last executing test programs: 5.079687745s ago: executing program 2 (id=526): prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$FUSE(r1, &(0x7f0000000340)={0x2020}, 0xfffffec1) read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0xfffffce2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x69c000) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, 0x0, 0x0) 4.07512912s ago: executing program 2 (id=529): r0 = syz_usb_connect(0x0, 0x371, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000140)={0xc, &(0x7f0000000000)={0x40, 0x5b7f6b5abf75483e, 0x2, {0x2, 0x8}}, &(0x7f00000000c0)={0x0, 0x3, 0x4d, @string={0x4d, 0x3, "8729e825ee81d27deedf710e006d1f6ce52ae8834f9ebc9c15e9c0a8559648b15f4c9fb144c9f966f24e41a05289eb09b3819d0b7b91ded577cc854f713f03c6e230814b81a13be5f40d85"}}}, &(0x7f0000000480)={0x1c, &(0x7f00000002c0)={0x20, 0x8, 0x4c, "fe4b29915647dd16a25545e0016d3f54544fb569fba224cd47b46f3a40f01c7893817524a980361345b7a30b65bf4a65ed6728be68263fa111c41309aea44d7ba4bf26a3674dd1ddc824864a"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0xb2}, &(0x7f0000000380)={0x0, 0x8, 0x1}, &(0x7f00000003c0)={0xc0, 0xa1, 0x4, 0x3}, 0x0, &(0x7f0000000440)={0xc0, 0xa2, 0x2f, "f124995335bbb1fd876bfe6a10d3ea427aa810f9547be75b483aa41d0653455bcb02fe2b6569f550ac41142055f537"}}) syz_usb_control_io$uac3(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r1, &(0x7f0000000200)="10", 0x20) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0xfe, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.697867354s ago: executing program 1 (id=535): prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) mknod$loop(&(0x7f0000000580)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000640), 0x80, &(0x7f0000000680)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4a040, 0x0) 1.857609964s ago: executing program 1 (id=538): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001b80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001bc0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000001c80)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="1f003300d0000000080211000001080211000000505050505050000015"], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x14) 1.825986325s ago: executing program 1 (id=539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x4c}}, 0x80e0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.788481096s ago: executing program 1 (id=541): r0 = memfd_create(&(0x7f0000000300)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) unshare(0x40600) fcntl$addseals(r0, 0x409, 0xa) 1.788163796s ago: executing program 1 (id=543): r0 = add_key(&(0x7f0000000500)='keyring\x00', &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000000580)='asymmetric\x00', 0x0, &(0x7f00000005c0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000b40)={r1}, &(0x7f0000000000)=ANY=[@ANYBLOB='enc=pkcs1 hash=sha3--'], 0x0, 0x0) 1.788076526s ago: executing program 1 (id=544): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000840)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x1, 0xc, "75cce0159c1eef016ebd354b"}, 0x0}) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010bd28710000000000000109022400010000000009040100010300000009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000440)={0x24, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x2}]}}, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$cdc_ecm(0x1, 0x67, 0x0, 0x0) 905.681978ms ago: executing program 2 (id=550): r0 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000180)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r3, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000b40)={[0x9, 0x400000000007, 0xfffffffffffffffd, 0x6, 0x3, 0xfffffffffffffffd, 0x4002004c3, 0xffe, 0x0, 0x2a, 0x14, 0xffff, 0x4, 0x0, 0x8, 0x7], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 852.926559ms ago: executing program 0 (id=551): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) set_robust_list(&(0x7f0000000040)={0x0, 0x59}, 0xc) 844.33382ms ago: executing program 0 (id=552): r0 = gettid() r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000340)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r1, &(0x7f0000000480)={0xa, 0x4e23, 0x8020000c, @loopback={0xfff5}, 0xffffffff}, 0x1c) timer_create(0x0, &(0x7f00000004c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000500)) timer_settime(0x0, 0x0, &(0x7f0000000540)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) 773.715151ms ago: executing program 2 (id=553): openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x100) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000240), 0x2ae, 0x0) 773.599461ms ago: executing program 2 (id=554): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'vlan0\x00', &(0x7f0000000580)=@ethtool_perm_addr={0x4b, 0x14, "26270000002000000000e253c04105ff12a4b6d6"}}) 773.462261ms ago: executing program 2 (id=555): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)=""/70, 0x46}, {&(0x7f0000000540)=""/4084, 0xff4}, {&(0x7f0000001600)=""/158, 0x9e}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) 773.355741ms ago: executing program 0 (id=556): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) connect$inet(r0, &(0x7f00000004c0)={0x2, 0x4e21, @local}, 0x10) 763.479902ms ago: executing program 0 (id=557): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x28, r0, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x5}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004085}, 0x0) 754.474602ms ago: executing program 0 (id=558): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000f00)=@updpolicy={0x1b8, 0x19, 0x1, 0x0, 0x10, {{@in6=@dev={0xfe, 0x80, '\x00', 0x3e}, @in=@loopback, 0x4e22, 0xd3a, 0xffff, 0x0, 0xa, 0x80, 0x80, 0x3c, 0x0, 0xffffffffffffffff}, {}, {0x2, 0x9, 0x80}, 0x0, 0x0, 0x1}, [@tmpl={0x104, 0x5, [{{@in=@multicast2, 0x0, 0x3c}, 0x0, @in=@remote, 0x34ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6e}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x15}, 0x0, 0x3c}, 0x0, @in6=@loopback, 0xfffffffd, 0x4, 0x3, 0x0, 0x7, 0x800, 0x2}, {{@in6=@loopback, 0x0, 0x32}, 0x0, @in6=@empty, 0x34ff, 0x1, 0x3, 0x0, 0x8, 0xfffffffd}, {{@in=@multicast1, 0x4d4, 0x3c}, 0x0, @in=@local, 0x4, 0x4, 0x1, 0x7, 0x0, 0x0, 0x1}]}]}, 0x1b8}}, 0x80c4) 693.731873ms ago: executing program 0 (id=559): prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) mknod$loop(&(0x7f0000000580)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000640), 0x80, &(0x7f0000000680)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4a040, 0x0) 196.848705ms ago: executing program 3 (id=560): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2c, 0xb, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20010000}, 0x0) 189.615086ms ago: executing program 3 (id=561): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f00000007c0)={0x1, &(0x7f0000000800)=[{0x6, 0x3, 0x7, 0x7ffc0001}]}) sync_file_range(0xffffffffffffffff, 0x9, 0x0, 0x2) 113.555318ms ago: executing program 3 (id=562): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000007c00)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0xfffffffd, 0x32}, 0x2, @in=@loopback, 0x0, 0x1}}, 0xe8) write(r0, &(0x7f0000007d00)="0123456789abcdef0123456789abcdef01234567", 0x14) 113.377778ms ago: executing program 3 (id=563): pipe(&(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x6000000d}) poll(&(0x7f0000000100)=[{r1, 0x5f4b8f9e57b39c22}], 0x1, 0x80) 7.15164ms ago: executing program 3 (id=564): r0 = fsopen(&(0x7f00000000c0)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source', &(0x7f0000000140)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b, priority 10 [ 48.736961][ T31] usb 1-1: USB disconnect, device number 11 [ 48.762793][ T1480] ./dev/sda1: Can't lookup blockdev [ 48.784112][ T1484] fuse: Bad value for 'fd' [ 48.930181][ T45] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 49.080168][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 49.086506][ T45] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 49.097590][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 49.105527][ T45] usb 2-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 49.114608][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.122654][ T45] usb 2-1: Product: syz [ 49.126815][ T45] usb 2-1: Manufacturer: syz [ 49.131422][ T45] usb 2-1: SerialNumber: syz [ 49.136571][ T45] usb 2-1: config 0 descriptor?? [ 49.695617][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 49.695635][ T36] audit: type=1400 audit(1792370168.810:206): avc: denied { ioctl } for pid=1490 comm="syz.2.526" path="socket:[10289]" dev="sockfs" ino=10289 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 49.810162][ T10] tipc: Node number set to 4269801488 [ 49.880158][ T920] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 50.040130][ T920] usb 1-1: Using ep0 maxpacket: 16 [ 50.046343][ T920] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 50.056496][ T920] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 50.065480][ T920] usb 1-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 50.074551][ T920] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.083040][ T920] usb 1-1: config 0 descriptor?? [ 50.474087][ T31] usb 4-1: USB disconnect, device number 11 [ 50.730873][ T920] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 50.880138][ T920] usb 3-1: Using ep0 maxpacket: 32 [ 50.886460][ T920] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 50.896794][ T920] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 50.908465][ T920] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 50.919520][ T920] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 50.933836][ T920] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 50.942917][ T920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.950918][ T920] usb 3-1: Product: syz [ 50.955058][ T920] usb 3-1: Manufacturer: syz [ 50.959635][ T920] usb 3-1: SerialNumber: syz [ 51.651680][ T31] usb 2-1: USB disconnect, device number 6 [ 51.734805][ T36] audit: type=1400 audit(1792370170.850:207): avc: denied { map } for pid=1513 comm="syz.1.532" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 52.641780][ T9] usb 1-1: USB disconnect, device number 12 [ 52.708532][ T36] audit: type=1400 audit(1792370171.820:208): avc: denied { ioctl } for pid=1531 comm="syz.1.538" path="socket:[10071]" dev="sockfs" ino=10071 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 52.758560][ T1540] UDC core: g1: couldn't find an available UDC or it's busy [ 53.030151][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 53.160554][ T36] audit: type=1400 audit(1792370172.280:209): avc: denied { sqpoll } for pid=1552 comm="syz.3.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 53.180122][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 53.186456][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 53.194523][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 53.204623][ T10] usb 2-1: config 0 has no interface number 0 [ 53.210728][ T10] usb 2-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 53.223615][ T10] usb 2-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 53.232732][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.241387][ T10] usb 2-1: config 0 descriptor?? [ 53.247133][ T10] usbhid 2-1:0.1: couldn't find an input interrupt endpoint [ 53.410140][ T311] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 53.560128][ T311] usb 4-1: Using ep0 maxpacket: 32 [ 53.566360][ T311] usb 4-1: config 250 has an invalid interface number: 64 but max is 0 [ 53.574985][ T311] usb 4-1: config 250 has no interface number 0 [ 53.581414][ T311] usb 4-1: config 250 interface 64 altsetting 3 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 53.582560][ T10] usb 3-1: USB disconnect, device number 5 [ 53.592640][ T311] usb 4-1: config 250 interface 64 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 53.613689][ T311] usb 4-1: config 250 interface 64 has no altsetting 0 [ 53.623458][ T311] usb 4-1: New USB device found, idVendor=16d6, idProduct=0001, bcdDevice= 1.7f [ 53.632677][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.640818][ T311] usb 4-1: Product: syz [ 53.644977][ T311] usb 4-1: Manufacturer: syz [ 53.649576][ T311] usb 4-1: SerialNumber: syz [ 53.656026][ T36] audit: type=1400 audit(1792370172.770:210): avc: denied { map } for pid=1557 comm="syz.2.550" path="socket:[10186]" dev="sockfs" ino=10186 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 53.679907][ T36] audit: type=1400 audit(1792370172.770:211): avc: denied { read } for pid=1557 comm="syz.2.550" path="socket:[10186]" dev="sockfs" ino=10186 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 53.810605][ T1577] netlink: 256 bytes leftover after parsing attributes in process `syz.0.558'. [ 53.859659][ T311] usb 4-1: USB disconnect, device number 12 [ 54.374609][ T36] audit: type=1326 audit(1792370173.490:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1583 comm="syz.3.561" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f303399e559 code=0x7ffc0000 [ 54.399890][ T36] audit: type=1326 audit(1792370173.490:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1583 comm="syz.3.561" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f303399e559 code=0x7ffc0000 [ 54.425126][ T36] audit: type=1326 audit(1792370173.490:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1583 comm="syz.3.561" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f303399e559 code=0x7ffc0000 [ 54.450403][ T36] audit: type=1326 audit(1792370173.490:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1583 comm="syz.3.561" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f303399e559 code=0x7ffc0000 [ 54.566559][ T1593] ------------[ cut here ]------------ [ 54.572404][ T1593] WARNING: CPU: 1 PID: 1593 at crypto/rsa-pkcs1pad.c:560 pkcs1pad_verify+0x4e4/0x700 [ 54.581933][ T1593] Modules linked in: [ 54.585865][ T1593] CPU: 1 UID: 0 PID: 1593 Comm: syz.3.565 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 54.597376][ T1593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 54.607503][ T1593] RIP: 0010:pkcs1pad_verify+0x4e4/0x700 [ 54.613132][ T1593] Code: 11 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 3a 7c 05 ff 0f 0b b8 ea ff ff ff eb de e8 2c 7c 05 ff <0f> 0b b8 ea ff ff ff eb d0 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 5d [ 54.632801][ T1593] RSP: 0018:ffffc900104cf728 EFLAGS: 00010287 [ 54.638892][ T1593] RAX: ffffffff8283d094 RBX: ffff8881154ff200 RCX: 0000000000080000 [ 54.646896][ T1593] RDX: ffffc90001e63000 RSI: 00000000000007e6 RDI: 00000000000007e7 [ 54.654908][ T1593] RBP: ffffc900104cf770 R08: ffffc900104cf82f R09: 0000000000000000 [ 54.662930][ T1593] R10: 0000000000000000 R11: ffffffff8283cbb0 R12: ffff888115ac1308 [ 54.670955][ T1593] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8881154ff238 [ 54.679112][ T1593] FS: 00007f30348fd6c0(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 54.688090][ T1593] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.694717][ T1593] CR2: 00007f30348fcff8 CR3: 000000013132e000 CR4: 00000000003526b0 [ 54.702733][ T1593] Call Trace: [ 54.706015][ T1593] [ 54.708943][ T1593] ? __asan_memcpy+0x5a/0x80 [ 54.713574][ T1593] crypto_sig_verify+0x1d0/0x260 [ 54.718533][ T1593] ? __cfi_crypto_sig_verify+0x10/0x10 [ 54.724023][ T1593] ? crypto_sig_set_pubkey+0x9d/0xb0 [ 54.729325][ T1593] public_key_verify_signature+0x654/0xa40 [ 54.735194][ T1593] ? __cfi_public_key_verify_signature+0x10/0x10 [ 54.742075][ T1593] ? keyctl_pkey_params_get+0x3b8/0x4c0 [ 54.747637][ T1593] ? __cfi_public_key_verify_signature_2+0x10/0x10 [ 54.754203][ T1593] public_key_verify_signature_2+0x47/0x60 [ 54.760032][ T1593] verify_signature+0xf3/0x120 [ 54.764830][ T1593] asymmetric_key_verify_signature+0x160/0x200 [ 54.771061][ T1593] ? __cfi_asymmetric_key_verify_signature+0x10/0x10 [ 54.777760][ T1593] ? should_fail+0xf/0x20 [ 54.782114][ T1593] ? __kasan_check_write+0x18/0x20 [ 54.787248][ T1593] ? _copy_from_user+0x87/0xa0 [ 54.792048][ T1593] ? memdup_user+0xb1/0x170 [ 54.796561][ T1593] keyctl_pkey_verify+0x203/0x290 [ 54.801611][ T1593] ? __cfi_keyctl_pkey_verify+0x10/0x10 [ 54.807605][ T1593] ? __kasan_check_write+0x18/0x20 [ 54.812745][ T1593] ? _raw_spin_lock+0x92/0x120 [ 54.817516][ T1593] ? __cfi__raw_spin_lock+0x10/0x10 [ 54.822751][ T1593] __se_sys_keyctl+0x743/0xe40 [ 54.827525][ T1593] ? __x64_sys_keyctl+0xf0/0xf0 [ 54.832402][ T1593] ? __cfi_do_futex+0x10/0x10 [ 54.837177][ T1593] ? kvfree_sensitive+0x51/0x70 [ 54.842078][ T1593] ? __se_sys_futex+0x13c/0x320 [ 54.846939][ T1593] ? __x64_sys_futex+0x110/0x110 [ 54.851938][ T1593] ? __kasan_check_write+0x18/0x20 [ 54.857117][ T1593] ? fpregs_restore_userregs+0x11c/0x260 [ 54.862793][ T1593] __x64_sys_keyctl+0xc3/0xf0 [ 54.867475][ T1593] x64_sys_call+0x996/0x2ee0 [ 54.872094][ T1593] do_syscall_64+0x57/0xf0 [ 54.876507][ T1593] ? clear_bhb_loop+0x50/0xa0 [ 54.881209][ T1593] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 54.887119][ T1593] RIP: 0033:0x7f303399e559 [ 54.891685][ T1593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.911329][ T1593] RSP: 002b:00007f30348fd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 54.919744][ T1593] RAX: ffffffffffffffda RBX: 00007f3033c25fa0 RCX: 00007f303399e559 [ 54.927740][ T1593] RDX: 0000200000000b80 RSI: 0000200000000b40 RDI: 000000000000001c [ 54.936019][ T1593] RBP: 00007f3033a35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 54.944035][ T1593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.952054][ T1593] R13: 00007f3033c26038 R14: 00007f3033c25fa0 R15: 00007ffd640ec8d8 [ 54.960108][ T1593] [ 54.963140][ T1593] ---[ end trace 0000000000000000 ]--- [ 55.787515][ T45] usb 2-1: USB disconnect, device number 7