, 0x2}, {0x5, 0x2}, {0x7, 0x1}, {0x4, 0x2}, {0x4, 0x3}, {0x1, 0xa}, {0x2, 0x8}, {}, {0x4, 0x3}, {0x5, 0x2}, {0x0, 0x6}, {0x5, 0x6}, {0x3, 0x7}, {0x6, 0x5}, {0x3, 0x8}, {0x1}, {0x2, 0x9}, {0x3, 0x6}, {0x3, 0x2}, {0x2, 0x8}, {0x0, 0x5}, {0x7, 0xa}, {0x4, 0x7}, {0x3, 0x9}, {0x1, 0x3}, {0x7, 0x5}, {0x5, 0x9}, {0x2, 0x3}, {0x7, 0x6}, {0x0, 0x4}, {0x7, 0xa}, {0x5, 0x7}, {0x6, 0xa}, {0x7, 0xe}, {0x7}, {0x7, 0x9}, {0x7, 0x8}, {0x5, 0x2}, {0x0, 0x3}, {0x1, 0x4}, {0x4}, {0x0, 0x8}, {0x0, 0x3}, {0x0, 0x4}, {0x1, 0x6}, {0x7}, {0x2, 0x7}, {0x7, 0x3}, {0x5, 0x5}, {0x0, 0x3}, {0x3, 0x4}, {0x5, 0x7}, {0x0, 0x9}, {0x1, 0x6}, {0x6}, {0x3, 0x9}, {0x1, 0x8}, {0x2, 0x1}, {0x3, 0x6}, {0x0, 0x6}, {0x4, 0x4}, {0x2, 0x6}, {0x5, 0x5}, {0x6, 0x4}, {0x7, 0x5}, {0x2, 0xa}, {0x0, 0x1}, {0x6, 0x7}, {0x1, 0x5}, {0x4, 0xa}, {0x4, 0x7}, {0x6, 0x5}, {0x4, 0x5}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x54, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x48, 0x2, [{0x1, 0x1}, {0x4, 0x1}, {0x1, 0x8}, {0x3, 0x1}, {0x3, 0x4}, {0x1, 0x6}, {0x0, 0x9}, {0x3, 0x4}, {0x0, 0xa}, {0x6}, {0x4}, {0x1, 0x6}, {0x6, 0x6}, {0x7, 0x9}, {0x0, 0x7}, {0x5, 0x3}, {0x0, 0xa}, {0x6, 0x5}, {0x2, 0x5}, {0x0, 0xa}, {0x6, 0x5}, {0x5, 0x4}, {0x2}, {0x4, 0x8}, {0x1, 0x7}, {0x4, 0x3}, {0x0, 0xa}, {0x4, 0x3}, {0x1, 0x2}, {0x5, 0x7}, {0x6, 0x8}, {0x5, 0x8}, {0x2, 0x3}, {0x0, 0x1}, {0x6, 0x9}, {0x4}, {0x2, 0x4}, {0x4, 0x4}, {0x6, 0xa}, {0x2, 0x3}, {0x6, 0x7}, {0x6}, {0x3, 0x5}, {0x0, 0x1}, {0x6, 0x8}, {0x4, 0x9}, {0x7, 0x6}, {0x6, 0x3}, {0x1, 0x5}, {0x6}, {0x0, 0x4}, {0x4}, {0x7}, {0x3, 0xa}, {0x0, 0x1}, {0x7, 0x5}, {0x6}, {0x0, 0x3}, {0x1, 0xa}, {0x3, 0x6}, {0x0, 0x6}, {0x1, 0x1}, {0x6}, {0x1, 0x1}, {0x6, 0xa}, {0x1, 0x8}, {0x1, 0x8}, {0x1, 0x7}]}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xffff, 0x3ff, 0x46, 0x8, 0x8, 0x6, 0xca0a, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x40f5, 0x7, 0xee, 0x2, 0x400, 0x0, 0x2]}}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x4c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x5, 0x0, 0x81, 0x6, 0x4, 0xa, 0x7]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x2, 0x18, 0x844, 0xf136, 0x2, 0x5, 0x80]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0xfc, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x80, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x5, 0x8, 0x9b8, 0x3, 0x6, 0xbda, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x200, 0x8001, 0x4, 0xe00, 0xdab, 0x6, 0x8]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xe, 0xf, 0x200, 0x0, 0x6, 0x7ff, 0xfffd, 0x3]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x2, 0x7}, {0x0, 0x1}, {0x3, 0x4}, {0x4, 0x1}, {0x2, 0x2}, {0x6, 0x7}, {0x1, 0x9}, {0x5, 0x7}, {0x6, 0x3}, {0x1, 0x2}, {0x4, 0x7}, {0x3, 0x8}, {0x6, 0x7}, {0x6}, {0x1, 0x8}, {0x3}, {0x3}, {0x1, 0x9}, {0x4, 0x3}, {0x2, 0x4}, {0x3, 0xa}, {0x7, 0xa}, {0x1, 0x3}, {0x1, 0x4}, {0x6, 0x9}, {0x3, 0x1}, {0x0, 0xa}, {0x3, 0x5}, {0x7, 0x2}, {0x6, 0x2}, {0x1, 0x8}, {0x1, 0x1}, {0x5, 0x6}, {0x6}, {0x7, 0x8}, {0x0, 0x7}, {0x7, 0x3}, {0x2, 0x6}, {0x0, 0x4}, {0x5}, {0x6, 0x1}, {0x5, 0x7}, {0x4, 0x1}, {0x6, 0x8}]}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x100, 0x2, 0x8, 0x0, 0x8, 0x5, 0xfff]}}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x4, 0x7f, 0x4, 0x3, 0x924a, 0xe, 0xfe00]}}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xec8e, 0x7, 0x7f, 0x1, 0x5, 0xcb03, 0x6, 0x1bc6]}}]}, @NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xff8, 0x4, 0x10, 0xc9f4, 0x3, 0x5, 0x8, 0x9]}}]}]}, @NL80211_ATTR_TX_RATES={0x190, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x58, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x3, 0x8, 0x8e, 0x4, 0x1, 0x7f, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x10, 0x1, 0x1, 0x8000, 0x4, 0x7, 0x7, 0x1ff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x12, 0x1b, 0x12, 0x0, 0x36, 0x32, 0x1, 0x6, 0x9, 0x6, 0x3, 0x18, 0x12, 0x21, 0x4, 0x30, 0x48, 0x9, 0x6, 0x0, 0x1]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_60GHZ={0x2c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xdeb3, 0x1d2, 0x0, 0xe, 0x7, 0x8000, 0x4, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x1000, 0xffff, 0xfffb, 0x2, 0x9, 0x3, 0x4]}}]}, @NL80211_BAND_5GHZ={0x44, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xfac1, 0x4, 0x9, 0x6, 0x0, 0x100, 0x4, 0xf]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x43, 0x0, 0x8, 0x3, 0x3ff, 0x9, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x38, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x2a, 0x2, [{0x4, 0x2}, {0x1, 0x1}, {0x6, 0x5}, {0x4, 0x7}, {0x1, 0x5}, {0x0, 0x4}, {0x5, 0x5}, {0x2, 0x5}, {0x5, 0x3}, {0x5}, {0x3, 0x8}, {0x0, 0x9}, {0x6, 0x3}, {0x3, 0x2}, {}, {0x6, 0x9}, {0x1, 0x7}, {0x6, 0x1}, {0x4, 0xa}, {0x5, 0xa}, {0x0, 0x4}, {0x2, 0x6}, {0x4, 0x3}, {0x7, 0x9}, {0x0, 0xa}, {0x1, 0x4}, {0x4, 0x1}, {}, {0x7, 0x4}, {0x5, 0x3}, {0x1, 0x8}, {0x0, 0xa}, {0x7, 0x3}, {}, {0x6, 0x8}, {0x1, 0x9}, {0x5, 0xa}, {0x4, 0x3}]}]}, @NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x7f, 0x1000, 0x8, 0x459, 0x3, 0x1, 0x7]}}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x16, 0x30, 0x4, 0x48, 0x24, 0x9, 0x4, 0xb, 0x4c, 0x24, 0x6, 0x17, 0x3, 0x4, 0xc, 0xc, 0x9, 0x12, 0x18, 0x36, 0xb, 0x36, 0xc, 0x2, 0xb, 0x24, 0x48, 0x4, 0x6c, 0x60]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x40, 0x400, 0x512, 0xfff7, 0x0, 0x7, 0x7d32, 0x2]}}]}, @NL80211_BAND_5GHZ={0x1c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x36, 0x6, 0x48, 0x1b, 0x10, 0xb, 0x18, 0x0, 0x9, 0x5, 0x48, 0x18]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0x1b0, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x84, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x60cd, 0x2, 0x7, 0x0, 0xffb0, 0x6, 0x6, 0x3858]}}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x4, 0x3, 0x1b, 0xc, 0x10, 0x16, 0x12, 0x1b, 0x12, 0x1b, 0x5, 0x48, 0x2, 0x2, 0x12, 0x1, 0xc, 0xb, 0x5, 0x5b, 0x9, 0x1b, 0x6c, 0x36, 0xc, 0x4]}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x2, 0x8}, {0x4, 0x1}, {0x3, 0x5}, {0x7, 0xa}, {0x6}, {0x2, 0x7}, {0x4, 0x8}, {0x0, 0x1}, {0x6, 0x6}, {0x4, 0x7}, {0x0, 0x4}, {0x3, 0x3}, {0x5, 0x5}, {0x4, 0x2}, {0x6}, {0x2, 0x1}, {0x4, 0x6}, {}, {0x1, 0x4}, {0x4, 0x6}, {0x7, 0x5}, {0x0, 0x2}, {0x6, 0x2}, {0x1, 0x3}, {0x4, 0x1}, {0x0, 0x7}, {0x1, 0x9}, {0x3, 0x1}, {0x0, 0xa}, {0x7, 0xa}, {0x7, 0xa}, {0x4}, {0x7, 0x9}, {0x1, 0x8}, {0x0, 0x4}, {0x1, 0x4}, {0x1}, {0x3, 0x2}, {0x0, 0x7}, {0x4, 0x7}, {0x2, 0x5}, {0x1, 0x7}, {0x0, 0x5}, {0x6, 0xa}, {0x4, 0x2}, {0x6, 0x8}, {0x6, 0x1}, {0x0, 0x7}, {0x7, 0x6}, {0x1, 0x7}, {0x5, 0x4}, {0x7, 0x5}, {0x7, 0x8}, {0x5, 0x5}, {0x2, 0x5}, {0x0, 0xa}, {0x0, 0x7}, {0x6, 0x1}, {0x2, 0x1}, {0x0, 0xa}, {0x2, 0x3}, {0x7}, {0x0, 0x9}, {0x3, 0x3}, {0x7, 0x9}, {0x2, 0xa}, {0x7, 0x2}, {0x1, 0xa}, {0x1, 0x3}]}]}, @NL80211_BAND_2GHZ={0x98, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x60, 0x6, 0x0, 0x4, 0x5, 0x24, 0xc, 0x3, 0x60, 0xb, 0x6c, 0x60, 0x1b, 0x9, 0x18, 0xc, 0x57, 0x4, 0x5, 0x16, 0x36, 0x48, 0xb, 0x2, 0x2, 0x36]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x942, 0x401, 0x1, 0x1, 0x8, 0x800, 0xbb, 0x40]}}, @NL80211_TXRATE_LEGACY={0x13, 0x1, [0xb, 0x4, 0x36, 0x9, 0x3, 0x30, 0x1b, 0x18, 0xc, 0x5, 0x48, 0x18, 0x4, 0x16, 0x1]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x2, 0x6}, {0x3, 0x5}, {0x7, 0x8}, {0x2, 0x9}, {0x1, 0x1}, {0x3, 0x7}, {0x6, 0x5}, {0x1, 0x3}, {0x4, 0x3}, {0x2, 0x2}, {0x2, 0x9}, {0x3, 0x8}, {0x5, 0x9}, {0x7, 0x8}, {0x3, 0x6}, {0x0, 0x7}, {0x0, 0x1}, {0x7, 0x9}, {0x5, 0x4}, {0x1, 0x9}, {0x3, 0xa}, {0x0, 0x9}, {0x5, 0x4}, {0x1, 0x9}, {0x5}, {0x6, 0x8}, {0x2, 0x3}, {0x6, 0x9}, {0x1, 0x3}, {0x0, 0x1}, {0x1, 0x9}]}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x5c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x6, 0x2, [{0x4, 0x1}, {0x6, 0x9}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x5, 0x2, 0x5, 0x5, 0x6c, 0x16, 0x9, 0x0, 0x4, 0x60, 0xb, 0xb, 0x36, 0x5, 0x36, 0x16, 0x2, 0x16, 0x3, 0x5, 0x12, 0x9, 0xb, 0x60, 0x5, 0x4, 0x1b, 0x60, 0xb, 0x48]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x15, 0xbab, 0x10, 0x1, 0x3ff, 0x3, 0x1]}}]}, @NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xffff, 0x3ff, 0x2, 0x9, 0xf7fa, 0x401, 0x696, 0x3]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x7c, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x2, 0x5, 0x401, 0x5d7, 0x1, 0xf, 0x5]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0xffff, 0x2, 0x778, 0x955, 0x81, 0xd36, 0xfff7]}}, @NL80211_TXRATE_GI={0x5}]}]}]}, 0x674}, 0x1, 0x0, 0x0, 0x44080}, 0x4094) 5.866781144s ago: executing program 8 (id=3844): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0, 0x0, 0x0, 0x0, 0xffffffff}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x20}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.411288402s ago: executing program 8 (id=3845): r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@in={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x80, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r1, 0x1, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r1, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x956}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010101}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x4008054) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x19) ioctl$KVM_CHECK_EXTENSION_VM(r3, 0xae03, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@ipmr_delroute={0x34, 0x19, 0x200, 0x70bd2a, 0x25dfdbff, {0x80, 0x20, 0xb4, 0x5, 0xfd, 0x8, 0x0, 0xb, 0x2000}, [@RTA_DST={0x8, 0x1, @rand_addr=0x64010102}, @RTA_IP_PROTO={0x5, 0x1b, 0x3a}, @RTA_GATEWAY={0x8, 0x5, @empty}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x4018) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r5) (async) getsockopt$inet6_mreq(r0, 0x29, 0xf, &(0x7f0000000400)={@rand_addr, 0x0}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r0, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=@ipv6_deladdr={0x3c, 0x15, 0x202, 0x70bd27, 0x25dfdbfc, {0xa, 0x1f, 0x0, 0xc8, r6}, [@IFA_CACHEINFO={0x14, 0x6, {0xffffff80, 0x11dc, 0xd7, 0xaa4}}, @IFA_RT_PRIORITY={0x8}, @IFA_FLAGS={0x8, 0x8, 0x40}]}, 0x3c}, 0x1, 0x0, 0x0, 0x41}, 0x4005) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000580)) (async) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000f80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r7, 0x0, 0xffffffffffffffff}, 0x18) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) (async) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) ioctl$FUSE_DEV_IOC_BACKING_OPEN(0xffffffffffffffff, 0x4010e501, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 64) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 5.403861696s ago: executing program 9 (id=3846): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0xc010) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r4 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r4, &(0x7f0000000100)='./file1\x00', r4, &(0x7f0000000240)='./file0\x00', 0x0) unlink(&(0x7f00000002c0)='./file0\x00') 5.317396908s ago: executing program 5 (id=3847): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r0 = socket(0x10, 0x3, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket(0x21, 0x5, 0x0) connect$inet(r5, 0x0, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r6 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000080)=r2) ioctl$SOUND_MIXER_WRITE_RECSRC(r6, 0xc0044dff, &(0x7f0000000200)=0xb) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r7, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "f611d1c6c124639c", "638ca218de45829114f23d30e8303726", '\x00', "9500"}, 0xf) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r7, 0x5421, &(0x7f0000000140)=0x1) 4.087585057s ago: executing program 5 (id=3848): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x10, r0, 'id1\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000080)={@initdev}, &(0x7f0000000140)=0x14) socket$netlink(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bond0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) listxattr(&(0x7f0000019300)='./file1\x00', &(0x7f0000019340)=""/199, 0xc7) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x17e) getdents64(r3, &(0x7f0000000200)=""/179, 0xb3) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180002000000000000000000000000009500000000060000"], &(0x7f0000000080)='GPL\x00', 0xa, 0x10, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r4, 0x8, 0x0, 0x0, 0x18, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0x1c}, 0x6d) 3.926877423s ago: executing program 2 (id=3849): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000300)={0x0, 0x17da, 0x0, 0x1, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000180)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0xffffffff, 0x8002) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x4, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1, 0x0, 0x7}, 0x18) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2002, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000300)={0x0, 0x3f00, &(0x7f0000001200)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) 3.49683088s ago: executing program 7 (id=3850): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x5) ioctl$TCSETA(r1, 0x8910, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "4feda26323b172e0"}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'veth0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000280)={&(0x7f0000000300)={0x1d, r2}, 0x10, &(0x7f0000000340)={0x0}}, 0x80054) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000540)={0x0, 0x48, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r7, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS={0x8, 0x2, 0xa}]}, 0x34}}, 0x240008c0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$KVM_REINJECT_CONTROL(r5, 0xae71, &(0x7f0000000200)={0xfd}) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x400) r10 = dup(0xffffffffffffffff) syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$PPPOEIOCDFWD(r10, 0xb101, 0x0) 3.49006102s ago: executing program 9 (id=3851): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = accept4$llc(0xffffffffffffffff, &(0x7f0000000280), &(0x7f0000000340)=0x10, 0x80000) recvmmsg(r2, &(0x7f0000000b00)=[{{&(0x7f0000000380)=@rc, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/140, 0x8c}], 0x1, &(0x7f0000000500)=""/175, 0xaf}, 0x7}, {{&(0x7f00000005c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000640)=""/121, 0x79}, {&(0x7f00000006c0)=""/137, 0x89}], 0x2, &(0x7f00000007c0)=""/198, 0xc6}, 0x6}, {{&(0x7f00000008c0)=@hci, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000940)=""/245, 0xf5}], 0x1, &(0x7f0000000a80)=""/122, 0x7a}, 0xe}], 0x3, 0x1, &(0x7f0000000bc0)) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000"], 0x48) mprotect(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x1000000) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') unlinkat(r4, &(0x7f0000000300)='./file0\x00', 0x200) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 2.843279185s ago: executing program 8 (id=3852): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x10, r0, 'id1\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000080)={@initdev}, &(0x7f0000000140)=0x14) socket$netlink(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bond0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file4/file6\x00', 0x1c0) listxattr(&(0x7f0000019300)='./file1\x00', &(0x7f0000019340)=""/199, 0xc7) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) landlock_create_ruleset(&(0x7f00000002c0)={0x2001, 0x0, 0x1}, 0x18, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000200)=""/179, 0xb3) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) 2.285563275s ago: executing program 2 (id=3853): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1300000005000000100000005f740000880000", @ANYBLOB="7b4300000000000000000000000000ebcf", @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x63, 0x11, 0x20}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x8}, @exit]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = semget$private(0x0, 0x2, 0x2) mount$9p_unix(&(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000500), 0xa0040, &(0x7f0000000780)=ANY=[@ANYBLOB="7472616e733d756e69782c706f73697861636c2c616669643d307830303030303030303030303b666666662c64656275673d3078303030303030303030303030303030312c6d6d61702c006bc1df51e469b20b461e7a0ebf05002bd8b7acc95699665ec915efa0a51392a6ba0bbec6f0f74eaac6faa1af3b8dd1a9a72dc7376183ce9a4fce33544e15d54e5cf1e601852287a0b1e9db1266e747f7cad189a63722104922b7a8d017a4ce1b21e52521c3d7ac0641963508ca44cfd8887521adc089b5c64f2afc5a5829469bda907c5908b45903e11cc07b95caa5d7713f2a1fe150f94549606d55629f57ae0c40c565102f1a0400fffadea9d0bd2080"]) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000380)=@o_path={&(0x7f0000000340)='./cgroup\x00', 0x0, 0x4010}, 0x18) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000000)) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000002c0)='hfsplus\x00', 0xc4, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40) sendto$packet(r4, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x1a, 0x80, 0x0, 0x0) 1.371082847s ago: executing program 9 (id=3854): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000180)={0x50, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}]}}) 1.230643539s ago: executing program 9 (id=3855): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0xa7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_io_uring_setup(0x23c, &(0x7f0000000080)={0x0, 0x0, 0x10100}, 0x0, &(0x7f0000000040)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x2, 0x30, 0xfffffffffffffffa, 0x8}, &(0x7f0000000280)=0x18) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000003c0)=@sack_info={r9, 0x8, 0x1}, &(0x7f0000000400)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_io_uring_submit(0x0, r7, &(0x7f0000000000)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r8, 0x0, &(0x7f0000000240), 0x0, 0xebec93e830f96115}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = syz_open_dev$tty1(0xc, 0x4, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) ioctl$TIOCL_BLANKSCREEN(r10, 0x4b67, &(0x7f0000000180)) io_uring_enter(r6, 0x7f5f, 0x4000000, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x437, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r2, 0x5394b, 0x601}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_FLOWINFO={0x8, 0xc, 0x1ff}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48800}, 0x0) 1.219994091s ago: executing program 2 (id=3856): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa000000000000791008000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000bf03000020000000850000000c000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) 1.213685891s ago: executing program 8 (id=3857): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000004c0)={r2, 0x3, 0x6, @remote}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x1ffffff, {0x0, 0x0, 0x0, r2, {0x7, 0x9}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r2, 0x240, 0x20238}}, 0x20}, 0x1, 0x0, 0x0, 0x44800}, 0x80) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000008, 0x810, 0xffffffffffffffff, 0x0) r4 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f00000fe000/0xd000)=nil, 0xd000, 0x1000005, 0xd2952, 0xffffffffffffffff, 0xfffff000) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r7}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_ADD_MIF(r4, 0x29, 0xca, 0x0, 0x0) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) r9 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r9, &(0x7f0000000240)=[{{&(0x7f00000003c0)={0x2, 0xce20, @empty}, 0x10, &(0x7f0000001980)=[{&(0x7f0000000200)="a90500040000746400009e150451160200000064c6", 0x15}, {&(0x7f0000000380)="17460081ba60ccbb9d000000000000", 0xf}], 0x2}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="5825be060000000000", 0x9}], 0x1}}], 0x2, 0x4080) ioctl$VHOST_SET_OWNER(r8, 0xaf01, 0x0) 1.043585792s ago: executing program 2 (id=3858): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt(r0, 0x416, 0x10, 0x0, &(0x7f00000000c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast2}, 0x3}}, 0x2e) connect$pppl2tp(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r7, 0x4b66, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{}, {}, {}]}) 205.10749ms ago: executing program 5 (id=3859): r0 = getpgrp(0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x1) prlimit64(r0, 0xe, &(0x7f0000000080)={0xc, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getrlimit(0xd, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000000)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000780)={0x1, 0x1, &(0x7f0000000380)=""/240, &(0x7f0000000900)=""/103, &(0x7f0000000800)=""/90}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000980)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x80, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x101842, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000050000000400000002000003000000000500000700000000090000400e000000840000000008000000005f0000"], 0x0, 0x41, 0x0, 0x1}, 0x28) getpid() 0s ago: executing program 9 (id=3860): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc010) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f00000002c0)='./file0\x00') kernel console output (not intermixed with test programs): 94967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18011 comm="syz.5.3315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa7618f749 code=0x7ffc0000 [ 863.743369][T18013] lo speed is unknown, defaulting to 1000 [ 863.749998][T18013] lo speed is unknown, defaulting to 1000 [ 863.790811][ T30] audit: type=1326 audit(1765922724.620:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18011 comm="syz.5.3315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7ffa7618f749 code=0x7ffc0000 [ 863.951326][ T30] audit: type=1400 audit(1765922724.700:712): avc: denied { remount } for pid=18011 comm="syz.5.3315" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 863.974234][ T30] audit: type=1326 audit(1765922724.820:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18011 comm="syz.5.3315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa7618f749 code=0x7ffc0000 [ 864.002287][ T5951] usb 9-1: usb_control_msg returned -32 [ 864.009189][T13255] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 864.017099][ T5951] usbtmc 9-1:16.0: can't read capabilities [ 864.035239][T13255] usb 7-1: Using ep0 maxpacket: 32 [ 864.047230][T13255] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 864.055947][T13255] usb 7-1: can't read configurations, error -61 [ 864.067786][T13255] usb usb7-port1: unable to enumerate USB device [ 866.085723][T13275] usb 9-1: USB disconnect, device number 11 [ 867.191611][T18072] binder: 18065:18072 ioctl c0046209 0 returned -22 [ 868.175900][T18084] netlink: 179596 bytes leftover after parsing attributes in process `syz.8.3330'. [ 868.484659][T13275] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 868.694729][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 868.702801][T13275] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 868.712041][T13275] usb 6-1: can't read configurations, error -61 [ 869.019497][T13275] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 869.255059][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 869.278828][T13275] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 869.312622][T13275] usb 6-1: can't read configurations, error -61 [ 869.354851][T13275] usb usb6-port1: attempt power cycle [ 869.715144][T13275] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 869.775441][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 869.907706][T13275] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 869.929986][T13275] usb 6-1: can't read configurations, error -61 [ 870.064639][T13275] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 870.081337][ T5816] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 870.093195][ T5816] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 870.102925][ T5816] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 870.110550][ T5816] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 870.118834][ T5816] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 870.144803][ T5951] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 870.193375][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 870.209761][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.219352][T13479] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 870.226788][T13479] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 870.234056][T13479] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 870.241669][T13479] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 870.249129][T13479] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 870.286218][T13275] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 870.294124][T13275] usb 6-1: can't read configurations, error -61 [ 870.305468][ T5951] usb 3-1: Using ep0 maxpacket: 8 [ 870.305474][T13275] usb usb6-port1: unable to enumerate USB device [ 870.353461][ T5951] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 870.388540][T18100] lo speed is unknown, defaulting to 1000 [ 870.396573][T18100] lo speed is unknown, defaulting to 1000 [ 870.402390][ T5951] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 870.435740][ T5951] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 870.497358][ T5951] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 870.518876][ T5951] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 870.534062][ T5951] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 870.544591][ T5951] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 870.847026][ T5951] usb 3-1: usb_control_msg returned -32 [ 870.866478][ T5951] usbtmc 3-1:16.0: can't read capabilities [ 870.909378][T18100] chnl_net:caif_netlink_parms(): no params data found [ 871.152342][T18100] bridge0: port 1(bridge_slave_0) entered blocking state [ 871.522004][T13517] usb 3-1: USB disconnect, device number 42 [ 871.538567][T18100] bridge0: port 1(bridge_slave_0) entered disabled state [ 871.665808][T18100] bridge_slave_0: entered allmulticast mode [ 871.682090][T18100] bridge_slave_0: entered promiscuous mode [ 871.698270][T18100] bridge0: port 2(bridge_slave_1) entered blocking state [ 872.110161][T18100] bridge0: port 2(bridge_slave_1) entered disabled state [ 872.126130][T18100] bridge_slave_1: entered allmulticast mode [ 872.144091][T18100] bridge_slave_1: entered promiscuous mode [ 872.244686][T18100] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 872.277647][T13479] Bluetooth: hci1: command tx timeout [ 872.279005][T18100] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 872.339729][ T6708] bridge_slave_1: left allmulticast mode [ 872.353214][ T6708] bridge_slave_1: left promiscuous mode [ 872.359783][ T6708] bridge0: port 2(bridge_slave_1) entered disabled state [ 872.369269][ T6708] bridge_slave_0: left allmulticast mode [ 872.375296][ T6708] bridge0: port 1(bridge_slave_0) entered disabled state [ 872.495254][T18132] netlink: 9 bytes leftover after parsing attributes in process `syz.5.3344'. [ 872.505871][T18132] netlink: 9 bytes leftover after parsing attributes in process `syz.5.3344'. [ 873.387686][ T6708] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 873.399457][ T6708] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 873.414424][ T6708] bond0 (unregistering): Released all slaves [ 873.625915][ T6708] bond1 (unregistering): (slave veth3): Releasing active interface [ 873.634225][ T6708] veth0_to_bond: entered promiscuous mode [ 873.650740][ T6708] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 873.669784][ T6708] bond1 (unregistering): (slave vlan2): Releasing active interface [ 873.678486][ T6708] bond1 (unregistering): Released all slaves [ 873.697223][ T6708] bond2 (unregistering): Released all slaves [ 873.758216][T18100] team0: Port device team_slave_0 added [ 873.876497][T18100] team0: Port device team_slave_1 added [ 873.947087][ T6708] : left promiscuous mode [ 874.164147][T18100] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 874.166139][T13275] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 874.357580][T13479] Bluetooth: hci1: command tx timeout [ 874.359224][T18157] netlink: 179596 bytes leftover after parsing attributes in process `syz.2.3349'. [ 874.372880][T18100] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 874.372904][T13275] usb 9-1: Using ep0 maxpacket: 32 [ 874.405392][T18100] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 874.546408][T13275] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 874.553979][T13275] usb 9-1: can't read configurations, error -61 [ 874.588220][T18100] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 874.597513][T18100] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 874.626194][ T6708] tipc: Left network mode [ 874.704678][T13275] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 874.745242][T18100] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 874.861881][ T5816] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 874.873960][ T5816] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 874.882533][ T5816] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 874.890214][ T5816] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 874.894601][T13275] usb 9-1: Using ep0 maxpacket: 32 [ 874.906750][T13275] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 874.922653][T18100] hsr_slave_0: entered promiscuous mode [ 874.931389][T18100] hsr_slave_1: entered promiscuous mode [ 874.944809][T18100] debugfs: 'hsr0' already exists in 'hsr' [ 874.950654][T18100] Cannot create hsr debugfs directory [ 874.959052][ T5816] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 874.993108][T13275] usb 9-1: can't read configurations, error -61 [ 875.008625][T13275] usb usb9-port1: attempt power cycle [ 875.123518][T18172] FAULT_INJECTION: forcing a failure. [ 875.123518][T18172] name failslab, interval 1, probability 0, space 0, times 0 [ 875.147299][T18172] CPU: 0 UID: 0 PID: 18172 Comm: syz.5.3354 Tainted: G L syzkaller #0 PREEMPT(full) [ 875.147327][T18172] Tainted: [L]=SOFTLOCKUP [ 875.147333][T18172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 875.147344][T18172] Call Trace: [ 875.147350][T18172] [ 875.147357][T18172] dump_stack_lvl+0x16c/0x1f0 [ 875.147383][T18172] should_fail_ex+0x512/0x640 [ 875.147408][T18172] ? fs_reclaim_acquire+0xae/0x150 [ 875.147433][T18172] should_failslab+0xc2/0x120 [ 875.147456][T18172] __kmalloc_noprof+0xeb/0x910 [ 875.147482][T18172] ? tomoyo_encode2+0x100/0x3e0 [ 875.147508][T18172] ? tomoyo_encode2+0x100/0x3e0 [ 875.147528][T18172] tomoyo_encode2+0x100/0x3e0 [ 875.147551][T18172] tomoyo_encode+0x29/0x50 [ 875.147571][T18172] tomoyo_realpath_from_path+0x18f/0x6e0 [ 875.147596][T18172] ? tomoyo_profile+0x47/0x60 [ 875.147624][T18172] tomoyo_path_number_perm+0x245/0x580 [ 875.147642][T18172] ? tomoyo_path_number_perm+0x237/0x580 [ 875.147663][T18172] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 875.147684][T18172] ? find_held_lock+0x2b/0x80 [ 875.147730][T18172] ? find_held_lock+0x2b/0x80 [ 875.147754][T18172] ? hook_file_ioctl_common+0x144/0x410 [ 875.147784][T18172] ? __fget_files+0x20e/0x3c0 [ 875.147811][T18172] security_file_ioctl+0x9b/0x240 [ 875.147835][T18172] __x64_sys_ioctl+0xb7/0x210 [ 875.147857][T18172] do_syscall_64+0xcd/0xf80 [ 875.147887][T18172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.147904][T18172] RIP: 0033:0x7ffa7618f749 [ 875.147918][T18172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 875.147934][T18172] RSP: 002b:00007ffa7710e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 875.147952][T18172] RAX: ffffffffffffffda RBX: 00007ffa763e5fa0 RCX: 00007ffa7618f749 [ 875.147963][T18172] RDX: 00002000000002c0 RSI: 00000000c0303e03 RDI: 0000000000000007 [ 875.147973][T18172] RBP: 00007ffa7710e090 R08: 0000000000000000 R09: 0000000000000000 [ 875.147983][T18172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.147992][T18172] R13: 00007ffa763e6038 R14: 00007ffa763e5fa0 R15: 00007ffd2e65f948 [ 875.148009][T18172] [ 875.148023][T18172] ERROR: Out of memory at tomoyo_realpath_from_path. [ 875.434651][T13275] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 875.455081][T13275] usb 9-1: Using ep0 maxpacket: 32 [ 875.461934][T13275] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 875.471653][T13275] usb 9-1: can't read configurations, error -61 [ 875.616282][T13275] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 875.728893][T18164] lo speed is unknown, defaulting to 1000 [ 875.734857][T13275] usb 9-1: Using ep0 maxpacket: 32 [ 875.742010][T13275] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 875.749762][T13275] usb 9-1: can't read configurations, error -61 [ 875.766597][T13275] usb usb9-port1: unable to enumerate USB device [ 876.206946][T18164] lo speed is unknown, defaulting to 1000 [ 876.446705][ T5816] Bluetooth: hci1: command tx timeout [ 876.470190][ T6708] hsr_slave_0: left promiscuous mode [ 876.476816][ T6708] hsr_slave_1: left promiscuous mode [ 876.482726][ T6708] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 876.493258][ T6708] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 876.994771][ T5816] Bluetooth: hci0: command tx timeout [ 877.642912][T18212] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3359'. [ 877.739912][T18212] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3359'. [ 878.514878][ T5816] Bluetooth: hci1: command tx timeout [ 878.558122][T18222] netlink: 84 bytes leftover after parsing attributes in process `syz.8.3361'. [ 879.090252][ T5816] Bluetooth: hci0: command tx timeout [ 879.370549][ T6708] team0 (unregistering): Port device team_slave_1 removed [ 879.420265][ T6708] team0 (unregistering): Port device team_slave_0 removed [ 881.139472][T18164] chnl_net:caif_netlink_parms(): no params data found [ 881.156509][ T5816] Bluetooth: hci0: command tx timeout [ 881.773392][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 881.773409][ T30] audit: type=1400 audit(1765922742.560:716): avc: denied { map } for pid=18258 comm="syz.2.3365" path="socket:[61739]" dev="sockfs" ino=61739 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 881.925626][T18100] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 881.998199][ T30] audit: type=1400 audit(1765922742.920:717): avc: denied { mount } for pid=18240 comm="syz.8.3364" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 882.101256][T18100] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 882.277872][T18283] netlink: 179596 bytes leftover after parsing attributes in process `syz.2.3367'. [ 882.290324][T13255] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 882.338432][T18100] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 882.355275][T18100] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 882.444652][T13255] usb 6-1: Using ep0 maxpacket: 32 [ 882.457312][T13255] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 882.479164][T18164] bridge0: port 1(bridge_slave_0) entered blocking state [ 882.488853][T13255] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 882.511529][T18164] bridge0: port 1(bridge_slave_0) entered disabled state [ 882.565666][T13255] usb 6-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 882.577573][T18164] bridge_slave_0: entered allmulticast mode [ 882.584730][T13255] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.623420][T18164] bridge_slave_0: entered promiscuous mode [ 882.643336][T13255] usb 6-1: Product: syz [ 882.649890][T18164] bridge0: port 2(bridge_slave_1) entered blocking state [ 882.666054][T13255] usb 6-1: Manufacturer: syz [ 882.672159][T18164] bridge0: port 2(bridge_slave_1) entered disabled state [ 882.683503][T13255] usb 6-1: SerialNumber: syz [ 882.699453][T18164] bridge_slave_1: entered allmulticast mode [ 882.718239][T13255] usb 6-1: config 0 descriptor?? [ 882.741461][T18164] bridge_slave_1: entered promiscuous mode [ 882.862444][T18164] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 882.936049][T18164] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 883.012409][T18164] team0: Port device team_slave_0 added [ 883.065246][ T6708] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 883.113387][T18164] team0: Port device team_slave_1 added [ 883.137045][T18100] 8021q: adding VLAN 0 to HW filter on device bond0 [ 883.198104][ T6708] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 883.238636][ T5816] Bluetooth: hci0: command tx timeout [ 883.347829][ T6708] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 883.380628][T18164] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 883.393261][T18164] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 883.466926][T18164] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 883.819519][T18100] 8021q: adding VLAN 0 to HW filter on device team0 [ 883.836262][T18164] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 883.861720][T18164] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 883.955575][T18164] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 884.021009][ T6708] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 884.084908][ T6506] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.091998][ T6506] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.130910][ T6506] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.137995][ T6506] bridge0: port 2(bridge_slave_1) entered forwarding state [ 884.147070][T18312] FAULT_INJECTION: forcing a failure. [ 884.147070][T18312] name failslab, interval 1, probability 0, space 0, times 0 [ 884.265020][T18164] hsr_slave_0: entered promiscuous mode [ 884.286322][T18164] hsr_slave_1: entered promiscuous mode [ 884.304415][T18164] debugfs: 'hsr0' already exists in 'hsr' [ 884.318895][T18164] Cannot create hsr debugfs directory [ 884.324592][T18312] CPU: 0 UID: 0 PID: 18312 Comm: syz.8.3370 Tainted: G L syzkaller #0 PREEMPT(full) [ 884.324619][T18312] Tainted: [L]=SOFTLOCKUP [ 884.324625][T18312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 884.324634][T18312] Call Trace: [ 884.324641][T18312] [ 884.324647][T18312] dump_stack_lvl+0x16c/0x1f0 [ 884.324672][T18312] should_fail_ex+0x512/0x640 [ 884.324691][T18312] ? __kmalloc_noprof+0xca/0x910 [ 884.324709][T18312] should_failslab+0xc2/0x120 [ 884.324723][T18312] __kmalloc_noprof+0xeb/0x910 [ 884.324740][T18312] ? bpf_test_init.isra.0+0x88/0x130 [ 884.324753][T18312] ? bpf_test_init.isra.0+0x88/0x130 [ 884.324762][T18312] bpf_test_init.isra.0+0x88/0x130 [ 884.324776][T18312] bpf_prog_test_run_skb+0x489/0x31a0 [ 884.324792][T18312] ? find_held_lock+0x2b/0x80 [ 884.324812][T18312] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 884.324826][T18312] ? fput+0x70/0xf0 [ 884.324850][T18312] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 884.324862][T18312] __sys_bpf+0x1035/0x4980 [ 884.324879][T18312] ? __pfx___sys_bpf+0x10/0x10 [ 884.324893][T18312] ? find_held_lock+0x2b/0x80 [ 884.324911][T18312] ? find_held_lock+0x2b/0x80 [ 884.324930][T18312] ? __mutex_unlock_slowpath+0x161/0x790 [ 884.324951][T18312] ? fput+0x70/0xf0 [ 884.324966][T18312] ? ksys_write+0x1ac/0x250 [ 884.324979][T18312] ? __pfx_ksys_write+0x10/0x10 [ 884.324994][T18312] __x64_sys_bpf+0x78/0xc0 [ 884.325009][T18312] ? lockdep_hardirqs_on+0x7c/0x110 [ 884.325021][T18312] do_syscall_64+0xcd/0xf80 [ 884.325035][T18312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.325045][T18312] RIP: 0033:0x7fe5cd58f749 [ 884.325054][T18312] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 884.325064][T18312] RSP: 002b:00007fe5cb7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 884.325075][T18312] RAX: ffffffffffffffda RBX: 00007fe5cd7e5fa0 RCX: 00007fe5cd58f749 [ 884.325081][T18312] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 884.325087][T18312] RBP: 00007fe5cb7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 884.325093][T18312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 884.325099][T18312] R13: 00007fe5cd7e6038 R14: 00007fe5cd7e5fa0 R15: 00007ffef62002b8 [ 884.325113][T18312] [ 884.842765][T13255] usb 6-1: USB disconnect, device number 49 [ 884.890156][ T6708] bridge_slave_1: left allmulticast mode [ 884.939581][ T6708] bridge_slave_1: left promiscuous mode [ 884.988537][ T6708] bridge0: port 2(bridge_slave_1) entered disabled state [ 885.332517][T18330] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3372'. [ 885.670091][ T6708] bridge_slave_0: left allmulticast mode [ 885.678297][ T6708] bridge_slave_0: left promiscuous mode [ 885.690951][ T6708] bridge0: port 1(bridge_slave_0) entered disabled state [ 886.989414][ T6708] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 887.015272][ T6708] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 887.034034][ T6708] bond0 (unregistering): Released all slaves [ 887.116402][T18340] lo speed is unknown, defaulting to 1000 [ 887.122773][T18340] lo speed is unknown, defaulting to 1000 [ 887.243875][T18354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.323957][T18354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.484087][T18100] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 887.494598][T13275] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 888.129432][ T30] audit: type=1400 audit(1765922749.100:718): avc: denied { accept } for pid=18365 comm="syz.5.3376" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 888.575923][T18164] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 888.599933][T18164] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 888.736105][T18164] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 888.772200][T18164] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 888.961725][T18399] FAULT_INJECTION: forcing a failure. [ 888.961725][T18399] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 888.974941][T18399] CPU: 0 UID: 0 PID: 18399 Comm: syz.2.3382 Tainted: G L syzkaller #0 PREEMPT(full) [ 888.974958][T18399] Tainted: [L]=SOFTLOCKUP [ 888.974962][T18399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 888.974968][T18399] Call Trace: [ 888.974972][T18399] [ 888.974976][T18399] dump_stack_lvl+0x16c/0x1f0 [ 888.974992][T18399] should_fail_ex+0x512/0x640 [ 888.975010][T18399] _copy_from_user+0x2e/0xd0 [ 888.975025][T18399] copy_msghdr_from_user+0x98/0x160 [ 888.975037][T18399] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 888.975050][T18399] ? __pfx__kstrtoull+0x10/0x10 [ 888.975063][T18399] ___sys_sendmsg+0xfe/0x1d0 [ 888.975074][T18399] ? __pfx____sys_sendmsg+0x10/0x10 [ 888.975090][T18399] ? find_held_lock+0x2b/0x80 [ 888.975114][T18399] __sys_sendmmsg+0x200/0x420 [ 888.975126][T18399] ? __pfx___sys_sendmmsg+0x10/0x10 [ 888.975140][T18399] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 888.975160][T18399] ? fput+0x70/0xf0 [ 888.975176][T18399] ? ksys_write+0x1ac/0x250 [ 888.975188][T18399] ? __pfx_ksys_write+0x10/0x10 [ 888.975203][T18399] __x64_sys_sendmmsg+0x9c/0x100 [ 888.975213][T18399] ? lockdep_hardirqs_on+0x7c/0x110 [ 888.975226][T18399] do_syscall_64+0xcd/0xf80 [ 888.975239][T18399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.975250][T18399] RIP: 0033:0x7fbabaf8f749 [ 888.975259][T18399] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 888.975269][T18399] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 888.975280][T18399] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 888.975286][T18399] RDX: 00000000040001b6 RSI: 0000200000001540 RDI: 0000000000000004 [ 888.975292][T18399] RBP: 00007fbabbdac090 R08: 0000000000000000 R09: 0000000000000000 [ 888.975299][T18399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 888.975304][T18399] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 888.975318][T18399] [ 889.400998][T13275] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 889.555224][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 889.593484][T13275] usb 6-1: config 0 has an invalid interface number: 29 but max is 0 [ 889.654661][T18421] hfsplus: unable to find HFS+ superblock [ 889.662717][ T30] audit: type=1400 audit(1765922750.610:719): avc: denied { mounton } for pid=18407 comm="syz.8.3384" path="/syzcgroup/unified/syz8" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 889.758119][T13275] usb 6-1: config 0 has no interface number 0 [ 889.791900][T18100] veth0_vlan: entered promiscuous mode [ 889.833086][T13275] usb 6-1: config 0 interface 29 has no altsetting 0 [ 889.940647][T13275] usb 6-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 889.963178][T13275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.991441][T13275] usb 6-1: Product: syz [ 890.006510][T13275] usb 6-1: Manufacturer: syz [ 890.011697][ T6708] hsr_slave_0: left promiscuous mode [ 890.012112][T13275] usb 6-1: SerialNumber: syz [ 890.023000][ T6708] hsr_slave_1: left promiscuous mode [ 890.029478][ T6708] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 890.048301][ T6708] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 890.051185][T13275] usb 6-1: config 0 descriptor?? [ 890.070674][ T6708] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 890.083511][ T6708] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 890.123444][ T6708] veth1_macvtap: left promiscuous mode [ 890.139214][ T6708] veth0_macvtap: left promiscuous mode [ 890.151245][ T6708] veth1_vlan: left promiscuous mode [ 890.171380][ T6708] veth0_vlan: left promiscuous mode [ 890.514675][T13256] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 890.699783][T13256] usb 9-1: Using ep0 maxpacket: 32 [ 890.707603][T13256] usb 9-1: config 0 has an invalid interface number: 184 but max is 0 [ 890.722867][T13256] usb 9-1: config 0 has no interface number 0 [ 890.740180][T13256] usb 9-1: config 0 interface 184 has no altsetting 0 [ 890.762676][T13256] usb 9-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 890.773517][T13256] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.790398][T13256] usb 9-1: Product: syz [ 890.802465][T13256] usb 9-1: Manufacturer: syz [ 890.814217][T13256] usb 9-1: SerialNumber: syz [ 890.826134][T13256] usb 9-1: config 0 descriptor?? [ 890.846620][T13256] smsc75xx v1.0.0 [ 890.933035][ T6708] team0 (unregistering): Port device team_slave_1 removed [ 890.989067][ T6708] team0 (unregistering): Port device team_slave_0 removed [ 891.971425][T18100] veth1_vlan: entered promiscuous mode [ 891.979267][T13275] peak_usb 6-1:0.29 can0: unable to request usb[type=0 value=1] err=-32 [ 892.015151][T13275] peak_usb 6-1:0.29: unable to read PCAN-USB X6 firmware info (err -32) [ 892.080224][T18434] FAULT_INJECTION: forcing a failure. [ 892.080224][T18434] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 892.116884][T18434] CPU: 0 UID: 0 PID: 18434 Comm: syz.2.3387 Tainted: G L syzkaller #0 PREEMPT(full) [ 892.116913][T18434] Tainted: [L]=SOFTLOCKUP [ 892.116989][T18434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 892.116996][T18434] Call Trace: [ 892.117003][T18434] [ 892.117008][T18434] dump_stack_lvl+0x16c/0x1f0 [ 892.117026][T18434] should_fail_ex+0x512/0x640 [ 892.117044][T18434] _copy_from_user+0x2e/0xd0 [ 892.117062][T18434] do_handle_open+0x5e3/0xd10 [ 892.117079][T18434] ? __fget_files+0x20e/0x3c0 [ 892.117094][T18434] ? __pfx_do_handle_open+0x10/0x10 [ 892.117112][T18434] ? ksys_write+0x1ac/0x250 [ 892.117129][T18434] ? do_syscall_64+0xcd/0xf80 [ 892.117142][T18434] do_syscall_64+0xcd/0xf80 [ 892.117155][T18434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.117167][T18434] RIP: 0033:0x7fbabaf8f749 [ 892.117176][T18434] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 892.117186][T18434] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 892.117196][T18434] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 892.117203][T18434] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 892.117209][T18434] RBP: 00007fbabbdac090 R08: 0000000000000000 R09: 0000000000000000 [ 892.117215][T18434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 892.117221][T18434] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 892.117235][T18434] [ 892.435726][T13275] peak_usb 6-1:0.29: probe with driver peak_usb failed with error -32 [ 892.464668][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 892.486377][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 892.502993][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 892.514226][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 892.524957][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 892.536441][T13256] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 892.561138][T18164] 8021q: adding VLAN 0 to HW filter on device bond0 [ 892.563579][T13256] smsc75xx 9-1:0.184: probe with driver smsc75xx failed with error -71 [ 892.630621][T18100] veth0_macvtap: entered promiscuous mode [ 892.654767][T13256] usb 9-1: USB disconnect, device number 16 [ 892.680219][T18100] veth1_macvtap: entered promiscuous mode [ 892.777000][T18164] 8021q: adding VLAN 0 to HW filter on device team0 [ 892.806670][ T6053] bridge0: port 1(bridge_slave_0) entered blocking state [ 892.813755][ T6053] bridge0: port 1(bridge_slave_0) entered forwarding state [ 892.867899][ T6053] bridge0: port 2(bridge_slave_1) entered blocking state [ 892.875101][ T6053] bridge0: port 2(bridge_slave_1) entered forwarding state [ 892.931088][T18100] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 892.993788][T18100] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 893.050421][ T4340] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.088453][ T4340] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.110265][ T4340] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.136700][ T4340] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.584067][ T4340] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 893.619182][ T4340] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 893.730267][ T6708] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 893.753316][ T6708] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 893.765322][T13276] usb 6-1: USB disconnect, device number 51 [ 894.213542][T18164] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 895.273910][T18507] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3396'. [ 895.751951][T18164] veth0_vlan: entered promiscuous mode [ 895.890508][T18164] veth1_vlan: entered promiscuous mode [ 895.920919][T18521] Scaler: ================= START STATUS ================= [ 896.010118][T18521] Scaler: ================== END STATUS ================== [ 896.040067][T18164] veth0_macvtap: entered promiscuous mode [ 896.102946][T18164] veth1_macvtap: entered promiscuous mode [ 896.186485][T18164] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 896.224398][T18531] FAULT_INJECTION: forcing a failure. [ 896.224398][T18531] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 896.267355][T18164] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 896.271155][T18531] CPU: 1 UID: 0 PID: 18531 Comm: syz.5.3403 Tainted: G L syzkaller #0 PREEMPT(full) [ 896.271180][T18531] Tainted: [L]=SOFTLOCKUP [ 896.271185][T18531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 896.271194][T18531] Call Trace: [ 896.271199][T18531] [ 896.271205][T18531] dump_stack_lvl+0x16c/0x1f0 [ 896.271228][T18531] should_fail_ex+0x512/0x640 [ 896.271253][T18531] _copy_from_user+0x2e/0xd0 [ 896.271274][T18531] iommufd_vfio_ioctl+0x678/0xe90 [ 896.271298][T18531] ? __pfx_iommufd_vfio_ioctl+0x10/0x10 [ 896.271327][T18531] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 896.271346][T18531] ? do_vfs_ioctl+0x128/0x14f0 [ 896.271364][T18531] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 896.271382][T18531] iommufd_fops_ioctl+0x453/0x530 [ 896.271400][T18531] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 896.271424][T18531] ? selinux_file_ioctl+0x180/0x270 [ 896.271442][T18531] ? selinux_file_ioctl+0xb4/0x270 [ 896.271461][T18531] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 896.271478][T18531] __x64_sys_ioctl+0x18e/0x210 [ 896.271496][T18531] do_syscall_64+0xcd/0xf80 [ 896.271515][T18531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.271530][T18531] RIP: 0033:0x7ffa7618f749 [ 896.271542][T18531] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 896.271556][T18531] RSP: 002b:00007ffa7710e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 896.271571][T18531] RAX: ffffffffffffffda RBX: 00007ffa763e5fa0 RCX: 00007ffa7618f749 [ 896.271580][T18531] RDX: 000020000000cfc0 RSI: 0000000000003b70 RDI: 0000000000000003 [ 896.271589][T18531] RBP: 00007ffa7710e090 R08: 0000000000000000 R09: 0000000000000000 [ 896.271597][T18531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.271606][T18531] R13: 00007ffa763e6038 R14: 00007ffa763e5fa0 R15: 00007ffd2e65f948 [ 896.271627][T18531] [ 896.468285][T13517] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 896.508391][ T4032] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.542594][ T4032] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.587362][ T4032] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.660083][T13517] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 896.686747][T13517] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 896.692232][ T4032] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.833955][T13517] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 896.896404][T13517] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 896.947521][T13517] usb 3-1: SerialNumber: syz [ 897.385361][ T6053] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 897.393248][ T6053] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 898.477064][ T30] audit: type=1400 audit(1765922759.450:720): avc: denied { add_name } for pid=18523 comm="syz.2.3401" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 898.521865][T18527] (syz.2.3401,18527,0):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 898.540189][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 898.625575][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 898.650628][ T30] audit: type=1400 audit(1765922759.500:721): avc: denied { create } for pid=18523 comm="syz.2.3401" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 898.726442][T13517] usb 3-1: 0:2 : does not exist [ 898.735774][T13517] usb 3-1: unit 5: unexpected type 0x0d [ 898.764119][T18554] syzkaller0: entered promiscuous mode [ 898.770061][T18554] syzkaller0: entered allmulticast mode [ 898.771258][T13517] usb 3-1: USB disconnect, device number 43 [ 898.810088][ T30] audit: type=1400 audit(1765922759.500:722): avc: denied { associate } for pid=18523 comm="syz.2.3401" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 898.880721][T17798] udevd[17798]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 902.497742][T18603] syzkaller0: entered promiscuous mode [ 902.503257][T18603] syzkaller0: entered allmulticast mode [ 902.962974][T18608] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3421'. [ 903.606742][T18616] siw: device registration error -23 [ 905.575193][T18633] netlink: 16 bytes leftover after parsing attributes in process `syz.9.3425'. [ 908.053498][T18663] syzkaller0: entered promiscuous mode [ 908.101152][T18663] syzkaller0: entered allmulticast mode [ 908.118636][T18665] siw: device registration error -23 [ 909.374627][ T5881] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 909.544579][T13281] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 909.635306][ T5881] usb 9-1: Using ep0 maxpacket: 32 [ 909.652626][ T5881] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 909.839231][T18686] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3437'. [ 909.878914][T13281] usb 10-1: Using ep0 maxpacket: 8 [ 910.089615][ T5881] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 910.102560][T13281] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 910.120148][T13281] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 910.131278][T13281] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 910.142926][T13281] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 910.156348][T13281] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 910.172745][T13281] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 910.183339][T13281] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 910.231057][ T5881] usb 9-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 910.283185][ T5881] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.400091][ T5881] usb 9-1: Product: syz [ 910.426004][ T5881] usb 9-1: Manufacturer: syz [ 910.438453][T13281] usb 10-1: usb_control_msg returned -32 [ 910.456351][T13281] usbtmc 10-1:16.0: can't read capabilities [ 910.491938][T13281] usb 10-1: USB disconnect, device number 2 [ 910.520342][ T5881] usb 9-1: SerialNumber: syz [ 910.583597][ T5881] usb 9-1: config 0 descriptor?? [ 910.836360][T18692] FAULT_INJECTION: forcing a failure. [ 910.836360][T18692] name failslab, interval 1, probability 0, space 0, times 0 [ 910.886809][T18692] CPU: 0 UID: 0 PID: 18692 Comm: syz.7.3439 Tainted: G L syzkaller #0 PREEMPT(full) [ 910.886850][T18692] Tainted: [L]=SOFTLOCKUP [ 910.886856][T18692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 910.886866][T18692] Call Trace: [ 910.886872][T18692] [ 910.886878][T18692] dump_stack_lvl+0x16c/0x1f0 [ 910.886902][T18692] should_fail_ex+0x512/0x640 [ 910.886924][T18692] ? fs_reclaim_acquire+0xae/0x150 [ 910.886948][T18692] should_failslab+0xc2/0x120 [ 910.886968][T18692] __kmalloc_noprof+0xeb/0x910 [ 910.886993][T18692] ? tomoyo_encode2+0x100/0x3e0 [ 910.887019][T18692] ? tomoyo_encode2+0x100/0x3e0 [ 910.887040][T18692] tomoyo_encode2+0x100/0x3e0 [ 910.887063][T18692] tomoyo_encode+0x29/0x50 [ 910.887083][T18692] tomoyo_realpath_from_path+0x18f/0x6e0 [ 910.887112][T18692] tomoyo_path_number_perm+0x245/0x580 [ 910.887130][T18692] ? tomoyo_path_number_perm+0x237/0x580 [ 910.887150][T18692] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 910.887169][T18692] ? find_held_lock+0x2b/0x80 [ 910.887214][T18692] ? find_held_lock+0x2b/0x80 [ 910.887238][T18692] ? hook_file_ioctl_common+0x144/0x410 [ 910.887269][T18692] ? __fget_files+0x20e/0x3c0 [ 910.887295][T18692] security_file_ioctl+0x9b/0x240 [ 910.887317][T18692] __x64_sys_ioctl+0xb7/0x210 [ 910.887338][T18692] do_syscall_64+0xcd/0xf80 [ 910.887360][T18692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.887376][T18692] RIP: 0033:0x7f9b1898f749 [ 910.887390][T18692] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 910.887406][T18692] RSP: 002b:00007f9b197c0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 910.887423][T18692] RAX: ffffffffffffffda RBX: 00007f9b18be5fa0 RCX: 00007f9b1898f749 [ 910.887433][T18692] RDX: 0000000000000001 RSI: 0000000000004b3a RDI: 0000000000000006 [ 910.887443][T18692] RBP: 00007f9b197c0090 R08: 0000000000000000 R09: 0000000000000000 [ 910.887454][T18692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 910.887464][T18692] R13: 00007f9b18be6038 R14: 00007f9b18be5fa0 R15: 00007ffd6c6567a8 [ 910.887489][T18692] [ 910.887906][T18692] ERROR: Out of memory at tomoyo_realpath_from_path. [ 911.598820][T18709] lo speed is unknown, defaulting to 1000 [ 911.611110][T18709] lo speed is unknown, defaulting to 1000 [ 912.265034][T13256] usb 9-1: USB disconnect, device number 17 [ 913.102967][T18741] FAULT_INJECTION: forcing a failure. [ 913.102967][T18741] name failslab, interval 1, probability 0, space 0, times 0 [ 913.140586][T18741] CPU: 1 UID: 0 PID: 18741 Comm: syz.9.3447 Tainted: G L syzkaller #0 PREEMPT(full) [ 913.140615][T18741] Tainted: [L]=SOFTLOCKUP [ 913.140622][T18741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 913.140632][T18741] Call Trace: [ 913.140638][T18741] [ 913.140645][T18741] dump_stack_lvl+0x16c/0x1f0 [ 913.140672][T18741] should_fail_ex+0x512/0x640 [ 913.140695][T18741] ? __kmalloc_cache_noprof+0x5f/0x800 [ 913.140725][T18741] should_failslab+0xc2/0x120 [ 913.140746][T18741] __kmalloc_cache_noprof+0x80/0x800 [ 913.140773][T18741] ? copy_mount_options+0x55/0x190 [ 913.140796][T18741] ? copy_mount_options+0x55/0x190 [ 913.140813][T18741] copy_mount_options+0x55/0x190 [ 913.140834][T18741] __x64_sys_mount+0x1ab/0x310 [ 913.140851][T18741] ? __pfx___x64_sys_mount+0x10/0x10 [ 913.140875][T18741] do_syscall_64+0xcd/0xf80 [ 913.140897][T18741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.140915][T18741] RIP: 0033:0x7fcf5c18f749 [ 913.140928][T18741] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 913.140944][T18741] RSP: 002b:00007fcf5d01b038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 913.140961][T18741] RAX: ffffffffffffffda RBX: 00007fcf5c3e5fa0 RCX: 00007fcf5c18f749 [ 913.140973][T18741] RDX: 0000200000004500 RSI: 00002000000000c0 RDI: 0000000000000000 [ 913.140984][T18741] RBP: 00007fcf5d01b090 R08: 0000200000000100 R09: 0000000000000000 [ 913.140998][T18741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 913.141008][T18741] R13: 00007fcf5c3e6038 R14: 00007fcf5c3e5fa0 R15: 00007ffe2f993468 [ 913.141035][T18741] [ 914.059463][T18776] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3452'. [ 914.711324][T18781] 9pnet: p9_errstr2errno: server reported unknown error ÿÿ [ 914.786874][ T5881] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 914.955496][ T5881] usb 10-1: Using ep0 maxpacket: 8 [ 915.123637][ T5881] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 915.158947][ T5881] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 915.206286][ T5881] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 915.219864][ T5881] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 915.230657][ T5881] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 915.244289][ T5881] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 915.253676][ T5881] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.326530][ T5881] usb 10-1: usb_control_msg returned -32 [ 916.343623][ T5881] usbtmc 10-1:16.0: can't read capabilities [ 916.525507][ T5881] usb 10-1: USB disconnect, device number 3 [ 916.863098][T18820] 9p: Bad value for 'wfdno' [ 917.134457][T18824] syzkaller0: entered promiscuous mode [ 917.150577][T18824] syzkaller0: entered allmulticast mode [ 917.495488][T18836] hfsplus: unable to find HFS+ superblock [ 917.724859][T18837] siw: device registration error -23 [ 918.613960][T18851] siw: device registration error -23 [ 919.023557][T18864] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3470'. [ 920.088218][T18889] misc userio: No port type given on /dev/userio [ 920.243470][T18892] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3475'. [ 920.494011][ T30] audit: type=1400 audit(1765922781.460:723): avc: denied { watch watch_reads } for pid=18888 comm="syz.7.3475" path="pipe:[64836]" dev="pipefs" ino=64836 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 920.564047][T18892] 8021q: adding VLAN 0 to HW filter on device bond1 [ 920.635799][T18893] vlan2: entered allmulticast mode [ 920.640922][T18893] macsec0: entered allmulticast mode [ 920.691270][T18893] veth1_macvtap: entered allmulticast mode [ 920.779800][ T30] audit: type=1800 audit(1765922781.520:724): pid=18881 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.8.3474" name="/" dev="fuse" ino=9 res=0 errno=0 [ 920.855714][T18893] bond1: (slave vlan2): Error -34 calling dev_set_mtu [ 921.369844][T18907] syzkaller0: entered promiscuous mode [ 921.400318][T18907] syzkaller0: entered allmulticast mode [ 921.674251][T18905] netlink: 179596 bytes leftover after parsing attributes in process `syz.9.3476'. [ 921.965975][T18920] netlink: 27 bytes leftover after parsing attributes in process `syz.8.3479'. [ 923.666821][T18947] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3486'. [ 923.704980][T18947] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.712557][T18947] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.836981][T18947] bridge0: entered allmulticast mode [ 923.837933][T18948] netlink: 'syz.2.3486': attribute type 2 has an invalid length. [ 924.085633][T18949] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3485'. [ 924.465565][ T5881] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 925.086637][T18947] bridge_slave_1: left allmulticast mode [ 925.094259][T18947] bridge_slave_1: left promiscuous mode [ 925.103018][T18947] bridge0: port 2(bridge_slave_1) entered disabled state [ 925.146790][ T5881] usb 9-1: Using ep0 maxpacket: 32 [ 925.155133][ T5881] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 925.232380][ T5881] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 925.287582][T18947] bridge_slave_0: left allmulticast mode [ 925.305211][ T5881] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 925.325798][T18947] bridge_slave_0: left promiscuous mode [ 925.344655][ T5881] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.364462][T18947] bridge0: port 1(bridge_slave_0) entered disabled state [ 925.427207][ T5881] usb 9-1: config 0 descriptor?? [ 925.448225][ T5881] hub 9-1:0.0: USB hub found [ 925.634332][ T5881] hub 9-1:0.0: 1 port detected [ 925.695228][T18968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.719539][T18968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.878387][T18970] syzkaller0: entered promiscuous mode [ 925.883858][T18970] syzkaller0: entered allmulticast mode [ 925.986218][T18975] FAULT_INJECTION: forcing a failure. [ 925.986218][T18975] name failslab, interval 1, probability 0, space 0, times 0 [ 925.995643][ T5881] hub 9-1:0.0: config failed, can't get hub status (err -5) [ 926.067292][T18975] CPU: 0 UID: 0 PID: 18975 Comm: syz.8.3491 Tainted: G L syzkaller #0 PREEMPT(full) [ 926.067323][T18975] Tainted: [L]=SOFTLOCKUP [ 926.067329][T18975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 926.067338][T18975] Call Trace: [ 926.067345][T18975] [ 926.067352][T18975] dump_stack_lvl+0x16c/0x1f0 [ 926.067377][T18975] should_fail_ex+0x512/0x640 [ 926.067399][T18975] ? kmem_cache_alloc_noprof+0x62/0x770 [ 926.067419][T18975] should_failslab+0xc2/0x120 [ 926.067440][T18975] kmem_cache_alloc_noprof+0x83/0x770 [ 926.067456][T18975] ? stack_depot_save_flags+0x29/0x9b0 [ 926.067477][T18975] ? alloc_empty_file+0x55/0x1e0 [ 926.067499][T18975] ? alloc_empty_file+0x55/0x1e0 [ 926.067513][T18975] ? kasan_save_track+0x14/0x30 [ 926.067531][T18975] alloc_empty_file+0x55/0x1e0 [ 926.067548][T18975] path_openat+0xde/0x3140 [ 926.067570][T18975] ? do_syscall_64+0xcd/0xf80 [ 926.067590][T18975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.067614][T18975] ? __pfx_path_openat+0x10/0x10 [ 926.067643][T18975] do_filp_open+0x20b/0x470 [ 926.067662][T18975] ? __pfx_do_filp_open+0x10/0x10 [ 926.067686][T18975] ? alloc_fd+0x471/0x7d0 [ 926.067704][T18975] do_sys_openat2+0x121/0x290 [ 926.067714][T18975] ? __pfx_do_sys_openat2+0x10/0x10 [ 926.067725][T18975] ? __fget_files+0x20e/0x3c0 [ 926.067742][T18975] __x64_sys_openat+0x174/0x210 [ 926.067752][T18975] ? __pfx___x64_sys_openat+0x10/0x10 [ 926.067761][T18975] ? ksys_write+0x1ac/0x250 [ 926.067780][T18975] do_syscall_64+0xcd/0xf80 [ 926.067794][T18975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.067804][T18975] RIP: 0033:0x7fe5cd58df90 [ 926.067813][T18975] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44 [ 926.067823][T18975] RSP: 002b:00007fe5cb7f5b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 926.067834][T18975] RAX: ffffffffffffffda RBX: 0000000000040800 RCX: 00007fe5cd58df90 [ 926.067840][T18975] RDX: 0000000000040800 RSI: 00007fe5cb7f5c10 RDI: 00000000ffffff9c [ 926.067847][T18975] RBP: 00007fe5cb7f5c10 R08: 0000000000000000 R09: 002367732f766564 [ 926.067853][T18975] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 926.067859][T18975] R13: 00007fe5cd7e6038 R14: 00007fe5cd7e5fa0 R15: 00007ffef62002b8 [ 926.067873][T18975] [ 926.429340][ T5881] usbhid 9-1:0.0: can't add hid device: -71 [ 926.451690][ T5881] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 926.545434][ T5881] usb 9-1: USB disconnect, device number 18 [ 926.557580][T18983] netlink: 27 bytes leftover after parsing attributes in process `syz.7.3494'. [ 926.861463][T18988] netlink: 179596 bytes leftover after parsing attributes in process `syz.8.3495'. [ 927.486542][T18997] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3497'. [ 927.645028][T13256] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 927.894580][T13256] usb 3-1: Using ep0 maxpacket: 16 [ 927.902488][T13256] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 928.092524][T13256] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.278498][T13256] usb 3-1: config 0 descriptor?? [ 928.296590][T13256] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 928.492918][T13256] gspca_sonixj: reg_r err -32 [ 928.498731][T13256] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 929.123092][ T5881] usb 3-1: USB disconnect, device number 44 [ 929.558991][T19032] syzkaller0: entered promiscuous mode [ 929.564747][T19032] syzkaller0: entered allmulticast mode [ 930.162029][T19044] hfsplus: unable to find HFS+ superblock [ 930.394601][T19034] comedi comedi0: rti800: I/O port conflict (0x2eff,16) [ 930.852246][ T30] audit: type=1400 audit(1765922791.390:725): avc: denied { name_bind } for pid=19033 comm="syz.2.3505" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 930.887693][T19035] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 931.638711][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.684410][T19073] netlink: 'syz.9.3514': attribute type 1 has an invalid length. [ 932.759887][T19076] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 932.767747][T19076] IPv6: NLM_F_CREATE should be set when creating new route [ 932.774991][T19076] IPv6: NLM_F_CREATE should be set when creating new route [ 932.797652][T19076] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 933.920193][T19095] FAULT_INJECTION: forcing a failure. [ 933.920193][T19095] name failslab, interval 1, probability 0, space 0, times 0 [ 933.946728][T19095] CPU: 0 UID: 0 PID: 19095 Comm: syz.2.3518 Tainted: G L syzkaller #0 PREEMPT(full) [ 933.946756][T19095] Tainted: [L]=SOFTLOCKUP [ 933.946762][T19095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 933.946772][T19095] Call Trace: [ 933.946778][T19095] [ 933.946786][T19095] dump_stack_lvl+0x16c/0x1f0 [ 933.946811][T19095] should_fail_ex+0x512/0x640 [ 933.946835][T19095] ? __kmalloc_cache_noprof+0x5f/0x800 [ 933.946865][T19095] should_failslab+0xc2/0x120 [ 933.946886][T19095] __kmalloc_cache_noprof+0x80/0x800 [ 933.946911][T19095] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 933.946932][T19095] ? v9fs_get_tree+0x9c/0xb50 [ 933.946959][T19095] ? v9fs_get_tree+0x9c/0xb50 [ 933.946982][T19095] v9fs_get_tree+0x9c/0xb50 [ 933.947009][T19095] ? rcu_is_watching+0x12/0xc0 [ 933.947024][T19095] ? __pfx_v9fs_get_tree+0x10/0x10 [ 933.947048][T19095] ? bpf_lsm_capable+0x9/0x10 [ 933.947066][T19095] ? security_capable+0x7e/0x260 [ 933.947086][T19095] vfs_get_tree+0x8e/0x330 [ 933.947108][T19095] path_mount+0x7bf/0x23a0 [ 933.947124][T19095] ? rcu_is_watching+0x12/0xc0 [ 933.947143][T19095] ? __pfx_path_mount+0x10/0x10 [ 933.947160][T19095] ? kmem_cache_free+0x2d8/0x770 [ 933.947178][T19095] ? putname+0xf5/0x1a0 [ 933.947206][T19095] ? putname+0xf5/0x1a0 [ 933.947228][T19095] ? putname+0xf5/0x1a0 [ 933.947254][T19095] ? __x64_sys_mount+0x293/0x310 [ 933.947268][T19095] __x64_sys_mount+0x293/0x310 [ 933.947284][T19095] ? __pfx___x64_sys_mount+0x10/0x10 [ 933.947306][T19095] do_syscall_64+0xcd/0xf80 [ 933.947328][T19095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.947346][T19095] RIP: 0033:0x7fbabaf8f749 [ 933.947360][T19095] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 933.947377][T19095] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 933.947394][T19095] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 933.947405][T19095] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 0000000000000000 [ 933.947415][T19095] RBP: 00007fbabbdac090 R08: 0000200000000200 R09: 0000000000000000 [ 933.947424][T19095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 933.947433][T19095] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 933.947457][T19095] [ 937.972891][ T5881] IPVS: starting estimator thread 0... [ 938.094815][T19141] IPVS: using max 36 ests per chain, 86400 per kthread [ 939.085072][T13256] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 939.104674][T13517] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 939.715893][T13517] usb 10-1: Using ep0 maxpacket: 32 [ 940.030747][T13517] usb 10-1: config 0 has an invalid interface number: 89 but max is 0 [ 940.060163][T13517] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 940.084727][T13274] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 940.085178][T13256] usb 6-1: device descriptor read/64, error -71 [ 940.102442][T13517] usb 10-1: config 0 has no interface number 0 [ 940.114565][T13517] usb 10-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 940.262109][T13517] usb 10-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 940.278145][T13517] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.289383][T13517] usb 10-1: Product: syz [ 940.293648][T13517] usb 10-1: Manufacturer: syz [ 940.299892][T13517] usb 10-1: SerialNumber: syz [ 940.313416][T13517] usb 10-1: config 0 descriptor?? [ 940.364642][T13256] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 940.407466][T13274] usb 8-1: Using ep0 maxpacket: 8 [ 940.419725][T13517] hub 10-1:0.89: bad descriptor, ignoring hub [ 940.429328][T13517] hub 10-1:0.89: probe with driver hub failed with error -5 [ 940.430170][T13274] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 940.445258][T13274] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 940.455042][T13274] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 940.565719][T13256] usb 6-1: device descriptor read/64, error -71 [ 940.825750][T13274] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 940.832948][T13256] usb usb6-port1: attempt power cycle [ 940.835841][T13274] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 940.854215][T13274] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 940.865952][T13274] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.971967][T19180] FAULT_INJECTION: forcing a failure. [ 940.971967][T19180] name failslab, interval 1, probability 0, space 0, times 0 [ 940.989127][T19180] CPU: 0 UID: 0 PID: 19180 Comm: syz.2.3539 Tainted: G L syzkaller #0 PREEMPT(full) [ 940.989154][T19180] Tainted: [L]=SOFTLOCKUP [ 940.989160][T19180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 940.989169][T19180] Call Trace: [ 940.989175][T19180] [ 940.989181][T19180] dump_stack_lvl+0x16c/0x1f0 [ 940.989205][T19180] should_fail_ex+0x512/0x640 [ 940.989221][T19180] ? kmem_cache_alloc_node_noprof+0x65/0x800 [ 940.989235][T19180] should_failslab+0xc2/0x120 [ 940.989248][T19180] kmem_cache_alloc_node_noprof+0x86/0x800 [ 940.989259][T19180] ? __alloc_skb+0x156/0x410 [ 940.989277][T19180] ? __alloc_skb+0x35d/0x410 [ 940.989304][T19180] ? __alloc_skb+0x156/0x410 [ 940.989323][T19180] __alloc_skb+0x156/0x410 [ 940.989343][T19180] ? __alloc_skb+0x35d/0x410 [ 940.989359][T19180] ? __pfx___alloc_skb+0x10/0x10 [ 940.989379][T19180] alloc_skb_with_frags+0xe0/0x860 [ 940.989390][T19180] ? __might_fault+0xe3/0x190 [ 940.989399][T19180] ? __might_fault+0x13b/0x190 [ 940.989413][T19180] sock_alloc_send_pskb+0x7f9/0x980 [ 940.989436][T19180] ? _copy_from_iter+0x161/0x16c0 [ 940.989465][T19180] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 940.989486][T19180] ? __lock_acquire+0x436/0x2890 [ 940.989499][T19180] ? _parse_integer_limit+0x17f/0x1d0 [ 940.989513][T19180] ? iov_iter_advance+0x7d/0x6c0 [ 940.989529][T19180] tun_get_user+0x7e2/0x3cc0 [ 940.989550][T19180] ? __pfx_tun_get_user+0x10/0x10 [ 940.989572][T19180] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 940.989603][T19180] ? find_held_lock+0x2b/0x80 [ 940.989630][T19180] ? tun_get+0x191/0x370 [ 940.989656][T19180] tun_chr_write_iter+0xdc/0x210 [ 940.989680][T19180] vfs_write+0x7d3/0x11d0 [ 940.989701][T19180] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 940.989725][T19180] ? __pfx_vfs_write+0x10/0x10 [ 940.989742][T19180] ? find_held_lock+0x2b/0x80 [ 940.989777][T19180] ksys_write+0x12a/0x250 [ 940.989790][T19180] ? __pfx_ksys_write+0x10/0x10 [ 940.989806][T19180] do_syscall_64+0xcd/0xf80 [ 940.989820][T19180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.989831][T19180] RIP: 0033:0x7fbabaf8f749 [ 940.989843][T19180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 940.989858][T19180] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 940.989874][T19180] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 940.989884][T19180] RDX: 0000000000000ffe RSI: 00002000000000c0 RDI: 0000000000000003 [ 940.989894][T19180] RBP: 00007fbabbdac090 R08: 0000000000000000 R09: 0000000000000000 [ 940.989903][T19180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 940.989912][T19180] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 940.989934][T19180] [ 941.354644][T13256] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 941.378257][T13256] usb 6-1: device descriptor read/8, error -71 [ 941.669949][T13274] usb 8-1: usb_control_msg returned -32 [ 941.694641][T13274] usbtmc 8-1:16.0: can't read capabilities [ 941.716207][T13274] usb 8-1: USB disconnect, device number 31 [ 941.785042][T13256] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 941.813299][T13256] usb 6-1: device descriptor read/8, error -71 [ 941.973130][T13256] usb usb6-port1: unable to enumerate USB device [ 942.537647][ T5881] usb 10-1: USB disconnect, device number 4 [ 942.632229][T13274] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 942.876283][T13274] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 942.894593][T13274] usb 3-1: config 0 interface 0 has no altsetting 0 [ 942.934618][ T5952] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 942.960471][T13274] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 942.970486][T13274] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 942.984534][T13274] usb 3-1: Product: syz [ 943.006290][T13274] usb 3-1: Manufacturer: syz [ 943.010993][T13274] usb 3-1: SerialNumber: syz [ 943.365599][T19220] hfsplus: unable to find HFS+ superblock [ 943.572069][ T5952] usb 10-1: device descriptor read/64, error -71 [ 943.600156][T13274] usb 3-1: config 0 descriptor?? [ 943.637852][T13274] usb 3-1: selecting invalid altsetting 0 [ 943.909243][ T30] audit: type=1400 audit(1765922804.880:726): avc: denied { map } for pid=19186 comm="syz.2.3541" path="/dev/audio3" dev="devtmpfs" ino=3616 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 943.924264][ T5952] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 943.957906][T13256] usb 3-1: USB disconnect, device number 45 [ 944.007501][T18679] udevd[18679]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 944.074835][ T5952] usb 10-1: device descriptor read/64, error -71 [ 944.234249][ T5952] usb usb10-port1: attempt power cycle [ 944.639830][T19242] siw: device registration error -23 [ 945.186514][ T5952] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 945.215002][ T5952] usb 10-1: device descriptor read/8, error -71 [ 945.320200][T13275] usb 8-1: new full-speed USB device number 32 using dummy_hcd [ 945.752503][ T5952] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 945.880066][T13275] usb 8-1: unable to get BOS descriptor or descriptor too short [ 945.893627][ T5952] usb 10-1: device descriptor read/8, error -71 [ 945.904446][T13275] usb 8-1: not running at top speed; connect to a high speed hub [ 945.933144][T13275] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 945.950641][T13275] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 945.980200][T13275] usb 8-1: string descriptor 0 read error: -22 [ 945.987200][T13275] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 946.001576][T13275] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.005212][ T5952] usb usb10-port1: unable to enumerate USB device [ 946.107199][T19259] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 946.431172][T19265] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 946.726718][T13275] usb 8-1: 0:2 : does not exist [ 947.330464][T19274] hfsplus: unable to find HFS+ superblock [ 947.668896][T13275] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 947.727518][T13275] usb 8-1: 5:0: cannot get min/max values for control 2 (id 5) [ 947.741360][T13275] usb 8-1: 5:0: cannot get min/max values for control 3 (id 5) [ 947.767810][T13275] usb 8-1: 5:0: failed to get current value for ch 1 (-22) [ 947.927296][T13275] usb 8-1: 5:0: cannot get min/max values for control 3 (id 5) [ 948.235610][T13275] usb 8-1: 5:0: cannot get min/max values for control 2 (id 5) [ 948.253272][T13275] usb 8-1: USB disconnect, device number 32 [ 948.859180][T19291] siw: device registration error -23 [ 950.526614][T19315] hfsplus: unable to find HFS+ superblock [ 950.974572][ T5881] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 951.486951][ T5881] usb 8-1: Using ep0 maxpacket: 32 [ 951.531845][ T5881] usb 8-1: config 0 has an invalid interface number: 89 but max is 0 [ 951.564055][ T5881] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 951.608062][ T5881] usb 8-1: config 0 has no interface number 0 [ 951.621525][ T5881] usb 8-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 951.661414][ T5881] usb 8-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 951.672292][ T5881] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 951.680521][ T5881] usb 8-1: Product: syz [ 951.697093][ T5881] usb 8-1: Manufacturer: syz [ 951.701729][ T5881] usb 8-1: SerialNumber: syz [ 951.715297][ T5881] usb 8-1: config 0 descriptor?? [ 951.726093][ T5881] hub 8-1:0.89: bad descriptor, ignoring hub [ 951.732260][ T5881] hub 8-1:0.89: probe with driver hub failed with error -5 [ 952.801661][T19344] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3575'. [ 953.737377][T19361] FAULT_INJECTION: forcing a failure. [ 953.737377][T19361] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 953.764771][T19361] CPU: 1 UID: 0 PID: 19361 Comm: syz.2.3584 Tainted: G L syzkaller #0 PREEMPT(full) [ 953.764800][T19361] Tainted: [L]=SOFTLOCKUP [ 953.764806][T19361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 953.764815][T19361] Call Trace: [ 953.764821][T19361] [ 953.764828][T19361] dump_stack_lvl+0x16c/0x1f0 [ 953.764852][T19361] should_fail_ex+0x512/0x640 [ 953.764879][T19361] _copy_from_user+0x2e/0xd0 [ 953.764904][T19361] ucma_write+0x128/0x330 [ 953.764927][T19361] ? __pfx_ucma_write+0x10/0x10 [ 953.764949][T19361] ? bpf_lsm_file_permission+0x9/0x10 [ 953.764966][T19361] ? security_file_permission+0x71/0x210 [ 953.764990][T19361] ? rw_verify_area+0xcf/0x6c0 [ 953.765011][T19361] ? __pfx_ucma_write+0x10/0x10 [ 953.765031][T19361] vfs_writev+0x5df/0xde0 [ 953.765057][T19361] ? __pfx_vfs_writev+0x10/0x10 [ 953.765094][T19361] ? __fget_files+0x20e/0x3c0 [ 953.765116][T19361] ? __fget_files+0x1a0/0x3c0 [ 953.765143][T19361] ? do_writev+0x28c/0x340 [ 953.765160][T19361] do_writev+0x28c/0x340 [ 953.765180][T19361] ? __pfx_do_writev+0x10/0x10 [ 953.765206][T19361] do_syscall_64+0xcd/0xf80 [ 953.765229][T19361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 953.765246][T19361] RIP: 0033:0x7fbabaf8f749 [ 953.765261][T19361] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 953.765277][T19361] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 953.765293][T19361] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 953.765304][T19361] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000008 [ 953.765315][T19361] RBP: 00007fbabbdac090 R08: 0000000000000000 R09: 0000000000000000 [ 953.765325][T19361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 953.765335][T19361] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 953.765358][T19361] [ 954.091573][ T5952] usb 8-1: USB disconnect, device number 33 [ 954.429982][T19378] hfsplus: unable to find HFS+ superblock [ 956.174589][T13256] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 956.317178][T19401] netlink: 179596 bytes leftover after parsing attributes in process `syz.9.3597'. [ 956.507287][T13256] usb 9-1: Using ep0 maxpacket: 32 [ 956.518907][T13256] usb 9-1: config 0 has an invalid interface number: 89 but max is 0 [ 956.527344][T13256] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 956.543820][T13256] usb 9-1: config 0 has no interface number 0 [ 956.587163][T13256] usb 9-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 957.270197][T13256] usb 9-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 957.281376][T13256] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 957.300927][T19411] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3596'. [ 957.321625][T13256] usb 9-1: Product: syz [ 957.494647][T13256] usb 9-1: Manufacturer: syz [ 957.499315][T13256] usb 9-1: SerialNumber: syz [ 957.611191][T13256] usb 9-1: config 0 descriptor?? [ 957.778470][T13256] hub 9-1:0.89: bad descriptor, ignoring hub [ 958.208485][T13256] hub 9-1:0.89: probe with driver hub failed with error -5 [ 958.674783][T19424] lo speed is unknown, defaulting to 1000 [ 958.688387][T19424] lo speed is unknown, defaulting to 1000 [ 958.886971][ T30] audit: type=1326 audit(1765922819.480:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19419 comm="syz.7.3601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b1898f749 code=0x7ffc0000 [ 958.947839][ T30] audit: type=1326 audit(1765922819.480:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19419 comm="syz.7.3601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b1898f749 code=0x7ffc0000 [ 958.979818][T19427] netlink: 27 bytes leftover after parsing attributes in process `syz.5.3602'. [ 959.034909][T13255] usb 9-1: USB disconnect, device number 19 [ 959.035186][ T30] audit: type=1326 audit(1765922819.480:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19419 comm="syz.7.3601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f9b1898f749 code=0x7ffc0000 [ 959.046041][T19423] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nullb0": -EINTR [ 960.124143][T19453] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3607'. [ 961.185995][T19470] netlink: 9 bytes leftover after parsing attributes in process `syz.9.3611'. [ 961.202343][T19470] netlink: 9 bytes leftover after parsing attributes in process `syz.9.3611'. [ 961.499670][T19474] siw: device registration error -23 [ 962.595058][ T5952] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 962.805183][ T5952] usb 6-1: Using ep0 maxpacket: 32 [ 962.842709][ T5952] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 962.909841][ T5952] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 962.990547][ T5952] usb 6-1: config 0 has no interface number 0 [ 963.047605][ T5952] usb 6-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 963.127206][ T5952] usb 6-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 963.153516][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.176542][ T5952] usb 6-1: Product: syz [ 963.200873][ T5952] usb 6-1: Manufacturer: syz [ 963.226519][ T5952] usb 6-1: SerialNumber: syz [ 963.237708][ T5952] usb 6-1: config 0 descriptor?? [ 963.262708][ T5952] hub 6-1:0.89: bad descriptor, ignoring hub [ 963.289915][ T5952] hub 6-1:0.89: probe with driver hub failed with error -5 [ 963.331245][ T5952] option 6-1:0.89: GSM modem (1-port) converter detected [ 964.425107][T19505] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 964.660781][T19516] siw: device registration error -23 [ 964.814927][ T5952] usb 6-1: USB disconnect, device number 56 [ 964.895067][ T5952] option 6-1:0.89: device disconnected [ 965.606912][T19531] xt_CT: You must specify a L4 protocol and not use inversions on it [ 966.846217][T19543] hfsplus: unable to find HFS+ superblock [ 967.506160][T19548] input: syz1 as /devices/virtual/input/input41 [ 968.598131][T13517] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 968.851806][T13517] usb 6-1: not running at top speed; connect to a high speed hub [ 968.866938][T13517] usb 6-1: config 128 has an invalid interface number: 231 but max is 1 [ 968.890060][T13517] usb 6-1: config 128 has an invalid interface number: 3 but max is 1 [ 969.053642][T19565] lo speed is unknown, defaulting to 1000 [ 969.066785][T19565] lo speed is unknown, defaulting to 1000 [ 969.348575][T13517] usb 6-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 969.359617][T13517] usb 6-1: config 128 has no interface number 0 [ 969.368683][T13517] usb 6-1: config 128 has no interface number 1 [ 969.378602][T13517] usb 6-1: config 128 interface 231 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 10 [ 969.393885][T13517] usb 6-1: too many endpoints for config 128 interface 3 altsetting 52: 230, using maximum allowed: 30 [ 969.433254][T13517] usb 6-1: config 128 interface 3 altsetting 52 has 0 endpoint descriptors, different from the interface descriptor's value: 230 [ 969.489839][T13517] usb 6-1: config 128 interface 231 has no altsetting 0 [ 969.502124][T13517] usb 6-1: config 128 interface 3 has no altsetting 0 [ 969.549243][T13517] usb 6-1: New USB device found, idVendor=12d1, idProduct=141f, bcdDevice= 0.00 [ 969.572895][T13517] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.582240][T13517] usb 6-1: Product: Ñ… [ 969.594851][T13517] usb 6-1: Manufacturer: И [ 969.645197][T13517] usb 6-1: SerialNumber: Ѓ [ 969.912736][T19559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 969.973837][T19559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 969.991950][T19580] pimreg: entered allmulticast mode [ 970.169025][T13517] usb-storage 6-1:128.231: USB Mass Storage device detected [ 970.296293][T19581] pimreg: left allmulticast mode [ 970.531571][T13517] hub 6-1:128.3: Invalid hub with more than one config or interface [ 970.604449][T13517] hub 6-1:128.3: probe with driver hub failed with error -22 [ 970.733667][T13517] usb-storage 6-1:128.3: USB Mass Storage device detected [ 971.151560][T19592] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 971.911977][T19603] input: syz1 as /devices/virtual/input/input42 [ 971.950374][T19592] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 972.089909][T13517] usb 6-1: USB disconnect, device number 57 [ 972.201894][T19592] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 972.579363][T19592] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 973.139391][T19641] hfsplus: unable to find HFS+ superblock [ 973.673493][T19645] serio: Serial port ttyS3 [ 973.964578][ T5952] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 974.114571][ T5952] usb 10-1: Using ep0 maxpacket: 16 [ 974.137447][ T5952] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 974.171255][ T5952] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 974.190899][ T5952] usb 10-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 974.233427][ T5952] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.258992][T19658] input: syz1 as /devices/virtual/input/input43 [ 974.276018][ T5952] usb 10-1: config 0 descriptor?? [ 974.480401][T19666] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1 sclass=netlink_route_socket pid=19666 comm=syz.2.3660 [ 974.521452][T19664] macvlan1: entered promiscuous mode [ 974.537240][T19664] macvlan1: entered allmulticast mode [ 974.552908][T19664] veth1_vlan: entered allmulticast mode [ 974.709122][ T5952] lenovo 0003:17EF:60A3.0018: hidraw0: USB HID v0.05 Device [HID 17ef:60a3] on usb-dummy_hcd.9-1/input0 [ 974.911379][T13279] usb 10-1: USB disconnect, device number 9 [ 974.945153][T13517] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 975.157206][T13517] usb 8-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 975.175213][T13517] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.358250][T19681] lo speed is unknown, defaulting to 1000 [ 975.371075][T19681] lo speed is unknown, defaulting to 1000 [ 975.691742][T13517] usb 8-1: config 0 descriptor?? [ 975.787526][T19685] netlink: 'syz.8.3664': attribute type 10 has an invalid length. [ 975.839727][T19686] netlink: 'syz.8.3664': attribute type 10 has an invalid length. [ 975.926001][T13517] hackrf 8-1:0.0: usb_control_msg() failed -32 request 0e [ 975.933119][T13517] hackrf 8-1:0.0: Could not detect board [ 975.949177][T19685] team0: Port device netdevsim0 added [ 975.956254][T13517] hackrf 8-1:0.0: probe with driver hackrf failed with error -32 [ 976.027490][T19691] futex_wake_op: syz.9.3667 tries to shift op by -1; fix this program [ 976.039280][T19686] team0: Port device netdevsim0 removed [ 976.054074][T19686] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 977.114563][ T5951] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 977.274618][ T5951] usb 10-1: Using ep0 maxpacket: 32 [ 977.281101][ T5951] usb 10-1: config 0 has an invalid interface number: 29 but max is 0 [ 977.294557][ T5951] usb 10-1: config 0 has no interface number 0 [ 977.305003][ T5951] usb 10-1: config 0 interface 29 has no altsetting 0 [ 977.322531][ T5951] usb 10-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 977.334327][ T5951] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 977.354143][ T5951] usb 10-1: Product: syz [ 977.365562][ T5951] usb 10-1: Manufacturer: syz [ 977.376397][ T5951] usb 10-1: SerialNumber: syz [ 977.410499][ T5951] usb 10-1: config 0 descriptor?? [ 977.530960][T19715] FAULT_INJECTION: forcing a failure. [ 977.530960][T19715] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 977.548769][T19717] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3673'. [ 977.591195][T19715] CPU: 0 UID: 0 PID: 19715 Comm: syz.2.3675 Tainted: G L syzkaller #0 PREEMPT(full) [ 977.591224][T19715] Tainted: [L]=SOFTLOCKUP [ 977.591230][T19715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 977.591240][T19715] Call Trace: [ 977.591246][T19715] [ 977.591254][T19715] dump_stack_lvl+0x16c/0x1f0 [ 977.591279][T19715] should_fail_ex+0x512/0x640 [ 977.591307][T19715] strncpy_from_user+0x3b/0x2e0 [ 977.591332][T19715] getname_flags.part.0+0x8f/0x550 [ 977.591352][T19715] getname_flags+0x93/0xf0 [ 977.591373][T19715] do_sys_openat2+0xb9/0x290 [ 977.591389][T19715] ? __pfx_do_sys_openat2+0x10/0x10 [ 977.591406][T19715] ? __fget_files+0x20e/0x3c0 [ 977.591432][T19715] __x64_sys_openat+0x174/0x210 [ 977.591448][T19715] ? __pfx___x64_sys_openat+0x10/0x10 [ 977.591490][T19715] ? ksys_write+0x1ac/0x250 [ 977.591519][T19715] do_syscall_64+0xcd/0xf80 [ 977.591540][T19715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.591557][T19715] RIP: 0033:0x7fbabaf8df90 [ 977.591572][T19715] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44 [ 977.591587][T19715] RSP: 002b:00007fbabbdabb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 977.591603][T19715] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fbabaf8df90 [ 977.591614][T19715] RDX: 0000000000000002 RSI: 00007fbabbdabc10 RDI: 00000000ffffff9c [ 977.591624][T19715] RBP: 00007fbabbdabc10 R08: 0000000000000000 R09: 00236f656469762f [ 977.591634][T19715] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 977.591644][T19715] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 977.591667][T19715] [ 977.779404][ T5951] peak_usb 10-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 977.911486][T13255] usb 8-1: USB disconnect, device number 34 [ 977.994944][ T5951] peak_usb 10-1:0.29 can0: sending command failure: -22 [ 978.001977][ T5951] peak_usb 10-1:0.29 can0: sending command failure: -22 [ 978.052580][ T5951] peak_usb 10-1:0.29 can0: sending command failure: -22 [ 978.122049][ T5951] peak_usb 10-1:0.29: probe with driver peak_usb failed with error -22 [ 978.166007][T19729] FAULT_INJECTION: forcing a failure. [ 978.166007][T19729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 978.254636][T19729] CPU: 0 UID: 0 PID: 19729 Comm: syz.5.3678 Tainted: G L syzkaller #0 PREEMPT(full) [ 978.254663][T19729] Tainted: [L]=SOFTLOCKUP [ 978.254669][T19729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 978.254678][T19729] Call Trace: [ 978.254684][T19729] [ 978.254690][T19729] dump_stack_lvl+0x16c/0x1f0 [ 978.254719][T19729] should_fail_ex+0x512/0x640 [ 978.254743][T19729] strncpy_from_user+0x3b/0x2e0 [ 978.254765][T19729] getname_flags.part.0+0x8f/0x550 [ 978.254784][T19729] getname_uflags+0x98/0xf0 [ 978.254803][T19729] __x64_sys_execveat+0xc4/0x120 [ 978.254824][T19729] do_syscall_64+0xcd/0xf80 [ 978.254845][T19729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.254861][T19729] RIP: 0033:0x7ffa7618f749 [ 978.254874][T19729] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 978.254889][T19729] RSP: 002b:00007ffa770ed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 978.254905][T19729] RAX: ffffffffffffffda RBX: 00007ffa763e6090 RCX: 00007ffa7618f749 [ 978.254915][T19729] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 978.254925][T19729] RBP: 00007ffa770ed090 R08: 0000000000000000 R09: 0000000000000000 [ 978.254934][T19729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 978.254944][T19729] R13: 00007ffa763e6128 R14: 00007ffa763e6090 R15: 00007ffd2e65f948 [ 978.254966][T19729] [ 979.503990][T19748] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3683'. [ 979.513760][T19748] FAULT_INJECTION: forcing a failure. [ 979.513760][T19748] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 979.529157][T19748] CPU: 0 UID: 0 PID: 19748 Comm: syz.5.3683 Tainted: G L syzkaller #0 PREEMPT(full) [ 979.529180][T19748] Tainted: [L]=SOFTLOCKUP [ 979.529184][T19748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 979.529190][T19748] Call Trace: [ 979.529194][T19748] [ 979.529199][T19748] dump_stack_lvl+0x16c/0x1f0 [ 979.529217][T19748] should_fail_ex+0x512/0x640 [ 979.529235][T19748] _copy_from_user+0x2e/0xd0 [ 979.529251][T19748] copy_msghdr_from_user+0x98/0x160 [ 979.529262][T19748] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 979.529279][T19748] ___sys_sendmsg+0xfe/0x1d0 [ 979.529290][T19748] ? __pfx____sys_sendmsg+0x10/0x10 [ 979.529315][T19748] __sys_sendmsg+0x16d/0x220 [ 979.529325][T19748] ? __pfx___sys_sendmsg+0x10/0x10 [ 979.529344][T19748] do_syscall_64+0xcd/0xf80 [ 979.529358][T19748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 979.529369][T19748] RIP: 0033:0x7ffa7618f749 [ 979.529377][T19748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 979.529388][T19748] RSP: 002b:00007ffa7710e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 979.529398][T19748] RAX: ffffffffffffffda RBX: 00007ffa763e5fa0 RCX: 00007ffa7618f749 [ 979.529405][T19748] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 979.529411][T19748] RBP: 00007ffa7710e090 R08: 0000000000000000 R09: 0000000000000000 [ 979.529417][T19748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 979.529423][T19748] R13: 00007ffa763e6038 R14: 00007ffa763e5fa0 R15: 00007ffd2e65f948 [ 979.529436][T19748] [ 979.551421][T19749] binder: 19744:19749 ioctl 40046210 0 returned -14 [ 981.189759][T19763] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=19763 comm=syz.8.3685 [ 981.915810][ T5952] usb 10-1: USB disconnect, device number 10 [ 982.612530][T19782] netlink: 16 bytes leftover after parsing attributes in process `syz.9.3690'. [ 982.690333][T19791] hfsplus: unable to find HFS+ superblock [ 982.732745][T19779] syzkaller0: entered promiscuous mode [ 982.749300][T19779] syzkaller0: entered allmulticast mode [ 983.249137][ T30] audit: type=1400 audit(1765922844.220:730): avc: denied { create } for pid=19798 comm="syz.9.3694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 983.556742][T19805] lo speed is unknown, defaulting to 1000 [ 983.570065][T19805] lo speed is unknown, defaulting to 1000 [ 985.185075][T19825] FAULT_INJECTION: forcing a failure. [ 985.185075][T19825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 985.226922][T19825] CPU: 0 UID: 0 PID: 19825 Comm: syz.5.3699 Tainted: G L syzkaller #0 PREEMPT(full) [ 985.226943][T19825] Tainted: [L]=SOFTLOCKUP [ 985.226946][T19825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 985.226953][T19825] Call Trace: [ 985.226957][T19825] [ 985.226961][T19825] dump_stack_lvl+0x16c/0x1f0 [ 985.226979][T19825] should_fail_ex+0x512/0x640 [ 985.226997][T19825] _copy_from_iter+0x2a4/0x16c0 [ 985.227014][T19825] ? __alloc_skb+0x220/0x410 [ 985.227029][T19825] ? __alloc_skb+0x35d/0x410 [ 985.227044][T19825] ? __pfx__copy_from_iter+0x10/0x10 [ 985.227059][T19825] ? netlink_autobind.isra.0+0x158/0x370 [ 985.227078][T19825] netlink_sendmsg+0x820/0xdd0 [ 985.227092][T19825] ? __pfx_netlink_sendmsg+0x10/0x10 [ 985.227110][T19825] ____sys_sendmsg+0xa5d/0xc30 [ 985.227124][T19825] ? copy_msghdr_from_user+0x10a/0x160 [ 985.227134][T19825] ? __pfx_____sys_sendmsg+0x10/0x10 [ 985.227153][T19825] ___sys_sendmsg+0x134/0x1d0 [ 985.227164][T19825] ? __pfx____sys_sendmsg+0x10/0x10 [ 985.227189][T19825] __sys_sendmsg+0x16d/0x220 [ 985.227199][T19825] ? __pfx___sys_sendmsg+0x10/0x10 [ 985.227218][T19825] do_syscall_64+0xcd/0xf80 [ 985.227232][T19825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 985.227242][T19825] RIP: 0033:0x7ffa7618f749 [ 985.227251][T19825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 985.227262][T19825] RSP: 002b:00007ffa7710e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 985.227272][T19825] RAX: ffffffffffffffda RBX: 00007ffa763e5fa0 RCX: 00007ffa7618f749 [ 985.227279][T19825] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 985.227285][T19825] RBP: 00007ffa7710e090 R08: 0000000000000000 R09: 0000000000000000 [ 985.227291][T19825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 985.227297][T19825] R13: 00007ffa763e6038 R14: 00007ffa763e5fa0 R15: 00007ffd2e65f948 [ 985.227310][T19825] [ 985.646703][ T30] audit: type=1400 audit(1765922846.580:731): avc: denied { ioctl } for pid=19830 comm="syz.5.3702" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x660b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 985.754793][T13279] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 986.134541][T13279] usb 3-1: Using ep0 maxpacket: 8 [ 986.152903][T13279] usb 3-1: config 0 has an invalid interface number: 166 but max is 0 [ 986.168346][T13279] usb 3-1: config 0 has no interface number 0 [ 986.178548][T13279] usb 3-1: config 0 interface 166 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 986.317307][T13279] usb 3-1: config 0 interface 166 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16 [ 986.327729][T13279] usb 3-1: New USB device found, idVendor=0c10, idProduct=0000, bcdDevice=b0.a7 [ 986.336947][T13279] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 986.348561][T13279] usb 3-1: config 0 descriptor?? [ 986.355427][T19828] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 986.363021][T19828] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 986.432175][T19843] hfsplus: unable to find HFS+ superblock [ 986.796931][ T5951] usb 3-1: USB disconnect, device number 46 [ 987.044545][T13279] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 987.255809][T19851] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 987.294567][T13279] usb 6-1: Using ep0 maxpacket: 32 [ 987.303503][T13279] usb 6-1: unable to get BOS descriptor or descriptor too short [ 987.318622][T19851] netlink: 44 bytes leftover after parsing attributes in process `syz.7.3708'. [ 987.327694][T19851] netlink: 'syz.7.3708': attribute type 6 has an invalid length. [ 987.335417][T19851] netlink: 'syz.7.3708': attribute type 5 has an invalid length. [ 987.343114][T19851] netlink: 'syz.7.3708': attribute type 4 has an invalid length. [ 988.023033][T13279] usb 6-1: config 135 has an invalid interface number: 152 but max is 0 [ 988.031742][T13279] usb 6-1: config 135 has no interface number 0 [ 988.038407][T13279] usb 6-1: config 135 interface 152 has no altsetting 0 [ 988.047327][T13279] usb 6-1: New USB device found, idVendor=0547, idProduct=6801, bcdDevice=11.3b [ 988.056594][T13279] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.066250][T13279] usb 6-1: Product: syz [ 988.070461][T13279] usb 6-1: Manufacturer: syz [ 988.075357][T13279] usb 6-1: SerialNumber: syz [ 988.247168][T19859] input: syz1 as /devices/virtual/input/input44 [ 988.445130][T19868] lo speed is unknown, defaulting to 1000 [ 988.458182][T19868] lo speed is unknown, defaulting to 1000 [ 989.023531][T13279] gspca_main: touptek-2.14.0 probing 0547:6801 [ 989.093290][T13279] usb 6-1: USB disconnect, device number 58 [ 989.145271][T13517] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 989.324620][T13517] usb 8-1: Using ep0 maxpacket: 32 [ 989.346775][T13517] usb 8-1: config 0 has an invalid interface number: 29 but max is 0 [ 989.367084][T13517] usb 8-1: config 0 has no interface number 0 [ 989.463141][T13517] usb 8-1: config 0 interface 29 has no altsetting 0 [ 989.506195][T13517] usb 8-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 989.530061][T13517] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.556669][T13517] usb 8-1: Product: syz [ 989.558744][T19885] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3716'. [ 989.560867][T13517] usb 8-1: Manufacturer: syz [ 989.590638][T13517] usb 8-1: SerialNumber: syz [ 989.597700][T19890] FAULT_INJECTION: forcing a failure. [ 989.597700][T19890] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 989.602561][T13517] usb 8-1: config 0 descriptor?? [ 989.610934][T19890] CPU: 1 UID: 0 PID: 19890 Comm: syz.2.3719 Tainted: G L syzkaller #0 PREEMPT(full) [ 989.610961][T19890] Tainted: [L]=SOFTLOCKUP [ 989.610967][T19890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 989.610976][T19890] Call Trace: [ 989.610981][T19890] [ 989.610988][T19890] dump_stack_lvl+0x16c/0x1f0 [ 989.611012][T19890] should_fail_ex+0x512/0x640 [ 989.611036][T19890] _copy_from_user+0x2e/0xd0 [ 989.611057][T19890] ucma_write+0x128/0x330 [ 989.611078][T19890] ? __pfx_ucma_write+0x10/0x10 [ 989.611096][T19890] ? bpf_lsm_file_permission+0x9/0x10 [ 989.611111][T19890] ? security_file_permission+0x71/0x210 [ 989.611132][T19890] ? rw_verify_area+0xcf/0x6c0 [ 989.611150][T19890] ? __pfx_ucma_write+0x10/0x10 [ 989.611167][T19890] vfs_writev+0x5df/0xde0 [ 989.611189][T19890] ? __pfx_vfs_writev+0x10/0x10 [ 989.611220][T19890] ? __fget_files+0x20e/0x3c0 [ 989.611238][T19890] ? __fget_files+0x1a0/0x3c0 [ 989.611261][T19890] ? do_writev+0x28c/0x340 [ 989.611276][T19890] do_writev+0x28c/0x340 [ 989.611292][T19890] ? __pfx_do_writev+0x10/0x10 [ 989.611315][T19890] do_syscall_64+0xcd/0xf80 [ 989.611335][T19890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.611351][T19890] RIP: 0033:0x7fbabaf8f749 [ 989.611363][T19890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 989.611377][T19890] RSP: 002b:00007fbabbdac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 989.611392][T19890] RAX: ffffffffffffffda RBX: 00007fbabb1e5fa0 RCX: 00007fbabaf8f749 [ 989.611401][T19890] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000016 [ 989.611410][T19890] RBP: 00007fbabbdac090 R08: 0000000000000000 R09: 0000000000000000 [ 989.611419][T19890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 989.611427][T19890] R13: 00007fbabb1e6038 R14: 00007fbabb1e5fa0 R15: 00007ffcc71db648 [ 989.611447][T19890] [ 990.165531][T19901] hfsplus: unable to find HFS+ superblock [ 990.495296][T13517] peak_usb 8-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 990.769626][T13517] peak_usb 8-1:0.29 can0: sending command failure: -22 [ 990.779154][T13517] peak_usb 8-1:0.29 can0: sending command failure: -22 [ 990.787005][T13517] peak_usb 8-1:0.29 can0: sending command failure: -22 [ 991.194008][T13517] peak_usb 8-1:0.29: probe with driver peak_usb failed with error -22 [ 991.931582][T19922] siw: device registration error -23 [ 992.489521][T19921] input: syz1 as /devices/virtual/input/input45 [ 992.809387][T19929] lo speed is unknown, defaulting to 1000 [ 992.822252][T19929] lo speed is unknown, defaulting to 1000 [ 993.110399][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.404667][T19937] siw: device registration error -23 [ 994.089185][T19944] openvswitch: netlink: IP tunnel dst address not specified [ 994.427458][ T30] audit: type=1400 audit(1765922855.390:732): avc: denied { search } for pid=19945 comm="syz.8.3733" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 994.526374][T13517] usb 8-1: USB disconnect, device number 35 [ 994.555369][T19957] FAULT_INJECTION: forcing a failure. [ 994.555369][T19957] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 994.568640][ T30] audit: type=1400 audit(1765922855.450:733): avc: denied { search } for pid=19945 comm="syz.8.3733" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 994.613536][T19957] CPU: 1 UID: 0 PID: 19957 Comm: syz.7.3735 Tainted: G L syzkaller #0 PREEMPT(full) [ 994.613561][T19957] Tainted: [L]=SOFTLOCKUP [ 994.613567][T19957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 994.613576][T19957] Call Trace: [ 994.613582][T19957] [ 994.613589][T19957] dump_stack_lvl+0x16c/0x1f0 [ 994.613614][T19957] should_fail_ex+0x512/0x640 [ 994.613644][T19957] _copy_from_iter+0x2a4/0x16c0 [ 994.613677][T19957] ? __alloc_skb+0x220/0x410 [ 994.613700][T19957] ? __alloc_skb+0x35d/0x410 [ 994.613723][T19957] ? __pfx__copy_from_iter+0x10/0x10 [ 994.613746][T19957] ? netlink_autobind.isra.0+0x158/0x370 [ 994.613777][T19957] netlink_sendmsg+0x820/0xdd0 [ 994.613801][T19957] ? __pfx_netlink_sendmsg+0x10/0x10 [ 994.613829][T19957] ____sys_sendmsg+0xa5d/0xc30 [ 994.613850][T19957] ? copy_msghdr_from_user+0x10a/0x160 [ 994.613866][T19957] ? __pfx_____sys_sendmsg+0x10/0x10 [ 994.613897][T19957] ___sys_sendmsg+0x134/0x1d0 [ 994.613909][T19957] ? __pfx____sys_sendmsg+0x10/0x10 [ 994.613935][T19957] __sys_sendmsg+0x16d/0x220 [ 994.613945][T19957] ? __pfx___sys_sendmsg+0x10/0x10 [ 994.613964][T19957] do_syscall_64+0xcd/0xf80 [ 994.613978][T19957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.613989][T19957] RIP: 0033:0x7f9b1898f749 [ 994.613998][T19957] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 994.614009][T19957] RSP: 002b:00007f9b197c0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 994.614019][T19957] RAX: ffffffffffffffda RBX: 00007f9b18be5fa0 RCX: 00007f9b1898f749 [ 994.614026][T19957] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 994.614032][T19957] RBP: 00007f9b197c0090 R08: 0000000000000000 R09: 0000000000000000 [ 994.614038][T19957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 994.614044][T19957] R13: 00007f9b18be6038 R14: 00007f9b18be5fa0 R15: 00007ffd6c6567a8 [ 994.614057][T19957] [ 994.841977][ T30] audit: type=1400 audit(1765922855.480:734): avc: denied { search } for pid=19945 comm="syz.8.3733" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 994.885199][T19961] netlink: 44 bytes leftover after parsing attributes in process `syz.7.3737'. [ 995.084230][T19961] netlink: 59 bytes leftover after parsing attributes in process `syz.7.3737'. [ 995.137034][T19961] netlink: 59 bytes leftover after parsing attributes in process `syz.7.3737'. [ 996.524935][T19967] input: syz1 as /devices/virtual/input/input46 [ 997.826062][T19979] lo speed is unknown, defaulting to 1000 [ 997.832451][T19979] lo speed is unknown, defaulting to 1000 [ 998.534781][ T5952] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 998.694650][ T5952] usb 8-1: Using ep0 maxpacket: 16 [ 998.708317][ T5952] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 998.718971][ T5952] usb 8-1: config 1 has no interface number 1 [ 998.734584][ T5952] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 998.747581][ T30] audit: type=1400 audit(1765922859.710:735): avc: denied { write } for pid=19997 comm="syz.2.3745" path="socket:[69680]" dev="sockfs" ino=69680 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 998.773079][ T30] audit: type=1400 audit(1765922859.730:736): avc: denied { read } for pid=19997 comm="syz.2.3745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 998.804291][ T5952] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 998.814633][ T5952] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.826043][ T5952] usb 8-1: Product: syz [ 998.830275][ T5952] usb 8-1: Manufacturer: syz [ 998.841122][ T5952] usb 8-1: SerialNumber: syz [ 999.076363][ T5952] usb 8-1: 2:1 : no UAC_FORMAT_TYPE desc [ 999.091591][ T5952] usb 8-1: USB disconnect, device number 36 [ 999.117107][T19600] udevd[19600]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 999.175481][T13279] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 999.310989][T20004] input: syz1 as /devices/virtual/input/input47 [ 999.324811][T13279] usb 9-1: Using ep0 maxpacket: 8 [ 999.343892][T13279] usb 9-1: config 0 has an invalid interface number: 55 but max is 0 [ 999.357352][T13279] usb 9-1: config 0 has no interface number 0 [ 999.363464][T13279] usb 9-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 999.374788][T13279] usb 9-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 999.386528][T13279] usb 9-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 999.397814][T13279] usb 9-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 999.411698][T13279] usb 9-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 999.420781][T13279] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 999.435488][T13279] usb 9-1: config 0 descriptor?? [ 999.455253][T13279] ldusb 9-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1000.324702][ T5951] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1000.492547][T13279] usb 9-1: USB disconnect, device number 20 [ 1000.492618][ C1] ldusb 9-1:0.55: usb_submit_urb failed (-19) [ 1000.599597][T13279] ldusb 9-1:0.55: LD USB Device #0 now disconnected [ 1000.606552][T20002] ldusb: No device or device unplugged -19 [ 1000.655315][ T5951] usb 6-1: Using ep0 maxpacket: 8 [ 1000.789555][T20028] lo speed is unknown, defaulting to 1000 [ 1000.802948][T20028] lo speed is unknown, defaulting to 1000 [ 1001.104000][ T5951] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1001.154321][ T5951] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1001.205545][ T5951] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1001.253207][T20034] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1001.293970][ T5951] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1001.389045][ T5951] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1001.402646][ T5951] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.864203][ T5951] usb 6-1: GET_CAPABILITIES returned 0 [ 1001.874287][ T5951] usbtmc 6-1:16.0: can't read capabilities [ 1001.917744][T20047] input: syz1 as /devices/virtual/input/input48 [ 1002.008557][T20050] syzkaller1: entered promiscuous mode [ 1002.026696][T20050] syzkaller1: entered allmulticast mode [ 1002.194352][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.203430][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.212467][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.221502][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.230534][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.239559][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.248591][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.257640][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.266693][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.275725][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.778254][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.787379][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.796476][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.805517][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1002.814563][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1003.034331][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1003.359277][T20006] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3751'. [ 1003.791822][T13517] usb 6-1: USB disconnect, device number 59 [ 1003.873030][T20076] lo speed is unknown, defaulting to 1000 [ 1003.880633][T20076] lo speed is unknown, defaulting to 1000 [ 1004.350387][T20084] FAULT_INJECTION: forcing a failure. [ 1004.350387][T20084] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.779299][T20084] CPU: 1 UID: 0 PID: 20084 Comm: syz.7.3773 Tainted: G L syzkaller #0 PREEMPT(full) [ 1004.779319][T20084] Tainted: [L]=SOFTLOCKUP [ 1004.779323][T20084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1004.779329][T20084] Call Trace: [ 1004.779332][T20084] [ 1004.779337][T20084] dump_stack_lvl+0x16c/0x1f0 [ 1004.779354][T20084] should_fail_ex+0x512/0x640 [ 1004.779377][T20084] ? kmem_cache_alloc_noprof+0x62/0x770 [ 1004.779390][T20084] should_failslab+0xc2/0x120 [ 1004.779404][T20084] kmem_cache_alloc_noprof+0x83/0x770 [ 1004.779413][T20084] ? __might_fault+0xe3/0x190 [ 1004.779423][T20084] ? getname_flags.part.0+0x4c/0x550 [ 1004.779436][T20084] ? getname_flags.part.0+0x4c/0x550 [ 1004.779446][T20084] getname_flags.part.0+0x4c/0x550 [ 1004.779458][T20084] getname_flags+0x93/0xf0 [ 1004.779471][T20084] path_getxattrat+0x296/0x2d0 [ 1004.779489][T20084] ? __pfx_path_getxattrat+0x10/0x10 [ 1004.779504][T20084] ? ksys_write+0x190/0x250 [ 1004.779519][T20084] ? __mutex_unlock_slowpath+0x161/0x790 [ 1004.779542][T20084] ? __pfx_ksys_write+0x10/0x10 [ 1004.779558][T20084] do_syscall_64+0xcd/0xf80 [ 1004.779571][T20084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.779582][T20084] RIP: 0033:0x7f9b1898f749 [ 1004.779591][T20084] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1004.779601][T20084] RSP: 002b:00007f9b197c0038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bf [ 1004.779612][T20084] RAX: ffffffffffffffda RBX: 00007f9b18be5fa0 RCX: 00007f9b1898f749 [ 1004.779618][T20084] RDX: 0000200000000480 RSI: 0000200000000280 RDI: 0000200000000240 [ 1004.779625][T20084] RBP: 00007f9b197c0090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.779631][T20084] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.779637][T20084] R13: 00007f9b18be6038 R14: 00007f9b18be5fa0 R15: 00007ffd6c6567a8 [ 1004.779650][T20084] [ 1005.265821][T20089] input: syz1 as /devices/virtual/input/input49 [ 1006.750385][T20109] hfsplus: unable to find HFS+ superblock [ 1008.005394][T20131] lo speed is unknown, defaulting to 1000 [ 1008.115609][T20131] lo speed is unknown, defaulting to 1000 [ 1008.580363][T20123] FAULT_INJECTION: forcing a failure. [ 1008.580363][T20123] name failslab, interval 1, probability 0, space 0, times 0 [ 1008.811570][T20123] CPU: 0 UID: 0 PID: 20123 Comm: syz.8.3783 Tainted: G L syzkaller #0 PREEMPT(full) [ 1008.811606][T20123] Tainted: [L]=SOFTLOCKUP [ 1008.811613][T20123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1008.811623][T20123] Call Trace: [ 1008.811630][T20123] [ 1008.811637][T20123] dump_stack_lvl+0x16c/0x1f0 [ 1008.811664][T20123] should_fail_ex+0x512/0x640 [ 1008.811688][T20123] ? __kmalloc_noprof+0xca/0x910 [ 1008.811716][T20123] should_failslab+0xc2/0x120 [ 1008.811738][T20123] __kmalloc_noprof+0xeb/0x910 [ 1008.811760][T20123] ? __might_fault+0x13b/0x190 [ 1008.811776][T20123] ? sk_prot_alloc+0x1a8/0x2a0 [ 1008.811800][T20123] ? sk_prot_alloc+0x1a8/0x2a0 [ 1008.811818][T20123] sk_prot_alloc+0x1a8/0x2a0 [ 1008.811840][T20123] sk_alloc+0x36/0xe30 [ 1008.811865][T20123] bpf_prog_test_run_skb+0x4cd/0x31a0 [ 1008.811891][T20123] ? find_held_lock+0x2b/0x80 [ 1008.811923][T20123] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1008.811946][T20123] ? fput+0x70/0xf0 [ 1008.811973][T20123] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1008.811992][T20123] __sys_bpf+0x1035/0x4980 [ 1008.812020][T20123] ? __pfx___sys_bpf+0x10/0x10 [ 1008.812042][T20123] ? find_held_lock+0x2b/0x80 [ 1008.812071][T20123] ? find_held_lock+0x2b/0x80 [ 1008.812101][T20123] ? __mutex_unlock_slowpath+0x161/0x790 [ 1008.812138][T20123] ? fput+0x70/0xf0 [ 1008.812162][T20123] ? ksys_write+0x1ac/0x250 [ 1008.812182][T20123] ? __pfx_ksys_write+0x10/0x10 [ 1008.812206][T20123] __x64_sys_bpf+0x78/0xc0 [ 1008.812228][T20123] ? lockdep_hardirqs_on+0x7c/0x110 [ 1008.812247][T20123] do_syscall_64+0xcd/0xf80 [ 1008.812269][T20123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1008.812285][T20123] RIP: 0033:0x7fe5cd58f749 [ 1008.812300][T20123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1008.812316][T20123] RSP: 002b:00007fe5cb7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1008.812332][T20123] RAX: ffffffffffffffda RBX: 00007fe5cd7e5fa0 RCX: 00007fe5cd58f749 [ 1008.812344][T20123] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 1008.812353][T20123] RBP: 00007fe5cb7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1008.812362][T20123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1008.812372][T20123] R13: 00007fe5cd7e6038 R14: 00007fe5cd7e5fa0 R15: 00007ffef62002b8 [ 1008.812396][T20123] [ 1009.275970][T20146] FAULT_INJECTION: forcing a failure. [ 1009.275970][T20146] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1009.289145][T20146] CPU: 0 UID: 0 PID: 20146 Comm: syz.9.3788 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.289172][T20146] Tainted: [L]=SOFTLOCKUP [ 1009.289178][T20146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1009.289187][T20146] Call Trace: [ 1009.289193][T20146] [ 1009.289199][T20146] dump_stack_lvl+0x16c/0x1f0 [ 1009.289225][T20146] should_fail_ex+0x512/0x640 [ 1009.289253][T20146] _copy_from_iter+0x2a4/0x16c0 [ 1009.289280][T20146] ? __alloc_skb+0x220/0x410 [ 1009.289303][T20146] ? __alloc_skb+0x35d/0x410 [ 1009.289326][T20146] ? __pfx__copy_from_iter+0x10/0x10 [ 1009.289348][T20146] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 1009.289370][T20146] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 1009.289395][T20146] netlink_sendmsg+0x820/0xdd0 [ 1009.289415][T20146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1009.289437][T20146] ____sys_sendmsg+0xa5d/0xc30 [ 1009.289455][T20146] ? copy_msghdr_from_user+0x10a/0x160 [ 1009.289467][T20146] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1009.289492][T20146] ___sys_sendmsg+0x134/0x1d0 [ 1009.289506][T20146] ? __pfx____sys_sendmsg+0x10/0x10 [ 1009.289541][T20146] __sys_sendmsg+0x16d/0x220 [ 1009.289555][T20146] ? __pfx___sys_sendmsg+0x10/0x10 [ 1009.289580][T20146] do_syscall_64+0xcd/0xf80 [ 1009.289601][T20146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.289614][T20146] RIP: 0033:0x7fcf5c18f749 [ 1009.289626][T20146] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1009.289638][T20146] RSP: 002b:00007fcf5d01b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1009.289651][T20146] RAX: ffffffffffffffda RBX: 00007fcf5c3e5fa0 RCX: 00007fcf5c18f749 [ 1009.289659][T20146] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1009.289667][T20146] RBP: 00007fcf5d01b090 R08: 0000000000000000 R09: 0000000000000000 [ 1009.289675][T20146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1009.289683][T20146] R13: 00007fcf5c3e6038 R14: 00007fcf5c3e5fa0 R15: 00007ffe2f993468 [ 1009.289702][T20146] [ 1009.547709][T20144] FAULT_INJECTION: forcing a failure. [ 1009.547709][T20144] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1009.727996][T20150] FAULT_INJECTION: forcing a failure. [ 1009.727996][T20150] name failslab, interval 1, probability 0, space 0, times 0 [ 1009.740693][T20150] CPU: 1 UID: 0 PID: 20150 Comm: syz.9.3790 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.740710][T20150] Tainted: [L]=SOFTLOCKUP [ 1009.740713][T20150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1009.740720][T20150] Call Trace: [ 1009.740724][T20150] [ 1009.740728][T20150] dump_stack_lvl+0x16c/0x1f0 [ 1009.740745][T20150] should_fail_ex+0x512/0x640 [ 1009.740761][T20150] ? __kmalloc_cache_noprof+0x5f/0x800 [ 1009.740779][T20150] should_failslab+0xc2/0x120 [ 1009.740793][T20150] __kmalloc_cache_noprof+0x80/0x800 [ 1009.740808][T20150] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1009.740823][T20150] ? io_wq_create+0x6a/0x9a0 [ 1009.740835][T20150] ? io_wq_create+0x6a/0x9a0 [ 1009.740843][T20150] io_wq_create+0x6a/0x9a0 [ 1009.740853][T20150] io_uring_alloc_task_context+0x1e1/0x650 [ 1009.740870][T20150] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 1009.740888][T20150] __io_uring_add_tctx_node+0x2dd/0x500 [ 1009.740903][T20150] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 1009.740919][T20150] ? __fget_files+0x20e/0x3c0 [ 1009.740935][T20150] __io_uring_add_tctx_node_from_submit+0x89/0x130 [ 1009.740951][T20150] __do_sys_io_uring_enter+0x1242/0x1630 [ 1009.740963][T20150] ? __fget_files+0x20e/0x3c0 [ 1009.740977][T20150] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1009.740989][T20150] ? fput+0x70/0xf0 [ 1009.741008][T20150] ? ksys_write+0x1ac/0x250 [ 1009.741020][T20150] ? __pfx_ksys_write+0x10/0x10 [ 1009.741036][T20150] do_syscall_64+0xcd/0xf80 [ 1009.741050][T20150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.741061][T20150] RIP: 0033:0x7fcf5c18f749 [ 1009.741070][T20150] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1009.741080][T20150] RSP: 002b:00007fcf5cfed038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1009.741091][T20150] RAX: ffffffffffffffda RBX: 00007fcf5c3e6090 RCX: 00007fcf5c18f749 [ 1009.741097][T20150] RDX: 000000003e000000 RSI: 000000000000133d RDI: 0000000000000004 [ 1009.741103][T20150] RBP: 00007fcf5cfed090 R08: 0000000000000000 R09: 0000000000000000 [ 1009.741109][T20150] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 1009.741115][T20150] R13: 00007fcf5c3e6128 R14: 00007fcf5c3e6090 R15: 00007ffe2f993468 [ 1009.741129][T20150] [ 1009.755977][T20144] CPU: 0 UID: 0 PID: 20144 Comm: syz.7.3782 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.756001][T20144] Tainted: [L]=SOFTLOCKUP [ 1009.756006][T20144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1009.756015][T20144] Call Trace: [ 1009.756021][T20144] [ 1009.756027][T20144] dump_stack_lvl+0x16c/0x1f0 [ 1009.756048][T20144] should_fail_ex+0x512/0x640 [ 1009.756072][T20144] _copy_to_user+0x32/0xd0 [ 1009.756094][T20144] simple_read_from_buffer+0xcb/0x170 [ 1009.756116][T20144] proc_fail_nth_read+0x197/0x240 [ 1009.756132][T20144] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1009.756155][T20144] ? rw_verify_area+0xcf/0x6c0 [ 1009.756171][T20144] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1009.756185][T20144] vfs_read+0x1e4/0xcf0 [ 1009.756203][T20144] ? __pfx___mutex_lock+0x10/0x10 [ 1009.756224][T20144] ? __pfx_vfs_read+0x10/0x10 [ 1009.756247][T20144] ? __fget_files+0x20e/0x3c0 [ 1009.756273][T20144] ksys_read+0x12a/0x250 [ 1009.756289][T20144] ? __pfx_ksys_read+0x10/0x10 [ 1009.756307][T20144] ? fput+0x70/0xf0 [ 1009.756331][T20144] do_syscall_64+0xcd/0xf80 [ 1009.756355][T20144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.756371][T20144] RIP: 0033:0x7f9b1898e15c [ 1009.756383][T20144] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1009.756396][T20144] RSP: 002b:00007f9b1979f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1009.756410][T20144] RAX: ffffffffffffffda RBX: 00007f9b18be6090 RCX: 00007f9b1898e15c [ 1009.756420][T20144] RDX: 000000000000000f RSI: 00007f9b1979f0a0 RDI: 0000000000000007 [ 1009.756429][T20144] RBP: 00007f9b1979f090 R08: 0000000000000000 R09: 0000000000000000 [ 1009.756438][T20144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1009.756446][T20144] R13: 00007f9b18be6128 R14: 00007f9b18be6090 R15: 00007ffd6c6567a8 [ 1009.756467][T20144] [ 1010.327777][T20160] FAULT_INJECTION: forcing a failure. [ 1010.327777][T20160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1010.596392][T20165] hfsplus: unable to find HFS+ superblock [ 1010.854575][T20160] CPU: 0 UID: 0 PID: 20160 Comm: syz.8.3794 Tainted: G L syzkaller #0 PREEMPT(full) [ 1010.854604][T20160] Tainted: [L]=SOFTLOCKUP [ 1010.854610][T20160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1010.854620][T20160] Call Trace: [ 1010.854630][T20160] [ 1010.854638][T20160] dump_stack_lvl+0x16c/0x1f0 [ 1010.854664][T20160] should_fail_ex+0x512/0x640 [ 1010.854692][T20160] _copy_from_iter+0x2a4/0x16c0 [ 1010.854721][T20160] ? __alloc_skb+0x220/0x410 [ 1010.854745][T20160] ? __alloc_skb+0x35d/0x410 [ 1010.854769][T20160] ? __pfx__copy_from_iter+0x10/0x10 [ 1010.854791][T20160] ? netlink_autobind.isra.0+0x158/0x370 [ 1010.854821][T20160] netlink_sendmsg+0x820/0xdd0 [ 1010.854849][T20160] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1010.854879][T20160] ____sys_sendmsg+0xa5d/0xc30 [ 1010.854901][T20160] ? copy_msghdr_from_user+0x10a/0x160 [ 1010.854918][T20160] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1010.854951][T20160] ___sys_sendmsg+0x134/0x1d0 [ 1010.854969][T20160] ? __pfx____sys_sendmsg+0x10/0x10 [ 1010.855017][T20160] __sys_sendmsg+0x16d/0x220 [ 1010.855035][T20160] ? __pfx___sys_sendmsg+0x10/0x10 [ 1010.855068][T20160] do_syscall_64+0xcd/0xf80 [ 1010.855091][T20160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1010.855108][T20160] RIP: 0033:0x7fe5cd58f749 [ 1010.855122][T20160] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1010.855137][T20160] RSP: 002b:00007fe5cb7f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1010.855153][T20160] RAX: ffffffffffffffda RBX: 00007fe5cd7e5fa0 RCX: 00007fe5cd58f749 [ 1010.855165][T20160] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1010.855174][T20160] RBP: 00007fe5cb7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1010.855184][T20160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1010.855195][T20160] R13: 00007fe5cd7e6038 R14: 00007fe5cd7e5fa0 R15: 00007ffef62002b8 [ 1010.855219][T20160] [ 1011.552361][T20181] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1012.344600][ T5952] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1012.606035][ T5952] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1012.624703][ T5952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1012.776161][ T5952] usb 3-1: config 0 descriptor?? [ 1012.968759][ T5952] cp210x 3-1:0.0: cp210x converter detected [ 1012.993906][ T5952] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 1013.012032][ T5952] cp210x 3-1:0.0: querying part number failed [ 1013.046709][ T5952] usb 3-1: cp210x converter now attached to ttyUSB0 [ 1013.344634][ T30] audit: type=1400 audit(1765922874.270:737): avc: denied { ioctl } for pid=20205 comm="syz.5.3805" path="socket:[70713]" dev="sockfs" ino=70713 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1013.394176][T20196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.424394][T20196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1013.529143][T20208] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3805'. [ 1013.857360][T20208] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3805'. [ 1013.975288][T13517] usb 3-1: USB disconnect, device number 47 [ 1013.998148][T13517] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1014.026946][T13517] cp210x 3-1:0.0: device disconnected [ 1014.083340][T20213] openvswitch: netlink: IP tunnel dst address not specified [ 1014.152844][T20218] evm: overlay not supported [ 1014.158784][ T30] audit: type=1400 audit(1765922875.130:738): avc: denied { watch } for pid=20217 comm="syz.9.3808" path="/74/bus/file1" dev="overlay" ino=462 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1014.516225][T20222] netlink: 179596 bytes leftover after parsing attributes in process `syz.7.3807'. [ 1015.784318][T20241] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1 sclass=netlink_route_socket pid=20241 comm=syz.8.3812 [ 1016.016593][T20247] siw: device registration error -23 [ 1016.664563][ T5952] usb 6-1: new low-speed USB device number 60 using dummy_hcd [ 1016.855954][ T5952] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 1016.864077][ T5952] usb 6-1: config 0 has no interface number 0 [ 1016.871334][ T5952] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1016.885110][ T5952] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1016.898899][ T5952] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1016.910679][ T5952] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1016.924244][ T5952] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1016.944758][ T5952] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1016.961449][ T5952] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1016.970767][ T5952] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1016.982066][ T5952] usb 6-1: config 0 descriptor?? [ 1016.991766][T20246] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1017.012231][T20246] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1017.023472][ T5952] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1017.622819][ T30] audit: type=1400 audit(1765922878.590:739): avc: denied { write } for pid=20245 comm="syz.5.3814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1017.645729][T20246] netlink: 256 bytes leftover after parsing attributes in process `syz.5.3814'. [ 1017.692413][T20246] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3814'. [ 1017.771003][T20246] ldusb 6-1:0.55: Write buffer overflow, 1 bytes dropped [ 1018.393889][T13517] usb 6-1: USB disconnect, device number 60 [ 1018.405472][T13517] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 1018.958962][T20283] IPVS: set_ctl: invalid protocol: 44 0.0.0.0:0 [ 1019.199360][T20289] siw: device registration error -23 [ 1019.770248][T20295] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3826'. [ 1020.814894][T20311] input: syz1 as /devices/virtual/input/input50 [ 1021.244818][T13279] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1021.615073][T13279] usb 9-1: Using ep0 maxpacket: 8 [ 1021.629434][T13279] usb 9-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 1021.656942][T13279] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1021.867147][T20328] siw: device registration error -23 [ 1022.365183][T13279] usb 9-1: config 0 descriptor?? [ 1023.179564][T13279] usb 9-1: string descriptor 0 read error: -71 [ 1023.209617][T13279] uvcvideo 9-1:0.0: Found UVC 0.00 device (2833:0201) [ 1023.544677][T13279] uvcvideo 9-1:0.0: No valid video chain found. [ 1023.567767][T13279] usb 9-1: USB disconnect, device number 21 [ 1025.647905][T20367] mkiss: ax0: crc mode is auto. [ 1026.270781][T20374] siw: device registration error -23 [ 1027.208413][T20381] hfsplus: unable to find HFS+ superblock [ 1027.914390][T20387] veth0: entered promiscuous mode [ 1027.924347][T20387] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3857'. [ 1028.488175][T20387] veth0 (unregistering): left promiscuous mode [ 1134.204445][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1134.211418][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P18164/1:b..l P20370/1:b..l [ 1134.221158][ C1] rcu: (detected by 1, t=10502 jiffies, g=95497, q=310 ncpus=2) [ 1134.228861][ C1] task:syz.7.3850 state:R running task stack:27096 pid:20370 tgid:20365 ppid:18100 task_flags:0x40044c flags:0x00080001 [ 1134.243050][ C1] Call Trace: [ 1134.246326][ C1] [ 1134.249248][ C1] ? __schedule+0x10b9/0x6150 [ 1134.253918][ C1] __schedule+0x1139/0x6150 [ 1134.258425][ C1] ? __pfx___schedule+0x10/0x10 [ 1134.263265][ C1] ? lock_acquire+0x179/0x330 [ 1134.267938][ C1] preempt_schedule_irq+0x51/0x90 [ 1134.272953][ C1] irqentry_exit+0x1d8/0x8c0 [ 1134.278061][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1134.284036][ C1] RIP: 0010:lock_acquire+0x62/0x330 [ 1134.289225][ C1] Code: a6 18 12 83 f8 07 0f 87 a2 02 00 00 89 c0 48 0f a3 05 82 b6 ee 0e 0f 82 74 02 00 00 8b 35 1a e7 ee 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 99 a6 18 12 0f 85 ad 02 00 00 48 83 c4 [ 1134.308819][ C1] RSP: 0018:ffffc90003126e90 EFLAGS: 00000206 [ 1134.314871][ C1] RAX: 0000000000000046 RBX: ffffffff8e3c9620 RCX: 0000000068c1bacb [ 1134.322828][ C1] RDX: 0000000000000000 RSI: ffffffff8daa7ad1 RDI: ffffffff8bf2b380 [ 1134.330783][ C1] RBP: 0000000000000002 R08: 00000000ffffffff R09: 00000000ffffffff [ 1134.338738][ C1] R10: 0000000000000002 R11: ffff888025b6d4b0 R12: 0000000000000000 [ 1134.346696][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1134.354666][ C1] ? unwind_next_frame+0x3f4/0x20a0 [ 1134.359860][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1134.366005][ C1] unwind_next_frame+0xd1/0x20a0 [ 1134.370934][ C1] ? unwind_next_frame+0xbd/0x20a0 [ 1134.376038][ C1] ? do_exit+0x87f/0x2bd0 [ 1134.380358][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1134.386520][ C1] arch_stack_walk+0x94/0x100 [ 1134.391195][ C1] ? do_exit+0x87f/0x2bd0 [ 1134.395514][ C1] stack_trace_save+0x8e/0xc0 [ 1134.400181][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1134.405543][ C1] ? __lock_acquire+0x436/0x2890 [ 1134.410473][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 1134.415747][ C1] save_stack+0x160/0x1f0 [ 1134.420071][ C1] ? __pfx_save_stack+0x10/0x10 [ 1134.424912][ C1] ? free_unref_folios+0xa22/0x1610 [ 1134.430096][ C1] ? folios_put_refs+0x4be/0x750 [ 1134.435031][ C1] ? shmem_undo_range+0x58f/0x1140 [ 1134.440134][ C1] ? shmem_evict_inode+0x39e/0xbe0 [ 1134.445253][ C1] ? evict+0x3c2/0xad0 [ 1134.449307][ C1] ? iput.part.0+0x621/0x1190 [ 1134.453968][ C1] ? iput+0x35/0x40 [ 1134.457761][ C1] ? dentry_unlink_inode+0x29c/0x480 [ 1134.463047][ C1] ? __dentry_kill+0x1d0/0x600 [ 1134.467813][ C1] ? finish_dput+0x76/0x480 [ 1134.472312][ C1] ? dput.part.0+0x451/0x570 [ 1134.476899][ C1] ? dput+0x1f/0x30 [ 1134.480705][ C1] ? __fput+0x51c/0xb70 [ 1134.484845][ C1] ? task_work_run+0x150/0x240 [ 1134.489600][ C1] ? do_exit+0x87f/0x2bd0 [ 1134.493928][ C1] ? page_ext_put+0x3e/0xd0 [ 1134.498428][ C1] __reset_page_owner+0x84/0x1a0 [ 1134.503361][ C1] free_unref_folios+0xa22/0x1610 [ 1134.508382][ C1] ? rcu_is_watching+0x12/0xc0 [ 1134.513141][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1134.518942][ C1] folios_put_refs+0x4be/0x750 [ 1134.523700][ C1] ? __pfx_folios_put_refs+0x10/0x10 [ 1134.528977][ C1] ? folio_batch_remove_exceptionals+0x115/0x1a0 [ 1134.535298][ C1] shmem_undo_range+0x58f/0x1140 [ 1134.540230][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 1134.545609][ C1] ? __lock_acquire+0x436/0x2890 [ 1134.550556][ C1] ? find_held_lock+0x2b/0x80 [ 1134.555226][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 1134.560413][ C1] ? bpf_ksym_find+0x127/0x1c0 [ 1134.565170][ C1] ? percpu_counter_add_batch+0xca/0x200 [ 1134.570797][ C1] shmem_evict_inode+0x39e/0xbe0 [ 1134.575725][ C1] ? inode_wait_for_writeback+0x170/0x390 [ 1134.581435][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1134.586879][ C1] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 1134.592939][ C1] ? find_held_lock+0x2b/0x80 [ 1134.597608][ C1] ? evict+0x37e/0xad0 [ 1134.601666][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1134.607113][ C1] evict+0x3c2/0xad0 [ 1134.610996][ C1] ? find_held_lock+0x2b/0x80 [ 1134.615668][ C1] ? __pfx_evict+0x10/0x10 [ 1134.620076][ C1] ? iput.part.0+0x619/0x1190 [ 1134.624746][ C1] iput.part.0+0x621/0x1190 [ 1134.629241][ C1] iput+0x35/0x40 [ 1134.632861][ C1] dentry_unlink_inode+0x29c/0x480 [ 1134.637967][ C1] __dentry_kill+0x1d0/0x600 [ 1134.642545][ C1] finish_dput+0x76/0x480 [ 1134.646863][ C1] dput.part.0+0x451/0x570 [ 1134.651280][ C1] dput+0x1f/0x30 [ 1134.654923][ C1] __fput+0x51c/0xb70 [ 1134.658934][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1134.664138][ C1] task_work_run+0x150/0x240 [ 1134.668729][ C1] ? __pfx_task_work_run+0x10/0x10 [ 1134.673835][ C1] ? do_raw_spin_unlock+0x172/0x230 [ 1134.679035][ C1] do_exit+0x87f/0x2bd0 [ 1134.683179][ C1] ? lock_acquire+0x179/0x330 [ 1134.687848][ C1] ? __pfx_do_exit+0x10/0x10 [ 1134.692423][ C1] ? find_held_lock+0x2b/0x80 [ 1134.697099][ C1] do_group_exit+0xd3/0x2a0 [ 1134.701597][ C1] get_signal+0x2671/0x26d0 [ 1134.706100][ C1] ? __pfx_do_recvmmsg+0x10/0x10 [ 1134.711032][ C1] ? __pfx_get_signal+0x10/0x10 [ 1134.715913][ C1] ? do_futex+0x122/0x350 [ 1134.720253][ C1] arch_do_signal_or_restart+0x8f/0x7e0 [ 1134.725807][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1134.731965][ C1] ? __x64_sys_recvmmsg+0x1d9/0x280 [ 1134.737167][ C1] exit_to_user_mode_loop+0x8c/0x540 [ 1134.742457][ C1] do_syscall_64+0x4ee/0xf80 [ 1134.747042][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.752925][ C1] RIP: 0033:0x7f9b1898f749 [ 1134.757324][ C1] RSP: 002b:00007f9b1979f038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1134.765723][ C1] RAX: 0000000000010106 RBX: 00007f9b18be6090 RCX: 00007f9b1898f749 [ 1134.773679][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 000000000000000b [ 1134.781637][ C1] RBP: 00007f9b18a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 1134.789592][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1134.797552][ C1] R13: 00007f9b18be6128 R14: 00007f9b18be6090 R15: 00007ffd6c6567a8 [ 1134.805534][ C1] [ 1134.808555][ C1] task:syz-executor state:R running task stack:24008 pid:18164 tgid:18164 ppid:18163 task_flags:0x400140 flags:0x00080000 [ 1134.822037][ C1] Call Trace: [ 1134.825306][ C1] [ 1134.828229][ C1] ? __schedule+0x10b9/0x6150 [ 1134.832899][ C1] __schedule+0x1139/0x6150 [ 1134.837395][ C1] ? mark_held_locks+0x49/0x80 [ 1134.842161][ C1] ? __pfx___schedule+0x10/0x10 [ 1134.847003][ C1] ? preempt_schedule_thunk+0x16/0x30 [ 1134.852363][ C1] preempt_schedule_common+0x44/0xc0 [ 1134.857638][ C1] preempt_schedule_thunk+0x16/0x30 [ 1134.862831][ C1] _raw_spin_unlock+0x3e/0x50 [ 1134.867496][ C1] copy_page_range+0x22d0/0x6780 [ 1134.872459][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 1134.877750][ C1] ? __pfx___might_resched+0x10/0x10 [ 1134.883023][ C1] ? __pfx_mas_store+0x10/0x10 [ 1134.887784][ C1] ? dup_mmap+0xba4/0x20e0 [ 1134.892194][ C1] ? down_write+0x14d/0x200 [ 1134.896697][ C1] ? up_write+0x282/0x4e0 [ 1134.901037][ C1] dup_mmap+0xbea/0x20e0 [ 1134.905376][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 1134.910058][ C1] copy_process+0x3b9f/0x7430 [ 1134.914732][ C1] ? do_wp_page+0x1c04/0x5010 [ 1134.919407][ C1] ? __pfx_copy_process+0x10/0x10 [ 1134.924424][ C1] ? do_raw_spin_lock+0x12c/0x2b0 [ 1134.929448][ C1] kernel_clone+0xfc/0x910 [ 1134.933852][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 1134.938877][ C1] __do_sys_clone+0xce/0x120 [ 1134.943454][ C1] ? __pfx___do_sys_clone+0x10/0x10 [ 1134.948639][ C1] ? count_memcg_events+0x122/0x290 [ 1134.953840][ C1] ? do_user_addr_fault+0x843/0x1370 [ 1134.959124][ C1] do_syscall_64+0xcd/0xf80 [ 1134.963621][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.969501][ C1] RIP: 0033:0x7fcf5c185e93 [ 1134.973901][ C1] RSP: 002b:00007ffe2f9936e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1134.982301][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcf5c185e93 [ 1134.990260][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 1134.998218][ C1] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 1135.006175][ C1] R10: 0000555562d6e7d0 R11: 0000000000000246 R12: 0000000000000000 [ 1135.014136][ C1] R13: 00000000000927c0 R14: 00000000000fb267 R15: 00007ffe2f993880 [ 1135.022107][ C1] [ 1135.025113][ C1] rcu: rcu_preempt kthread starved for 10573 jiffies! g95497 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 1135.036294][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1135.046244][ C1] rcu: RCU grace-period kthread stack dump: [ 1135.052110][ C1] task:rcu_preempt state:R running task stack:28024 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1135.065585][ C1] Call Trace: [ 1135.068867][ C1] [ 1135.071788][ C1] ? __schedule+0x10b9/0x6150 [ 1135.076539][ C1] __schedule+0x1139/0x6150 [ 1135.081033][ C1] ? __lock_acquire+0x436/0x2890 [ 1135.085964][ C1] ? __mod_timer+0x8f2/0xd30 [ 1135.090552][ C1] ? __pfx___schedule+0x10/0x10 [ 1135.095386][ C1] ? find_held_lock+0x2b/0x80 [ 1135.100057][ C1] ? schedule+0x2d7/0x3a0 [ 1135.104376][ C1] schedule+0xe7/0x3a0 [ 1135.108433][ C1] schedule_timeout+0x123/0x290 [ 1135.113273][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 1135.118632][ C1] ? __pfx_process_timeout+0x10/0x10 [ 1135.123907][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1135.129701][ C1] ? prepare_to_swait_event+0xf5/0x480 [ 1135.135152][ C1] rcu_gp_fqs_loop+0x1ea/0xaf0 [ 1135.139913][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1135.145191][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 1135.150384][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 1135.155308][ C1] ? rcu_gp_cleanup+0x7c1/0xe90 [ 1135.160156][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1135.165955][ C1] rcu_gp_kthread+0x26d/0x380 [ 1135.170622][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1135.175807][ C1] ? rcu_is_watching+0x12/0xc0 [ 1135.180558][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 1135.185748][ C1] ? __kthread_parkme+0x19e/0x250 [ 1135.190759][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1135.195953][ C1] kthread+0x3c5/0x780 [ 1135.200019][ C1] ? __pfx_kthread+0x10/0x10 [ 1135.204602][ C1] ? rcu_is_watching+0x12/0xc0 [ 1135.209349][ C1] ? __pfx_kthread+0x10/0x10 [ 1135.213929][ C1] ret_from_fork+0x983/0xb10 [ 1135.218506][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1135.223609][ C1] ? __switch_to+0x7af/0x10d0 [ 1135.228277][ C1] ? __pfx_kthread+0x10/0x10 [ 1135.232854][ C1] ret_from_fork_asm+0x1a/0x30 [ 1135.237622][ C1] [ 1135.240624][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 1135.246933][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1135.257416][ C1] Tainted: [L]=SOFTLOCKUP [ 1135.261721][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1135.271764][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1135.277396][ C1] Code: c6 5f 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 59 12 00 fb f4 cc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1135.296992][ C1] RSP: 0018:ffffc90000197de8 EFLAGS: 000002c6 [ 1135.303047][ C1] RAX: 0000000004d666a3 RBX: 0000000000000001 RCX: ffffffff8b7806d9 [ 1135.311003][ C1] RDX: 0000000000000000 RSI: ffffffff8dacdb69 RDI: ffffffff8bf2b380 [ 1135.318961][ C1] RBP: ffffed1003b56498 R08: 0000000000000001 R09: ffffed10170a673d [ 1135.326918][ C1] R10: ffff8880b85339eb R11: ffff88801dab2ff0 R12: 0000000000000001 [ 1135.334875][ C1] R13: ffff88801dab24c0 R14: ffffffff9088afd0 R15: 0000000000000000 [ 1135.342836][ C1] FS: 0000000000000000(0000) GS:ffff8881249f6000(0000) knlGS:0000000000000000 [ 1135.351753][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1135.358324][ C1] CR2: 0000001b34b0bff8 CR3: 00000000427a0000 CR4: 00000000003526f0 [ 1135.366285][ C1] Call Trace: [ 1135.369552][ C1] [ 1135.372467][ C1] default_idle+0x13/0x20 [ 1135.376791][ C1] default_idle_call+0x6c/0xb0 [ 1135.381545][ C1] do_idle+0x38d/0x510 [ 1135.385621][ C1] ? __pfx_do_idle+0x10/0x10 [ 1135.390216][ C1] cpu_startup_entry+0x4f/0x60 [ 1135.394974][ C1] start_secondary+0x21d/0x2d0 [ 1135.399728][ C1] ? __pfx_start_secondary+0x10/0x10 [ 1135.405004][ C1] common_startup_64+0x13e/0x148 [ 1135.409943][ C1]