last executing test programs: 3m29.799108815s ago: executing program 1 (id=1016): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 3m29.49622357s ago: executing program 1 (id=1019): r0 = dup(0xffffffffffffffff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b40)=@bpf_lsm={0x1d, 0x10, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xb56}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}}}, &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x45, &(0x7f0000000600)=""/69, 0x41000, 0x40, '\x00', 0x0, 0x1b, r0, 0x8, &(0x7f0000000700)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000740)={0x5, 0x6, 0xffff, 0xf}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000ac0)=[r0, r0, r0, r0, r0], &(0x7f0000000b00)=[{0x0, 0x2, 0xd, 0x2}, {0x1, 0x5, 0x4, 0x5}, {0x1, 0x3, 0xe, 0x8}, {0x5, 0x5, 0xf, 0x7}], 0x10, 0x3}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='quota']) r4 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) quotactl_fd$Q_GETQUOTA(r4, 0xffffffff80000701, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0xaad82, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000140)={@broadcast, @random="17043a73dbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr=0x64010102, {[@lsrr={0x83, 0x3}, @timestamp_prespec={0x44, 0x24, 0x0, 0x3, 0x0, [{@private=0xa010102, 0x10000}, {@remote}, {@remote, 0x200}, {@private}]}]}}}}}}}, 0x0) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x13, r6, 0x0) 3m27.946498251s ago: executing program 1 (id=1024): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='itimer_state\x00', r1}, 0x10) setitimer(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0xfffffffffffffe31) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000040)={0x0, 0x2315, 0x9, 0x0, 0x7}) listen(0xffffffffffffffff, 0x0) openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) socket$kcm(0x10, 0x2, 0x10) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)={[{@quota}]}) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3m22.537627209s ago: executing program 1 (id=1032): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a00000009058135d2000000000904010000020d00000904010102020d0000090582020002000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 3m18.977251863s ago: executing program 1 (id=1044): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, 0x0) 3m18.744756006s ago: executing program 1 (id=1047): r0 = epoll_create1(0x0) lgetxattr(0x0, &(0x7f0000000040)=@known='trusted.overlay.upper\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e220000060005"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001900)=@newtaction={0xeb8, 0x30, 0xb, 0x0, 0x0, {}, [{0xea4, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xb}}]}, {0x4}, {0xc}, {0xc}}}, @m_pedit={0xe58, 0x2, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x1}, [{}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0xffffffff}, {0x0, 0xfffffffc}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {0x40}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x9}, {0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {0x20}, {0x0, 0x0, 0x6}, {0x0, 0x2000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0xfffffffc}, {0x0, 0x0, 0x8001}, {0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8df}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {0x1, 0x0, 0x0, 0x401, 0xfffffffe}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {0x0, 0x0, 0x0, 0x1d4ce113}, {}, {0x400}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1000000}, {}, {0x2}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x10000}, {}, {0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {0x400000}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x1}, {0x0, 0x3}, {0x0, 0x0, 0x3}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2, 0x1}, {}, {}, {}, {}, {}, {0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x92ac3a63ad849ad5}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x3}, {0x0, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb8}}, 0x4000) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) ioctl$FS_IOC_SETFLAGS(r0, 0x541b, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFC_CMD_START_POLL(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x24}}, 0x0) 3m3.603579735s ago: executing program 32 (id=1047): r0 = epoll_create1(0x0) lgetxattr(0x0, &(0x7f0000000040)=@known='trusted.overlay.upper\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e220000060005"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001900)=@newtaction={0xeb8, 0x30, 0xb, 0x0, 0x0, {}, [{0xea4, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xb}}]}, {0x4}, {0xc}, {0xc}}}, @m_pedit={0xe58, 0x2, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x1}, [{}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0xffffffff}, {0x0, 0xfffffffc}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {0x40}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x9}, {0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {0x20}, {0x0, 0x0, 0x6}, {0x0, 0x2000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0xfffffffc}, {0x0, 0x0, 0x8001}, {0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8df}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {0x1, 0x0, 0x0, 0x401, 0xfffffffe}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {0x0, 0x0, 0x0, 0x1d4ce113}, {}, {0x400}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1000000}, {}, {0x2}, {0x0, 0x0, 0x0, 0x7, 0x0, 0x10000}, {}, {0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {0x400000}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x1}, {0x0, 0x3}, {0x0, 0x0, 0x3}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2, 0x1}, {}, {}, {}, {}, {}, {0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x92ac3a63ad849ad5}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x3}, {0x0, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb8}}, 0x4000) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) ioctl$FS_IOC_SETFLAGS(r0, 0x541b, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFC_CMD_START_POLL(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x24}}, 0x0) 18.267662223s ago: executing program 4 (id=1510): clock_adjtime(0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="28020000", @ANYRES16=r3, @ANYRES8=r1], 0x228}, 0x1, 0x0, 0x0, 0x200480c0}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f00004a2000/0x2000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x13, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r4 = openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r4, 0xc0045103, &(0x7f0000000040)) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000140)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0xa, 0x4e24, 0x10000, @empty}, 0x0, {[0x0, 0x0, 0x79, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}}, 0x5c) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000000)={0xc4, "d941fbe7bc487d3ed43a4ee5d8d3fd5ec6ad01b27bd110d2db7fb8f71c6706ab612500decc85e2ab6430306372b5575271ea21a83a899a83bc740a4086a9e2f1efe9a24c4a42c469c863e962d48010dc66a3da706196b115ba62b1558bc3928b29bb5e42bd680ad2cebfb0877963c4051b54c3865dcc0d178811b1bf5ece24ee48351087a216d9021dcf883f8e6c09044519eb3e31a961e919496369f71ff95efb8de589655d6eb2f82403350d436dbdb2d6a99c944060369a2f59b41aab6b8db240faacaf57d649c190d725fdf968c15c8f500e9f126601c4c358a5215294fe7b957c3401e8c5b12fc6e41490b405edbf727c3bc48fd16cf853b95c541ab91a09b24016078eea1c75db20d4dd726ca63203f54262e04e201ce29338de9fb9f1f657edae9fc1738a07396350455fd137d74f92717b31993b5fed5c8576ebad6eb346ca69aaff1b1e278755482d09f2a817ba47fd6ac41b2d4cc82163b21c0a486685c373dcaae2471033b6edff36bdeaaab2f7cf4d3c116d56854f02cd9d8e0232fa896dcb6aaa0b508237a9d8768e9db3b807db47ba6d3809f0c700d0a118b3468a7f7314a5f4b1e55aa3c748bd6b02ccdd561c58b2c63cf87cbbafaca707f6697e10bd2c83dce6515c2e362dd8e69312c0e42955c4b6bada5ff3d2dbc5b630996596f0dfdf863ac7d6378b6b33c0786dd43695014f9137da71341866bbdebc"}) 15.014549882s ago: executing program 3 (id=1517): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xfffffffffffffefe) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000000)={0x4, 0x0, 0x16, 0x1, 0x100, &(0x7f0000000040)="387ed7626d850509a2d6c1aa38f15cd0c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88731b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d461d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8ddbf5e20d604413ed2ddf9bcbf881caf811852806175d638909f6234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44504901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a266639438ac5252d9bccff4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d01000100df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60ba0f013139929ccfec965c0c769785a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a9013923167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642447bc2195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) r2 = syz_open_dev$media(&(0x7f00000001c0), 0xfff, 0x82543) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000000)=0xffffffffffffffff) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0x7c80, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f00000001c0)=@e={0xff, 0xa, 0xc, 0x2, @generic=0x1f, 0x8, 0x7, 0x4}) 14.141332246s ago: executing program 4 (id=1519): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setsig(r0, 0xa, 0x30) fcntl$setlease(r0, 0x400, 0x1) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000001, 0x13, 0xffffffffffffffff, 0x1e67e000) open_tree(0xffffffffffffffff, &(0x7f0000000300)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x89800) open(&(0x7f00000000c0)='./file0\x00', 0x2, 0x2) flock(0xffffffffffffffff, 0x2) lsetxattr$system_posix_acl(&(0x7f0000000700)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x24, 0x0) 13.604657352s ago: executing program 4 (id=1521): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x2c020400) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x04\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}h\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000x0, &(0x7f0000000140)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_merged\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x3, 0x0, @fd, 0x0, 0x0, 0x7, 0x0, 0x1}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_POLL_REMOVE={0x7, 0x3c, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x7330, 0x0, 0x0, 0x0, 0x0) 11.186080597s ago: executing program 3 (id=1528): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x52, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @const={0x0, {0x0, 0x3400}}}) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000000)={0x1, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x0) 10.092918914s ago: executing program 2 (id=1531): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00'}, 0x18) syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000100013070000000000000000fc020000000000000000000000000000fe8000000000000000000000000000100004000000000000000000202c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe"], 0xf0}, 0x1, 0xe}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) sync() mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 10.051100031s ago: executing program 3 (id=1532): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xf, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='uid_map\x00') pread64(r4, &(0x7f0000000480)=""/177, 0xb1, 0xa6) socket$tipc(0x1e, 0x2, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7000000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x482, &(0x7f0000001640)=""/139, &(0x7f0000000100)=0x8) 9.29718533s ago: executing program 0 (id=1533): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x8000000004) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000100)=0x19, 0x4) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) r6 = landlock_create_ruleset(&(0x7f00000000c0)={0x501b, 0x2, 0x1}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) 8.8754792s ago: executing program 2 (id=1534): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0xf, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) ioctl$KVM_RUN(r3, 0xae80, 0x0) 8.653315989s ago: executing program 3 (id=1536): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) read(r0, &(0x7f0000000000)=""/60, 0x3c) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000018c0)={0x1c, r1, 0xacf5e67dd0b583a1, 0x0, 0x0, {{0x5}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x8001) syz_init_net_socket$ax25(0x3, 0x2, 0xce) socket$kcm(0x10, 0x4, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000040)={0x0, @null, @bpq0, 0xb49, 'syz1\x00', @null, 0xfff, 0x3, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 8.439812478s ago: executing program 3 (id=1537): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r1 = getpid() syz_pidfd_open(r1, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(r2, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) sched_setaffinity(0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x1f) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000040)={0x2, 0x1, 0x18, 0x7, 0x73, 0x0}) 7.765347863s ago: executing program 4 (id=1538): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x40000000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r2}, 0x10) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000000010ac054182000000200001090224000100000000090400000103000000092100000001220500090581030000000000dcfdc3aed67480c84275dd313b94f43542347497c9d5d7e59680d465197c675c2db1516b2f7cbc21b20efb61f8639d58f8943ffce64bdc5b8dc9124483e2c8aec2f49d1b58233687ec4f9289d69b128697816b2479c2e263a543d26a060cd6c39b6962955d5b9ac63146d55e677a76db6f747bda6413092ed1e5f2a8eb2f78a130f1236cd6f0eebd01467a35a8de2fbf5f685906b4f94d1c3f1b5dd0caae0709793c1a5c0532f4851eec53791ad3449ad97b9c506866e27dba8133aa74401cb5b69b7a63168ce79e609a7da9787a7e3efa0c4c382ca4b825b1d88adf074e5e14fef8ec4b373f4d5d8b"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000004c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) sendto$inet6(r1, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) 7.425019313s ago: executing program 2 (id=1540): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) socket$inet(0x10, 0x3, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x62043, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, 0x0) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x100000400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0xfffffffffffffc39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffe, 0x6, 0x3, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)="bb881affa01a", 0x0, 0x8001, 0x0, 0x3, 0x0}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x7) 7.384956989s ago: executing program 5 (id=1541): creat(&(0x7f0000000040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)) open(&(0x7f0000000140)='./file1\x00', 0x141242, 0x40) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x18) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) socket$packet(0x11, 0xa, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x17, 0x0, 0x8400, 0x1, 0x0, 0x1}, 0x48) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b40)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x3, 0x3, 0x1, 0x0, 0x8}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r3, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 7.312632289s ago: executing program 0 (id=1542): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sched_switch\x00', r3}, 0x18) recvmmsg(0xffffffffffffffff, &(0x7f0000006e40)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x2, 0x0) r4 = socket(0x840000000002, 0x3, 0xff) connect$inet(r4, &(0x7f0000000540)={0x2, 0x4e22, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x300, 0x401eb94) 6.900601845s ago: executing program 5 (id=1543): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffa000/0x4000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$rdma_cm(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) io_setup(0x6, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x8, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.76901966s ago: executing program 2 (id=1544): r0 = socket$xdp(0x2c, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x3) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000240), 0x4) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000180)) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x0, 0x2}, 0x20) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000001780)=0x100000, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x1a3480, 0x0) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffffff, 0xd, "ff3f66fa733f1b33e356d25b90c98fe587b88a"}) 5.557004024s ago: executing program 0 (id=1545): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec850000007d000000850000002a0000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x40200, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) gettid() r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r4, 0x0) connect$unix(r3, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 5.294031707s ago: executing program 5 (id=1546): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='itimer_state\x00', r0}, 0x10) setitimer(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0xfffffffffffffe31) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f0000000040)={0x0, 0x2315, 0x9, 0x0, 0x7}) listen(0xffffffffffffffff, 0x0) r4 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) socket$kcm(0x10, 0x2, 0x10) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)={[{@quota}]}) chdir(0x0) symlink(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') write$binfmt_format(r4, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x10) 4.216975426s ago: executing program 5 (id=1547): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone3(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$rdma_cm(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, 0x0) setregid(0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usbip_server_init(0x3) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x34, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x7, 0x0, 0x0, @fd=r1}]}, 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) 4.158136695s ago: executing program 0 (id=1548): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x9, 0x17, 0x8, 0x40, 0x42, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$usbfs(0x0, 0x76, 0x101b01) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r0, 0x0, 0x0}, 0x20) 2.302152761s ago: executing program 5 (id=1549): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f00000000c0), 0x101040, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001005000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) 2.295085625s ago: executing program 2 (id=1550): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000017850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x61680, 0x20, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x8000000000002) sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000001040)=@raw={'raw\x00', 0x3c1, 0x3, 0x360, 0x1c0, 0x12, 0x600, 0x0, 0x202, 0x290, 0x2e8, 0x2e8, 0x290, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "0000000000000019b5115c2aee68d23a465cd431e150c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baeb8989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b500", 0x2}}, @inet=@rpfilter={{0x28}, {0x397d920994752ccb}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) bind$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) 2.247716299s ago: executing program 3 (id=1551): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x521080, 0x0) gettid() timer_create(0x0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x8080) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) 2.005499826s ago: executing program 0 (id=1552): r0 = syz_open_dev$dri(0x0, 0x1, 0x70000) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x10, &(0x7f00000010c0), 0x4) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 97.856671ms ago: executing program 5 (id=1553): r0 = socket$xdp(0x2c, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x3) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000240), 0x4) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000180)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x0, 0x2}, 0x20) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000340)=0x8000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000001780)=0x100000, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x1a3480, 0x0) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffffff, 0xd, "ff3f66fa733f1b33e356d25b90c98fe587b88a"}) 55.071046ms ago: executing program 2 (id=1554): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 0 (id=1555): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f00000020c0)={0x2020}, 0x2020) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x93, &(0x7f00000003c0)=""/147}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) chdir(&(0x7f00000003c0)='./bus\x00') r5 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r5, &(0x7f0000001fc0)=""/184, 0x20002078) r6 = syz_open_dev$usbfs(0x0, 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000000)={0x0, 0x0, "ec9fe44d4dbe56a60274fcffffffffffffff14e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e008104df635e731a5bfcd942f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd4f6cfdfe756bc00d08e36655c00"}) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f00000006c0)={0x2, 0xf, 0x4, 0x1, 0x0, 0x5, 0x0}) kernel console output (not intermixed with test programs): ead failed [ 312.947945][ T5884] usb 3-1: selecting invalid altsetting 6 [ 312.957440][ T5884] usb 3-1: digital interface selection failed (-22) [ 312.971215][ T3950] usb 5-1: USB disconnect, device number 11 [ 312.977824][ T5884] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 313.014861][ T30] audit: type=1400 audit(1752070704.576:569): avc: denied { setcurrent } for pid=8628 comm="syz.1.628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 313.042550][ T5884] usb 3-1: setting power OFF [ 313.053057][ T5884] dvb-usb: bulk message failed: -22 (2/0) [ 313.059174][ T5884] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 313.069083][ T5884] (NULL device *): no alternate interface [ 313.147335][ T5884] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 313.233188][ T30] audit: type=1400 audit(1752070704.766:570): avc: denied { append } for pid=8633 comm="syz.1.630" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 313.240401][ T5884] usb 3-1: USB disconnect, device number 3 [ 313.290883][ T30] audit: type=1400 audit(1752070704.766:571): avc: denied { map } for pid=8633 comm="syz.1.630" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 313.334477][ T30] audit: type=1400 audit(1752070704.766:572): avc: denied { write execute } for pid=8633 comm="syz.1.630" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 313.701597][ T8646] usb usb1: check_ctrlrecip: process 8646 (syz.1.634) requesting ep 01 but needs 81 [ 314.086118][ T8649] overlayfs: missing 'lowerdir' [ 314.095366][ T8649] rdma_rxe: rxe_newlink: failed to add lo [ 314.187433][ T8654] xt_hashlimit: size too large, truncated to 1048576 [ 314.239689][ T8656] C: renamed from lo (while UP) [ 314.291424][ T8656] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 314.449782][ T3950] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 314.574517][ T30] audit: type=1400 audit(1752070706.136:573): avc: denied { bind } for pid=8664 comm="syz.2.641" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 314.718526][ T30] audit: type=1400 audit(1752070706.276:574): avc: denied { read } for pid=8667 comm="syz.1.642" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 314.766334][ T8669] usb usb1: check_ctrlrecip: process 8669 (syz.3.639) requesting ep 01 but needs 81 [ 314.891595][ T30] audit: type=1400 audit(1752070706.336:575): avc: denied { open } for pid=8667 comm="syz.1.642" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 315.040035][ T3950] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 315.069972][ T3950] usb 5-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 315.079055][ T3950] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 315.088273][ T3950] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.304932][ T3950] usb 5-1: USB disconnect, device number 12 [ 316.477024][ T5884] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 316.709341][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.718280][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.849783][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 316.861054][ T5884] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 316.881814][ T5884] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 316.924038][ T5884] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 316.938011][ T5884] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 316.960305][ T5884] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 316.979685][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.987893][ T5884] usb 2-1: Product: syz [ 317.002866][ T5884] usb 2-1: Manufacturer: syz [ 317.011033][ T5884] usb 2-1: SerialNumber: syz [ 317.027501][ T5884] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input16 [ 317.866239][ T30] audit: type=1400 audit(1752070709.426:576): avc: denied { append } for pid=8708 comm="syz.3.653" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 318.019574][ T8713] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 318.358362][ T8721] ubi: mtd0 is already attached to ubi31 [ 318.908888][ T5884] imon:send_packet: packet tx failed (-71) [ 318.933596][ T5884] imon 2-1:155.0: panel buttons/knobs setup failed [ 318.943121][ T5884] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 318.985572][ T5884] (id 0x00) [ 319.089884][ T5884] rc_core: IR keymap rc-imon-pad not found [ 319.095815][ T5884] Registered IR keymap rc-empty [ 319.121057][ T5884] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 319.149747][ T5884] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 319.159461][ T5884] imon:send_packet: packet tx failed (-71) [ 319.190142][ T5884] imon 2-1:155.0: remote input dev register failed [ 319.207220][ T5884] imon 2-1:155.0: imon_init_intf0: rc device setup failed [ 319.246763][ T5884] imon 2-1:155.0: unable to initialize intf0, err 0 [ 319.259371][ T5884] imon:imon_probe: failed to initialize context! [ 319.273197][ T5884] imon 2-1:155.0: unable to register, err -19 [ 319.297815][ T5884] usb 2-1: USB disconnect, device number 11 [ 319.932234][ T8739] ubi: mtd0 is already attached to ubi31 [ 320.800165][ T5884] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 321.684989][ T9] kernel read not supported for file /dsp1 (pid: 9 comm: kworker/0:0) [ 321.713679][ T5884] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 321.724681][ T5884] usb 4-1: config 0 has no interface number 0 [ 321.741424][ T3950] kernel write not supported for file /input/event2 (pid: 3950 comm: kworker/1:2) [ 321.774556][ T5884] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 321.805175][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.816626][ T5884] usb 4-1: Product: syz [ 321.825350][ T5884] usb 4-1: Manufacturer: syz [ 321.833268][ T5884] usb 4-1: SerialNumber: syz [ 321.858156][ T5884] usb 4-1: config 0 descriptor?? [ 322.104491][ T5884] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 322.158334][ T5884] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 322.190129][ T5884] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 322.210419][ T5884] usb 4-1: media controller created [ 322.258017][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.268028][ T8769] overlayfs: missing 'lowerdir' [ 322.283849][ T8769] rdma_rxe: rxe_newlink: failed to add lo [ 322.421968][ T8775] ubi: mtd0 is already attached to ubi31 [ 322.619975][ T3950] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 322.851035][ T5884] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 322.851249][ T3950] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 322.913672][ T8773] nvme_fabrics: missing parameter 'transport=%s' [ 322.920982][ T8773] nvme_fabrics: missing parameter 'nqn=%s' [ 322.926869][ T3950] usb 5-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 322.927539][ T5884] usb 4-1: USB disconnect, device number 14 [ 322.982558][ T3950] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 323.015019][ T3950] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.258205][ T5884] usb 5-1: USB disconnect, device number 13 [ 323.493405][ T8792] ubi: mtd0 is already attached to ubi31 [ 323.515557][ T3950] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 323.710290][ T3950] usb 2-1: Using ep0 maxpacket: 32 [ 323.777572][ T3950] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 323.819924][ T3950] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.836628][ T3950] usb 2-1: config 0 descriptor?? [ 324.278576][ T3950] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 324.404102][ T3950] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 324.442889][ T3950] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 324.461956][ T3950] usb 2-1: media controller created [ 324.485223][ T3950] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 325.292334][ T8812] siw: device registration error -23 [ 325.535843][ T3950] az6027: usb out operation failed. (-71) [ 325.647619][ T3950] az6027: usb out operation failed. (-71) [ 325.733263][ T3950] stb0899_attach: Driver disabled by Kconfig [ 326.105098][ T8820] netlink: 'syz.4.693': attribute type 10 has an invalid length. [ 326.113083][ T8820] netlink: 40 bytes leftover after parsing attributes in process `syz.4.693'. [ 326.573919][ T3950] az6027: no front-end attached [ 326.573919][ T3950] [ 328.029889][ T3950] az6027: usb out operation failed. (-71) [ 328.035700][ T3950] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 328.246817][ T3950] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input18 [ 328.410689][ T30] audit: type=1400 audit(1752070719.916:577): avc: denied { read } for pid=8821 comm="syz.0.696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 328.411687][ T3950] dvb-usb: schedule remote query interval to 400 msecs. [ 328.437564][ T3950] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 328.450314][ T3950] usb 2-1: USB disconnect, device number 12 [ 328.557512][ T8830] siw: device registration error -23 [ 329.545576][ T8833] netlink: 'syz.1.698': attribute type 10 has an invalid length. [ 329.553403][ T8833] netlink: 40 bytes leftover after parsing attributes in process `syz.1.698'. [ 330.159161][ T8833] team0: Port device geneve0 added [ 331.806966][ T3950] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 332.497995][ T8863] siw: device registration error -23 [ 333.249544][ T8867] netlink: 'syz.4.708': attribute type 10 has an invalid length. [ 333.257340][ T8867] netlink: 40 bytes leftover after parsing attributes in process `syz.4.708'. [ 334.198961][ T8874] nbd: must specify at least one socket [ 334.314016][ T8876] siw: device registration error -23 [ 334.859541][ T30] audit: type=1400 audit(1752070726.416:578): avc: denied { ioctl } for pid=8877 comm="syz.4.714" path="/dev/usbmon1" dev="devtmpfs" ino=717 ioctlcmd=0x9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 335.860850][ T8901] ubi: mtd0 is already attached to ubi31 [ 338.066632][ T8926] nbd: must specify at least one socket [ 338.110016][ T8928] usb usb1: check_ctrlrecip: process 8928 (syz.0.725) requesting ep 01 but needs 81 [ 340.920491][ T8939] pim6reg: entered allmulticast mode [ 340.927657][ T8939] pim6reg: left allmulticast mode [ 341.698350][ T8955] usb usb1: check_ctrlrecip: process 8955 (syz.3.732) requesting ep 01 but needs 81 [ 342.810953][ T8962] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 342.819745][ T8962] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 342.842038][ T8963] usb usb1: check_ctrlrecip: process 8963 (syz.1.733) requesting ep 01 but needs 81 [ 343.337034][ T8969] netlink: 4 bytes leftover after parsing attributes in process `syz.2.737'. [ 343.801231][ T8984] overlayfs: missing 'lowerdir' [ 343.821455][ T8984] usb usb1: check_ctrlrecip: process 8984 (syz.3.739) requesting ep 01 but needs 81 [ 345.697842][ T9003] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 345.706644][ T9003] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 345.715949][ T5840] Bluetooth: hci5: command 0x1003 tx timeout [ 346.407612][ T5845] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 347.310068][ T9003] usb usb1: check_ctrlrecip: process 9003 (syz.4.747) requesting ep 01 but needs 81 [ 348.768808][ T9026] af_packet: tpacket_rcv: packet too big, clamped from 52 to 0. macoff=72 [ 348.869891][ T5884] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 349.039838][ T5884] usb 5-1: Using ep0 maxpacket: 8 [ 349.047710][ T5884] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 349.061178][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.130276][ T9039] overlayfs: missing 'lowerdir' [ 349.152156][ T9039] usb usb1: check_ctrlrecip: process 9039 (syz.2.757) requesting ep 01 but needs 81 [ 349.944048][ T24] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 350.041656][ T5884] pvrusb2: Hardware description: Terratec Grabster AV400 [ 350.048726][ T5884] pvrusb2: ********** [ 350.059456][ T5884] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 350.069606][ T5884] pvrusb2: Important functionality might not be entirely working. [ 350.083083][ T5884] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 350.094608][ T5884] pvrusb2: ********** [ 350.132355][ T2335] pvrusb2: Invalid write control endpoint [ 350.249247][ T2335] pvrusb2: Invalid write control endpoint [ 350.257244][ T2335] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 350.271129][ T2335] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 350.278688][ T2335] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 350.292296][ T2335] pvrusb2: Device being rendered inoperable [ 350.304176][ T2335] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 350.314337][ T2335] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 350.326293][ T2335] pvrusb2: Attached sub-driver cx25840 [ 350.335185][ T2335] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 350.355691][ T24] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 350.379755][ T24] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 350.389433][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 350.475166][ T9047] overlayfs: failed to resolve './file1': -2 [ 350.498760][ T9017] pvrusb2: Attempted to execute control transfer when device not ok [ 350.514811][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 350.557336][ T9048] usb usb1: check_ctrlrecip: process 9048 (syz.2.761) requesting ep 01 but needs 81 [ 350.640890][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.669288][ T3950] usb 5-1: USB disconnect, device number 14 [ 350.756972][ T24] usb 4-1: Product: syz [ 350.801430][ T24] usb 4-1: Manufacturer: syz [ 350.810994][ T9] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 350.824214][ T24] usb 4-1: SerialNumber: syz [ 350.840256][ T2335] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 350.949068][ T24] hub 4-1:1.0: bad descriptor, ignoring hub [ 350.957960][ T24] hub 4-1:1.0: probe with driver hub failed with error -5 [ 350.980498][ T9] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 351.432275][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.445626][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.460187][ T24] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 351.469281][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.494384][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.515721][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.531046][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.538553][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.547688][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.558740][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.566459][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.575481][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.586549][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.594188][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.603251][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.614263][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.622189][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.634609][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.652460][ T30] audit: type=1400 audit(1752070743.216:579): avc: denied { read write } for pid=9027 comm="syz.3.755" name="lp0" dev="devtmpfs" ino=3119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 351.676064][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.687140][ T30] audit: type=1400 audit(1752070743.216:580): avc: denied { open } for pid=9027 comm="syz.3.755" path="/dev/usb/lp0" dev="devtmpfs" ino=3119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 351.714028][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.735285][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.770978][ T5891] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 351.782353][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.816869][ T9059] bond0: entered promiscuous mode [ 351.835480][ T9059] bond_slave_0: entered promiscuous mode [ 351.841651][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 351.854220][ T9059] bond_slave_1: entered promiscuous mode [ 351.860766][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 351.876944][ T9059] batadv0: entered promiscuous mode [ 351.884177][ T9059] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 351.894920][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 351.917062][ T9] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 351.926459][ T9] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 351.935592][ T9] usb 2-1: Product: syz [ 351.941178][ T9] usb 2-1: Manufacturer: syz [ 351.945791][ T9] usb 2-1: SerialNumber: syz [ 351.957217][ T9] usb 2-1: config 0 descriptor?? [ 352.028303][ T9061] siw: device registration error -23 [ 352.361905][ T5891] usb 3-1: Using ep0 maxpacket: 32 [ 352.368819][ T5891] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 352.379661][ T5891] usb 3-1: config 0 has no interface number 0 [ 352.385847][ T5891] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 352.397184][ T5891] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 352.407229][ T5891] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 352.416383][ T5891] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.426007][ T5891] usb 3-1: config 0 descriptor?? [ 352.710531][ T9028] usb 4-1: reset high-speed USB device number 15 using dummy_hcd [ 352.868354][ T9070] pim6reg: entered allmulticast mode [ 352.881732][ T9070] pim6reg: left allmulticast mode [ 352.915161][ T9] yurex 2-1:0.0: USB YUREX device now attached to Yurex #1 [ 352.957044][ T9] usb 2-1: USB disconnect, device number 13 [ 352.970472][ T9] yurex 2-1:0.0: USB YUREX #1 now disconnected [ 353.040982][ T5891] uclogic 0003:28BD:0094.0005: pen parameters not found [ 353.049341][ T5891] uclogic 0003:28BD:0094.0005: interface is invalid, ignoring [ 353.062195][ T5891] usb 3-1: USB disconnect, device number 4 [ 353.142730][ T24] usb 4-1: USB disconnect, device number 15 [ 353.174751][ T24] usblp0: removed [ 353.518960][ T30] audit: type=1400 audit(1752070745.076:581): avc: denied { read } for pid=9078 comm="syz.4.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 354.303218][ T9090] xt_hashlimit: size too large, truncated to 1048576 [ 354.403000][ T9085] netlink: 'syz.3.773': attribute type 10 has an invalid length. [ 354.410856][ T9085] netlink: 40 bytes leftover after parsing attributes in process `syz.3.773'. [ 354.662198][ T9099] siw: device registration error -23 [ 355.334022][ T9104] overlayfs: missing 'lowerdir' [ 355.416918][ T9105] usb usb1: check_ctrlrecip: process 9105 (syz.2.778) requesting ep 01 but needs 81 [ 355.859154][ T9112] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 356.160048][ T9123] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 356.167727][ T9123] netlink: 136 bytes leftover after parsing attributes in process `syz.4.785'. [ 356.262423][ T9123] netlink: 'syz.4.785': attribute type 2 has an invalid length. [ 356.274427][ T9123] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 356.446821][ C1] sd 0:0:1:0: [sda] tag#820 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.457194][ C1] sd 0:0:1:0: [sda] tag#820 CDB: Read(6) 08 00 9f d1 fe de [ 356.464650][ C1] sd 0:0:1:0: [sda] tag#821 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.474987][ C1] sd 0:0:1:0: [sda] tag#821 CDB: Read(6) 08 00 9f d1 fe de [ 356.482323][ C1] sd 0:0:1:0: [sda] tag#822 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.492641][ C1] sd 0:0:1:0: [sda] tag#822 CDB: Read(6) 08 00 9f d1 fe de [ 356.499654][ T9140] tipc: Started in network mode [ 356.509320][ C1] sd 0:0:1:0: [sda] tag#823 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.510207][ T9140] tipc: Node identity 00000000000000008, cluster identity 5 [ 356.519641][ C1] sd 0:0:1:0: [sda] tag#823 CDB: Read(6) 08 00 9f d1 fe de [ 356.519770][ C1] sd 0:0:1:0: [sda] tag#824 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.519823][ C1] sd 0:0:1:0: [sda] tag#824 CDB: Read(6) 08 00 9f d1 fe de [ 356.519907][ C1] sd 0:0:1:0: [sda] tag#825 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.519957][ C1] sd 0:0:1:0: [sda] tag#825 CDB: Read(6) 08 00 9f d1 fe de [ 356.520047][ C1] sd 0:0:1:0: [sda] tag#826 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.538894][ T9142] syzkaller1: entered promiscuous mode [ 356.544829][ C1] sd 0:0:1:0: [sda] tag#826 CDB: Read(6) 08 00 9f d1 fe de [ 356.544942][ C1] sd 0:0:1:0: [sda] tag#827 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.544999][ C1] sd 0:0:1:0: [sda] tag#827 CDB: Read(6) 08 00 9f d1 fe de [ 356.563415][ T9142] syzkaller1: entered allmulticast mode [ 356.579807][ C1] sd 0:0:1:0: [sda] tag#828 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.626135][ C1] sd 0:0:1:0: [sda] tag#828 CDB: Read(6) 08 00 9f d1 fe de [ 356.633504][ C1] sd 0:0:1:0: [sda] tag#829 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 356.643876][ C1] sd 0:0:1:0: [sda] tag#829 CDB: Read(6) 08 00 9f d1 fe de [ 356.919957][ T9151] siw: device registration error -23 [ 356.988251][ T9152] ubi: mtd0 is already attached to ubi31 [ 358.392547][ T9173] netlink: 'syz.3.800': attribute type 10 has an invalid length. [ 358.400556][ T9173] netlink: 40 bytes leftover after parsing attributes in process `syz.3.800'. [ 358.969760][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 359.130280][ T30] audit: type=1400 audit(1752070750.546:582): avc: denied { append } for pid=9174 comm="syz.1.803" name="loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 359.153798][ C0] vkms_vblank_simulate: vblank timer overrun [ 359.405872][ T24] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 359.498012][ T24] usb 3-1: config 0 has no interface number 0 [ 359.569828][ T24] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 359.598520][ T24] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 359.648029][ T24] usb 3-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 359.705740][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.732230][ T24] usb 3-1: config 0 descriptor?? [ 359.895263][ T30] audit: type=1400 audit(1752070751.456:583): avc: denied { create } for pid=9186 comm="syz.4.807" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 359.983880][ T30] audit: type=1400 audit(1752070751.456:584): avc: denied { read } for pid=9186 comm="syz.4.807" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 360.024823][ T9191] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 361.905264][ T24] prodikeys 0003:041E:2801.0006: item fetching failed at offset 3/7 [ 362.624121][ T24] prodikeys 0003:041E:2801.0006: hid parse failed [ 362.651392][ T24] prodikeys 0003:041E:2801.0006: probe with driver prodikeys failed with error -22 [ 363.776879][ T3950] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 363.933495][ T24] usb 3-1: USB disconnect, device number 5 [ 364.234331][ T3950] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 364.244387][ T3950] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.253037][ T3950] usb 5-1: Product: syz [ 364.257333][ T3950] usb 5-1: Manufacturer: syz [ 364.262335][ T3950] usb 5-1: SerialNumber: syz [ 365.234286][ T3950] usb 5-1: config 0 descriptor?? [ 365.267492][ T3950] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 365.710121][ T9231] netlink: 'syz.1.820': attribute type 10 has an invalid length. [ 365.717897][ T9231] netlink: 40 bytes leftover after parsing attributes in process `syz.1.820'. [ 365.742782][ T9236] netlink: 44 bytes leftover after parsing attributes in process `syz.2.823'. [ 365.783635][ T9236] netlink: 44 bytes leftover after parsing attributes in process `syz.2.823'. [ 366.284233][ T9248] ubi: mtd0 is already attached to ubi31 [ 366.763921][ T3950] gspca_sunplus: reg_w_riv err -71 [ 366.841529][ T3950] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 367.110057][ T3950] usb 5-1: USB disconnect, device number 15 [ 367.110221][ T30] audit: type=1400 audit(1752070758.676:585): avc: denied { create } for pid=9259 comm="syz.3.832" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 367.144592][ T30] audit: type=1400 audit(1752070758.696:586): avc: denied { sys_admin } for pid=9259 comm="syz.3.832" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 367.268602][ T5891] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 367.642330][ T5891] usb 2-1: Using ep0 maxpacket: 32 [ 367.676250][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 367.688219][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 367.699399][ T5891] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 367.717864][ T5891] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.751614][ T5891] usb 2-1: config 0 descriptor?? [ 367.760671][ T9267] netlink: 8 bytes leftover after parsing attributes in process `syz.4.834'. [ 367.796131][ T9267] gtp0: entered promiscuous mode [ 367.804906][ T9267] gtp0: entered allmulticast mode [ 368.497215][ T5891] ft260 0003:0403:6030.0007: unknown main item tag 0x0 [ 368.518079][ T9274] input: syz0 as /devices/virtual/input/input19 [ 368.629769][ T3950] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 368.659582][ T5891] ft260 0003:0403:6030.0007: chip code: 6424 8183 [ 368.704536][ T30] audit: type=1400 audit(1752070760.266:587): avc: denied { mounton } for pid=9279 comm="syz.3.839" path="/proc/552/task" dev="proc" ino=20398 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 368.730150][ T30] audit: type=1400 audit(1752070760.266:588): avc: denied { mount } for pid=9279 comm="syz.3.839" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 368.810275][ T3950] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 368.818788][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.830325][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.842769][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.850431][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.859515][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.870697][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.879517][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.888876][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.900214][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.907541][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.916620][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.927583][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.934970][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.944012][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.955044][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.962471][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 368.969878][ T5884] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 368.971475][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 368.990072][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 368.997662][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 369.006795][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 369.017840][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 369.028281][ T3950] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 369.044621][ T3950] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 369.056444][ T3950] usb 5-1: config 0 interface 0 has no altsetting 0 [ 369.068685][ T3950] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 369.091394][ T3950] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 369.109008][ T3950] usb 5-1: Product: syz [ 369.117821][ T9] usb 2-1: USB disconnect, device number 14 [ 369.119544][ T3950] usb 5-1: Manufacturer: syz [ 369.139936][ T5884] usb 4-1: Using ep0 maxpacket: 16 [ 369.140491][ T3950] usb 5-1: SerialNumber: syz [ 369.156821][ T3950] usb 5-1: config 0 descriptor?? [ 369.161835][ T5884] usb 4-1: unable to get BOS descriptor or descriptor too short [ 369.162700][ T5884] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 369.203021][ T3950] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 369.203594][ T5884] usb 4-1: can't read configurations, error -71 [ 369.800698][ T9291] netlink: 'syz.2.843': attribute type 10 has an invalid length. [ 369.808526][ T9291] netlink: 40 bytes leftover after parsing attributes in process `syz.2.843'. [ 370.494766][ T9297] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 370.614565][ T9] IPVS: starting estimator thread 0... [ 370.629076][ T5891] usb 5-1: USB disconnect, device number 16 [ 370.670122][ T5891] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 370.720767][ T9299] IPVS: using max 44 ests per chain, 105600 per kthread [ 370.742239][ T30] audit: type=1400 audit(1752070762.306:589): avc: denied { append } for pid=9307 comm="syz.2.850" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 371.168343][ T9312] overlayfs: overlapping lowerdir path [ 371.187676][ T9310] overlayfs: missing 'lowerdir' [ 371.196218][ T9310] usb usb1: check_ctrlrecip: process 9310 (syz.3.848) requesting ep 01 but needs 81 [ 372.021437][ T5940] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 372.083041][ T9332] usb usb1: check_ctrlrecip: process 9332 (syz.3.856) requesting ep 01 but needs 81 [ 372.130137][ T3950] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 372.222230][ T5940] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 372.243216][ T5940] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 372.266292][ T5940] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.286249][ T5940] usb 2-1: config 0 descriptor?? [ 372.299449][ T9320] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 372.314471][ T3950] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 372.326578][ T3950] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 372.340305][ T3950] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 372.348407][ T9335] ip6gre1: entered allmulticast mode [ 372.349622][ T3950] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 372.369637][ T3950] usb 5-1: Manufacturer: syz [ 372.378580][ T3950] usb 5-1: config 0 descriptor?? [ 372.460636][ T3950] rc_core: IR keymap rc-hauppauge not found [ 372.469255][ T3950] Registered IR keymap rc-empty [ 372.507706][ T3950] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 372.557551][ T3950] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input20 [ 372.903343][ C1] igorplugusb 5-1:0.0: receive overflow, at least 3 lost [ 372.911298][ T5940] elan 0003:04F3:0755.0008: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 373.018112][ T9357] siw: device registration error -23 [ 373.166603][ T5940] usb 5-1: USB disconnect, device number 17 [ 373.418733][ T5884] usb 2-1: USB disconnect, device number 15 [ 373.457328][ T9359] fido_id[9359]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 373.926484][ T9372] overlayfs: missing 'lowerdir' [ 374.008059][ T9374] usb usb1: check_ctrlrecip: process 9374 (syz.3.867) requesting ep 01 but needs 81 [ 374.350459][ T9373] pim6reg: entered allmulticast mode [ 374.359160][ T9373] pim6reg: left allmulticast mode [ 375.013710][ T30] audit: type=1400 audit(1752070766.576:590): avc: denied { mount } for pid=9386 comm="syz.3.874" name="/" dev="9p" ino=12161590295206323045 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 375.488421][ T9398] siw: device registration error -23 [ 378.001855][ T9412] ubi: mtd0 is already attached to ubi31 [ 378.090163][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.096653][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.440076][ T5940] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 378.923953][ T5940] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 378.934324][ T5940] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 378.944804][ T5940] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 378.959375][ T5940] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 378.967527][ T5940] usb 2-1: SerialNumber: syz [ 379.073159][ T9436] vxcan1: entered allmulticast mode [ 379.183488][ T5940] usb 2-1: 0:2 : does not exist [ 379.377262][ T5940] usb 2-1: USB disconnect, device number 16 [ 379.589593][ T9441] pim6reg: entered allmulticast mode [ 379.646831][ T9441] pim6reg: left allmulticast mode [ 379.943588][ T9448] netlink: 'syz.2.893': attribute type 10 has an invalid length. [ 379.951363][ T9448] netlink: 40 bytes leftover after parsing attributes in process `syz.2.893'. [ 380.712306][ T9467] ubi: mtd0 is already attached to ubi31 [ 381.123470][ T9461] netlink: 'syz.1.899': attribute type 10 has an invalid length. [ 381.131267][ T9461] netlink: 40 bytes leftover after parsing attributes in process `syz.1.899'. [ 381.194752][ T30] audit: type=1400 audit(1752070772.756:591): avc: denied { search } for pid=9468 comm="syz.2.901" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 381.218512][ T30] audit: type=1400 audit(1752070772.786:592): avc: denied { search } for pid=9468 comm="syz.2.901" name="/" dev="configfs" ino=69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 381.537270][ T9471] C speed is unknown, defaulting to 1000 [ 381.563207][ T9471] lo speed is unknown, defaulting to 1000 [ 381.640588][ T9481] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 381.847470][ T9482] usb usb1: check_ctrlrecip: process 9482 (syz.2.903) requesting ep 01 but needs 81 [ 382.830868][ T30] audit: type=1400 audit(1752070774.396:593): avc: denied { listen } for pid=9489 comm="syz.0.908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 383.146553][ T9474] netlink: 8 bytes leftover after parsing attributes in process `syz.1.902'. [ 383.574822][ T9499] ubi: mtd0 is already attached to ubi31 [ 383.752175][ T3950] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 384.072062][ T9485] siw: device registration error -23 [ 384.339712][ T3950] usb 3-1: Using ep0 maxpacket: 8 [ 384.346007][ T3950] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 384.362881][ T3950] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 384.381502][ T3950] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.412942][ T3950] usb 3-1: config 0 descriptor?? [ 384.474430][ T3950] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 384.576283][ T9503] netlink: 'syz.4.911': attribute type 10 has an invalid length. [ 384.584052][ T9503] netlink: 40 bytes leftover after parsing attributes in process `syz.4.911'. [ 385.135965][ T9515] PKCS7: Unknown OID: [5] (bad) [ 385.192921][ T9515] PKCS7: Only support pkcs7_signedData type [ 385.538692][ T9514] netlink: 'syz.4.914': attribute type 10 has an invalid length. [ 385.546648][ T9514] netlink: 40 bytes leftover after parsing attributes in process `syz.4.914'. [ 385.957161][ T3950] gspca_vc032x: reg_w err -71 [ 385.970916][ T3950] vc032x 3-1:0.0: probe with driver vc032x failed with error -71 [ 385.985443][ T3950] usb 3-1: USB disconnect, device number 6 [ 387.402842][ T9545] siw: device registration error -23 [ 387.872482][ T9548] rdma_rxe: rxe_newlink: failed to add lo [ 388.463498][ T9560] ubi: mtd0 is already attached to ubi31 [ 388.578985][ T5945] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 388.902180][ T9562] siw: device registration error -23 [ 389.211809][ T5945] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 389.236316][ T5945] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 389.245662][ T5945] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 389.254898][ T5945] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.275873][ T9551] netlink: 'syz.2.924': attribute type 10 has an invalid length. [ 389.283668][ T9551] netlink: 40 bytes leftover after parsing attributes in process `syz.2.924'. [ 389.480923][ T5945] usb 4-1: USB disconnect, device number 18 [ 389.761069][ T9569] netlink: 'syz.4.929': attribute type 10 has an invalid length. [ 389.768936][ T9569] netlink: 40 bytes leftover after parsing attributes in process `syz.4.929'. [ 390.999735][ T5945] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 391.761722][ T9587] netlink: 'syz.0.936': attribute type 10 has an invalid length. [ 391.769508][ T9587] netlink: 40 bytes leftover after parsing attributes in process `syz.0.936'. [ 392.392687][ T30] audit: type=1400 audit(1752070783.766:594): avc: denied { read } for pid=9593 comm="syz.2.937" path="socket:[22106]" dev="sockfs" ino=22106 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 392.491651][ T9587] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 392.613417][ T5945] usb 4-1: Using ep0 maxpacket: 8 [ 392.631074][ T5945] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 392.801049][ T5945] usb 4-1: config 0 has no interfaces? [ 392.839133][ T5945] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 392.858627][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.900877][ T5945] usb 4-1: Product: syz [ 392.905068][ T5945] usb 4-1: Manufacturer: syz [ 392.927836][ T5945] usb 4-1: SerialNumber: syz [ 392.942916][ T9590] netlink: 'syz.1.938': attribute type 10 has an invalid length. [ 392.961871][ T5945] usb 4-1: config 0 descriptor?? [ 392.989940][ T9590] netlink: 40 bytes leftover after parsing attributes in process `syz.1.938'. [ 393.186108][ T9612] netlink: 'syz.1.941': attribute type 1 has an invalid length. [ 393.284453][ T9612] 8021q: adding VLAN 0 to HW filter on device bond2 [ 393.294683][ T5884] usb 4-1: USB disconnect, device number 19 [ 394.451267][ T9618] bond2: (slave veth3): Enslaving as an active interface with a down link [ 394.548379][ T9631] netlink: 'syz.3.943': attribute type 10 has an invalid length. [ 394.560631][ T9612] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 394.567483][ T30] audit: type=1400 audit(1752070786.106:595): avc: denied { listen } for pid=9628 comm="syz.3.943" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 394.587261][ T9612] bond2: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 394.658394][ T9631] team0: Port device dummy0 added [ 397.024474][ T9671] ubi: mtd0 is already attached to ubi31 [ 398.545084][ T30] audit: type=1400 audit(1752070790.086:596): avc: denied { map } for pid=9688 comm="syz.3.956" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 398.590389][ T5884] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 398.598169][ T30] audit: type=1400 audit(1752070790.086:597): avc: denied { execute } for pid=9688 comm="syz.3.956" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 398.781231][ T5884] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 398.790106][ T5884] usb 3-1: config 0 has no interface number 0 [ 398.802973][ T5884] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 398.817941][ T5884] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 398.831838][ T5884] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 398.841818][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.860519][ T5884] usb 3-1: config 0 descriptor?? [ 398.940527][ T9686] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 399.401519][ T5884] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 399.417329][ T5884] usb 3-1: USB disconnect, device number 7 [ 400.290038][ T9703] netlink: 'syz.1.960': attribute type 10 has an invalid length. [ 400.297767][ T9703] netlink: 40 bytes leftover after parsing attributes in process `syz.1.960'. [ 400.975168][ T9714] netlink: 'syz.3.961': attribute type 10 has an invalid length. [ 400.983069][ T9714] netlink: 40 bytes leftover after parsing attributes in process `syz.3.961'. [ 401.746185][ T9715] nbd: must specify at least one socket [ 401.854292][ T30] audit: type=1400 audit(1752070793.416:598): avc: denied { read } for pid=9719 comm="syz.1.967" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 401.886374][ T30] audit: type=1400 audit(1752070793.416:599): avc: denied { open } for pid=9719 comm="syz.1.967" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 401.921187][ T30] audit: type=1400 audit(1752070793.446:600): avc: denied { append } for pid=9719 comm="syz.1.967" name="video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 402.193396][ T9721] netlink: 'syz.0.966': attribute type 10 has an invalid length. [ 402.201176][ T9721] netlink: 40 bytes leftover after parsing attributes in process `syz.0.966'. [ 402.210030][ T9721] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 402.293596][ T9733] siw: device registration error -23 [ 403.653192][ T9741] overlayfs: missing 'workdir' [ 403.921142][ T9741] usb usb1: check_ctrlrecip: process 9741 (syz.4.971) requesting ep 01 but needs 81 [ 404.413431][ T9762] netlink: 4 bytes leftover after parsing attributes in process `syz.1.979'. [ 404.959340][ T9764] netlink: 'syz.4.978': attribute type 10 has an invalid length. [ 404.967199][ T9764] netlink: 40 bytes leftover after parsing attributes in process `syz.4.978'. [ 405.928668][ T9778] netlink: 4 bytes leftover after parsing attributes in process `syz.4.983'. [ 405.938295][ T9780] netlink: 4 bytes leftover after parsing attributes in process `syz.2.985'. [ 405.947113][ T30] audit: type=1400 audit(1752070797.506:601): avc: denied { connect } for pid=9776 comm="syz.2.985" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 406.002340][ T9784] netlink: 'syz.0.987': attribute type 39 has an invalid length. [ 406.195699][ T9787] siw: device registration error -23 [ 406.745190][ T9779] netlink: 'syz.1.984': attribute type 10 has an invalid length. [ 406.756047][ T9779] netlink: 40 bytes leftover after parsing attributes in process `syz.1.984'. [ 407.017637][ T9792] overlayfs: missing 'workdir' [ 407.096367][ T9794] usb usb1: check_ctrlrecip: process 9794 (syz.0.988) requesting ep 01 but needs 81 [ 407.656131][ T30] audit: type=1400 audit(1752070799.216:602): avc: denied { create } for pid=9803 comm="syz.0.992" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 407.784970][ T30] audit: type=1400 audit(1752070799.346:603): avc: denied { cmd } for pid=9805 comm="syz.3.993" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 407.964463][ T9808] netlink: 'syz.4.994': attribute type 10 has an invalid length. [ 407.972220][ T9808] netlink: 40 bytes leftover after parsing attributes in process `syz.4.994'. [ 411.258064][ T9850] ALSA: mixer_oss: invalid OSS volume '' [ 411.259287][ T9851] siw: device registration error -23 [ 411.327842][ T9842] netlink: 'syz.3.1000': attribute type 10 has an invalid length. [ 411.335773][ T9842] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1000'. [ 412.262628][ T9865] siw: device registration error -23 [ 412.868037][ T9871] input: syz1 as /devices/virtual/input/input21 [ 413.044496][ T9872] uprobe: syz.0.1011:9872 failed to unregister, leaking uprobe [ 413.098058][ T43] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 413.359822][ T43] usb 4-1: Using ep0 maxpacket: 16 [ 413.371948][ T43] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 413.389706][ T43] usb 4-1: config 0 has an invalid descriptor of length 35, skipping remainder of the config [ 413.410875][ T43] usb 4-1: config 0 has no interface number 0 [ 413.425048][ T43] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 413.506672][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.845618][ T43] usb 4-1: Product: syz [ 413.860055][ T43] usb 4-1: Manufacturer: syz [ 413.872703][ T43] usb 4-1: SerialNumber: syz [ 413.896276][ T43] usb 4-1: config 0 descriptor?? [ 413.913046][ T43] usb 4-1: Found UVC 0.00 device syz (046d:08f3) [ 413.919465][ T43] usb 4-1: No valid video chain found. [ 414.179070][ T43] usb 4-1: USB disconnect, device number 20 [ 414.680581][ T9906] siw: device registration error -23 [ 417.239385][ T9926] netlink: 'syz.4.1027': attribute type 10 has an invalid length. [ 417.247338][ T9926] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1027'. [ 421.147824][ T30] audit: type=1400 audit(1752070812.706:604): avc: denied { read } for pid=9933 comm="syz.0.1030" path="socket:[24825]" dev="sockfs" ino=24825 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 421.444340][ T9942] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 421.455770][ T9942] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 421.592622][ T9942] usb usb1: check_ctrlrecip: process 9942 (syz.3.1031) requesting ep 01 but needs 81 [ 421.909342][ T9947] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1034'. [ 421.960123][ T5884] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 422.133777][ T5884] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 422.173095][ T5884] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 422.194411][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.226098][ T5884] usb 2-1: Product: syz [ 422.243263][ T5884] usb 2-1: Manufacturer: syz [ 422.248216][ T5884] usb 2-1: SerialNumber: syz [ 422.363804][ T9957] netlink: 'syz.0.1033': attribute type 10 has an invalid length. [ 422.395384][ T9957] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1033'. [ 423.366981][ T9957] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 423.483962][ T5834] udevd[5834]: setting owner of /dev/rfcomm68 to uid=0, gid=18 failed: No such file or directory [ 423.506052][ T9967] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 423.987033][ T9969] netlink: 'syz.2.1040': attribute type 10 has an invalid length. [ 423.995136][ T9969] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1040'. [ 424.213049][ T5884] cdc_ncm 2-1:1.0: bind() failure [ 424.231393][ T5884] cdc_ncm 2-1:1.1: probe with driver cdc_ncm failed with error -71 [ 424.296385][ T5884] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 424.336777][ T5884] usbtest 2-1:1.1: probe with driver usbtest failed with error -71 [ 424.383165][ T5884] usb 2-1: USB disconnect, device number 17 [ 424.696546][ T30] audit: type=1400 audit(1752070816.256:605): avc: denied { remount } for pid=9976 comm="syz.2.1043" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 424.877265][ T30] audit: type=1400 audit(1752070816.436:606): avc: denied { mounton } for pid=9980 comm="syz.1.1044" path="/198/file1/file0" dev="autofs" ino=23955 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 424.900451][ C0] vkms_vblank_simulate: vblank timer overrun [ 425.851542][ T9989] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 425.863240][ T9989] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 426.389994][ T9987] usb usb1: check_ctrlrecip: process 9987 (syz.4.1046) requesting ep 01 but needs 81 [ 426.742858][ T9995] C speed is unknown, defaulting to 1000 [ 426.776259][ T9995] lo speed is unknown, defaulting to 1000 [ 427.769614][T10006] usb usb1: check_ctrlrecip: process 10006 (syz.3.1051) requesting ep 01 but needs 81 [ 428.688572][T10014] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.1055'. [ 428.729895][ T9] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 428.759871][T10012] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.1055'. [ 428.872909][T10019] PKCS7: Unknown OID: [5] (bad) [ 428.877852][T10019] PKCS7: Only support pkcs7_signedData type [ 428.934865][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 428.956907][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 429.064184][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 429.592396][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.611742][ T9] usb 4-1: config 0 descriptor?? [ 429.920310][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 429.926311][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 429.962002][ T9] usb 4-1: USB disconnect, device number 21 [ 430.862720][ T9] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 430.889548][ T5905] libceph: connect (1)[c::]:6789 error -101 [ 430.908426][ T5905] libceph: mon0 (1)[c::]:6789 connect error [ 430.990055][T10040] ceph: No mds server is up or the cluster is laggy [ 431.061390][ T9] usb 4-1: config 0 has an invalid interface number: 168 but max is 0 [ 431.074215][ T9] usb 4-1: config 0 has no interface number 0 [ 431.080824][ T9] usb 4-1: config 0 interface 168 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 431.096185][ T9] usb 4-1: config 0 interface 168 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 256 [ 431.125129][ T9] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice=a8.a4 [ 431.159906][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.235514][T10053] ubi: mtd0 is already attached to ubi31 [ 431.606949][ T9] usb 4-1: config 0 descriptor?? [ 431.622743][ T9] usb 4-1: can't set config #0, error -71 [ 431.660669][ T9] usb 4-1: USB disconnect, device number 22 [ 431.749407][T10055] pim6reg: entered allmulticast mode [ 431.756765][T10055] pim6reg: left allmulticast mode [ 431.914592][T10062] nbd: must specify at least one socket [ 437.440721][T10094] siw: device registration error -23 [ 437.896126][T10103] C speed is unknown, defaulting to 1000 [ 437.905885][T10103] lo speed is unknown, defaulting to 1000 [ 439.077465][ T30] audit: type=1400 audit(1752070830.636:607): avc: denied { setattr } for pid=10122 comm="syz.4.1087" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 439.128474][ T30] audit: type=1400 audit(1752070830.666:608): avc: denied { write } for pid=10122 comm="syz.4.1087" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 439.154011][ T30] audit: type=1400 audit(1752070830.666:609): avc: denied { open } for pid=10122 comm="syz.4.1087" path="/218/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 439.179599][ T30] audit: type=1400 audit(1752070830.716:610): avc: denied { unmount } for pid=5824 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 439.327512][T10125] ubi: mtd0 is already attached to ubi31 [ 439.520323][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.527200][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.992278][ T30] audit: type=1400 audit(1752070831.556:611): avc: denied { accept } for pid=10129 comm="syz.4.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 440.011755][ C0] vkms_vblank_simulate: vblank timer overrun [ 440.411338][ T5840] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 440.422894][ T5840] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 440.430923][ T5840] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 440.438670][ T5840] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 440.452799][ T5840] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 440.466861][ T30] audit: type=1400 audit(1752070832.026:612): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 440.512316][T10139] C speed is unknown, defaulting to 1000 [ 440.518710][T10139] lo speed is unknown, defaulting to 1000 [ 440.695758][ T1150] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.722606][T10139] chnl_net:caif_netlink_parms(): no params data found [ 440.805957][ T1150] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.280932][ T1150] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.488988][ T5840] Bluetooth: hci5: command tx timeout [ 442.702357][ T30] audit: type=1400 audit(1752070834.216:613): avc: denied { connect } for pid=10161 comm="syz.4.1094" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 442.736764][ T1150] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.918727][T10139] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.941266][T10139] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.963230][T10139] bridge_slave_0: entered allmulticast mode [ 443.417616][T10139] bridge_slave_0: entered promiscuous mode [ 443.427541][T10139] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.434953][T10139] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.472895][T10139] bridge_slave_1: entered allmulticast mode [ 443.480635][T10139] bridge_slave_1: entered promiscuous mode [ 443.561497][T10169] ntfs3(nullb0): Primary boot signature is not NTFS. [ 443.568570][T10169] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 443.663469][ T30] audit: type=1400 audit(1752070835.216:614): avc: denied { set_context_mgr } for pid=10178 comm="syz.4.1099" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 443.694543][T10139] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.755788][ T5840] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 443.766681][ T30] audit: type=1400 audit(1752070835.226:615): avc: denied { map } for pid=10178 comm="syz.4.1099" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 443.790697][ T30] audit: type=1400 audit(1752070835.226:616): avc: denied { call } for pid=10178 comm="syz.4.1099" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 443.812362][T10139] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 444.427815][T10176] netlink: 'syz.3.1098': attribute type 10 has an invalid length. [ 444.448160][T10176] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1098'. [ 444.493592][T10139] team0: Port device team_slave_0 added [ 444.516108][T10139] team0: Port device team_slave_1 added [ 444.549972][ T5840] Bluetooth: hci5: command tx timeout [ 444.641200][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 444.641215][ T30] audit: type=1326 audit(1752070836.206:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10194 comm="syz.0.1105" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f047f78e929 code=0x0 [ 444.718137][T10139] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 444.745108][T10139] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.792202][T10139] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 444.810753][T10139] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.817847][T10139] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.843837][ C0] vkms_vblank_simulate: vblank timer overrun [ 444.860527][T10139] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.629761][ T5840] Bluetooth: hci5: command tx timeout [ 446.689558][ T1150] batman_adv: batadv0: Removing interface: gretap1 [ 446.763332][T10230] ubi: mtd0 is already attached to ubi31 [ 448.062322][ T1150] team0: Port device geneve0 removed [ 448.178264][ T1150] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 448.190449][ T1150] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.200355][ T1150] bond0 (unregistering): Released all slaves [ 448.207919][T10240] netlink: 61 bytes leftover after parsing attributes in process `syz.2.1113'. [ 448.220606][ T1150] bond1 (unregistering): Released all slaves [ 448.293468][ T1150] bond2 (unregistering): (slave veth3): Releasing active interface [ 448.302425][ T1150] bond2 (unregistering): Released all slaves [ 448.416201][T10139] hsr_slave_0: entered promiscuous mode [ 448.423783][T10139] hsr_slave_1: entered promiscuous mode [ 448.430223][T10139] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 448.438005][T10139] Cannot create hsr debugfs directory [ 448.716389][ T5840] Bluetooth: hci5: command tx timeout [ 449.241248][T10252] netlink: 'syz.4.1115': attribute type 10 has an invalid length. [ 449.249221][T10252] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1115'. [ 450.545560][ T30] audit: type=1326 audit(1752070842.106:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10253 comm="syz.2.1116" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4eeb38e929 code=0x0 [ 450.638064][T10139] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 450.664117][T10139] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 450.678838][T10139] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 450.692714][T10139] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 452.164577][ T5905] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 452.944969][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 453.097375][ T5905] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 453.097402][ T5905] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 453.097417][ T5905] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 453.097430][ T5905] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 453.099220][ T5905] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 453.099236][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.099246][ T5905] usb 4-1: Product: syz [ 453.099254][ T5905] usb 4-1: Manufacturer: syz [ 453.099261][ T5905] usb 4-1: SerialNumber: syz [ 453.174700][ T5905] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input22 [ 453.372212][T10139] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.426745][ T5905] imon:send_packet: packet tx failed (-71) [ 453.441856][ T5905] imon 4-1:155.0: panel buttons/knobs setup failed [ 453.441878][ T5905] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 453.441890][ T5905] (id 0x00) [ 453.448454][T10139] 8021q: adding VLAN 0 to HW filter on device team0 [ 453.469652][ T6339] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.469796][ T6339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 453.494711][ T6339] bridge0: port 2(bridge_slave_1) entered blocking state [ 453.494800][ T6339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 453.659389][ T5905] rc_core: IR keymap rc-imon-pad not found [ 453.659407][ T5905] Registered IR keymap rc-empty [ 453.659542][ T5905] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 453.659558][ T5905] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 453.659768][ T5905] imon:send_packet: packet tx failed (-71) [ 453.679769][ T5905] imon 4-1:155.0: remote input dev register failed [ 453.679969][ T5905] imon 4-1:155.0: imon_init_intf0: rc device setup failed [ 453.867479][ T5905] imon 4-1:155.0: unable to initialize intf0, err 0 [ 453.867500][ T5905] imon:imon_probe: failed to initialize context! [ 453.867511][ T5905] imon 4-1:155.0: unable to register, err -19 [ 453.879815][ T1150] hsr_slave_0: left promiscuous mode [ 453.894310][ T5905] usb 4-1: USB disconnect, device number 23 [ 453.973051][T10293] tty tty3: ldisc open failed (-12), clearing slot 2 [ 454.030739][ T1150] hsr_slave_1: left promiscuous mode [ 454.090200][ T1150] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 454.252093][ T1150] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 454.429754][ T1150] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 454.437189][ T1150] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 454.530030][T10317] ubi: mtd0 is already attached to ubi31 [ 454.652199][ T1150] veth1_macvtap: left promiscuous mode [ 454.762854][ T1150] veth0_macvtap: left promiscuous mode [ 454.861908][ T1150] veth1_vlan: left promiscuous mode [ 454.889922][ T1150] veth0_vlan: left promiscuous mode [ 455.416121][ T1150] pim6reg (unregistering): left allmulticast mode [ 456.131320][ T1150] team0 (unregistering): Port device team_slave_1 removed [ 456.162274][ T1150] team0 (unregistering): Port device team_slave_0 removed [ 456.404349][ T1032] smc: removing ib device sz1 [ 456.415078][ T5884] lo speed is unknown, defaulting to 1000 [ 456.481396][ T5884] sz1: Port: 1 Link DOWN [ 456.702650][T10352] tipc: Started in network mode [ 456.708238][T10352] tipc: Node identity 1a048b38cb22, cluster identity 4711 [ 456.735390][T10352] tipc: Enabled bearer , priority 0 [ 456.757361][T10139] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 456.913644][T10356] syzkaller0: entered promiscuous mode [ 456.931134][T10356] syzkaller0: entered allmulticast mode [ 456.950955][T10356] tipc: Resetting bearer [ 457.139918][T10351] tipc: Resetting bearer [ 457.741287][T10367] siw: device registration error -23 [ 457.861404][ T5945] tipc: Node number set to 3508964152 [ 457.897250][T10374] kvm: pic: single mode not supported [ 457.903009][T10374] kvm: pic: single mode not supported [ 458.337000][T10383] Bluetooth: (null): Out-of-order packet arrived (4 != 0) [ 458.361925][ T5977] Bluetooth: (null): Invalid header checksum [ 458.801437][T10388] ubi: mtd0 is already attached to ubi31 [ 459.740437][ T30] audit: type=1400 audit(1752070851.306:620): avc: denied { read write } for pid=10398 comm="syz.0.1143" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 459.771154][ T30] audit: type=1400 audit(1752070851.336:621): avc: denied { open } for pid=10398 comm="syz.0.1143" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 460.162130][T10406] usb usb1: check_ctrlrecip: process 10406 (syz.4.1145) requesting ep 01 but needs 81 [ 461.311890][T10416] (syz.4.1147,10416,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 461.321172][T10416] (syz.4.1147,10416,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 462.289197][T10351] tipc: Disabling bearer [ 462.477356][T10139] veth0_vlan: entered promiscuous mode [ 462.665784][T10139] veth1_vlan: entered promiscuous mode [ 463.613249][T10139] veth0_macvtap: entered promiscuous mode [ 463.623253][T10139] veth1_macvtap: entered promiscuous mode [ 463.640600][T10139] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 463.695853][T10139] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 464.031544][T10139] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.042200][T10139] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.059768][T10139] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.078635][T10139] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.209274][ T6339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 464.266421][ T6339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 464.349571][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 464.367606][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 464.441331][ T30] audit: type=1400 audit(1752070855.996:622): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/root/syzkaller.fK2LB6/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 464.465684][ C0] vkms_vblank_simulate: vblank timer overrun [ 464.539578][ T30] audit: type=1400 audit(1752070856.036:623): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/root/syzkaller.fK2LB6/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 464.566304][ C0] vkms_vblank_simulate: vblank timer overrun [ 464.659291][ T30] audit: type=1400 audit(1752070856.036:624): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/root/syzkaller.fK2LB6/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=27898 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 464.874339][T10462] usb usb1: check_ctrlrecip: process 10462 (syz.0.1157) requesting ep 01 but needs 81 [ 465.218478][ T30] audit: type=1400 audit(1752070856.066:625): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2788 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 465.360222][ T30] audit: type=1400 audit(1752070856.076:626): avc: denied { mounton } for pid=10139 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 465.886194][T10469] netlink: 'syz.5.1090': attribute type 10 has an invalid length. [ 465.929233][T10469] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1090'. [ 466.164180][T10481] ubi: mtd0 is already attached to ubi31 [ 466.523929][T10469] team0: Port device geneve0 added [ 468.010942][T10514] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 468.022274][T10514] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 468.154351][T10514] usb usb1: check_ctrlrecip: process 10514 (syz.0.1162) requesting ep 01 but needs 81 [ 468.558248][ T30] audit: type=1400 audit(1752070860.116:627): avc: denied { read } for pid=10515 comm="syz.4.1163" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 468.580236][ C0] vkms_vblank_simulate: vblank timer overrun [ 468.629425][ T30] audit: type=1400 audit(1752070860.116:628): avc: denied { open } for pid=10515 comm="syz.4.1163" path="/242/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 468.767801][ T30] audit: type=1400 audit(1752070860.156:629): avc: denied { ioctl } for pid=10515 comm="syz.4.1163" path="/242/file0/file0" dev="fuse" ino=0 ioctlcmd=0x545c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 468.792264][ C0] vkms_vblank_simulate: vblank timer overrun [ 469.684159][T10538] netlink: 'syz.0.1167': attribute type 10 has an invalid length. [ 469.692029][T10538] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1167'. [ 469.701108][T10538] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 470.315403][T10517] delete_channel: no stack [ 470.670600][T10550] usb usb1: check_ctrlrecip: process 10550 (syz.2.1169) requesting ep 01 but needs 81 [ 470.684223][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 470.850006][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 470.877697][ T9] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 471.234539][ T9] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 471.365084][ T9] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 471.436819][ T9] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 471.479232][ T9] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 471.499707][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.507793][ T9] usb 4-1: Product: syz [ 471.608600][ T9] usb 4-1: Manufacturer: syz [ 472.052935][ T9] usb 4-1: SerialNumber: syz [ 472.085067][ T9] usb 4-1: can't set config #155, error -71 [ 472.778411][ T9] usb 4-1: USB disconnect, device number 24 [ 473.244155][ T30] audit: type=1400 audit(1752070864.306:630): avc: denied { getattr } for pid=10568 comm="syz.2.1175" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 473.412382][ T30] audit: type=1400 audit(1752070864.306:631): avc: denied { ioctl } for pid=10568 comm="syz.2.1175" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xb704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 473.853487][T10583] binder: BINDER_SET_CONTEXT_MGR already set [ 473.860980][T10583] binder: 10582:10583 ioctl 4018620d 200000000040 returned -16 [ 473.881942][T10583] binder: 10582:10583 ioctl c0306201 200000000900 returned -14 [ 476.759922][T10610] usb usb1: check_ctrlrecip: process 10610 (syz.3.1181) requesting ep 01 but needs 81 [ 478.551674][T10625] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 479.317008][ T30] audit: type=1400 audit(1752070870.876:632): avc: denied { bind } for pid=10641 comm="syz.2.1192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 479.593864][T10649] siw: device registration error -23 [ 479.972803][ T30] audit: type=1400 audit(1752070871.526:633): avc: denied { bind } for pid=10647 comm="syz.5.1194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 479.992171][ C0] vkms_vblank_simulate: vblank timer overrun [ 480.709517][T10669] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 480.720985][T10669] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 480.859983][T10669] usb usb1: check_ctrlrecip: process 10669 (syz.5.1197) requesting ep 01 but needs 81 [ 481.190349][T10668] pim6reg: entered allmulticast mode [ 481.198953][T10668] pim6reg: left allmulticast mode [ 481.859802][ T5884] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 482.659799][ T5884] usb 6-1: Using ep0 maxpacket: 8 [ 482.666238][ T5884] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 482.678028][ T5884] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 482.735727][ T5884] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 482.803572][ T5884] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 482.839303][ T5884] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 482.882270][ T5884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.543537][T10681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.625453][T10681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.232742][ T5884] usb 6-1: GET_CAPABILITIES returned 0 [ 484.265135][ T5884] usbtmc 6-1:16.0: can't read capabilities [ 484.284790][T10707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 484.452228][ T5884] usb 6-1: USB disconnect, device number 2 [ 485.079744][ T30] audit: type=1400 audit(1752070876.626:634): avc: denied { wake_alarm } for pid=10721 comm="syz.4.1211" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 485.150582][ T5840] Bluetooth: hci0: unexpected event for opcode 0x1004 [ 485.159529][ T30] audit: type=1400 audit(1752070876.696:635): avc: denied { bind } for pid=10721 comm="syz.4.1211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 486.042012][T10739] usb usb1: check_ctrlrecip: process 10739 (syz.5.1214) requesting ep 01 but needs 81 [ 487.003959][T10742] 9pnet: Could not find request transport: 0xffffffffffffffff [ 487.731698][T10749] syzkaller0: entered promiscuous mode [ 487.770301][T10749] syzkaller0: entered allmulticast mode [ 488.951063][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 489.190142][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 489.195451][ T5840] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 489.205392][ T5840] Bluetooth: hci0: Injecting HCI hardware error event [ 489.216773][ T5840] Bluetooth: hci0: hardware error 0x00 [ 489.274593][ T9] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 489.471829][ T9] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 489.722473][ T9] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 489.885182][T10770] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 489.967692][ T9] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 490.218177][ T9] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 490.384371][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.456489][ T9] usb 3-1: Product: syz [ 490.489884][ T9] usb 3-1: Manufacturer: syz [ 490.518232][ T9] usb 3-1: SerialNumber: syz [ 490.999680][ T43] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 491.230126][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 491.269740][ T5840] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 491.304193][ T43] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 491.441911][ T43] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 491.487256][ T9] usb 3-1: can't set config #155, error -71 [ 491.635066][ T43] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 491.854566][ T43] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 492.307380][ T43] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 492.495411][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.601982][ T9] usb 3-1: USB disconnect, device number 8 [ 492.673141][ T43] usb 5-1: Product: syz [ 492.705878][ T43] usb 5-1: Manufacturer: syz [ 492.765913][ T43] usb 5-1: SerialNumber: syz [ 492.831529][ T30] audit: type=1400 audit(1752070884.376:636): avc: denied { mounton } for pid=10796 comm="syz.3.1228" path="/220/file0" dev="tmpfs" ino=1196 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 492.855549][ T43] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input24 [ 493.271175][ T9] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 493.744385][ T30] audit: type=1400 audit(1752070885.306:637): avc: denied { write } for pid=10817 comm="syz.0.1233" name="/" dev="9p" ino=17889801302421081418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 493.771336][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 493.807792][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 111, setting to 64 [ 493.825901][ T9] usb 6-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice= 1.00 [ 493.858184][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.903780][ T9] usb 6-1: config 0 descriptor?? [ 493.928372][T10805] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 494.055699][ T30] audit: type=1400 audit(1752070885.586:638): avc: denied { connect } for pid=10822 comm="syz.0.1234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 494.223786][T10805] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.369647][ T43] imon:send_packet: packet tx failed (-71) [ 494.486627][T10805] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.520127][ T43] imon 5-1:155.0: panel buttons/knobs setup failed [ 494.666939][ T43] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 494.902638][ T43] (id 0x00) [ 495.082392][ T43] rc_core: IR keymap rc-imon-pad not found [ 495.088314][ T43] Registered IR keymap rc-empty [ 495.508516][ T43] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 495.529919][ T43] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 495.546137][ T43] imon:send_packet: packet tx failed (-71) [ 495.564187][ T9] rc_core: IR keymap rc-xbox-dvd not found [ 495.638059][T10848] usb usb1: check_ctrlrecip: process 10848 (syz.3.1236) requesting ep 01 but needs 81 [ 495.762131][ T9] Registered IR keymap rc-empty [ 495.857296][ T43] imon 5-1:155.0: remote input dev register failed [ 496.011216][ T9] rc rc0: Xbox DVD USB Remote Control(045e,0284) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 496.042324][ T9] input: Xbox DVD USB Remote Control(045e,0284) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input26 [ 496.065123][ T43] imon 5-1:155.0: imon_init_intf0: rc device setup failed [ 496.242813][T10857] binder: 10856:10857 ioctl c0306201 200000000040 returned -14 [ 496.264167][ T43] imon 5-1:155.0: unable to initialize intf0, err 0 [ 496.273958][ T9] usb 6-1: USB disconnect, device number 3 [ 496.279854][ C0] xbox_remote 6-1:0.0: xbox_remote_irq_in: usb_submit_urb()=-19 [ 496.282719][ T43] imon:imon_probe: failed to initialize context! [ 496.309086][ T30] audit: type=1400 audit(1752070887.866:639): avc: denied { read } for pid=10852 comm="syz.0.1239" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 496.348001][ T43] imon 5-1:155.0: unable to register, err -19 [ 496.380795][ T43] usb 5-1: USB disconnect, device number 18 [ 496.988493][T10867] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 497.463417][T10878] ubi: mtd0 is already attached to ubi31 [ 500.143096][T10891] overlayfs: overlapping lowerdir path [ 500.174652][T10890] usb usb1: check_ctrlrecip: process 10890 (syz.3.1249) requesting ep 01 but needs 81 [ 500.987639][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.995158][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.200401][T10905] evm: overlay not supported [ 501.646119][T10915] overlayfs: statfs failed on './file0' [ 503.469768][ T5979] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 503.709849][ T5979] usb 6-1: Using ep0 maxpacket: 32 [ 503.796792][ T5979] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 503.957666][ T5979] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 504.044509][T10957] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1263'. [ 504.161483][ T5979] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 504.352771][ T5979] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 504.588472][ T5979] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 504.839700][ T5979] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.908387][ T5979] usb 6-1: Product: syz [ 504.934252][ T5979] usb 6-1: Manufacturer: syz [ 504.959250][ T5979] usb 6-1: SerialNumber: syz [ 505.002671][T10966] binder: 10964:10966 ioctl c0306201 2000000003c0 returned -14 [ 505.019473][ T5979] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/input/input27 [ 505.392309][T10980] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 505.403889][T10980] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 505.499460][T10980] usb usb1: check_ctrlrecip: process 10980 (syz.4.1267) requesting ep 01 but needs 81 [ 506.034977][T10977] pim6reg: entered allmulticast mode [ 506.624009][ T5979] imon:send_packet: packet tx failed (-71) [ 506.663230][ T5979] imon 6-1:155.0: panel buttons/knobs setup failed [ 506.689654][ T5979] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 506.727357][T10977] pim6reg: left allmulticast mode [ 506.742383][ T5979] (id 0x00) [ 506.879693][ T5979] rc_core: IR keymap rc-imon-pad not found [ 506.908766][ T5979] Registered IR keymap rc-empty [ 506.989683][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 506.989978][ T5979] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 507.108939][ T5979] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 507.280627][ T5979] imon:send_packet: packet tx failed (-71) [ 507.321122][ T5979] imon 6-1:155.0: remote input dev register failed [ 507.352356][ T5979] imon 6-1:155.0: imon_init_intf0: rc device setup failed [ 507.701808][ T9] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 507.719709][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.761715][ T9] usb 5-1: Product: syz [ 507.781675][ T9] usb 5-1: Manufacturer: syz [ 507.801097][ T9] usb 5-1: SerialNumber: syz [ 508.019721][ T5979] imon 6-1:155.0: unable to initialize intf0, err 0 [ 508.026351][ T5979] imon:imon_probe: failed to initialize context! [ 508.039674][ T5979] imon 6-1:155.0: unable to register, err -19 [ 508.058020][ T9] usb 5-1: config 0 descriptor?? [ 508.060715][ T5979] usb 6-1: USB disconnect, device number 4 [ 508.197081][ T30] audit: type=1400 audit(1752070899.756:640): avc: denied { connect } for pid=11006 comm="syz.3.1272" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 508.197246][ T9] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 019 [ 508.379548][ T30] audit: type=1400 audit(1752070899.936:641): avc: denied { write } for pid=11006 comm="syz.3.1272" path="socket:[28610]" dev="sockfs" ino=28610 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 508.573055][ T9] (null): failure reading functionality [ 508.587739][ T9] i2c i2c-1: failure reading functionality [ 508.848634][ T9] i2c i2c-1: connected i2c-tiny-usb device [ 508.928363][ T9] usb 5-1: USB disconnect, device number 19 [ 509.375172][T11031] usb usb1: check_ctrlrecip: process 11031 (syz.2.1276) requesting ep 01 but needs 81 [ 510.482982][ T9] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 510.590602][ T9] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 511.857568][T11060] netlink: 'syz.4.1283': attribute type 10 has an invalid length. [ 511.865460][T11060] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1283'. [ 512.096045][T11044] hid-generic 0000:0000:0000.0009: pid 11044 passed too short report [ 513.170256][T11084] netlink: 'syz.4.1287': attribute type 10 has an invalid length. [ 513.178071][T11084] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1287'. [ 513.985977][ T30] audit: type=1400 audit(1752070905.546:642): avc: denied { bind } for pid=11099 comm="syz.5.1291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 514.427363][T11114] binder_alloc: 11113: binder_alloc_buf, no vma [ 514.568767][T11112] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 514.579907][T11112] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 514.583718][T11103] pim6reg: entered allmulticast mode [ 514.618935][T11112] usb usb1: check_ctrlrecip: process 11112 (syz.5.1294) requesting ep 01 but needs 81 [ 514.665213][T11103] pim6reg: left allmulticast mode [ 514.949784][T11124] siw: device registration error -23 [ 516.381276][T11107] netlink: 'syz.4.1292': attribute type 10 has an invalid length. [ 516.389110][T11107] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1292'. [ 516.887520][T11134] pim6reg: entered allmulticast mode [ 516.930844][T11131] pim6reg: left allmulticast mode [ 518.215764][T11177] tipc: Cannot configure node identity twice [ 518.452531][T11180] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 518.463965][T11180] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 518.608268][T11180] usb usb1: check_ctrlrecip: process 11180 (syz.2.1305) requesting ep 01 but needs 81 [ 518.837240][T11175] binder: 11173:11175 ioctl 400c620e 2000000000c0 returned -22 [ 518.881815][T11169] netlink: 'syz.5.1303': attribute type 10 has an invalid length. [ 518.889901][T11169] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1303'. [ 519.105827][ T30] audit: type=1400 audit(1752070910.666:643): avc: denied { append } for pid=11187 comm="syz.3.1307" name="event2" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 520.426117][T11197] ubi: mtd0 is already attached to ubi31 [ 520.734759][ T5891] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 521.106555][ T5891] usb 5-1: Using ep0 maxpacket: 32 [ 521.223692][ T5891] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 521.233911][ T5891] usb 5-1: config 0 has no interface number 0 [ 521.240764][ T5891] usb 5-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 521.262991][ T5891] usb 5-1: config 0 interface 1 has no altsetting 0 [ 521.287805][ T5891] usb 5-1: New USB device found, idVendor=0572, idProduct=58a2, bcdDevice=27.0a [ 521.299441][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.308876][ T5891] usb 5-1: Product: syz [ 521.313445][ T5891] usb 5-1: Manufacturer: syz [ 521.318113][ T5891] usb 5-1: SerialNumber: syz [ 521.360959][ T5891] usb 5-1: config 0 descriptor?? [ 521.409677][ T30] audit: type=1400 audit(1752070912.966:644): avc: denied { module_load } for pid=11208 comm="syz.3.1312" path="/sys/kernel/oops_count" dev="sysfs" ino=57569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 521.910290][ T5891] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a2) with 1 interfaces [ 522.071170][ T5891] cx231xx 5-1:0.1: Failed to read PCB config [ 522.141642][ T5891] cx231xx 5-1:0.1: probe with driver cx231xx failed with error -71 [ 522.377724][ T5891] usb 5-1: USB disconnect, device number 20 [ 522.571846][T11221] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 522.583452][T11221] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 522.594611][T11221] usb usb1: check_ctrlrecip: process 11221 (syz.5.1314) requesting ep 01 but needs 81 [ 523.880168][T11223] siw: device registration error -23 [ 524.138590][ T5891] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 524.348224][ T30] audit: type=1400 audit(1752070915.906:645): avc: denied { listen } for pid=11230 comm="syz.5.1318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 524.486715][T11236] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 524.497827][T11236] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 524.654608][T11236] usb usb1: check_ctrlrecip: process 11236 (syz.0.1319) requesting ep 01 but needs 81 [ 525.122615][ T30] audit: type=1400 audit(1752070916.606:646): avc: denied { write } for pid=11230 comm="syz.5.1318" path="socket:[30991]" dev="sockfs" ino=30991 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 525.205881][T11240] netlink: 'syz.4.1321': attribute type 1 has an invalid length. [ 525.279451][T11240] bond2: entered promiscuous mode [ 525.407262][T11240] 8021q: adding VLAN 0 to HW filter on device bond2 [ 525.804089][T11244] 8021q: adding VLAN 0 to HW filter on device bond2 [ 525.910589][T11244] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 525.928685][T11244] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 526.536820][T11244] bond2: (slave ip6gre1): making interface the new active one [ 526.545961][T11244] ip6gre1: entered promiscuous mode [ 527.170002][T11263] usb usb1: check_ctrlrecip: process 11263 (syz.5.1325) requesting ep 01 but needs 81 [ 527.469245][T11244] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 528.243977][T11270] netlink: 'syz.2.1327': attribute type 10 has an invalid length. [ 528.251917][T11270] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1327'. [ 529.282785][T11275] ubi: mtd0 is already attached to ubi31 [ 529.766982][T11269] netlink: 'syz.0.1328': attribute type 10 has an invalid length. [ 529.808507][T11269] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1328'. [ 529.945561][T11269] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 530.064627][T11282] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 530.075996][T11282] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 530.102109][T11282] usb usb1: check_ctrlrecip: process 11282 (syz.3.1329) requesting ep 01 but needs 81 [ 530.745801][T11289] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1331'. [ 532.439875][ T5884] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 533.299993][ T5884] usb 4-1: Using ep0 maxpacket: 32 [ 533.389306][ T5884] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 533.553887][ T5884] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 534.257259][T11314] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 534.268373][T11314] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 534.279722][T11314] usb usb1: check_ctrlrecip: process 11314 (syz.5.1338) requesting ep 01 but needs 81 [ 534.990704][ T43] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 535.504012][ T5884] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 535.515937][ T5884] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 535.529717][ T5884] usb 4-1: string descriptor 0 read error: -71 [ 535.535910][ T5884] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 535.545102][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.564232][ T5884] usb 4-1: can't set config #155, error -71 [ 535.572174][ T5884] usb 4-1: USB disconnect, device number 25 [ 535.612819][T11317] pim6reg: entered allmulticast mode [ 535.620111][T11317] pim6reg: left allmulticast mode [ 535.849860][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 536.255270][ T43] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 536.268855][ T43] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 536.284689][ T43] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 536.296035][ T43] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 536.406504][ T43] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 537.242587][T11331] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 537.253683][T11331] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 537.264719][T11331] usb usb1: check_ctrlrecip: process 11331 (syz.3.1343) requesting ep 01 but needs 81 [ 537.439742][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.469621][ T43] usb 3-1: Product: syz [ 537.553847][ T43] usb 3-1: Manufacturer: syz [ 537.558500][ T43] usb 3-1: SerialNumber: syz [ 537.577888][ T43] usb 3-1: can't set config #155, error -71 [ 537.622851][ T43] usb 3-1: USB disconnect, device number 9 [ 538.207579][T11339] netlink: 'syz.5.1342': attribute type 10 has an invalid length. [ 538.215477][T11339] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1342'. [ 541.415198][T11362] ubi: mtd0 is already attached to ubi31 [ 543.007197][T11364] netlink: 'syz.5.1353': attribute type 10 has an invalid length. [ 543.015180][T11364] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1353'. [ 546.419638][ T5945] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 546.499714][ T24] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 547.388820][ T5945] usb 3-1: Using ep0 maxpacket: 32 [ 547.402029][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 547.412227][ T24] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 547.421489][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 547.447462][ T24] usb 4-1: config 0 descriptor?? [ 547.462667][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 547.481673][ T5945] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 547.492765][ T5945] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 547.506074][ T5945] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 547.517968][ T5945] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 547.668199][T11385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.677111][T11385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.728479][ T5945] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 547.791234][T11402] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 547.802794][T11402] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 547.832859][T11402] usb usb1: check_ctrlrecip: process 11402 (syz.5.1361) requesting ep 01 but needs 81 [ 548.187708][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.198685][ T5945] usb 3-1: Product: syz [ 548.203238][ T5945] usb 3-1: Manufacturer: syz [ 548.248198][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 548.254856][ T5945] usb 3-1: SerialNumber: syz [ 548.298718][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 548.379330][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 548.479507][ T5945] usb 3-1: can't set config #155, error -71 [ 548.496346][ T5945] usb 3-1: USB disconnect, device number 10 [ 548.930633][ T24] pwc: recv_control_msg error -71 req 02 val 2000 [ 549.056010][ T24] pwc: recv_control_msg error -71 req 02 val 2100 [ 549.170692][ T24] pwc: recv_control_msg error -71 req 04 val 1500 [ 549.254499][ T24] pwc: recv_control_msg error -71 req 02 val 2500 [ 549.342569][ T24] pwc: recv_control_msg error -71 req 02 val 2400 [ 549.399688][ T24] pwc: recv_control_msg error -71 req 02 val 2600 [ 549.484247][ T24] pwc: recv_control_msg error -71 req 02 val 2900 [ 549.529889][ T24] pwc: recv_control_msg error -71 req 02 val 2800 [ 549.717941][ T24] pwc: recv_control_msg error -71 req 04 val 1100 [ 549.872108][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 550.003093][ T24] pwc: Registered as video103. [ 550.466717][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input29 [ 550.496950][ T24] usb 4-1: USB disconnect, device number 26 [ 553.874213][T11464] trusted_key: encrypted_key: hex blob is missing [ 553.989212][ T30] audit: type=1400 audit(1752070945.206:647): avc: denied { write } for pid=11457 comm="syz.2.1377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 555.965138][ T5945] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 556.155675][ T5945] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 556.173628][ T5945] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 556.187856][ T5945] usb 6-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 556.200038][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.225899][ T5945] usb 6-1: config 0 descriptor?? [ 557.077244][T11503] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 557.088665][T11503] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 557.422142][T11504] usb usb1: check_ctrlrecip: process 11504 (syz.4.1391) requesting ep 01 but needs 81 [ 557.529169][T11505] input: syz1 as /devices/virtual/input/input30 [ 557.543470][ T5945] hid-led 0003:1294:1320.000A: hidraw0: USB HID vff.fe Device [HID 1294:1320] on usb-dummy_hcd.5-1/input0 [ 557.568575][T11497] netlink: 'syz.2.1389': attribute type 10 has an invalid length. [ 557.576740][T11497] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1389'. [ 557.628189][ T30] audit: type=1326 audit(1752070949.186:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11500 comm="syz.0.1390" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f047f78e929 code=0x0 [ 557.664671][ T5945] hid-led 0003:1294:1320.000A: Riso Kagaku Webmail Notifier initialized [ 557.696390][ T5945] usb 6-1: USB disconnect, device number 5 [ 557.984846][ T36] leds riso_kagaku0:blue: Setting an LED's brightness failed (-38) [ 558.047814][ T36] leds riso_kagaku0:green: Setting an LED's brightness failed (-38) [ 558.070505][ T36] leds riso_kagaku0:red: Setting an LED's brightness failed (-38) [ 558.116569][T11513] bpq0: entered promiscuous mode [ 558.129935][T11513] bpq0: entered allmulticast mode [ 558.152596][ T30] audit: type=1400 audit(1752070949.706:649): avc: denied { ioctl } for pid=11512 comm="syz.4.1393" path="socket:[30681]" dev="sockfs" ino=30681 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 558.177467][ C0] vkms_vblank_simulate: vblank timer overrun [ 559.976252][ T30] audit: type=1400 audit(1752070951.536:650): avc: denied { ioctl } for pid=11527 comm="syz.4.1399" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5431 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 561.245651][T11539] netlink: 'syz.2.1400': attribute type 10 has an invalid length. [ 561.253519][T11539] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1400'. [ 562.339625][ T5884] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 562.402915][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.409333][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.844750][T11553] overlayfs: missing 'lowerdir' [ 563.136726][T11553] lo speed is unknown, defaulting to 1000 [ 563.145403][T11553] lo speed is unknown, defaulting to 1000 [ 563.153735][T11553] lo speed is unknown, defaulting to 1000 [ 563.721208][T11553] infiniband sz1: set down [ 563.726323][ T5945] lo speed is unknown, defaulting to 1000 [ 563.732244][T11553] infiniband sz1: added lo [ 563.772552][T11553] RDS/IB: sz1: added [ 563.777142][T11553] smc: adding ib device sz1 with port count 1 [ 563.783730][T11553] smc: ib device sz1 port 1 has pnetid [ 563.791155][ T5945] lo speed is unknown, defaulting to 1000 [ 563.800210][T11553] lo speed is unknown, defaulting to 1000 [ 564.508898][T11574] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 564.521077][T11574] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 564.750265][T10766] Bluetooth: hci5: command 0x0406 tx timeout [ 564.757650][T11573] usb usb1: check_ctrlrecip: process 11573 (syz.4.1408) requesting ep 01 but needs 81 [ 564.960996][ T30] audit: type=1400 audit(1752070956.516:651): avc: denied { append } for pid=11576 comm="syz.2.1409" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 565.545956][ T30] audit: type=1400 audit(1752070957.086:652): avc: denied { watch watch_reads } for pid=11576 comm="syz.2.1409" path="/303/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 565.569285][ C0] vkms_vblank_simulate: vblank timer overrun [ 565.675087][T11553] lo speed is unknown, defaulting to 1000 [ 567.220130][T11597] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1414'. [ 567.249156][T11553] lo speed is unknown, defaulting to 1000 [ 569.399749][ T24] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 569.619838][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 569.668982][ T24] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 569.767005][ T24] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 569.877183][ T24] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 569.975250][ T24] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 570.032065][ T24] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 570.108535][T11618] netlink: 'syz.2.1417': attribute type 10 has an invalid length. [ 570.116494][T11618] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1417'. [ 570.144466][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.220641][ T24] usb 6-1: Product: syz [ 570.242288][T11553] lo speed is unknown, defaulting to 1000 [ 570.309647][ T24] usb 6-1: Manufacturer: syz [ 570.319744][ T24] usb 6-1: SerialNumber: syz [ 570.353035][ T24] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 570.379992][ T24] imon 6-1:155.0: unable to initialize intf0, err -19 [ 570.419930][ T24] imon:imon_probe: failed to initialize context! [ 570.426297][ T24] imon 6-1:155.0: unable to register, err -19 [ 570.591568][T11630] netlink: 'syz.3.1423': attribute type 10 has an invalid length. [ 570.599387][T11630] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1423'. [ 570.777185][T11553] lo speed is unknown, defaulting to 1000 [ 571.409105][T11639] netlink: 'syz.4.1426': attribute type 10 has an invalid length. [ 571.416949][T11639] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1426'. [ 571.975725][ T5979] usb 6-1: USB disconnect, device number 6 [ 574.191027][T11670] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1434'. [ 576.034992][T11678] C speed is unknown, defaulting to 1000 [ 576.108849][T11678] lo speed is unknown, defaulting to 1000 [ 576.411672][T11687] overlayfs: missing 'lowerdir' [ 576.446944][T11687] sz1: rxe_newlink: already configured on lo [ 579.797826][T11728] netlink: 'syz.5.1445': attribute type 10 has an invalid length. [ 579.807681][T11728] veth1_vlan: entered allmulticast mode [ 579.839170][T11728] team0: Device veth1_vlan failed to register rx_handler [ 580.820946][T11726] netlink: 'syz.4.1446': attribute type 10 has an invalid length. [ 580.828793][T11726] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1446'. [ 580.922575][T11733] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 581.043274][T11735] kvm: pic: non byte read [ 581.090861][T11735] kvm: pic: level sensitive irq not supported [ 581.090933][T11735] kvm: pic: non byte read [ 581.120082][T11735] kvm: pic: level sensitive irq not supported [ 581.120145][T11735] kvm: pic: non byte read [ 581.150483][T11735] kvm: pic: level sensitive irq not supported [ 581.150547][T11735] kvm: pic: non byte read [ 581.836067][T11744] ubi: mtd0 is already attached to ubi31 [ 582.627726][T11751] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 582.649163][T11751] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 582.665348][T11751] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 582.695039][T11751] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 582.724675][T11755] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 582.733237][T11755] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 582.741791][T11755] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 582.864487][T11755] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 584.600543][T11775] ubi: mtd0 is already attached to ubi31 [ 586.261803][T11783] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 586.273368][T11783] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 587.062355][T11783] usb usb1: check_ctrlrecip: process 11783 (syz.5.1461) requesting ep 01 but needs 81 [ 587.073457][T11783] usb usb1: usbfs: process 11783 (syz.5.1461) did not claim interface 0 before use [ 587.811760][T11785] netlink: 'syz.4.1462': attribute type 10 has an invalid length. [ 587.819771][T11785] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1462'. [ 588.029681][ T30] audit: type=1400 audit(1752070979.546:653): avc: denied { watch } for pid=11788 comm="syz.3.1465" path="/276/file1" dev="tmpfs" ino=1501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 588.321982][ T30] audit: type=1400 audit(1752070979.546:654): avc: denied { watch_sb watch_reads } for pid=11788 comm="syz.3.1465" path="/276/file1" dev="tmpfs" ino=1501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 591.039471][T11821] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 591.052845][T11821] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 591.203120][T11821] usb usb1: check_ctrlrecip: process 11821 (syz.3.1470) requesting ep 01 but needs 81 [ 591.403522][ T5884] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 591.573360][ T5884] usb 6-1: Using ep0 maxpacket: 8 [ 591.591275][ T5884] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 591.715156][ T5884] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 592.476360][ T5884] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 592.506570][ T5884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.656343][ T5884] usb 6-1: config 0 descriptor?? [ 593.210513][T11845] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 593.222704][T11845] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 593.538180][T11845] usb usb1: check_ctrlrecip: process 11845 (syz.0.1476) requesting ep 01 but needs 81 [ 593.548409][T11845] usb usb1: usbfs: process 11845 (syz.0.1476) did not claim interface 0 before use [ 593.552630][T11844] capability: warning: `syz.2.1478' uses deprecated v2 capabilities in a way that may be insecure [ 593.747933][T11852] netlink: 'syz.4.1480': attribute type 1 has an invalid length. [ 593.891948][T11852] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 594.016197][ T5884] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 594.024892][ T5905] usb 6-1: USB disconnect, device number 7 [ 594.110633][T11852] 8021q: adding VLAN 0 to HW filter on device bond3 [ 594.578352][ T6339] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 594.654981][ T5884] usb 3-1: Using ep0 maxpacket: 8 [ 594.662150][ T5884] usb 3-1: config index 0 descriptor too short (expected 28277, got 36) [ 594.678386][ T5884] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 594.689397][ T5884] usb 3-1: config 0 has no interfaces? [ 595.089802][ T5884] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 595.098887][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.111446][ T5884] usb 3-1: config 0 descriptor?? [ 595.340995][T11862] bond3 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 595.345987][ T3950] usb 3-1: USB disconnect, device number 11 [ 595.355121][T11862] bond3 (unregistering): (slave ip6gretap1): Releasing backup interface [ 595.534722][T11875] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 595.545870][T11875] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 595.559062][T11875] usb usb1: check_ctrlrecip: process 11875 (syz.3.1484) requesting ep 01 but needs 81 [ 596.333389][T11862] bond3 (unregistering): Released all slaves [ 596.352399][T11859] tipc: Started in network mode [ 596.357363][T11859] tipc: Node identity 080211000001, cluster identity 4711 [ 596.368469][T11859] tipc: Enabled bearer , priority 0 [ 596.375415][T11863] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 596.383838][T11863] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 596.717166][T11869] tipc: Resetting bearer [ 597.061854][T11886] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 597.072955][T11886] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 597.852920][ T3950] tipc: Node number set to 134418688 [ 597.858762][ T30] audit: type=1400 audit(1752070988.486:655): avc: denied { mount } for pid=11881 comm="syz.4.1487" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 598.199123][T11888] siw: device registration error -23 [ 599.154340][T11904] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 599.154435][T11904] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 599.930310][T11917] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1494'. [ 599.939305][T11917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1494'. [ 600.412604][T11895] delete_channel: no stack [ 600.913085][T11928] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 600.922130][T11928] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 601.479710][T11935] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 601.490824][T11935] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 601.504377][T11935] usb usb1: check_ctrlrecip: process 11935 (syz.2.1499) requesting ep 01 but needs 81 [ 602.552585][T11936] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 602.662462][T11943] siw: device registration error -23 [ 605.080724][T11969] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1507'. [ 605.089677][T11969] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1507'. [ 607.179767][T11987] C speed is unknown, defaulting to 1000 [ 607.188637][T11987] lo speed is unknown, defaulting to 1000 [ 607.320190][T11993] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 607.835457][ T30] audit: type=1400 audit(1752070999.396:656): avc: denied { read } for pid=11996 comm="syz.0.1515" lport=51970 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 608.232114][ T30] audit: type=1400 audit(1752070999.486:657): avc: denied { setopt } for pid=11996 comm="syz.0.1515" lport=51970 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 609.619577][ T5979] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 609.636017][T12008] netlink: 'syz.5.1518': attribute type 1 has an invalid length. [ 609.785872][T12008] 8021q: adding VLAN 0 to HW filter on device bond1 [ 609.857913][ T5979] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 610.006129][ T5979] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 610.102985][ T5979] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 610.117527][ T5979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.123654][T12013] bond1: (slave geneve2): making interface the new active one [ 610.142486][T12005] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 610.184957][ T5979] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 610.211357][T12013] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 610.461495][ T30] audit: type=1400 audit(1752071002.026:658): avc: denied { getopt } for pid=12007 comm="syz.5.1518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 611.159109][T12008] veth3: entered promiscuous mode [ 611.232491][T12008] bond1: (slave veth3): Enslaving as an active interface with a down link [ 611.333326][T12017] vlan2: entered allmulticast mode [ 611.372651][T12017] bond1: entered allmulticast mode [ 611.424086][T12017] geneve2: entered allmulticast mode [ 611.461103][T12017] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 611.565703][ T5891] usb 4-1: USB disconnect, device number 28 [ 611.724360][T12039] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 613.282570][T12053] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 613.295093][T12034] XFS (nullb0): Invalid superblock magic number [ 613.334938][T12049] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 613.341599][T12049] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 613.346635][T12062] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1529'. [ 613.373104][T12049] vhci_hcd vhci_hcd.0: Device attached [ 613.406909][T12063] netlink: 'syz.5.1529': attribute type 1 has an invalid length. [ 613.442309][T12053] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(10) [ 613.448929][T12053] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 613.582664][T12053] vhci_hcd vhci_hcd.0: Device attached [ 613.666848][T12063] 8021q: adding VLAN 0 to HW filter on device bond2 [ 613.738372][ T24] vhci_hcd: vhci_device speed not set [ 613.903925][ T24] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 614.152754][T12072] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 614.181537][T12053] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 614.351647][T12068] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(12) [ 614.358280][T12068] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 614.383195][T12062] 8021q: adding VLAN 0 to HW filter on device bond2 [ 614.548462][T12062] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 614.702858][T12049] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(7) [ 614.709395][T12049] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 614.743101][T12062] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 614.781954][T12057] vhci_hcd: connection reset by peer [ 614.783526][T12058] vhci_hcd: connection closed [ 614.793134][T12068] vhci_hcd vhci_hcd.0: Device attached [ 614.801876][T12079] vhci_hcd: connection closed [ 614.805917][T11033] vhci_hcd: stop threads [ 614.829218][T11033] vhci_hcd: release socket [ 614.837409][T11033] vhci_hcd: disconnect device [ 614.843692][T12049] vhci_hcd vhci_hcd.0: Device attached [ 614.846797][T11033] vhci_hcd: stop threads [ 614.849310][T12078] vhci_hcd: connection closed [ 614.855560][T11033] vhci_hcd: release socket [ 614.865761][T11033] vhci_hcd: disconnect device [ 614.877637][T11033] vhci_hcd: stop threads [ 614.883742][T11033] vhci_hcd: release socket [ 614.888336][T11033] vhci_hcd: disconnect device [ 614.913034][T11033] vhci_hcd: stop threads [ 614.928786][T11033] vhci_hcd: release socket [ 614.955651][T11033] vhci_hcd: disconnect device [ 616.340061][ T5884] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 616.560883][ T5884] usb 5-1: Using ep0 maxpacket: 16 [ 616.800315][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.819594][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.841149][ T5884] usb 5-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 616.853945][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 616.863432][ T5884] usb 5-1: Product: syz [ 616.883963][ T5884] usb 5-1: config 0 descriptor?? [ 617.977810][T12117] ubi: mtd0 is already attached to ubi31 [ 618.533902][T12124] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1538'. [ 618.863711][T12128] netlink: 'syz.2.1544': attribute type 10 has an invalid length. [ 618.872309][T12128] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1544'. [ 619.551411][ T24] vhci_hcd: vhci_device speed not set [ 619.745338][T12137] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(8) [ 619.751878][T12137] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 619.759786][T12137] vhci_hcd vhci_hcd.0: Device attached [ 620.804521][T12138] vhci_hcd: connection closed [ 620.806316][ T1032] vhci_hcd: stop threads [ 620.817573][ T1032] vhci_hcd: release socket [ 620.825078][ T1032] vhci_hcd: disconnect device [ 623.352837][T12156] ip6t_rpfilter: unknown options [ 623.455464][ T5884] usbhid 5-1:0.0: can't add hid device: -32 [ 623.597149][ T5884] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 623.833316][ C0] ================================================================== [ 623.833567][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.841393][ C0] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x45a/0x4d0 [ 623.841423][ C0] Read of size 2 at addr ffff888057e7402a by task swapper/0/0 [ 623.851261][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 623.855491][ C0] [ 623.855504][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc5-syzkaller-00038-g733923397fd9 #0 PREEMPT(full) [ 623.855526][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 623.855536][ C0] Call Trace: [ 623.855542][ C0] [ 623.855548][ C0] dump_stack_lvl+0x116/0x1f0 [ 623.855572][ C0] print_report+0xcd/0x680 [ 623.855593][ C0] ? __virt_addr_valid+0x81/0x610 [ 623.855611][ C0] ? __phys_addr+0xe8/0x180 [ 623.855629][ C0] ? rose_timer_expiry+0x45a/0x4d0 [ 623.855649][ C0] kasan_report+0xe0/0x110 [ 623.855671][ C0] ? rose_timer_expiry+0x45a/0x4d0 [ 623.855693][ C0] rose_timer_expiry+0x45a/0x4d0 [ 623.855714][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 623.855733][ C0] call_timer_fn+0x19a/0x620 [ 623.855760][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 623.855784][ C0] ? rcu_is_watching+0x12/0xc0 [ 623.855804][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 623.855825][ C0] __run_timers+0x6ef/0x960 [ 623.855850][ C0] ? __pfx___run_timers+0x10/0x10 [ 623.855879][ C0] run_timer_base+0x114/0x190 [ 623.855902][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 623.855924][ C0] ? rcu_is_watching+0x12/0xc0 [ 623.855944][ C0] run_timer_softirq+0x1a/0x40 [ 623.855965][ C0] handle_softirqs+0x219/0x8e0 [ 623.855986][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 623.856006][ C0] __irq_exit_rcu+0x109/0x170 [ 623.856024][ C0] irq_exit_rcu+0x9/0x30 [ 623.856041][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 623.856062][ C0] [ 623.856067][ C0] [ 623.856073][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 623.856090][ C0] RIP: 0010:tick_nohz_idle_enter+0x56/0x270 [ 623.856113][ C0] Code: 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 d7 01 00 00 8b 1d b0 74 fc 0e 31 ff 89 de e8 b3 b5 0e 00 85 db 74 1d e8 6a ba 0e 00 <65> 8b 1d 1b a5 23 12 31 ff 89 de e8 9a b5 0e 00 85 db 0f 84 5f 01 [ 623.856129][ C0] RSP: 0000:ffffffff8e207e00 EFLAGS: 00000293 [ 623.856143][ C0] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81ad3c9d [ 623.856153][ C0] RDX: ffffffff8e297780 RSI: ffffffff81ad3ca6 RDI: 0000000000000005 [ 623.856164][ C0] RBP: ffffffff90a9b144 R08: 0000000000000005 R09: 0000000000000000 [ 623.856174][ C0] R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 [ 623.856183][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000008b000 [ 623.856196][ C0] ? tick_nohz_idle_enter+0x4d/0x270 [ 623.856217][ C0] ? tick_nohz_idle_enter+0x56/0x270 [ 623.856240][ C0] do_idle+0x80/0x510 [ 623.856260][ C0] ? __pfx_do_idle+0x10/0x10 [ 623.856279][ C0] ? trace_sched_exit_tp+0x31/0x130 [ 623.856302][ C0] cpu_startup_entry+0x4f/0x60 [ 623.856322][ C0] rest_init+0x16b/0x2b0 [ 623.856338][ C0] ? acpi_subsystem_init+0x133/0x180 [ 623.856358][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 623.856381][ C0] start_kernel+0x3ee/0x4d0 [ 623.856402][ C0] x86_64_start_reservations+0x18/0x30 [ 623.856423][ C0] x86_64_start_kernel+0x130/0x190 [ 623.856444][ C0] common_startup_64+0x13e/0x148 [ 623.856465][ C0] [ 623.856470][ C0] [ 624.167021][ C0] Allocated by task 5201: [ 624.171333][ C0] kasan_save_stack+0x33/0x60 [ 624.175986][ C0] kasan_save_track+0x14/0x30 [ 624.180635][ C0] __kasan_kmalloc+0xaa/0xb0 [ 624.185194][ C0] kernfs_fop_open+0x244/0xda0 [ 624.189939][ C0] do_dentry_open+0x741/0x1c10 [ 624.194699][ C0] vfs_open+0x82/0x3f0 [ 624.198740][ C0] path_openat+0x1de4/0x2cb0 [ 624.203307][ C0] do_filp_open+0x20b/0x470 [ 624.207798][ C0] do_sys_openat2+0x11b/0x1d0 [ 624.212444][ C0] __x64_sys_openat+0x174/0x210 [ 624.217264][ C0] do_syscall_64+0xcd/0x4c0 [ 624.221744][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.227608][ C0] [ 624.229903][ C0] Freed by task 5201: [ 624.233851][ C0] kasan_save_stack+0x33/0x60 [ 624.238505][ C0] kasan_save_track+0x14/0x30 [ 624.243155][ C0] kasan_save_free_info+0x3b/0x60 [ 624.248151][ C0] __kasan_slab_free+0x51/0x70 [ 624.252890][ C0] kfree+0x2b4/0x4d0 [ 624.256758][ C0] kernfs_fop_release+0x12c/0x1e0 [ 624.261757][ C0] __fput+0x402/0xb70 [ 624.265707][ C0] fput_close_sync+0x118/0x260 [ 624.270439][ C0] __x64_sys_close+0x8b/0x120 [ 624.275085][ C0] do_syscall_64+0xcd/0x4c0 [ 624.279561][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.285424][ C0] [ 624.287719][ C0] The buggy address belongs to the object at ffff888057e74000 [ 624.287719][ C0] which belongs to the cache kmalloc-512 of size 512 [ 624.301747][ C0] The buggy address is located 42 bytes inside of [ 624.301747][ C0] freed 512-byte region [ffff888057e74000, ffff888057e74200) [ 624.315425][ C0] [ 624.317719][ C0] The buggy address belongs to the physical page: [ 624.324106][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057e77c00 pfn:0x57e74 [ 624.334137][ C0] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 624.342615][ C0] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 624.351084][ C0] page_type: f5(slab) [ 624.355034][ C0] raw: 00fff00000000240 ffff88801b841c80 ffffea000161a310 ffffea0000d08010 [ 624.363587][ C0] raw: ffff888057e77c00 000000000010000f 00000000f5000000 0000000000000000 [ 624.372140][ C0] head: 00fff00000000240 ffff88801b841c80 ffffea000161a310 ffffea0000d08010 [ 624.380781][ C0] head: ffff888057e77c00 000000000010000f 00000000f5000000 0000000000000000 [ 624.389430][ C0] head: 00fff00000000002 ffffea00015f9d01 00000000ffffffff 00000000ffffffff [ 624.398074][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 624.406725][ C0] page dumped because: kasan: bad access detected [ 624.413132][ C0] page_owner tracks the page as allocated [ 624.418820][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5201, tgid 5201 (udevd), ts 64967526769, free_ts 14510609829 [ 624.439559][ C0] post_alloc_hook+0x1c0/0x230 [ 624.444312][ C0] get_page_from_freelist+0x1321/0x3890 [ 624.449832][ C0] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 624.455701][ C0] alloc_pages_mpol+0x1fb/0x550 [ 624.460528][ C0] new_slab+0x23b/0x330 [ 624.464662][ C0] ___slab_alloc+0xd9c/0x1940 [ 624.469319][ C0] __slab_alloc.constprop.0+0x56/0xb0 [ 624.474664][ C0] __kmalloc_cache_noprof+0xfb/0x3e0 [ 624.479920][ C0] kernfs_fop_open+0x244/0xda0 [ 624.484656][ C0] do_dentry_open+0x741/0x1c10 [ 624.489391][ C0] vfs_open+0x82/0x3f0 [ 624.493432][ C0] path_openat+0x1de4/0x2cb0 [ 624.498009][ C0] do_filp_open+0x20b/0x470 [ 624.502488][ C0] do_sys_openat2+0x11b/0x1d0 [ 624.507137][ C0] __x64_sys_openat+0x174/0x210 [ 624.511968][ C0] do_syscall_64+0xcd/0x4c0 [ 624.516455][ C0] page last free pid 1 tgid 1 stack trace: [ 624.522238][ C0] __free_frozen_pages+0x7fe/0x1180 [ 624.527407][ C0] free_contig_range+0x183/0x4b0 [ 624.532315][ C0] destroy_args+0x7f6/0xa60 [ 624.536789][ C0] debug_vm_pgtable+0x13b8/0x2d00 [ 624.541787][ C0] do_one_initcall+0x120/0x6e0 [ 624.546520][ C0] kernel_init_freeable+0x5c2/0x900 [ 624.551701][ C0] kernel_init+0x1c/0x2b0 [ 624.555999][ C0] ret_from_fork+0x5d7/0x6f0 [ 624.560563][ C0] ret_from_fork_asm+0x1a/0x30 [ 624.565297][ C0] [ 624.567599][ C0] Memory state around the buggy address: [ 624.573209][ C0] ffff888057e73f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 624.581250][ C0] ffff888057e73f80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 624.589279][ C0] >ffff888057e74000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 624.597331][ C0] ^ [ 624.602676][ C0] ffff888057e74080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 624.610710][ C0] ffff888057e74100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 624.618743][ C0] ================================================================== [ 624.626813][ C0] vkms_vblank_simulate: vblank timer overrun [ 624.632794][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 624.639961][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc5-syzkaller-00038-g733923397fd9 #0 PREEMPT(full) [ 624.651557][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 624.661597][ C0] Call Trace: [ 624.664861][ C0] [ 624.667679][ C0] dump_stack_lvl+0x3d/0x1f0 [ 624.672261][ C0] panic+0x71c/0x800 [ 624.676142][ C0] ? __pfx_panic+0x10/0x10 [ 624.680533][ C0] ? asm_common_interrupt+0x26/0x40 [ 624.685711][ C0] ? rose_timer_expiry+0x45a/0x4d0 [ 624.690811][ C0] ? check_panic_on_warn+0x1f/0xb0 [ 624.695938][ C0] ? rose_timer_expiry+0x45a/0x4d0 [ 624.701054][ C0] check_panic_on_warn+0xab/0xb0 [ 624.705993][ C0] end_report+0x107/0x170 [ 624.710312][ C0] kasan_report+0xee/0x110 [ 624.714727][ C0] ? rose_timer_expiry+0x45a/0x4d0 [ 624.719817][ C0] rose_timer_expiry+0x45a/0x4d0 [ 624.724747][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 624.730182][ C0] call_timer_fn+0x19a/0x620 [ 624.734759][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 624.739848][ C0] ? rcu_is_watching+0x12/0xc0 [ 624.744585][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 624.750026][ C0] __run_timers+0x6ef/0x960 [ 624.754507][ C0] ? __pfx___run_timers+0x10/0x10 [ 624.759519][ C0] run_timer_base+0x114/0x190 [ 624.764178][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 624.769351][ C0] ? rcu_is_watching+0x12/0xc0 [ 624.774101][ C0] run_timer_softirq+0x1a/0x40 [ 624.778842][ C0] handle_softirqs+0x219/0x8e0 [ 624.783581][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 624.788847][ C0] __irq_exit_rcu+0x109/0x170 [ 624.793504][ C0] irq_exit_rcu+0x9/0x30 [ 624.797730][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 624.803338][ C0] [ 624.806242][ C0] [ 624.809146][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 624.815113][ C0] RIP: 0010:tick_nohz_idle_enter+0x56/0x270 [ 624.820993][ C0] Code: 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 d7 01 00 00 8b 1d b0 74 fc 0e 31 ff 89 de e8 b3 b5 0e 00 85 db 74 1d e8 6a ba 0e 00 <65> 8b 1d 1b a5 23 12 31 ff 89 de e8 9a b5 0e 00 85 db 0f 84 5f 01 [ 624.840576][ C0] RSP: 0000:ffffffff8e207e00 EFLAGS: 00000293 [ 624.846614][ C0] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81ad3c9d [ 624.854557][ C0] RDX: ffffffff8e297780 RSI: ffffffff81ad3ca6 RDI: 0000000000000005 [ 624.862500][ C0] RBP: ffffffff90a9b144 R08: 0000000000000005 R09: 0000000000000000 [ 624.870443][ C0] R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 [ 624.878399][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000008b000 [ 624.886360][ C0] ? tick_nohz_idle_enter+0x4d/0x270 [ 624.891720][ C0] ? tick_nohz_idle_enter+0x56/0x270 [ 624.897018][ C0] do_idle+0x80/0x510 [ 624.900984][ C0] ? __pfx_do_idle+0x10/0x10 [ 624.905553][ C0] ? trace_sched_exit_tp+0x31/0x130 [ 624.910736][ C0] cpu_startup_entry+0x4f/0x60 [ 624.915478][ C0] rest_init+0x16b/0x2b0 [ 624.919693][ C0] ? acpi_subsystem_init+0x133/0x180 [ 624.924954][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 624.930487][ C0] start_kernel+0x3ee/0x4d0 [ 624.934966][ C0] x86_64_start_reservations+0x18/0x30 [ 624.940405][ C0] x86_64_start_kernel+0x130/0x190 [ 624.945507][ C0] common_startup_64+0x13e/0x148 [ 624.950418][ C0] [ 624.953601][ C0] Kernel Offset: disabled [ 624.957899][ C0] Rebooting in 86400 seconds..