last executing test programs: 2m50.896259129s ago: executing program 0 (id=547): syz_emit_ethernet(0x2e, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffff0580c20000004008004700001cd171eaefaa266f08ff000002ac1e0101890fbf0a0101"], 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_mr_cache\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/107, 0x6b}], 0x1, 0x6, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r2, r4, 0x25, 0x0, @void}, 0x10) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r1, 0x71f9fd87, 0x3, r5}) socket(0x10, 0x803, 0x0) socket(0x2, 0xa, 0x300) unshare(0x62040200) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0x3a}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) 2m50.474621019s ago: executing program 0 (id=548): r0 = memfd_secret(0x80000) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000080)={0x4, 0x0, '\x00', {0x0, @bt={0x7, 0x8, 0x0, 0x2, 0x10000, 0x71, 0x1, 0x2, 0x7, 0xf, 0x0, 0xfffffd17, 0xfffffff0, 0x6, 0xe, 0x20, {0x101, 0x4}, 0x8, 0xd}}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x4d, 0xda, 0xcc, 0x20, 0xe41, 0x4750, 0x269c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xf4, 0x2, 0x0, 0xd2, 0x98, 0x2c}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000094c0)=ANY=[@ANYBLOB="8c45000043000701feff416ec366166e0314000004004580744501"], 0x458c}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000380)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[], 0x70}, 0x1, 0x7}, 0x0) 2m47.374345721s ago: executing program 0 (id=558): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001040)='/proc/partitions\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000000)={0x0, 0xfffffffc, 0x100, 0x8000, 0x0, "7a58beca3900000000000000000000000200"}) 2m46.271043238s ago: executing program 0 (id=559): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x17e, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001a00)=ANY=[@ANYBLOB="61154c18000000006113500000000000bfa00000000000001503000008004e002d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a81426104000000000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546ccd3f1d5ab2af27546e7c07000000000000009555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4d08000000ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43000000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000b712c1e47be511fe32fbc90e2364a55e9bb609c64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd4722a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c835d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff5af657a67463d7dbf85ae9321fad16ee751cd7dde94ec97549c2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf377b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059a6cffb92e2a0cfd81434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5c4d188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a59a08077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a5cbb8be3f7741b18007dff12eb95066cc6bc256f0a12282224bb031bbee6d23cef7074f6d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873d0ecdf904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054e5deb27f7922fe6c14eba96c9af409da03290e4009f872d5aac263dbe239efb1e02dd4fc07f8c5b070e2ddeb4b5afa6df2e7e162962e334d85fa4373d5b569ac3353cc56008ddc8277fa9e8f6684513bfa827686b6fb71259743f55f46fa7e6379312e93213faf275f0441d46bc5690181244c44bea45854ed4ccd99f3fd328110ae22ef1504ec0566652d742ed8a7e202539c6531824f7399b486fbb906a91b77f2a6ba27bf97ebc7482cea32278a7acd9f2210e6ed2defcbd112f29a92401c5a37c58835f870b056186ef3971d3d9effa5661cabc2ff070000cfb030dd4ac0fe54db67510d3e9a5d36b900000074000000000000000000000000006e96ba8f5e7e89bef4226173e20ebb17b924e9e6d0ee163713b2bd56f58dec64df91417beaac4061e6216774e048276e110d25fe936b2cf31dc573b98bd037bceeae7feb600897c8364af49ce59027a6ee5d7c6e12c0f45c0f376d9da065ca0499e209655d2420fcfa10fccf2cbe7b60161cc6cbd874c928689acd9d4e00cefacc88"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) r4 = accept4$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14, 0x80800) getsockopt$packet_buf(r4, 0x107, 0x16, &(0x7f0000000940)=""/4096, &(0x7f0000000500)=0x1000) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) openat$kvm(0xffffffffffffff9c, 0x0, 0x90940, 0x0) mount$binderfs(0x0, &(0x7f00000001c0)='./binderfs\x00', &(0x7f0000000280), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="6d61783d30303030303030303030303030303030303030303030302c00fe9635f8fdbc748b0153822f50901a11d00225841d2806d68c3c74d06686118b0a75455e707100f283224db36fdde7cb89e91f8245ccff6e70c2dc01552a44946d9fa9d02eaa903af4bb9b06ab530623ff69a2d0542c69defeffdb1a51f25d33d08852890c7a4549394874a365748b91e27afd58b5e92a019c1efe40232ccf04321b51d1d09f8ebcbaa85760a954218188b62bcc0711d6f13461c6d1b36e18cf1aff8788b43a99f0f34a5a594f951af1995ceb47caef"]) openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002500)={{}, 0x0, &(0x7f00000024c0)}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r6, @ANYBLOB="200001"], 0x38}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 2m39.582394865s ago: executing program 0 (id=577): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_DIRENTPLUS(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000", @ANYRES64=r0], 0x10) 2m39.37247047s ago: executing program 0 (id=579): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r1, 0x5, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}, {0xc}, {0xfffffffffffffed6, 0x90, 0x6}}]}, 0x54}}, 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='affs\x00', 0x8008, 0x0) socket$inet(0x2, 0x80001, 0xfffffffb) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r1, 0x5, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}, {0xc}, {0xfffffffffffffed6, 0x90, 0x6}}]}, 0x54}}, 0x0) (async) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='affs\x00', 0x8008, 0x0) (async) socket$inet(0x2, 0x80001, 0xfffffffb) (async) 2m24.291702222s ago: executing program 32 (id=579): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r1, 0x5, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}, {0xc}, {0xfffffffffffffed6, 0x90, 0x6}}]}, 0x54}}, 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='affs\x00', 0x8008, 0x0) socket$inet(0x2, 0x80001, 0xfffffffb) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r1, 0x5, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}, {0xc}, {0xfffffffffffffed6, 0x90, 0x6}}]}, 0x54}}, 0x0) (async) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='affs\x00', 0x8008, 0x0) (async) socket$inet(0x2, 0x80001, 0xfffffffb) (async) 15.15794444s ago: executing program 5 (id=999): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) socket$pppoe(0x18, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000380)={0x1, 0x0, 0x6, &(0x7f0000000340)={0xff, "bd12e80000000000000000001900000000000000000000a884dfcc00"}}) setpriority(0x2, 0x0, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f000023d000/0x4000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x0, 0x0, 0x0, 0x2}) 13.205211287s ago: executing program 5 (id=1004): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) ftruncate(0xffffffffffffffff, 0x200000000000de) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000026c0)={0x14, 0x10, 0x21, 0x70bd29, 0x0, {0x3}}, 0x14}}, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 8.842363617s ago: executing program 5 (id=1014): syz_open_procfs(0x0, &(0x7f0000000000)='net/icmp6\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="10010000100007000000000000000000fc000000000000000000000000000000e00000020000000000000000000000004e2000004e2300000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000001000000000ffffffffffffffff0000000000000000000000000000000000000000000700000000000000000000000000000000000400fdffffffe80a000025bd7000000000000a000200340000000000000014000e00fe8000000000000000000000000000bf0c0015005b0735003b000000b96d03ecf64046359c51acb0643c02127b00"/217], 0x110}}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000000)={0x10000000}) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000000)=0x400) syz_io_uring_setup(0x7831, 0x0, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x200) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x18, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000009504118d59c7cba16c5680b01a72b0d4000000000000f1ff0000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x20802, 0x0) write$dsp(r7, &(0x7f0000000140)="2f1966d988dd", 0x6) 8.762280947s ago: executing program 2 (id=1015): r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x408400, 0x0) ioctl$PTP_PEROUT_REQUEST2(r0, 0x40383d0c, &(0x7f0000000040)={{0x400, 0x80000001}, {0x7ff, 0x10001}, 0x200, 0x1}) ioctl$sock_proto_private(r0, 0x89eb, &(0x7f0000000080)="51663b7a5e9d7025756d8180b9dd07abcba4bcc8f9e38e1c1e50b4fb96219225e2ed26a8269f29878f71a6b98aeb2d8679062ab58db5989a48987298e11974370ca6a534a0d70ffc7d42429df9702522feca8b7ca487fb27e140f6b2b6f7a51db8aa4041bb26c1362748309e00f1bb571efbfe71896f5e3a2d7ae97192a6b0aaea642c8d9ed01cbea0a8d11659910d29bdc8bffd100d1c785b3bcb5ae5c7b631344dbf") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$uac1(0x2, 0x91, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x7d669f44f434841, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x3, 0x1, 0x4, 0x30, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0x8}, [@output_terminal={0x9, 0x24, 0x3, 0x4, 0x100, 0x3, 0x6, 0xe9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x7, 0xf7, 0xf, {0x7, 0x25, 0x1, 0x0, 0x4, 0x80}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0xf, 0x9, 0x1}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x1, 0x4, 0x5, 0x9, "6eda993332fd9d2d"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0xa2, 0x5, 0x1, {0x7, 0x25, 0x1, 0x83, 0x94, 0x8}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x201, 0x5, 0x31, 0x5, 0x8, 0x7}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x7, [{0x39, &(0x7f0000000280)=@string={0x39, 0x3, "69277af6d38e5adfd0471ee64f220f4eac3dc327ce30e01cb0acc2355ccbee1d4c3c0b7267a56f50430f0447254ed0053bf85c6245a949"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x41f}}, {0xca, &(0x7f0000000300)=@string={0xca, 0x3, "e277f9f3cd906507b19f8bdfc47029aca646f7ea7394bb82970c12d33a82be3767be1e2941dc25712a97c11c74477182cd614d06933ae5b476b2c9e7ab4f9a84e28660889459f0c57eefe630f7c4e0c8d19d60f7e72633a8d4081a0cd7517dbf46bae3c42c8728797e87ebd368996f06decf8d22397f56fc2ce12b4985522d37b52da6b726a904519eeb8d72fed2a4698a2a88fc5eebd577ae5fcb6e8e7e6b96c98d8188a1332eb66b4705365ac6e80263edc7fdd57f7f0644851f7d8a0580549cc245a7b7e255cd"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x100a}}, {0x98, &(0x7f0000000440)=@string={0x98, 0x3, "2bac56dd41d08e4489508a381ecf6ad7791b44483d4b92521a6c96ee62959c7f90633710401f12639da90bd195dd241976de97a768581f468de26e970086b5af37bb7051594a1a6ed8212fd9fb51c5bd22e9e9baea2baaaa45788f1db4fa120f00700f99c2fb42d14e1a591616eab2d2f34593dedd318157ede36835bf61cbaa9b1925f64d1f6c1971f1bd6cff47992e7635ed8d1134"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x3c01}}, {0xb5, &(0x7f0000000540)=@string={0xb5, 0x3, "2e52ce98a379dc5edcf0f77624c825dc20db7dc9cc2b22fcf18be9836d2d16475c118aad6a4fb250d22ef884b3ebbca02fa218d2c15fa10376beea68a2759f531830193a3124e0ecda88da5ca29709b27da472ec21f6c6248b682d0602855f59a131915e7734307180629e5196d66f768774a4d32a834e72ac2b20ff64029d0eb734856fd6c0d2006b0570733584edd80d6575bb28274bf19c356723518a6b8170bd58786e9f4c9612f75a430a168bb7703f99"}}]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000700)={'syztnl0\x00', &(0x7f0000000680)={'ip6tnl0\x00', 0x0, 0x4, 0x81, 0x7f, 0xbd7, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x0, 0x9, 0x2}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@bloom_filter={0x1e, 0x1c4, 0x4, 0x4, 0x20040, r0, 0x70000000, '\x00', r2, r0, 0x0, 0x1, 0x4, 0xa}, 0x50) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000007c0)={0x2000}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000800)={r0}) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x5c, 0x0, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0x5}, [@CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xffffffff}]}, @CTA_SEQ_ADJ_REPLY={0x3c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xa7b}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1000}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1ff8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x4}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x80) (async, rerun: 64) r5 = accept4$unix(r0, &(0x7f0000000980), &(0x7f0000000a00)=0x6e, 0x80000) (rerun: 64) bind$unix(r5, &(0x7f0000000a40)=@file={0x1, './file0\x00'}, 0x6e) (async) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x1c, 0x1, 0x9, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000000}, 0x8000) (async) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000bc0)={0x3, 0x6f73309d11bb0d75, 0x86, 0x2, 0x5}) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000c40), r0) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000c80)={@local, @empty, 0x0}, &(0x7f0000000cc0)=0xc) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000ec0)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d00)={0x174, r6, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x50, 0x2, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0xf}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x6c, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x174}, 0x1, 0x0, 0x0, 0x10}, 0x40080) (async) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000f00), 0x38800, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000f40)={0x1, 0xf7, "942bc14ba86288c35f2060e75a60e668164daeff058f013ba2090631868a2295f02793b2d71b04ac084853102c324689443d3d7eebe4e2d13a1d81b33701fb66dfea1522e6e31587ff74b203f2708fe8d1cb6945d6f7fc953a80858fc016c12fe8861a3acfa3934915136806ae4d82d194a2e9c26028191455be4adb6a5e183e1466910f8f7762eb68d2b526e0befced82b9cac538e472f2c60aba107f879c677ec8ef501a178234aedab7ffb1f6d3594746949fe62122fbf3278dd623cb601662541affb3ec19ec85a4785cbab56daeccb606d7b4c26fc376ba6497eb6220cca16beb5467690cf1bf92a654595a75efa7604ab3cbfb67"}) (async) r8 = accept4(r4, 0x0, &(0x7f0000001040), 0x800) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f0000001080), 0x3) syz_usb_connect$uac1(0x4, 0xbb, &(0x7f00000010c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x99d7bb9495b86b8b, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa9, 0x3, 0x1, 0x4, 0xd0, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xe, 0x4}, [@selector_unit={0x9, 0x24, 0x5, 0x6, 0x7, "b62190de"}, @feature_unit={0xd, 0x24, 0x6, 0x1, 0x2, 0x3, [0x6, 0x0, 0x9], 0x4}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x304, 0x1, 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x8c, 0x7, 0x1, {0x7, 0x25, 0x1, 0x80, 0x0, 0xfff8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x6, 0x0, 0x0, "6c5949cf089d"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0xf, 0x4, 0x7, 0x2, 'X', "25d3b3"}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x6, 0x5, 0x40, "63c6441321ca3d"}]}, {{0x9, 0x5, 0x82, 0x9, 0x7d7, 0x7, 0x4b, 0x7, {0x7, 0x25, 0x1, 0x1, 0x5, 0x2}}}}}}}]}}, &(0x7f0000001440)={0xa, &(0x7f0000001180)={0xa, 0x6, 0x250, 0x6, 0x8, 0x8, 0x8, 0x9}, 0x50, &(0x7f00000011c0)={0x5, 0xf, 0x50, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x5, 0xc, 0x5}, @ssp_cap={0x24, 0x10, 0xa, 0x9, 0x6, 0x2, 0x0, 0x5, [0xc0, 0xff3f0f, 0x0, 0x3f0f, 0xff0000, 0x0]}, @wireless={0xb, 0x10, 0x1, 0xc, 0x14, 0x6, 0x80, 0x9, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xf, 0x8, 0x31, 0xa96}, @wireless={0xb, 0x10, 0x1, 0xc, 0x40, 0x5, 0x4, 0x4, 0x1}]}, 0x3, [{0xfc, &(0x7f0000001240)=@string={0xfc, 0x3, "f9e5773f70531e16ab558c011f73f2dd254ba4ea496f3f2360ad33278046ec8593a1e2fdf46ab182527fb7681c2d448dc496ba04706d5850b21deb3393cd7712727613214ada0aa5642ecb0ba193fb1cab4dc599fe40ac6ca919310ef1426362cd0792d07faf2ff54b41448f1bca5065f79a49d80e1c245e63b7e8d097b65c18b99a819d320f4f6b963b4f34d36235c083754de35b8bb03463c257fa24b0e15aaaa31b19ad4eabe5c12256d1c01207d42050d889cc9eec53cc74f2583cdb0595f99ff94a4d0fb53a0e7ae1371940f96ba4a6bd7b99f2cdaf5dd3aaa1cb59f03fbfb23b672629a38b8dc5c8ecf0618c9ef72f98bc0231c4310bfe"}}, {0x4, &(0x7f0000001340)=@lang_id={0x4, 0x3, 0x3078}}, {0xb1, &(0x7f0000001380)=@string={0xb1, 0x3, "70760c65120381ddf068aecc5d2cf92aef285ed874810578d464a858c66b6795482d43e3472f8bc471f2f36d0907b1af90a7c0d7d1773e5d8b9c01f06257a97c11bd188966183e74f828f21a99a1ce7549d15823bbaeaf369c80341011cbcb0c17677dab89ba3c12d47bb06f02cf075d2259ab0ce3f65f50c2144f01817c3e74ec837b7efebe5b7825e8c9936e797eea26e2e1d9a6a4ec27ceb471dd37946f68b6666e3c8c9fb3f91360219cb36905"}}]}) (async) socket$unix(0x1, 0x2, 0x0) (async) sendmsg$ETHTOOL_MSG_WOL_GET(r4, &(0x7f0000001680)={&(0x7f0000001480), 0xc, &(0x7f0000001640)={&(0x7f00000014c0)={0x148, r6, 0x1, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4}, 0x10) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r0, 0xc018937d, &(0x7f00000016c0)={{0x1, 0x1, 0x18, r5, {0x1}}, './file0/file0\x00'}) sendmsg$NFNL_MSG_CTHELPER_DEL(r9, &(0x7f0000001800)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000017c0)={&(0x7f0000001740)={0x50, 0x2, 0x9, 0x201, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x3}}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x6}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x10001}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1000}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x9}}]}, 0x50}}, 0x800) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r10, 0x11a, 0x1, &(0x7f0000001840)=@ccm_128={{0xd671847239105dd}, "bee316b94782687e", "a2167266b87ab74bfae4138a8a92cc54", "76af1bfe", "b66e49cdc76979dc"}, 0x28) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f00000020c0)={0x0, 0x4, {0x0, @struct={0xc, 0x2}, 0x0, 0x67, 0x4, 0x6, 0xb1f, 0x9, 0x402, @struct={0x2, 0x2}, 0xffff, 0x2, [0xff9, 0x10, 0x101, 0x1, 0xc9, 0xffffffffffffffff]}, {0x89e, @usage=0x240000000000000, 0x0, 0xd3dc, 0xb, 0x0, 0x7fffffff, 0x40, 0x2a, @usage=0x8, 0x2, 0x7, [0x8, 0x5, 0x8, 0xa, 0x6, 0x2]}, {0x7ff, @usage=0x5, 0x0, 0x2, 0x5, 0x800, 0x0, 0x9, 0x12, @struct={0xfffffd44, 0x399}, 0x1000, 0x5, [0x1000, 0x7fffffff, 0x8c6e, 0x4, 0x81, 0x3]}, {0x2, 0x8000000000000000, 0x9}}) 7.67075475s ago: executing program 5 (id=1020): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES32=r0], 0xa4}, 0x1, 0x0, 0x0, 0x48005}, 0x801) 6.061528874s ago: executing program 5 (id=1025): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1c9b41, 0x8) setfsuid(0xee00) setresuid(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000600)={{{@in=@multicast1, @in=@broadcast}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f00000003c0)=0xe8) fstat(r1, &(0x7f0000000340)) ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f0000000000)={0x80000000, 0x100, "9a9c01d78e8a02e5ebf73d3a7cf26c7ed280337eedc1e26eff5b96f8a8a5db4d", 0xffff, 0x8, 0xfffffffffffff840, 0x0, 0x4, 0x8, 0xa6, 0x7ff, [0xd2e4, 0x1, 0x4, 0x4]}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x2, 0x80805, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x44) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000300)=0x4, 0x12) io_getevents(0x0, 0x6, 0x0, &(0x7f00000003c0), &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) listen(0xffffffffffffffff, 0xb) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000880)=@mangle={'mangle\x00', 0x44, 0x6, 0x3d8, 0x1e8, 0x98, 0x0, 0x1e8, 0x150, 0x340, 0x340, 0x340, 0x340, 0x340, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x0, 0xd14bdc4, {0x8}}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00', {}, {}, 0x0, 0x0, 0x70}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0xff, 0x0, 'syzkaller0\x00', 'geneve1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x438) ioctl$SIOCSIFHWADDR(r0, 0x8947, &(0x7f00000002c0)={'vlan0\x00', @local}) 6.022634252s ago: executing program 1 (id=1026): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x1) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @remote}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x802) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0x40405515, &(0x7f00000000c0)={0x9, 0x1, 0x401, 0x5, 'syz0\x00', 0x2}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d658ec87bb53679fd0000078548ceb6c4414fab0919616e19aecedec1b76aea5922406b64cddaeb9d339ba3c01c2c7b8df8e61740b9af2d4d58654a4af0fa0ce1f830cc1eaf991fd00"}, 0xd8) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000180)={'\x00', &(0x7f0000000140)=@ethtool_rxfh_indir={0x38, 0x6, [0x8001, 0x80000001, 0x81, 0x4, 0x7fff, 0x7]}}) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) sendmsg$inet(r6, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') exit(0xf) pread64(r8, &(0x7f0000001400)=""/4108, 0x100c, 0x7) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000780)=ANY=[@ANYBLOB="3000eaff", @ANYRES16=r7, @ANYBLOB="020027bd7000fedbdf2515000000050029000000000008002c00030000000c0006000100000001000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x880) 5.829004637s ago: executing program 4 (id=1027): r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r4, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000380)='dx\xeb\xf4\xd8&w\xef\xcd1w\xfd2\x19x\xcc\x8d\xabN\xea\xd1\xea\xfa\xc3u\xcdMB\xb2m\xe5Bq\xe3\x9a~\xbe3\xd7\xb1\x16\x8b\xb9\xb6\xc6u\x0f9S\x05\x83n\x01\xa1\x1c\x82\\fsa<\xcd\x18}=A{\x17\xd0\x95\xbd25N\b^\x8eFsTvd)\xad') sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r5) keyctl$KEYCTL_MOVE(0x1e, r5, r5, r6, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r7, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r7, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x81}]}, 0x10) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000000)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000540)=@ccm_128={{0x303}, "064fdcb90d61d144", "3673f2d46c7e32ab7af5760ce14fd739", "a498f55f", "f4922dda9aa7220b"}, 0x28) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000180)) write$binfmt_misc(r7, &(0x7f0000000000)='i', 0x1) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x185200) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, &(0x7f0000000400)={0xa, 0x2, 0x0, 'queue1\x00', 0x38000}) sendto$inet(r7, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x0, 0x0, 0x0) 5.591959176s ago: executing program 2 (id=1028): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000140)='.\x00', 0x0, 0x10000, &(0x7f0000000440)={'trans=rdma,', {'port', 0x3d, 0x4e23}}) 5.159908211s ago: executing program 3 (id=1029): r0 = inotify_init() r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0x9}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="98", 0x1}], 0x1}}], 0x1, 0x6081) close_range(r0, 0xffffffffffffffff, 0x0) 4.791991712s ago: executing program 4 (id=1030): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) pwritev(r0, &(0x7f0000000480)=[{&(0x7f0000010340)="98672395318085d8d1329c1fa586c5a7b28caf2a64efca1fd7420ff875a4aa40fe1ed37f5d6b1bfb", 0x28}], 0x1, 0x1083, 0x23000005) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000280)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)="27050200590214000600002fb96da7f706e10500000086ddffff1144ee1611d4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184bbfdb9dd6f635406c4a67c5ff905a80e8404bb39fa4647893c17de955e6c8e765fa111bab1b33a1571772290d038d6cdfe81208da10a97337ccacb53d20e2311bbcc6f8e4d2a5f8256cb8584db15a24067e11e1462505442d912f40e409000000f8dd2eb87781e0802b62ce525aaa91b19a8296d13e2f0b6ef45c8e76a8e12bb7b77f5b882f41a1abc6839ba447dee5704f6c7e70", 0xc9}, {&(0x7f00000006c0)="1c393502dda1a67d93b1ceccbe972c4fef9c33ecf2d824f3a33513f45f472bbdc8e3a2275f2587f0ca0b3ae419bed996116448f90d113ce98aa985f379d729430858f5cb9a668a1800bf2354b33cdff83033de518580a3080d7f4cc2406e071138439e1566dd17983ee153ab672f362d3292e24a9952f18ec3d8b37bb3391096c1d4442a754899299321c03cbcfb98a26994b2a072c2b9d9c70d619545e5f61b050e40166d2ff57dcc008f24fd5339e7bc21e25863f80d2487c30b6bf781608a31d68e9319ab1712d8f5bfde849c040417c864cbfd3923dcb9fc6bdc2ea53334184b03efcb631dc68f0a7b6e13eea4b80d4237120e32932ca4e2b50bad0a35496d36a191d91f03b477b9587bc0ba489932e34f819fa1524ebad53a3d94b46c6aeff4f42fa067729fbb2862c09d337a75e0c8429d4bfe0dee2e1e23e8c22787178600ecca135623731e4701f35bd4e7c936a8ee274120e7662328a5aba1161b05889b045696721c79bff0547efe051f3c5de77fdd3c77afd41a1a7747a982b7efb013c9d6bac7d3ad1f9b7c3a5a1448b35696f03bca1c875e346edc55b7a271c3e5f3c0df72c8e4d7cccfa2827b87e8d4ae9c17bd51ed1a21cdb3f3e9b598f0ae06efbc1a5d5bd91aed6b32deccf7755cef50fab72633c80253", 0x1d9}], 0x2}, 0x9cdc2384056b48b8) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000cc0)) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 4.722768099s ago: executing program 3 (id=1031): syz_open_procfs(0x0, &(0x7f0000000000)='net/icmp6\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="10010000100007000000000000000000fc000000000000000000000000000000e00000020000000000000000000000004e2000004e2300000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000001000000000ffffffffffffffff0000000000000000000000000000000000000000000700000000000000000000000000000000000400fdffffffe80a000025bd7000000000000a000200340000000000000014000e00fe8000000000000000000000000000bf0c0015005b0735003b000000b96d03ecf64046359c51acb0643c02127b00"/217], 0x110}}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40088a01, &(0x7f0000000040)=0x10000000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000000)={0x10000000}) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000000)=0x400) syz_io_uring_setup(0x7831, 0x0, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x200) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x18, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES32=r5, @ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000009504118d59c7cba16c5680b01a72b0d4000000000000f1ff0000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x20802, 0x0) write$dsp(r6, &(0x7f0000000140)="2f1966d988dd", 0x6) 4.673766911s ago: executing program 4 (id=1032): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_TABLE(r1, 0x0, 0xcf, &(0x7f0000000040), 0x4) syz_emit_ethernet(0xc7, &(0x7f0000000080)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}, @val={@val={0x88a8, 0x4, 0x0, 0x4}, {0x8100, 0x3, 0x1, 0x1}}, {@generic={0x200, "886197b09e422b840daa1a53183615207492a614fd83886299e51c85e2d70aa096338a788572d4caa1403d423552120f554f51c166d333e9afbcc19b907db0e59a1572d30998a0c5dc01e696ffebc5374e551338481129693ecd2242e9880778c205ef47888b9d760aa6201192bb729c74f08dde7e4b8191e4c4824997d1d725e4ab6a8f989dabb5d61fe4188b748f3260f98db07ae5ff12fc3966e39823cf4e57c0aea59f5cde2e99d7605132fa72c9db"}}}, &(0x7f0000000180)={0x1, 0x2, [0xee0, 0x8b4, 0xe6a, 0xec0]}) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000200)={0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CURSOR(r2, 0xc01c64a3, &(0x7f0000000240)={0x3, r3, 0x7, 0x3, 0x80, 0x0, 0x5}) r4 = socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x1, 0x8, 0x400, 0x4}, 0x1}, 0x20, 0x0, 0x0) r5 = open(&(0x7f0000000300)='./file0\x00', 0x20000, 0x100) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x40, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x2, 0x37}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x4}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x209}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x20044000) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r4) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40401a4}, 0xc, &(0x7f0000000640)={&(0x7f0000000500)={0x104, r7, 0x8, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x4f, 0x4b}}}}, [@NL80211_ATTR_FRAME_MATCH={0x69, 0x5b, "c42e593511040e0732a604407a56d0bc2e4637ffd9515af8bbd5711d48e102330f57f99897b6786bd205cd8a5c33df29277fb787a661d4a262768ff935992e9b9b574cc00eda39e8a647fe2de5bef1a2119cfddc0919400737a205878b71192b8bad8c9867"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x8}, @NL80211_ATTR_FRAME_MATCH={0x65, 0x5b, "7d30e07e05fae782944c638149cca548a3c17dbd9164ebb4c75254b79ff50ac2cb1077319b17b7dd0b6555513ef7ebcb4da8c2dc0bfc879065ced4b895cc17ffb84b618a298752424b451861163fb61c23395acb29d462ecf1e1cff42bc36a7a7b"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x2}]}, 0x104}, 0x1, 0x0, 0x0, 0x48080}, 0x8881) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r4) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000780)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f00000007c0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000880)={'syztnl1\x00', &(0x7f0000000800)={'syztnl1\x00', 0x0, 0x8, 0x40, 0x0, 0xfffffffe, {{0xb, 0x4, 0x0, 0x1b, 0x2c, 0x68, 0x0, 0x6, 0x4, 0x0, @broadcast, @broadcast, {[@lsrr={0x83, 0x7, 0xc1, [@dev={0xac, 0x14, 0x14, 0x1d}]}, @generic={0x7, 0xe, "c3759a0197ffe0d84b3c4b47"}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b80)={r5, 0xe0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000008c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0xa, &(0x7f0000000900)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000940)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc8, &(0x7f0000000980)=[{}, {}], 0x10, 0x10, &(0x7f00000009c0), &(0x7f0000000a00), 0x8, 0xcf, 0x8, 0x8, &(0x7f0000000a40)}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000cc0)={'tunl0\x00', &(0x7f0000000bc0)={'syztnl1\x00', 0x0, 0x80, 0x10, 0x0, 0x1b, {{0x2d, 0x4, 0x3, 0x3c, 0xb4, 0x64, 0x0, 0x66, 0x29, 0x0, @private=0xa010101, @multicast1, {[@timestamp_prespec={0x44, 0x24, 0x54, 0x3, 0x0, [{@dev={0xac, 0x14, 0x14, 0x20}, 0x7}, {@broadcast, 0xc6}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x100}, {@rand_addr=0x64010100, 0x4}]}, @cipso={0x86, 0x31, 0xffffffffffffffff, [{0x5, 0x3, "f1"}, {0x2, 0x12, "e8c7caac06b1b76b1350a9c2a9e514b3"}, {0x5, 0x8, "ad9aadba43cf"}, {0x0, 0xe, "5b2a6ef379456a0406a20824"}]}, @ssrr={0x89, 0x17, 0xce, [@multicast2, @broadcast, @broadcast, @multicast1, @dev={0xac, 0x14, 0x14, 0x18}]}, @generic={0x82, 0x2}, @rr={0x7, 0xb, 0xf1, [@broadcast, @multicast2]}, @ssrr={0x89, 0xf, 0x75, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x44}, @rand_addr=0x64010102]}, @rr={0x7, 0x17, 0x13, [@empty, @remote, @empty, @dev={0xac, 0x14, 0x14, 0x30}, @dev={0xac, 0x14, 0x14, 0xb}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000dc0)={'erspan0\x00', &(0x7f0000000d00)={'gretap0\x00', 0x0, 0x700, 0x1, 0x4, 0x8, {{0x21, 0x4, 0x1, 0x5, 0x84, 0x68, 0x0, 0x7, 0x29, 0x0, @multicast2, @remote, {[@generic={0x44, 0x5, "c348a5"}, @noop, @ra={0x94, 0x4}, @ra={0x94, 0x4}, @ssrr={0x89, 0x17, 0x6e, [@multicast1, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @private=0xa010102]}, @generic={0x83, 0xf, "b3778c29aed6347da739418ba0"}, @cipso={0x86, 0x1e, 0x2, [{0x2, 0x6, "71772498"}, {0x0, 0xb, "040885e0f0de89ccd4"}, {0x1, 0x7, "d4117e0a72"}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x17, 0x27, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x20}, @multicast1, @broadcast, @multicast1]}]}}}}}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000001000)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000e00)={0x190, r9, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x200450c1}, 0x1) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) socketpair(0xf, 0x6, 0x3dd235b8, &(0x7f0000001040)) getpeername$inet(r1, &(0x7f0000001080)={0x2, 0x0, @loopback}, &(0x7f00000010c0)=0x10) r16 = syz_genetlink_get_family_id$batadv(&(0x7f0000001140), r4) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x10008000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x34, r16, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008004}, 0x20004080) sendmsg$NL80211_CMD_LEAVE_OCB(r4, &(0x7f0000001380)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x28, 0x0, 0x20, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffff23c, 0x48}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) 4.435825629s ago: executing program 4 (id=1033): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x200}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x7d, &(0x7f00000000c0)={0x0, 0x20000a}, 0x8) sendmsg$nl_xfrm(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4401000021000100000000000100000000000000000000000000000000000000fe8000000000000000000000000000bb0086e475f1eab5ff447100"/73, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000e8001100e0000001000000000000000000000000ac1414aa000000000000000000000000ac1414aa000000000000000000000000ffffffff0000000000000000000000003c040000053500000a00020000000000000000000000000000000000ac1e0001000000000000000000000000e0000002000000000000000000000000000000000000000000000000000000006c0100000635000002000200000000000000000000000000000000007f000001000000000000000000000000fe8000000000000000000000000000bbff02000000000000000000000000000133020000000000000a000a000a0010000000000000000000"], 0x144}}, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r5 = socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8916, &(0x7f0000000040)={'veth1_macvtap\x00', @random="0200ac7f7f00"}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r6, 0x0, 0x4048050) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_GET_XCRS(r7, 0x8188aea6, &(0x7f00000005c0)) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000006800010002000000d6ffff7f00000000000000001410020001000000040000000100000001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 4.006794646s ago: executing program 2 (id=1034): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$inet6(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000440)=""/128, 0x80}], 0x1}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x80, 0x0, 0x0, &(0x7f0000000740)=""/23, 0x17}, 0x3}], 0x2, 0x40012100, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000100)={0x20000014}) close_range(r3, r5, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400daea765db0bc10260000000002000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000000000000000000002900001811", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf090000000000006609010000000000060000000b000000180100002020702500000000002020207b9af8ff00000000"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) 3.936546403s ago: executing program 1 (id=1035): munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r1 = gettid() r2 = socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x403, 0xfffffff9, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x19c04, 0x55007}, [@IFLA_NET_NS_PID={0x8, 0x13, r1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4802}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11, r0, 0x9c437000) r3 = socket$isdn(0x22, 0x2, 0x10) r4 = socket$isdn(0x22, 0x2, 0x2) r5 = dup3(r4, r3, 0x0) accept4$ax25(r5, 0x0, 0x0, 0x800) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x10}}, './file0\x00'}) 3.782189878s ago: executing program 3 (id=1036): sendmsg$IPSET_CMD_GET_BYINDEX(0xffffffffffffffff, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000d80)={0x24, 0xf, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000080}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) close(0x3) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r2, 0x3ff) accept$netrom(r3, 0x0, 0x0) write$tun(r1, 0x0, 0xfdef) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000340)=0x0) timer_settime(r5, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000240)={0x23, 0x1, 0x13, 0x1, 0x0, 0x5, 0x0}) socket(0x10, 0x80002, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x200000000000000) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r7, &(0x7f0000009780)={0x2020}, 0x2020) read$FUSE(0xffffffffffffffff, &(0x7f0000000e80)={0x2020}, 0x2020) 3.519877361s ago: executing program 1 (id=1037): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x4000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x2}, 0x8) 3.284850133s ago: executing program 1 (id=1038): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_emit_ethernet(0xfc6, &(0x7f0000001000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c890f902bff20010000000000000000000000000000fe8000000000000000000000000000aa3cf00000000000000401aa05020009040101007503a05ea1a450710e39e45f43900c1597c958f65cad2b2261c7ecaa658392b3be2d7e27e0e4f0e1ae727081dc1e6b28cca212d4580bada268c4f1330da9b27818057c9ac90f3140536c824850e3928a28a6a1871374a6be57bf11afbad5047ff833cb7cc58a7e9aa5e7d00d1f0ff2c0443cd45192c023cec099f75e720a664898e88ca684b991c56d97a67638b3aa45b0df209a2e3a64cdfc4f1ad67dacf6de0659b42247e508bfc25e38a45f0dfcb086121cef4c827535737ca766e2156a11b248f40f14517cfcc411cee2402cd1402d67948e8ef3efd93dd07a3399197f894bc67a427d6055ae7c65e11a167f04ede9833c2831a2f029dfa400e79aa0b572740eedbd42d6e3a3b28e95721b37b5312d650cb93a673fcaeac5e4957de61786d5ae86bd1566524a081ac8aac160801849355eb388c8343d661b772ffea40aa77e94f0b6b3b609eb799fbd713ff944d2cc679b037d845ba31eebc347ef42eb78701771d99d1f32d12458578ec39037e9c812eedef05571e94b27a611748ce2aef5a6c5b0de3c81a2e99c2829ec4bdc897f0812c5048bd47de69918a64cbcc229a92720c85ba3f460ee76222bd0592aa62af50de5aa6e2f2c2f503b547ba266f875d8fd13381600309778467392fdf7959fc43e3625fe7d82b8f27d0172e0df5625474eff8598064b322a7fe9d1091fc115323cf5fca57bb2f5d5c2cb030028ffafc3a6d0e26c46c33c68a3bd722d32a0717c6a6647a9752a0770a25ea9b1ac529a017573c63560a2342d5c3045869ad6e8c7c6ebe895b2495db3c74a97255789cba936126b43cbd7a251523a6daafd8cd700565119ed29061de300476f5dd180d3a12f097d2d08a2f6168e7f4f7ab856af3a9d6d5ac5c79d1ed498c9301888bfe6fc638a1412ee7c804f55faf54acb92b13d0f9729ba8bdd09086f46f6ca58f9393f0a798cb9abf1d4b37c74631ce083906bd96000f98dddde39abf2b9cfd6fa6273741785cabe5775ea3fcb579c14332bf45508a92a86ce0e8b2433894a24c5a6906edfd5701dd3e685efcc1c495e8b4c044ea8b4a7e0ec53f1edde2275692cbec5b94e12ecf2fd282a483e7369e33e69c075efc4f281973f382cb58b556d5f72b2aad2fad6386819e0ae73d8dd4ac5d2244d3ced08b3c1f8e2a941125f9c19dbd5b14a2710c7553987926b4a7fbff73f3d1e45002886a1ba4504e0d0e0c63441092ebb5dd2289145e7cdc62c04dab7985a76dd8f3b436ff4401ea947fa3c19d6c884d2cc0e4e90d25c3ab34160162cca8e7af77acac5a4856cc9f4b86789c5d6830976322c370f39ad275a093eba9be5b1b022eb6557ca23a6d7d4cbf2e070ba7933eb4edfeae24ec785d398ca4362dc10681add35a9fad817d4dcf38188600fb4745e1a6f2e12a38b72bd4b2f17e187cf3995009d9e2fc7477465ef481ab8b5f22e43b599524e1b80203e1977f10c92b63b914c252408eb61c1c085e6fbe035ff60392dfb178015ef08e615e363585719d380c09458f15a97e22154b833700d2024d2d5f454e5ec78cb7acb3121b24c17cbaef0a2c3bc2afc52966c737e6fbae60e00b246ecc20a5e02760e038037b0ac6f7665d2fd2f02e7467777d85775b90ecd3d13f0dd779c5171642fe1d124e09db36c687f58ab439aa6d2d898e9e2d501a1e63b464068f6d7a7379fb5f361c52cd423645c3355f339f496b7dbbf8e3c14ba2d4ff3084ee0b225274f84488fab57e78eb1157d08b7e791b6eb208a2a5f409b7d2dcbb12a492e11c926be133a9d1f4c9d19a64d381b12d26988a32950209249c54fab8e72e243bbd882d0ccaa238e522f3d43773187c773d90df071537f06cdc05c0a7d99f32b2c195d991a27d48b070964b4ca260b3922923139a809e8c5f9a8f1de673f764964fe6ab2437f745bc8d87ab5e1a8d6d956edf0345ee0780566dd9ae2a0ebe6733bde2cfa37148ecb7c62f2e95b7c6a4c9e501710b05b1f54c29e299a064abb46c6b1d559461384c3ccfbacfa91e7da7d2fd49132d606f051988f2920f446a10fc1e85cadfab8771765e9356af3e832f58ced783dc000209b929358e8b3f14a689262fc8fff5c6d218b9d1e58302ab39dffa64f65f19bd316024d54b8da371648f26f37961322c930b083e9bea7967eca51b586e5426cdca7433e0e01d1b4342ba776b218ba1887ca63418724ee5794f469e28ef78ac51bae577aa10e2725c6f80c9b0ca451524d64e721aaf5060556b0c707209ae6f92adb49e9227892c76db17df76dc2481a30d9215bf9468f0d2f86ebaf5347846af972a39f7e72cc03fd29f7187064e241f096b397b303beea8c4ca834c0abfb2fe6e78f6902ce0ab3f31b031e29712fd4b90cbddb3effa48f95aef2d1afd78733ab49bed81fb09aab9d4d25c1deb5e57f48c4c53fd77d40ebff8e856c7263cf074a0f2ef5f8e7fc83f3bbb071c77b979d9ae1da6a4e05f3bcef60843777f9f2084c66b6f1043a4609ff4e01648b4ff2b07dbc0b9c9232f5aaeae90bc4736bffe4235559c1735cea5a660e3d4ac27e2311491693cafadbfda7a8bfdad824b767d17b22bcfe04a833f657643ee1670b12f3ecdf0be52bb78b30ddad8ac2862d2e7bb28eff654e75a7304e84c2902edfad20974928e703c8c5cae27f84e68011eb983bc223e7aaa5d502f07342c33223132e8e8604675d2cfb"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r3, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x100010, r0, 0x2) r5 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$F2FS_IOC_COMPRESS_FILE(r5, 0xf518, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x800) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) fchdir(r4) r7 = openat$cgroup_freezer_state(r4, &(0x7f00000002c0), 0x2, 0x0) write$cgroup_freezer_state(r7, &(0x7f00000000c0)='THAWED\x00', 0x7) sendfile(r7, r7, 0x0, 0x8000002) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x80, 0x46, 0x2, 0x8, 0x7}, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="bba40f00010a1003020d0041057500"]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 3.131561986s ago: executing program 2 (id=1039): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x10, 0x7f, 0x20000a2e, 0x0, 0xe, 0x3, 0x2000000, 0x0, 0x3000000}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r3, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0xc4, 0x1, 0x3, 0x301, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFQA_CT={0x14, 0xb, 0x0, 0x1, [@CTA_LABELS_MASK={0x10, 0x17, [0x3, 0x28b, 0x6]}]}, @NFQA_CT={0x44, 0xb, 0x0, 0x1, [@CTA_TUPLE_ORIG={0x40, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @broadcast}}}]}]}, @NFQA_EXP={0x58, 0xf, 0x0, 0x1, [@CTA_EXPECT_NAT={0x54, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x48, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @local}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4004000}, 0x4840) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="240000000202010400000000000000000a000002ff0007400000000008000940fffffff691e15368c64658412829177b5e13c72ec880a376505af6c6850e548e85b3b9c755281cb7000040c64c04bfd336b291224c2f2b4a5a7584c114f90d5f1454725d640c9132f14d02c19552c171648c49dffa6e8cc22b08a38d74dbb77f99efcbd53dd83999a7a723cb0127fba773d12009dbe3a1d2e0f12f3e8997813ee476f3ddd48aa98573ba4dea514073f47f4b5b0e79506c6b1c8045dd78c0c09b18fbf8f976c1e5b23ee4d381bdd95494c622080c9e244fb2de7793a2ff06163c3738438e863998cf71b2c12442e307909fc36375bc1cbb2cf1a47f3034c134df44a332b3c77285d00582277f568ac17e0555f9cd5b60ab08786dc551"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x800) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r9, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100ffffffff"}) sendmmsg(r8, &(0x7f0000000f40)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0xf275, @private2, 0x4000a, 0x23}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='B', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c0071000048049d20922014647f643c6b091a790ab90007d1080fbef3f3"], 0xc}}], 0x2, 0x44055) r10 = syz_open_procfs(0x0, &(0x7f0000000080)='attr\x00') r11 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) fcntl$setstatus(r11, 0x4, 0x2000) getdents64(r10, &(0x7f0000000fc0)=""/224, 0xe0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x0, @fd=r7, 0x73b, &(0x7f0000000500)=[{0x0}], 0x1, 0x0, 0x1}) sendfile(r4, r5, 0x0, 0x201f00) 2.845481632s ago: executing program 3 (id=1040): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001040)='/proc/partitions\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000000)={0x0, 0xfffffffc, 0x100, 0x8000, 0x0, "7a58beca3900000000000000000000000200"}) 1.730887458s ago: executing program 3 (id=1041): r0 = socket$alg(0x26, 0x5, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x24000000) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYRES16, @ANYBLOB="05000000", @ANYBLOB="3d000e0080000000ffffffffffff080211000000ffffffffffff0000feffffffffffffff070001000406f0027f0006a7000c"], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) r1 = add_key$user(&(0x7f00000002c0), &(0x7f0000000440)={'syz', 0x0}, &(0x7f0000000280)="41e4aa3bf146", 0x6, 0xfffffffffffffffe) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="310329bd7000ffffffff0900000008000300", @ANYRES32, @ANYBLOB="0800060002"], 0x24}}, 0x4000) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x120488}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fddbdf04000000000800390007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x874) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, 0x0, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) capget(&(0x7f0000000000)={0x20071026, r2}, &(0x7f00000000c0)={0x192c0, 0x3, 0x3ff, 0xfffffffa, 0xb88, 0x2}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) r3 = dup(0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) ptrace$getregset(0x4204, r2, 0x3, &(0x7f0000000400)={&(0x7f00000003c0)=""/21, 0x15}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='gfs2\x00', 0x10, 0x0) 1.584606304s ago: executing program 5 (id=1042): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) r4 = accept4$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14, 0x80800) getsockopt$packet_buf(r4, 0x107, 0x16, &(0x7f0000000940)=""/4096, &(0x7f0000000500)=0x1000) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) openat$kvm(0xffffffffffffff9c, 0x0, 0x90940, 0x0) mount$binderfs(0x0, &(0x7f00000001c0)='./binderfs\x00', &(0x7f0000000280), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="6d61783d30303030303030303030303030303030303030303030302c00fe9635f8fdbc748b0153822f50901a11d00225841d2806d68c3c74d06686118b0a75455e707100f283224db36fdde7cb89e91f8245ccff6e70c2dc01552a44946d9fa9d02eaa903af4bb9b06ab530623ff69a2d0542c69defeffdb1a51f25d33d08852890c7a4549394874a365748b91e27afd58b5e92a019c1efe40232ccf04321b51d1d09f8ebcbaa85760a954218188b62bcc0711d6f13461c6d1b36e18cf1aff8788b43a99f0f34a5a594f951af1995ceb47caef"]) openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002500)={{}, 0x0, &(0x7f00000024c0)}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r6, @ANYBLOB="200001"], 0x38}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 1.159984731s ago: executing program 4 (id=1043): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, 0x0, &(0x7f00000002c0)) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') pwritev(r5, &(0x7f0000000d40), 0x1000000000000258, 0x4, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r7, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r8, 0x0, 0x0, 0x0, 0x0, 0x37737bd56944c50e}) ioctl$IOMMU_VFIO_IOAS$SET(r7, 0x3b88, &(0x7f0000000140)={0xc, r8}) ioctl$IOMMU_VFIO_SET_IOMMU(r7, 0x3b66, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000ac0)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r9, {0x0, 0xc}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0xbe5b}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x55}, 0xc010) 543.650728ms ago: executing program 2 (id=1044): r0 = socket$alg(0x26, 0x5, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x24000000) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYRES16, @ANYBLOB="05000000", @ANYBLOB="3d000e0080000000ffffffffffff080211000000ffffffffffff0000feffffffffffffff070001000406f0027f0006a7000c"], 0x70}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) r1 = add_key$user(&(0x7f00000002c0), &(0x7f0000000440)={'syz', 0x0}, &(0x7f0000000280)="41e4aa3bf146", 0x6, 0xfffffffffffffffe) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="310329bd7000ffffffff0900000008000300", @ANYRES32, @ANYBLOB="0800060002"], 0x24}}, 0x4000) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x120488}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fddbdf04000000000800390007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x874) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, 0x0, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x22) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) ptrace$getregset(0x4204, r2, 0x3, &(0x7f0000000400)={&(0x7f00000003c0)=""/21, 0x15}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) setreuid(0x0, 0x0) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='gfs2\x00', 0x10, 0x0) 269.71602ms ago: executing program 4 (id=1045): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x1) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @remote}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x802) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0x40405515, &(0x7f00000000c0)={0x9, 0x1, 0x401, 0x5, 'syz0\x00', 0x2}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d658ec87bb53679fd0000078548ceb6c4414fab0919616e19aecedec1b76aea5922406b64cddaeb9d339ba3c01c2c7b8df8e61740b9af2d4d58654a4af0fa0ce1f830cc1eaf991fd00"}, 0xd8) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000180)={'\x00', &(0x7f0000000140)=@ethtool_rxfh_indir={0x38, 0x6, [0x8001, 0x80000001, 0x81, 0x4, 0x7fff, 0x7]}}) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) sendmsg$inet(r6, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') exit(0xf) pread64(r8, &(0x7f0000001400)=""/4108, 0x100c, 0x7) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000780)=ANY=[@ANYBLOB="3000eaff", @ANYRES16=r7, @ANYBLOB="020027bd7000fedbdf2515000000050029000000000008002c00030000000c0006000100000001000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x880) 103.798405ms ago: executing program 1 (id=1046): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 102.024816ms ago: executing program 2 (id=1047): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)='4', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x6, 0x109000) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0xff, 0x3c, 0x1001, 0x0, 0x8, 0x9, 0x2, 0x2}}) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) sched_setaffinity(0x0, 0xc67e7be33bfcd098, &(0x7f0000000180)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x8044) 20.147687ms ago: executing program 1 (id=1048): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x74, 0x10, 0x1, 0x70bd27, 0x25dfdbfd, {0x1a}, [@generic="5d19291e2fedd63633c42d5665f2931df0618109f4eb4439594866c0988a0c2cc6892d49980057ab66b478b78c96745e0c052f53262bbd8e0228d7e547b94575259203c13f730f46249b17939819bae66c7e4ee920a3cdfdf8316b9992"]}, 0x74}, 0x1, 0x0, 0x0, 0x4002}, 0x40000) mkdirat(0xffffffffffffff9c, 0x0, 0x67) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc810) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_SREGS2(r0, 0x8140aecc, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_int(r1, 0x1, 0x5, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='iso9660\x00', 0x21c000, 0x0) 0s ago: executing program 3 (id=1049): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x200}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x7d, &(0x7f00000000c0)={0x0, 0x20000a}, 0x8) sendmsg$nl_xfrm(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r5, 0x0, 0x4048050) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f00000005c0)) socket$nl_route(0x10, 0x3, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) kernel console output (not intermixed with test programs): g interface batadv_slave_1 (retrying later): interface not active [ 280.119937][ T6640] usb 5-1: Using ep0 maxpacket: 32 [ 280.385633][ T8524] binder: Unknown parameter 'stat' [ 280.407158][ T8522] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 280.421464][ T6640] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 280.429592][ T6640] usb 5-1: config 0 has no interface number 0 [ 280.441486][ T6640] usb 5-1: config 0 interface 89 has no altsetting 0 [ 280.499253][ T6640] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 280.536064][ T6640] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.549410][ T6640] usb 5-1: Product: syz [ 280.585929][ T5858] usb 2-1: USB disconnect, device number 28 [ 280.619428][ T6640] usb 5-1: Manufacturer: syz [ 280.627909][ T6640] usb 5-1: SerialNumber: syz [ 280.642212][ T30] audit: type=1400 audit(1771124586.282:449): avc: denied { create } for pid=8525 comm="syz.3.622" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 280.666876][ T8475] hsr_slave_0: entered promiscuous mode [ 280.667098][ T6640] usb 5-1: config 0 descriptor?? [ 280.678807][ T8475] hsr_slave_1: entered promiscuous mode [ 280.688577][ T8475] debugfs: 'hsr0' already exists in 'hsr' [ 280.699900][ T30] audit: type=1400 audit(1771124586.282:450): avc: denied { unlink } for pid=8525 comm="syz.3.622" name="file0" dev="ramfs" ino=19718 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 280.722382][ T8475] Cannot create hsr debugfs directory [ 280.731438][ T6640] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 280.741350][ T6640] em28xx 5-1:0.89: Video interface 89 found: bulk [ 280.890635][ T29] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 280.939596][ T8475] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 280.953759][ T8475] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 280.974085][ T8475] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 280.983972][ T8475] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 281.001611][ T5858] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 281.044367][ T29] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 281.063689][ T29] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 281.085815][ T29] usb 4-1: can't read configurations, error -22 [ 281.143529][ T8475] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.164661][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.176250][ T5858] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 281.188127][ T8475] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.196319][ T5858] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.209174][ T1037] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.216352][ T1037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.226323][ T5858] usb 2-1: config 0 descriptor?? [ 281.230614][ T29] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 281.244439][ T1037] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.251593][ T1037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.308878][ T8475] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 281.334706][ T6640] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 281.402024][ T29] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 281.421192][ T29] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 281.439894][ T29] usb 4-1: can't read configurations, error -22 [ 281.448187][ T29] usb usb4-port1: attempt power cycle [ 281.460923][ T5806] Bluetooth: hci5: command tx timeout [ 281.527438][ T8475] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.645698][ T5858] keytouch 0003:0926:3333.0011: fixing up Keytouch IEC report descriptor [ 281.671816][ T5858] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0011/input/input37 [ 281.756266][ T6640] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 281.768711][ T6640] em28xx 5-1:0.89: board has no eeprom [ 281.818741][ T5858] keytouch 0003:0926:3333.0011: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 281.820526][ T29] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 281.847151][ T6640] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 281.870647][ T6640] em28xx 5-1:0.89: analog set to bulk mode. [ 281.878655][ T6054] em28xx 5-1:0.89: Registering V4L2 extension [ 281.897927][ T8475] veth0_vlan: entered promiscuous mode [ 281.906087][ T29] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 281.920717][ T6640] usb 5-1: USB disconnect, device number 27 [ 281.927661][ T6640] em28xx 5-1:0.89: Disconnecting em28xx [ 281.944492][ T29] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 281.962404][ T29] usb 4-1: can't read configurations, error -22 [ 281.975122][ T8475] veth1_vlan: entered promiscuous mode [ 281.997575][ T6054] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 282.013658][ T6054] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 282.031266][ T6054] em28xx 5-1:0.89: No AC97 audio processor [ 282.044749][ T8475] veth0_macvtap: entered promiscuous mode [ 282.045274][ T6054] usb 5-1: Decoder not found [ 282.055471][ T6054] em28xx 5-1:0.89: failed to create media graph [ 282.064383][ T6054] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 282.075855][ T8475] veth1_macvtap: entered promiscuous mode [ 282.093076][ T6054] em28xx 5-1:0.89: Registering snapshot button... [ 282.108050][ T8475] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.118191][ T6054] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input38 [ 282.118813][ T5858] usb 2-1: USB disconnect, device number 29 [ 282.129630][ T29] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 282.148072][ T8475] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.167936][ T1037] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.176985][ T1037] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.193727][ T29] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 282.202403][ T1037] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.213312][ T6054] em28xx 5-1:0.89: Remote control support is not available for this card. [ 282.224948][ T6640] em28xx 5-1:0.89: Closing input extension [ 282.231712][ T29] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 282.240407][ T6640] em28xx 5-1:0.89: Deregistering snapshot button [ 282.251716][ T29] usb 4-1: can't read configurations, error -22 [ 282.277253][ T29] usb usb4-port1: unable to enumerate USB device [ 282.278039][ T103] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.322748][ T6640] em28xx 5-1:0.89: Freeing device [ 282.707122][ T1153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.730579][ T1153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.834930][ T103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.909152][ T103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.987493][ T30] audit: type=1400 audit(1771124588.622:451): avc: denied { mounton } for pid=8475 comm="syz-executor" path="/root/syzkaller.iWGGXd/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 283.059439][ T30] audit: type=1400 audit(1771124588.662:452): avc: denied { mounton } for pid=8475 comm="syz-executor" path="/root/syzkaller.iWGGXd/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 283.152739][ T30] audit: type=1400 audit(1771124588.682:453): avc: denied { mounton } for pid=8475 comm="syz-executor" path="/root/syzkaller.iWGGXd/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=20250 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 283.217113][ T30] audit: type=1400 audit(1771124588.702:454): avc: denied { mounton } for pid=8475 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 283.540741][ T5806] Bluetooth: hci5: command tx timeout [ 285.120523][ T6640] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 285.280487][ T6640] usb 4-1: Using ep0 maxpacket: 16 [ 285.287690][ T6640] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 285.310819][ T6640] usb 4-1: config 0 interface 0 has no altsetting 0 [ 285.317501][ T6640] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 285.345023][ T6640] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.431006][ T6640] usb 4-1: config 0 descriptor?? [ 285.620529][ T5806] Bluetooth: hci5: command tx timeout [ 285.908506][ T8584] netlink: 32 bytes leftover after parsing attributes in process `syz.2.631'. [ 285.942007][ T6054] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 286.380518][ T6054] usb 5-1: Using ep0 maxpacket: 32 [ 286.388438][ T6054] usb 5-1: config 0 has an invalid interface number: 26 but max is 0 [ 286.407044][ T6054] usb 5-1: config 0 has no interface number 0 [ 286.419812][ T6054] usb 5-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=3b.e2 [ 286.429377][ T6054] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.442054][ T6054] usb 5-1: Product: syz [ 286.446311][ T6054] usb 5-1: Manufacturer: syz [ 286.451688][ T6054] usb 5-1: SerialNumber: syz [ 286.469609][ T6054] usb 5-1: config 0 descriptor?? [ 286.747533][ T8579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.780863][ T8579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.805922][ T8579] FAULT_INJECTION: forcing a failure. [ 286.805922][ T8579] name failslab, interval 1, probability 0, space 0, times 0 [ 286.836455][ T8579] CPU: 0 UID: 0 PID: 8579 Comm: syz.4.630 Tainted: G L syzkaller #0 PREEMPT(full) [ 286.836484][ T8579] Tainted: [L]=SOFTLOCKUP [ 286.836489][ T8579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 286.836498][ T8579] Call Trace: [ 286.836504][ T8579] [ 286.836510][ T8579] dump_stack_lvl+0x100/0x190 [ 286.836533][ T8579] should_fail_ex.cold+0x5/0xa [ 286.836549][ T8579] should_failslab+0xc2/0x120 [ 286.836565][ T8579] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 286.836585][ T8579] ? __alloc_skb+0x140/0x710 [ 286.836607][ T8579] __alloc_skb+0x140/0x710 [ 286.836622][ T8579] ? __alloc_skb+0x5b7/0x710 [ 286.836638][ T8579] ? __pfx___alloc_skb+0x10/0x10 [ 286.836659][ T8579] alloc_skb_with_frags+0xe0/0x810 [ 286.836679][ T8579] sock_alloc_send_pskb+0x801/0x980 [ 286.836690][ T8579] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 286.836708][ T8579] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 286.836721][ T8579] ? find_held_lock+0x2b/0x80 [ 286.836740][ T8579] ? dev_get_by_index+0x180/0x380 [ 286.836757][ T8579] ? dev_get_by_index+0x180/0x380 [ 286.836780][ T8579] packet_sendmsg+0x20e0/0x53c0 [ 286.836805][ T8579] ? avc_has_perm+0x80/0x1e0 [ 286.836819][ T8579] ? __lock_acquire+0x4a5/0x2630 [ 286.836839][ T8579] ? sock_has_perm+0x258/0x2f0 [ 286.836852][ T8579] ? __pfx_sock_has_perm+0x10/0x10 [ 286.836871][ T8579] ? __pfx_packet_sendmsg+0x10/0x10 [ 286.836909][ T8579] ____sys_sendmsg+0xa54/0xc30 [ 286.836934][ T8579] ? __pfx_____sys_sendmsg+0x10/0x10 [ 286.836955][ T8579] ? __pfx__kstrtoull+0x10/0x10 [ 286.836973][ T8579] ___sys_sendmsg+0x190/0x1e0 [ 286.836991][ T8579] ? __pfx____sys_sendmsg+0x10/0x10 [ 286.837021][ T8579] ? find_held_lock+0x2b/0x80 [ 286.837055][ T8579] __sys_sendmmsg+0x205/0x430 [ 286.837075][ T8579] ? __pfx___sys_sendmmsg+0x10/0x10 [ 286.837095][ T8579] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 286.837116][ T8579] ? fput+0x79/0x100 [ 286.837126][ T8579] ? ksys_write+0x1ac/0x250 [ 286.837141][ T8579] ? __pfx_ksys_write+0x10/0x10 [ 286.837165][ T8579] __x64_sys_sendmmsg+0x9c/0x100 [ 286.837183][ T8579] ? lockdep_hardirqs_on+0x78/0x100 [ 286.837202][ T8579] do_syscall_64+0x106/0xf80 [ 286.837220][ T8579] ? clear_bhb_loop+0x40/0x90 [ 286.837237][ T8579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.837249][ T8579] RIP: 0033:0x7f442259bf79 [ 286.837259][ T8579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.837269][ T8579] RSP: 002b:00007f44207f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 286.837281][ T8579] RAX: ffffffffffffffda RBX: 00007f4422815fa0 RCX: 00007f442259bf79 [ 286.837288][ T8579] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000011 [ 286.837297][ T8579] RBP: 00007f44207f6090 R08: 0000000000000000 R09: 0000000000000000 [ 286.837306][ T8579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.837316][ T8579] R13: 00007f4422816038 R14: 00007f4422815fa0 R15: 00007ffcd629fa58 [ 286.837338][ T8579] [ 287.105212][ T6054] int51x1 5-1:0.26: probe with driver int51x1 failed with error -71 [ 287.183787][ T8592] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 287.211087][ T8596] binder: Unknown parameter 'stat' [ 287.418850][ T6054] usb 5-1: USB disconnect, device number 28 [ 287.560173][ T6640] usbhid 4-1:0.0: can't add hid device: -71 [ 287.566296][ T6640] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 287.586098][ T8602] netlink: 244 bytes leftover after parsing attributes in process `syz.5.637'. [ 287.598216][ T6640] usb 4-1: USB disconnect, device number 19 [ 287.724355][ T30] audit: type=1400 audit(1771124593.342:455): avc: denied { nlmsg_read } for pid=8601 comm="syz.3.638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 288.042164][ T8612] netlink: 32 bytes leftover after parsing attributes in process `syz.3.640'. [ 288.449441][ T8613] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.639'. [ 288.500698][ T8605] nvme_fabrics: missing parameter 'transport=%s' [ 288.507452][ T8605] nvme_fabrics: missing parameter 'nqn=%s' [ 290.087257][ T8630] netlink: 32 bytes leftover after parsing attributes in process `syz.5.646'. [ 291.041188][ T792] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 291.270703][ T792] usb 4-1: Using ep0 maxpacket: 32 [ 291.277355][ T792] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 291.298369][ T8642] netlink: 4 bytes leftover after parsing attributes in process `syz.4.650'. [ 291.311473][ T8642] netlink: 12 bytes leftover after parsing attributes in process `syz.4.650'. [ 291.332056][ T8642] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 291.475065][ T792] usb 4-1: config 0 has no interface number 0 [ 291.481890][ T792] usb 4-1: config 0 interface 89 has no altsetting 0 [ 291.541215][ T792] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 291.558156][ T792] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.586166][ T792] usb 4-1: Product: syz [ 291.595584][ T792] usb 4-1: Manufacturer: syz [ 291.604400][ T792] usb 4-1: SerialNumber: syz [ 291.610508][ T5912] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 291.626963][ T792] usb 4-1: config 0 descriptor?? [ 291.643484][ T792] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 291.663437][ T792] em28xx 4-1:0.89: Video interface 89 found: bulk [ 291.792131][ T5912] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 291.806515][ T5912] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 291.833445][ T5912] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 291.866388][ T5912] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 291.880507][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.906729][ T5912] usb 6-1: Product: syz [ 291.911076][ T5912] usb 6-1: Manufacturer: syz [ 291.917223][ T5912] usb 6-1: SerialNumber: syz [ 291.930320][ T5912] hub 6-1:1.0: bad descriptor, ignoring hub [ 291.940246][ T5912] hub 6-1:1.0: probe with driver hub failed with error -5 [ 292.130578][ T6640] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 292.141723][ T5912] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 292.249347][ T792] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 292.280479][ T6640] usb 2-1: Using ep0 maxpacket: 16 [ 292.287018][ T6640] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 292.298397][ T6640] usb 2-1: config 0 interface 0 has no altsetting 0 [ 292.305541][ T6640] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 292.324828][ T6640] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.364618][ T6640] usb 2-1: config 0 descriptor?? [ 292.445987][ T8655] comedi comedi1: Minor 3 could not be opened [ 292.470955][ T5913] usb 6-1: USB disconnect, device number 2 [ 292.484597][ T5913] usblp0: removed [ 292.665475][ T792] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 292.680291][ T792] em28xx 4-1:0.89: board has no eeprom [ 292.765076][ T792] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 292.774852][ T792] em28xx 4-1:0.89: analog set to bulk mode. [ 292.788230][ T5912] em28xx 4-1:0.89: Registering V4L2 extension [ 292.799360][ T792] usb 4-1: USB disconnect, device number 20 [ 292.977883][ T8661] binder: Unknown parameter 'stat' [ 293.040087][ T5912] em28xx 4-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 293.088265][ T8659] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 293.210098][ T5912] em28xx 4-1:0.89: reading from i2c device at 0x48 failed (error=-19) [ 293.219755][ T792] em28xx 4-1:0.89: Disconnecting em28xx [ 293.251408][ T5912] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 293.265359][ T5912] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 293.292081][ T5912] em28xx 4-1:0.89: No AC97 audio processor [ 293.302010][ T5912] usb 4-1: Decoder not found [ 293.306692][ T5912] em28xx 4-1:0.89: failed to create media graph [ 293.315243][ T5912] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 293.324380][ T5912] em28xx 4-1:0.89: Registering snapshot button... [ 293.357630][ T5912] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input39 [ 293.401128][ T5912] em28xx 4-1:0.89: Remote control support is not available for this card. [ 293.434087][ T792] em28xx 4-1:0.89: Closing input extension [ 293.447640][ T792] em28xx 4-1:0.89: Deregistering snapshot button [ 293.581205][ T792] em28xx 4-1:0.89: Freeing device [ 293.623539][ T30] audit: type=1400 audit(1771124599.272:456): avc: denied { map } for pid=8668 comm="syz.5.656" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 293.666023][ T30] audit: type=1400 audit(1771124599.272:457): avc: denied { execute } for pid=8668 comm="syz.5.656" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 293.666450][ T8672] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 293.813589][ T8680] netlink: 244 bytes leftover after parsing attributes in process `syz.3.657'. [ 294.332817][ T8686] netlink: 32 bytes leftover after parsing attributes in process `syz.4.659'. [ 294.907611][ T6640] usbhid 2-1:0.0: can't add hid device: -71 [ 294.919164][ T6640] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 294.970645][ T6640] usb 2-1: USB disconnect, device number 30 [ 295.667199][ T8704] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 295.788414][ T8702] netlink: 84 bytes leftover after parsing attributes in process `syz.5.661'. [ 296.275547][ T8714] FAULT_INJECTION: forcing a failure. [ 296.275547][ T8714] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 296.289168][ T8714] CPU: 0 UID: 0 PID: 8714 Comm: syz.3.667 Tainted: G L syzkaller #0 PREEMPT(full) [ 296.289196][ T8714] Tainted: [L]=SOFTLOCKUP [ 296.289202][ T8714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 296.289212][ T8714] Call Trace: [ 296.289218][ T8714] [ 296.289224][ T8714] dump_stack_lvl+0x100/0x190 [ 296.289284][ T8714] should_fail_ex.cold+0x5/0xa [ 296.289307][ T8714] _copy_from_user+0x2e/0xd0 [ 296.289327][ T8714] video_usercopy+0xe71/0x1740 [ 296.289351][ T8714] ? __pfx___video_do_ioctl+0x10/0x10 [ 296.289372][ T8714] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 296.289401][ T8714] ? __pfx_video_usercopy+0x10/0x10 [ 296.289438][ T8714] v4l2_ioctl+0x1bd/0x250 [ 296.289459][ T8714] ? __pfx_v4l2_ioctl+0x10/0x10 [ 296.289482][ T8714] __x64_sys_ioctl+0x18e/0x210 [ 296.289507][ T8714] do_syscall_64+0x106/0xf80 [ 296.289528][ T8714] ? clear_bhb_loop+0x40/0x90 [ 296.289550][ T8714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.289568][ T8714] RIP: 0033:0x7f796b79bf79 [ 296.289584][ T8714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.289600][ T8714] RSP: 002b:00007f796c5aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 296.289619][ T8714] RAX: ffffffffffffffda RBX: 00007f796ba15fa0 RCX: 00007f796b79bf79 [ 296.289630][ T8714] RDX: 0000200000000080 RSI: 00000000c058565d RDI: 0000000000000003 [ 296.289640][ T8714] RBP: 00007f796c5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 296.289651][ T8714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.289661][ T8714] R13: 00007f796ba16038 R14: 00007f796ba15fa0 R15: 00007ffe60c42548 [ 296.289685][ T8714] [ 296.520559][ T5912] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 296.870531][ T5912] usb 5-1: Using ep0 maxpacket: 16 [ 296.881012][ T5912] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 296.890906][ T5912] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 296.901696][ T5912] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.934173][ T5912] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 297.487156][ T5912] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 297.501794][ T5912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.521074][ T5912] usb 5-1: Product: syz [ 297.530977][ T5912] usb 5-1: Manufacturer: syz [ 297.536687][ T5912] usb 5-1: SerialNumber: syz [ 297.592462][ T6054] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 297.642788][ T5912] usb 5-1: config 0 descriptor?? [ 297.668083][ T5912] mcba_usb 5-1:0.0 can0: couldn't setup read URBs [ 297.678350][ T5912] mcba_usb 5-1:0.0 can0: couldn't start device: -90 [ 297.820492][ T6054] usb 3-1: Using ep0 maxpacket: 32 [ 297.943528][ T6054] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 297.966365][ T6054] usb 3-1: config 0 has no interface number 0 [ 297.987402][ T6054] usb 3-1: config 0 interface 89 has no altsetting 0 [ 297.996438][ T5912] mcba_usb 5-1:0.0: probe with driver mcba_usb failed with error -90 [ 298.015561][ T6054] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 298.456111][ T8729] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 298.463878][ T8729] audit: out of memory in audit_log_start [ 298.930620][ T6054] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.939465][ T30] audit: type=1400 audit(1771124604.582:458): avc: denied { read } for pid=5472 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 298.960676][ T6054] usb 3-1: Product: syz [ 298.964999][ T6054] usb 3-1: Manufacturer: syz [ 298.969712][ T6054] usb 3-1: SerialNumber: syz [ 298.976073][ T6054] usb 3-1: config 0 descriptor?? [ 298.987318][ T6054] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 298.996866][ T6054] em28xx 3-1:0.89: Video interface 89 found: bulk [ 299.119187][ T5912] usb 5-1: USB disconnect, device number 29 [ 299.468030][ T8737] netlink: 32 bytes leftover after parsing attributes in process `syz.5.674'. [ 299.593643][ T6054] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 299.840558][ T5912] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 299.973819][ T8741] netlink: 8 bytes leftover after parsing attributes in process `syz.1.672'. [ 300.147979][ T5912] usb 5-1: Using ep0 maxpacket: 16 [ 300.157291][ T5912] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.168619][ T5912] usb 5-1: config 0 interface 0 has no altsetting 0 [ 300.175362][ T5912] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 300.184541][ T5912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.534623][ T6054] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 300.543290][ T6054] em28xx 3-1:0.89: board has no eeprom [ 300.543770][ T5912] usb 5-1: config 0 descriptor?? [ 300.600504][ T6054] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 300.670967][ T6054] em28xx 3-1:0.89: analog set to bulk mode. [ 300.677086][ T5913] em28xx 3-1:0.89: Registering V4L2 extension [ 300.688029][ T6054] usb 3-1: USB disconnect, device number 23 [ 300.709271][ T6054] em28xx 3-1:0.89: Disconnecting em28xx [ 301.203731][ T5913] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 301.226373][ T5913] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 301.247359][ T5913] em28xx 3-1:0.89: No AC97 audio processor [ 301.265857][ T5913] usb 3-1: Decoder not found [ 301.275567][ T5913] em28xx 3-1:0.89: failed to create media graph [ 301.287397][ T8754] netlink: 244 bytes leftover after parsing attributes in process `syz.1.676'. [ 301.296662][ T5913] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 301.337263][ T5913] em28xx 3-1:0.89: Registering snapshot button... [ 301.371556][ T5913] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input40 [ 301.589019][ T5913] em28xx 3-1:0.89: Remote control support is not available for this card. [ 301.640141][ T6054] em28xx 3-1:0.89: Closing input extension [ 301.656383][ T6054] em28xx 3-1:0.89: Deregistering snapshot button [ 301.708800][ T6054] em28xx 3-1:0.89: Freeing device [ 303.569539][ T5912] usbhid 5-1:0.0: can't add hid device: -71 [ 303.587317][ T5912] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 303.760767][ T5912] usb 5-1: USB disconnect, device number 30 [ 303.870543][ T8791] netlink: 32 bytes leftover after parsing attributes in process `syz.1.687'. [ 304.881885][ T5912] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 305.053191][ T5912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.065584][ T5912] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 305.075202][ T5912] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.104633][ T5912] usb 2-1: config 0 descriptor?? [ 305.270496][ T6054] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 305.290621][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 305.450711][ T6054] usb 3-1: Using ep0 maxpacket: 32 [ 305.452781][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 305.462711][ T6054] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 305.463435][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 305.471280][ T6054] usb 3-1: config 0 has no interface number 0 [ 305.485290][ T6054] usb 3-1: config 0 interface 89 has no altsetting 0 [ 305.493163][ T10] usb 4-1: config 0 has no interface number 0 [ 305.499484][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.511473][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.511669][ T6054] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 305.530825][ T6054] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.531257][ T10] usb 4-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 305.548327][ T6054] usb 3-1: Product: syz [ 305.552625][ T6054] usb 3-1: Manufacturer: syz [ 305.557192][ T6054] usb 3-1: SerialNumber: syz [ 305.564539][ T5912] keytouch 0003:0926:3333.0012: fixing up Keytouch IEC report descriptor [ 305.575660][ T6054] usb 3-1: config 0 descriptor?? [ 305.577168][ T5912] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0012/input/input41 [ 305.592974][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.606122][ T6054] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 305.616337][ T6054] em28xx 3-1:0.89: Video interface 89 found: bulk [ 305.636532][ T10] usb 4-1: config 0 descriptor?? [ 305.729001][ T5912] keytouch 0003:0926:3333.0012: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 305.998053][ T10] usbhid 4-1:0.1: can't add hid device: -71 [ 306.004234][ T10] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 306.040657][ T5912] usb 2-1: USB disconnect, device number 31 [ 306.055289][ T10] usb 4-1: USB disconnect, device number 21 [ 306.076722][ T8815] comedi comedi3: das16m1: a I/O base address must be specified [ 306.130634][ T8810] fido_id[8810]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 306.208984][ T6054] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 306.220495][ T8816] nbd1: detected capacity change from 0 to 63 [ 306.380510][ T30] audit: type=1400 audit(1771124611.882:459): avc: denied { write } for pid=8814 comm="syz.3.693" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 306.412040][ T30] audit: type=1400 audit(1771124611.882:460): avc: denied { open } for pid=8814 comm="syz.3.693" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 306.442374][ T30] audit: type=1400 audit(1771124611.882:461): avc: denied { ioctl } for pid=8814 comm="syz.3.693" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 307.279753][ T5806] block nbd1: Receive control failed (result -104) [ 307.519455][ T6054] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 307.527643][ T6054] em28xx 3-1:0.89: board has no eeprom [ 307.590923][ T6054] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 307.629507][ T6054] em28xx 3-1:0.89: analog set to bulk mode. [ 307.675095][ T29] em28xx 3-1:0.89: Registering V4L2 extension [ 307.703864][ T6020] block nbd0: Possible stuck request ffff8880279c8000: control (read@0,1024B). Runtime 150 seconds [ 307.719568][ T6020] block nbd0: Possible stuck request ffff8880279c8200: control (read@1024,1024B). Runtime 150 seconds [ 307.730618][ T6020] block nbd0: Possible stuck request ffff8880279c8400: control (read@2048,1024B). Runtime 150 seconds [ 307.744063][ T6020] block nbd0: Possible stuck request ffff8880279c8600: control (read@3072,1024B). Runtime 150 seconds [ 307.770140][ T6054] usb 3-1: USB disconnect, device number 24 [ 307.795466][ T6054] em28xx 3-1:0.89: Disconnecting em28xx [ 307.836868][ T29] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 307.844455][ T29] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 307.851901][ T29] em28xx 3-1:0.89: No AC97 audio processor [ 307.859343][ T29] usb 3-1: Decoder not found [ 307.957683][ T29] em28xx 3-1:0.89: failed to create media graph [ 307.964410][ T29] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 307.972340][ T29] em28xx 3-1:0.89: Registering snapshot button... [ 307.980144][ T29] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input42 [ 307.994351][ T29] em28xx 3-1:0.89: Remote control support is not available for this card. [ 308.028507][ T6054] em28xx 3-1:0.89: Closing input extension [ 308.043692][ T6054] em28xx 3-1:0.89: Deregistering snapshot button [ 308.105936][ T8845] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 308.140581][ T5913] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 308.476040][ T6054] em28xx 3-1:0.89: Freeing device [ 308.591973][ T5913] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 308.607256][ T8852] netlink: 244 bytes leftover after parsing attributes in process `syz.2.700'. [ 308.616660][ T5913] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 308.635767][ T5913] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 308.721321][ T10] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 308.722906][ T5913] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 308.740540][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.760216][ T5913] usb 5-1: Product: syz [ 308.767488][ T5913] usb 5-1: Manufacturer: syz [ 308.775051][ T5913] usb 5-1: SerialNumber: syz [ 308.788215][ T5913] hub 5-1:1.0: bad descriptor, ignoring hub [ 308.798707][ T5913] hub 5-1:1.0: probe with driver hub failed with error -5 [ 308.930607][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 308.937567][ T10] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 308.946364][ T10] usb 6-1: config 0 has no interface number 0 [ 308.952871][ T10] usb 6-1: config 0 interface 89 has no altsetting 0 [ 309.028325][ T8856] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 309.412423][ T5913] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 31 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 309.534175][ T10] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 309.663928][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.691448][ T10] usb 6-1: Product: syz [ 309.695805][ T10] usb 6-1: Manufacturer: syz [ 309.701269][ T10] usb 6-1: SerialNumber: syz [ 309.766509][ T8843] comedi comedi1: Minor 3 could not be opened [ 309.774009][ T10] usb 6-1: config 0 descriptor?? [ 309.829644][ T10] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 309.840961][ T5913] usb 5-1: USB disconnect, device number 31 [ 310.268742][ T5913] usblp0: removed [ 310.273966][ T10] em28xx 6-1:0.89: Video interface 89 found: bulk [ 310.516190][ T30] audit: type=1400 audit(1771124616.162:462): avc: denied { map } for pid=8864 comm="syz.4.704" path="socket:[21685]" dev="sockfs" ino=21685 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 310.604319][ T30] audit: type=1400 audit(1771124616.252:463): avc: denied { read accept } for pid=8864 comm="syz.4.704" path="socket:[21685]" dev="sockfs" ino=21685 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 310.705842][ T10] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 310.890526][ T30] audit: type=1400 audit(1771124616.362:464): avc: denied { setopt } for pid=8864 comm="syz.4.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 310.998015][ T792] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 311.180598][ T792] usb 5-1: Using ep0 maxpacket: 16 [ 311.195036][ T10] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 311.203647][ T5882] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 311.274680][ T792] usb 5-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 311.322081][ T10] em28xx 6-1:0.89: board has no eeprom [ 311.841272][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.847611][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 311.922666][ T792] usb 5-1: config 1 interface 0 has no altsetting 0 [ 311.931231][ T792] usb 5-1: New USB device found, idVendor=056a, idProduct=00ba, bcdDevice= 0.40 [ 311.940821][ T792] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.957166][ T5882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 311.970621][ T792] usb 5-1: Product: ఇ [ 311.974796][ T792] usb 5-1: Manufacturer: 譄蛜펆頜⢬櫣昖쩍綉뭲❹ꚓ⥝闘恪簕谆∕殙颖牓段⌳Ჹ쀫鈀傧䅮螇⩙鞱疓 [ 311.990169][ T5882] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 312.167608][ T8873] gfs2: not a GFS2 filesystem [ 312.191082][ T10] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 312.201125][ T5882] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 312.218172][ T10] em28xx 6-1:0.89: analog set to bulk mode. [ 312.224938][ T792] usb 5-1: SerialNumber: ឍ晧忭퉘늛ⶏ㐖ᠹ⁺⇟큉꣺狗窹䗎㉅啬枽뇩㪀ꆂ묿䤠稚笎Ẑ艼䁬錰萊㕿뽥寝ନ韴ꖣ㸉㸱➻켌婚㴍ᓎ⩽〬踖픶졳ᡄ髯춫㸞笎୅℞諅倻᠚ꟓꔟ蝛倾︱췜ࡌ혿ᔅ鯳杦嘋輛ࢅ닣塤ꨜ邪ꪐ編 [ 312.252708][ T5882] usb 2-1: config 0 descriptor?? [ 312.265269][ T5912] em28xx 6-1:0.89: Registering V4L2 extension [ 312.280531][ T10] usb 6-1: USB disconnect, device number 3 [ 312.322228][ T10] em28xx 6-1:0.89: Disconnecting em28xx [ 312.611782][ T5912] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 312.620513][ T5912] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 312.627620][ T5912] em28xx 6-1:0.89: No AC97 audio processor [ 312.636085][ T5912] usb 6-1: Decoder not found [ 312.640759][ T5912] em28xx 6-1:0.89: failed to create media graph [ 312.647245][ T5912] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 312.667804][ T5912] em28xx 6-1:0.89: Registering snapshot button... [ 312.771609][ T5912] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input43 [ 312.963352][ T5912] em28xx 6-1:0.89: Remote control support is not available for this card. [ 312.975702][ T5882] keytouch 0003:0926:3333.0013: fixing up Keytouch IEC report descriptor [ 312.984447][ T10] em28xx 6-1:0.89: Closing input extension [ 312.990251][ T10] em28xx 6-1:0.89: Deregistering snapshot button [ 313.001129][ T5882] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0013/input/input44 [ 313.113692][ T10] em28xx 6-1:0.89: Freeing device [ 313.129055][ T5882] keytouch 0003:0926:3333.0013: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 313.308329][ T30] audit: type=1400 audit(1771124618.882:465): avc: denied { bind } for pid=8883 comm="syz.5.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 313.455753][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.466385][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.481057][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.487849][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.494279][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.497876][ T30] audit: type=1400 audit(1771124618.952:466): avc: denied { getopt } for pid=8864 comm="syz.4.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 313.500742][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.500756][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.502350][ C0] keyboard: can't emulate rawmode for keycode 240 [ 313.629517][ T792] usbhid 5-1:1.0: can't add hid device: -71 [ 313.677331][ T792] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 313.729332][ T792] usb 5-1: USB disconnect, device number 32 [ 313.767093][ T5912] usb 2-1: USB disconnect, device number 32 [ 314.544965][ T8908] netlink: 32 bytes leftover after parsing attributes in process `syz.4.714'. [ 314.920666][ T8909] netlink: 244 bytes leftover after parsing attributes in process `syz.3.715'. [ 315.192784][ T29] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 315.337187][ T8912] gfs2: not a GFS2 filesystem [ 315.345436][ T29] usb 2-1: device descriptor read/64, error -71 [ 316.570496][ T29] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 317.162127][ T8930] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 317.462611][ T29] usb 2-1: device descriptor read/64, error -71 [ 317.569585][ T8938] netlink: 32 bytes leftover after parsing attributes in process `syz.4.722'. [ 317.887481][ T29] usb usb2-port1: attempt power cycle [ 319.012205][ T8953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.727'. [ 319.301234][ T10] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 319.467903][ T8960] netlink: 244 bytes leftover after parsing attributes in process `syz.3.729'. [ 319.537518][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 319.634271][ T10] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 319.668756][ T10] usb 5-1: config 0 has no interface number 0 [ 319.676549][ T10] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 319.693813][ T10] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 320.512089][ T10] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 320.607209][ T10] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 320.674233][ T10] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 320.729064][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.749398][ T10] usb 5-1: config 0 descriptor?? [ 320.782998][ T10] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 321.962543][ T792] usb 5-1: USB disconnect, device number 33 [ 322.001054][ T792] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 322.087226][ T8994] netlink: 16 bytes leftover after parsing attributes in process `syz.3.734'. [ 322.104292][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 322.104311][ T30] audit: type=1400 audit(1771124627.722:467): avc: denied { connect } for pid=8993 comm="syz.4.740" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 322.400103][ T30] audit: type=1400 audit(1771124627.792:468): avc: denied { name_connect } for pid=8981 comm="syz.3.734" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 322.500979][ T9004] FAULT_INJECTION: forcing a failure. [ 322.500979][ T9004] name failslab, interval 1, probability 0, space 0, times 0 [ 322.514291][ T9004] CPU: 0 UID: 0 PID: 9004 Comm: syz.4.741 Tainted: G L syzkaller #0 PREEMPT(full) [ 322.514317][ T9004] Tainted: [L]=SOFTLOCKUP [ 322.514321][ T9004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 322.514328][ T9004] Call Trace: [ 322.514331][ T9004] [ 322.514336][ T9004] dump_stack_lvl+0x100/0x190 [ 322.514357][ T9004] should_fail_ex.cold+0x5/0xa [ 322.514378][ T9004] should_failslab+0xc2/0x120 [ 322.514403][ T9004] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 322.514424][ T9004] ? alloc_empty_file+0x55/0x1c0 [ 322.514442][ T9004] ? __pfx_stack_trace_save+0x10/0x10 [ 322.514467][ T9004] alloc_empty_file+0x55/0x1c0 [ 322.514486][ T9004] path_openat+0xe8/0x31a0 [ 322.514509][ T9004] ? kasan_save_stack+0x3f/0x50 [ 322.514526][ T9004] ? kasan_save_stack+0x30/0x50 [ 322.514539][ T9004] ? kasan_save_track+0x14/0x30 [ 322.514552][ T9004] ? __kasan_slab_alloc+0x89/0x90 [ 322.514567][ T9004] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 322.514579][ T9004] ? do_getname+0x35/0x390 [ 322.514590][ T9004] ? do_sys_openat2+0xc5/0x1e0 [ 322.514601][ T9004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.514614][ T9004] ? __pfx_path_openat+0x10/0x10 [ 322.514636][ T9004] do_file_open+0x20e/0x430 [ 322.514654][ T9004] ? __pfx_do_file_open+0x10/0x10 [ 322.514680][ T9004] ? alloc_fd+0x476/0x790 [ 322.514699][ T9004] ? do_getname+0x191/0x390 [ 322.514712][ T9004] do_sys_openat2+0x10d/0x1e0 [ 322.514723][ T9004] ? __pfx_do_sys_openat2+0x10/0x10 [ 322.514734][ T9004] ? preempt_schedule_irq+0x7b/0x90 [ 322.514749][ T9004] ? irqentry_exit+0x180/0x670 [ 322.514762][ T9004] ? lockdep_hardirqs_on+0x78/0x100 [ 322.514777][ T9004] __x64_sys_openat+0x12d/0x210 [ 322.514789][ T9004] ? __pfx___x64_sys_openat+0x10/0x10 [ 322.514806][ T9004] do_syscall_64+0x106/0xf80 [ 322.514818][ T9004] ? clear_bhb_loop+0x40/0x90 [ 322.514832][ T9004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.514843][ T9004] RIP: 0033:0x7f442259bf79 [ 322.514854][ T9004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.514865][ T9004] RSP: 002b:00007f44207d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 322.514876][ T9004] RAX: ffffffffffffffda RBX: 00007f4422816090 RCX: 00007f442259bf79 [ 322.514883][ T9004] RDX: 0000000000000000 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 322.514890][ T9004] RBP: 00007f44207d5090 R08: 0000000000000000 R09: 0000000000000000 [ 322.514896][ T9004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.514902][ T9004] R13: 00007f4422816128 R14: 00007f4422816090 R15: 00007ffcd629fa58 [ 322.514916][ T9004] [ 323.208991][ T30] audit: type=1400 audit(1771124628.852:469): avc: denied { unmount } for pid=8475 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 323.691533][ T9017] netlink: 244 bytes leftover after parsing attributes in process `syz.4.744'. [ 323.820283][ T30] audit: type=1400 audit(1771124629.462:470): avc: denied { connect } for pid=9019 comm="syz.5.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 324.000095][ T9023] netlink: 8 bytes leftover after parsing attributes in process `syz.1.746'. [ 324.341617][ T5912] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 324.351769][ T9033] netlink: 32 bytes leftover after parsing attributes in process `syz.1.749'. [ 324.530597][ T792] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 324.570616][ T5912] usb 6-1: Using ep0 maxpacket: 32 [ 324.597914][ T5912] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 324.648536][ T5912] usb 6-1: config 0 has no interface number 0 [ 324.661981][ T5912] usb 6-1: config 0 interface 89 has no altsetting 0 [ 324.675390][ T5912] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 324.684779][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.693009][ T5912] usb 6-1: Product: syz [ 324.697223][ T5912] usb 6-1: Manufacturer: syz [ 324.702455][ T5912] usb 6-1: SerialNumber: syz [ 324.710003][ T5912] usb 6-1: config 0 descriptor?? [ 324.719682][ T5912] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 324.729497][ T792] usb 4-1: Using ep0 maxpacket: 32 [ 324.736362][ T5912] em28xx 6-1:0.89: Video interface 89 found: bulk [ 324.746091][ T792] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 324.754470][ T792] usb 4-1: config 0 has no interface number 0 [ 324.761208][ T792] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 324.772638][ T792] usb 4-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 324.784968][ T792] usb 4-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 324.796396][ T792] usb 4-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 324.823556][ T792] usb 4-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 324.852266][ T792] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 324.864423][ T792] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.521534][ T5912] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 325.566448][ T792] usb 4-1: Product: syz [ 325.628118][ T9046] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 325.940572][ T792] usb 4-1: Manufacturer: syz [ 325.945354][ T792] usb 4-1: SerialNumber: syz [ 325.955610][ T792] usb 4-1: config 0 descriptor?? [ 325.961338][ T9032] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 325.975641][ T792] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input45 [ 326.152777][ T9050] gfs2: not a GFS2 filesystem [ 326.170460][ T792] usb 4-1: USB disconnect, device number 22 [ 326.184836][ T5912] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 326.197576][ T9052] netlink: 244 bytes leftover after parsing attributes in process `syz.2.753'. [ 326.216885][ T9052] netlink: 20 bytes leftover after parsing attributes in process `syz.2.753'. [ 326.291467][ T5912] em28xx 6-1:0.89: board has no eeprom [ 326.370656][ T5912] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 326.378317][ T5912] em28xx 6-1:0.89: analog set to bulk mode. [ 326.384911][ T5865] em28xx 6-1:0.89: Registering V4L2 extension [ 326.503959][ T5865] em28xx 6-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 326.523125][ T5912] usb 6-1: USB disconnect, device number 4 [ 327.520550][ T5865] em28xx 6-1:0.89: reading from i2c device at 0x48 failed (error=-19) [ 327.528819][ T5865] em28xx 6-1:0.89: reading from i2c device at 0x42 failed (error=-19) [ 327.538384][ T5912] em28xx 6-1:0.89: Disconnecting em28xx [ 327.840853][ T9070] FAULT_INJECTION: forcing a failure. [ 327.840853][ T9070] name failslab, interval 1, probability 0, space 0, times 0 [ 327.873501][ T9070] CPU: 0 UID: 0 PID: 9070 Comm: syz.3.757 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.873532][ T9070] Tainted: [L]=SOFTLOCKUP [ 327.873538][ T9070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 327.873548][ T9070] Call Trace: [ 327.873554][ T9070] [ 327.873561][ T9070] dump_stack_lvl+0x100/0x190 [ 327.873592][ T9070] should_fail_ex.cold+0x5/0xa [ 327.873614][ T9070] should_failslab+0xc2/0x120 [ 327.873637][ T9070] __kmalloc_cache_noprof+0x7a/0x6f0 [ 327.873656][ T9070] ? snd_pcm_oss_change_params_locked+0x247/0x39f0 [ 327.873689][ T9070] snd_pcm_oss_change_params_locked+0x247/0x39f0 [ 327.873716][ T9070] ? rcu_is_watching+0x12/0xc0 [ 327.873735][ T9070] ? trace_contention_end+0x140/0x180 [ 327.873755][ T9070] ? _kstrtoull+0x13c/0x1f0 [ 327.873776][ T9070] ? snd_pcm_oss_read+0x3b2/0x730 [ 327.873799][ T9070] ? __pfx__kstrtoull+0x10/0x10 [ 327.873819][ T9070] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 327.873856][ T9070] ? __pfx___mutex_lock+0x10/0x10 [ 327.873881][ T9070] ? copy_iovec_from_user+0x102/0x140 [ 327.873899][ T9070] ? iovec_from_user+0xbb/0x140 [ 327.873921][ T9070] snd_pcm_oss_make_ready_locked+0xb7/0x130 [ 327.873948][ T9070] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 327.873972][ T9070] snd_pcm_oss_read+0x3d4/0x730 [ 327.874003][ T9070] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 327.874029][ T9070] vfs_readv+0x5d8/0x8d0 [ 327.874055][ T9070] ? __pfx_vfs_readv+0x10/0x10 [ 327.874077][ T9070] ? find_held_lock+0x2b/0x80 [ 327.874112][ T9070] ? __fget_files+0x21f/0x3d0 [ 327.874143][ T9070] ? do_readv+0x13e/0x340 [ 327.874162][ T9070] do_readv+0x13e/0x340 [ 327.874182][ T9070] ? __pfx_do_readv+0x10/0x10 [ 327.874210][ T9070] do_syscall_64+0x106/0xf80 [ 327.874230][ T9070] ? clear_bhb_loop+0x40/0x90 [ 327.874251][ T9070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.874269][ T9070] RIP: 0033:0x7f796b79bf79 [ 327.874284][ T9070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 327.874300][ T9070] RSP: 002b:00007f796c5aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 327.874314][ T9070] RAX: ffffffffffffffda RBX: 00007f796ba15fa0 RCX: 00007f796b79bf79 [ 327.874323][ T9070] RDX: 0000000000000002 RSI: 00002000000031c0 RDI: 0000000000000003 [ 327.874331][ T9070] RBP: 00007f796c5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 327.874339][ T9070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 327.874347][ T9070] R13: 00007f796ba16038 R14: 00007f796ba15fa0 R15: 00007ffe60c42548 [ 327.874366][ T9070] [ 328.306148][ T5865] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 328.313292][ T5865] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 328.320316][ T5865] em28xx 6-1:0.89: No AC97 audio processor [ 328.355216][ T5865] usb 6-1: Decoder not found [ 328.360292][ T5865] em28xx 6-1:0.89: failed to create media graph [ 328.370129][ T5865] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 328.385875][ T5865] em28xx 6-1:0.89: Registering snapshot button... [ 328.393892][ T5865] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input46 [ 328.454103][ T5865] em28xx 6-1:0.89: Remote control support is not available for this card. [ 328.480653][ T5912] em28xx 6-1:0.89: Closing input extension [ 328.490031][ T5912] em28xx 6-1:0.89: Deregistering snapshot button [ 328.570622][ T5912] em28xx 6-1:0.89: Freeing device [ 328.771661][ T30] audit: type=1400 audit(1771124634.402:471): avc: denied { accept } for pid=9087 comm="syz.5.763" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 329.028508][ T30] audit: type=1400 audit(1771124634.422:472): avc: denied { ioctl } for pid=9090 comm="syz.1.764" path="socket:[22090]" dev="sockfs" ino=22090 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 329.620655][ T9103] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 329.850681][ T6054] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 329.861503][ C1] raw-gadget.0 gadget.2: ignoring, device is not running [ 329.994337][ T6054] usb 3-1: device descriptor read/64, error -32 [ 330.276502][ T6054] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 330.455785][ T9111] gfs2: not a GFS2 filesystem [ 330.480699][ T9113] gfs2: not a GFS2 filesystem [ 330.500634][ T6054] usb 3-1: Using ep0 maxpacket: 32 [ 331.381268][ T30] audit: type=1400 audit(1771124636.592:473): avc: denied { connect } for pid=9112 comm="syz.1.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 331.417419][ T6054] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 331.463421][ T6054] usb 3-1: config 0 has no interface number 0 [ 331.486815][ T6054] usb 3-1: config 0 interface 89 has no altsetting 0 [ 331.507873][ T6054] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 331.528293][ T6054] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.555951][ T6054] usb 3-1: Product: syz [ 331.564626][ T6054] usb 3-1: Manufacturer: syz [ 331.574815][ T6054] usb 3-1: SerialNumber: syz [ 331.634262][ T6054] usb 3-1: config 0 descriptor?? [ 331.644559][ T6054] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 331.661489][ T6054] em28xx 3-1:0.89: Video interface 89 found: bulk [ 331.674795][ T9120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.773'. [ 331.686383][ T9120] netlink: 12 bytes leftover after parsing attributes in process `syz.4.773'. [ 331.707781][ T9120] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 332.374315][ T6054] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 332.417674][ T9128] FAULT_INJECTION: forcing a failure. [ 332.417674][ T9128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 332.436601][ T9128] CPU: 0 UID: 0 PID: 9128 Comm: syz.1.776 Tainted: G L syzkaller #0 PREEMPT(full) [ 332.436624][ T9128] Tainted: [L]=SOFTLOCKUP [ 332.436627][ T9128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 332.436635][ T9128] Call Trace: [ 332.436640][ T9128] [ 332.436645][ T9128] dump_stack_lvl+0x100/0x190 [ 332.436668][ T9128] should_fail_ex.cold+0x5/0xa [ 332.436684][ T9128] _copy_from_user+0x2e/0xd0 [ 332.436698][ T9128] video_usercopy+0xe71/0x1740 [ 332.436712][ T9128] ? __pfx___video_do_ioctl+0x10/0x10 [ 332.436726][ T9128] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 332.436744][ T9128] ? __pfx_video_usercopy+0x10/0x10 [ 332.436766][ T9128] v4l2_ioctl+0x1bd/0x250 [ 332.436780][ T9128] ? __pfx_v4l2_ioctl+0x10/0x10 [ 332.436795][ T9128] __x64_sys_ioctl+0x18e/0x210 [ 332.436811][ T9128] do_syscall_64+0x106/0xf80 [ 332.436824][ T9128] ? clear_bhb_loop+0x40/0x90 [ 332.436838][ T9128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.436850][ T9128] RIP: 0033:0x7fb61f19bf79 [ 332.436859][ T9128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.436870][ T9128] RSP: 002b:00007fb61ff6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.436881][ T9128] RAX: ffffffffffffffda RBX: 00007fb61f415fa0 RCX: 00007fb61f19bf79 [ 332.436887][ T9128] RDX: 0000200000000140 RSI: 0000000040045612 RDI: 0000000000000003 [ 332.436894][ T9128] RBP: 00007fb61ff6e090 R08: 0000000000000000 R09: 0000000000000000 [ 332.436900][ T9128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.436906][ T9128] R13: 00007fb61f416038 R14: 00007fb61f415fa0 R15: 00007ffd642be8a8 [ 332.436919][ T9128] [ 333.557825][ T6054] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 333.566020][ T6054] em28xx 3-1:0.89: board has no eeprom [ 333.713392][ T6054] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 333.721173][ T6054] em28xx 3-1:0.89: analog set to bulk mode. [ 333.727528][ T5913] em28xx 3-1:0.89: Registering V4L2 extension [ 333.741606][ T6054] usb 3-1: USB disconnect, device number 26 [ 333.766342][ T6054] em28xx 3-1:0.89: Disconnecting em28xx [ 333.836889][ T9145] netlink: 32 bytes leftover after parsing attributes in process `syz.2.780'. [ 335.148892][ T5913] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 335.155899][ T5913] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 335.163051][ T5913] em28xx 3-1:0.89: No AC97 audio processor [ 335.180920][ T5913] usb 3-1: Decoder not found [ 335.185544][ T5913] em28xx 3-1:0.89: failed to create media graph [ 335.192874][ T5913] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 335.214286][ T5913] em28xx 3-1:0.89: Registering snapshot button... [ 335.224614][ T5913] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input47 [ 335.301545][ T5913] em28xx 3-1:0.89: Remote control support is not available for this card. [ 335.340532][ T6054] em28xx 3-1:0.89: Closing input extension [ 335.356564][ T6054] em28xx 3-1:0.89: Deregistering snapshot button [ 335.791462][ T6054] em28xx 3-1:0.89: Freeing device [ 336.166357][ T9168] netlink: 32 bytes leftover after parsing attributes in process `syz.5.781'. [ 336.519595][ T5190] block nbd1: Possible stuck request ffff888027a60000: control (read@0,1024B). Runtime 30 seconds [ 336.531000][ T5190] block nbd1: Possible stuck request ffff888027a60200: control (read@1024,1024B). Runtime 30 seconds [ 336.541972][ T5190] block nbd1: Possible stuck request ffff888027a60400: control (read@2048,1024B). Runtime 30 seconds [ 336.553086][ T5190] block nbd1: Possible stuck request ffff888027a60600: control (read@3072,1024B). Runtime 30 seconds [ 336.571389][ T9171] gfs2: not a GFS2 filesystem [ 336.729884][ T9175] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 336.745439][ T9177] netlink: 244 bytes leftover after parsing attributes in process `syz.1.789'. [ 336.759892][ T9177] netlink: 20 bytes leftover after parsing attributes in process `syz.1.789'. [ 336.912848][ T9180] syz_tun: entered allmulticast mode [ 336.988190][ T9178] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 337.057708][ T9179] syz_tun: left allmulticast mode [ 337.191076][ T9178] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 337.290737][ T30] audit: type=1400 audit(1771124642.932:474): avc: denied { ioctl } for pid=9181 comm="syz.5.792" path="socket:[22721]" dev="sockfs" ino=22721 ioctlcmd=0x660f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 337.512799][ T9187] FAULT_INJECTION: forcing a failure. [ 337.512799][ T9187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 337.530497][ T9187] CPU: 1 UID: 0 PID: 9187 Comm: syz.5.793 Tainted: G L syzkaller #0 PREEMPT(full) [ 337.530524][ T9187] Tainted: [L]=SOFTLOCKUP [ 337.530529][ T9187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 337.530538][ T9187] Call Trace: [ 337.530544][ T9187] [ 337.530551][ T9187] dump_stack_lvl+0x100/0x190 [ 337.530593][ T9187] should_fail_ex.cold+0x5/0xa [ 337.530615][ T9187] _copy_to_iter+0x1f3/0x1720 [ 337.530634][ T9187] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 337.530662][ T9187] ? __pfx__copy_to_iter+0x10/0x10 [ 337.530677][ T9187] ? __pfx_tty_read+0x10/0x10 [ 337.530699][ T9187] ? __pfx_woken_wake_function+0x10/0x10 [ 337.530726][ T9187] tty_read+0x242/0x550 [ 337.530749][ T9187] ? __pfx_tty_read+0x10/0x10 [ 337.530766][ T9187] ? tty_poll+0xf1/0x140 [ 337.530785][ T9187] ? avc_policy_seqno+0x9/0x20 [ 337.530806][ T9187] ? bpf_lsm_file_permission+0x9/0x10 [ 337.530827][ T9187] ? security_file_permission+0x76/0x210 [ 337.530852][ T9187] ? rw_verify_area+0xce/0x6d0 [ 337.530873][ T9187] ? __pfx_tty_read+0x10/0x10 [ 337.530890][ T9187] __io_read+0x357/0x14b0 [ 337.530909][ T9187] ? check_noncircular+0x97/0x160 [ 337.530935][ T9187] io_read+0x8d/0x1f0 [ 337.530951][ T9187] ? __pfx_io_read+0x10/0x10 [ 337.530975][ T9187] ? lockdep_unlock+0x5a/0xc0 [ 337.530993][ T9187] ? __lock_acquire+0xd73/0x2630 [ 337.531022][ T9187] __io_issue_sqe+0xe8/0x7a0 [ 337.531040][ T9187] io_issue_sqe+0x85/0x1410 [ 337.531064][ T9187] io_req_task_submit+0x15f/0x290 [ 337.531084][ T9187] ? __pfx_io_req_task_submit+0x10/0x10 [ 337.531109][ T9187] io_poll_task_func+0x9af/0xe30 [ 337.531132][ T9187] ? __pfx_io_poll_task_func+0x10/0x10 [ 337.531154][ T9187] ? find_held_lock+0x2b/0x80 [ 337.531174][ T9187] ? io_handle_tw_list+0xd4/0x580 [ 337.531194][ T9187] ? __pfx_io_poll_task_func+0x10/0x10 [ 337.531216][ T9187] io_handle_tw_list+0x194/0x580 [ 337.531241][ T9187] tctx_task_work_run+0x57/0x340 [ 337.531263][ T9187] tctx_task_work+0x7a/0xd0 [ 337.531284][ T9187] ? __pfx_tctx_task_work+0x10/0x10 [ 337.531307][ T9187] ? _raw_spin_unlock_irq+0x23/0x50 [ 337.531327][ T9187] ? lockdep_hardirqs_on+0x78/0x100 [ 337.531348][ T9187] task_work_run+0x150/0x240 [ 337.531368][ T9187] ? __pfx_task_work_run+0x10/0x10 [ 337.531386][ T9187] ? tty_ldisc_put+0x82/0xc0 [ 337.531411][ T9187] get_signal+0x1bd/0x21e0 [ 337.531432][ T9187] ? tty_set_ldisc+0x38/0x740 [ 337.531457][ T9187] ? tty_ioctl+0x345/0x1690 [ 337.531479][ T9187] ? __pfx_get_signal+0x10/0x10 [ 337.531497][ T9187] ? __pfx_tty_ioctl+0x10/0x10 [ 337.531519][ T9187] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 337.531551][ T9187] arch_do_signal_or_restart+0x91/0x7a0 [ 337.531575][ T9187] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 337.531603][ T9187] ? selinux_file_ioctl+0x139/0x290 [ 337.531627][ T9187] ? selinux_file_ioctl+0xb4/0x290 [ 337.531657][ T9187] exit_to_user_mode_loop+0x86/0x4a0 [ 337.531689][ T9187] do_syscall_64+0x67c/0xf80 [ 337.531710][ T9187] ? clear_bhb_loop+0x40/0x90 [ 337.531731][ T9187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.531749][ T9187] RIP: 0033:0x7f76e399bf79 [ 337.531766][ T9187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.531782][ T9187] RSP: 002b:00007f76e47ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 337.531799][ T9187] RAX: 0000000000000000 RBX: 00007f76e3c15fa0 RCX: 00007f76e399bf79 [ 337.531810][ T9187] RDX: 0000200000000140 RSI: 0000000000005423 RDI: 0000000000000004 [ 337.531819][ T9187] RBP: 00007f76e47ac090 R08: 0000000000000000 R09: 0000000000000000 [ 337.531828][ T9187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.531837][ T9187] R13: 00007f76e3c16038 R14: 00007f76e3c15fa0 R15: 00007ffd28739ea8 [ 337.531860][ T9187] [ 337.915782][ T6020] block nbd0: Possible stuck request ffff8880279c8000: control (read@0,1024B). Runtime 180 seconds [ 337.927645][ T6020] block nbd0: Possible stuck request ffff8880279c8200: control (read@1024,1024B). Runtime 180 seconds [ 337.938606][ T6020] block nbd0: Possible stuck request ffff8880279c8400: control (read@2048,1024B). Runtime 180 seconds [ 337.949574][ T6020] block nbd0: Possible stuck request ffff8880279c8600: control (read@3072,1024B). Runtime 180 seconds [ 338.121711][ T6640] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 338.130375][ T6054] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 338.290767][ T6640] usb 3-1: device descriptor read/64, error -71 [ 338.320535][ T6054] usb 5-1: Using ep0 maxpacket: 32 [ 338.332625][ T6054] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 338.341014][ T6054] usb 5-1: config 0 has no interface number 0 [ 338.347608][ T6054] usb 5-1: config 0 interface 89 has no altsetting 0 [ 338.391087][ T6054] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 338.410272][ T6054] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.444861][ T6054] usb 5-1: Product: syz [ 338.453050][ T6054] usb 5-1: Manufacturer: syz [ 338.457776][ T6054] usb 5-1: SerialNumber: syz [ 338.478801][ T6054] usb 5-1: config 0 descriptor?? [ 338.487659][ T6054] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 338.499831][ T6054] em28xx 5-1:0.89: Video interface 89 found: bulk [ 338.550484][ T6640] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 338.690693][ T6640] usb 3-1: device descriptor read/64, error -71 [ 338.750654][ T5913] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 339.110847][ T6640] usb usb3-port1: attempt power cycle [ 339.160339][ T6054] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 339.180539][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 339.187342][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.197763][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 339.209520][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 339.219496][ T5913] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 339.229781][ T5913] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 339.261210][ T5913] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 339.263186][ T9208] netlink: 4 bytes leftover after parsing attributes in process `syz.5.799'. [ 339.284914][ T9208] netlink: 12 bytes leftover after parsing attributes in process `syz.5.799'. [ 339.308090][ T9208] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 339.329865][ T5913] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 339.341938][ T5913] usb 4-1: Manufacturer: syz [ 339.388998][ T5913] usb 4-1: config 0 descriptor?? [ 339.560944][ T6640] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 339.667774][ T6054] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 339.716574][ T6640] usb 3-1: device descriptor read/8, error -71 [ 339.739687][ T6054] em28xx 5-1:0.89: board has no eeprom [ 339.790493][ T5913] rc_core: IR keymap rc-hauppauge not found [ 339.796482][ T5913] Registered IR keymap rc-empty [ 339.803267][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 339.810471][ T6054] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 339.817747][ T6054] em28xx 5-1:0.89: analog set to bulk mode. [ 339.824037][ T7513] em28xx 5-1:0.89: Registering V4L2 extension [ 339.831753][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 339.848078][ T6054] usb 5-1: USB disconnect, device number 34 [ 339.862759][ T6054] em28xx 5-1:0.89: Disconnecting em28xx [ 339.868619][ T5913] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 339.880590][ T7513] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 339.896074][ T7513] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 339.905137][ T5913] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input48 [ 339.917418][ T7513] em28xx 5-1:0.89: No AC97 audio processor [ 339.925535][ T7513] usb 5-1: Decoder not found [ 339.931289][ T7513] em28xx 5-1:0.89: failed to create media graph [ 339.937975][ T7513] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 339.945100][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 339.957477][ T7513] em28xx 5-1:0.89: Registering snapshot button... [ 339.964813][ T7513] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input49 [ 339.975603][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 339.990519][ T5865] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 340.014784][ T6640] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 340.025414][ T7513] em28xx 5-1:0.89: Remote control support is not available for this card. [ 340.036570][ T6054] em28xx 5-1:0.89: Closing input extension [ 340.042580][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.049956][ T6054] em28xx 5-1:0.89: Deregistering snapshot button [ 340.070549][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.081144][ T6640] usb 3-1: device descriptor read/8, error -71 [ 340.090701][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.113336][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.125997][ T6054] em28xx 5-1:0.89: Freeing device [ 340.150522][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.203529][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.213815][ T6640] usb usb3-port1: unable to enumerate USB device [ 340.240967][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.260642][ T5913] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 340.305766][ T9218] netlink: 32 bytes leftover after parsing attributes in process `syz.5.801'. [ 340.367616][ T5913] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 340.421659][ T5913] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 340.671342][ T5913] usb 4-1: USB disconnect, device number 23 [ 340.699010][ T5865] usb 2-1: Using ep0 maxpacket: 32 [ 341.210567][ T5865] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 341.218930][ T5865] usb 2-1: config 0 has no interface number 0 [ 341.225862][ T5865] usb 2-1: config 0 interface 89 has no altsetting 0 [ 341.234537][ T5865] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 341.270464][ T5865] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.278538][ T5865] usb 2-1: Product: syz [ 341.313456][ T5865] usb 2-1: Manufacturer: syz [ 341.340559][ T5865] usb 2-1: SerialNumber: syz [ 341.362924][ T5865] usb 2-1: config 0 descriptor?? [ 341.373043][ T5865] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 341.383685][ T30] audit: type=1400 audit(1771124647.032:475): avc: denied { mounton } for pid=9224 comm="syz.2.804" path="/proc/618/task" dev="proc" ino=22854 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 341.390578][ T5865] em28xx 2-1:0.89: Video interface 89 found: bulk [ 341.406677][ T9227] FAULT_INJECTION: forcing a failure. [ 341.406677][ T9227] name failslab, interval 1, probability 0, space 0, times 0 [ 341.614936][ T9227] CPU: 0 UID: 0 PID: 9227 Comm: syz.2.804 Tainted: G L syzkaller #0 PREEMPT(full) [ 341.614966][ T9227] Tainted: [L]=SOFTLOCKUP [ 341.614971][ T9227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 341.614980][ T9227] Call Trace: [ 341.614986][ T9227] [ 341.614993][ T9227] dump_stack_lvl+0x100/0x190 [ 341.615017][ T9227] should_fail_ex.cold+0x5/0xa [ 341.615032][ T9227] should_failslab+0xc2/0x120 [ 341.615052][ T9227] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 341.615067][ T9227] ? alloc_empty_file+0x55/0x1c0 [ 341.615078][ T9227] ? __pfx_stack_trace_save+0x10/0x10 [ 341.615094][ T9227] alloc_empty_file+0x55/0x1c0 [ 341.615106][ T9227] path_openat+0xe8/0x31a0 [ 341.615122][ T9227] ? kasan_save_stack+0x3f/0x50 [ 341.615136][ T9227] ? kasan_save_stack+0x30/0x50 [ 341.615149][ T9227] ? kasan_save_track+0x14/0x30 [ 341.615163][ T9227] ? __kasan_slab_alloc+0x89/0x90 [ 341.615177][ T9227] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 341.615190][ T9227] ? do_getname+0x35/0x390 [ 341.615200][ T9227] ? do_sys_openat2+0xc5/0x1e0 [ 341.615212][ T9227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.615225][ T9227] ? __pfx_path_openat+0x10/0x10 [ 341.615247][ T9227] do_file_open+0x20e/0x430 [ 341.615265][ T9227] ? __pfx_do_file_open+0x10/0x10 [ 341.615292][ T9227] ? alloc_fd+0x476/0x790 [ 341.615311][ T9227] ? do_getname+0x191/0x390 [ 341.615324][ T9227] do_sys_openat2+0x10d/0x1e0 [ 341.615335][ T9227] ? __pfx_do_sys_openat2+0x10/0x10 [ 341.615346][ T9227] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 341.615363][ T9227] ? __fget_files+0x21f/0x3d0 [ 341.615382][ T9227] __x64_sys_openat+0x12d/0x210 [ 341.615394][ T9227] ? __pfx___x64_sys_openat+0x10/0x10 [ 341.615405][ T9227] ? ksys_write+0x1ac/0x250 [ 341.615425][ T9227] do_syscall_64+0x106/0xf80 [ 341.615437][ T9227] ? clear_bhb_loop+0x40/0x90 [ 341.615451][ T9227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.615462][ T9227] RIP: 0033:0x7f316399bf79 [ 341.615472][ T9227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.615482][ T9227] RSP: 002b:00007f3164902028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 341.615494][ T9227] RAX: ffffffffffffffda RBX: 00007f3163c15fa0 RCX: 00007f316399bf79 [ 341.615501][ T9227] RDX: 0000000000000000 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 341.615507][ T9227] RBP: 00007f3164902090 R08: 0000000000000000 R09: 0000000000000000 [ 341.615513][ T9227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 341.615520][ T9227] R13: 00007f3163c16038 R14: 00007f3163c15fa0 R15: 00007ffc83984968 [ 341.615533][ T9227] [ 342.233885][ T5865] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 343.406979][ T5865] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 343.426098][ T5865] em28xx 2-1:0.89: board has no eeprom [ 343.500485][ T5865] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 343.509529][ T5865] em28xx 2-1:0.89: analog set to bulk mode. [ 343.515692][ T792] em28xx 2-1:0.89: Registering V4L2 extension [ 343.528050][ T5865] usb 2-1: USB disconnect, device number 36 [ 343.545179][ T5865] em28xx 2-1:0.89: Disconnecting em28xx [ 343.680549][ T7513] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 343.720521][ T792] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 343.727466][ T792] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 343.790496][ T792] em28xx 2-1:0.89: No AC97 audio processor [ 343.809304][ T792] usb 2-1: Decoder not found [ 343.824705][ T792] em28xx 2-1:0.89: failed to create media graph [ 343.840518][ T7513] usb 3-1: Using ep0 maxpacket: 8 [ 343.850626][ T792] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 343.867676][ T7513] usb 3-1: New USB device found, idVendor=046d, idProduct=0896, bcdDevice=3a.11 [ 343.882017][ T792] em28xx 2-1:0.89: Registering snapshot button... [ 343.905104][ T792] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input50 [ 343.940856][ T7513] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.950088][ T792] em28xx 2-1:0.89: Remote control support is not available for this card. [ 343.983282][ T5865] em28xx 2-1:0.89: Closing input extension [ 343.994312][ T7513] usb 3-1: Product: syz [ 343.998509][ T7513] usb 3-1: Manufacturer: syz [ 344.018247][ T7513] usb 3-1: SerialNumber: syz [ 344.075991][ T7513] usb 3-1: config 0 descriptor?? [ 344.118904][ T5865] em28xx 2-1:0.89: Deregistering snapshot button [ 344.173009][ T7513] gspca_main: vc032x-2.14.0 probing 046d:0896 [ 344.606174][ T5865] em28xx 2-1:0.89: Freeing device [ 345.203718][ T9272] netlink: 244 bytes leftover after parsing attributes in process `syz.3.814'. [ 345.269065][ T9272] netlink: 20 bytes leftover after parsing attributes in process `syz.3.814'. [ 345.501094][ T7513] gspca_vc032x: reg_w err -71 [ 345.510827][ T7513] vc032x 3-1:0.0: probe with driver vc032x failed with error -71 [ 345.570081][ T7513] usb 3-1: USB disconnect, device number 31 [ 345.731021][ T9277] binder: Unknown parameter 'stat' [ 346.344809][ T9281] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 346.680548][ T7513] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 347.143420][ T7513] usb 3-1: unable to get BOS descriptor or descriptor too short [ 347.171140][ T7513] usb 3-1: not running at top speed; connect to a high speed hub [ 347.190002][ T7513] usb 3-1: config 128 has an invalid interface number: 210 but max is 1 [ 347.208868][ T7513] usb 3-1: config 128 has an invalid interface number: 25 but max is 1 [ 347.226585][ T7513] usb 3-1: config 128 has an invalid interface number: 2 but max is 1 [ 347.864258][ T7513] usb 3-1: config 128 descriptor has 1 excess byte, ignoring [ 347.874294][ T7513] usb 3-1: config 128 has 3 interfaces, different from the descriptor's value: 2 [ 347.888866][ T7513] usb 3-1: config 128 has no interface number 0 [ 347.897966][ T7513] usb 3-1: config 128 has no interface number 1 [ 347.906608][ T7513] usb 3-1: config 128 interface 25 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 347.923085][ T7513] usb 3-1: too many endpoints for config 128 interface 2 altsetting 3: 130, using maximum allowed: 30 [ 347.942420][ T7513] usb 3-1: config 128 interface 2 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 130 [ 347.957432][ T7513] usb 3-1: config 128 interface 210 has no altsetting 0 [ 348.080650][ T7513] usb 3-1: config 128 interface 25 has no altsetting 0 [ 348.095198][ T7513] usb 3-1: config 128 interface 2 has no altsetting 0 [ 348.170134][ T7513] usb 3-1: New USB device found, idVendor=8516, idProduct=3072, bcdDevice=50.b0 [ 348.236156][ T7513] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.278898][ T7513] usb 3-1: Product: syz [ 348.307618][ T7513] usb 3-1: Manufacturer: syz [ 348.325810][ T7513] usb 3-1: SerialNumber: syz [ 348.800736][ T5912] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 348.851285][ T9312] gfs2: not a GFS2 filesystem [ 349.061123][ T7513] hub 3-1:128.2: Invalid hub with more than one config or interface [ 349.075065][ T7513] hub 3-1:128.2: probe with driver hub failed with error -22 [ 349.106705][ T7513] usb 3-1: USB disconnect, device number 32 [ 349.120465][ T5912] usb 4-1: Using ep0 maxpacket: 32 [ 349.128836][ T5912] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 349.140500][ T5912] usb 4-1: config 0 has no interface number 0 [ 349.146823][ T5912] usb 4-1: config 0 interface 89 has no altsetting 0 [ 349.221365][ T5912] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 349.261079][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.269093][ T5912] usb 4-1: Product: syz [ 349.311186][ T5912] usb 4-1: Manufacturer: syz [ 349.315839][ T5912] usb 4-1: SerialNumber: syz [ 349.331246][ T5912] usb 4-1: config 0 descriptor?? [ 349.347711][ T5912] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 349.393180][ T5912] em28xx 4-1:0.89: Video interface 89 found: bulk [ 350.112328][ T5912] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 350.143728][ T9326] netlink: 244 bytes leftover after parsing attributes in process `syz.4.827'. [ 350.157490][ T9326] netlink: 20 bytes leftover after parsing attributes in process `syz.4.827'. [ 350.285245][ T9328] netlink: 244 bytes leftover after parsing attributes in process `syz.2.828'. [ 350.296955][ T9328] netlink: 20 bytes leftover after parsing attributes in process `syz.2.828'. [ 350.530513][ T9329] binder: Unknown parameter 'stat' [ 350.538301][ T9329] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 351.362326][ T5912] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 351.454333][ T5912] em28xx 4-1:0.89: board has no eeprom [ 351.520620][ T5912] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 351.528733][ T5912] em28xx 4-1:0.89: analog set to bulk mode. [ 351.536113][ T792] em28xx 4-1:0.89: Registering V4L2 extension [ 351.569173][ T5912] usb 4-1: USB disconnect, device number 24 [ 351.642342][ T5912] em28xx 4-1:0.89: Disconnecting em28xx [ 351.677599][ T792] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 351.723901][ T792] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 351.741836][ T792] em28xx 4-1:0.89: No AC97 audio processor [ 351.761702][ T792] usb 4-1: Decoder not found [ 351.830511][ T792] em28xx 4-1:0.89: failed to create media graph [ 351.836777][ T792] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 351.901588][ T792] em28xx 4-1:0.89: Registering snapshot button... [ 351.935688][ T792] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input51 [ 351.947603][ T9336] bond1 (unregistering): Released all slaves [ 351.997873][ T792] em28xx 4-1:0.89: Remote control support is not available for this card. [ 352.020551][ T5912] em28xx 4-1:0.89: Closing input extension [ 352.056482][ T5912] em28xx 4-1:0.89: Deregistering snapshot button [ 352.108473][ T5912] em28xx 4-1:0.89: Freeing device [ 352.237696][ T9347] overlayfs: failed to resolve './file1': -2 [ 352.520501][ T7513] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 352.594394][ T9357] netlink: 32 bytes leftover after parsing attributes in process `syz.4.837'. [ 353.182904][ T7513] usb 3-1: Using ep0 maxpacket: 16 [ 353.330997][ T7513] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 353.342493][ T7513] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.352903][ T7513] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 353.362210][ T7513] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.379965][ T7513] usb 3-1: config 0 descriptor?? [ 354.909510][ T7513] nzxt-smart2 0003:1E71:2009.0014: unknown main item tag 0x0 [ 355.010492][ T7513] nzxt-smart2 0003:1E71:2009.0014: unknown main item tag 0x0 [ 355.018454][ T7513] nzxt-smart2 0003:1E71:2009.0014: unknown main item tag 0x0 [ 355.028149][ T7513] nzxt-smart2 0003:1E71:2009.0014: unknown main item tag 0x0 [ 355.078111][ T7513] nzxt-smart2 0003:1E71:2009.0014: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 355.201319][ C1] usb 3-1: input irq status -75 received [ 356.480593][ T6640] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 356.675810][ T7513] usb 3-1: USB disconnect, device number 33 [ 356.771188][ T9395] gfs2: not a GFS2 filesystem [ 356.800753][ T6640] usb 5-1: Using ep0 maxpacket: 8 [ 356.815437][ T6640] usb 5-1: config 0 has an invalid descriptor of length 37, skipping remainder of the config [ 357.025042][ T6640] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 357.133982][ T6640] usb 5-1: New USB device found, idVendor=16d1, idProduct=10a9, bcdDevice=30.52 [ 357.159068][ T6640] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.179428][ T6640] usb 5-1: Product: syz [ 357.184079][ T6640] usb 5-1: Manufacturer: syz [ 357.189621][ T6640] usb 5-1: SerialNumber: syz [ 357.219559][ T6640] usb 5-1: config 0 descriptor?? [ 357.255849][ T9404] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 357.378760][ T9405] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 357.420621][ T7513] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 357.797106][ T30] audit: type=1400 audit(1771124663.322:476): avc: denied { firmware_load } for pid=9388 comm="syz.4.845" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 357.903995][ T7513] usb 6-1: Using ep0 maxpacket: 8 [ 358.906567][ T9406] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 358.930777][ T7513] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 358.939873][ T7513] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.951816][ T30] audit: type=1400 audit(1771124663.372:477): avc: denied { setopt } for pid=9388 comm="syz.4.845" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 358.979102][ T7513] usb 6-1: Product: syz [ 358.987340][ T7513] usb 6-1: Manufacturer: syz [ 359.002808][ T7513] usb 6-1: SerialNumber: syz [ 359.043307][ T9416] netlink: 24 bytes leftover after parsing attributes in process `syz.3.851'. [ 359.096269][ T7513] usb 6-1: config 0 descriptor?? [ 359.587083][ T7513] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 359.715037][ T9420] netlink: 244 bytes leftover after parsing attributes in process `syz.2.852'. [ 359.732548][ T9420] netlink: 20 bytes leftover after parsing attributes in process `syz.2.852'. [ 359.837355][ T9400] xt_CONNSECMARK: invalid mode: 66 [ 360.025722][ T9410] syz.4.845 (9410) used greatest stack depth: 19672 bytes left [ 360.068387][ T6640] usb 5-1: USB disconnect, device number 35 [ 360.239582][ T30] audit: type=1400 audit(1771124665.862:478): avc: denied { create } for pid=9421 comm="syz.4.853" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 360.435242][ T30] audit: type=1800 audit(1771124666.082:479): pid=9426 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.853" name="file1" dev="overlay" ino=926 res=0 errno=0 [ 360.460499][ T6054] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 361.096987][ T7513] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 361.180474][ T6054] usb 2-1: Using ep0 maxpacket: 32 [ 361.189047][ T6054] usb 2-1: config 0 has an invalid interface number: 244 but max is 0 [ 361.215235][ T6054] usb 2-1: config 0 has no interface number 0 [ 361.241072][ T6054] usb 2-1: config 0 interface 244 has no altsetting 0 [ 361.346893][ T6054] usb 2-1: New USB device found, idVendor=0e41, idProduct=4750, bcdDevice=26.9c [ 361.366981][ T6054] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.400458][ T6054] usb 2-1: Product: syz [ 361.564947][ T6054] usb 2-1: Manufacturer: syz [ 361.639040][ T6054] usb 2-1: SerialNumber: syz [ 361.702464][ T6054] usb 2-1: config 0 descriptor?? [ 361.771832][ T6054] snd_usb_toneport 2-1:0.244: Line 6 GuitarPort found [ 361.888167][ T7513] usb 6-1: USB disconnect, device number 5 [ 361.967262][ T6054] snd_usb_toneport 2-1:0.244: cannot get proper max packet size [ 362.331439][ T6054] snd_usb_toneport 2-1:0.244: Line 6 GuitarPort now disconnected [ 362.354898][ T6054] snd_usb_toneport 2-1:0.244: probe with driver snd_usb_toneport failed with error -22 [ 362.901051][ T9453] netlink: 4 bytes leftover after parsing attributes in process `syz.2.860'. [ 362.917743][ T9453] netlink: 12 bytes leftover after parsing attributes in process `syz.2.860'. [ 362.945737][ T9453] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 363.506472][ T7513] usb 2-1: USB disconnect, device number 37 [ 365.297382][ T9474] binder: Unknown parameter 'stat' [ 365.364766][ T9460] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 366.332959][ T9486] netlink: 32 bytes leftover after parsing attributes in process `syz.5.867'. [ 366.611168][ T5190] block nbd1: Possible stuck request ffff888027a60000: control (read@0,1024B). Runtime 60 seconds [ 366.625069][ T5190] block nbd1: Possible stuck request ffff888027a60200: control (read@1024,1024B). Runtime 60 seconds [ 366.636223][ T5190] block nbd1: Possible stuck request ffff888027a60400: control (read@2048,1024B). Runtime 60 seconds [ 366.647226][ T5190] block nbd1: Possible stuck request ffff888027a60600: control (read@3072,1024B). Runtime 60 seconds [ 367.531080][ T5882] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 367.550517][ T5912] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 367.720758][ T5882] usb 4-1: Using ep0 maxpacket: 32 [ 367.725999][ T5912] usb 6-1: Using ep0 maxpacket: 32 [ 367.753959][ T5912] usb 6-1: config 0 has an invalid interface number: 244 but max is 0 [ 367.763696][ T5912] usb 6-1: config 0 has no interface number 0 [ 367.774037][ T5882] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 367.792314][ T5912] usb 6-1: config 0 interface 244 has no altsetting 0 [ 367.799181][ T5882] usb 4-1: config 0 has no interface number 0 [ 367.810487][ T6054] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 367.810493][ T5882] usb 4-1: config 0 interface 89 has no altsetting 0 [ 367.845863][ T5912] usb 6-1: New USB device found, idVendor=0e41, idProduct=4750, bcdDevice=26.9c [ 367.860643][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.890604][ T5882] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 367.909987][ T5912] usb 6-1: Product: syz [ 367.914205][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.930490][ T5912] usb 6-1: Manufacturer: syz [ 367.935168][ T5912] usb 6-1: SerialNumber: syz [ 367.940495][ T5882] usb 4-1: Product: syz [ 367.944666][ T5882] usb 4-1: Manufacturer: syz [ 367.955861][ T5912] usb 6-1: config 0 descriptor?? [ 367.975531][ T5882] usb 4-1: SerialNumber: syz [ 367.986116][ T5912] snd_usb_toneport 6-1:0.244: Line 6 GuitarPort found [ 368.003203][ T5882] usb 4-1: config 0 descriptor?? [ 368.005967][ T6054] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 368.038748][ T6054] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 368.049570][ T5882] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 368.068399][ T5882] em28xx 4-1:0.89: Video interface 89 found: bulk [ 368.088788][ T6054] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.186225][ T6054] usb 5-1: config 0 descriptor?? [ 368.228686][ T5912] snd_usb_toneport 6-1:0.244: cannot get proper max packet size [ 368.594254][ T6020] block nbd0: Possible stuck request ffff8880279c8000: control (read@0,1024B). Runtime 210 seconds [ 368.605151][ T6020] block nbd0: Possible stuck request ffff8880279c8200: control (read@1024,1024B). Runtime 210 seconds [ 368.627074][ T6020] block nbd0: Possible stuck request ffff8880279c8400: control (read@2048,1024B). Runtime 210 seconds [ 368.638321][ T6020] block nbd0: Possible stuck request ffff8880279c8600: control (read@3072,1024B). Runtime 210 seconds [ 368.677856][ T5912] snd_usb_toneport 6-1:0.244: Line 6 GuitarPort now disconnected [ 368.689158][ T6054] keytouch 0003:0926:3333.0015: fixing up Keytouch IEC report descriptor [ 368.723092][ T6054] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0926:3333.0015/input/input52 [ 368.753827][ T5912] snd_usb_toneport 6-1:0.244: probe with driver snd_usb_toneport failed with error -22 [ 368.810867][ T5912] usb 6-1: USB disconnect, device number 6 [ 368.947105][ T6054] keytouch 0003:0926:3333.0015: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 369.091850][ T5882] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 369.155081][ T5912] usb 5-1: USB disconnect, device number 36 [ 369.256217][ T9512] fido_id[9512]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 369.405175][ T5882] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 369.422878][ T5882] em28xx 4-1:0.89: board has no eeprom [ 369.504556][ T30] audit: type=1400 audit(1771124675.142:480): avc: denied { mount } for pid=9517 comm="syz.1.876" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 369.542118][ T5882] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 369.564066][ T5882] em28xx 4-1:0.89: analog set to bulk mode. [ 369.574174][ T5865] em28xx 4-1:0.89: Registering V4L2 extension [ 369.595541][ T5882] usb 4-1: USB disconnect, device number 25 [ 369.622555][ T5882] em28xx 4-1:0.89: Disconnecting em28xx [ 369.668747][ T5865] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 369.686125][ T5865] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 369.710198][ T5865] em28xx 4-1:0.89: No AC97 audio processor [ 369.727434][ T5865] usb 4-1: Decoder not found [ 369.740496][ T5865] em28xx 4-1:0.89: failed to create media graph [ 369.757010][ T5865] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 369.791411][ T5865] em28xx 4-1:0.89: Registering snapshot button... [ 369.805238][ T5865] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input53 [ 369.853342][ T5865] em28xx 4-1:0.89: Remote control support is not available for this card. [ 369.885275][ T5882] em28xx 4-1:0.89: Closing input extension [ 369.898427][ T5882] em28xx 4-1:0.89: Deregistering snapshot button [ 369.952657][ T5882] em28xx 4-1:0.89: Freeing device [ 371.482131][ T30] audit: type=1400 audit(1771124677.102:481): avc: denied { setopt } for pid=9536 comm="syz.4.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 371.571548][ T30] audit: type=1400 audit(1771124677.222:482): avc: denied { getopt } for pid=9544 comm="syz.1.884" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 371.945841][ T9554] binder: Unknown parameter 'stat' [ 371.969887][ T9555] binder: Unknown parameter 'stat' [ 371.979745][ T9541] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 372.000046][ T9537] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 372.010659][ T6054] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 372.586042][ T9561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.888'. [ 372.750477][ T6054] usb 2-1: Using ep0 maxpacket: 32 [ 372.757294][ T6054] usb 2-1: config 0 has an invalid interface number: 244 but max is 0 [ 372.765899][ T6054] usb 2-1: config 0 has no interface number 0 [ 372.781451][ T6054] usb 2-1: config 0 interface 244 has no altsetting 0 [ 372.922208][ T6054] usb 2-1: New USB device found, idVendor=0e41, idProduct=4750, bcdDevice=26.9c [ 372.941318][ T6054] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.949822][ T6054] usb 2-1: Product: syz [ 372.997594][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.004072][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.043558][ T6054] usb 2-1: Manufacturer: syz [ 373.048187][ T6054] usb 2-1: SerialNumber: syz [ 373.083256][ T6054] usb 2-1: config 0 descriptor?? [ 373.141339][ T9568] netlink: 4 bytes leftover after parsing attributes in process `syz.3.889'. [ 373.159685][ T9568] netlink: 12 bytes leftover after parsing attributes in process `syz.3.889'. [ 373.219960][ T9568] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 373.681182][ T6054] snd_usb_toneport 2-1:0.244: Line 6 GuitarPort found [ 374.694078][ T9570] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 374.809588][ T6054] snd_usb_toneport 2-1:0.244: set_interface failed [ 374.818049][ T6054] snd_usb_toneport 2-1:0.244: Line 6 GuitarPort now disconnected [ 374.827855][ T6054] snd_usb_toneport 2-1:0.244: probe with driver snd_usb_toneport failed with error -71 [ 374.848824][ T6054] usb 2-1: USB disconnect, device number 38 [ 376.060218][ T9592] netlink: 4 bytes leftover after parsing attributes in process `syz.2.897'. [ 376.083070][ T9592] netlink: 12 bytes leftover after parsing attributes in process `syz.2.897'. [ 376.290599][ T6054] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 376.602761][ T9588] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 376.765502][ T6054] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 376.792810][ T6054] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 376.810685][ T6054] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.868964][ T6054] usb 6-1: config 0 descriptor?? [ 376.904456][ T5882] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 377.062865][ T5882] usb 5-1: config 0 has no interfaces? [ 377.074355][ T5882] usb 5-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=7a.ac [ 377.087730][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.096204][ T30] audit: type=1400 audit(1771124682.742:483): avc: denied { bind } for pid=9601 comm="syz.1.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 377.116734][ T5912] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 377.128555][ T5882] usb 5-1: Product: syz [ 377.136832][ T5882] usb 5-1: Manufacturer: syz [ 377.141646][ T30] audit: type=1400 audit(1771124682.782:484): avc: denied { getopt } for pid=9601 comm="syz.1.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 377.170473][ T5882] usb 5-1: SerialNumber: syz [ 377.177517][ T5882] usb 5-1: config 0 descriptor?? [ 377.280488][ T5912] usb 3-1: Using ep0 maxpacket: 32 [ 377.292704][ T5912] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 377.309658][ T5912] usb 3-1: config 0 has no interface number 0 [ 377.328579][ T6054] keytouch 0003:0926:3333.0016: fixing up Keytouch IEC report descriptor [ 377.339212][ T6054] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0016/input/input54 [ 377.939535][ T5912] usb 3-1: config 0 interface 89 has no altsetting 0 [ 377.952433][ T6054] keytouch 0003:0926:3333.0016: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 377.967557][ T5912] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 378.053581][ T6054] usb 6-1: USB disconnect, device number 7 [ 378.127282][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.137828][ T5912] usb 3-1: Product: syz [ 378.146307][ T5912] usb 3-1: Manufacturer: syz [ 378.182145][ T5912] usb 3-1: SerialNumber: syz [ 378.196290][ T9613] fido_id[9613]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 378.233576][ T5912] usb 3-1: config 0 descriptor?? [ 378.245425][ T5912] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 378.257674][ T5912] em28xx 3-1:0.89: Video interface 89 found: bulk [ 378.670650][ T6054] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 378.840465][ T6054] usb 6-1: Using ep0 maxpacket: 32 [ 378.846460][ T5912] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 378.853672][ T6054] usb 6-1: config 0 has an invalid interface number: 244 but max is 0 [ 378.863457][ T6054] usb 6-1: config 0 has no interface number 0 [ 378.869772][ T6054] usb 6-1: config 0 interface 244 has no altsetting 0 [ 378.879366][ T6054] usb 6-1: New USB device found, idVendor=0e41, idProduct=4750, bcdDevice=26.9c [ 378.889656][ T6054] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.898046][ T6054] usb 6-1: Product: syz [ 378.913317][ T6054] usb 6-1: Manufacturer: syz [ 378.918309][ T6054] usb 6-1: SerialNumber: syz [ 378.952215][ T6054] usb 6-1: config 0 descriptor?? [ 378.961036][ T6054] snd_usb_toneport 6-1:0.244: Line 6 GuitarPort found [ 379.161239][ T6054] snd_usb_toneport 6-1:0.244: cannot get proper max packet size [ 379.174189][ T6054] snd_usb_toneport 6-1:0.244: Line 6 GuitarPort now disconnected [ 379.188765][ T6054] snd_usb_toneport 6-1:0.244: probe with driver snd_usb_toneport failed with error -22 [ 379.318864][ T5912] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 379.327610][ T5912] em28xx 3-1:0.89: board has no eeprom [ 379.452175][ T5912] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 379.460166][ T5912] em28xx 3-1:0.89: analog set to bulk mode. [ 379.465334][ T6054] usb 6-1: USB disconnect, device number 8 [ 379.472321][ T5882] em28xx 3-1:0.89: Registering V4L2 extension [ 379.499286][ T5912] usb 3-1: USB disconnect, device number 34 [ 379.524605][ T5912] em28xx 3-1:0.89: Disconnecting em28xx [ 379.537856][ T5882] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 379.550104][ T5882] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 379.562970][ T5882] em28xx 3-1:0.89: No AC97 audio processor [ 379.575301][ T5882] usb 3-1: Decoder not found [ 379.580156][ T5882] em28xx 3-1:0.89: failed to create media graph [ 379.590798][ T5882] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 379.600021][ T5882] em28xx 3-1:0.89: Registering snapshot button... [ 379.614509][ T5882] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input55 [ 379.667243][ T10] usb 5-1: USB disconnect, device number 37 [ 379.679292][ T5882] em28xx 3-1:0.89: Remote control support is not available for this card. [ 379.688229][ T5912] em28xx 3-1:0.89: Closing input extension [ 379.697276][ T5912] em28xx 3-1:0.89: Deregistering snapshot button [ 379.732045][ T5912] em28xx 3-1:0.89: Freeing device [ 380.462819][ T9643] netlink: 244 bytes leftover after parsing attributes in process `syz.3.909'. [ 380.749602][ T30] audit: type=1400 audit(1771124686.392:485): avc: denied { lock } for pid=9647 comm="syz.4.912" path="socket:[24329]" dev="sockfs" ino=24329 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 381.040747][ T9593] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 381.191489][ T7513] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 381.210459][ T9593] usb 6-1: Using ep0 maxpacket: 32 [ 381.226158][ T9593] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 381.234635][ T9593] usb 6-1: config 0 has no interface number 0 [ 381.241775][ T9593] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 381.265925][ T9593] usb 6-1: config 0 interface 85 has no altsetting 0 [ 381.284368][ T9593] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 381.300212][ T9593] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.327325][ T9593] usb 6-1: Product: syz [ 381.342819][ T9593] usb 6-1: Manufacturer: syz [ 381.358116][ T9593] usb 6-1: SerialNumber: syz [ 381.372460][ T7513] usb 2-1: Using ep0 maxpacket: 8 [ 381.395488][ T7513] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 381.406100][ T9593] usb 6-1: config 0 descriptor?? [ 381.502959][ T7513] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 381.517679][ T7513] usb 2-1: config 0 has no interface number 0 [ 381.541535][ T7513] usb 2-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 382.103747][ T7513] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 382.498049][ T7513] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 382.521066][ T7513] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 382.530203][ T7513] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 382.538728][ T7513] usb 2-1: Product: syz [ 382.663080][ T9593] appletouch 6-1:0.85: Geyser mode initialized. [ 382.680050][ T7513] usb 2-1: config 0 descriptor?? [ 382.726616][ T9593] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input56 [ 382.852186][ T9675] netlink: 244 bytes leftover after parsing attributes in process `syz.4.917'. [ 383.015471][ T5912] usb 6-1: USB disconnect, device number 9 [ 383.069220][ T5912] appletouch 6-1:0.85: input: appletouch disconnected [ 383.214002][ T9679] netlink: 244 bytes leftover after parsing attributes in process `syz.3.918'. [ 383.448842][ T7513] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.21/input/input57 [ 383.662151][ T7513] input: failed to attach handler kbd to device input57, error: -5 [ 383.873052][ T9693] netlink: 4 bytes leftover after parsing attributes in process `syz.2.922'. [ 383.891630][ T9693] netlink: 12 bytes leftover after parsing attributes in process `syz.2.922'. [ 383.949270][ T9693] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 384.778785][ T980] usb 2-1: USB disconnect, device number 39 [ 387.400494][ T5882] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 387.540556][ T5882] usb 6-1: device descriptor read/64, error -71 [ 387.713900][ T9752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.935'. [ 387.732023][ T9752] netlink: 12 bytes leftover after parsing attributes in process `syz.1.935'. [ 388.583626][ T9752] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 388.681942][ T5882] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 388.950467][ T5882] usb 6-1: device descriptor read/64, error -71 [ 389.104685][ T5882] usb usb6-port1: attempt power cycle [ 389.193786][ T9764] netlink: 32 bytes leftover after parsing attributes in process `syz.3.937'. [ 389.610670][ T5882] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 389.663524][ T5882] usb 6-1: device descriptor read/8, error -71 [ 390.082752][ T5882] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 390.351384][ T5882] usb 6-1: device descriptor read/8, error -71 [ 390.530953][ T5882] usb usb6-port1: unable to enumerate USB device [ 390.559456][ T9781] gfs2: not a GFS2 filesystem [ 391.430732][ T5882] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 391.620869][ T5882] usb 4-1: Using ep0 maxpacket: 16 [ 391.842470][ T5882] usb 4-1: config index 0 descriptor too short (expected 65, got 36) [ 391.875498][ T5882] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 391.912822][ T5882] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 391.951758][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.989607][ T5882] usb 4-1: config 0 descriptor?? [ 392.036355][ T5882] pxrc 4-1:0.0: Could not find endpoint [ 392.140762][ T30] audit: type=1400 audit(1771124697.792:486): avc: denied { bind } for pid=9793 comm="syz.5.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 392.210452][ T30] audit: type=1400 audit(1771124697.822:487): avc: denied { listen } for pid=9793 comm="syz.5.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 392.230326][ T30] audit: type=1400 audit(1771124697.822:488): avc: denied { map } for pid=9793 comm="syz.5.949" path="socket:[25205]" dev="sockfs" ino=25205 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 392.238509][ T5913] usb 4-1: USB disconnect, device number 26 [ 392.299298][ T9797] IPVS: set_ctl: invalid protocol: 1 224.0.0.1:20004 [ 393.453050][ T9820] netlink: 244 bytes leftover after parsing attributes in process `syz.1.954'. [ 393.994807][ T9825] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.294670][ T9823] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.379123][ T9823] trusted_key: encrypted_key: keylen parameter is missing [ 394.458701][ T9823] bond0: entered promiscuous mode [ 394.473709][ T9823] bond_slave_0: entered promiscuous mode [ 394.501447][ T9823] bond_slave_1: entered promiscuous mode [ 394.593375][ T9832] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 395.317842][ T9839] faux_driver vkms: [drm] Unknown color mode 70; guessing buffer size. [ 396.662943][ T5190] block nbd1: Possible stuck request ffff888027a60000: control (read@0,1024B). Runtime 90 seconds [ 396.674691][ T5190] block nbd1: Possible stuck request ffff888027a60200: control (read@1024,1024B). Runtime 90 seconds [ 396.686837][ T5190] block nbd1: Possible stuck request ffff888027a60400: control (read@2048,1024B). Runtime 90 seconds [ 396.698961][ T5190] block nbd1: Possible stuck request ffff888027a60600: control (read@3072,1024B). Runtime 90 seconds [ 398.075140][ T9879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 398.292786][ T9879] bond0: entered promiscuous mode [ 398.298060][ T9879] bond_slave_0: entered promiscuous mode [ 398.303918][ T9879] bond_slave_1: entered promiscuous mode [ 398.314777][ T9879] mac80211_hwsim hwsim4 wlan1: entered promiscuous mode [ 398.404906][ T9881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 399.179661][ T9884] SELinux: failed to load policy [ 399.360739][ T6020] block nbd0: Possible stuck request ffff8880279c8000: control (read@0,1024B). Runtime 240 seconds [ 399.371839][ T6020] block nbd0: Possible stuck request ffff8880279c8200: control (read@1024,1024B). Runtime 240 seconds [ 399.375172][ T30] audit: type=1400 audit(1771124704.902:489): avc: denied { ioctl } for pid=9883 comm="syz.4.972" path="socket:[25920]" dev="sockfs" ino=25920 ioctlcmd=0x563b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 399.384016][ T6020] block nbd0: Possible stuck request ffff8880279c8400: control (read@2048,1024B). Runtime 240 seconds [ 399.419487][ T6020] block nbd0: Possible stuck request ffff8880279c8600: control (read@3072,1024B). Runtime 240 seconds [ 400.392145][ T9907] netlink: 32 bytes leftover after parsing attributes in process `syz.1.975'. [ 400.700991][ T9914] FAULT_INJECTION: forcing a failure. [ 400.700991][ T9914] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 400.715809][ T9914] CPU: 0 UID: 0 PID: 9914 Comm: syz.5.978 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.715840][ T9914] Tainted: [L]=SOFTLOCKUP [ 400.715846][ T9914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 400.715856][ T9914] Call Trace: [ 400.715862][ T9914] [ 400.715869][ T9914] dump_stack_lvl+0x100/0x190 [ 400.715908][ T9914] should_fail_ex.cold+0x5/0xa [ 400.715931][ T9914] _copy_to_user+0x32/0xd0 [ 400.715953][ T9914] simple_read_from_buffer+0xcb/0x170 [ 400.715980][ T9914] proc_fail_nth_read+0x1af/0x230 [ 400.716008][ T9914] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 400.716039][ T9914] ? rw_verify_area+0xce/0x6d0 [ 400.716059][ T9914] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 400.716087][ T9914] vfs_read+0x1e4/0xb30 [ 400.716114][ T9914] ? __pfx_vfs_read+0x10/0x10 [ 400.716136][ T9914] ? __fget_files+0x215/0x3d0 [ 400.716167][ T9914] ? __fget_files+0x21f/0x3d0 [ 400.716199][ T9914] ksys_read+0x12a/0x250 [ 400.716221][ T9914] ? __pfx_ksys_read+0x10/0x10 [ 400.716252][ T9914] do_syscall_64+0x106/0xf80 [ 400.716273][ T9914] ? clear_bhb_loop+0x40/0x90 [ 400.716295][ T9914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.716313][ T9914] RIP: 0033:0x7f76e395c84e [ 400.716329][ T9914] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 400.716346][ T9914] RSP: 002b:00007f76e47abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 400.716362][ T9914] RAX: ffffffffffffffda RBX: 00007f76e47ac6c0 RCX: 00007f76e395c84e [ 400.716373][ T9914] RDX: 000000000000000f RSI: 00007f76e47ac0a0 RDI: 0000000000000006 [ 400.716383][ T9914] RBP: 00007f76e47ac090 R08: 0000000000000000 R09: 0000000000000000 [ 400.716393][ T9914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 400.716403][ T9914] R13: 00007f76e3c16038 R14: 00007f76e3c15fa0 R15: 00007ffd28739ea8 [ 400.716426][ T9914] [ 401.420277][ T9930] overlayfs: failed to resolve './bus': -2 [ 401.450489][ T5913] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 401.741614][ T5913] usb 6-1: Using ep0 maxpacket: 32 [ 401.800520][ T5913] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 401.810917][ T5913] usb 6-1: config 0 has no interface number 0 [ 401.819051][ T5913] usb 6-1: config 0 interface 89 has no altsetting 0 [ 401.845744][ T5913] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 401.858489][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.877554][ T5913] usb 6-1: Product: syz [ 401.886302][ T5913] usb 6-1: Manufacturer: syz [ 401.903031][ T5913] usb 6-1: SerialNumber: syz [ 401.915522][ T5913] usb 6-1: config 0 descriptor?? [ 401.931102][ T5913] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 401.955651][ T5913] em28xx 6-1:0.89: Video interface 89 found: bulk [ 402.539556][ T5913] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 403.644015][ T5913] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 403.682109][ T5913] em28xx 6-1:0.89: board has no eeprom [ 403.767016][ T5913] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 403.784850][ T5913] em28xx 6-1:0.89: analog set to bulk mode. [ 403.790881][ T7513] em28xx 6-1:0.89: Registering V4L2 extension [ 403.806683][ T5913] usb 6-1: USB disconnect, device number 14 [ 403.817631][ T5913] em28xx 6-1:0.89: Disconnecting em28xx [ 403.877872][ T9966] program syz.2.991 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 404.157071][ T7513] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 404.212041][ T7513] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 404.221052][ T7513] em28xx 6-1:0.89: No AC97 audio processor [ 404.323594][ T7513] usb 6-1: Decoder not found [ 404.345697][ T7513] em28xx 6-1:0.89: failed to create media graph [ 404.378026][ T7513] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 404.445525][ T7513] em28xx 6-1:0.89: Registering snapshot button... [ 404.782593][ T7513] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input58 [ 404.819266][ T7513] em28xx 6-1:0.89: Remote control support is not available for this card. [ 404.836225][ T5913] em28xx 6-1:0.89: Closing input extension [ 404.869320][ T5913] em28xx 6-1:0.89: Deregistering snapshot button [ 404.904432][ T5913] em28xx 6-1:0.89: Freeing device [ 404.929287][ T30] audit: type=1400 audit(1771124710.572:490): avc: denied { read } for pid=9974 comm="syz.5.993" path="socket:[26730]" dev="sockfs" ino=26730 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 405.445579][ T9992] netlink: 16 bytes leftover after parsing attributes in process `syz.3.996'. [ 405.483382][ T5913] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 405.685258][ T5913] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.127060][ T5913] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 406.301674][ T5913] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 406.313491][ T5913] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 406.330492][ T5913] usb 3-1: Manufacturer: syz [ 406.350108][ T5913] usb 3-1: config 0 descriptor?? [ 406.509815][ T5913] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 407.314047][ T30] audit: type=1400 audit(1771124712.712:491): avc: denied { create } for pid=9983 comm="syz.2.995" name="#f" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 407.360650][T10013] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1001'. [ 407.747627][ T30] audit: type=1400 audit(1771124713.382:492): avc: denied { link } for pid=9983 comm="syz.2.995" name="#f" dev="tmpfs" ino=1095 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 407.870563][ T30] audit: type=1400 audit(1771124713.422:493): avc: denied { rename } for pid=9983 comm="syz.2.995" name="#10" dev="tmpfs" ino=1095 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 409.512532][ T5865] usb 3-1: USB disconnect, device number 35 [ 409.572597][T10026] netlink: 244 bytes leftover after parsing attributes in process `syz.1.1002'. [ 409.701586][T10026] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1002'. [ 409.710695][ T30] audit: type=1400 audit(1771124715.342:494): avc: denied { mount } for pid=10025 comm="syz.5.1004" name="/" dev="configfs" ino=1160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 411.272242][ T5806] Bluetooth: hci5: command 0x0405 tx timeout [ 411.373737][ T30] audit: type=1400 audit(1771124716.862:495): avc: denied { create } for pid=10035 comm="syz.3.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 411.400695][ T30] audit: type=1400 audit(1771124717.012:496): avc: denied { ioctl } for pid=10035 comm="syz.3.1006" path="socket:[26809]" dev="sockfs" ino=26809 ioctlcmd=0x61d0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 411.631183][T10035] lec:lec_atm_close: lec0: Shut down! [ 411.799686][T10060] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1012'. [ 411.887527][T10060] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 412.376902][ T30] audit: type=1400 audit(1771124718.022:497): avc: denied { listen } for pid=10066 comm="syz.1.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 412.570566][ T30] audit: type=1400 audit(1771124718.052:498): avc: denied { connect } for pid=10066 comm="syz.1.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 412.892830][ T5865] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 413.010640][T10089] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1014'. [ 413.046154][ T30] audit: type=1400 audit(1771124718.692:499): avc: denied { read write } for pid=10079 comm="syz.5.1014" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 413.379643][ T30] audit: type=1400 audit(1771124718.692:500): avc: denied { open } for pid=10079 comm="syz.5.1014" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 413.412883][ T5865] usb 3-1: device descriptor read/64, error -71 [ 413.430598][ T29] lec:lec_start_xmit: lec0:No lecd attached [ 413.680469][ T5865] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 413.842213][ T5865] usb 3-1: device descriptor read/64, error -71 [ 413.981316][ T5865] usb usb3-port1: attempt power cycle [ 414.120610][ T5912] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 414.281751][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 414.309154][ T5912] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 414.327425][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.352156][ T5912] usb 4-1: config 0 descriptor?? [ 414.400820][ T5865] usb 3-1: new full-speed USB device number 38 using dummy_hcd [ 414.441742][ T5865] usb 3-1: device descriptor read/8, error -71 [ 414.643215][ T30] audit: type=1400 audit(1771124720.292:501): avc: denied { write } for pid=10100 comm="syz.5.1020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 414.669857][T10100] lec:lec_atm_close: lec0: Shut down! [ 414.700674][ T5865] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 414.741965][ T5865] usb 3-1: device descriptor read/8, error -71 [ 414.775724][ T5912] keytouch 0003:0926:3333.0017: fixing up Keytouch IEC report descriptor [ 414.867584][ T5865] usb usb3-port1: unable to enumerate USB device [ 414.991711][ T5912] input: HID 0926:3333 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0926:3333.0017/input/input59 [ 415.116243][ T5912] keytouch 0003:0926:3333.0017: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.3-1/input0 [ 415.227359][ T5912] usb 4-1: USB disconnect, device number 27 [ 415.286360][T10129] fido_id[10129]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 416.525248][T10151] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 416.711016][ T30] audit: type=1400 audit(1771124722.362:502): avc: denied { write } for pid=10159 comm="syz.4.1032" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 416.861743][T10163] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1031'. [ 417.424696][T10171] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1033'. [ 417.518410][T10171] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1033'. [ 417.598009][ T30] audit: type=1400 audit(1771124723.242:503): avc: denied { map } for pid=10170 comm="syz.1.1035" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 417.598677][T10177] delete_channel: no stack [ 417.865155][ T30] audit: type=1400 audit(1771124723.372:504): avc: denied { accept } for pid=10170 comm="syz.1.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 418.007875][ T30] audit: type=1400 audit(1771124723.372:505): avc: denied { ioctl } for pid=10170 comm="syz.1.1035" path="socket:[26978]" dev="sockfs" ino=26978 ioctlcmd=0x9373 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 418.088232][ T30] audit: type=1400 audit(1771124723.552:506): avc: denied { listen } for pid=10180 comm="syz.1.1037" lport=47357 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 418.162069][ T30] audit: type=1400 audit(1771124723.552:507): avc: denied { accept } for pid=10180 comm="syz.1.1037" lport=47357 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 418.231206][ T30] audit: type=1400 audit(1771124723.562:508): avc: denied { write } for pid=10180 comm="syz.1.1037" lport=47357 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 418.300528][T10186] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.440038][ T30] audit: type=1400 audit(1771124723.562:509): avc: denied { setopt } for pid=10180 comm="syz.1.1037" lport=47357 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 418.480836][T10192] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1039'. [ 420.262154][T10210] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1043'. [ 420.280352][T10210] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1043'. [ 420.299010][T10210] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 420.430409][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5770 ms [ 420.438738][ C0] lec:lec_tx_timeout: lec0 [ 420.450524][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 420.842264][T10213] gfs2: not a GFS2 filesystem [ 421.177534][T10215] gfs2: not a GFS2 filesystem [ 421.210509][ T30] audit: type=1400 audit(1771124726.852:510): avc: denied { set_context_mgr } for pid=10217 comm="syz.1.1046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 421.257368][ T30] audit: type=1400 audit(1771124726.882:511): avc: denied { map } for pid=10217 comm="syz.1.1046" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 421.621708][ T31] INFO: task syz.0.579:8264 blocked for more than 143 seconds. [ 421.629852][ T31] Tainted: G L syzkaller #0 [ 421.642004][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 421.697948][ T31] task:syz.0.579 state:D stack:26952 pid:8264 tgid:8263 ppid:5802 task_flags:0x400140 flags:0x00080002 [ 421.820314][ T31] Call Trace: [ 421.859293][ T31] [ 421.898681][ T31] __schedule+0xfee/0x60e0 [ 421.924159][ T31] ? __lock_acquire+0x4a5/0x2630 [ 421.990464][ T31] ? __pfx___schedule+0x10/0x10 [ 421.995344][ T31] ? find_held_lock+0x2b/0x80 [ 422.000028][ T31] ? schedule+0x2bf/0x390 [ 422.290477][ T31] schedule+0xdd/0x390 [ 422.340600][ T31] schedule_preempt_disabled+0x13/0x30 [ 422.346103][ T31] __mutex_lock+0xc9a/0x1b90 [ 422.372356][ T31] ? bdev_open+0xa2/0xe40 [ 422.376735][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 422.430479][ T31] ? bd_prepare_to_claim+0x1e0/0x280 [ 422.435788][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 422.450671][ T31] ? file_init_path+0x48e/0x670 [ 422.455529][ T31] ? bdev_open+0xa2/0xe40 [ 422.459923][ T31] bdev_open+0xa2/0xe40 [ 422.480538][ T31] ? iput+0x3a/0x40 [ 422.484357][ T31] bdev_file_open_by_dev+0x179/0x210 [ 422.489621][ T31] setup_bdev_super+0x385/0x730 [ 422.510515][ T31] get_tree_bdev_flags+0x363/0x620 [ 422.515644][ T31] ? __pfx_affs_fill_super+0x10/0x10 [ 422.547285][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 422.570478][ T31] ? cap_capable+0x107/0x460 [ 422.575086][ T31] ? bpf_lsm_capable+0x9/0x10 [ 422.579742][ T31] ? security_capable+0x80/0x260 [ 422.600462][ T31] vfs_get_tree+0x92/0x320 [ 422.604905][ T31] path_mount+0x7d0/0x23d0 [ 422.609319][ T31] ? __pfx_path_mount+0x10/0x10 [ 422.640431][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 422.645658][ T31] ? putname+0xb1/0x110 [ 422.649801][ T31] ? kmem_cache_free+0x124/0x6a0 [ 422.673628][ T31] ? __x64_sys_mount+0x293/0x310 [ 422.678588][ T31] __x64_sys_mount+0x293/0x310 [ 422.757231][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 422.792364][ T31] do_syscall_64+0x106/0xf80 [ 422.796976][ T31] ? clear_bhb_loop+0x40/0x90 [ 422.805352][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.811524][ T31] RIP: 0033:0x7f1ce899bf79 [ 422.815968][ T31] RSP: 002b:00007f1ce9879028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 422.827529][ T31] RAX: ffffffffffffffda RBX: 00007f1ce8c15fa0 RCX: 00007f1ce899bf79 [ 422.835717][ T31] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 00002000000000c0 [ 422.843862][ T31] RBP: 00007f1ce8a327e0 R08: 0000000000000000 R09: 0000000000000000 [ 422.852065][ T31] R10: 0000000000008008 R11: 0000000000000246 R12: 0000000000000000 [ 422.860056][ T31] R13: 00007f1ce8c16038 R14: 00007f1ce8c15fa0 R15: 00007ffe38a9ec18 [ 422.868450][ T31] [ 422.874345][ T31] INFO: task syz.0.579:8265 blocked for more than 144 seconds. [ 422.882290][ T31] Tainted: G L syzkaller #0 [ 422.888775][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 422.897766][ T31] task:syz.0.579 state:D stack:27464 pid:8265 tgid:8263 ppid:5802 task_flags:0x400140 flags:0x00080002 [ 422.912529][ T31] Call Trace: [ 422.915881][ T31] [ 422.918849][ T31] __schedule+0xfee/0x60e0 [ 422.923673][ T31] ? __lock_acquire+0x4a5/0x2630 [ 422.928765][ T31] ? __pfx___schedule+0x10/0x10 [ 422.934214][ T31] ? find_held_lock+0x2b/0x80 [ 422.938916][ T31] ? schedule+0x2bf/0x390 [ 422.943549][ T31] schedule+0xdd/0x390 [ 422.947640][ T31] super_lock+0x283/0x3f0 [ 422.952245][ T31] ? __pfx_super_lock+0x10/0x10 [ 422.957140][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 422.962890][ T31] ? grab_super+0x9d/0x420 [ 422.967335][ T31] grab_super+0xaa/0x420 [ 422.972158][ T31] ? __pfx_grab_super+0x10/0x10 [ 422.977042][ T31] ? do_raw_spin_lock+0x128/0x260 [ 422.985085][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 422.990669][ T31] ? mntput_no_expire+0xe7/0x220 [ 422.995630][ T31] ? mntput+0x70/0xa0 [ 422.999632][ T31] ? __pfx_super_s_dev_test+0x10/0x10 [ 423.005352][ T31] sget_fc+0x655/0xc70 [ 423.009452][ T31] ? __pfx_super_s_dev_set+0x10/0x10 [ 423.015058][ T31] get_tree_bdev_flags+0x1ba/0x620 [ 423.020190][ T31] ? __pfx_affs_fill_super+0x10/0x10 [ 423.025858][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 423.031821][ T31] ? cap_capable+0x107/0x460 [ 423.036454][ T31] ? bpf_lsm_capable+0x9/0x10 [ 423.041773][ T31] ? security_capable+0x80/0x260 [ 423.046742][ T31] vfs_get_tree+0x92/0x320 [ 423.051476][ T31] path_mount+0x7d0/0x23d0 [ 423.055922][ T31] ? __pfx_path_mount+0x10/0x10 [ 423.061045][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 423.066266][ T31] ? putname+0xb1/0x110 [ 423.070761][ T31] ? kmem_cache_free+0x124/0x6a0 [ 423.075734][ T31] ? __x64_sys_mount+0x293/0x310 [ 423.080911][ T31] __x64_sys_mount+0x293/0x310 [ 423.085692][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 423.093668][ T31] do_syscall_64+0x106/0xf80 [ 423.098303][ T31] ? clear_bhb_loop+0x40/0x90 [ 423.103300][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.109220][ T31] RIP: 0033:0x7f1ce899bf79 [ 423.113956][ T31] RSP: 002b:00007f1ce9858028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 423.122553][ T31] RAX: ffffffffffffffda RBX: 00007f1ce8c16090 RCX: 00007f1ce899bf79 [ 423.131006][ T31] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 00002000000000c0 [ 423.139024][ T31] RBP: 00007f1ce8a327e0 R08: 0000000000000000 R09: 0000000000000000 [ 423.147330][ T31] R10: 0000000000008008 R11: 0000000000000246 R12: 0000000000000000 [ 423.155847][ T31] R13: 00007f1ce8c16128 R14: 00007f1ce8c16090 R15: 00007ffe38a9ec18 [ 423.164144][ T31] [ 423.167242][ T31] [ 423.167242][ T31] Showing all locks held in the system: [ 423.310536][ T31] 3 locks held by kworker/1:1/29: [ 423.351283][ T31] #0: ffff88813fe63548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 423.410460][ T31] #1: ffffc90000a47d08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 423.420159][ T31] #2: ffffffff8e7f50b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 423.480420][ T31] 1 lock held by khungtaskd/31: [ 423.510416][ T31] #0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 423.520339][ T31] 2 locks held by getty/5562: [ 423.572041][ T31] #0: ffff88803700b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 423.603582][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 423.613786][ T31] 1 lock held by udevd/7065: [ 423.618473][ T31] #0: ffff888027932358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 423.627864][ T31] 1 lock held by udevd/7215: [ 423.633164][ T31] #0: ffff888026935358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 423.650985][ T31] 2 locks held by syz.0.579/8264: [ 423.656007][ T31] #0: ffff88803597c0e0 (&type->s_umount_key#81/1){+.+.}-{4:4}, at: alloc_super+0x244/0xd20 [ 423.666197][ T31] #1: ffff888027932358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 423.680549][ T31] 4 locks held by syz.5.1042/10204: [ 423.690590][ T31] #0: ffff88804dfbcec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 423.700494][ T31] #1: ffff88804dfbc0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 423.710443][ T31] #2: ffffffff908a4ca8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 423.721180][ T31] #3: ffff88804de112f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x770 [ 423.730588][ T31] 1 lock held by syz.4.1045/10233: [ 423.735807][ T31] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 423.747407][ T31] 1 lock held by syz.2.1047/10226: [ 423.752551][ T31] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 423.761652][ T31] 1 lock held by syz.1.1048/10223: [ 423.766755][ T31] #0: ffffffff8e7f50b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 423.776811][ T31] 1 lock held by syz.3.1049/10230: [ 423.782055][ T31] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 423.791185][ T31] [ 423.793510][ T31] ============================================= [ 423.793510][ T31] [ 423.802125][ T31] NMI backtrace for cpu 0 [ 423.802147][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 423.802172][ T31] Tainted: [L]=SOFTLOCKUP [ 423.802178][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 423.802188][ T31] Call Trace: [ 423.802193][ T31] [ 423.802200][ T31] dump_stack_lvl+0x100/0x190 [ 423.802231][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 423.802247][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 423.802272][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 423.802296][ T31] sys_info+0x141/0x190 [ 423.802315][ T31] watchdog+0xd25/0x1050 [ 423.802337][ T31] ? __pfx_watchdog+0x10/0x10 [ 423.802354][ T31] ? __kthread_parkme+0x18c/0x230 [ 423.802375][ T31] ? kthread+0x13a/0x450 [ 423.802385][ T31] ? __pfx_watchdog+0x10/0x10 [ 423.802401][ T31] kthread+0x370/0x450 [ 423.802412][ T31] ? __pfx_kthread+0x10/0x10 [ 423.802434][ T31] ret_from_fork+0x754/0xd80 [ 423.802449][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 423.802463][ T31] ? __switch_to+0x7b4/0x1120 [ 423.802481][ T31] ? __pfx_kthread+0x10/0x10 [ 423.802505][ T31] ret_from_fork_asm+0x1a/0x30 [ 423.802531][ T31] [ 423.802537][ T31] Sending NMI from CPU 0 to CPUs 1: [ 423.929219][ C1] NMI backtrace for cpu 1 [ 423.929239][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 423.929258][ C1] Tainted: [L]=SOFTLOCKUP [ 423.929263][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 423.929271][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 423.929294][ C1] Code: a8 83 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 3c 1d 00 fb f4 bc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 423.929306][ C1] RSP: 0018:ffffc90000197df0 EFLAGS: 00000246 [ 423.929318][ C1] RAX: 0000000001e8c665 RBX: ffff88801e6b2480 RCX: ffffffff8b8e4c75 [ 423.929326][ C1] RDX: 0000000000000000 RSI: ffffffff8de6ce9d RDI: ffffffff8c1adfa0 [ 423.929334][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed10170a6795 [ 423.929342][ C1] R10: ffff8880b8533cab R11: 0000000000000000 R12: ffffed1003cd6490 [ 423.929350][ C1] R13: 0000000000000001 R14: ffffffff90d92f10 R15: 0000000000000000 [ 423.929358][ C1] FS: 0000000000000000(0000) GS:ffff888124452000(0000) knlGS:0000000000000000 [ 423.929373][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 423.929381][ C1] CR2: 0000200000032000 CR3: 000000000e598000 CR4: 00000000003526f0 [ 423.929390][ C1] Call Trace: [ 423.929397][ C1] [ 423.929402][ C1] default_idle+0x9/0x10 [ 423.929429][ C1] default_idle_call+0x6c/0xb0 [ 423.929445][ C1] do_idle+0x35b/0x4b0 [ 423.929464][ C1] ? __pfx_do_idle+0x10/0x10 [ 423.929481][ C1] cpu_startup_entry+0x4f/0x60 [ 423.929496][ C1] start_secondary+0x21d/0x2d0 [ 423.929516][ C1] ? __pfx_start_secondary+0x10/0x10 [ 423.929536][ C1] common_startup_64+0x13e/0x148 [ 423.929557][ C1] [ 424.105180][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 424.112039][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 424.122702][ T31] Tainted: [L]=SOFTLOCKUP [ 424.127002][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 424.137035][ T31] Call Trace: [ 424.140296][ T31] [ 424.143207][ T31] dump_stack_lvl+0x100/0x190 [ 424.147877][ T31] vpanic+0x552/0x970 [ 424.151842][ T31] ? __pfx_vpanic+0x10/0x10 [ 424.156328][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 424.162478][ T31] panic+0xd1/0xe0 [ 424.166180][ T31] ? __pfx_panic+0x10/0x10 [ 424.170580][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 424.176729][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 424.182871][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 424.189012][ T31] ? watchdog.cold+0x198/0x1ca [ 424.193757][ T31] ? watchdog+0xd35/0x1050 [ 424.198157][ T31] watchdog.cold+0x1a9/0x1ca [ 424.202735][ T31] ? __pfx_watchdog+0x10/0x10 [ 424.207396][ T31] ? __kthread_parkme+0x18c/0x230 [ 424.212408][ T31] ? kthread+0x13a/0x450 [ 424.216630][ T31] ? __pfx_watchdog+0x10/0x10 [ 424.221289][ T31] kthread+0x370/0x450 [ 424.225338][ T31] ? __pfx_kthread+0x10/0x10 [ 424.229919][ T31] ret_from_fork+0x754/0xd80 [ 424.234490][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 424.239582][ T31] ? __switch_to+0x7b4/0x1120 [ 424.244244][ T31] ? __pfx_kthread+0x10/0x10 [ 424.248823][ T31] ret_from_fork_asm+0x1a/0x30 [ 424.253578][ T31] [ 424.256847][ T31] Kernel Offset: disabled [ 424.261234][ T31] Rebooting in 86400 seconds..